From b2fa0513e069d219aa32d57d3732caea544f5742 Mon Sep 17 00:00:00 2001 From: Garry Tan Date: Thu, 26 Mar 2026 17:54:29 -0600 Subject: [PATCH] fix: add --xhigh reminder to challenge and consult modes The --xhigh override was only documented in Step 2A (review). Steps 2B (challenge) and 2C (consult) lacked the reminder, so the flag would silently do nothing for those modes. Found by adversarial review. --- codex/SKILL.md | 5 +++++ codex/SKILL.md.tmpl | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/codex/SKILL.md b/codex/SKILL.md index 9973f69d..2cabff5c 100644 --- a/codex/SKILL.md +++ b/codex/SKILL.md @@ -573,6 +573,9 @@ With focus (e.g., "security"): "Review the changes on this branch against the base branch. Run `git diff origin/` to see the diff. Focus specifically on SECURITY. Your job is to find every way an attacker could exploit this code. Think about injection vectors, auth bypasses, privilege escalation, data exposure, and timing attacks. Be adversarial." 2. Run codex exec with **JSONL output** to capture reasoning traces and tool calls (5-minute timeout): + +If the user passed `--xhigh`, use `"xhigh"` instead of `"high"`. + ```bash codex exec "" -C "$(git rev-parse --show-toplevel)" -s read-only -c 'model_reasoning_effort="high"' --enable web_search_cached --json 2>/dev/null | PYTHONUNBUFFERED=1 python3 -u -c " import sys, json @@ -669,6 +672,8 @@ THE PLAN: 4. Run codex exec with **JSONL output** to capture reasoning traces (5-minute timeout): +If the user passed `--xhigh`, use `"xhigh"` instead of `"medium"`. + For a **new session:** ```bash codex exec "" -C "$(git rev-parse --show-toplevel)" -s read-only -c 'model_reasoning_effort="medium"' --enable web_search_cached --json 2>"$TMPERR" | PYTHONUNBUFFERED=1 python3 -u -c " diff --git a/codex/SKILL.md.tmpl b/codex/SKILL.md.tmpl index 0f5a30b7..4a8fbbe8 100644 --- a/codex/SKILL.md.tmpl +++ b/codex/SKILL.md.tmpl @@ -168,6 +168,9 @@ With focus (e.g., "security"): "Review the changes on this branch against the base branch. Run `git diff origin/` to see the diff. Focus specifically on SECURITY. Your job is to find every way an attacker could exploit this code. Think about injection vectors, auth bypasses, privilege escalation, data exposure, and timing attacks. Be adversarial." 2. Run codex exec with **JSONL output** to capture reasoning traces and tool calls (5-minute timeout): + +If the user passed `--xhigh`, use `"xhigh"` instead of `"high"`. + ```bash codex exec "" -C "$(git rev-parse --show-toplevel)" -s read-only -c 'model_reasoning_effort="high"' --enable web_search_cached --json 2>/dev/null | PYTHONUNBUFFERED=1 python3 -u -c " import sys, json @@ -264,6 +267,8 @@ THE PLAN: 4. Run codex exec with **JSONL output** to capture reasoning traces (5-minute timeout): +If the user passed `--xhigh`, use `"xhigh"` instead of `"medium"`. + For a **new session:** ```bash codex exec "" -C "$(git rev-parse --show-toplevel)" -s read-only -c 'model_reasoning_effort="medium"' --enable web_search_cached --json 2>"$TMPERR" | PYTHONUNBUFFERED=1 python3 -u -c "