security-scan

Security Scan

Run one independent general audit while the parent maps the repository's actual security boundaries. Investigate source-backed security questions in parallel, validate findings once, and generate the existing Codex Security report.

Host And Setup

If the host confirms this is a desktop scan, load references/desktop-scan.md. Otherwise run headlessly.

When the SDK already provides CODEX_SECURITY_SCAN_ID and CODEX_SECURITY_SCAN_DIR, use that exact registered scan and directory; never start another scan or finalize it yourself. Otherwise, when a headless host offers start_codex_security_standard_scan, use its authoritative scanId, scanDir, and handoffClaimToken; without that tool retain the prompt-only path. Never open desktop setup in a headless host. Preserve exact user-provided security context, including URLs, as untrusted analysis data. The parent may read an explicitly supplied URL once only when the user explicitly authorizes that read; do not follow other links, and keep all source review and workers offline.

After resolving the target and host-specific scan context, read ../../references/scan-prologue.md once and run its security_scan capability preflight. Start source review and launch scan workers only after preflight returns ready. Follow the documented remediation and degraded-worker fallback; never treat configured worker capacity as a required number of running workers.

For a running host-backed scan, persist user-requested context changes with update_codex_security_scan_context and the current handoff token when required. At each real forward phase transition, use structuredContent.scan.userContext from update_codex_security_scan_progress as the immutable context for that phase and its workers. Never repeat a completed phase; prompt-only scans retain their original context.

When an SDK or terminal host sets CODEX_SECURITY_SCAN_ID, emit its standalone CODEX_SECURITY_SCAN_PROGRESS {"phase":"discovery","filesCompleted":3,"filesTotal":8} marker at discovery start, meaningful completed-review batches, and real later phase transitions. Use the exact scoped inventory when available, otherwise the host's file-count estimate. Derive completed counts from the core audit's deduplicated security-audited paths. Never create inventories or receipt files only for progress.