test: verify the installed MCP scan lifecycle

[kmbroai]

Summary

Verify that the actual installed npm package can complete a credential-free Codex Security scan through its bundled MCP server.

Changes

• Extend the existing installed-package smoke test with a real MCP stdio handshake and scan lifecycle: start, record a complete draft, seal, and read the completed scan.
• Validate the completed manifest, installed plugin provenance, complete coverage, empty findings, and all four required scan artifacts.
• Exercise the installed CLI with a local-only dry run and a synthetic API key.
• Isolate temporary scan state, remove inherited credentials from the MCP process, disable Python bytecode, and canonicalize paths for cross-platform compatibility.
• Reuse the existing Linux, macOS, and Windows package-verification jobs without adding workflows, secrets, model requests, or manual gates.
• Install Python in the temporary container package-builder stage so the same integration check also runs for amd64 and arm64 images.

Testing

• bun test --timeout 30000 tests-ts/package-smoke-timeouts.test.ts tests-ts/package-provenance.test.ts tests-ts/cli-launcher.test.ts — 13 passed.
• Focused runtime, CLI, and compact-diff behavioral tests — 8 passed.
• bun test --timeout 30000 tests-ts/container-entrypoint.test.ts — 12 passed.
• node node_modules/typescript/bin/tsc --noEmit — passed.
• node scripts/generate-models.cjs --check — passed.
• Full SDK Prettier check and node --check scripts/smoke-package.mjs — passed.
• Packed npm artifact and bundled-plugin contract validation — passed, 203 package entries.
• Actual credential-free MCP handshake, tool discovery, scan start, handoff, and draft submission — passed locally. Full sealing and installed-package validation run in the existing hosted Linux, macOS, and Windows CI jobs.

Risk and rollout

• Test-only changes in the existing package smoke script and temporary container build stage; no production behavior, release configuration, or workflow changes.
• The final runtime image is unchanged; Python is additionally installed only in the discarded package-builder stage.
• The synthetic target, scan state, and artifacts stay in disposable private directories outside the target.
• No real credentials, external model requests, or additional CI provisioning are required.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[ting-hong-shieh]

I reviewed exact head 34f130ece434c4b4171e226f81c88b8ba91a4dfe on current main 216212b70a421b0bf30319d241de47a64050ec0f and found no correctness blocker.

The installed-package path is exercised end to end rather than through source-tree imports. I packed the exact head into a 203-entry tarball, installed it in a fresh consumer, and completed MCP initialization, tool discovery, scan start, draft recording, sealing, and completed-scan readback. The smoke also verified all 107 bundled-plugin files, the CLI dry run, and a nested Codex worker with no global codex on PATH. The resulting manifest, producer provenance, complete coverage, empty findings, and four required artifacts matched the assertions.

Additional validation passed: 13 package provenance/timeout/launcher tests (29 assertions), 12 container-entrypoint tests (52 assertions), and the randomized full SDK suite with 1,079 pass, 11 skip, and 0 fail (7,250 assertions across 54 files). Generated-model checking, TypeScript, the production build, script syntax, full Prettier checking, and whitespace checks were also clean. The current-head public Linux, macOS, and Windows matrices are green; the container failures on the first commit are superseded by the successful current-head runs after Python was added to the discarded package-builder stage.

Local validation used Node 26.5.0, Bun 1.3.14, and Python 3.12.13 on macOS. Installing the isolated consumer resolved 76 public npm packages. The MCP scan made no model or provider request and used no real credentials; the CLI dry run used only the committed synthetic API-key value, and the nested worker was stopped after its local startup event.