Fix test-mock leakage breaking codex-session and eslint unused import

mock.module for codex/session.js and xai/session.js in
oauth-scope-check.test.ts, and for oauth-scope-check.js in
provider-setup-submit.test.ts, replaced those modules for the whole
bun test process without restoring them, breaking
tests/unit/codex-session.test.ts which imports the real module
directly. Capture the real module before mocking and restore it in
afterAll. Also drops an unused beforeEach import that eslint flagged.

Author: TheGreatAxios

src/auth/oauth-scope-check.test.ts

@@ -1,16 +1,28 @@
-import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { afterAll, afterEach, describe, expect, mock, test } from "bun:test";
 
 // getValidCodexToken/getValidXaiToken hit the real home-level auth store and
 // refresh endpoints; stub the session layer so this test only exercises the
-// scope probe's own HTTP call and status classification.
+// scope probe's own HTTP call and status classification. Other suites
+// (tests/unit/codex-session.test.ts) import the real modules directly, so the
+// mocks must be torn down after this file's tests run rather than leaking
+// into the rest of the bun test process.
+const realCodexSession = { ...(await import("./codex/session.js")) };
+const realXaiSession = { ...(await import("./xai/session.js")) };
+
 mock.module("./codex/session.js", () => ({
+  ...realCodexSession,
   getValidCodexToken: async () => ({ access: "codex-token", accountId: "acct-1" }),
 }));
 mock.module("./xai/session.js", () => ({
+  ...realXaiSession,
   getValidXaiToken: async () => ({ access: "xai-token" }),
-  xaiUserIdFromAccessToken: () => undefined,
 }));
 
+afterAll(() => {
+  mock.module("./codex/session.js", () => realCodexSession);
+  mock.module("./xai/session.js", () => realXaiSession);
+});
+
 const { checkOAuthProviderScope } = await import("./oauth-scope-check.js");
 
 const originalFetch = global.fetch;

src/tui/provider-setup-submit.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect, afterEach, mock } from "bun:test";
+import { describe, test, expect, afterEach, afterAll, mock } from "bun:test";
 import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -7,16 +7,23 @@ import type { OAuthScopeCheckResult } from "../auth/oauth-scope-check.js";
 
 // The oauth branch probes real provider scope over the network; stub the
 // check so these tests exercise buildProviderSubmitHandler's own branching
-// (ok / insufficient-scope / unavailable) without a live call.
+// (ok / insufficient-scope / unavailable) without a live call. Restored after
+// this file's tests run so a mock never leaks into another suite that
+// imports provider-setup-submit.js and expects the real probe.
+const realOAuthScopeCheck = { ...(await import("../auth/oauth-scope-check.js")) };
 let scopeCheckResult: OAuthScopeCheckResult = { status: "ok" };
 mock.module("../auth/oauth-scope-check.js", () => ({
+  ...realOAuthScopeCheck,
   checkOAuthProviderScope: async () => scopeCheckResult,
 }));
 
+afterAll(() => {
+  mock.module("../auth/oauth-scope-check.js", () => realOAuthScopeCheck);
+});
+
 const { buildProviderSubmitHandler } = await import("./provider-setup-submit.js");
-const { loadLocalSettings, loadSettings, localSettingsPath } = await import(
-  "../config/settings.js"
-);
+const { loadLocalSettings, loadSettings, localSettingsPath } =
+  await import("../config/settings.js");
 import type { ProviderFormValues, SubmitPhase } from "./provider-setup.js";
 
 const noopSetPhase = (_phase: SubmitPhase): void => {};
@@ -226,7 +233,10 @@ describe("buildProviderSubmitHandler", () => {
             oauthProfile: "work",
           },
           noopSetPhase,
-          { skipValidation: false, oauth: { kind: "codex", providerName: "codex/work", profile: "work" } },
+          {
+            skipValidation: false,
+            oauth: { kind: "codex", providerName: "codex/work", profile: "work" },
+          },
         );
 
         const local = await loadLocalSettings(localPath);
@@ -286,7 +296,10 @@ describe("buildProviderSubmitHandler", () => {
             oauthProfile: "work",
           },
           noopSetPhase,
-          { skipValidation: false, oauth: { kind: "codex", providerName: "codex/work", profile: "work" } },
+          {
+            skipValidation: false,
+            oauth: { kind: "codex", providerName: "codex/work", profile: "work" },
+          },
         );
 
         const local = await loadLocalSettings(localPath);
@@ -310,7 +323,10 @@ describe("buildProviderSubmitHandler", () => {
             oauthProfile: "work",
           },
           noopSetPhase,
-          { skipValidation: true, oauth: { kind: "codex", providerName: "codex/work", profile: "work" } },
+          {
+            skipValidation: true,
+            oauth: { kind: "codex", providerName: "codex/work", profile: "work" },
+          },
         );
 
         const local = await loadLocalSettings(localPath);