Marketplace upgrade staging folders leak ~400MB each and are never cleaned up — 212GB orphaned in ~/.codex/.tmp/marketplaces/.staging

What version of Codex CLI is running?

0.154.0 (installed globally via npm: @openai/codex@0.154.0)

What subscription do you have?

Plus

Which model were you using?

Not model-specific — this happens during background marketplace sync/upgrade, regardless of model in use.

What platform is your computer?

Darwin 25.6.0 x86_64 i386

What terminal emulator and version are you using (if applicable)?

zsh 5.9 inside Orca

Codex doctor report

not available

What issue are you seeing?

Codex leaks a full ~400MB git clone of the plugin marketplace every time it attempts a marketplace sync/upgrade, and never cleans up the staging folder when the upgrade is interrupted or fails.

Over ~1 month this accumulated 462 orphaned staging folders totaling 212GB, filling my 460GB disk (98% usage).

Evidence:

$ du -sh ~/.codex
214G ~/.codex

$ du -sh ~/.codex/.tmp
212G ~/.codex/.tmp

$ ls ~/.codex/.tmp/marketplaces/.staging | wc -l
462

$ du -sh ~/.codex/.tmp/marketplaces/.staging
212G ~/.codex/.tmp/marketplaces/.staging

Each orphaned folder contains a full marketplace clone whose .git pack is ~400–414MB, e.g.:

~/.codex/.tmp/marketplaces/.staging/marketplace-upgrade-iDBncB/.git/objects/pack/pack-38348f1883bee2b2176d90ee09b9dccaaa71e4ef.pack (409M, Sep 14)
~/.codex/.tmp/marketplaces/.staging/marketplace-upgrade-DNnkt4/.git/objects/pack/pack-8f1bc941271a68dd8d42850330d31d42a04c97d0.pack (414M, Sep 13)
~/.codex/.tmp/marketplaces/.staging/marketplace-upgrade-F1dLQ8/.git/objects/pack/pack-8d3aef5084290389b11f8b4734eeb5d1493ddef5.pack (403M, Sep 6)

The staging folders are created multiple times per day (several on Sep 1, 3, 6, 7, 13, 14, 15, 16), each with a fresh random suffix — meaning upgrades are being attempted repeatedly and every incomplete attempt is leaked. There are also ~800 tiny orphaned git-* temp dirs in the same .tmp directory, suggesting other git-based operations leak the same way.

No error surfaced to me during normal use; the disk just filled up. Only manual inspection of ~/.codex revealed the cause. Expected cleanup of incomplete staging directories never happens, neither on next successful upgrade nor at session/app start.

Important: the leak is NOT limited to interrupted upgrades. On a fresh, correctly-installed Codex 0.154.0, a successful read-only
codex plugin marketplace list cloned a 547MB marketplace repo into .staging/marketplace-upgrade-eeALi1 and left it behind after the command completed without error. This suggests every marketplace operation clones a full copy to .staging/ with no post-operation cleanup, regardless of success.

What steps can reproduce the bug?

1. Use Codex with a plugin marketplace that has a large git history (~400MB .git pack, in my case the "hyperframes" marketplace).

2. Trigger marketplace sync/upgrade repeatedly (it happens automatically in the background) while the upgrade is interrupted or fails partway.

3. Observe that each attempt leaves a full clone behind:

   ~/.codex/.tmp/marketplaces/.staging/marketplace-upgrade-/

4. Over time, these are never pruned:

   ls ~/.codex/.tmp/marketplaces/.staging | wc -l # 462
   du -sh ~/.codex/.tmp/marketplaces/.staging # 212GB

5. Reproduction confirmed on a FRESH install (Codex 0.154.0 reinstalled via
   npm install -g @openai/codex@latest), not a corrupted local state:

   $ codex plugin marketplace list # completes successfully, no error
   $ du -sh ~/.codex/.tmp/marketplaces/.staging
   547M ~/.codex/.tmp/marketplaces/.staging

   A single read-only marketplace list command cloned the full marketplace repo (547MB) into .staging/marketplace-upgrade-eeALi1 and left it behind when the command finished. A sibling .codex/.tmp/plugins-clone-FxsA7a (88MB) was orphaned the same way.

   This means the leak is not limited to interrupted/failed upgrades — every marketplace operation that clones to .staging/ appears to orphan the clone, even successful read-only ones.

The growth is steady: dozens of new marketplace-upgrade-* folders per week, each ~400–420MB, all containing an identical-sized git pack of the same marketplace repo.

What is the expected behavior?

1. Incomplete marketplace upgrade staging directories should be cleaned up:

   • on the next successful upgrade attempt, and/or
   • at startup (sweep .staging/ and remove entries not referenced by an in-flight upgrade), and/or
   • via a TTL-based garbage collection.

2. Repeated failed upgrades of the same marketplace should not stack hundreds of full ~400MB clones of the same repo without any retention limit.

3. Ideally, reusing a single persistent clone location for the marketplace (updating in place, or pruning previous attempts before starting a new one) instead of cloning a fresh ~400MB copy per attempt.

Additional information

• Cleaning ~/.codex/.tmp/marketplaces/.staging freed 212GB instantly. Nothing else in ~/.codex (sessions, plugins, sqlite state) was larger than ~500MB.
• The random-suffix folder names (marketplace-upgrade-U5bk8j, marketplace-upgrade-bMfACj, ...) with mtimes spread across ~4 weeks confirm a continuous leak, not a single incident.
• Possibly related: after this accumulation, the local CLI install broke ("Missing optional dependency @openai/codex-darwin-x64"), suggesting the update/upgrade pipeline leaves the install in a partial state when interrupted.
• Suggest also exposing this temp-directory usage in codex doctor (e.g., a check for oversized ~/.codex/.tmp) so leaks like this are detectable.
• Reproduced on a fresh reinstall (npm install -g @openai/codex@latest, codex-cli 0.154.0), ruling out a corrupted local install as the cause. The leak is in the product's marketplace pipeline: it clones the full repo per operation with no post-operation cleanup, GC, or startup sweep of .staging/.

Start with the codex plugin marketplace list entry point and the ~/.codex/.tmp/marketplaces/.staging paths described in the report; trace how marketplace clones are created and completed. Reproduce the fresh-install case, then verify that successful and interrupted operations no longer leave unreferenced staging directories or unbounded clone data behind.