Skip to content

fix(build): refuse vendoring @cometix/codex older than 0.142.0 (logs_2.sqlite disk-burn fix) #97

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MatrixNeoKozak wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix(build): refuse vendoring @cometix/codex older than 0.142.0 (logs_2.sqlite disk-burn fix) #97

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions scripts/build-from-upstream.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,25 @@ function resolveCodexVendor(platform) {
if (fs.existsSync(localPath)) return localPath;

// npm pack fallback — fetch platform-specific package
// openai/codex#28224: CLI versions < 0.142.0 let ~/.codex/logs_2.sqlite grow
// unbounded (2 GB+ disk burn). Never vendor an older CLI.
const MIN_CODEX_VERSION = "0.142.0";

@sourcery-ai sourcery-ai Bot Sep 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

issue (broader_impact): The minimum-version check is bypassed whenever an existing platform-specific or old-style vendor binary is found in node_modules, because both functions return before reaching assertMinCodexVersion. A stale installed package below 0.142.0 can therefore still be copied into a release.

Triggers: When node_modules contains an older @cometix/codex vendor package.

Suggested fix: Read and validate the installed package version before returning a local vendor path, or apply the version check to every resolved vendor source.

@sourcery-ai sourcery-ai Bot Sep 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nitpick: The minimum version and comparison logic are duplicated in two standalone scripts, so updating the vulnerability threshold in one resolver leaves the other resolver enforcing a different policy.

Triggers: When the required minimum Codex version changes in a later fix.

Suggested fix: Move the shared minimum version and comparison/assertion helper into a common module imported by both build scripts.


function compareVersion(a, b) {
const pa = a.split("-")[0].split(".").map(Number);
const pb = b.split("-")[0].split(".").map(Number);
for (let i = 0; i < 3; i++) {
const d = (pa[i] || 0) - (pb[i] || 0);
if (d !== 0) return d;
}
return 0;
Comment on lines +73 to +80

@sourcery-ai sourcery-ai Bot Sep 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

issue (bug_risk): compareVersion removes everything after the first hyphen, so prereleases such as 0.142.0-alpha compare equal to stable 0.142.0 and pass the minimum check even though semver orders them below the stable release.

Triggers: When npm resolves a prerelease version at the minimum numeric version.

Suggested fix: Parse and compare prerelease identifiers according to semver, while treating the package-specific -cometix suffix according to the intended versioning contract.

}

function assertMinCodexVersion(ver) {
if (compareVersion(ver, MIN_CODEX_VERSION) < 0) {
throw new Error(`@cometix/codex ${ver} is older than ${MIN_CODEX_VERSION}, which fixed the logs_2.sqlite disk-burn bug (openai/codex#28224). Refusing to vendor a buggy CLI; upgrade @cometix/codex first.`);
}
}
// First get latest cometix base version, then append platform suffix
const PLAT_SUFFIX = {
"mac-arm64": "darwin-arm64", "mac-x64": "darwin-x64",
Expand All @@ -80,6 +99,7 @@ function resolveCodexVendor(platform) {
baseVer = execSync("npm view @cometix/codex version", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
} catch { return null; }

assertMinCodexVersion(baseVer);
// e.g. "0.128.0-cometix" → "@cometix/codex@0.128.0-cometix-darwin-x64"
const platPkgSpec = `@cometix/codex@${baseVer}-${suffix}`;
console.log(` [codex] fetching ${platPkgSpec} via npm pack...`);
Expand Down
20 changes: 20 additions & 0 deletions scripts/prepare-src.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,25 @@ function ensureVendorExtracted(platform) {
// 2. Try old-style vendor
const oldPath = path.join(PROJECT_ROOT, "node_modules", "@cometix", "codex", "vendor", triple);
if (fs.existsSync(oldPath)) { _vendorRootCache = oldPath; return oldPath; }
// openai/codex#28224: CLI versions < 0.142.0 let ~/.codex/logs_2.sqlite grow
// unbounded (2 GB+ disk burn). Never vendor an older CLI.
const MIN_CODEX_VERSION = "0.142.0";

function compareVersion(a, b) {
const pa = a.split("-")[0].split(".").map(Number);
const pb = b.split("-")[0].split(".").map(Number);
for (let i = 0; i < 3; i++) {
const d = (pa[i] || 0) - (pb[i] || 0);
if (d !== 0) return d;
}
return 0;
}

function assertMinCodexVersion(ver) {
if (compareVersion(ver, MIN_CODEX_VERSION) < 0) {
throw new Error(`@cometix/codex ${ver} is older than ${MIN_CODEX_VERSION}, which fixed the logs_2.sqlite disk-burn bug (openai/codex#28224). Refusing to vendor a buggy CLI; upgrade @cometix/codex first.`);
}
}

// 3. npm pack platform package
const PLAT_SUFFIX = {
Expand All @@ -90,6 +109,7 @@ function ensureVendorExtracted(platform) {
baseVer = execSync("npm view @cometix/codex version", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
} catch { return null; }

assertMinCodexVersion(baseVer);
const spec = `@cometix/codex@${baseVer}-${suffix}`;
console.log(` [vendor] fetching ${spec} via npm pack...`);
const tmpDir = path.join(require("os").tmpdir(), "cometix-codex-pack");
Expand Down