docs(server): include plugin setup in source startup

[faizan-oai]

Summary

The findings-server source-start recipe omits the generated plugin required by
storage initialization. Document the existing prerequisites before starting the
compiled server.

Changes

• Install the canonical MCP app's locked dependencies using the command already
  documented in the SDK testing guide.
• Run pnpm run build:plugin before the existing package build and server start.

Testing

• prettier --check README.md passed with Prettier 3.2.5.
• git diff --check passed.
• Reviewed a native Windows source-start probe using lockfile-matched SDK and MCP
  dependencies reused read-only, with package scripts invoked through
  node --run. The package build succeeded, but compiled startup failed before
  readiness with the missing-plugin error. After node --run build:plugin, the
  same compiled entrypoint served the expected HTTP 501 stubs and initialized
  SQLite.
• No fresh dependency installation or full-suite rerun was performed for this
  documentation-only change.

Risk and rollout

Documentation only. The added commands are existing source-build steps and apply
across supported platforms. No runtime, API, default, or published-package
behavior changes; no migration is required.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-27T22:21:25.522098Z	002eeb7	Manual request
🔒 Security Review	✅ Completed 2026-08-27T22:20:41.009772Z	002eeb7	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[faizan-oai]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: 002eeb7942

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

npm or pnpm?

[faizan-oai]

@codex should this be pnpm or npm?

[chatgpt-codex-connector]

npm is correct for that line.

The commands intentionally use two package managers because they target two separate packages:

• sdk/typescript declares pnpm 11.9.0 as its package manager, so its install and build commands should use pnpm. sdk/typescript/package.jsonL15-L18 sdk/typescript/README.mdL951-L959
• plugins/codex-security/mcp-app has an npm package-lock.json with lockfile version 3, so npm ci --prefix ../../plugins/codex-security/mcp-app installs that package’s locked dependencies correctly. plugins/codex-security/mcp-app/package-lock.jsonL1-L10
• Existing SDK scripts also invoke npm for operations in that nested MCP app, confirming the package-manager boundary is intentional. sdk/typescript/package.jsonL57-L62

So the current documentation should remain:

pnpm install --frozen-lockfile
npm ci --prefix ../../plugins/codex-security/mcp-app --no-audit --no-fund

No repository change was necessary, so I did not create a commit or follow-up PR.

Checks

• ✅ find plugins/codex-security/mcp-app -maxdepth 2 \( -name package.json -o -name 'package-lock.json' -o -name 'pnpm-lock.yaml' \) -print
• ✅ node -e "for (const p of ['sdk/typescript/package.json','plugins/codex-security/mcp-app/package.json']) {const j=require('./'+p); console.log(p, {packageManager:j.packageManager, scripts:j.scripts})}"
• ✅ git status --short --branch (working tree clean)

View task →

[faizan-oai]

@codex what if the user only uses pnpm and not npm though? How does it make sense to mix package managers?

[chatgpt-codex-connector]

Summary

• Clarified that the source build intentionally requires both package managers because the SDK is locked with pnpm, while the nested MCP app has its own npm lockfile. This avoids implying that the npm command is interchangeable with pnpm. sdk/typescript/README.mdL951-L954
• Preserved the reproducible installation commands for both packages and the existing build/start sequence. sdk/typescript/README.mdL956-L961
• Committed the change as 282b713 (docs: clarify source build package managers) and prepared a follow-up PR titled “docs: clarify source build package managers.”

Testing

• ✅ pnpm exec prettier --check README.md
• ✅ git diff --check
• ✅ git status --short --branch (clean working tree after commit)

View task →

[mldangelo-oai]

Reviewed 002eeb7 against current main. This is now superseded: the source-start recipe on main already installs the MCP dependencies and runs build:plugin. It also uses pnpm consistently after #725. The npm command in this branch is stale because the MCP app now has a pnpm lockfile.

I recommend closing this PR as superseded instead of resolving the README conflict and restoring the old npm command. No additional implementation is needed for the original problem.

[faizan-oai]

Closing as superseded. Main already includes the MCP dependency setup and plugin-build steps, and #725 updated the source-start recipe to use pnpm consistently. The original setup gap is covered; restoring this branch's npm command would be obsolete.