Codex Security “Start scan” times out and leaves an orphaned scan-start waiter

What version of the Codex App are you using (From “About Codex” dialog)?

Codex desktop 26.707.3563, Windows

What subscription do you have?

Pro

What platform is your computer?

Microsoft Windows NT 10.0.26100.0 x64

What issue are you seeing?

await_codex_security_scan_start remained pending after Start scan, and eventually times out.

What steps can reproduce the bug?

Environment:

• Windows: Microsoft Windows NT 10.0.26100.0 x64
• Codex desktop: 26.707.3563
• Codex Security plugin: 0.1.11

Steps to reproduce:

1. In Codex desktop, open a repository and ask:

“[@codex-security](plugin://codex-security@openai-curated-remote) Run a Codex Security scan on this repository. U have full rights.”

1. The agent opens the Codex Security setup workspace for the repository in standard mode.
2. Click “Start scan.”
3. The UI shows:

“Action needed — MCP error -32001: Request timed out”

1. Retry or reopen the same setup workspace. The plugin responds:

“A scan-start waiter already exists for session …”

1. No scan ID is returned, so the scan cannot begin.

Expected:
Clicking Start scan should promptly return a durable scan ID and allow the security scan to continue.

Actual:
The start-scan handoff remains pending until the MCP client times out. It leaves an orphaned waiter, which blocks retries.

Reproduction snippet:

const workspace = await tools.mcp__codex_security__open_codex_security_workspace({
targetPath: "C:\\Users\\mt\\Documents\\Programming\\InfraveilNew",
mode: "standard",
scope: ".",
targetTitle: "InfraveilNew"
});

await tools.mcp__codex_security__await_codex_security_scan_start({
sessionId: "a62c9885-aadb-4683-918b-32c1017e75f5"
});

// Click Start scan in the rendered workspace.
// Result: MCP error -32001: Request timed out.

Session ID:
a62c9885-aadb-4683-918b-32c1017e75f5

Evidence:

• The initial await call began at 2026-07-10T00:01:51Z.
• A retry returned: “A scan-start waiter already exists for session a62c9885-aadb-4683-918b-32c1017e75f5.”
• Desktop logs later recorded related MCP calls lasting 201,269 ms and 255,930 ms.
• Setup was saved, but no durable scan ID was delivered.

Token/context information at the time:

• Model context window: 353,400 tokens.
• Usage was below quota; no rate-limit event occurred.
• The failure occurred before scan analysis, so repository size/token usage was not a factor.

What is the expected behavior?

After I click Start scan, Codex Security should immediately confirm the launch, return a durable scan ID to the active Codex task, and begin the standard repository security scan. The setup should not time out, and retrying should not leave or encounter a stale “scan-start waiter.”

Additional information

This was reproducible in the Codex desktop app on Windows and was not caused by repository access, permissions, rate limits, or a broad Codex outage. The workspace setup saved successfully; only the Start-scan handoff failed.
The plugin’s scan-start wait request remained pending after the button click. Desktop logs show related MCP calls eventually completing after roughly 201–256 seconds, which is consistent with the client timing out before the long-polling handoff completed. No scan ID was returned, so the scan never began.

This message was created by Codex which directly scanned for the root cause, etc.