Codex Desktop (macOS): Codex Security scan-setup MCP workspace renders blank after successful workspace creation

Codex App version

Codex Desktop 26.721.41059 (build 5848)

Embedded Chromium / Codex Framework: 150.0.7871.128

Codex Security plugin package: 0.1.13
Codex Security MCP implementation reports: 0.1.84

Platform

macOS 26.5.2 (build 25F84), Apple silicon (arm64).

The problem is visible in the main Codex window in a dual-monitor setup.

Issue

Opening the native Codex Security scan-setup workspace results in a completely white content area. The surrounding Codex tab/window shell remains visible and responsive, but the setup form does not render and no usable error state is shown.

This is reproducible when requesting only the standard scan setup, without starting a scan. It also reproduces after a complete clean UI-profile reset.

The Codex Security backend appears to be healthy:

• open_codex_security_workspace returns successfully and creates a workspace.
• The returned workspace remains in the expected pre-scan state (setup.submitted=false).
• No scan row is created, so the scan has not started.
• The Codex Security MCP processes remain alive.
• The bundled MCP UI artifact decompresses successfully, has the title Codex Security, and contains the Start scan UI text.
• The Codex app bundle passes macOS code-signature verification.

This suggests a Desktop MCP-app renderer/host integration failure rather than a scan-engine or workspace-creation failure.

Steps to reproduce

1. Open any local Git repository in Codex Desktop.
2. Ask Codex to open only the standard Codex Security scan setup, or use:

@Codex Security Run a Codex Security scan on this repository.

1. Codex Security creates/opens its workspace.
2. Observe that the workspace tab opens, but its content area is entirely white.
3. Refresh/reopen the workspace or relaunch Codex; the content remains white.
4. Quit Codex, move both the Codex Application Support directory and Codex cache directory aside so the app creates a completely fresh UI profile, relaunch, and repeat.
5. The same white screen still occurs.

The MCP app may briefly appear inline in chat in some attempts, but reopening the same workspace does not produce a usable setup UI.

Expected behavior

The Codex Security setup form should render with repository scope, scan mode, and a Start Scan action. If rendering fails, the host should show an explicit, recoverable error instead of an empty white surface.

Actual behavior

Only a white content area is displayed. The backend workspace exists, but the user cannot review or submit the setup.

Diagnostics observed

The following renderer warnings were observed around affected sessions:

ResizeObserver loop completed with undelivered notifications.
Matched leaf route at location "/" ... "empty" page
MaxListenersExceededWarning: Possible EventEmitter memory leak detected.
11 destroyed listeners added to [WebContents]

These warnings are reported as concurrent evidence and are not asserted to be the root cause. No relevant authentication failure, scan-backend failure, or render-process-gone event was observed.

The shipped UI artifact was independently validated:

Brotli decompression: success
Decompressed size: 543,884 bytes
Document title: Codex Security
Contains: Start scan
SHA-256: f1fd90b431cff3b6c0d7c0a9fdb690181ee6202880955a6cf16384203af8e5c8

Related issue

• #34901 reports a blank Plugins → Codex Security detail page and similar renderer warnings. This report is a different route: the native Codex Security scan-setup MCP workspace remains blank even though workspace creation succeeds.

Privacy

Local usernames, repository/project names, absolute paths, account/thread/workspace/request IDs, authentication material, and complete logs are intentionally omitted. Sanitized excerpts or a screen recording can be provided if needed.