mldangelo-oai · Sep 15, 2026 · Sep 15, 2026 · Sep 15, 2026 · Sep 15, 2026 · Sep 15, 2026
diff --git a/.github/workflows/node-ci.yml b/.github/workflows/node-ci.yml
@@ -200,7 +200,7 @@ jobs:
     name: tests / ${{ matrix.os }} / shard-${{ matrix.shard }}
     needs: [validate-title, package]
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 20
+    timeout-minutes: ${{ matrix.os == 'macos-latest' && 30 || 20 }}
     strategy:
       fail-fast: false
       matrix:
@@ -295,7 +295,9 @@ jobs:
         with:
           cache-dependency-path: plugins/codex-security/mcp-app/pnpm-lock.yaml
       - name: Install dependencies
-        run: pnpm --dir plugins/codex-security/mcp-app install --frozen-lockfile
+        run: |
+          pnpm --dir sdk/typescript install --frozen-lockfile
+          pnpm --dir plugins/codex-security/mcp-app install --frozen-lockfile
       - name: Install ripgrep
         run: |
           sudo apt-get update
@@ -326,16 +328,19 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - name: Checkout plugin source without the SDK
+      - name: Checkout plugin and shared SDK source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
             plugins/codex-security
+            sdk/typescript
             .github/actions/setup-tools
       - *set-up-mcp-tools
       - name: Install plugin dependencies
-        run: pnpm --dir plugins/codex-security/mcp-app install --frozen-lockfile
+        run: |
+          pnpm --dir sdk/typescript install --frozen-lockfile
+          pnpm --dir plugins/codex-security/mcp-app install --frozen-lockfile
       - name: Build and test the standalone host runtime
         run: node --experimental-strip-types --test plugins/codex-security/mcp-app/scripts/test_host_build.mts
 
@@ -484,7 +489,7 @@ jobs:
     name: windows-latest / node-22 / tests-${{ matrix.shard }}
     needs: [validate-title, package]
     runs-on: windows-latest
-    timeout-minutes: 25
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:

diff --git a/.github/workflows/test-quality.yml b/.github/workflows/test-quality.yml
@@ -32,7 +32,7 @@ jobs:
     if: ${{ !cancelled() && (inputs.native-artifacts-ready || needs.native.result == 'success') }}
     name: ${{ matrix.os }} / ${{ matrix.mode }}
     runs-on: ${{ matrix.os }}
-    timeout-minutes: ${{ matrix.os == 'windows-latest' && (matrix.mode == 'baseline' && 90 || matrix.mode == 'parallel' && 60) || 30 }}
+    timeout-minutes: ${{ matrix.os == 'windows-latest' && (matrix.mode == 'baseline' && 90 || matrix.mode == 'parallel' && 60 || 40) || 30 }}
     env:
       CODEX_SECURITY_PROPERTY_SEED: ${{ github.event_name == 'pull_request' && 1 || github.run_number }}
     strategy:

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -16,8 +16,7 @@ packages and releases. Do not edit or commit files in that directory. See the
 commands.
 
 Model-based evaluations live in [`evals/`](evals/README.md), outside the plugin
-source. Deterministic triage checks and the MCP reducer IPC regression remain
-part of normal CI.
+source. Deterministic triage checks remain part of normal CI.
 
 Search [existing issues](https://github.com/openai/codex-security/issues)
 before opening a new one.

diff --git a/docs/project-configuration.md b/docs/project-configuration.md
@@ -350,3 +350,11 @@ and applies its severity policy to recovered findings.
 Workflow identity records explicitly requested deep settings, not ambient values
 or shipped defaults, so changing those defaults does not prevent resumption.
 Changing the explicit request still requires a different workflow ID.
+
+### Native executable selection
+
+Native plugin sessions use `CODEX_CLI_PATH` when supplied, or a real `codex`
+executable on `PATH` (`codex.exe` on Windows). The selected executable must be
+outside the scan target. Windows npm shims, managed-package directories and
+desktop cache directories are no longer searched; set `CODEX_CLI_PATH` to the
+installed executable when it is not directly on `PATH`.
diff --git a/evals/README.md b/evals/README.md
@@ -5,13 +5,11 @@ being embedded in its source tree or shipped npm runtime.
 
 - [Triage finding](triage-finding/README.md): Promptfoo input contracts, OSS
   calibration, and SastBench. This suite owns its private package and lockfile.
-- [Deep reducer](deep-reducer/README.md): optional model evaluation of real IPC
-  size-limit recovery, pagination, and finding retention. It reuses the MCP
-  test helpers and dependencies.
+- [Completed-report merge](../sdk/typescript/scripts/merge-eval/README.md):
+  synthetic grouping quality checks and negative controls.
 - [Secret discovery](secret-discovery/README.md): checks whether the production
   core audit finds synthetic credentials in source and keeps them in its final
   findings, with deterministic grading and harness checks.
 
 Model runs are opt-in. CI runs the deterministic triage and secret-discovery
-helper checks and the real-IPC reducer regression through the normal MCP test
-suite.
+helper checks.
diff --git a/evals/deep-reducer/.gitignore b/evals/deep-reducer/.gitignore
diff --git a/evals/deep-reducer/README.md b/evals/deep-reducer/README.md
diff --git a/evals/deep-reducer/run.mts b/evals/deep-reducer/run.mts
diff --git a/plugins/codex-security/.codex-plugin/plugin.json b/plugins/codex-security/.codex-plugin/plugin.json
@@ -19,7 +19,6 @@
   "apps": "./.app.json",
   "mcpServers": "./.mcp.json",
   "codexSecurity": {
-    "directDeepScanEngine": 1,
     "workerProviderSnapshot": 4
   },
   "interface": {

diff --git a/plugins/codex-security/mcp-app/artifact-writer-main.ts b/plugins/codex-security/mcp-app/artifact-writer-main.ts
diff --git a/plugins/codex-security/mcp-app/deep-scan-main.ts b/plugins/codex-security/mcp-app/deep-scan-main.ts