refactor(plugin): port candidate normalization to TypeScript

plugins/codex-security/mcp-app/helpers-main.ts

@@ -1,6 +1,8 @@
+import { closeSync, readFileSync } from "node:fs";
 import { resolveSecurityMdCommand } from "./src/helpers/resolve-security-md";
 import { decodePosixBytes } from "./src/helpers/posix-path";
 import { windowsBinding } from "./src/native";
+import { normalizeCandidatesCommand } from "./src/helpers/normalize-candidates";
 
 let commandLine = process.argv.slice(2);
 if (process.platform === "win32") {
@@ -14,8 +16,10 @@ if (commandLine[0] === "--helper") {
   if (process.platform === "win32") {
     commandLine = commandLine.slice(1);
   } else {
+    const encoded = readFileSync(3, "ascii");
+    closeSync(3);
     const [homeSet, home, ...args] = decodePosixBytes(
-      Buffer.from(commandLine[1] ?? "", "hex"),
+      Buffer.from(encoded.trim(), "hex"),
     )
       .split("\0")
       .slice(0, -1);
@@ -26,9 +30,11 @@ if (commandLine[0] === "--helper") {
 const [command, ...args] = commandLine;
 if (command === "resolve-security-md") {
   process.exitCode = resolveSecurityMdCommand(args, posixHome);
+} else if (command === "normalize-candidates") {
+  process.exitCode = normalizeCandidatesCommand(args, posixHome);
 } else {
   console.error(
-    "Usage: launch_codex_security_mcp[.cmd] --helper resolve-security-md [options]",
+    "Usage: launch_codex_security_mcp[.cmd] --helper <resolve-security-md | normalize-candidates> [options]",
   );
   process.exitCode = 2;
 }

plugins/codex-security/mcp-app/src/artifact-discovery.ts

@@ -17,10 +17,6 @@ import {
   type SchemaDocument,
 } from "./artifact-schema-loader.js";
 import { candidateSchemaV1 } from "./deep-scan/artifact-contracts.js";
-import {
-  missingPythonHelperMessage,
-  resolvePythonCommand,
-} from "./python_command.js";
 
 const execFileAsync = promisify(execFile);
 const discoveryComponents = ["artifacts", "02_discovery"] as const;
@@ -144,7 +140,7 @@ export async function recordCodexSecurityDiscoveryCandidates(
     "candidate_ledger.jsonl",
   ];
 
-  // Verify the inventory is a context-bound regular file before passing it to Python.
+  // Verify the inventory is a context-bound regular file before normalization.
   await readArtifactText(
     context,
     inventoryComponents,
@@ -167,23 +163,21 @@ export async function recordCodexSecurityDiscoveryCandidates(
 
   try {
     await fs.chmod(temporaryDirectory, 0o700);
-    const content =
-      candidates.length === 0
-        ? ""
-        : `${candidates.map((candidate) => JSON.stringify(candidate)).join("\n")}\n`;
+    const content = candidates
+      .map((candidate) => `${JSON.stringify(candidate)}\n`)
+      .join("");
     await fs.writeFile(temporaryInput, content, {
       encoding: "utf8",
       flag: "wx",
       mode: 0o600,
     });
 
-    const pythonCommand =
-      context.pythonCommand ?? (await resolvePythonCommand());
     try {
       await execFileAsync(
-        pythonCommand,
+        process.execPath,
         [
-          join(pluginRoot, "scripts", "normalize_candidates.py"),
+          join(pluginRoot, "mcp", "helpers.mjs"),
+          "normalize-candidates",
           "--input",
           temporaryInput,
           "--out",
@@ -201,7 +195,7 @@ export async function recordCodexSecurityDiscoveryCandidates(
         },
       );
     } catch (error) {
-      throw discoveryNormalizationError(error, pythonCommand, [
+      throw discoveryNormalizationError(error, [
         [temporaryInput, "candidate input"],
         [temporaryDirectory, "private candidate input"],
         [inventoryPath, "the assigned review inventory"],
@@ -245,14 +239,8 @@ export async function listCodexSecurityCandidates(
 
 function discoveryNormalizationError(
   error: unknown,
-  pythonCommand: string,
   privateValues: Array<readonly [string, string]>,
 ): Error {
-  const pythonMessage = missingPythonHelperMessage(error, pythonCommand);
-  if (pythonMessage) {
-    return new Error(`${discoveryLabel}: ${pythonMessage}`, { cause: error });
-  }
-
   const stderr =
     error && typeof error === "object" && "stderr" in error
       ? error.stderr