test: split Windows CI and test the installed package

[mldangelo-oai]

Part 1 of 46. Next: #1103 · Stack index

Summary

Split the Windows isolated test run into seven jobs and move launcher checks into the installed-package smoke test. Also fix a Windows credential ACL reader race that could lose buffered output when its subprocess exited.

Changes

• Use Bun 1.4.2 for runner quality checks, shard Windows isolated mode, and compare combined reports with the baseline. Update terminal fixtures to check rendering across Bun versions.
• Exercise the installed command with Node environment options and an unavailable working directory.
• Check package filenames, metadata and decoded contents, including assets split across compressed files.

Testing

Final-head node-ci passed at d15e40d: 66 jobs passed and one was skipped. The first Ubuntu isolated-test attempt timed out; its diagnostic rerun passed on unchanged code with 3,369 tests, 51 skips, and no failures. The dependent inventory comparison passed too. Post-merge node-ci passed at 688e2ae (45 jobs passed, one skipped).

• Full SDK suites with Bun 1.4.2 at 18fcffc: seeded (12345) and randomized (3621653093) runs each passed 3,367 tests with 51 platform-specific skips and no failures.
• At the final merged head d15e40d, 751 focused tests passed with ten platform-specific skips, covering model defaults, API and CLI behavior, dedupe and comparison, and terminal rendering. The Deep Scan worker boundary suite also passed.
• All five portable plugin checks, the plugin bundle, SDK build, types, formatting, and diff checks passed.
• Actionlint 1.7.12 with ShellCheck 0.11.0 and zizmor 1.30.1 passed.
• Three fresh native Codex reviews and independent verification completed with no findings.
• The final-head package archive and installed-package smoke checks passed using a real npm install.

Risk and rollout

CI and package validation change immediately. The ACL reader keeps the existing permission checks while draining complete and partial stdout lines through EOF. No public command or option changes.

Review the stack

This stack combines the Deep Scan work from #939 and #1095. Each Deep Scan pass becomes an ordinary Standard scan; a separate merge step combines the saved findings and evidence. It includes the approved review fixes and simplifications.

Parts 1–19 extract shared scan behavior and introduce child tracking, merging and recovery. Parts 20–38 finish settings, packaging and saved-result handling. Part 39 switches the SDK, and part 40 switches the plugin. Parts 41–46 remove the retired implementation.

Review in order against each PR’s selected base. Part 1 targets main; every later PR targets the preceding branch. The individual descriptions distinguish changes active at that step from helpers connected later.

Part	Pull request
1	test: split Windows CI and test the installed package
2	fix: preserve each scan's severity assessments
3	fix: reuse matching plugin installations at startup
4	refactor: prepare each scan's environment and authentication
5	refactor: extract scan startup and add worker permission checks
6	refactor: reuse scan settings when comparing findings
7	refactor: separate scan events, progress, and cost reporting
8	refactor: extract scan registration and result saving
9	refactor: share scan result preparation between the SDK and plugin
10	feat: record which scans belong to a Deep Scan
11	test: cover saved severity assessment caching
12	feat: copy verified child scan results into a Deep Scan
13	fix: keep scan drafts when saving results fails
14	refactor: merge findings without rewriting their evidence
15	refactor: schedule Deep Scan passes and resume saved progress
16	fix: preserve cost records when scans stop or resume
17	fix!: prepare recovery of sealed scan results
18	refactor(plugin): prepare scans with the caller's Codex settings
19	refactor(plugin): let callers wait on the same scan
20	fix(sdk): install the dependency required by SDK types
21	fix: preserve dots in Codex configuration keys
22	refactor: reuse prepared settings for Deep Scan workers
23	refactor: reuse scan settings for comparison and validation
24	refactor: prepare reusable reference document snapshots
25	refactor(plugin): share Codex executable lookup
26	build(plugin): bundle SDK document reader dependencies
27	refactor: store scan sessions in SQLite
28	fix: keep follow-up output separate from completed scans
29	refactor: link merged findings to original writeups
30	fix: include retained evidence in merged reports
31	fix: save scan drafts before exporting results
32	refactor: separate old worker draft handling
33	fix!: update draft findings using saved IDs
34	test: cover stopped scan draft recovery
35	refactor(deep-scan)!: reuse finding matching and save merge progress
36	fix: preserve native scan settings when resuming
37	fix: complete Deep Scans from saved child results
38	fix: load sealed scan results without starting Codex
39	refactor(sdk)!: run Deep Scan passes as Standard scans
40	refactor(deep-scan)!: run plugin Deep Scans through the SDK
41	refactor: remove unused scan result helpers
42	refactor: remove retired Deep Scan recovery routes
43	refactor: delete the retired coordinator and store
44	refactor: delete the retired worker runtime
45	refactor: delete the legacy Python scan engine
46	refactor: delete the retired worker result protocol

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-01T22:01:08.418659Z	d15e40d	Manual request
🔒 Security Review	✅ Completed 2026-10-01T22:02:53.222681Z	d15e40d	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: f2c3eed65b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Copilot review overview

🟢 Approval recommended

The CI and package-verification changes are coherent, targeted, and directly covered by tests.

Review effort: Balanced
Findings: None

What changed in this PR

Improves CI reliability and validates installed npm package contents more thoroughly.

Changes:

• Shards Windows isolated tests, updates Bun, and adjusts timeout/report handling.
• Moves launcher verification into installed-package smoke tests.
• Scans package paths, metadata, plaintext, and expanded Brotli assets for internal references.

File	Description
.github/​workflows/​node-ci.yml	Lets test steps use job-level deadlines.
.github/​workflows/​test-quality.yml	Updates Bun, Windows sharding, timeouts, and report comparison.
sdk/​typescript/​scripts/​check-package.mjs	Integrates package-content validation.
sdk/​typescript/​scripts/​package-public-content.mjs	Validates public paths, metadata, and compressed assets.
sdk/​typescript/​scripts/​smoke-package.mjs	Tests the installed CLI launcher.
sdk/​typescript/​tests-ts/​cli-launcher.test.ts	Removes duplicated source-build launcher coverage.
sdk/​typescript/​tests-ts/​package-public-content.test.ts	Covers package-content validation behavior.
sdk/​typescript/​tests-ts/​test-reports.test.ts	Accounts for sharded report patterns.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[soyeon-oai]

Reviewed current ACL EOF/chunk handling and its callers, package-content validation, launcher smoke coverage, and Windows sharding/inventory checks. No actionable findings. The earlier Bun regression in discussion_r4146928685 is addressed by current test changes: the Windows baseline log shows Bun 1.4.2, both cited terminal tests and both ACL EOF cases passing (3234 pass, 0 fail): https://github.com/openai/codex-security/actions/runs/36877426698/job/110423108643 . Hosted CI inspected; no independent execution.

[alandelong-oai]

The Windows ACL reader now drains buffered descriptors through EOF, while package checks validate decoded contents and the installed launcher. Three independent high-reasoning reviews plus source verification found no new actionable findings.

Validation at 75d6f5cb78812d7967ae03d641c4f32922274049: 110 package-content, publication, dashboard, and report tests passed under Bun 1.4.2; three focused ACL streaming/failure tests passed. The earlier terminal-test issue in discussion_r4146928685 is addressed by the current changes. Full installed-package and native Windows execution were not run locally.

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 75d6f5cb78

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Copilot review overview

🟢 Approval recommended

The CI, package-validation, and ACL-streaming changes are coherent and adequately tested.

Review effort: Balanced
Findings: None

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: d15e40d2ce

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Copilot review overview

🔵 Needs a closer look

Credential ACL processing and public-package disclosure validation are security-sensitive changes requiring final human review.

Review effort: Balanced
Findings: None

[alandelong-oai]

Re-reviewed the updated PR at d15e40d against base 794e046 with three fresh independent high-reasoning passes and root verification. No actionable findings remain in this diff.

Validation: 287 focused tests passed (22 platform-specific skips), SDK/MCP typechecks and formatting passed, clean plugin/SDK builds passed, and the 528-entry installed package passed CLI, SDK lifecycle, credential-locking, MCP initialization, and nested-worker checks. Checks were rerun after refreshing dependencies to this commit's lockfiles. Local execution was on macOS; native Windows CI is still running. This approval does not imply the rest of the stack is ready to merge.