openai / openai/codex-security
Could not save the Codex Security scan: scan-manifest.json
Open
Nobody has claimed this yet.
area:cost
area:reports
area:sandbox
bug
priority:p1
- Dominant language
- TypeScript
- Stars
- 10.8k
- Forks
- 802
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 257
Description
dev@97fb1e3c0649:/workspace$ codex login --device-auth
Welcome to Codex [v0.145.0]
OpenAI's command-line coding agent
(snip)
Successfully logged in
dev@97fb1e3c0649:/workspace$ npx codex-security scan .
[00:00] Preparing scan
[00:00] Authentication: stored Codex credentials.
[00:01] Preparing scan
[03:35] Running scan
codex-security: Could not save the Codex Security scan: scan-manifest.json: expected a regular file inside the scan directory.
codex-security: Partial output was kept at /home/dev/.codex-home/state/plugins/codex-security/scans/workspace/codex-security-workspace-bIo7BP.
dev@97fb1e3c0649:/workspace$ ls /home/dev/.codex-home/state/plugins/codex-security/scans/workspace/codex-security-workspace-bIo7BP
dev@97fb1e3c0649:/workspace$
dev@97fb1e3c0649:/workspace$ pwd
/workspace
dev@97fb1e3c0649:/workspace$ ls
CHANGES.md CONTRIBUTING.md README.md byre cmd go.mod install.sh scripts skills
CLAUDE.md LICENSE TODO.md byre.preset docs go.sum internal site wip
dev@97fb1e3c0649:/workspace$ node -v
v22.23.1
dev@97fb1e3c0649:/workspace$ uname -a
Linux 97fb1e3c0649 7.0.0-28-generic #28-Ubuntu SMP PREEMPT_DYNAMIC Sun Jun 21 01:01:36 UTC 2026 x86_64 GNU/Linux
dev@97fb1e3c0649:/workspace$ python3 -V
Python 3.11.2
dev@97fb1e3c0649:/workspace$ npm list -g @openai/codex-security --depth=0
/usr/lib
`-- @openai/codex-security@0.1.0
Any other details that would be helpful, let me know
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing npx codex-security scan . after codex login --device-auth in the reported environment. Inspect the partial output under /home/dev/.codex-home/state/plugins/codex-security/scans/workspace/ and the scan-manifest.json handling in the package. Done means the scan completes and saves a valid manifest instead of reporting that it is not a regular file.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nodejs, typescript
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 45/100