security(medium): unbounded worktree accumulation (leave-branch) → disk exhaustion #17

Reliability/DoS finding from the adversarial review of #12 (commit 1a9eb11).

Vulnerability

By design, the leave-branch cleanup (#12) never removes the worktree or its branch. Every rescue call adds one <repoRoot>/.worktrees/codex-<ts>/ checkout + one codex/<ts> branch, forever. There is no cap, no roster, and no warning at N existing worktrees.

A malicious or buggy Codex run that triggers rescue in a loop, or a long-running session, fills disk with .worktrees/codex-<ts>/ checkouts — GB-per-call on a multi-GB repo (linked worktrees share the object database but each carries a full working-tree checkout).

This also multiplies the symlink-traversal window (#14): the more .worktrees/ churn, the more chances for a malicious run to swap it for a symlink between rescues.

Severity

MEDIUM — denial of service against the user's disk, trivially triggered, no rate limit. Not data loss.

Fix

At session creation, list existing .worktrees/codex-*. Warn loudly at a threshold (e.g. 10), or fail-closed, requiring the user to clean up before creating more. This is additive — it preserves the leave-branch contract (the library still never destroys); it only adds a pre-creation guard. Optionally pair with a /codex:worktree-cleanup convenience that lists stale worktrees for manual removal.

Refs #12, #13 (umbrella), #14.