feat(cli): review and apply saved SECURITY.md drafts

Dockerfile

@@ -2,6 +2,10 @@
 
 FROM node:22-bookworm-slim@sha256:6c74791e557ce11fc957704f6d4fe134a7bc8d6f5ca4403205b2966bd488f6b3 AS package
 
+RUN apt-get update \
+    && apt-get install --no-install-recommends --yes python3 \
+    && rm -rf /var/lib/apt/lists/*
+
 WORKDIR /build/sdk/typescript
 
 COPY sdk/typescript/package.json sdk/typescript/pnpm-lock.yaml ./

README.md

@@ -34,6 +34,11 @@ threat-model, and review documents stay outside the repository and may contain
 sensitive details. See the [SDK policy guide](sdk/typescript/README.md#generate-a-security-policy)
 for headless generation, saved artifacts, and SDK usage.
 
+Use `codex-security policy . --apply /path/to/draft` to review and confirm a
+saved draft interactively. Add `--write` to apply the reviewed draft without
+another confirmation. The command revalidates the draft and selected checkout
+before writing; see the SDK guide for recovery after an interrupted apply.
+
 ## TypeScript SDK
 
 Codex Security is a Javascript package:

sdk/typescript/README.md

@@ -250,8 +250,8 @@ Cyber approval. Apply or check your access at
 
 ## Generate a security policy
 
-`policy` drafts a source-backed `SECURITY.md` without changing the checkout or
-creating a scan record. It uses the scan runtime and authentication, with
+`policy` drafts a source-backed `SECURITY.md` for review before writing it.
+It uses the scan runtime and authentication without creating a scan record, with
 read-only access to the selected repository and required tools. Network access,
 web search, apps, and MCP servers are disabled. Drafts stay outside the checkout.
 
@@ -272,54 +272,92 @@ For an intentional separate Git directory, set `core.worktree` to the checkout's
 absolute path. Use `git worktree repair` for moved linked worktrees.
 
 Generation describes the system, builds a threat model, then drafts the policy.
-In a terminal, it asks about facts the source cannot establish and shows the
-exact diff. If both ChatGPT and API-key credentials are available, it asks which
+In a terminal, it asks about facts the source cannot establish, shows the exact
+diff, and asks before writing. If both ChatGPT and API-key credentials are available, it asks which
 to use; `--auth chatgpt` or `--auth api-key` selects one explicitly.
 
-### Review the draft
+### Review and apply a saved draft
 
-Review the saved `SECURITY.md` before copying it to the reported target. Check
-links from `.github/SECURITY.md` or `docs/SECURITY.md`: copying can change their
-guidance too. Preserve reporting instructions and obtain owner approval for
+Review the saved `SECURITY.md` before applying it. Preserve reporting
+instructions and obtain owner approval for
 exclusions, accepted risks, and severity decisions. Later scans read this policy.
 
 Preview rejects changes to the selected or inherited policies. Other source
 files are not frozen; regenerate if relevant source or neighboring policies change.
 
-Use `--headless` or an explicit output format to skip questions. Unanswered
-questions remain in the review notes. Drafts default to the Codex Security state
-directory; `--output-dir` selects an empty directory outside every enclosing
-Git checkout and its Git metadata.
+Use `--headless` or an explicit output format to skip questions and write
+prompts. Unanswered questions remain in the review notes. Drafts default to the
+Codex Security state directory; `--output-dir` selects an empty directory
+outside every enclosing Git checkout and its Git metadata.
 
 ```bash
 npx @openai/codex-security policy . --path services/api \
   --headless --output-dir /path/outside/repository/api-policy --json
+
+# Review or edit the saved SECURITY.md.
+npx @openai/codex-security policy . --path services/api \
+  --apply /path/outside/repository/api-policy --write
 ```
 
+`--apply` loads the saved draft without starting Codex. Omit `--write` to review
+and confirm interactively. `--write` requires `--apply`; it cannot write an
+unseen model response. The repository and component must match the draft.
+Before writing, the command checks that the original policy and inherited
+guidance have not changed. It also rejects links that would change another
+component's guidance or a separate reporting policy in `.github` or `docs`.
+Fix those links before applying. It writes the reviewed bytes, verifies that
+the policy resolver can read them, and does not stage, commit, or publish them.
+If a write succeeded but verification failed, fix the reported problem and
+retry the same saved draft with `--write`. An exact-content retry verifies the
+installed policy without replacing it. Keep any previously reported recovery
+file until concurrent edits have been reconciled.
+
+Updates keep the previous file so a late save through an open editor handle is
+not lost. The command moves it into the private artifact directory when possible;
+otherwise it stays beside the target as `.SECURITY.md.*.previous`. The CLI prints
+the path and returns `recoveryPath` in JSON. Keep that file until other writers
+have closed it and any edits are reconciled. A `recovery_required` result means
+the replacement needs manual reconciliation. A `written_unverified` result means
+the new policy was written but verification failed. Inspect the reported paths
+before retrying. Once a write commits, SDK cancellation does not skip the
+remaining checks. A terminal interrupt or process failure can still leave a
+`written_unverified` result. A later Ctrl-C or SIGTERM forces the CLI to stop.
+
+On Windows, updates preserve the existing policy's complete security descriptor,
+including audit rules and integrity labels. If the current account cannot read or
+copy that descriptor, the existing policy is left unchanged.
+
+Save edited drafts as UTF-8. If generation used a custom `--plugin-path`, select
+it again when applying a saved draft. Saved metadata cannot choose executable
+plugin code. Both plugin directories and ZIP files are supported.
+
 The artifact directory contains:
 
 | File                   | Purpose                                                   |
 | ---------------------- | --------------------------------------------------------- |
 | `SECURITY.md`          | Editable policy draft.                                    |
 | `THREAT_MODEL.md`      | Detailed threat model with source references.             |
 | `project-spec.md`      | System description and security boundaries.               |
-| `previous-SECURITY.md` | Original policy used for the diff.                        |
+| `previous-SECURITY.md` | Original policy used for the diff and overwrite checks.   |
 | `policy-draft.json`    | Target, policy hashes, revision, model, and review notes. |
 
+An update may also retain `recovery-SECURITY-*.md` files.
+
 Keep supporting documents private until reviewed for disclosure. A generated
 threat scenario is neither owner approval nor a confirmed vulnerability.
 
 `--format md` writes the draft to stdout. `--json` returns paths, review notes,
 status, and estimated cost. Global filters and token options work with these
 formats. Progress goes to stderr. `--full-output` reports failures with
-`ok: false`. `--max-cost` applies to the whole generation. If a stage cannot
+`ok: false`. Plain `--json` retains recovery status and paths when a write
+needs attention. `--max-cost` applies to the whole generation. If a stage cannot
 inspect required source evidence, generation stops and preserves completed
 documents. Fix the reported problem and use a new output directory to retry.
 
 ### Generate a policy from TypeScript
 
 ```ts
-import { CodexSecurity } from "@openai/codex-security";
+import { CodexSecurity, applySecurityPolicy } from "@openai/codex-security";
 
 const security = new CodexSecurity();
 try {
@@ -331,6 +369,8 @@ try {
 
   console.log(await security.previewPolicy(draft));
   // Open draft.draftPath in an editor to review the saved policy.
+  // Obtain approval for this exact draft before calling:
+  // await applySecurityPolicy(draft, { pythonPath: security.config.pythonPath });
 } finally {
   await security.close();
 }
@@ -340,11 +380,20 @@ try {
 `previewPolicy()` uses the client's Python setting and makes terminal control
 characters visible. The standalone `securityPolicyDiff()` returns a raw diff
 for files or other non-terminal uses; pass an interpreter explicitly if needed.
-`generatePolicy()` accepts `auth`, `path`, `knowledgeBasePaths`, `outputDir`,
-`maxCostUsd`, `signal`, and progress and cost callbacks. An optional
+`generatePolicy()` never edits the repository. It accepts `auth`, `path`,
+`knowledgeBasePaths`, `outputDir`, `maxCostUsd`, `signal`, and progress and cost
+callbacks. An optional
 `answerQuestions` callback receives each group of up to three owner questions
 and a cancellation signal. Without it, the questions remain unresolved.
 
+Use `loadSecurityPolicyDraft(repository, artifactDirectory, { path })` to load
+an edited draft. `applySecurityPolicy()` returns `{ status, targetPath, recoveryPath }`;
+`status` is `written` or `unchanged`.
+`recoveryPath` is `null` when no existing file was replaced. Pass `{ pluginPath }`
+when applying a saved custom-plugin draft. `SecurityPolicyVerificationError` and
+`SecurityPolicyRecoveryError` identify files that need inspection or
+reconciliation.
+
 ## CLI
 
 ```bash

sdk/typescript/scripts/run-windows-ci-tests.mjs

@@ -14,7 +14,7 @@ const shardSeeds = [
   ["api-credentials.test.ts"],
   ["api.test.ts"],
   ["runtime.test.ts"],
-  ["cli-authentication.test.ts"],
+  ["cli-authentication.test.ts", "security-policy.test.ts"],
   ["scan-recovery.test.ts"],
   [],
   [],