adversarial-review builds an unbounded prompt — large working trees fail with "Input exceeds the maximum length of 1048576 characters"

Summary

adversarial-review (and any runAppServerTurn-based review that interpolates the working-tree context into a text prompt) builds an unbounded aggregate prompt. collectReviewContext in scripts/lib/git.mjs caps each untracked file at 24KB individually, but never caps the total assembled size. With enough untracked files, the prompt exceeds Codex's input limit and the run dies with:

Input exceeds the maximum length of 1048576 characters.

…exit 1, empty stdout. The failure is opaque: nothing in the message points at "your working tree is too big for an inline review."

Repro

In a repo with many untracked files (e.g. agent/session tooling artifacts that aren't gitignored):

node scripts/codex-companion.mjs adversarial-review --scope working-tree --model gpt-5.5 --json "any focus"
# -> exit 1
# stderr: Input exceeds the maximum length of 1048576 characters.

Real case: a working tree with 309 untracked files (~6.8MB). git ls-files --others --exclude-standard returns them all; each ≤24KB file is inlined in full into the Untracked Files section, summing to ~1.7MB of prompt — over the 1,048,576-char ceiling.

Root cause

scripts/lib/git.mjs:

• MAX_UNTRACKED_BYTES = 24 * 1024 — per-file cap on untracked content (good).
• DEFAULT_INLINE_DIFF_MAX_BYTES = 256 * 1024 — cap on the inline diff portion (good).
• No aggregate cap on the untracked section, nor on the final assembled REVIEW_INPUT. state.untracked.map(formatUntrackedFile).join(...) grows linearly with file count with no ceiling.

So two independently-bounded sections (diff ≤256KB, each untracked ≤24KB) compose into an unbounded whole.

Suggested fix

Bound the assembled context, ideally with a clear truncation notice rather than a downstream hard error. Options:

1. Track a running byte budget across the untracked section (e.g. reuse/raise a single cap like DEFAULT_INLINE_DIFF_MAX_BYTES); once exceeded, stop inlining and append (N more untracked files omitted: aggregate exceeds <limit> bytes).
2. Enforce a final guard on REVIEW_INPUT length before the turn, truncating with a visible marker and/or returning an actionable error like "review context exceeds Codex input limit; narrow scope or commit/ignore untracked files" instead of the raw Input exceeds the maximum length from the model layer.

Either keeps reviews working on large/dirty trees and makes the boundary explicit.

Impact / how it surfaced

Downstream callers (e.g. the council Claude Code plugin) invoke this headless and report it as a generic "Codex unavailable", which misdirects debugging toward auth/runtime rather than prompt size. The interactive native reviewer (runAppServerReview with a git target) is unaffected because it doesn't inline the diff into a prompt — making the failure look mode-specific.

Version: openai-codex plugin 1.0.4 (codex-cli 0.142.2).

Start in scripts/lib/git.mjs, reading collectReviewContext and the assembly of the untracked-file and REVIEW_INPUT sections; reproduce the failure with adversarial-review --scope working-tree on a tree containing many untracked files. Choose and implement an aggregate or final prompt-size boundary with a visible truncation or actionable error, then verify that large working trees no longer fail with the raw input-length message.