diff --git a/plugins/codex-security/mcp-app/src/artifact-discovery.ts b/plugins/codex-security/mcp-app/src/artifact-discovery.ts
index 300f0e68cc..8b2083f72a 100644
--- a/plugins/codex-security/mcp-app/src/artifact-discovery.ts
+++ b/plugins/codex-security/mcp-app/src/artifact-discovery.ts
@@ -23,7 +23,6 @@ import {
   replaceArtifactText,
 } from "./artifact-io.js";
 import { artifactSchemaDocuments } from "./artifact-contracts.js";
-import { candidateSchemaV1 } from "./deep-scan/artifact-contracts.js";
 
 const discoveryComponents = ["artifacts", "02_discovery"] as const;
 const discoveryLabel = "discovery candidates";
diff --git a/plugins/codex-security/mcp-app/src/deep-scan/worker-runner.ts b/plugins/codex-security/mcp-app/src/deep-scan/worker-runner.ts
index 64bc32de5a..c50d428e8e 100644
--- a/plugins/codex-security/mcp-app/src/deep-scan/worker-runner.ts
+++ b/plugins/codex-security/mcp-app/src/deep-scan/worker-runner.ts
@@ -14,7 +14,6 @@ import { archiveDirectory, writePrivateFile } from "./artifacts.js";
 import type { DeepScanArtifacts } from "./artifacts.js";
 import {
   abortError,
-  errorNameWithCode,
   boundedDeepScanErrorMessage,
   classifyCodexWorkerError as asError,
   DeepScanNonRetryableError,
diff --git a/plugins/codex-security/scripts/windows_scan_local_files.py b/plugins/codex-security/scripts/windows_scan_local_files.py
index b4e60490d7..2f57483ca8 100644
--- a/plugins/codex-security/scripts/windows_scan_local_files.py
+++ b/plugins/codex-security/scripts/windows_scan_local_files.py
@@ -23,13 +23,13 @@
 import argparse
 import contextlib
 import ctypes
+import ctypes.wintypes as wintypes
 import errno
 import importlib
 import ntpath
 import os
 import secrets
 from collections.abc import Iterator
-from ctypes import wintypes
 from pathlib import Path, PurePosixPath
 from typing import BinaryIO
 
diff --git a/plugins/codex-security/tests/test_finalize_scan_timestamps.py b/plugins/codex-security/tests/test_finalize_scan_timestamps.py
index 595eb329d3..dcc50a2a3b 100644
--- a/plugins/codex-security/tests/test_finalize_scan_timestamps.py
+++ b/plugins/codex-security/tests/test_finalize_scan_timestamps.py
@@ -2,8 +2,8 @@
 
 import os
 import unittest
+import unittest.mock as mock
 from datetime import datetime, timezone
-from unittest import mock
 
 import test_finalize_scan_contract as fixtures
 
diff --git a/plugins/codex-security/tests/test_workbench_scan_archive.py b/plugins/codex-security/tests/test_workbench_scan_archive.py
index f92e8b1d39..162c2cf20b 100644
--- a/plugins/codex-security/tests/test_workbench_scan_archive.py
+++ b/plugins/codex-security/tests/test_workbench_scan_archive.py
@@ -304,7 +304,7 @@ def compete():
             second.archive_existing, second.parent_scan_id = False, None
             try:
                 outcomes.append(register(connection, second))
-            except BaseException as error:
+            except SystemExit as error:
                 outcomes.append(error)
 
     mkdir = Path.mkdir