refactor(plugin): port patch-risk validation to TypeScript

[kmbroai]

Summary

Replace the Python patch-risk assessment validator with the bundled TypeScript helper.

Changes

• Preserve schema checks, assessment invariants, file/stdin input, numeric values, duplicate-key detection, and property order.
• Use JSON.parse to validate string escapes and check schema items before Set-based string uniqueness; remove recursive aggregate equality.
• Update the skill, package inputs, and helper dispatch; remove the Python validator and its owned tests.

Testing

• Combined stack tip ba12023: both full SDK runs passed 2,656 tests with 50 skips and zero failures (seeds 12345 and 4201856736).
• The six affected helper suites passed 213 tests with four Windows-only skips; all 23 MCP test processes passed.
• CI compilation, plugin build, types, formatting, Ruff, portable source checks, and nine source-checker tests passed.
• Rust formatting and cross-target Clippy for the Windows x64 native proof passed. Local execution was Linux; hosted CI supplies platform runtime coverage.

Risk and rollout

Stacked on candidate normalization. Invocation becomes launch_codex_security_mcp[.cmd] --helper validate-patch-risk-assessment <assessment.json>; - still reads stdin. Schema acceptance and decision rules are unchanged. Invalid-item errors now precede uniqueness errors, and malformed-string diagnostic wording comes from JSON.parse.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	🔄 Running since 2026-09-10T23:51:28.089515Z	afd609b	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

Reviewed b408067753cb908d97a9de20e1339b766cff5cf6 against its recorded #837 base using GPT-6 Astra at ultra effort, with the PR deslop and critical review passes.

Assessment validation works through the bundled helper without Python. I found no correctness regression in the covered contracts and left two nonblocking simplification comments: remove the redundant JSON string escape scan, and validate string items before Set-based uniqueness. Disposable versions remove 34 lines; malformed-input diagnostics change intentionally.

Verification beyond the complete-stack comparison with main:

• 85 focused tests passed; 2 Windows-only skips.
• 931 assessment cases matched the Python baseline; 1,182 string inputs checked parsing acceptance and values. The original and both proposed simplifications passed independent replays on Node 22.13, 24, 26 and Bun.
• 84 launcher invocations passed across the Python baseline and Node 22.13/24/26, preserving input files, modes and symlinks.
• 262 downstream serialization comparisons preserved artifact bytes. Builds, types, formatting and portable source checks passed.

Local execution was Linux. Exact-head CI supplies separate Windows/macOS/native coverage; it does not cover the synthetic combined stack. Shared numeric, ordering and raw-path behavior has real consumers, so those parts need a separate proof before deletion.

[kmbroai]

Addressed both simplification comments: the duplicate string-escape scan and recursive aggregate equality are removed, and validated string items use Set uniqueness. The shared numeric representation, duplicate-key handling, and property order remain for their actual consumers. The updated PR description records the diagnostic changes.

Updated head: afd609bce44577068eef895f27750fa62dc08bb3. Hosted CI passes on this head, including Linux/macOS/Windows tests, native proofs, installed-package checks, plugin source contracts, types, and formatting. Codex Security Review also passes. The Windows Node 24 package job passed on an unchanged-commit retry after npm install timed out. The combined stack at 5bd1d1909ad99d2749fe8d3ec49a9a144ae2bac0 includes this head and has also passed platform CI.