[moah0911]

Summary

Issue #2078 reported that Codex Security 0.1.32 silently excluded .cgi, .pl, .pm, and .t files from diff inventories because of a fixed TEXT_CODE_EXTENSIONS allowlist. That allowlist was removed in #1347 ("include text files in scans regardless of extension"), and #1432 later moved inventory generation from Python to the Node helper. The behavior is fixed: I verified the published 0.8.0 bundle on a synthetic repo containing .cgi, .pl, .pm, .t, and an EUC-JP CGI file, and every changed file appears in in_scope_files.txt.

What the migration left behind is coverage. #1347 added extensionless and unfamiliar-source cases to the Python source_cases matrix, but #1432 replaced those tests and plugins/codex-security/tests/source_cases.py is now unreferenced. Nothing currently pins Perl or non-UTF-8 text, so a future suffix filter could reintroduce the reported coverage gap silently. This PR adds the regression coverage the issue asks for.

Changes

• Add testPrepareIncludesPerlSourceWithMixedEncodings to plugins/codex-security/mcp-app/tests/test_artifact_inventory.ts.
• The fixture commits and modifies .cgi, .pl, .pm, and .t files, an extensionless Perl shebang script, and a CGI file encoded as EUC-JP; all are asserted present in the automatic diff inventory.
• A .pm containing NUL bytes is asserted absent, pinning selection to file content rather than suffix.
• Allow the fixture helper to write raw Buffer content so the EUC-JP case is byte-exact.

Testing

• node --experimental-strip-types --test tests/test_artifact_inventory.ts with a helper built from the branch source: 1/1 file passed.
• Mutation check: reintroducing a .cgi|.pl|.pm|.t suffix filter in generate-inventory.ts made the new test fail (reviewItemsTotal: 0 vs 6); restored afterward.
• node --experimental-strip-types --test tests/test_candidate_inventory.ts: 2/2 passed.
• pnpm --dir plugins/codex-security/mcp-app exec prettier --check "tests/test_artifact_inventory.ts": clean.
• uvx ruff==0.17.1 check / format --check with plugins/codex-security/pyproject.toml: clean.
• pnpm --dir sdk/typescript run build:ci, check_plugin_source_compatibility.mjs, and its test: pass.

Risk and rollout

Test-only change; no production code, CLI surface, or artifacts change. The new case runs in the existing MCP test job and is platform-neutral (NUL-based binary classification, ASCII paths).

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

Thanks!