` /codex:transfer` fails with "did not record an imported thread" for both auto-detected and explicit --source

Description

codex-companion.mjs transfer consistently fails with an opaque error, both when auto-detecting the current Claude Code session and when passing an explicit, verified-valid --source path.

Steps to Reproduce

1. From within an active Claude Code session (Windows, Git Bash), run: node "<plugin-root>/scripts/codex-companion.mjs" transfer
2. Observe failure.
3. Retry with an explicit, confirmed-existing .jsonl path instead of relying on auto-detection: node "<plugin-root>/scripts/codex-companion.mjs" transfer --source "C:\Users\lukas\.claude\projects\C--Users-lukas-source-repos-pfs-web-app\d845c3e0-b354-4895-8723-c0669d0aa03a.jsonl"
4. Same failure, byte-for-byte identical error message.

Expected behavior

The session transfers into a resumable Codex thread, and the command prints a codex resume <id>.

Actual behavior

Both invocations fail identically:

(node:40764) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
(Use node --trace-deprecation ... to show where the warning was created)
Codex reported that the Claude import completed, but did not record an imported thread. Check the Codex app-server logs for the underlying import error.

Exit code 1. No further detail is surfaced — codex-companion.mjs status --all shows no job entry for the transfer attempt at all, so there's no job-id to inspect via status/result for more context.

Notes

• The --source file was confirmed to exist, be a valid non-empty .jsonl, and live under the expected ~/.claude/projects/<project>/ directory — ruling out a source-resolution problem. Since the no-argument (auto-detect via CODEX_COMPANION_TRANSCRIPT_PATH) and explicit --source runs fail identically, the bug appears to be in the Codex-side import/thread-registration step itself, not in path resolution.
• The [DEP0190] deprecation warning (child_process spawned with shell: true and unescaped args) fires on every invocation and may be worth addressing separately regardless of the main bug.

Environment

• OS: Windows 11 Pro (10.0.26200)
• Node.js: v24.15.0
• Plugin path/version: .../plugins/cache/openai-codex/codex/1.0.5/scripts/codex-companion.mjs
• Shell: Git Bash (MSYS)

Start in scripts/codex-companion.mjs at the transfer command and compare auto-detected and explicit --source handling. Reproduce both commands, then inspect the Codex app-server logs and status --all behavior for the missing imported-thread registration. Done means a transfer records a resumable thread and prints its codex resume command.