[Bug]:Legacy cleo-mcp-reaper kills active Codex CLI sessions and needs upgrade-time migration

[kryptobaseddev]

Bug Report

Impact

Active Codex CLI sessions are deterministically terminated after their npm Node launcher is older than 900 seconds. This can discard in-progress terminal work and was initially misidentified as a Codex crash.

Reproduction and evidence

A host-local user timer ran every 10 minutes and invoked ~/.local/bin/cleo-mcp-reaper.sh. The helper selected every process where /proc/PID/comm equals MainThread, age is at least 900 seconds, and the ancestry lacks a live claude or container process.

The npm-distributed Codex CLI has a legitimate resident Node launcher whose Linux comm is MainThread. The launcher intentionally forwards SIGINT, SIGTERM, and SIGHUP to its native child, so the reaper SIGTERM cleanly terminates the entire Codex session without a panic or coredump.

Observed journal correlations on 2026-08-11 PDT include:

• 14:23:36: two Codex histories ended; 14:23:37: reaper logged killed=2 freed=102MB.
• 14:53:52: reaper logged killed=1 freed=51MB, coincident with another Codex exit.
• Earlier pairs occurred at 11:20:25/26, 11:51:06/07, 12:11:16/27, 12:41:55/56, 13:33:03/04, and 13:53:06/07.
• MIN_AGE_S=0 cleo-mcp-reaper.sh --dry-run selected active Codex npm wrapper PIDs.

The helper and its user units were created together on 2026-07-01 during a CLEO dogfood OOM investigation. They are not package-owned and have no match in current CLEO 2026.8.5 package contents or git history. CLEO memory observation O-mr31kv4d-0 records them as a manually applied live fix. Canonical task T11995 and commit f7f58e5895f10bc17d5f210247e20a9b416e6e62 already implement the safer cleo janitor run, using CLEO-owned scope registration or explicit MCP command signatures plus age and dead stdio peers.

Upstream Codex signal behavior is intentional: https://github.com/openai/codex/blob/f317dc8a17d30d8feb2c79add1d9d565be0402bf/codex-cli/bin/codex.js#L209-L249. Process-title hardening is separately tracked at openai/codex#15238 and cannot make a generic pgrep -x MainThread killer safe.

Immediate remediation applied

The legacy timer was disabled and stopped with systemctl --user disable --now cleo-mcp-reaper.timer. Verification shows UnitFileState=disabled, ActiveState=inactive, no next elapse, and zero timer or cron/autostart activation references. The original helper and journal were preserved as evidence.

Requested CLEO fix

1. cleo doctor and cleo upgrade should detect legacy cleo-mcp-reaper user units or equivalent generic MainThread reapers.
2. Provide an audited migration that disables the unsafe timer and directs operators to the canonical janitor or a positively-owned harness reaper.
3. Never identify an MCP orphan solely through a generic process comm value. Require registered CLEO scope or process group ownership; fallback must require a known MCP command signature, sufficient age, and dead transport or stdio peers.
4. Add regression coverage with a live long-running Codex or generic Node MainThread wrapper that must survive, plus a verified orphan MCP helper that must be reaped.
5. Document the legacy artifact and the migration in troubleshooting and release notes.

Acceptance

After upgrade or doctor repair, an affected host has no enabled unsafe legacy timer; an active Codex CLI older than the grace period survives repeated cleanup cycles; and a synthetic verified MCP orphan is still reclaimed.

Severity: Major
Area: cli

Are you using an AI agent?

Yes - AI agent filed this issue

---

Environment

Component	Version
CLEO	2026.8.5
Node.js	v24.16.0
OS	linux 7.1.5-201.fc44.x86_64 x64 (x64)
Shell	/bin/bash
gh CLI	gh version 2.97.0 (2026-07-31)
Install	/home/keatonhoskins/.npm-global/bin/cleo

[kryptobaseddev]

Follow-up: persistent local containment and systemd precedence

A runtime mask under /run/user/1000/systemd/user did not override the existing units in ~/.config/systemd/user; a test start still returned success. This is important for the requested upgrade migration.

The durable local containment was therefore changed to:

1. Stop and disable the timer.
2. Archive the original unit files as cleo-mcp-reaper.timer.disabled-20260811 and cleo-mcp-reaper.service.disabled-20260811.
3. Persistently mask both original unit names in ~/.config/systemd/user with /dev/null symlinks.

Fresh verification after the change:

• systemctl --user is-enabled cleo-mcp-reaper.timer -> masked
• timer and service are both inactive
• systemctl --user list-timers --all cleo-mcp-reaper.timer -> 0 timers listed
• explicit starts of both units fail with exit 1 and Unit ... is masked

The CLEO migration should account for unit load-path precedence: move or remove the high-precedence user unit before creating the persistent mask. Merely adding a runtime mask is insufficient when the legacy file remains under ~/.config/systemd/user.

[kryptobaseddev]

Final local verification

The legacy executable itself is now neutralized in addition to the persistent unit masks:

• Original helper preserved as ~/.local/bin/cleo-mcp-reaper.sh.disabled-20260811, SHA-256 1db32bd775af9c0ebcec7f56477087e1d5cfe0a210897d245b0b020d62d2ab0f, mode 0644.
• The original path now contains an executable diagnostic-only shim that prints the retirement reason and exits 0; it contains no process enumeration or signal operation.
• A search for the generic MainThread killer logic found it only in the non-executable dated archive.

End-to-end soak proof completed at 15:24:55 PDT:

• The same npm Codex wrapper PID 3716985 and native child PID 3716994 remained alive for 1,246 seconds.
• This exceeded the old 900-second eligibility threshold and crossed the former 15:23:52 timer interval.
• Timer state remained LoadState=masked, ActiveState=inactive, UnitFileState=masked, with no next elapse.
• No reaper journal activity occurred after the deliberate 15:09 safety test; that pre-persistent-mask test killed 0 processes.

An independent read-only audit reached the same result and found no second scheduled process killer. This confirms the deterministic Codex termination path is contained locally while the requested CLEO migration and regression work is pending.