[Codex Security] Deep Scan setup fails with RangeError: Invalid string length

What issue are you seeing?

A Codex Security Deep Security Scan launched from the macOS desktop app fails terminally during the coordinator setup phase with:

RangeError: Invalid string length

The scan never reaches repeated discovery. The authoritative scan state becomes failed, with no report and no resumable discovery state.

Sanitized failure-manifest excerpt:

{
  "schemaVersion": 1,
  "workflowVersion": "deep-scan-mcp/v1",
  "scanId": "3f996be4-3b1a-4a3d-ae53-230287b19d1d",
  "discoveryCount": 0,
  "setup": {
    "mode": "deterministic",
    "completed": false
  },
  "status": "failed",
  "dispatchedCount": 0,
  "failure": {
    "phase": "setup",
    "message": "Invalid string length",
    "kind": "RangeError"
  },
  "canonical": null
}

The manifest referenced rank_input.jsonl and deep_review_input.jsonl, but neither file was created. The failure manifest was the only artifact present.

What steps can reproduce the bug?

1. In the Codex macOS desktop app, open a local Git worktree containing a multi-repository development workspace.
2. Start a Codex Security scan in Deep mode for the whole target (scope: ".").
3. Submit the setup workspace and continue in the owning Codex task.
4. Load the authoritative context using get_codex_security_scan_context.
5. Run the required Deep Scan capability preflight; it returns ready.
6. Call start_codex_security_deep_scan for the existing scan ID and wait for the coordinator.
7. The call eventually returns Invalid string length and preserves a terminal failure manifest.

I intentionally did not retry the same logical scan because the Deep Scan workflow marks this failure as terminal and non-resumable.

What is the expected behavior?

The coordinator should complete deterministic setup, create the ranking/deep-review inputs, dispatch discovery, and eventually return a saturated or capped terminal discovery manifest. Large input should either be processed incrementally or rejected early with an actionable size limit rather than a JavaScript RangeError.

Additional information

• Codex/ChatGPT desktop app: 26.727.51351 (build 6119)
• Platform: macOS 26.5.2 (build 25F84), arm64
• Codex Security plugin bundle: 0.1.15
• Workflow: deep-scan-mcp/v1
• Model: gpt-5.6-sol, reasoning effort xhigh
• Target type: private local Git worktree; whole-target scan
• Authoritative inventory reported 829 files
• Capability preflight status: ready
• No repository source, credentials, handoff token, or absolute local paths are included in this report.