Plugin marketplace upgrades leak staging clones under ~/.codex/.tmp (26 GB / 234 dirs over ~4 months)

What happened

Every plugin-marketplace upgrade stages into a randomized temp clone under

~/.codex/.tmp/marketplaces/.staging/marketplace-upgrade-<random>/

and the staging directory is never removed — on either the success or the failure branch. Because each staging directory is a full-history git clone, the .git alone is ~293 MB against a ~35 MB working tree, so the directory grows without bound.

I found this during a routine disk audit. On my machine:

That was 26 GB of a 33 GB ~/.codex, and it had taken the volume down to 13 GB free. After removing them, free space went from 13 GB to 39 GB.

The .tmp path segment suggests these were always intended to be transient, so I don't think this is by design.

Steps to reproduce

1. Install one or more plugin marketplaces.
2. Trigger marketplace upgrades repeatedly over a period of normal use.
3. du -sh ~/.codex/.tmp/marketplaces/.staging/

$ ls -1 ~/.codex/.tmp/marketplaces/.staging | wc -l
234
$ du -sh ~/.codex/.tmp/marketplaces/.staging
 26G	.../.staging
$ du -sh ~/.codex/.tmp/marketplaces/.staging/marketplace-upgrade-*/.git | head -3
293M	.../marketplace-upgrade-<a>/.git
293M	.../marketplace-upgrade-<b>/.git
292M	.../marketplace-upgrade-<c>/.git

Expected

Staging directories are removed once an upgrade completes or fails.

Actual

They accumulate indefinitely, one per upgrade run, each carrying full git history.

Suggested fixes

Two independent changes — either alone stops the unbounded growth, and I'd suggest both:

1. Clean up on exit. Wrap the staging directory in trap/defer-style cleanup covering both the success and failure paths. This is the actual bug.
2. Shallow-clone the staging copy (--depth=1). Staging only needs the tree, not the history. This alone would have made 234 leaked directories cost ~8 GB instead of 26 GB — useful defence in depth, but not a substitute for (1).

A startup reaper for pre-existing backlogs would also help users who already have hundreds of these, since fixing the leak going forward won't reclaim what's already on disk.

Related, same pattern, much smaller

Two other never-reaped directory families under ~/.codex/.tmp/, noting them in case they share a code path:

• plugins-backup-* — 86 MB across 2 directories
• marketplace-backup-* — ~120 MB across 6 directories

Environment

• codex-cli 0.144.4 (installed via Homebrew)
• ~/.codex/version.json reports latest_version 0.146.0
• macOS (Apple Silicon)

Workaround

For anyone hitting this before a fix lands — a dry run first, since this deletes directories:

# inspect
find ~/.codex/.tmp/marketplaces/.staging -mindepth 1 -maxdepth 1 \
     -type d -name 'marketplace-upgrade-*' -mtime +7 | wc -l

# remove only clones older than 7 days, so an in-flight upgrade is never touched
find ~/.codex/.tmp/marketplaces/.staging -mindepth 1 -maxdepth 1 \
     -type d -name 'marketplace-upgrade-*' -mtime +7 -exec rm -rf {} +

The age gate matters — deleting the whole directory unconditionally can race an upgrade that is currently running.

The staging path is ~/.codex/.tmp/marketplaces/.staging/marketplace-upgrade-; start by tracing the marketplace upgrade entry point and its git-clone lifecycle. Verify cleanup on both success and failure, then reproduce repeated upgrades and confirm no staging directories remain; assess shallow cloning separately.