fix(build): refuse vendoring @cometix/codex older than 0.142.0 (logs_2.sqlite disk-burn fix) - #97
Open
Conversation
…2.sqlite disk-burn fix)
Reviewer's GuideBoth macOS/Windows and Linux vendor-resolution paths now fail fast when npm resolves @cometix/codex below 0.142.0, preventing builds from silently packaging a CLI affected by unbounded ~/.codex/logs_2.sqlite growth. Sequence diagram for minimum Codex version validation during vendoringsequenceDiagram
participant Build as Build process
participant Resolver as Vendor resolver
participant NPM as npm registry
participant Pack as npm pack
Build->>Resolver: resolveCodexVendor(platform) / ensureVendorExtracted(platform)
Resolver->>NPM: npm view @cometix/codex version
NPM-->>Resolver: baseVer
Resolver->>Resolver: compareVersion(baseVer, MIN_CODEX_VERSION)
alt baseVer older than 0.142.0
Resolver-->>Build: assertMinCodexVersion(baseVer) throws
else baseVer is supported
Resolver->>Pack: npm pack @cometix/codex@baseVer-platform
Pack-->>Resolver: packaged CLI
Resolver-->>Build: vendor CLI
end
File-Level Changes
Assessment against linked issues
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 3 issues
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="scripts/build-from-upstream.js" line_range="71" />
<code_context>
// npm pack fallback — fetch platform-specific package
+ // openai/codex#28224: CLI versions < 0.142.0 let ~/.codex/logs_2.sqlite grow
+ // unbounded (2 GB+ disk burn). Never vendor an older CLI.
+ const MIN_CODEX_VERSION = "0.142.0";
+
+ function compareVersion(a, b) {
</code_context>
<issue_to_address>
**issue (broader_impact):** The minimum-version check is bypassed whenever an existing platform-specific or old-style vendor binary is found in `node_modules`, because both functions return before reaching `assertMinCodexVersion`. A stale installed package below 0.142.0 can therefore still be copied into a release.
**Triggers:** When `node_modules` contains an older @cometix/codex vendor package.
**Suggested fix:** Read and validate the installed package version before returning a local vendor path, or apply the version check to every resolved vendor source.
</issue_to_address>
### Comment 2
<location path="scripts/build-from-upstream.js" line_range="73-80" />
<code_context>
+ // unbounded (2 GB+ disk burn). Never vendor an older CLI.
+ const MIN_CODEX_VERSION = "0.142.0";
+
+ function compareVersion(a, b) {
+ const pa = a.split("-")[0].split(".").map(Number);
+ const pb = b.split("-")[0].split(".").map(Number);
+ for (let i = 0; i < 3; i++) {
+ const d = (pa[i] || 0) - (pb[i] || 0);
+ if (d !== 0) return d;
+ }
+ return 0;
+ }
+
</code_context>
<issue_to_address>
**issue (bug_risk):** `compareVersion` removes everything after the first hyphen, so prereleases such as `0.142.0-alpha` compare equal to stable `0.142.0` and pass the minimum check even though semver orders them below the stable release.
**Triggers:** When npm resolves a prerelease version at the minimum numeric version.
**Suggested fix:** Parse and compare prerelease identifiers according to semver, while treating the package-specific `-cometix` suffix according to the intended versioning contract.
</issue_to_address>
### Comment 3
<location path="scripts/build-from-upstream.js" line_range="71" />
<code_context>
// npm pack fallback — fetch platform-specific package
+ // openai/codex#28224: CLI versions < 0.142.0 let ~/.codex/logs_2.sqlite grow
+ // unbounded (2 GB+ disk burn). Never vendor an older CLI.
+ const MIN_CODEX_VERSION = "0.142.0";
+
+ function compareVersion(a, b) {
</code_context>
<issue_to_address>
**nitpick:** The minimum version and comparison logic are duplicated in two standalone scripts, so updating the vulnerability threshold in one resolver leaves the other resolver enforcing a different policy.
**Triggers:** When the required minimum Codex version changes in a later fix.
**Suggested fix:** Move the shared minimum version and comparison/assertion helper into a common module imported by both build scripts.
</issue_to_address>Sourcery assessment
Approval pending. 2 findings to address first.
Blocking findings: scripts/build-from-upstream.js:71, scripts/build-from-upstream.js:80
| // npm pack fallback — fetch platform-specific package | ||
| // openai/codex#28224: CLI versions < 0.142.0 let ~/.codex/logs_2.sqlite grow | ||
| // unbounded (2 GB+ disk burn). Never vendor an older CLI. | ||
| const MIN_CODEX_VERSION = "0.142.0"; |
There was a problem hiding this comment.
issue (broader_impact): The minimum-version check is bypassed whenever an existing platform-specific or old-style vendor binary is found in node_modules, because both functions return before reaching assertMinCodexVersion. A stale installed package below 0.142.0 can therefore still be copied into a release.
Triggers: When node_modules contains an older @cometix/codex vendor package.
Suggested fix: Read and validate the installed package version before returning a local vendor path, or apply the version check to every resolved vendor source.
Comment on lines
+73
to
+80
| function compareVersion(a, b) { | ||
| const pa = a.split("-")[0].split(".").map(Number); | ||
| const pb = b.split("-")[0].split(".").map(Number); | ||
| for (let i = 0; i < 3; i++) { | ||
| const d = (pa[i] || 0) - (pb[i] || 0); | ||
| if (d !== 0) return d; | ||
| } | ||
| return 0; |
There was a problem hiding this comment.
issue (bug_risk): compareVersion removes everything after the first hyphen, so prereleases such as 0.142.0-alpha compare equal to stable 0.142.0 and pass the minimum check even though semver orders them below the stable release.
Triggers: When npm resolves a prerelease version at the minimum numeric version.
Suggested fix: Parse and compare prerelease identifiers according to semver, while treating the package-specific -cometix suffix according to the intended versioning contract.
| // npm pack fallback — fetch platform-specific package | ||
| // openai/codex#28224: CLI versions < 0.142.0 let ~/.codex/logs_2.sqlite grow | ||
| // unbounded (2 GB+ disk burn). Never vendor an older CLI. | ||
| const MIN_CODEX_VERSION = "0.142.0"; |
There was a problem hiding this comment.
nitpick: The minimum version and comparison logic are duplicated in two standalone scripts, so updating the vulnerability threshold in one resolver leaves the other resolver enforcing a different policy.
Triggers: When the required minimum Codex version changes in a later fix.
Suggested fix: Move the shared minimum version and comparison/assertion helper into a common module imported by both build scripts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Issue #89 tracks openai/codex#28224: the codex CLI wrote an unbounded logs_2.sqlite (~/.codex/logs_2.sqlite growing past 2 GB), fixed in CLI 0.142.0. This repo vendors the CLI binary at build time via
npm view @cometix/codex version+npm packin both scripts/build-from-upstream.js (mac/win) and scripts/prepare-src.js (linux). Previously nothing validated the resolved version, so a stale registry/cache response would silently ship a CLI that still has the disk-burn bug. Both vendor resolvers now enforce a MIN_CODEX_VERSION of 0.142.0 with a numeric (prerelease-aware) semver comparison and abort the build with a clear message if the resolved base version is older, so releases fail fast instead of burning users' disks. Affected users can self-check withls -alh ~/.codex/logs_2.sqlite.Why
This change resolves the target issue or improvement.
How to test
Verify that the project builds/runs correctly and the specific bug/improvement is addressed.
Fixes #89
Summary by Sourcery
Refuse to vendor vulnerable Codex CLI releases by enforcing version 0.142.0 or newer during builds.
Bug Fixes:
logs_2.sqlitedisk-growth bug.Enhancements: