release: bump Codex Security to 0.1.18 - #615

Summary

Release Codex Security 0.1.18 with per-scan safety identifiers for API-key integrations and more reliable Deep Scan terminal recovery.

Changes

• Bump @openai/codex-security from 0.1.17 to 0.1.18.
• Add a reviewed, version-matched release summary for the automated GitHub release.
• Add optional CLI and SDK safety identifiers that remain scoped to each scan and propagate to nested work.
• Preserve accepted findings and partial artifacts when Deep Scan fails, is canceled, or is interrupted, while keeping incomplete coverage and terminal status explicit.

The user-facing release changes are #609 and #617. #616 adds the reviewed-release-note safeguards required before this version bump.

Testing

• corepack pnpm install --frozen-lockfile
• corepack pnpm run types
• corepack pnpm run format
• corepack pnpm pack --pack-destination /private/tmp/codex-security-0.1.18-package
• npm_config_cache=/private/tmp/codex-security-0.1.18-npm-cache corepack pnpm run check:package /private/tmp/codex-security-0.1.18-package/openai-codex-security-0.1.18.tgz — passed with 265 entries; verified the public import, NodeNext types, CLI, 113 bundled plugin files, bundled Codex version, and a nested worker without a global Codex install

Required CI covers the full test matrix on the updated release commit.

Risk and rollout

Safety identifiers require API-key authentication and a Codex runtime with native safety identifier support. The bundled runtime does not yet support the option; integrations must select a compatible build with CODEX_CLI_PATH. Omitting the option leaves existing scans unchanged.

Deep Scan recovery changes persisted workbench state and terminal result publication. Its migrations are append-only, and recovered terminal scans remain explicitly failed, canceled, or interrupted with incomplete coverage.

The fail-closed release checks from #616 require the reviewed 0.1.18 summary included in this pull request. Merging this pull request starts the automated tag, npm publication, and GitHub release workflows for 0.1.18.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.