test(mcp): reuse Deep Scan fixtures

[mldangelo-oai]

Summary

Deep Scan executor and coordinator tests repeat worker setup and clock recording. Share those fixtures while retaining the existing retry, cancellation and worker-failure scenarios.

Changes

• Use common executor fixture setup and discovery request construction, with cleanup around each case.
• Share the clock that records retry delays.
• Remove unused private deferred and line-consumer test helpers and their unused plumbing.

Testing

Passed on commit 8677017d07da:

• In sdk/typescript: pnpm run build:plugin, pnpm run types (including MCP typecheck), and pnpm run test:mcp — 209 tests passed, none failed or skipped.
• In plugins/codex-security/mcp-app: node --test --test-concurrency=2 --test-reporter=./scripts/test_reporter.mjs tests/test_deep_scan_coordinator.mjs tests/test_deep_scan_executor.mjs tests/test_deep_scan_store.mjs — all three test files passed.
• node sdk/typescript/node_modules/prettier/bin/prettier.cjs --check on the six modified MCP test files — passed.
• All five portable plugin checks passed:

python -m ruff check --config plugins/codex-security/pyproject.toml plugins/codex-security
python -m ruff format --check --config plugins/codex-security/pyproject.toml plugins/codex-security
pnpm --dir sdk/typescript run build:ci
node .github/scripts/check_plugin_source_compatibility.mjs
node --test .github/scripts/test_check_plugin_source_compatibility.mjs

Two independent Codex reviews and separate verification completed without findings.

Risk and rollout

Test-only change. Worker request values, failure markers and assertions remain explicit in their cases. The fixture wrapper must preserve per-case resource cleanup and asynchronous sequencing.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review the current head SHA.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-04T18:07:36.963452Z	8677017	Manual request
🔒 Security Review	✅ Completed 2026-10-04T18:09:27.726613Z	8677017	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 8677017d07

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Copilot review overview

🟢 Approval recommended

The test-only refactor preserves existing behavior, cleanup, and sequencing with no unresolved findings.

Review effort: Balanced
Findings: None

What changed in this PR

Refactors Deep Scan tests to reuse fixture and clock helpers while removing unused utilities.

Changes:

• Centralizes executor fixture setup and discovery requests.
• Reuses a retry-recording clock.
• Removes unused deferred and line-consumer helpers.

File	Description
tests/​test_deep_scan_store.mjs	Removes an unused import.
tests/​test_deep_scan_executor.mjs	Reuses executor fixtures and request construction.
tests/​test_deep_scan_coordinator.mjs	Introduces and shares the recording clock.
tests/​deferred.mjs	Removes the unused deferred helper.
tests/​deep_scan_worker_failure_cases.mjs	Uses the shared recording clock.
tests/​deep_scan_publication_cases.mjs	Removes unused fixture plumbing.
tests/​deep_scan_deadline_cases.mjs	Removes unused fixture plumbing.
tests/​consume-lines.mjs	Removes the unused line-consumer helper.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[alandelong-oai]

Reviewed the actual PR contribution at 8677017d07da36b121a573c79f455c9318d2d3df against 1fb0e5fbf8684c926cac2a36d08389b212d28d5a with three independent full-diff review passes and root synthesis, including every changed test and fixture. No actionable introduced issue was identified.

Inspected coordinator clock extraction and executor fixture/environment restoration helpers and changed call sites; synthesized three full-diff reports covering all eight changed test paths. No supported loss of assertions or fixture cleanup identified.

Static source review only; tests and builds were not run locally. This approval does not establish whole-stack integration or deployment.