Deep Security Scan

Setup Workspace Routing

When this skill is the active top-level workflow, use the setup workspace only when the host context explicitly says it is running inside the Codex desktop app and both required setup continuation tools are available. Tool availability alone does not identify the app host. Otherwise, including Codex CLI interactive and headless runs, use the prompt-only terminal/chat workflow: do not call Codex Security app setup tools, ask the user to press Start scan, or wait for an app-generated scanId.

Treat goal creation as scan execution, not setup. In the app setup path, do not create or adopt scan goals before the user presses Start scan, the authoritative scan context has been loaded from a status: "started" wait result or a direct continuation with a scanId, and the capability preflight has returned ready. This includes coordinator and worker-local goals.

For an app continuation that already includes a scanId and optional handoffClaimToken, do not open another workspace: call get_codex_security_scan_context with the scanId, pass its handoffClaimToken when present, route elsewhere only if its validated mode differs, and use its target, optional userContext, and scanDir.

The top-level coordinator must inspect otherRunningDeepScans only once for each newly launched scan: immediately after the first scan context load for that handoff and before preflight, goal creation, worklist creation, or worker creation. Treat this gate as passed for the current scan when the list is empty or the user chooses Continue. Do not repeat the check on later context loads, if another scan appears after the current scan already passed this gate, or after the current scan has progressed beyond preflight. Delegated workers do not perform this check.

• If it is empty, continue normally.
• If it is non-empty, show a compact warning. For each other scan, include only its target path, current phase in plain language, and human-friendly start time. Do not include scan IDs, raw timestamps, update times, or commentary about stale records or interrupted threads. Add one short sentence that running Deep Security Scans concurrently can increase CPU, memory, and token consumption and slow both scans.
• After showing those details in an interactive Codex session, optimistically call the native request_user_input tool so the user can choose without typing. If the native tool is unavailable or errors, use the Codex Security MCP fallback described below: