refactor(deep-scan)!: run plugin Deep Scans through the SDK

Author: codex

docs/project-configuration.md

@@ -348,3 +348,11 @@ and applies its severity policy to recovered findings.
 Workflow identity records explicitly requested deep settings, not ambient values
 or shipped defaults, so changing those defaults does not prevent resumption.
 Changing the explicit request still requires a different workflow ID.
+
+### Native executable selection
+
+Native plugin sessions use `CODEX_CLI_PATH` when supplied, or a real `codex`
+executable on `PATH` (`codex.exe` on Windows). The selected executable must be
+outside the scan target. Windows npm shims, managed-package directories and
+desktop cache directories are no longer searched; set `CODEX_CLI_PATH` to the
+installed executable when it is not directly on `PATH`.

plugins/codex-security/mcp-app/main.ts

@@ -1,25 +1,16 @@
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { createCodexSecurityArtifactWriterServer } from "./artifact-writer-main.js";
 import { createCodexSecurityServer } from "./server.js";
 
 async function main(): Promise<void> {
-  const artifactWriter = process.argv.includes("--artifact-writer");
-  const server = artifactWriter
-    ? await createCodexSecurityArtifactWriterServer()
-    : createCodexSecurityServer();
+  const server = createCodexSecurityServer();
   await server.connect(new StdioServerTransport());
   let closing = false;
   const close = async (exitCode?: number): Promise<void> => {
     if (closing) return;
     closing = true;
     if (exitCode !== undefined) process.exitCode = exitCode;
     await server.close().catch((error: unknown) => {
-      console.error(
-        artifactWriter
-          ? "Codex Security artifact writer failed to close:"
-          : "Codex Security MCP server failed to close:",
-        error,
-      );
+      console.error("Codex Security MCP server failed to close:", error);
     });
   };
   process.stdin.once("end", () => void close());
@@ -28,11 +19,6 @@ async function main(): Promise<void> {
 }
 
 main().catch((error) => {
-  console.error(
-    process.argv.includes("--artifact-writer")
-      ? "Codex Security artifact writer failed to start:"
-      : "Codex Security MCP server failed to start:",
-    error,
-  );
+  console.error("Codex Security MCP server failed to start:", error);
   process.exitCode = 1;
 });