[kmbroai]

Summary

Add a CLI command and TypeScript SDK function for reviewing grouped service audit events. A caller can supply historical context and receive observations tied to the new events that support them.

Changes

• Read one versioned JSON batch from stdin with codex-security review-events --json, or pass it to reviewSecurityEvents().
• Opt in to Decisions screening with --screen-with-decisions or screenWithDecisions. A routine result at or above the cutoff skips the full review. Other results go to the read-only Codex reviewer.
• Set the minimum confidence with --decisions-cutoff, SDK option decisionsCutoff, or project setting review_events.decisions_cutoff. The range is 0 through 1 inclusive and the default is 0.95. An explicit CLI cutoff takes precedence over the file.

Testing

• Full seeded SDK suite and randomized coverage suite each passed 7,062 tests with 108 skips. The MCP suite passed 1,606 tests with four skips.
• Type and format checks, schema generation checks, portable plugin source checks, npm archive validation, and installed-package smoke tests passed.
• The installed-package test resolved dependencies as of the base commit because a newer transitive package version was unavailable. Decisions routing used synthetic responses.
• The independent local Codex review could not run because CLI authentication was unavailable.

Risk and rollout

Each nonempty group gets a full review by default. Enabling screening sends the group's evidence to the OpenAI Decisions API using OPENAI_API_KEY. A lower cutoff allows more routine classifications to skip full review. A screening error fails the batch so the caller can retry before advancing its cursor.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.