opencode-codex-security 0.1.0 → 0.1.2

package/src/core/provider-config.ts

@@ -0,0 +1,254 @@
+import { open, realpath } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { homedir } from 'node:os';
+import { isAbsolute, join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { parse } from 'smol-toml';
+
+export interface ProviderSettings {
+  id: string;
+  baseUrl: string;
+  envKey: string;
+  wireApi: 'responses';
+}
+export interface ProviderSource {
+  path: string;
+  profile?: string;
+  /** Hash of the allowlisted selection only. Never hash credentials or the full source file. */
+  digest: string;
+}
+export class ProviderConfigurationError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'ProviderConfigurationError';
+  }
+}
+const fail = (message: string): never => {
+  throw new ProviderConfigurationError(message);
+};
+export const record = (value: unknown): value is Record<string, unknown> =>
+  value !== null && typeof value === 'object' && !Array.isArray(value);
+const reserved = new Set([
+  'openai',
+  'ollama',
+  'lmstudio',
+  'amazon-bedrock',
+  'amazon-bedrock-runtime',
+  'gcp',
+  '__proto__',
+  'prototype',
+  'constructor',
+]);
+export function validateProvider(raw: unknown): ProviderSettings {
+  if (
+    !record(raw) ||
+    Object.keys(raw).some((key) => !['id', 'baseUrl', 'envKey', 'wireApi'].includes(key))
+  )
+    return fail(
+      'Provider accepts only id, baseUrl, envKey, and wireApi. Inline credentials, headers, and auth commands are unsupported.',
+    );
+  const { id, baseUrl, envKey, wireApi } = raw;
+  if (
+    typeof id !== 'string' ||
+    !/^[A-Za-z][A-Za-z0-9_-]{0,63}$/.test(id) ||
+    reserved.has(id.toLowerCase())
+  )
+    return fail('Use a custom provider ID, not a built-in provider or reserved name.');
+  if (typeof envKey !== 'string' || !/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(envKey))
+    return fail('Provider envKey must be an environment-variable name, never a key value.');
+  if (wireApi !== 'responses')
+    return fail('Provider wireApi must be responses. Chat Completions is unsupported.');
+  if (typeof baseUrl !== 'string' || baseUrl.length > 2048 || /[\s\x00-\x1f\x7f\\]/.test(baseUrl))
+    return fail('Provider baseUrl must be a credential-free HTTPS URL.');
+  let url: URL;
+  try {
+    url = new URL(baseUrl);
+  } catch {
+    return fail('Provider baseUrl must be a credential-free HTTPS URL.');
+  }
+  // Keep URLs safe to show in approval plans. No userinfo, query, fragment, opaque
+  // schemes, encoded components, or token-bearing path segments are supported.
+  if (
+    url.protocol !== 'https:' ||
+    !url.hostname ||
+    url.username ||
+    url.password ||
+    url.search ||
+    url.hash ||
+    /[%@]/.test(baseUrl) ||
+    !/^\/[A-Za-z0-9/_.-]*$/.test(url.pathname) ||
+    url.pathname
+      .split('/')
+      .some((part) => part.length > 64 || /^(?:sk-|Bearer|token[=:]|key[=:])/i.test(part))
+  )
+    return fail(
+      'Provider baseUrl must be HTTPS without credentials, query parameters, fragments, or encoded paths.',
+    );
+  return { id, baseUrl: url.href.replace(/\/$/, ''), envKey, wireApi };
+}
+export function validateConfigFile(value: unknown): asserts value is string {
+  if (
+    typeof value !== 'string' ||
+    value.length > 4096 ||
+    /[\x00-\x1f\x7f]/.test(value) ||
+    (!isAbsolute(value) && !value.startsWith('~/')) ||
+    !value.endsWith('.toml')
+  )
+    fail('codex.configFile must be an absolute or ~/ path to a TOML file.');
+}
+/** Standard Codex location; call only after explicit import opt-in. No file or credential reads. */
+export function defaultCodexConfigFile(
+  environment: { CODEX_HOME?: string } = process.env,
+  home = homedir(),
+): string {
+  const configured = environment.CODEX_HOME;
+  let path: string;
+  try {
+    if (configured !== undefined && configured !== '' && !isAbsolute(configured)) throw new Error();
+    const directory =
+      configured === undefined || configured === '' ? join(home, '.codex') : configured;
+    // Check the raw directory before path normalization can erase a control
+    // character segment or turn a relative value into an accepted ~/ path.
+    validateConfigFile(`${directory}/config.toml`);
+    path = join(directory, 'config.toml');
+    validateConfigFile(path);
+  } catch {
+    return fail(
+      'CODEX_HOME must be an absolute directory path without control characters. Leave it unset or empty to use ~/.codex/config.toml.',
+    );
+  }
+
+  return path;
+}
+export function validateProfile(value: unknown): asserts value is string {
+  if (typeof value !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(value))
+    fail('codex.profile must be a simple named profile in the selected TOML file.');
+}
+/** Explicit opt-in only. Nothing here resolves ambient config, authentication, or SDK profiles. */
+export async function readProviderConfiguration(configFile: string, profile?: string) {
+  validateConfigFile(configFile);
+  if (profile !== undefined) validateProfile(profile);
+  const requested = configFile.startsWith('~/') ? join(homedir(), configFile.slice(2)) : configFile;
+  let content: string;
+  let path: string;
+  try {
+    const file = await open(
+      requested,
+      constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK,
+    );
+    try {
+      const info = await file.stat();
+      if (!info.isFile() || info.size > 256 * 1024) throw new Error();
+      const bytes = Buffer.alloc(256 * 1024 + 1);
+      const { bytesRead } = await file.read(bytes, 0, bytes.length, 0);
+      if (bytesRead > 256 * 1024 || bytes.subarray(0, bytesRead).includes(0)) throw new Error();
+      content = bytes.subarray(0, bytesRead).toString('utf8');
+      path = await realpath(requested);
+    } finally {
+      await file.close();
+    }
+  } catch {
+    return fail(
+      'Cannot read the selected Codex config. Use a regular, nonsymlink TOML file of at most 256 KiB.',
+    );
+  }
+  let root: Record<string, unknown>;
+  try {
+    root = parse(content);
+  } catch {
+    return fail(
+      'Cannot parse the selected Codex TOML config. Parser details are withheld because they may contain credentials.',
+    );
+  }
+  const selectedName = profile ?? root.profile;
+  let selected: Record<string, unknown> = root;
+  let profileFields: Record<string, unknown> = {};
+  if (selectedName !== undefined) {
+    validateProfile(selectedName);
+    if (
+      !record(root.profiles) ||
+      !Object.hasOwn(root.profiles, selectedName) ||
+      !record(root.profiles[selectedName])
+    )
+      return fail('The selected Codex profile is missing or invalid.');
+    profileFields = root.profiles[selectedName];
+    selected = { ...root, ...profileFields };
+  }
+  const id = selected.model_provider;
+  if (typeof id !== 'string')
+    return fail(
+      'The selected Codex config must define its custom model_provider and model_providers entry.',
+    );
+  if (
+    (root.model_providers !== undefined && !record(root.model_providers)) ||
+    (profileFields.model_providers !== undefined && !record(profileFields.model_providers))
+  )
+    return fail('The selected Codex provider table must be an object.');
+  const rootProviders = record(root.model_providers) ? root.model_providers : {};
+  const profileProviders = record(profileFields.model_providers)
+    ? profileFields.model_providers
+    : {};
+  // Inherit only the selected provider's fields, never whole profile/runtime configuration.
+  const inherited = Object.hasOwn(rootProviders, id) ? rootProviders[id] : undefined;
+  const override = Object.hasOwn(profileProviders, id) ? profileProviders[id] : undefined;
+  if (
+    (!record(inherited) && !record(override)) ||
+    (inherited !== undefined && !record(inherited)) ||
+    (override !== undefined && !record(override))
+  )
+    return fail(
+      'The selected Codex config must define its custom model_provider and model_providers entry.',
+    );
+  const native = { ...(record(inherited) ? inherited : {}), ...(record(override) ? override : {}) };
+  const ignoredHints = [
+    'env_key_instructions',
+    'request_max_retries',
+    'stream_max_retries',
+    'stream_idle_timeout_ms',
+  ];
+  if (
+    Object.keys(native).some(
+      (key) =>
+        ![
+          'name',
+          'base_url',
+          'env_key',
+          'wire_api',
+          'requires_openai_auth',
+          ...ignoredHints,
+        ].includes(key),
+    ) ||
+    (native.requires_openai_auth !== undefined && native.requires_openai_auth !== false)
+  )
+    return fail(
+      'The selected provider uses unsupported options. Only Responses routing with env_key and requires_openai_auth=false is supported; headers, inline tokens, auth commands, and OAuth are not imported.',
+    );
+  const provider = validateProvider({
+    id,
+    baseUrl: native.base_url,
+    envKey: native.env_key,
+    wireApi: native.wire_api === undefined ? 'responses' : native.wire_api,
+  });
+  const settings = {
+    provider,
+    ...(selected.model === undefined ? {} : { model: selected.model }),
+    ...(selected.model_reasoning_effort === undefined
+      ? {}
+      : { reasoningEffort: selected.model_reasoning_effort }),
+    ...(selected.daybreak === undefined ? {} : { daybreak: selected.daybreak }),
+  };
+  // Only known non-secret configuration reaches the digest or callers. Validate
+  // model/reasoning/daybreak in sdk-settings before exposing this selection.
+  return { settings, path, profile: selectedName };
+}
+export function providerSource(
+  path: string,
+  profile: string | undefined,
+  settings: unknown,
+): ProviderSource {
+  return {
+    path,
+    ...(profile === undefined ? {} : { profile }),
+    digest: createHash('sha256').update(JSON.stringify(settings)).digest('hex'),
+  };
+}

package/src/core/scan-plan.ts

@@ -1,4 +1,4 @@
-import { loadGlobalSettings, mergeSettings, type ResolvedSdkSettings } from './sdk-settings.ts';
+import { loadGlobalSettings, resolveSettings, type ResolvedSdkSettings } from './sdk-settings.ts';
 import { realpath, stat, open } from 'node:fs/promises';
 import { constants } from 'node:fs';
 import { homedir } from 'node:os';
@@ -133,7 +133,7 @@ export async function prepareScan(
       'Choose a specific project repository explicitly. Your home folder and its parent directories cannot be scan targets.',
     );
   const global = await loadGlobalSettings();
-  const settings = mergeSettings(global.settings, input.mode ? { scan: { mode: input.mode } } : {});
+  const settings = await resolveSettings(global.settings, input.mode);
   const merged = input;
   const scopePaths: string[] = [];
   for (const path of merged.scopePaths ?? [])
@@ -173,6 +173,7 @@ export async function validatePlan(plan: ScanPlan) {
   const current = await prepareScan(plan.repository, plan.inputs, plan.mock);
   if (
     current.repository !== plan.repository ||
+    current.globalConfigFile !== plan.globalConfigFile ||
     current.globalConfigDigest !== plan.globalConfigDigest ||
     JSON.stringify(current.settings) !== JSON.stringify(plan.settings) ||
     JSON.stringify(current.contextFiles) !== JSON.stringify(plan.contextFiles) ||

package/src/core/sdk-settings.ts

@@ -2,10 +2,27 @@ import { readFile, lstat } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { createHash } from 'node:crypto';
+import type { CodexSecurityConfig } from '@openai/codex-security';
+import {
+  readProviderConfiguration,
+  defaultCodexConfigFile,
+  providerSource,
+  validateProvider,
+  validateConfigFile,
+  validateProfile,
+  ProviderConfigurationError,
+  type ProviderSettings,
+  type ProviderSource,
+} from './provider-config.ts';
 export interface CodexSettings {
   model?: string;
   reasoningEffort?: string;
   daybreak?: boolean;
+  auth?: 'chatgpt' | 'api-key';
+  provider?: ProviderSettings;
+  configFile?: string;
+  useCodexConfig?: boolean;
+  profile?: string;
 }
 export interface ScanSettings {
   mode?: 'standard' | 'deep';
@@ -20,11 +37,14 @@ export interface SdkSettings {
   scan?: ScanSettings;
 }
 export interface ResolvedSdkSettings {
-  codex: Required<CodexSettings>;
+  codex: Required<Pick<CodexSettings, 'model' | 'reasoningEffort' | 'daybreak' | 'auth'>> & {
+    provider?: ProviderSettings;
+    source?: ProviderSource;
+  };
   scan: ScanSettings & { mode: 'standard' | 'deep'; maxCostUsd: number };
 }
 export const defaultSettings: ResolvedSdkSettings = {
-  codex: { model: 'gpt-5.6-sol', reasoningEffort: 'xhigh', daybreak: false },
+  codex: { model: 'gpt-5.6-sol', reasoningEffort: 'xhigh', daybreak: false, auth: 'chatgpt' },
   scan: { mode: 'standard', maxCostUsd: 1 },
 };
 export function validateSettings(raw: unknown): SdkSettings {
@@ -38,13 +58,29 @@ export function validateSettings(raw: unknown): SdkSettings {
       throw new Error(`${section} settings must be an object.`);
     const allowed =
       section === 'codex'
-        ? ['model', 'reasoningEffort', 'daybreak']
+        ? [
+            'model',
+            'reasoningEffort',
+            'daybreak',
+            'auth',
+            'provider',
+            'configFile',
+            'useCodexConfig',
+            'profile',
+          ]
         : ['mode', 'maxCostUsd', 'maxTimeMinutes', 'cyberAccessProgram', 'workers', 'subagents'];
     for (const [key, val] of Object.entries(group)) {
       if (!allowed.includes(key))
         throw new Error(
-          `Unsupported ${section} setting: ${key}. Credentials and arbitrary runtime overrides are not accepted.`,
+          `Unsupported ${section} setting. Credentials and arbitrary runtime overrides are not accepted.`,
         );
+      if (key === 'auth' && val !== 'chatgpt' && val !== 'api-key')
+        throw new ProviderConfigurationError('codex.auth must be chatgpt or api-key.');
+      if (key === 'useCodexConfig' && typeof val !== 'boolean')
+        throw new ProviderConfigurationError('codex.useCodexConfig must be true or false.');
+      if (key === 'provider') validateProvider(val);
+      if (key === 'configFile') validateConfigFile(val);
+      if (key === 'profile') validateProfile(val);
       if (
         key === 'model' &&
         (typeof val !== 'string' || !val.trim() || val.length > 200 || /[\x00-\x1f]/.test(val))
@@ -94,7 +130,12 @@ export async function loadGlobalSettings(
       throw new Error('Global config must be a regular JSON file of at most 32 KiB.');
     const content = await readFile(path);
     if (content.length > 32768) throw new Error('Global config too large.');
-    const raw = JSON.parse(content.toString('utf8'));
+    let raw: unknown;
+    try {
+      raw = JSON.parse(content.toString('utf8'));
+    } catch {
+      throw new Error('Global config is not valid JSON. Parser details are withheld.');
+    }
     if (
       !raw ||
       typeof raw !== 'object' ||
@@ -113,11 +154,94 @@ export async function loadGlobalSettings(
     throw error;
   }
 }
-export function mergeSettings(...sources: SdkSettings[]): ResolvedSdkSettings {
-  const result = structuredClone(defaultSettings);
-  for (const source of sources) {
-    Object.assign(result.codex, source.codex);
-    Object.assign(result.scan, source.scan);
+/** Resolve only user-owned global settings; model tool inputs cannot select routing. */
+export async function resolveSettings(
+  source: SdkSettings,
+  mode?: 'standard' | 'deep',
+): Promise<ResolvedSdkSettings> {
+  validateSettings(source);
+  const explicit = source.codex ?? {};
+  if (explicit.useCodexConfig === false && explicit.configFile)
+    throw new ProviderConfigurationError(
+      'codex.configFile cannot be combined with useCodexConfig=false.',
+    );
+  const importing = explicit.useCodexConfig === true || explicit.configFile !== undefined;
+  if (importing && explicit.provider)
+    throw new ProviderConfigurationError(
+      'Choose existing Codex config import or codex.provider, not both.',
+    );
+  if (explicit.profile && !importing)
+    throw new ProviderConfigurationError(
+      'codex.profile requires useCodexConfig=true or codex.configFile.',
+    );
+  // Explicit paths take precedence without even consulting ignored CODEX_HOME.
+  const imported = importing
+    ? await readProviderConfiguration(
+        explicit.configFile ?? defaultCodexConfigFile(),
+        explicit.profile,
+      )
+    : undefined;
+  const selected = imported ? validateSettings({ codex: imported.settings }).codex! : {};
+  const {
+    configFile: _configFile,
+    useCodexConfig: _useCodexConfig,
+    profile: _profile,
+    ...overrides
+  } = explicit;
+  const codex = { ...defaultSettings.codex, ...selected, ...overrides };
+  if (codex.provider) {
+    codex.provider = validateProvider(codex.provider);
+    if (explicit.auth === 'chatgpt')
+      throw new ProviderConfigurationError(
+        'Custom providers require api-key authentication; ChatGPT credentials will not be forwarded.',
+      );
+    codex.auth = 'api-key';
+    if (
+      codex.daybreak ||
+      (source.scan?.cyberAccessProgram && source.scan.cyberAccessProgram !== 'standard')
+    )
+      throw new ProviderConfigurationError(
+        'Custom-provider Daybreak is not supported by this plugin yet. Disable daybreak and use the standard access program.',
+      );
+  } else if (codex.auth !== 'chatgpt') {
+    throw new ProviderConfigurationError(
+      'API-key authentication requires an explicit custom provider with an envKey.',
+    );
   }
-  return result;
+  if (imported) codex.source = providerSource(imported.path, imported.profile, selected);
+  return { codex, scan: { ...defaultSettings.scan, ...source.scan, ...(mode ? { mode } : {}) } };
+}
+
+/** Build the entire routing override from validated, non-secret fields. Never pass a profile. */
+export function sdkConfiguration(settings?: ResolvedSdkSettings): CodexSecurityConfig {
+  const codex = settings?.codex;
+  const provider = codex?.provider ? validateProvider(codex.provider) : undefined;
+  if (provider && codex?.auth !== 'api-key')
+    throw new ProviderConfigurationError('Custom providers require api-key authentication.');
+  return {
+    codexOverrides: {
+      model_provider: provider?.id ?? 'openai',
+      ...(codex
+        ? {
+            model: codex.model,
+            model_reasoning_effort: codex.reasoningEffort,
+            daybreak: codex.daybreak,
+          }
+        : {}),
+      ...(provider
+        ? {
+            analytics: { enabled: false },
+            model_providers: {
+              [provider.id]: {
+                name: provider.id,
+                base_url: provider.baseUrl,
+                env_key: provider.envKey,
+                wire_api: provider.wireApi,
+                requires_openai_auth: false,
+              },
+            },
+          }
+        : {}),
+    },
+  };
 }

package/src/core/security-operations.ts

@@ -11,8 +11,12 @@ import type {
 } from '@openai/codex-security';
 import { prepareScan, validatePlan, type ScanPlan } from './scan-plan.ts';
 import { safeReportText } from './report-safety.ts';
+import { sdkConfiguration } from './sdk-settings.ts';
+import { ProviderConfigurationError } from './provider-config.ts';
+import { unsupportedPricingMessage } from './codex-adapter.ts';
 import {
-  requireDedicatedSecurityCredentials,
+  requireSdkCredentials,
+  ProviderCredentialsRequiredError,
   DedicatedSecurityCredentialsRequiredError,
 } from './credential-guard.ts';
 
@@ -102,7 +106,7 @@ type Entry = {
   };
 };
 const realClient: SecurityOperationsFactory = async (config) => {
-  await requireDedicatedSecurityCredentials();
+  await requireSdkCredentials(config);
   const { CodexSecurity } = await import('@openai/codex-security');
   return new CodexSecurity(config);
 };
@@ -271,8 +275,8 @@ export class SecurityOperationsService {
       costLimitEnforced: input.kind === 'policy',
       costNotice:
         input.kind === 'policy'
-          ? `OpenAI model inference uses an estimated USD ${scan.settings.scan.maxCostUsd} SDK limit, not a guaranteed billing cap.`
-          : 'OpenAI model inference has no SDK cost limit for validation in version 0.9.1. The scan budget does not apply.',
+          ? `Model inference uses an estimated USD ${scan.settings.scan.maxCostUsd} SDK limit, not a guaranteed billing cap.`
+          : 'Model inference has no SDK cost limit for validation in version 0.9.1. The scan budget does not apply.',
     };
     const entry: Entry = {
       controller: new AbortController(),
@@ -358,19 +362,12 @@ export class SecurityOperationsService {
     const observing = () => !signal.aborted && active(entry.state);
     try {
       signal.throwIfAborted();
-      client = await this.#factory({
-        codexOverrides: {
-          model_provider: 'openai',
-          model: plan.settings.codex.model,
-          model_reasoning_effort: plan.settings.codex.reasoningEffort,
-          daybreak: plan.settings.codex.daybreak,
-        },
-      });
+      client = await this.#factory(sdkConfiguration(plan.settings));
       signal.throwIfAborted();
       const context = plan.contextFiles.map((file) => resolve(plan.repository, file.path));
       if (plan.kind === 'policy') {
         const options: SecurityPolicyOptions = {
-          auth: 'chatgpt',
+          auth: plan.settings.codex.auth,
           path: plan.path,
           knowledgeBasePaths: context,
           maxCostUsd: plan.settings.scan.maxCostUsd,
@@ -409,7 +406,7 @@ export class SecurityOperationsService {
         const options: ValidationOptions = {
           repositoryPath: plan.repository,
           finding: plan.finding!,
-          auth: 'chatgpt',
+          auth: plan.settings.codex.auth,
           knowledgeBasePaths: context,
           signal,
           ...(plan.settings.scan.cyberAccessProgram
@@ -438,9 +435,12 @@ export class SecurityOperationsService {
       entry.state.result = null;
       entry.state.error = signal.aborted
         ? null
-        : error instanceof DedicatedSecurityCredentialsRequiredError
+        : error instanceof DedicatedSecurityCredentialsRequiredError ||
+            error instanceof ProviderCredentialsRequiredError ||
+            error instanceof ProviderConfigurationError
           ? error.message
-          : 'SDK operation failed. Review local SDK diagnostics and runtime prerequisites. Raw output is not exposed.';
+          : (unsupportedPricingMessage(error) ??
+            'SDK operation failed. Review local SDK diagnostics and runtime prerequisites. Raw output is not exposed.');
     } finally {
       this.#rejectQuestion(entry, new Error('Operation ended before this question was answered.'));
       try {

package/src/operation-tools.ts

@@ -1,3 +1,4 @@
+import { describeInferenceRoute } from './plan-view.ts';
 import { safeFinding } from './core/report-safety.ts';
 import type { Plugin } from '@opencode/plugin';
 import { createHash } from 'node:crypto';
@@ -34,6 +35,7 @@ const summary = (s: SecurityOperationState) => ({
   startedAt: s.startedAt,
   finishedAt: s.finishedAt,
   costNotice: s.plan.costNotice,
+  inferenceRoute: describeInferenceRoute(s.plan.settings),
 });
 export function registerOperationTools(
   editor: Editor,
@@ -90,7 +92,7 @@ export function registerOperationTools(
           model: state.plan.settings.codex.model,
           path: state.plan.path,
           contextFiles: state.plan.contextFiles.map((f) => f.path),
-          note: 'Prepared only. Show target and cost notice before starting. Policy will not be applied automatically.',
+          note: 'Prepared only. Show target, inference route and cost notice before starting. Policy will not be applied automatically.',
         }),
       };
     },
@@ -112,7 +114,7 @@ export function registerOperationTools(
           ...summary(state),
           finding: f.finding,
           model: state.plan.settings.codex.model,
-          note: 'Prepared only. Separate uncapped-validation authorization is required.',
+          note: 'Prepared only. Show inference route. Separate uncapped-validation authorization is required.',
         }),
       };
     },
@@ -146,6 +148,8 @@ export function registerOperationTools(
           path: state.plan.path ?? null,
           contextFiles: state.plan.contextFiles.map((f) => f.path),
           costNotice: state.plan.costNotice,
+          inferenceRoute: describeInferenceRoute(state.plan.settings),
+          settings: JSON.stringify(state.plan.settings),
         },
       });
       context.signal.throwIfAborted();
@@ -212,11 +216,13 @@ export function registerOperationTools(
           args.operationId,
           args.questionId,
           createHash('sha256').update(args.answer).digest('hex'),
+          JSON.stringify(state.plan.settings),
         ],
         metadata: {
           questions: state.question.questions,
           answer: args.answer,
-          recipient: 'OpenAI via the already-authorized Security policy operation',
+          recipient: `${describeInferenceRoute(state.plan.settings)} via the already-authorized Security policy operation`,
+          settings: JSON.stringify(state.plan.settings),
         },
       });
       context.signal.throwIfAborted();

package/src/plan-view.ts

@@ -1,7 +1,22 @@
+import type { ResolvedSdkSettings } from './core/sdk-settings';
 import type { ScanState } from './types';
 import type { ScanInputs, ScanPlan } from './core/scan-plan';
+/** Public route details only: never resolve credentials or read configuration in the UI. */
+export function describeInferenceRoute(settings: ResolvedSdkSettings): string {
+  const { provider, auth, source, model } = settings.codex;
+  const destination = provider ? `${provider.id} (${provider.baseUrl})` : 'OpenAI';
+  const authentication =
+    auth === 'api-key'
+      ? `API key from environment variable ${provider?.envKey ?? 'OPENAI_API_KEY'} (name only)`
+      : 'dedicated ChatGPT sign-in';
+  const configuration = source
+    ? `; config ${source.path}${source.profile ? `, profile ${source.profile}` : ''}, SHA-256 ${source.digest}`
+    : '';
+  return `${destination}; auth: ${authentication}; model: ${model}${configuration}${provider ? '; gateway upstream routing is not verified' : ''}`;
+}
+
 export function describePlan(plan: ScanPlan): string {
-  return `${plan.mock ? 'MOCK SDK TEST: no model calls or uploads.\n' : ''}Repository: ${plan.repository}\nScope: ${plan.scopePaths.join(', ') || 'whole repository'}\nScan prompt:\n${plan.scanPrompt || '(none)'}\nContext files: ${plan.contextFiles.map((f) => `${f.path} (${f.bytes} bytes, SHA-256 ${f.sha256})`).join('; ') || '(none)'}\nSDK settings: model ${plan.settings.codex.model}, reasoning ${plan.settings.codex.reasoningEffort}, Daybreak ${plan.settings.codex.daybreak ? 'on' : 'off'}; mode ${plan.settings.scan.mode} (${plan.inputs.mode ? 'per-scan choice' : 'global default'}), access program ${plan.settings.scan.cyberAccessProgram ?? 'Codex default'}, estimated cost stop USD ${plan.settings.scan.maxCostUsd}. Account/model/Daybreak access is not verified by these settings.\nGlobal config: ${plan.globalConfigFile}${plan.globalConfigDigest ? '' : ' (not present)'}\nOnly this explicit prompt and these files are added as context; conversation history is not copied. Scoped paths guide the scan, not a filesystem sandbox.\n${plan.mock ? 'Synthetic SDK responses only.' : `Repository source and listed context go to OpenAI via dedicated ChatGPT sign-in. Local results. USD ${plan.settings.scan.maxCostUsd} estimated stop threshold, not a hard cap; in-flight usage may exceed it.`}`;
+  return `${plan.mock ? 'MOCK SDK TEST: no model calls or uploads.\n' : ''}Repository: ${plan.repository}\nScope: ${plan.scopePaths.join(', ') || 'whole repository'}\nScan prompt:\n${plan.scanPrompt || '(none)'}\nContext files: ${plan.contextFiles.map((f) => `${f.path} (${f.bytes} bytes, SHA-256 ${f.sha256})`).join('; ') || '(none)'}\nSDK settings: model ${plan.settings.codex.model}, reasoning ${plan.settings.codex.reasoningEffort}, Daybreak ${plan.settings.codex.daybreak ? 'on' : 'off'}; mode ${plan.settings.scan.mode} (${plan.inputs.mode ? 'per-scan choice' : 'global default'}), access program ${plan.settings.scan.cyberAccessProgram ?? 'Codex default'}, estimated cost stop USD ${plan.settings.scan.maxCostUsd}. Account/model/Daybreak access is not verified by these settings.\nGlobal config: ${plan.globalConfigFile}${plan.globalConfigDigest ? '' : ' (not present)'}\nOnly this explicit prompt and these files are added as context; conversation history is not copied. Scoped paths guide the scan, not a filesystem sandbox.\n${plan.mock ? 'Synthetic SDK responses only.' : `Repository source and listed context go to ${describeInferenceRoute(plan.settings)}. Local results. USD ${plan.settings.scan.maxCostUsd} estimated stop threshold, not a hard cap; in-flight usage may exceed it.`}`;
 }
 
 /** A UI choice affects only the next preview, never the global file. */

package/src/plugin.ts

@@ -165,7 +165,11 @@ export function createSecurityPlugin(
               source: { type: 'tool', messageID: context.messageID, id: context.id },
               action: 'codex_security_scan',
               resources: [plan.repository, JSON.stringify(plan.settings)],
-              metadata: { preview: describePlan(plan), planId },
+              metadata: {
+                preview: describePlan(plan),
+                planId,
+                settings: JSON.stringify(plan.settings),
+              },
             });
             context.signal.throwIfAborted();
             const state = await service.start({ planId, approveOpenAIInference: true });

package/src/security-operations-panel.tsx

@@ -1,3 +1,4 @@
+import { describeInferenceRoute } from './plan-view';
 import { createEffect, createMemo, createSignal, For, Show, on, onCleanup } from 'solid-js';
 import { createStore, reconcile } from 'solid-js/store';
 import type {
@@ -350,7 +351,8 @@ export function SecurityOperationsPanel(props: {
                       <>
                         <p>
                           Repository source{op().kind === 'validation' ? ', the finding,' : ''} and
-                          selected context will be sent to OpenAI.
+                          selected context will be sent to{' '}
+                          {describeInferenceRoute(op().plan.settings)}.
                         </p>
                         <p>
                           <strong>{op().plan.costNotice}</strong>
@@ -464,8 +466,9 @@ export function SecurityOperationsPanel(props: {
                       onInput={(e) => setAnswer(e.currentTarget.value)}
                     />
                     <span class="gs-help">
-                      Answer each question, or say what is unknown. Your answer goes to OpenAI for
-                      this operation; do not include secrets.
+                      Answer each question, or say what is unknown. Your answer goes to the
+                      already-approved route: {describeInferenceRoute(op().plan.settings)}. Do not
+                      include secrets.
                     </span>
                   </label>
                   <button