Codex Desktop app spawns Git on launch in read-only mode and leaves massive tmp_pack_/tmp_obj_ garbage in .git/objects on macOS

What version of the Codex App are you using (From “About Codex” dialog)?

Codex Version 26.325.31654 (1272)

What subscription do you have?

ChatGPT Pro

What platform is your computer?

Darwin 25.4.0 arm64 arm

What issue are you seeing?

Summary

On macOS Tahoe, Codex Desktop launches a Git process shortly after app startup even when my configuration is set to:

• Approval policy: Never
• Sandbox settings: Read only

I do not submit any prompt or intentionally trigger any action.

The app then causes my repository's .git directory to balloon rapidly due to garbage files such as:

• .git/objects/pack/tmp_pack_*
• .git/objects/**/tmp_obj_*

In one incident this grew to roughly 250 GB of garbage.
In a later incident it grew again to about 17 GB before aborting the offending git process.
After switching to read-only / never-approve, the behavior still happened.
The spawned git process runs at 100% CPU until I quit Codex or switch to a project where this issue does not occur in which case the process immediately drops from the top activity users and the junk growth stops.

Expected behavior

If Codex is in read-only mode with approval policy set to Never, opening the app should not modify my repository, should not start mutating Git object storage, and should not leave temporary pack/object garbage behind.

Actual behavior

Opening Codex is enough to trigger Git activity against the repo.
The repo accumulates large amounts of tmp_pack_* / tmp_obj_* junk under .git/objects.
git count-objects -vH reports huge garbage or loose-object growth.
Manual cleanup is required:

• remove tmp_pack_*
• remove tmp_obj_*
• git reflog expire --expire=now --expire-unreachable=now --all
• git gc --prune=now
• git fsck --full

The repo is healthy again after cleanup, but the problem reoccurs when Codex is launched again.

Environment

• Codex Desktop app on macOS Tahoe
• Repository is local
• No repo-level .codex/config.toml override exists
• User config is set to read-only / never approval

Evidence

Observed files:

• .git/objects/pack/tmp_pack_*
• .git/objects/**/tmp_obj_*

Observed symptoms:

• background Git process starts on launch
• .git grows dramatically without intentional user action
• growth is in junk/temp object files, not meaningful repo history

Representative command output after cleanup showed the repo returning to a healthy state, e.g.:

• git fsck --full succeeds
• git count-objects -vH returns small normal values
• .git/objects shrinks back to a few hundred KB

Similar issue

This looks related to issue #7491, which mentions repositories accumulating very large .git garbage from orphaned tmp_pack_* files.

Request

Please investigate why the Desktop app is able to trigger Git object/temp-pack growth on launch in read-only mode, and whether a stale worktree/session/app-server state is bypassing the intended sandbox restrictions.

What steps can reproduce the bug?

Uploaded thread: 019d3171-8d83-7d22-866c-06685a381b14

What is the expected behavior?

_No response_

Additional information

_No response_