[ianw-oai]

Summary

Allow codex-security scans resume SCAN_ID to continue an interrupted Standard scan in its original Codex session.

Changes

• Reuse the existing resume command, saved recipe, scan ID, output directory, and checkpoints.
• Leave a Standard scan resumable after a transport failure and print its recovery command. Keep cancellation, access failures, and other terminal errors terminal.
• Preserve accumulated usage, the saved cost limit, and the original advisory time allowance.
• Use an exclusive SQLite lock to prevent two CLI or SDK calls from running the same Standard scan. The operating system releases the lock when its owner exits.
• Extend the existing Windows directory identity handling to Standard scans.
• Update CLI help and recovery documentation. The published CLI recovery guide should also describe Standard resume.

Testing

• Focused recovery, execution lock, event, time-budget, and history tests before integration: 129 passed, 2 platform skips.
• Standard recovery, execution lock, and event tests after integration with fix(sdk): keep scans running while Codex waits for the network #2411: 45 passed.
• TypeScript checks, formatting, SDK build, and package validation passed.
• Ruff and portable plugin source checks passed.
• Full seeded SDK suite is running. Cross-platform CI is pending.

Risk and rollout

This extends an existing command; it adds no flags, dependencies, or database migrations. The original checkout, state directory, saved session, and output must remain available. Unsaved work may need to repeat. Scans already marked failed by an older version require a rerun. Custom-validation scans remain outside the resume path.

The live reconnect fix in #2411 and resume after process exit cover separate recovery cases. This branch includes the merged fix and preserves its waiting behavior.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-11-11T19:25:34.742419Z	bd127c4	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.