Codex Security 0.1.23 on Windows: recursive snapshot crash before scan ID; supported recovery needed

Summary

On Windows, Codex Security plugin 0.1.23 failed while starting a local changes review. The prompt-only scan launcher returned RecursionError: maximum recursion depth exceeded before returning a scan ID, scan directory or authoritative context. No application files were reviewed.

This is a plugin startup/recovery bug, not an appeal of a cybersecurity content flag. Please route it to the Codex Security plugin maintainers.

Environment and prior report

• Windows 11 Pro, 64-bit, OS version 10.0.26200.
• Installed Codex Security plugin: 0.1.23.
• Current desktop app observed on September 8: 26.901.6511.0. The app version at the original failure is not established here.
• Reported through desktop composer feedback, category Bug, on September 6, 2026. The feedback/session identifier can be supplied privately; no whole-session sharing is intended by this public issue.

Observed failure and bounded diagnosis

The traceback runs through workbench_db.py:960 -> directory_snapshot_regular_file_count at workbench_target.py:567 -> recursive git_directory_snapshot_paths(path) at line 479, repeated another 982 times.

A separate read-only inspection found no active-root recursion guard. An invented, in-memory directory-alias fixture reproduced excessive recursion in the unchanged enumeration functions; ordinary nested-repository and symbolic-link-leaf controls passed. This demonstrates a possible mechanism, NOT the actual cause in the real target. No real-target recursive investigation or installed-tool repair was performed.

The installed workflow says to continue an existing scan ID and never replace a failed or missing scan. No ID was returned. Local source inspection places this failure before the scan insertion and existing-scan join branch, but earlier database connection/migration effects may exist. Partial state is unknown and has not been inspected or removed.

Requested resolution

1. Provide a supported way to identify and preserve any state from this pre-ID failure, with exact safe recovery steps that do not replace or bypass the required review.
2. Confirm whether this recursive-enumeration failure is known and identify the supported Windows fix/version, if any.
3. Specify the minimum additional diagnostic information needed, without application source, credentials, whole-session sharing or destructive cleanup.

The review remains paused. We have not retried the launcher, changed its scope or target, edited the plugin/configuration, or treated the failure as a completed review. Application source, private project paths, credentials, raw logs and session transcripts are intentionally excluded.

Start with workbench_db.py:960 and workbench_target.py lines 479 and 567, tracing the pre-scan-ID path and existing-scan join behavior. Compare the reported alias fixture and nested-repository or symbolic-link-leaf controls without retrying the real launcher; done means maintainers identify supported Windows recovery steps, a fix or version, and the minimum safe diagnostics.