Codex code_sign_clone Taking Disk Space On Mac

Codex Desktop can leave large code_sign_clone.* directories under /private/var/folders. Recent reports range from a few GB to 100GB+ on low-free-space Macs. Treat them as temporary app clones, but prove they are stale before deleting anything broader like sessions, projects, or app support data.

Read-only confirmation

First measure the clone tree, the largest clone bundles, and whether Codex or helper processes still have files open there.

root=$(find /private/var/folders -path "*/X/com.openai.codex.code_sign_clone" -type d 2>/dev/null | head -1)
echo "clone root: ${root:-not found}"

if [ -n "$root" ]; then
  du -sh "$root" 2>/dev/null
  find "$root" -maxdepth 1 -type d -name "code_sign_clone.*" 2>/dev/null | wc -l
  find "$root" -maxdepth 3 -type d -name "Codex.app.bundle" -print0 2>/dev/null \
    | xargs -0 du -sh 2>/dev/null \
    | sort -h \
    | tail -20
  lsof +D "$root" 2>/dev/null | head -40
fi

Usually safe boundary

The code_sign_clone.* folders are temporary app clone directories, not your project code or Codex conversation history. The safer boundary is narrow:

• Quit Codex first, then check whether lsof still shows open handles inside the clone root.
• If no process is using the clone root, keep the newest clone group and move only older code_sign_clone.* directories to Trash.
• If a reboot clears the folder, treat the root cause as stale temporary clone retention and report the measured count/size upstream.

Cron and read-only workaround guardrails

If you automate cleanup while waiting for an upstream fix, keep the workaround reversible. Avoid making the clone parent, Crashpad folders, ~/.codex, or app support directories permanently read-only; that can break future launch, update, crash reporting, or diagnostic behavior.

• Run the script in dry-run mode first and log the clone count, moved bytes, and kept newest group.
• Add a minimum-age guard, such as only moving clone folders older than 6-24 hours.
• Check lsof +D "$root" before moving anything, and skip the whole parent if any handle is open.
• Move older clone folders to a Trash/staging folder instead of using rm -rf directly.
• Do not combine clone cleanup with Crashpad deletion or session cleanup in the same unattended script.

Do not delete first

• ~/.codex, active workspaces, session files, credentials, or project repositories.
• The whole ~/Library/Application Support or Codex app support folder.
• Crash dumps, logs, or session data attached publicly without reviewing for prompts, paths, tokens, or project names.

osascript -e 'quit app "Codex"' 2>/dev/null || true
root=$(find /private/var/folders -path "*/X/com.openai.codex.code_sign_clone" -type d 2>/dev/null | head -1)
trash="$HOME/.Trash/SafeDisk-Codex-code-sign-clone"

if [ -z "$root" ] || lsof +D "$root" 2>/dev/null | grep -q .; then
  echo "Codex clone root missing or still in use; do not move it yet."
  exit 0
fi

tmp=$(mktemp)
find "$root" -maxdepth 1 -type d -name "code_sign_clone.*" -print0 2>/dev/null \
  | while IFS= read -r -d '' dir; do
      printf "%s\t%s\n" "$(stat -f '%B' "$dir" 2>/dev/null || echo 0)" "$dir"
    done \
  | sort -k1,1nr > "$tmp"

[ -s "$tmp" ] || { echo "No clone directories found."; rm -f "$tmp"; exit 0; }
keep_birth=$(head -1 "$tmp" | cut -f1)
mkdir -p "$trash"

while IFS=$'\t' read -r birth dir; do
  if [ "$birth" = "$keep_birth" ]; then
    echo "keep newest: $dir"
  else
    mv "$dir" "$trash/"
    echo "moved older clone: $dir"
  fi
done < "$tmp"

rm -f "$tmp"
du -sh "$trash" 2>/dev/null