TypeScript SDK: invalid input leaks the temporary output-schema file

Abierto Apto para principiantes
  • ¿Algo no está bien?
#60,299 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
72/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
javascript, node.js, typescript
Área
cli

Línea de trabajo

La fuga está en sdk/typescript/src/thread.ts, en Thread.runStreamedInternal(), donde createOutputSchemaFile se ejecuta antes de normalizeInput y antes del try/finally de limpieza. Lee primero ese orden y luego reproduce el problema con el fragmento de JavaScript que usa entrada null, y comprueba si quedan directorios codex-output-schema-*. Se considera terminado cuando la entrada no válida se rechaza sin dejar ningún directorio temporal de esquema, y tests/outputSchemaCleanup.test.ts pasa; la propuesta del issue valida la entrada antes de reservar el recurso.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug
What issue are you seeing?

The TypeScript SDK creates the temporary output-schema file before validating input, then enters its cleanup try/finally only after input normalization. If a JavaScript caller supplies invalid input such as null, normalization throws and leaves a codex-output-schema-* directory containing schema.json behind.

This is a low-severity cleanup defect for invalid JavaScript input. Rejecting null is expected; TypeScript callers respecting the static input type do not trigger this case.

What steps can reproduce the bug?

Confirmed with SDK source at 0b021a5fc981448a2555bd378518e85e3aae3016, Node v26.12.1, macOS. Build/install the SDK from that revision and run this JavaScript as an ES module where @openai/codex-sdk resolves to that build. No model call is needed: input normalization fails before execution.

import assert from 'node:assert/strict';
import { Codex } from '@openai/codex-sdk';
import { readdir, rm } from 'node:fs/promises';
import { tmpdir } from 'node:os';
import { join } from 'node:path';

const root = tmpdir();
const before = new Set(await readdir(root));
let leaked = [];
try {
  await assert.rejects(
    new Codex().startThread().run(null, { outputSchema: { type: 'object' } }),
    TypeError,
  );
  leaked = (await readdir(root)).filter(
    name => name.startsWith('codex-output-schema-') && !before.has(name),
  );
  console.log('temporary schema directories left behind:', leaked.length);
  for (const name of leaked) {
    console.log('contents:', await readdir(join(root, name)));
  }
} finally {
  for (const name of leaked) {
    await rm(join(root, name), { recursive: true, force: true });
  }
}

Use a disposable environment without other SDK runs so temporary-directory comparisons are unambiguous. Our original harness used the actual source modules with a controlled executor and observed one leaked directory containing only schema.json. A valid-input control with the same schema left no directory.

What is the expected behavior?

Invalid input should reject without retaining the temporary schema file or directory.

Additional information

Root cause: Thread.runStreamedInternal() awaits createOutputSchemaFile, then calls normalizeInput, before entering the cleanup guard. The helper's own write-error cleanup cannot cover this later exception.

A local candidate validates input before allocating the temporary resource. Checks against that fix, based on a09812981de7, reported:

13 control: valid input with schema -> run ok, schema dir cleaned
13 after: invalid input rejected with TypeError, schema directories left behind=0

The regression suite tests/outputSchemaCleanup.test.ts fails against the old source and passes against the candidate. It spies on os.tmpdir() to isolate the test directory; setting Jest's sandboxed process.env.TMPDIR alone does not redirect the native os.tmpdir() result. Checks ran in an isolated no-network container. Full native CLI integration tests were not run. The candidate fix remains local.

Searched existing issues for SDK output-schema cleanup, temporary schema files, and schema leaks before filing. Prepared with Codex assistance as an issue-based contribution.

Lenguaje dominante
Rust
Estrellas
133k
Forks
21.1k
Merge medio
1 min
PR fusionados (30 d)
995

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de openai/codex

Todos los issues de openai/codex

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.