refactor(deep-scan): compose ordinary scans and merge their results

.github/workflows/node-ci.yml

@@ -390,13 +390,17 @@ jobs:
         with:
           package_json_file: package.json
           cache: true
-          cache_dependency_path: plugins/codex-security/mcp-app/pnpm-lock.yaml
+          cache_dependency_path: |
+            sdk/typescript/pnpm-lock.yaml
+            plugins/codex-security/mcp-app/pnpm-lock.yaml
       - name: Set up Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22.13.0"
       - name: Install dependencies
-        run: pnpm --dir plugins/codex-security/mcp-app install --frozen-lockfile
+        run: |
+          pnpm --dir sdk/typescript install --frozen-lockfile
+          pnpm --dir plugins/codex-security/mcp-app install --frozen-lockfile
       - name: Install ripgrep
         run: |
           sudo apt-get update

.github/workflows/test-quality.yml

@@ -99,6 +99,7 @@ jobs:
         run: ./sdk/typescript/scripts/prepare-windows-test-root.ps1
       - name: Test runner mode
         env:
+          CODEX_SECURITY_TEST_TIMEOUT_MS: ${{ runner.os == 'Windows' && '120000' || '30000' }}
           TEMP: ${{ steps.windows-temp.outputs.path || runner.temp }}
           TMP: ${{ steps.windows-temp.outputs.path || runner.temp }}
           TMPDIR: ${{ steps.windows-temp.outputs.path || runner.temp }}

plugins/codex-security/mcp-app/main.ts

@@ -1,12 +1,8 @@
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { createCodexSecurityArtifactWriterServer } from "./artifact-writer-main.js";
 import { createCodexSecurityServer } from "./server.js";
 
 async function main(): Promise<void> {
-  const artifactWriter = process.argv.includes("--artifact-writer");
-  const server = artifactWriter
-    ? await createCodexSecurityArtifactWriterServer()
-    : createCodexSecurityServer();
+  const server = createCodexSecurityServer();
   await server.connect(new StdioServerTransport());
   let closing = false;
   const close = async (exitCode?: number): Promise<void> => {
@@ -15,9 +11,7 @@ async function main(): Promise<void> {
     if (exitCode !== undefined) process.exitCode = exitCode;
     await server.close().catch((error: unknown) => {
       console.error(
-        artifactWriter
-          ? "Codex Security artifact writer failed to close:"
-          : "Codex Security MCP server failed to close:",
+        "Codex Security MCP server failed to close:",
         error
       );
     });
@@ -29,9 +23,7 @@ async function main(): Promise<void> {
 
 main().catch((error) => {
   console.error(
-    process.argv.includes("--artifact-writer")
-      ? "Codex Security artifact writer failed to start:"
-      : "Codex Security MCP server failed to start:",
+    "Codex Security MCP server failed to start:",
     error
   );
   process.exitCode = 1;

plugins/codex-security/mcp-app/scripts/build_mcp_app.mjs

@@ -1,12 +1,14 @@
 #!/usr/bin/env node
 import { copyFile, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
+import { createRequire } from "node:module";
 import { pathToFileURL } from "node:url";
 import { brotliCompressSync, constants as zlibConstants } from "node:zlib";
 import { execFileSync } from "node:child_process";
 import { build } from "esbuild";
 
 const root = resolve(import.meta.dirname, "..");
+const sdkRequire = createRequire(join(root, "../../../sdk/typescript/package.json"));
 const maxChunkBytes = 140_000;
 
 export async function buildMcpApp({ output }) {
@@ -34,8 +36,10 @@ export async function buildMcpApp({ output }) {
     try {
       await build({
         bundle: true,
-        define: { "import.meta.url": "__filename" },
+        banner: { js: "const __codexSecurityModuleUrl = require('node:url').pathToFileURL(__filename).href;" },
+        define: { "import.meta.url": "__codexSecurityModuleUrl" },
         entryPoints: [join(root, entryPoint)],
+        inject: name === "server" ? [sdkRequire.resolve("pdfjs-dist/legacy/build/pdf.worker.mjs")] : [],
         external: ["fsevents"],
         format: "cjs",
         loader: { ".md": "text" },