mldangelo-oai · Oct 7, 2026 · Oct 6, 2026 · Oct 6, 2026 · Oct 6, 2026 · Oct 6, 2026
diff --git a/plugins/codex-security/mcp-app/helpers-main.ts b/plugins/codex-security/mcp-app/helpers-main.ts
@@ -1,4 +1,5 @@
 import { closeSync, readFileSync } from "node:fs";
+import { parseArgs } from "node:util";
 import { resolveSecurityMdCommand } from "./src/helpers/resolve-security-md";
 import { decodePosixBytes } from "./src/helpers/posix-path";
 import { windowsBinding } from "./src/native";
@@ -8,6 +9,8 @@ import { deepReviewInputCommand } from "./src/helpers/deep-review-input";
 import { rankShardsCommand } from "./src/helpers/rank-shards";
 import { rankPoolCommand } from "./src/helpers/rank-pool";
 import { bindRepoScopesCommand } from "./src/helpers/bind-repo-scopes";
+import { escapeControls } from "./src/helpers/json";
+import { decodeUtf8 } from "./src/helpers/utf8";
 
 let commandLine = process.argv.slice(2);
 if (process.platform === "win32") {
@@ -58,9 +61,40 @@ if (command === "resolve-security-md") {
   process.exitCode = rankPoolCommand(command, args, posixHome);
 } else if (command === "bind-repo-scopes") {
   process.exitCode = bindRepoScopesCommand(args, posixHome);
+} else if (command === "database-info") {
+  void (async () => {
+    const { values } = parseArgs({
+      args,
+      options: { help: { type: "boolean", short: "h" } },
+    });
+    if (values.help) {
+      console.log(
+        "Usage: database-info (reads a JSON absolute state-directory string from stdin)",
+      );
+      return;
+    }
+    const { databaseInfo } = await import("./src/workbench/database");
+    console.log(
+      JSON.stringify(
+        await databaseInfo(JSON.parse(decodeUtf8(readFileSync(0)))),
+      ).replace(/[\p{Cc}\p{Cf}]/gu, (character) =>
+        character
+          .split("")
+          .map(
+            (unit) => `\\u${unit.charCodeAt(0).toString(16).padStart(4, "0")}`,
+          )
+          .join(""),
+      ),
+    );
+  })().catch((error: unknown) => {
+    console.error(
+      escapeControls(error instanceof Error ? error.message : String(error)),
+    );
+    process.exitCode = 1;
+  });
 } else {
   console.error(
-    "Usage: launch_codex_security_mcp[.cmd] --helper <resolve-security-md | normalize-candidates | validate-patch-risk-assessment | copy-deep-review-input | select-deep-review-input | make-rank-shards | validate-rank-shard | merge-rank-outputs | make-rank-pool-plan | validate-rank-worker | validate-rank-pool | bind-repo-scopes> [options]",
+    "Usage: launch_codex_security_mcp[.cmd] --helper <resolve-security-md | normalize-candidates | validate-patch-risk-assessment | copy-deep-review-input | select-deep-review-input | make-rank-shards | validate-rank-shard | merge-rank-outputs | make-rank-pool-plan | validate-rank-worker | validate-rank-pool | bind-repo-scopes | database-info> [options]",
   );
   process.exitCode = 2;
 }
diff --git a/plugins/codex-security/mcp-app/src/workbench/database.ts b/plugins/codex-security/mcp-app/src/workbench/database.ts
@@ -0,0 +1,98 @@
+import {
+  chmodSync,
+  lstatSync,
+  mkdirSync,
+  readlinkSync,
+  realpathSync,
+  statSync,
+} from "node:fs";
+import { dirname, isAbsolute, join, sep } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { setTimeout } from "node:timers/promises";
+import { applyMigrations } from "./migrations";
+import { decodePosixBytes, encodePosixPath } from "../helpers/posix-path";
+import { windowsBinding } from "../native";
+import { widePath, windowsFileSystem } from "../../../native/windows-files.mjs";
+
+function createStateDirectory(path: string): void {
+  if (process.platform !== "win32") path = path.replace(/\/+$/u, "") || "/";
+  const nativePath =
+    process.platform === "win32" ? path : encodePosixPath(path);
+  if (statSync(nativePath, { throwIfNoEntry: false })?.isDirectory()) return;
+  const entry = lstatSync(nativePath, { throwIfNoEntry: false });
+  if (entry?.isSymbolicLink()) {
+    const target =
+      process.platform === "win32"
+        ? readlinkSync(nativePath)
+        : decodePosixBytes(readlinkSync(nativePath, { encoding: "buffer" }));
+    createStateDirectory(
+      isAbsolute(target) ? target : `${dirname(path)}${sep}${target}`,
+    );
+    return;
+  }
+  if (!entry) {
+    const parent = dirname(path);
+    if (parent !== path) createStateDirectory(parent);
+  }
+  try {
+    if (process.platform === "win32")
+      windowsFileSystem(windowsBinding()).mkdirPrivate(widePath(path));
+    else mkdirSync(nativePath, { mode: 0o700 });
+  } catch (error) {
+    if (!statSync(nativePath, { throwIfNoEntry: false })?.isDirectory())
+      throw error;
+  }
+}
+
+export async function openWorkbenchDatabase(
+  databasePath: string,
+  { deferred = false }: { deferred?: boolean } = {},
+): Promise<DatabaseSync> {
+  createStateDirectory(dirname(databasePath));
+  for (let attempt = 0; ; attempt++) {
+    const database = new DatabaseSync(databasePath);
+    try {
+      database.exec("PRAGMA foreign_keys = ON; PRAGMA busy_timeout = 5000;");
+      applyMigrations(database, undefined, !deferred || attempt > 0);
+      database.exec("PRAGMA journal_mode = WAL");
+      chmodSync(databasePath, 0o600);
+      return database;
+    } catch (error) {
+      database.close();
+      const busy =
+        error instanceof Error &&
+        "errcode" in error &&
+        [5, 6].includes(Number(error.errcode) & 0xff);
+      if (attempt === 4 || !busy) throw error;
+      await setTimeout(50 * 2 ** attempt);
+    }
+  }
+}
+
+export async function databaseInfo(
+  state: string,
+): Promise<{ databasePath: string }> {
+  if (
+    typeof state !== "string" ||
+    !isAbsolute(state) ||
+    !state.isWellFormed()
+  ) {
+    throw new Error(
+      "database-info requires an absolute Unicode state-directory string.",
+    );
+  }
+  // Keep an ASCII alias usable even when its destination has raw POSIX bytes.
+  const database = await openWorkbenchDatabase(
+    `${state}${sep}workbench.sqlite3`,
+    { deferred: true },
+  );
+  database.close();
+  const canonicalState =
+    process.platform === "win32"
+      ? realpathSync.native(state)
+      : decodePosixBytes(
+          realpathSync.native(encodePosixPath(state), { encoding: "buffer" }),
+        );
+  const databasePath = join(canonicalState, "workbench.sqlite3");
+  return { databasePath };
+}