Audio Temp Files Fill /tmp After Upload

Podcast, video, and media-generation workers often write composed output to a temp file, upload it, then forget to remove the temp file. The safe fix is not a broad rm -rf /tmp; first prove which generated files are stale, then delete only temp outputs whose upload already succeeded.

Measure The Temp File Backlog

Start with read-only checks. They list temp-dir capacity and the largest composed audio files without opening file contents.

tmp="${TMPDIR:-/tmp}"
echo "tmp=$tmp"
df -h "$tmp" 2>/dev/null || true
df -i "$tmp" 2>/dev/null || true

find "$tmp" -maxdepth 1 -type f \( -name 'composed_*.mp3' -o -name 'composed_*.wav' -o -name 'composed_*.m4a' \) -print0 2>/dev/null \
  | xargs -0 du -h 2>/dev/null \
  | sort -hr \
  | head -40

Safe Cleanup Boundary

1. Keep failed-upload temp files so retries still have source bytes.
2. Delete only after the upload returns success and the object key is recorded.
3. Restrict cleanup to the system temp directory after resolving the real path.
4. Require regular files with expected generated names such as composed_*.mp3.
5. Never delete user uploads, project assets, data/, or working directories from this cleanup path.
6. Log path, byte size, episode ID, and cleanup result, but not audio contents.

tmp="${TMPDIR:-/tmp}"
quarantine="$tmp/safedisk-audio-temp-quarantine-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$quarantine"

find "$tmp" -maxdepth 1 -type f \( -name 'composed_*.mp3' -o -name 'composed_*.wav' -o -name 'composed_*.m4a' \) -mmin +120 -print0 2>/dev/null \
  | while IFS= read -r -d '' file; do
      mv "$file" "$quarantine/"
    done

du -sh "$quarantine" 2>/dev/null || true

Implementation Guardrails

• Put cleanup on the upload success path, not in a broad finally block.
• Resolve tempfile.gettempdir() and the candidate file with realpath before comparing directories.
• Use a helper that returns a boolean and logs cleanup failure without failing the completed upload.
• Test success-upload deletes temp output, failed-upload keeps it, non-temp path is kept, and symlink/path traversal is refused.
• Add a metric for bytes quarantined or deleted so recurring leaks are visible before temp storage is full.