openai / openai/codex-security

Could not save the Codex Security scan: scan-manifest.json

Open
#20 13 comments 4 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

area:cost area:reports area:sandbox bug priority:p1
Dominant language
TypeScript
Stars
10.8k
Forks
802
Avg merge
1d 8h
Merged PRs (30d)
257

Description

dev@97fb1e3c0649:/workspace$ codex login --device-auth

Welcome to Codex [v0.145.0]
OpenAI's command-line coding agent
(snip)
Successfully logged in
dev@97fb1e3c0649:/workspace$ npx codex-security scan .
[00:00] Preparing scan
[00:00] Authentication: stored Codex credentials.
[00:01] Preparing scan
[03:35] Running scan
codex-security: Could not save the Codex Security scan: scan-manifest.json: expected a regular file inside the scan directory.
codex-security: Partial output was kept at /home/dev/.codex-home/state/plugins/codex-security/scans/workspace/codex-security-workspace-bIo7BP.
dev@97fb1e3c0649:/workspace$ ls /home/dev/.codex-home/state/plugins/codex-security/scans/workspace/codex-security-workspace-bIo7BP
dev@97fb1e3c0649:/workspace$
dev@97fb1e3c0649:/workspace$ pwd
/workspace
dev@97fb1e3c0649:/workspace$ ls
CHANGES.md  CONTRIBUTING.md  README.md  byre         cmd   go.mod  install.sh  scripts  skills
CLAUDE.md   LICENSE          TODO.md    byre.preset  docs  go.sum  internal    site     wip
dev@97fb1e3c0649:/workspace$ node -v
v22.23.1
dev@97fb1e3c0649:/workspace$ uname -a
Linux 97fb1e3c0649 7.0.0-28-generic #28-Ubuntu SMP PREEMPT_DYNAMIC Sun Jun 21 01:01:36 UTC 2026 x86_64 GNU/Linux
dev@97fb1e3c0649:/workspace$ python3 -V
Python 3.11.2
dev@97fb1e3c0649:/workspace$ npm list -g  @openai/codex-security --depth=0
/usr/lib
`-- @openai/codex-security@0.1.0

Any other details that would be helpful, let me know

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing npx codex-security scan . after codex login --device-auth in the reported environment. Inspect the partial output under /home/dev/.codex-home/state/plugins/codex-security/scans/workspace/ and the scan-manifest.json handling in the package. Done means the scan completes and saves a valid manifest instead of reporting that it is not a regular file.

Written by the indexing model from the issue text.

Assessment

Tech stack
nodejs, typescript
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.