feat(deep-scan): resume from accepted worker results

.github/workflows/node-ci.yml

@@ -345,13 +345,14 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - name: Checkout plugin source without the SDK
+      - name: Checkout plugin and shared SDK source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
             plugins/codex-security
             .github/actions/setup-tools
+            sdk/typescript
       - *set-up-mcp-tools
       - name: Install plugin dependencies
         run: pnpm --dir plugins/codex-security/mcp-app install --frozen-lockfile

plugins/codex-security/mcp-app/deep-scan-main.ts

@@ -9,11 +9,30 @@ import { startDeepScanEngine } from "./src/deep-scan/engine.js";
 import { resolveDeepWorkerParentSandbox } from "./src/deep-scan/parent-sandbox.js";
 import { DeepScanCoordinatorRegistry } from "./src/deep-scan/registry.js";
 import { WorkbenchDeepScanStore } from "./src/deep-scan/store.js";
+import {
+  beginDeepScanWithCapturedSettings,
+  captureDeepScanExecutionSettings,
+} from "./src/deep-scan/recovery-settings.js";
 
 /** Private SDK entry point. The child process isolates each scan's environment. */
 export async function runCliDeepScan(): Promise<void> {
-  const runWorkbench = (args: string[], input?: string | Buffer) =>
-    runWorkbenchCommand(args, input, { isolatedPython: true });
+  const runWorkbench = (
+    args: string[],
+    input?: string | Buffer,
+    selectFinalization?: boolean,
+    withExecutionSettings?: boolean,
+    signal?: AbortSignal,
+    releaseCoordinator?: boolean,
+  ) =>
+    runWorkbenchCommand(
+      args,
+      input,
+      selectFinalization,
+      withExecutionSettings,
+      signal,
+      releaseCoordinator,
+      true,
+    );
   const lines = createInterface({ input: process.stdin, crlfDelay: Infinity });
   const registry = new DeepScanCoordinatorRegistry();
   const controller = new AbortController();
@@ -49,13 +68,24 @@ export async function runCliDeepScan(): Promise<void> {
     });
     if (controller.signal.aborted)
       throw new Error("Deep Scan canceled before coordinator startup.");
-    const run = await store.begin({
-      scanId: input.scanId,
-      threadId: input.threadId,
-      model: input.model,
-      reasoningEffort: input.reasoningEffort,
-      scanRoot: join(process.env.CODEX_SECURITY_STATE_DIR!, "scans"),
-    });
+    const run = await beginDeepScanWithCapturedSettings(
+      () =>
+        captureDeepScanExecutionSettings(
+          { model: input.model, reasoningEffort: input.reasoningEffort },
+          parentSandbox,
+          process.env,
+          { threadId: input.threadId, startedAt: new Date().toISOString() },
+        ),
+      (executionSettings) =>
+        store.begin({
+          executionSettings,
+          scanId: input.scanId,
+          threadId: input.threadId,
+          model: input.model,
+          reasoningEffort: input.reasoningEffort,
+          scanRoot: join(process.env.CODEX_SECURITY_STATE_DIR!, "scans"),
+        }),
+    );
     if (controller.signal.aborted)
       throw new Error("Deep Scan canceled before coordinator startup.");
     let terminal = run;

plugins/codex-security/mcp-app/helpers-main.ts

@@ -19,7 +19,9 @@ import { bindRepoScopesCommand } from "./src/helpers/bind-repo-scopes";
 import { escapeControls, stringifyJson } from "./src/helpers/json";
 import { decodeUtf8 } from "./src/helpers/utf8";
 
-// Importing the bundled parser does not invoke its CLI adapter.
+export { resumeSelectedDeepScan } from "./src/deep-scan/finalization.js";
+
+// Importing the bundled helper from the SDK does not invoke its CLI adapter.
 const entryPath = import.meta.url.startsWith("file:")
   ? fileURLToPath(import.meta.url)
   : import.meta.url;

plugins/codex-security/mcp-app/package.json

@@ -6,18 +6,20 @@
   "scripts": {
     "build": "node scripts/generate-artifact-schemas.mjs && tsc --noEmit",
     "build:mcp": "node scripts/build_mcp_app.mjs --output .preview/mcp",
-    "test:mcp": "node --experimental-strip-types --test --test-concurrency=2 --test-reporter=./scripts/test_reporter.mts \"tests/test_*.ts\"",
+    "test:mcp": "node --experimental-strip-types --test --test-concurrency=2 --test-reporter=./scripts/test_reporter.mts \"tests/test_*.ts\" \"tests/test_*.mjs\"",
     "typecheck": "node scripts/generate-artifact-schemas.mjs --check && tsc --noEmit"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.32.1",
     "@openai/codex-sdk": "0.163.0",
     "ajv": "8.20.0",
     "smol-toml": "1.9.1",
+    "yauzl": "3.4.0",
     "zod": "^4.6.7"
   },
   "devDependencies": {
     "@types/node": "^26.6.5",
+    "@types/yauzl": "3.4.0",
     "esbuild": "^0.28.2",
     "prettier": "3.9.10",
     "typescript": "^7.0.2"

plugins/codex-security/mcp-app/scripts/build_mcp_app.mjs

@@ -97,6 +97,7 @@ export async function buildMcpApp({ output, native = "universal" }) {
       loader: { ".md": "text" },
       logLevel: "info",
       logOverride: { "empty-import-meta": "silent" },
+      nodePaths: [join(root, "node_modules")],
       outfile: bundle,
       platform: "node",
       plugins: [