From 293ab5080c1498dede3e704bea48ed876559ab86 Mon Sep 17 00:00:00 2001
From: Sylvester Kaczmarek
 <16242628+sylvesterkaczmarek@users.noreply.github.com>
Date: Thu, 20 Aug 2026 00:02:27 +0100
Subject: [PATCH 1/3] fix: allow large git output during scan prep

---
 sdk/typescript/src/targets.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sdk/typescript/src/targets.ts b/sdk/typescript/src/targets.ts
index 5c8ab0888..4b5f1e56f 100644
--- a/sdk/typescript/src/targets.ts
+++ b/sdk/typescript/src/targets.ts
@@ -413,6 +413,7 @@ async function gitOutput(
       encoding: "utf8",
       signal,
       env: command.environment,
+      maxBuffer: Infinity,
     },
   );
   return stdout.trim();

From f8b9a2aab066a3550f039d7dfc6fffe8d597c025 Mon Sep 17 00:00:00 2001
From: Sylvester Kaczmarek
 <16242628+sylvesterkaczmarek@users.noreply.github.com>
Date: Thu, 20 Aug 2026 00:02:50 +0100
Subject: [PATCH 2/3] test: cover large tracked-file inventories

---
 .../tests-ts/targets-large-output.test.ts     | 74 +++++++++++++++++++
 1 file changed, 74 insertions(+)
 create mode 100644 sdk/typescript/tests-ts/targets-large-output.test.ts

diff --git a/sdk/typescript/tests-ts/targets-large-output.test.ts b/sdk/typescript/tests-ts/targets-large-output.test.ts
new file mode 100644
index 000000000..35853ee2c
--- /dev/null
+++ b/sdk/typescript/tests-ts/targets-large-output.test.ts
@@ -0,0 +1,74 @@
+import { execFileSync } from "node:child_process";
+import { mkdtemp, mkdir, realpath, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, expect, test } from "bun:test";
+import {
+  DiffTarget,
+  normalizeTarget,
+  validateCommittedDiffCheckout,
+} from "../src/targets.js";
+
+const temporaryDirectories: string[] = [];
+
+afterEach(async () => {
+  await Promise.all(
+    temporaryDirectories
+      .splice(0)
+      .map((path) => rm(path, { recursive: true, force: true })),
+  );
+});
+
+function git(repo: string, ...args: string[]): string {
+  return execFileSync("git", args, {
+    cwd: repo,
+    encoding: "utf8",
+    maxBuffer: Infinity,
+  }).trim();
+}
+
+test("validates committed diffs with tracked-file output larger than 1 MB", async () => {
+  if (process.platform === "win32") return;
+
+  const root = await realpath(
+    await mkdtemp(join(tmpdir(), "codex-security-large-targets-")),
+  );
+  temporaryDirectories.push(root);
+  const repo = join(root, "repo");
+  await mkdir(repo);
+
+  git(repo, "init", "-b", "main");
+  git(repo, "config", "user.email", "test@example.com");
+  git(repo, "config", "user.name", "Test");
+
+  const longDirectory = join(
+    repo,
+    "a".repeat(200),
+    "b".repeat(200),
+    "c".repeat(200),
+  );
+  await mkdir(longDirectory, { recursive: true });
+  await Promise.all(
+    Array.from({ length: 1_500 }, (_, index) =>
+      writeFile(
+        join(
+          longDirectory,
+          `${index.toString().padStart(4, "0")}-${"x".repeat(180)}.ts`,
+        ),
+        "",
+      ),
+    ),
+  );
+
+  git(repo, "add", ".");
+  git(repo, "commit", "--quiet", "-m", "large tracked tree");
+
+  const tracked = git(repo, "ls-files", "-t", "-z");
+  expect(Buffer.byteLength(tracked, "utf8")).toBeGreaterThan(1024 * 1024);
+
+  const target = await normalizeTarget(
+    repo,
+    DiffTarget.refs({ base: "HEAD" }),
+  );
+  await expect(validateCommittedDiffCheckout(repo, target)).resolves.toBeUndefined();
+});

From 3c848052cd76e16517e63518dce12d7de5f34210 Mon Sep 17 00:00:00 2001
From: Sylvester Kaczmarek
 <16242628+sylvesterkaczmarek@users.noreply.github.com>
Date: Thu, 20 Aug 2026 00:10:18 +0100
Subject: [PATCH 3/3] test: format large inventory assertion

---
 sdk/typescript/tests-ts/targets-large-output.test.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sdk/typescript/tests-ts/targets-large-output.test.ts b/sdk/typescript/tests-ts/targets-large-output.test.ts
index 35853ee2c..d9f3e3c31 100644
--- a/sdk/typescript/tests-ts/targets-large-output.test.ts
+++ b/sdk/typescript/tests-ts/targets-large-output.test.ts
@@ -70,5 +70,7 @@ test("validates committed diffs with tracked-file output larger than 1 MB", asyn
     repo,
     DiffTarget.refs({ base: "HEAD" }),
   );
-  await expect(validateCommittedDiffCheckout(repo, target)).resolves.toBeUndefined();
+  await expect(
+    validateCommittedDiffCheckout(repo, target),
+  ).resolves.toBeUndefined();
 });