refactor(plugin): port security policy resolution to TypeScript

.github/workflows/native-windows.yml

@@ -56,13 +56,17 @@ jobs:
         run: |
           node build.mjs
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          node proof-policy-windows.mjs build
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           node check.mjs
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           node --test windows-files.test.mjs
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           $nativeNode = (Get-Command node).Source
           $env:PATH = ""
           & $nativeNode --expose-gc proof-windows.mjs
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          & $nativeNode proof-policy-windows.mjs
       - name: Compare the existing Python completion lock
         run: |
           $python = (Get-Command python -ErrorAction Stop).Source
@@ -81,6 +85,8 @@ jobs:
           $nativeNode = (Get-Command node).Source
           $env:PATH = ""
           & $nativeNode --expose-gc proof-windows.mjs
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          & $nativeNode proof-policy-windows.mjs
       - name: Upload verified native artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:

plugins/codex-security/mcp-app/helpers-main.ts

@@ -0,0 +1,34 @@
+import { resolveSecurityMdCommand } from "./src/helpers/resolve-security-md";
+import { decodePosixBytes } from "./src/helpers/posix-path";
+import { windowsBinding } from "./src/native";
+
+let commandLine = process.argv.slice(2);
+if (process.platform === "win32") {
+  const original = windowsBinding().windowsArguments();
+  commandLine = original
+    .slice(original.length - commandLine.length)
+    .map((argument) => argument.toString("utf16le"));
+}
+let posixHome = process.env.HOME;
+if (commandLine[0] === "--helper") {
+  if (process.platform === "win32") {
+    commandLine = commandLine.slice(1);
+  } else {
+    const [homeSet, home, ...args] = decodePosixBytes(
+      Buffer.from(commandLine[1] ?? "", "hex"),
+    )
+      .split("\0")
+      .slice(0, -1);
+    posixHome = homeSet ? home : undefined;
+    commandLine = args;
+  }
+}
+const [command, ...args] = commandLine;
+if (command === "resolve-security-md") {
+  process.exitCode = resolveSecurityMdCommand(args, posixHome);
+} else {
+  console.error(
+    "Usage: launch_codex_security_mcp[.cmd] --helper resolve-security-md [options]",
+  );
+  process.exitCode = 2;
+}

plugins/codex-security/mcp-app/scripts/build_mcp_app.mjs

@@ -27,6 +27,7 @@ export async function buildMcpApp({ output }) {
     await mkdir(dirname(destination), { recursive: true });
     await copyFile(join(root, "../native/prebuilt", path), destination);
   }
+  await writeRuntime("helpers", "helpers-main.ts");
 
   async function writeRuntime(name, entryPoint) {
     const bundle = join(mcpDir, name + ".bundle.cjs");

plugins/codex-security/mcp-app/src/helpers/posix-path.ts

@@ -0,0 +1,88 @@
+const utf8 = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+
+export function decodePosixBytes(bytes: Buffer): string {
+  try {
+    return utf8.decode(bytes);
+  } catch {
+    // Match Python's surrogateescape for undecodable POSIX path bytes.
+    let value = "";
+    for (let offset = 0; offset < bytes.length; ) {
+      let decoded = false;
+      for (let size = 1; size <= 4 && offset + size <= bytes.length; size++) {
+        try {
+          value += utf8.decode(bytes.subarray(offset, offset + size));
+          offset += size;
+          decoded = true;
+          break;
+        } catch {
+          // A UTF-8 character can occupy up to four bytes.
+        }
+      }
+      if (!decoded) value += String.fromCharCode(0xdc00 + bytes[offset++]!);
+    }
+    return value;
+  }
+}
+
+export function encodePosixPath(value: string): Buffer {
+  return Buffer.concat(
+    value
+      .split(/([\udc80-\udcff])/u)
+      .map((part) =>
+        /^[\udc80-\udcff]$/u.test(part)
+          ? Buffer.from([part.charCodeAt(0) - 0xdc00])
+          : Buffer.from(part),
+      ),
+  );
+}
+
+export class SymlinkLoopError extends Error {}
+
+export function resolvePosixPath(value: Buffer): Buffer {
+  // GNU Linux native realpath rejects file/.. and links targeting it with
+  // ENOTDIR. Retain the shipped pathlib contract for those inputs.
+  const seen = new Map<string, string | null>();
+  // Latin-1 is a lossless internal representation of pathname bytes.
+  function follow(directory: string, path: string): string {
+    if (path.startsWith("/")) directory = "/";
+    for (const name of path.split("/")) {
+      if (name === "" || name === ".") continue;
+      if (name === "..") {
+        directory = directory.slice(0, directory.lastIndexOf("/")) || "/";
+        continue;
+      }
+      const candidate = `${directory === "/" ? "" : directory}/${name}`;
+      const bytes = Buffer.from(candidate, "latin1");
+      if (!lstatSync(bytes).isSymbolicLink()) {
+        directory = candidate;
+        continue;
+      }
+      const cached = seen.get(candidate);
+      if (cached === null) {
+        throw new SymlinkLoopError(
+          `Symlink loop from ${decodePosixBytes(bytes)}`,
+        );
+      }
+      if (cached !== undefined) {
+        directory = cached;
+        continue;
+      }
+      seen.set(candidate, null);
+      directory = follow(
+        directory,
+        readlinkSync(bytes, { encoding: "buffer" }).toString("latin1"),
+      );
+      seen.set(candidate, directory);
+    }
+    return directory;
+  }
+  const cwd =
+    value[0] === 0x2f
+      ? Buffer.from("/")
+      : realpathSync.native(".", { encoding: "buffer" });
+  return Buffer.from(
+    follow(cwd.toString("latin1"), value.toString("latin1")),
+    "latin1",
+  );
+}
+import { lstatSync, readlinkSync, realpathSync } from "node:fs";