Desktop app leaves orphaned code_sign_clone bundles under /private/var/folders, consuming ~26 GB

Environment

• macOS Tahoe 26.5
• Codex Desktop (current production release), Version 26.623.70822 • Released Jun 29, 2026
• Heavy long-term desktop usage

Issue

After approximately three weeks of normal use, I found ~26 GB of orphaned
temporary application bundles under:

/private/var/folders/.../X/com.openai.codex.code_sign_clone

Observations

• 23 temporary clone directories
• Each contains a Codex.app.bundle
• Total size ~26 GB
• No open file handles (verified with lsof)
• Active Codex processes execute from /Applications/Codex.app
• Bundle timestamps span roughly June 5 through June 25
• Bundle executables are not all identical, suggesting different signing/build stages

Deleting the directory will recover approximately 26 GB.

codex-executable-hashes.txt
codex-total-size.txt
codex-code-sign-times.txt
codex-code-sign-sizes.txt

<img width="3182" height="2120" alt="Image" src="https://github.com/user-attachments/assets/fc7db75f-5398-4c3e-b41a-1bfa374ff746" />

Artifacts attached

• DaisyDisk screenshot
• Timestamp listing
• Size listing
• Executable hashes