›_ Codex Issues
Codex Issues / #28036

VS Code extension runs background mutating git add -A before any user task, scanning .bare object database

Open 💬 2 comments Opened Jun 13, 2026 by woolkingx
💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

Summary

The Codex VS Code extension appears to run background diff/analytics capture on workspace open, before I select any conversation or type any prompt. It spawns mutating Git commands from the VS Code Server extensionHost / openai.chatgpt extension, even when VS Code Git is disabled.

This is not task-scoped and not read-only.

This report was prepared from a live Codex diagnostic session. Codex itself identified the behavior as a consent-boundary violation: task-time agent permissions appear to be used as always-on background workspace access.

Environment

  • Product: Codex VS Code extension / openai.chatgpt
  • Host: VS Code Remote SSH / VS Code Server
  • Platform: Linux x86_64
  • Workspace shape: bare-container root with named Git worktrees
  • VS Code Git integration: disabled by the user before this observation

Sensitive local project names and absolute paths are intentionally redacted from this report.

What happened

Immediately after opening VS Code for UI usage, before selecting a Codex conversation or typing a prompt, the extensionHost spawned Git commands in the workspace.

Process evidence:

VS Code Server extensionHost
|- codex app-server --analytics-default-enabled
|- git -c core.hooksPath=/dev/null -c core.fsmonitor= add -A

Observed command:

git -c core.hooksPath=/dev/null -c core.fsmonitor= add -A
cwd=<redacted bare-container workspace root>
parent=VS Code Server extensionHost

Earlier repeated commands also included:

git -c core.hooksPath=/dev/null -c core.fsmonitor= add -- <bare git object database paths>

The active git add -A process caused sustained high CPU and zombie Git processes under the extensionHost.

Codex extension log evidence

The Codex extension log included:

requestKind=turn-diff-capture-start
source=turn_diff_analytics
command="git -c core.hooksPath=/dev/null -c core.fsmonitor= add -A"
cwd=<redacted bare-container workspace root>
exitCode=128
failureReason=command_failed
subcommand=add

The same log showed the capture attempting to include Git internals and non-source files such as:

<bare repo object database paths>
<bare repo pack/index files>
<bare worktree index files>
<local session log files>
<editor workspace settings>

Repository shape

This workspace is a bare-container layout:

<workspace root>/.git -> gitdir: ./.bare
<workspace root>/.bare/HEAD -> refs/heads/<bare-container sentinel branch>

Actual development work happens under named worktrees such as:

<workspace root>/<development worktree>
<workspace root>/<release worktree>

Running branch probes at the container root fails:

git -C <workspace root> rev-parse --abbrev-ref HEAD
fatal: ambiguous argument 'HEAD': unknown revision or path not in the working tree.
exit=128

Expected behavior

Background workspace discovery should be read-only.

The extension should not run mutating Git commands such as git add, git reset, git checkout, git worktree, or any index/ref/worktree write unless there is an explicit active user task and visible consent.

The extension should never scan or snapshot .git/ or .bare/ object stores as workspace content.

If background Git/context discovery exists, it needs an independent setting to disable it. Disabling VS Code Git should not leave the Codex extension doing its own silent background Git mutation.

Actual behavior

On startup/background activity, before an active user task, Codex VS Code extension ran:

git add -A

against the workspace root, which attempted to stage/snapshot Git internals and non-source files.

Impact

This is a consent-boundary and privacy issue. Opening VS Code for UI purposes, such as sending an image in the Codex UI, should not grant always-on background access to scan or mutate the workspace.

Even if no network upload is proven from this observation, the local behavior is already unsafe:

  • mutates the Git index path via git add
  • causes high CPU and zombie Git processes
  • can pollute or lock repository state
  • can include Git object databases and worktree indexes in diff/analytics capture
  • ignores the user's expectation after disabling VS Code Git
  • is not scoped to an active user task

Codex's own live-session analysis:

This is not normal read-only Git discovery. It is background diff analytics using a mutating Git command (`git add -A`) against a bare-container workspace root. The behavior crosses task-scope, visibility, and repository-boundary expectations. Local scanning is confirmed; network upload is not confirmed from the available evidence.

Related issues

This appears related to prior git add -A / background snapshot reports, but this report adds VS Code extension-specific evidence plus turn_diff_analytics and bare Git object database scanning:

Workaround

Disable the Codex VS Code extension or avoid opening bare-container roots. Open the actual worktree path instead of the bare-container root.

In my case, I had to stop the VS Code Server / extensionHost process tree to stop the background Git activity.

View original on GitHub ↗

2 Comments

github-actions[bot] contributor · 2 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

  • #27120
  • #26685

Powered by Codex Action

woolkingx · 2 months ago

Additional context, intentionally high-level but slightly spicy:

This is the funny part: the actual source is not some forbidden treasure. Much of it is public anyway. The issue is not that Codex discovered secrets. The issue is that it quietly started opening cabinets
before confirming which room it was in.

The observed Git behavior does not look like the normal agent path. It appears to happen below the instruction/routing layer, before local AGENTS.md / CLAUDE.md rules have any chance to say: "this is the
working surface, that is metadata, this is projection, that is not yours."

So the problem is not just "Codex ran Git." The problem is:

  • it did not read the map;
  • it did not ask which room mattered;
  • it used a mutating Git operation for background capture;
  • it got lost in a layered workspace;
  • and then, instead of stopping at the first wrong door, it started brute-forcing the wall.

For unknown workspace topology, the safe behavior should be boring:

  • read-only detection first;
  • consult local routing instructions before capture;
  • never use mutating Git commands without an active user task and visible consent;
  • avoid internal metadata, local sessions, editor settings, logs, and generated artifacts unless explicitly requested;
  • if the workspace shape is unclear, ask the user instead of scanning harder;
  • provide a visible audit trail and a disable/kill switch for background capture.

Short version: if Codex walks into a building with a floor plan on the wall, it should read the floor plan before inspecting cabinets. And if there is no "authorized personnel only" sign on every door, that
still does not mean the extension should quietly start taking inventory while the user only opened VS Code to send a picture.