refactor(deep-scan)!: unify execution and durable result recovery (#1123)

Consolidate Deep Scan changes and their reviewed follow-up fixes into the parent topic branch.

Author: mldangelo-oai

.github/workflows/node-ci.yml

@@ -427,6 +427,10 @@ jobs:
           pnpm --dir plugins/codex-security/mcp-app install --frozen-lockfile
       - name: Build and test the standalone host runtime
         run: node --test plugins/codex-security/mcp-app/scripts/test_host_build.mjs
+      - name: Test native executable discovery
+        run: node --test plugins/codex-security/mcp-app/tests/test_native_executable.mjs
+      - name: Test native scans and permissions
+        run: node --test plugins/codex-security/mcp-app/tests/test_native_scan.mjs plugins/codex-security/mcp-app/tests/test_native_permissions.mjs
 
   plugin-source:
     name: plugin source contracts

CONTRIBUTING.md

@@ -16,8 +16,7 @@ packages and releases. Do not edit or commit files in that directory. See the
 commands.
 
 Model-based evaluations live in [`evals/`](evals/README.md), outside the plugin
-source. Deterministic triage checks and the MCP reducer IPC regression remain
-part of normal CI.
+source. Deterministic triage checks remain part of normal CI.
 
 Search [existing issues](https://github.com/openai/codex-security/issues)
 before opening a new one.

docs/project-configuration.md

@@ -350,3 +350,12 @@ and applies its severity policy to recovered findings.
 Workflow identity records explicitly requested deep settings, not ambient values
 or shipped defaults, so changing those defaults does not prevent resumption.
 Changing the explicit request still requires a different workflow ID.
+
+### Native executable selection
+
+Native plugin sessions use `CODEX_CLI_PATH` when supplied. Otherwise they search
+for a real `codex` executable on `PATH` (`codex.exe` on Windows). Windows also
+supports managed-package installations, npm package binaries beside `PATH`
+entries, and desktop package caches. WindowsApps aliases are skipped. The
+selected executable must be outside the scan target and reference-document
+repositories. Set `CODEX_CLI_PATH` to select an installed executable explicitly.

evals/README.md

@@ -5,16 +5,12 @@ being embedded in its source tree or shipped npm runtime.
 
 - [Triage finding](triage-finding/README.md): Promptfoo input contracts, OSS
   calibration, and SastBench. This suite owns its private package and lockfile.
-- [Deep reducer](deep-reducer/README.md): optional model evaluation of real IPC
-  size-limit recovery, pagination, and finding retention. It reuses the MCP
-  test helpers and dependencies.
-- [Secret discovery](secret-discovery/README.md): checks whether the production
-  core audit finds synthetic credentials in source and keeps them in its final
-  findings, with deterministic grading and harness checks.
 
+- [Secret discovery](secret-discovery/README.md): checks synthetic credential
+  discovery with deterministic grading and harness checks.
 - [Completed-report merge](../sdk/typescript/scripts/merge-eval/README.md):
   synthetic grouping quality checks and negative controls.
 
 Model runs are opt-in. CI runs the deterministic triage and secret-discovery
-helper checks and the real-IPC reducer regression through the normal MCP test
-suite.
+helper checks. The SDK test suite includes the completed-report merge oracle
+and its negative controls.

evals/deep-reducer/.gitignore

@@ -1,25 +1,16 @@
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { createCodexSecurityArtifactWriterServer } from "./artifact-writer-main.js";
 import { createCodexSecurityServer } from "./server.js";
 
 async function main(): Promise<void> {
-  const artifactWriter = process.argv.includes("--artifact-writer");
-  const server = artifactWriter
-    ? await createCodexSecurityArtifactWriterServer()
-    : createCodexSecurityServer();
+  const server = createCodexSecurityServer();
   await server.connect(new StdioServerTransport());
   let closing = false;
   const close = async (exitCode?: number): Promise<void> => {
     if (closing) return;
     closing = true;
     if (exitCode !== undefined) process.exitCode = exitCode;
     await server.close().catch((error: unknown) => {
-      console.error(
-        artifactWriter
-          ? "Codex Security artifact writer failed to close:"
-          : "Codex Security MCP server failed to close:",
-        error,
-      );
+      console.error("Codex Security MCP server failed to close:", error);
     });
   };
   process.stdin.once("end", () => void close());
@@ -28,11 +19,6 @@ async function main(): Promise<void> {
 }
 
 main().catch((error) => {
-  console.error(
-    process.argv.includes("--artifact-writer")
-      ? "Codex Security artifact writer failed to start:"
-      : "Codex Security MCP server failed to start:",
-    error,
-  );
+  console.error("Codex Security MCP server failed to start:", error);
   process.exitCode = 1;
 });

evals/deep-reducer/README.md

@@ -11,14 +11,13 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.1",
-    "@openai/codex-sdk": "0.162.0-alpha.9",
-    "smol-toml": "1.9.0",
     "zod": "^4.6.5"
   },
   "devDependencies": {
     "@types/node": "^26.6.3",
     "esbuild": "^0.28.2",
     "prettier": "3.9.9",
+    "smol-toml": "1.9.0",
     "typescript": "^7.0.2"
   }
 }