Repository navigation
Linux musl CLI: SIGSEGV in cost --provider codex on any non-empty session file (0.73.0+, glibc build unaffected) #4672
Description
Summary
The Linux musl CLI build crashes with SIGSEGV in codexbar cost --provider codex as soon as the Codex sessions directory contains any non-empty .jsonl file, even {}. The glibc build of the same version does not crash on the same input.
Minimal reproduction
export CODEX_HOME="$(mktemp -d)"
mkdir -p "$CODEX_HOME/sessions/2026/10/20"
echo '{}' > "$CODEX_HOME/sessions/2026/10/20/rollout-test.jsonl"
HOME="$(mktemp -d)" ./CodexBarCLI cost --provider codex --json
echo "rc=$?" # rc=139 (SIGSEGV) on the musl buildAn empty sessions directory, or an empty .jsonl file, does not crash.
Results (5 runs each, Ubuntu 26.04.1 LTS, x86_64, kernel 7.0)
| Build | {} repro |
|---|---|
linux-musl-x86_64 0.72.0 |
rc=0 |
linux-musl-x86_64 0.77.0 |
rc=139, 5/5 |
linux-musl-x86_64 0.78.0 |
rc=139, 5/5 |
linux-x86_64 (glibc) 0.77.0 |
rc=0 |
With real Codex session files, the musl build already crashes from 0.73.0 (0.73.0, 0.74.1, 0.75.0, 0.76.0, 0.77.0 all crash; 0.72.0 is fine). The {} file is enough from 0.77.0.
Stack (core dump, musl 0.78.0)
#0 swift::Demangle::__runtime::TypeDecoder<DecodedMetadataBuilder>::decodeMangledType
#2 swift_getTypeByMangledNameImpl
#3 swift::_checkGenericRequirements
#9 swift_getAssociatedTypeWitnessSlowImpl
#10 FoundationEssentials.Data.init<A where A: Sequence, A.Element == UInt8>(_:)
#12 String.data(using:allowLossyConversion:) (FoundationEssentials)
#13 Data.containsAscii(_:) (CodexBarCore extension)
#14 CostUsageScanner.parseCodexFileCancellable(fileURL:range:startOffset:initialModel:...)
#16 CostUsageJsonl.scanBounded(fileURL:offset:maxLineBytes:...)
#17 CostUsageScanner.parseCodexRescan(...)
#18 CostUsageScanner.scanCodexFile(...)
#21 CostUsageScanner.loadDailyReportCancellable(provider:since:until:now:...)
#23 CostUsageScanExecutor.run(on:_:)
The crash is inside the Swift runtime while resolving generic metadata for Data.init(_: some Sequence<UInt8>), reached from Data.containsAscii. containsAscii seems to come from 871e947 ("Fix Codex session tier pricing", between v0.72.0 and v0.73.0). This looks like a metadata-resolution problem specific to the static musl build. A possible workaround would be to avoid the generic Data(sequence) path there, for example by comparing bytes with withUnsafeBytes or by searching Data(string.utf8). I have not tested that change.
Impact
On the musl build, every Codex cost scan with at least one session file crashes, and codexbar serve crashes too when its cost endpoint is used (we saw it restarted by systemd). We are staying on 0.72.0 for now.
Related: #2243 (a different Linux use-after-free, closed), #4652 (glibc 0.78.0 libxml2 regression, fixed in #4653).
Activity
clawsweeper commentedon Oct 20, 2026
Codex review: this still needs some work.
Summary
Keep open: the report establishes a repeatable crash in released musl binaries, and current main retains the conversion identified in its stack trace.
Reproducibility: The reporter provides a strong isolated reproducer and release comparison, and current source confirms its path into the reported helper; this read-only review did not execute the musl binary or independently reproduce the crash.
Regression provenance
Possible regression — suspected (failure trace). No predecessor PR is attributed.
Next step
Establish a failing static-musl CLI regression with the isolated session fixture, then verify a narrow marker-conversion repair against cost output and serve survival.
Review details
Best possible solution:
Restore successful musl cost scans with a verified narrow repair and a synthetic-session smoke check against the packaged CLI.
Do we have a high-confidence way to reproduce the issue?
The reporter provides a strong isolated reproducer and release comparison, and current source confirms its path into the reported helper; this read-only review did not execute the musl binary or independently reproduce the crash.
Is this the best way to solve the issue?
Avoiding the implicated string conversion is a focused candidate, but the matching static-musl CLI must first fail on the fixture and then pass with unchanged report and search semantics before accepting that workaround.
AGENTS.md: found and applied where relevant.
Remaining risk / open question:
Codex review notes: model internal, reasoning medium; reviewed against b49d42eb53bb.
Label changes
Label changes:
P1: A supported Linux artifact reportedly crashes deterministically during Codex cost scans and terminates the serve process when cost is requested.impact:crash-loop: The report documents SIGSEGV termination and systemd restarts after the serve cost endpoint is used.issue-rating: 🦪 silver shellfish: Current issue advisory state selects this label.Label justifications:
P1: A supported Linux artifact reportedly crashes deterministically during Codex cost scans and terminates the serve process when cost is requested.impact:crash-loop: The report documents SIGSEGV termination and systemd restarts after the serve cost endpoint is used.Evidence reviewed
Acceptance criteria:
What I checked:
Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner+CacheHelpers.swift:1386, b49d42eb53bb)Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner.swift:5085, b49d42eb53bb)TestsLinux/CostUsageAsciiSearchTests.swift:7, b49d42eb53bb).github/workflows/release-cli.yml:374, b49d42eb53bb)Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner+CacheHelpers.swift:1386, 8a11b6645861)How this review workflow works
@clawsweeper re-reviewcomments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.@clawsweeper re-reviewor@clawsweeper re-runon an open PR or issue to request a fresh review only.@clawsweeper reviewto request a fresh review only.@clawsweeper explainto ask for more context, or@clawsweeper stopto stop active automation.Reviewed October 20, 2026, 6:37 PM ET / 22:37 UTC.
fix(linux): reserve worker stack for musl cost scans
Fix musl CLI crash in Codex cost scan
fix(linux): reserve a larger CLI stack so the musl Codex cost scan ca…
steipete commentedon Oct 21, 2026
Fixed in #4673 (eb3c5dc). Thanks @psl75011 for the precise report! The crash came from musl's small default thread stack, which the Codex cost scan exceeded on any non-empty session. The Linux CLI now reserves an 8 MiB stack, and CI runs the real CLI against a Codex session on musl and glibc so this can't come back unnoticed. It will be in the next release.