refactor(plugin): port deep-review input to TypeScript

[kmbroai]

Summary

Move deep-review worklist creation to the bundled TypeScript helper.

Changes

• Preserve row selection, ordering, output formatting, argument grammar, and raw-path behavior.
• Read inputs directly through the shared file helper; filesystem errors reach the existing failure handler before output is written.
• Update helper routing and workflow instructions; remove the Python commands and tests.

Testing

• Combined stack tip ba12023: both full SDK runs passed 2,656 tests with 50 skips and zero failures (seeds 12345 and 4201856736).
• The six affected helper suites passed 213 tests with four Windows-only skips; all 23 MCP test processes passed.
• CI compilation, plugin build, types, formatting, Ruff, portable source checks, and nine source-checker tests passed.
• Rust formatting and cross-target Clippy for the Windows x64 native proof passed. Local execution was Linux; hosted CI supplies platform runtime coverage.

Risk and rollout

Stacked on patch-risk validation. copy-deep-review-input and select-deep-review-input move to launch_codex_security_mcp[.cmd] --helper. Options, accepted argument grammar, and defaults are preserved. Missing or invalid paths now report the underlying read error.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-11T00:05:37.934170Z	b7f638d	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

Reviewed e762ac40eb92c25c83eb481c5d15293eb4dcbb89 against its #838 base using GPT-6 Astra at ultra effort, including the PR deslop and critical review passes.

The bundled helper preserves the covered worklist behavior. I found no supported-path correctness regression and left two nonblocking simplification comments. The first removes the existence preflight before reading the input. The tested change removes 21 lines; actual filesystem errors replace the custom missing-input diagnostics.

Verification beyond the complete-stack comparison with main:

• 66 focused tests passed; 1 Windows-only skip.
• The direct-read variant matched the current head in all 160 reviewer cases, including artifact bytes, permissions and symlinks. Independent 163-case replays passed on Node 22.13, 24 and 26.
• The two Python-baseline differences were the previously documented 4,301-digit percentage conversion cases; no ordinary selection difference was found.
• Seven downstream rank-pool cases and 16 Windows adapter-model checks passed. Builds, types, formatting and portable source checks passed.

The final-stack Astra ultra review also validated a 38-line shared argument-parser reduction, attributed here because the parser originates in this PR and is extracted by #841. util.parseArgs handles the ordinary command grammar. The proposal deliberately retires automatic abbreviations, Unicode/underscore integer spellings and some help/dash-value conveniences; those accepted-input and exit-status changes are explicit in the comment. The 38-line estimate applies to the final shared module.

A 242-case comparison on Node 20/22 classified all 59 intentional success-to-usage-error changes. Real helper compositions on Node 20/22/24/26 retained ordinary outputs, raw filenames, modes and independently checked receipt hashes. Preserve existing defaults and document the grammar change when applying it.

Local OS execution was Linux. Exact-head CI provides separate Windows, PowerShell, macOS and native evidence; the synthetic combined stack still needs platform CI after restacking. Preserve deterministic Unicode selection order and raw-path behavior. Shared diagnostic-formatting suggestions are being coordinated with the later serializer change.

[kmbroai]

Removed the existence wrapper and pre-read checks, including the extracted worklist reader and the later rank-pool caller. I retained the existing argument grammar: retiring accepted options and integer/help/dash-value forms would be an unnecessary public compatibility change for this migration. Both inline threads have explanations and are resolved.

Updated head: b7f638d626bd7240cabac5350cb2d5ba846296a2. Hosted CI passes on this head, including Linux/macOS/Windows tests, native proofs, installed-package checks, plugin source contracts, types, and formatting. Codex Security Review also passes. The combined stack at 5bd1d1909ad99d2749fe8d3ec49a9a144ae2bac0 includes this head and has also passed platform CI.