Client or integration
Codex App
Area
CLI
Summary
OpenCodex 2.8.0 archived-session cleanup does not inspect Codex's threads.is_pinned column. An archived pinned task can therefore enter an oldest-percent preview and then be quarantined or permanently removed together with its rollout and satellite rows.
Expected: pinned tasks must be protected independently of archive status, age, percentage target, cleanup mode, and whether cleanup is manual or policy-driven.
This is a source-level safety reproduction. I did not destructively delete a real pinned task.
Reproduction
- Inspect the Codex state schema and confirm
threads.is_pinned INTEGER NOT NULL DEFAULT 0.
- Inspect
src/storage/cleanup.ts in OpenCodex 2.8.0.
- Follow
loadMatchingThreads(): it selects id, rollout_path, optional archived, and optional history_mode, but not is_pinned.
- Follow the candidate filter and execution path: archived rollout matches can be staged, snapshotted, and deleted without a pin-state guard.
- Search the storage-cleanup path and tests for
is_pinned; no cleanup exclusion or execution-time pin re-check is present.
Suggested safety contract:
- Preview excludes matched rows where
is_pinned = 1.
- Execution re-checks pin state under the same state-DB write lock used to freeze the delete set.
- If a candidate became pinned after preview, fail closed with a typed stale-preview/pinned result and restore staged files.
- If the live schema has
is_pinned but it cannot be read, fail closed.
- Older schemas without the column retain compatibility.
- Add quarantine, permanent, policy, and pin-between-preview-and-execution tests.
Version
2.8.0
Operating system
macOS 26.5.2 (25F84)
Provider and model
Not provider- or model-specific.
Logs or error output
Source-level safety finding; no destructive cleanup command was run against a pinned task.
Screenshots and supporting files
Relevant 2.8.0 source: src/storage/cleanup.ts. The current Codex schema contains is_pinned INTEGER NOT NULL DEFAULT 0.
Redacted configuration
{
"cleanup_scope": "archived sessions",
"required_exclusion": "threads.is_pinned = 1"
}Checks
Client or integration
Codex App
Area
CLI
Summary
OpenCodex 2.8.0 archived-session cleanup does not inspect Codex's
threads.is_pinnedcolumn. An archived pinned task can therefore enter an oldest-percent preview and then be quarantined or permanently removed together with its rollout and satellite rows.Expected: pinned tasks must be protected independently of archive status, age, percentage target, cleanup mode, and whether cleanup is manual or policy-driven.
This is a source-level safety reproduction. I did not destructively delete a real pinned task.
Reproduction
threads.is_pinned INTEGER NOT NULL DEFAULT 0.src/storage/cleanup.tsin OpenCodex 2.8.0.loadMatchingThreads(): it selectsid,rollout_path, optionalarchived, and optionalhistory_mode, but notis_pinned.is_pinned; no cleanup exclusion or execution-time pin re-check is present.Suggested safety contract:
is_pinned = 1.is_pinnedbut it cannot be read, fail closed.Version
2.8.0
Operating system
macOS 26.5.2 (25F84)
Provider and model
Not provider- or model-specific.
Logs or error output
Screenshots and supporting files
Relevant 2.8.0 source:
src/storage/cleanup.ts. The current Codex schema containsis_pinned INTEGER NOT NULL DEFAULT 0.Redacted configuration
{ "cleanup_scope": "archived sessions", "required_exclusion": "threads.is_pinned = 1" }Checks