fix(plugin): pin Deep Scan worker executable

[soyeon-oai]

Summary

Keep every worker in a live Deep Scan coordinator on the Codex executable selected for its first worker. Stop safely with retained partial results if that executable changes or disappears.

Changes

• Cache the selected executable path and file identity per worker executor.
• Verify the identity before permission preflight and again at the SDK launch boundary.
• Treat a changed or missing executable as a non-retryable worker-start failure.
• Add regressions for environment path drift, replacement between workers, and replacement after preflight.
• Bump the MCP app version to 0.1.159.

Testing

• node tests/test_deep_scan_executor.mjs
• pnpm run typecheck
• pnpm run build:mcp
• node scripts/build-plugin.mjs
• pnpm run test:mcp (23/23 passed)
• python .github/scripts/check_plugin_source_compatibility.py
• python -m ruff check --config plugins/codex-security/pyproject.toml .github/scripts/check_plugin_source_compatibility.py .github/scripts/test_check_plugin_source_compatibility.py plugins/codex-security
• python -m ruff format --check --config plugins/codex-security/pyproject.toml .github/scripts/check_plugin_source_compatibility.py .github/scripts/test_check_plugin_source_compatibility.py plugins/codex-security

Risk and rollout

The executor now fails closed when the selected executable changes during a scan. Completed work remains available as retained partial results. Existing scans that keep a stable executable are unchanged. CI should provide the Windows coverage for executable identity checks.

Public disclosure review

• No customer, internal-system, private-repository, or nonpublic incident details are included.
• No credentials, tokens, private URLs, or sensitive identifiers are included.
• I reviewed the branch name, commit message, diff, and pull request text for public disclosure.

Change impact

A live Deep Scan reuses one CLI path and stops before launching a worker if that file changes.

flowchart LR
  subgraph column_0["Scan coordinator"]
    direction TB
    node_0["One executor per live scan<br/><code>startOrJoinDeepScanCoordinator</code>"]
  end
  subgraph column_1["Executable checks"]
    direction TB
    node_1["Pin path and file identity<br/><code>CodexSdkWorkerExecutor</code>"]
    node_2["Check permissions on pinned CLI<br/><code>preflightDeepScanWorkerPermissionProfile</code>"]
    node_3["Recheck at worker launch<br/><code>runStreamed</code>"]
  end
  subgraph column_2["Worker outcome"]
    direction TB
    node_4["Run one CLI or stop safely"]
    node_5["Keep shutdown coverage isolated<br/><code>deep-scan-worker-shutdown.test.ts</code>"]
  end
  node_0 -->|"owns"| node_1
  node_1 -->|"supplies path"| node_2
  node_2 -->|"then rechecks"| node_3
  node_3 -->|"runs or stops"| node_4
  node_3 -->|"stays testable"| node_5
  class node_0 context
  class node_1 changed
  class node_2 affected
  class node_3 changed
  class node_4 affected
  class node_5 changed
  classDef changed fill:#d7f5e5,stroke:#237a4b,color:#111
  classDef affected fill:#e6f0ff,stroke:#3569a8,color:#111
  classDef context fill:#f2f3f5,stroke:#6e7781,color:#111

Loading

Limits: The launch identity check is adjacent to, but not atomic with, OS process creation. · Local validation ran on macOS; exact-head Windows CI was still pending.

Source evidence (6)

• plugins/codex-security/mcp-app/server.ts:L658-L673 — The scan coordinator receives one CodexSdkWorkerExecutor instance with its scan context.
• plugins/codex-security/mcp-app/src/deep-scan/executor.ts:L53-L85 — The executor caches the first selected executable and gives the same path to permission preflight and the SDK.
• plugins/codex-security/mcp-app/src/deep-scan/executor.ts:L125-L129 — The executor verifies the pinned file identity immediately before runStreamed starts the worker.
• plugins/codex-security/mcp-app/src/deep-scan/executor.ts:L396-L462 — Identity changes or missing files produce a non-retryable error that preserves completed partial-scan work.
• plugins/codex-security/mcp-app/tests/test_deep_scan_executor.mjs:L540-L654 — The tests prove path pinning and fail-closed behavior for replacements between workers and after preflight.
• sdk/typescript/tests-ts/deep-scan-worker-shutdown.test.ts:L51-L84 — The isolated shutdown tests receive stubs for the two new executable-binding dependencies.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-31T18:13:54.970683Z	8748d44	PR opened
🔒 Security Review	✅ Completed 2026-08-31T18:22:59.945507Z	7bc07b0	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[sylvesterkaczmarek]

The final identity check still has a TOCTOU gap: the path can be replaced after verifyBoundCodexExecutable() returns but before the SDK actually spawns it. Preflight and the worker can therefore still execute different binaries. Pin a scan-owned immutable copy (or equivalent atomic binding) and test replacement at spawn time.