[codex] Prevent background Git fetches from leaking temp packs#3537

closed7

main

codex/fix-git-fetch-temp-pack-leaks

openedJun 23, 2026byJJulius Marminge

View on GitHubTwo-way sync enabledPR last imported 3d ago

16 unresolved threads · Jump to file

Selected thread: apps/server/src/provider/Layers/EventNdjsonLogger.ts:226 — 🟠 **High** `Layers/EventNdjsonLogger.ts:226` `enforceRetention` deletes every file in the store's directory whose name matches `/\.log(?:\.\d+)?$/u` — including unrelated log files from other components. Since `makeEventNdjsonLogStore` accepts arbitrary paths (e.g. adapter-supplied `nativeEventLogPath`), pointing it at a shared log directory causes the initial and periodic retention sweeps to permanently delete other components' `.log` files once they exceed `maxAgeMs` or contribute to `maxTotalBytes`. The `PROVIDER_LOG_FILE_PATTERN` regex is too broad to scope deletion to this store's own thread-log files. Consider restricting candidates to the thread-segment naming scheme (e.g. `^[A-Za-z0-9_-]+\.log(?:\.\d+)?$` matching `toSafeThreadAttachmentSegment` output) or requiring a dedicated directory. ```suggestion if (!entry.isFile() || !PROVIDER_THREAD_LOG_PATTERN.test(entry.name)) continue; ``` <details> <summary>🚀 Reply "<strong>fix it for me</strong>" or copy this <strong>AI Prompt</strong> for your agent:</summary> ```text In file @apps/server/src/provider/Layers/EventNdjsonLogger.ts around line 226: `enforceRetention` deletes every file in the store's directory whose name matches `/\.log(?:\.\d+)?$/u` — including unrelated log files from other components. Since `makeEventNdjsonLogStore` accepts arbitrary paths (e.g. adapter-supplied `nativeEventLogPath`), pointing it at a shared log directory causes the initial and periodic retention sweeps to permanently delete other components' `.log` files once they exceed `maxAgeMs` or contribute to `maxTotalBytes`. The `PROVIDER_LOG_FILE_PATTERN` regex is too broad to scope deletion to this store's own thread-log files. Consider restricting candidates to the thread-segment naming scheme (e.g. `^[A-Za-z0-9_-]+\.log(?:\.\d+)?$` matching `toSafeThreadAttachmentSegment` output) or requiring a dedicated directory. ``` </details>

0 / 100 viewed100 files changedLine totals unavailable

apps/server/src/diagnostics/ProcessDiagnostics.ts · File comment

macroscopeappBotJul 29, 2026

🟡 Medium

https://github.com/pingdotgg/t3code/blob/58340604f0b7967e7a5a3e532993f3443442d14e/apps/server/src/diagnostics/ProcessDiagnostics.ts#L1

The read function filters only the server PID out of snapshot.processes, so independent Electron roots and the resource-monitor process are returned as server child processes. This inflates processCount, totalRssBytes, and totalCpuPercent, and their depth is clamped to 0 via Math.max(0, entry.depth - 1) even though they are not descendants of the server. The filter at line 78 should restrict the list to the server/backend descendant tree rather than all telemetry processes.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

text

1	In file @apps/server/src/diagnostics/ProcessDiagnostics.ts around line 1:
2
3	The `read` function filters only the server PID out of `snapshot.processes`, so independent Electron roots and the resource-monitor process are returned as server child processes. This inflates `processCount`, `totalRssBytes`, and `totalCpuPercent`, and their `depth` is clamped to `0` via `Math.max(0, entry.depth - 1)` even though they are not descendants of the server. The filter at line 78 should restrict the list to the server/backend descendant tree rather than all telemetry processes.