feat(scripts): add local Codex security review runner

[illegalprime]

Summary

Adds scripts/codex-security-review-local.sh, which runs the same Codex Security Review that CI runs on PRs, but locally against the merge-base diff (including uncommitted tracked changes) so findings surface before pushing.

How it works

• Reads CODEX_MODEL, CODEX_REASONING_EFFORT, and the run_codex step's prompt block directly from .github/workflows/codex-security-review.yml with yq, so the local run can't drift from CI — the workflow stays the single source of truth.
• Fills in the ${{ env.* }} prompt refs with local equivalents, with honest provenance for dirty trees (no fake HEAD pin or blob links when the diff includes uncommitted changes).
• Runs codex exec --sandbox read-only, then applies the same output validation as CI (overall_risk enum, non-empty review_markdown) via yq -p=json and prints the review to the terminal.
• Refuses to run a codex binary that resolves inside the checkout, so a reviewed branch can't substitute the agent binary.

Tooling

• yq 4.53.3 and shellcheck 0.11.0 added to hermit (bin/); the script uses bare yq from the activated hermit environment and passes shellcheck clean.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3ec03cd9e3

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Load the review prompt from a trusted ref

When this local runner is used on an untrusted branch that edits .github/workflows/codex-security-review.yml, this line reads the run_codex prompt from the checked-out branch and passes it as the top-level codex exec task. That lets the branch remove or replace the security boundary before Codex starts, so the external-binary guard does not protect the developer's authenticated run. Read the prompt/model from a trusted base ref, or embed a trusted prompt, and use the branch only as diff input.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Avoid adding unapproved toolchain entries

This makes the new local runner depend on a newly added yq toolchain entry, while the repo guidance says not to introduce new tooling without asking. If this lands without explicit approval, everyone gets an expanded Hermit toolchain and the script depends on it contrary to that policy; either use existing repo tooling or document the approval for adding yq/shellcheck.

Useful? React with 👍 / 👎.

[github-actions]

🔐 Codex Security Review

Note: This is an automated security-focused code review generated by Codex.
It should be used as a supplementary check alongside human review.
False positives are possible - use your judgment.

Scope summary

• Reviewed pull request diff only (dff6538cd00678458c5b6135852e83aed9248781...3ec03cd9e30136552942ff9765ceccf00a7937a0, exact PR three-dot diff)
• Model: gpt-5.6-sol

💡 Click "edited" above to see previous reviews for this PR.

---

Review Summary

Overall Risk: HIGH

Findings

[HIGH] Local reviewer executes tooling from the untrusted checkout

• Category: Other
• Location: scripts/codex-security-review-local.sh:13
• Description: The script protects only the Codex executable. It invokes yq from PATH and recommends activating the checkout's Hermit environment; the added bin/yq ultimately runs the checked-in Hermit bootstrap. The launcher itself is also stored in the branch being reviewed. A malicious branch can therefore replace the launcher, activation code, or tool shims and execute commands before the Codex sandbox starts.
• Impact: Running this reviewer on an untrusted branch can execute arbitrary code with the developer's privileges, enabling credential theft or host modification.
• Recommendation: Keep the launcher and its complete toolchain in a trusted worktree or external installation. Run reviews in an isolated container or VM, canonicalize and allow-list every executable, and never source activation scripts from the reviewed checkout.

[HIGH] Attacker-controlled workflow content becomes the privileged review prompt

• Category: Other
• Location: scripts/codex-security-review-local.sh:68
• Description: The prompt, model, and reasoning effort are read from the current checkout and passed directly to Codex. A branch can replace the workflow prompt, while project instructions or configuration from that checkout may also be loaded by Codex. --sandbox read-only restricts writes but does not make attacker-controlled instructions trustworthy or prevent access to readable host data.
• Impact: A malicious PR can suppress or falsify findings, induce disclosure of developer files through the model session, or consume unexpected model resources.
• Recommendation: Load the prompt and model configuration exclusively from a verified trusted revision or embed them in the trusted launcher. Disable reviewed-checkout instructions, configuration, hooks, and plugins, and expose only the immutable diff and necessary source files to the Codex process.

Notes

The authoritative diff was well-formed. Shell syntax and ShellCheck validation passed; the material risks are the new local reviewer's broken trust boundary.

---

_{Generated by Codex Security Review |
Triggered by: @illegalprime |
Review workflow run}