Codex Security: path-based repository entries accumulate with no supported merge or removal

Codex Security: duplicate path-based repositories cannot be consolidated

Environment

• Desktop host installed as ChatGPT.app: 26.901.51231 (build 8109), Codex Security surface.
• Codex Security plugin: 0.1.23.
• macOS 26.6.2, Darwin 25.6.0, arm64.
• Investigated on 2026-09-09.
• Subscription details not collected.

Trigger and observed behavior

Existing scan records include a Git repository root, a subdirectory, and
separate local checkout paths. Scanning these paths separately is the trigger
indicated by the persisted records and the inspected implementation; no new
scan was launched solely to reproduce this report. Security > Repositories accumulates separate
entries. The user cannot find an archive/remove/merge control. The installed
workbench CLI exposes no repository removal or consolidation command.

Evidence in installed plugin

• scripts/workbench_target_state.py: stable_target_id hashes the local absolute
  path; ensure_security_target matches current_path, not the Git remote.
• scripts/workbench_native_indexes.py: list_repositories groups scans and finding
  counts by target_id. Path existence only changes checkoutAvailable; it does
  not remove the entry. There is no branch selector in this projection.
• scripts/workbench_scan_history.py: _same_repository already compares common
  Git directories and normalized origin URLs, but the repository-list projection
  does not use that identity.

Expected behavior / requested product change

One repository entry per normalized GitHub repository identity; selected review
ref origin/main and immutable reviewed commit displayed separately. A scoped
subdirectory and additional checkouts should not create independent repositories.
Provide supported archive/remove and consolidation operations for historical
entries, including an explicit option to discard old reports/findings.

Removing Security metadata must never remove, move, rewrite, or stage local
project files, including untracked and ignored files. Active scans must be
handled explicitly; persisted historical identities must not reappear on restart.

User impact

Findings are split across targets, so reviewing the repository-root target can
incorrectly appear complete while a subdirectory target still contains findings.
Creating a clean origin/main checkout prevents dirty-source scans but does not
consolidate this list. Rescanning cannot fix the existing organization.

No database cleanup or project-file deletion was performed. No private source,
absolute local project paths, finding contents, credentials, or session logs are
included. This report was prepared and submitted by Codex at the user's explicit request.

This is distinct from #32180: the duplicates here are persisted repository
entries and split finding counts, not duplicate workspace tabs.

Start by reading scripts/workbench_target_state.py, scripts/workbench_native_indexes.py, and scripts/workbench_scan_history.py, comparing their repository identity handling. Trace how Security > Repositories and the workbench CLI consume these projections. Done means normalized repository entries can be consolidated or removed safely, historical findings are handled explicitly, and local project files remain untouched.