Document npm package, bundled plugin, and runtime version mapping

Summary

The following identifiers refer to the same Codex Security plugin release/content, but they use different version numbers:

• npm release tag: npm-v0.1.5
• bundled plugin manifest: 0.1.14
• Codex runtime distribution: 0.1.15

The vendor snapshot is therefore correct when copied byte-for-byte from npm-v0.1.5; the confusing part is the undocumented mapping between these three identifiers.

Observed source identity

• Tag npm-v0.1.5 resolves to commit 66778d0d85f478d7832854b81d0a6ddb93a3ce4c.
• The bundled plugin tree is 09b14c17694b5f568dd61860f2bc63771e5e4280.
• sdk/typescript/_bundled_plugin/.codex-plugin/plugin.json reports 0.1.14.
• The corresponding Codex runtime plugin reports 0.1.15.

Request

Could the release documentation or metadata explicitly describe the relationship between:

1. the npm release tag/version,
2. the bundled .codex-plugin/plugin.json version, and
3. the Codex runtime/catalog version?

An immutable mapping such as npm tag → commit SHA → bundled tree hash → runtime version would make byte-for-byte vendoring and provenance checks unambiguous.

Alternatively, aligning these version fields for future releases would avoid downstream tools interpreting the same release as a version mismatch.

Reproduction

git clone https://github.com/openai/codex-security.git
cd codex-security
git checkout npm-v0.1.5

git rev-parse HEAD
git rev-parse HEAD:sdk/typescript/_bundled_plugin
jq -r .version sdk/typescript/_bundled_plugin/.codex-plugin/plugin.json

Observed:

66778d0d85f478d7832854b81d0a6ddb93a3ce4c
09b14c17694b5f568dd61860f2bc63771e5e4280
0.1.14

Start with the npm-v0.1.5 tag and the commands in the reproduction section, then inspect sdk/typescript/_bundled_plugin/.codex-plugin/plugin.json. Done means the release documentation or metadata explicitly maps the npm version, commit SHA, bundled tree hash, plugin version, and runtime/catalog version, or clearly records the intended alignment for future releases.