fix: complete the bundled scan example

[mldangelo-oai]

Summary

Make the bundled completed-scan example usable by tracking preflight, including installations that already cached the previous plugin version.

Changes

• Add the report generated from the example's existing canonical JSON.
• Include the report in the exact bundled-plugin package manifest.
• Run the real tracking preflight against the unchanged example in a focused regression test.
• Advance both bundled-plugin version markers from 0.1.20 to 0.1.21 so existing SDK plugin caches receive the completed example.
• Leave the npm package version and sealed canonical JSON unchanged.

Testing

• Full randomized SDK suite on db2b2765becacdbc35335a96e48c6af731031d17: 1,294 passed, 11 skipped, 0 failed; 9,151 assertions across 63 files. Used Bun 1.3.14, seed 12345, and the original 30,000 ms timeout.
• pnpm run types and pnpm run format passed again on that exact head.
• pnpm run build, pnpm pack, and pnpm run check:package passed. The installed-package smoke verified public imports, the CLI, all 107 bundled-plugin files, and local nested-worker startup.
• The unchanged example passed tracking preflight from the verified tarball, and its report matches the packaged canonical renderer byte-for-byte.
• Verified that the packaged canonical JSON and report match the source files, both packaged plugin-version markers report 0.1.21, and the npm package version remains 0.1.14.
• git diff --check passed. Fresh pushed-head GitHub CI remains required for the standard and cross-platform suites.
• Three independent native code-review passes and a separate source verifier found no remaining issues at this head.

Risk and rollout

The report is a derived artifact; this change does not alter the sealed canonical scan JSON or scan runtime behavior. The paired plugin-version update is required because an existing SDK marketplace cache is refreshed only when the selected plugin version changes.

If another plugin-bearing change merges first, refresh this branch against main and advance both version markers to the next unused plugin version before shipping. This pull request does not change the npm version, create a release tag, or publish a release.

Public disclosure review

Newly authored material was reviewed for public disclosure. Existing automated review comments contain access-restricted report references; maintainer cleanup remains outstanding.

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review

Please review the current head f4c7cf1.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: f4c7cf135b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: f4c7cf135b

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[mldangelo-oai]

@codex review

The validation record is complete. The code head remains f4c7cf1; the ordinary and randomized suites and installed-package smoke all passed.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: f4c7cf135b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: f4c7cf135b

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[mldangelo-oai]

@codex review

Please review the current head, db2b2765becacdbc35335a96e48c6af731031d17.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: db2b2765be

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: db2b2765be

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[mldangelo-oai]

@codex review Please review current head db2b276, including the additive bundled-plugin cache version refresh.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: db2b2765be

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: db2b2765be

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.