VS Code extension runs background mutating git add -A before any user task, scanning .bare object database

Summary

The Codex VS Code extension appears to run background diff/analytics capture on workspace open, before I select any conversation or type any prompt. It spawns mutating Git commands from the VS Code Server extensionHost / openai.chatgpt extension, even when VS Code Git is disabled.

This is not task-scoped and not read-only.

This report was prepared from a live Codex diagnostic session. Codex itself identified the behavior as a consent-boundary violation: task-time agent permissions appear to be used as always-on background workspace access.

Environment

• Product: Codex VS Code extension / openai.chatgpt
• Host: VS Code Remote SSH / VS Code Server
• Platform: Linux x86_64
• Workspace shape: bare-container root with named Git worktrees
• VS Code Git integration: disabled by the user before this observation

Sensitive local project names and absolute paths are intentionally redacted from this report.

What happened

Immediately after opening VS Code for UI usage, before selecting a Codex conversation or typing a prompt, the extensionHost spawned Git commands in the workspace.

Process evidence:

VS Code Server extensionHost
|- codex app-server --analytics-default-enabled
|- git -c core.hooksPath=/dev/null -c core.fsmonitor= add -A

Observed command:

git -c core.hooksPath=/dev/null -c core.fsmonitor= add -A
cwd=<redacted bare-container workspace root>
parent=VS Code Server extensionHost

Earlier repeated commands also included:

git -c core.hooksPath=/dev/null -c core.fsmonitor= add -- <bare git object database paths>

The active git add -A process caused sustained high CPU and zombie Git processes under the extensionHost.

Codex extension log evidence

The Codex extension log included:

requestKind=turn-diff-capture-start
source=turn_diff_analytics
command="git -c core.hooksPath=/dev/null -c core.fsmonitor= add -A"
cwd=<redacted bare-container workspace root>
exitCode=128
failureReason=command_failed
subcommand=add

The same log showed the capture attempting to include Git internals and non-source files such as:

<bare repo object database paths>
<bare repo pack/index files>
<bare worktree index files>
<local session log files>
<editor workspace settings>

Repository shape

This workspace is a bare-container layout:

<workspace root>/.git -> gitdir: ./.bare
<workspace root>/.bare/HEAD -> refs/heads/<bare-container sentinel branch>

Actual development work happens under named worktrees such as:

<workspace root>/<development worktree>
<workspace root>/<release worktree>

Running branch probes at the container root fails:

git -C <workspace root> rev-parse --abbrev-ref HEAD
fatal: ambiguous argument 'HEAD': unknown revision or path not in the working tree.
exit=128

Expected behavior

Background workspace discovery should be read-only.

The extension should not run mutating Git commands such as git add, git reset, git checkout, git worktree, or any index/ref/worktree write unless there is an explicit active user task and visible consent.

The extension should never scan or snapshot .git/ or .bare/ object stores as workspace content.

If background Git/context discovery exists, it needs an independent setting to disable it. Disabling VS Code Git should not leave the Codex extension doing its own silent background Git mutation.

Actual behavior

On startup/background activity, before an active user task, Codex VS Code extension ran:

git add -A

against the workspace root, which attempted to stage/snapshot Git internals and non-source files.

Impact

This is a consent-boundary and privacy issue. Opening VS Code for UI purposes, such as sending an image in the Codex UI, should not grant always-on background access to scan or mutate the workspace.

Even if no network upload is proven from this observation, the local behavior is already unsafe:

• mutates the Git index path via git add
• causes high CPU and zombie Git processes
• can pollute or lock repository state
• can include Git object databases and worktree indexes in diff/analytics capture
• ignores the user's expectation after disabling VS Code Git
• is not scoped to an active user task

Codex's own live-session analysis:

This is not normal read-only Git discovery. It is background diff analytics using a mutating Git command (`git add -A`) against a bare-container workspace root. The behavior crosses task-scope, visibility, and repository-boundary expectations. Local scanning is confirmed; network upload is not confirmed from the available evidence.

Related issues

This appears related to prior git add -A / background snapshot reports, but this report adds VS Code extension-specific evidence plus turn_diff_analytics and bare Git object database scanning:

• https://github.com/openai/codex/issues/19588
• https://github.com/openai/codex/issues/20933
• https://github.com/openai/codex/issues/22085
• https://github.com/openai/codex/issues/27120

Workaround

Disable the Codex VS Code extension or avoid opening bare-container roots. Open the actual worktree path instead of the bare-container root.

In my case, I had to stop the VS Code Server / extensionHost process tree to stop the background Git activity.