# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

## [0.1.2] - 2026-07-29

### Fixed

- A failing `CodexSecurity.close()` no longer masks the original scan error (or an Esc abort) in `security_scan` and `security_auth_status`.

### Changed

- Release workflow is idempotent: `npm publish` is skipped when the tag's version is already on the registry, so the GitHub Release step always runs.
- GitHub Actions bumped to `checkout@v7` / `setup-node@v7`.

## [0.1.1] - 2026-07-29

### Added

- `security_scan` tool: run Codex Security scans from the pi agent with streamed progress, severity-ranked findings summary, and report/SARIF artifact paths. Supports whole-repo, working-tree diff, and ref-range diff targets, `standard`/`deep` modes, auth selection, severity filtering, and cost caps.
- `security_auth_status` tool: check ChatGPT sign-in / API key authentication.
- `/security-scan` command with `--deep`, `--diff base[:head]`, and `--auth` flags.
- `/security-status` command.
- `codex-security` skill covering scan targeting, triage, and fix workflows.