deep-security-scan
Deep Security Scan
The coordinator runs independent Standard audits, aggregates their validated findings, and finalizes plugin-launched scans even if the calling thread detaches. This thread owns setup, user context, and reporting the completed result.
Resolve the Scan
For a continuation with scanId, call get_codex_security_scan_context with the supplied handoffClaimToken when present. Preserve its authoritative identity, directory, target, scope, and context. If its validated mode is not deep, route to the corresponding top-level skill.
For a new conversation, CLI, or headless request, resolve the authorized local targetPath and optional exact userContext. For a scoped-path request, use that directory as targetPath with scope: "."; do not widen it to the repository root. If the coordinator tool is unavailable, report that the plugin server is required.
Read ../../references/scan-prologue.md for source-access, context-update, cancellation, and recovery rules. Deep has no parent capability preflight: the coordinator validates ownership, target, scope, and sandbox, and manages workers independently of this thread's delegation capacity.
Concurrent Desktop Scans
For a newly launched native scan with authoritative context, inspect otherRunningDeepScans once before discovery. If another Deep scan is running, show its target, phase in plain language, and human-friendly start time. Explain the additional CPU, memory, and token use without exposing scan IDs or raw timestamps.
Ask whether to continue, with Cancel (Recommended) and Continue. Use native request_user_input, then request_codex_security_user_input or plain chat if unavailable. Wait for an explicit choice; a declined or cancelled input dialog is not a scan cancellation. If the user cancels, cancel only the new scan. Do not repeat this guard after it passes or after preflight.