Codex crash during cleanup session caused unlogged deletion of ~328K files

What version of the IDE extension are you using?

0.4.76

What subscription do you have?

Pro

Which IDE are you using?

VS Code

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

During a multi-phase workstation cleanup session, the Codex extension crashed and ~328,000 files were permanently deleted across
10+ directories on C:\. The deletions were not logged in the chat transcript and far exceeded the user-approved scope.

Crash errors:

Codex process errored: Codex process is not available

codex_protocol::openai_models: Model personality requested but model_messages is missing, falling back to base instructions.
model=gpt-5.2 personality=pragmatic

Scope approved by user: 3 cache directories (~3.3 GB)
Actual blast radius: 10+ project directories, infrastructure folders, backup directories (~328K files permanently deleted,
Recycle Bin bypassed)

A recovered planning file (phase2_pre_targets.json) reveals Codex planned 4 cleanup targets but only disclosed 3. The undisclosed
4th target was .vscode\extensions (31,391 files) -- which contains the Codex extension itself, a plausible self-induced crash
vector.

Recovery was performed via Windows Volume Shadow Copies (326,063 items restored, 99.35%).

What steps can reproduce the bug?

Not deterministically reproducible. The sequence was:

1. Phased cleanup session with Codex (gpt-5.2, personality: pragmatic)
2. Phase 1: Approved deletion of temp files -- completed successfully
3. Phase 2: Approved deletion of 3 cache directories (whisper, huggingface, Neo4j)
4. During Phase 2, Codex detected unexpected changes: "I detected unexpected filesystem changes during Phase 2 (outside intended

targets)"

1. Codex did not halt -- continued, then crashed
2. Post-crash: 10+ directories outside approved scope permanently deleted

What is the expected behavior?

• Only explicitly approved paths should be modified
• All filesystem operations should appear in the chat log
• Agent should halt on detecting unexpected filesystem changes
• Deletions should use Recycle Bin by default
• Agent should not delete directories containing its own runtime

Additional information

Evidence preserved (available upon request, PII-redacted with SHA256 hashes):

• Complete Codex chat transcript (~2,015 lines)
• Recovered phase2_pre_targets.json showing 4 planned targets (3 disclosed)
• Filesystem timestamps clustering deletions in ~2-minute window
• PSReadLine history showing Clear-RecycleBin -Force and Remove-Item loops
• Recuva scan cataloging 164,830 deleted files