refactor(plugin): migrate candidate normalization to TypeScript

plugins/codex-security/mcp-app/src/artifact-discovery.ts

@@ -17,7 +17,6 @@ import {
   type SchemaDocument
 } from "./artifact-schema-loader.js";
 import { candidateSchemaV1 } from "./deep-scan/artifact-contracts.js";
-import { missingPythonHelperMessage, resolvePythonCommand } from "./python_command.js";
 
 const execFileAsync = promisify(execFile);
 const discoveryComponents = ["artifacts", "02_discovery"] as const;
@@ -137,7 +136,7 @@ export async function recordCodexSecurityDiscoveryCandidates(
   const inventoryComponents = [...discoveryComponents, "in_scope_files.txt"];
   const candidateComponents = [...discoveryComponents, "candidate_ledger.jsonl"];
 
-  // Verify the inventory is a context-bound regular file before passing it to Python.
+  // Verify the inventory is a context-bound regular file before normalization.
   await readArtifactText(context, inventoryComponents, "discovery review inventory");
   const inventoryPath = await artifactDestination(
     context,
@@ -161,12 +160,11 @@ export async function recordCodexSecurityDiscoveryCandidates(
       mode: 0o600
     });
 
-    const pythonCommand = context.pythonCommand ?? await resolvePythonCommand();
     try {
       await execFileAsync(
-        pythonCommand,
+        process.execPath,
         [
-          join(pluginRoot, "scripts", "normalize_candidates.py"),
+          join(pluginRoot, "scripts", "normalize_candidates.mjs"),
           "--input",
           temporaryInput,
           "--out",
@@ -184,7 +182,7 @@ export async function recordCodexSecurityDiscoveryCandidates(
         }
       );
     } catch (error) {
-      throw discoveryNormalizationError(error, pythonCommand, [
+      throw discoveryNormalizationError(error, [
         [temporaryInput, "candidate input"],
         [temporaryDirectory, "private candidate input"],
         [inventoryPath, "the assigned review inventory"],
@@ -226,14 +224,8 @@ export async function listCodexSecurityCandidates(
 
 function discoveryNormalizationError(
   error: unknown,
-  pythonCommand: string,
   privateValues: Array<readonly [string, string]>
 ): Error {
-  const pythonMessage = missingPythonHelperMessage(error, pythonCommand);
-  if (pythonMessage) {
-    return new Error(`${discoveryLabel}: ${pythonMessage}`, { cause: error });
-  }
-
   const stderr = error && typeof error === "object" && "stderr" in error
     ? error.stderr
     : undefined;

plugins/codex-security/mcp-app/tests/test_artifact_discovery.mjs

@@ -34,7 +34,9 @@ const {
   `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].contents).toString("base64")}`
 );
 
-const pluginRoot = fileURLToPath(new URL("../../", import.meta.url));
+const pluginRoot = process.env.CODEX_SECURITY_TEST_PLUGIN_ROOT
+  ? path.resolve(process.env.CODEX_SECURITY_TEST_PLUGIN_ROOT)
+  : fileURLToPath(new URL("../../../../sdk/typescript/_bundled_plugin/", import.meta.url));
 const definitions = JSON.parse(await readFile(path.join(
   pluginRoot,
   "schemas",
@@ -388,7 +390,8 @@ async function createContext(root, repoRoot, name, layout) {
     root: artifactRoot,
     repoRoot,
     layout,
-    pluginRoot
+    pluginRoot,
+    pythonCommand: path.join(root, "missing-python")
   };
 }
 

plugins/codex-security/mcp-app/tests/test_compact_artifact_server.mjs

@@ -13,8 +13,7 @@ const applicationRoot = path.resolve(
   path.dirname(fileURLToPath(import.meta.url)),
   ".."
 );
-const pluginRoot = path.resolve(applicationRoot, "..");
-const bundledPluginRoot = process.env.CODEX_SECURITY_TEST_PLUGIN_ROOT
+const pluginRoot = process.env.CODEX_SECURITY_TEST_PLUGIN_ROOT
   ? path.resolve(process.env.CODEX_SECURITY_TEST_PLUGIN_ROOT)
   : path.resolve(applicationRoot, "../../../sdk/typescript/_bundled_plugin");
 const temporaryRoot = await mkdtemp(path.join(tmpdir(), "codex-security-artifact-mcp-"));
@@ -30,7 +29,7 @@ try {
   await testDiscoveryWorkerToolList(runtimeBundle);
   await testReducerWorkerToolList(runtimeBundle);
 
-  const shippedRuntime = path.join(bundledPluginRoot, "mcp", "server.mjs");
+  const shippedRuntime = path.join(pluginRoot, "mcp", "server.mjs");
   await testParentToolList(shippedRuntime);
   await testClaimedParentArtifactOperations(shippedRuntime, "shipped");
   await testSemanticScanDraftCompletion(shippedRuntime, "shipped");
@@ -1179,7 +1178,7 @@ async function bundleEntrypoint(entrypoint, outfile) {
   await build({
     bundle: true,
     define: {
-      __dirname: JSON.stringify(applicationRoot),
+      __dirname: JSON.stringify(path.join(pluginRoot, "mcp")),
       "import.meta.url": "__filename"
     },
     entryPoints: [path.join(applicationRoot, entrypoint)],

plugins/codex-security/plugin-files.json

@@ -50,7 +50,7 @@
     "scripts/generate_rank_input.py",
     "scripts/launch_codex_security_mcp",
     "scripts/launch_codex_security_mcp.cmd",
-    "scripts/normalize_candidates.py",
+    "scripts/normalize_candidates.mjs",
     "scripts/rank_preview.py",
     "scripts/report_projection.py",
     "scripts/resolve_security_md.py",