refactor(plugin): migrate rank pool helpers to TypeScript

plugins/codex-security/mcp-app/helpers-main.ts

@@ -6,6 +6,7 @@ import { normalizeCandidatesCommand } from "./src/helpers/normalize-candidates";
 import { validatePatchRiskAssessmentCommand } from "./src/helpers/validate-patch-risk-assessment";
 import { deepReviewInputCommand } from "./src/helpers/deep-review-input";
 import { rankShardsCommand } from "./src/helpers/rank-shards";
+import { rankPoolCommand } from "./src/helpers/rank-pool";
 
 let commandLine = process.argv.slice(2);
 if (process.platform === "win32") {
@@ -48,9 +49,15 @@ if (command === "resolve-security-md") {
   command === "merge-rank-outputs"
 ) {
   process.exitCode = rankShardsCommand(command, args, posixHome);
+} else if (
+  command === "make-rank-pool-plan" ||
+  command === "validate-rank-worker" ||
+  command === "validate-rank-pool"
+) {
+  process.exitCode = rankPoolCommand(command, args, posixHome);
 } else {
   console.error(
-    "Usage: launch_codex_security_mcp[.cmd] --helper <resolve-security-md | normalize-candidates | validate-patch-risk-assessment | copy-deep-review-input | select-deep-review-input | make-rank-shards | validate-rank-shard | merge-rank-outputs> [options]",
+    "Usage: launch_codex_security_mcp[.cmd] --helper <resolve-security-md | normalize-candidates | validate-patch-risk-assessment | copy-deep-review-input | select-deep-review-input | make-rank-shards | validate-rank-shard | merge-rank-outputs | make-rank-pool-plan | validate-rank-worker | validate-rank-pool> [options]",
   );
   process.exitCode = 2;
 }

plugins/codex-security/mcp-app/src/helpers/normalize-candidates.ts

@@ -1,4 +1,5 @@
 import { decodeUtf8 } from "./utf8";
+import { resolvedPath } from "./resolve-path";
 import { createHash, randomBytes } from "node:crypto";
 import {
   closeSync,
@@ -11,12 +12,7 @@ import {
   writeFileSync,
 } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, sep } from "node:path";
-import {
-  decodePosixBytes,
-  encodePosixPath,
-  resolvePosixPath,
-  SymlinkLoopError,
-} from "./posix-path";
+import { encodePosixPath, SymlinkLoopError } from "./posix-path";
 import {
   expandHome,
   HomeExpansionError,
@@ -106,20 +102,6 @@ const stat = (path: string) =>
 const pathKey = (value: string) =>
   process.platform === "win32" ? value.toLowerCase() : value;
 
-function resolvedPath(value: string, strict = true): string {
-  if (process.platform !== "win32")
-    return decodePosixBytes(
-      resolvePosixPath(encodePosixPath(parsedPath(value)), strict),
-    );
-  try {
-    return pathText(windowsFiles().realpath(widePath(value), strict));
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === "ELOOP")
-      throw new SymlinkLoopError(`Symlink loop from ${value}`);
-    throw error;
-  }
-}
-
 function inside(path: string, root: string, allowMissing = false): string {
   let result: string | undefined;
   if (windows) {

plugins/codex-security/mcp-app/src/helpers/python-json.ts

@@ -1,3 +1,5 @@
+import { decodeUtf8 } from "./utf8";
+
 // Preserve Python's integer/float distinction and arbitrary-size JSON integers.
 export class JsonFloat {
   constructor(readonly source: string) {}
@@ -22,6 +24,54 @@ export function objectEntries(value: Row): [string, unknown][] {
 
 export class JsonSyntaxError extends Error {}
 
+// Detect UTF-8/16/32 JSON bytes; UTF-8 input uses the shared strict decoder.
+export function parseJsonBytes(bytes: Buffer): unknown {
+  let width = 1;
+  let little = true;
+  let offset = 0;
+  const prefix = bytes.subarray(0, 4).toString("hex");
+  if (prefix === "fffe0000" || prefix === "0000feff") {
+    width = 4;
+    little = prefix === "fffe0000";
+    offset = 4;
+  } else if (prefix.startsWith("fffe") || prefix.startsWith("feff")) {
+    width = 2;
+    little = prefix.startsWith("fffe");
+    offset = 2;
+  } else if (prefix.startsWith("efbbbf")) {
+    offset = 3;
+  } else if (bytes.length >= 4) {
+    if (bytes[0] === 0) {
+      width = bytes[1] === 0 ? 4 : 2;
+      little = false;
+    } else if (bytes[1] === 0) {
+      width = bytes[2] || bytes[3] ? 2 : 4;
+    }
+  } else if (bytes.length === 2 && (bytes[0] === 0 || bytes[1] === 0)) {
+    width = 2;
+    little = bytes[0] !== 0;
+  }
+  let text = "";
+  if (width === 1) {
+    text = decodeUtf8(bytes.subarray(offset));
+  } else {
+    if ((bytes.length - offset) % width !== 0)
+      throw new Error(`Truncated UTF-${width * 8} JSON input`);
+    for (let index = offset; index < bytes.length; index += width) {
+      const point =
+        width === 2
+          ? little
+            ? bytes.readUInt16LE(index)
+            : bytes.readUInt16BE(index)
+          : little
+            ? bytes.readUInt32LE(index)
+            : bytes.readUInt32BE(index);
+      text += String.fromCodePoint(point);
+    }
+  }
+  return parseJson(text);
+}
+
 export function parseJson(source: string, rejectDuplicates = false): unknown {
   const tokens = [
     ...source.matchAll(