TypeScript SDK: invalid input leaks the temporary output-schema file

Aperta Adatta ai principianti
  • Qualcosa non va?
#60,299 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
72/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
javascript, node.js, typescript
Ambito
cli

Direzione di ricerca

La perdita si trova in sdk/typescript/src/thread.ts, in Thread.runStreamedInternal(), dove createOutputSchemaFile viene eseguita prima di normalizeInput e prima del try/finally di pulizia. Leggi prima questo ordine, poi riproduci il problema con lo snippet JavaScript che usa input null, e controlla se restano directory codex-output-schema-*. Il lavoro è completato quando un input non valido viene rifiutato senza lasciare alcuna directory temporanea dello schema e tests/outputSchemaCleanup.test.ts passa; la proposta nell'issue valida l'input prima di allocare la risorsa.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug
What issue are you seeing?

The TypeScript SDK creates the temporary output-schema file before validating input, then enters its cleanup try/finally only after input normalization. If a JavaScript caller supplies invalid input such as null, normalization throws and leaves a codex-output-schema-* directory containing schema.json behind.

This is a low-severity cleanup defect for invalid JavaScript input. Rejecting null is expected; TypeScript callers respecting the static input type do not trigger this case.

What steps can reproduce the bug?

Confirmed with SDK source at 0b021a5fc981448a2555bd378518e85e3aae3016, Node v26.12.1, macOS. Build/install the SDK from that revision and run this JavaScript as an ES module where @openai/codex-sdk resolves to that build. No model call is needed: input normalization fails before execution.

import assert from 'node:assert/strict';
import { Codex } from '@openai/codex-sdk';
import { readdir, rm } from 'node:fs/promises';
import { tmpdir } from 'node:os';
import { join } from 'node:path';

const root = tmpdir();
const before = new Set(await readdir(root));
let leaked = [];
try {
  await assert.rejects(
    new Codex().startThread().run(null, { outputSchema: { type: 'object' } }),
    TypeError,
  );
  leaked = (await readdir(root)).filter(
    name => name.startsWith('codex-output-schema-') && !before.has(name),
  );
  console.log('temporary schema directories left behind:', leaked.length);
  for (const name of leaked) {
    console.log('contents:', await readdir(join(root, name)));
  }
} finally {
  for (const name of leaked) {
    await rm(join(root, name), { recursive: true, force: true });
  }
}

Use a disposable environment without other SDK runs so temporary-directory comparisons are unambiguous. Our original harness used the actual source modules with a controlled executor and observed one leaked directory containing only schema.json. A valid-input control with the same schema left no directory.

What is the expected behavior?

Invalid input should reject without retaining the temporary schema file or directory.

Additional information

Root cause: Thread.runStreamedInternal() awaits createOutputSchemaFile, then calls normalizeInput, before entering the cleanup guard. The helper's own write-error cleanup cannot cover this later exception.

A local candidate validates input before allocating the temporary resource. Checks against that fix, based on a09812981de7, reported:

13 control: valid input with schema -> run ok, schema dir cleaned
13 after: invalid input rejected with TypeError, schema directories left behind=0

The regression suite tests/outputSchemaCleanup.test.ts fails against the old source and passes against the candidate. It spies on os.tmpdir() to isolate the test directory; setting Jest's sandboxed process.env.TMPDIR alone does not redirect the native os.tmpdir() result. Checks ran in an isolated no-network container. Full native CLI integration tests were not run. The candidate fix remains local.

Searched existing issues for SDK output-schema cleanup, temporary schema files, and schema leaks before filing. Prepared with Codex assistance as an issue-based contribution.

Lingua principale
Rust
Stelle
133k
Fork
21.1k
Merge medio
1m
PR unite (30g)
995

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di openai/codex

Tutte le issue di openai/codex

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.