Fix libsignal temp dir leak from signal-cli subprocess churn (#28)

Every signal-cli invocation extracts ~21MB of native libraries into a
fresh libsignal* directory under java.io.tmpdir. Receive polling spawns
one JVM every few seconds, and runs that overran their context deadline
were SIGKILLed, stranding the extraction dir. Leaked dirs accumulated
until the disk filled (87GB / 4,455 dirs observed in #27).

Three defenses, verified against signal-cli 0.14.1:

- Confine: each invocation now runs with TMPDIR and java.io.tmpdir
  (appended last to SIGNAL_CLI_OPTS, so it wins) pointed at a private
  per-run dir under <configDir>/tmp, removed as soon as the process
  exits — leaks are structurally impossible even on SIGKILL.
- Graceful cancel: context cancellation now sends SIGTERM first with a
  3s WaitDelay before the hard kill, so the JVM's own shutdown hooks
  (which include libsignal temp cleanup) get a chance to run.
- Sweep: the app-owned tmp root is swept at startup and every 10
  minutes for entries no live run can still own (crash backstop), and
  libsignal* dirs older than 24h that earlier builds leaked into the
  system temp dir are reaped on the same cadence so existing installs
  recover disk space without manual cleanup. Opt out with
  OPENMESSAGES_SIGNAL_TMP_SWEEP=0.

Fixes #27

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: MaxGhenis

internal/signallive/client.go

@@ -19,6 +19,7 @@ import (
 	"strconv"
 	"strings"
 	"sync"
+	"syscall"
 	"time"
 
 	"github.com/rs/zerolog"
@@ -54,22 +55,59 @@ var (
 	runSignalCLI = func(ctx context.Context, configDir string, args ...string) ([]byte, error) {
 		commandArgs := append([]string{"--config", configDir}, args...)
 		cmd := exec.CommandContext(ctx, signalCLIExecutable(), commandArgs...)
+		tmpDir, cleanupTmp, tmpErr := newSignalRunTmpDir(configDir)
+		if tmpErr == nil {
+			cmd.Env = signalCLIEnv(os.Environ(), tmpDir)
+			defer cleanupTmp()
+		}
+		configureSignalCancel(cmd)
 		return cmd.CombinedOutput()
 	}
 
 	startSignalLink = func(ctx context.Context, configDir string) (io.ReadCloser, func() error, error) {
 		cmd := exec.CommandContext(ctx, "script", "-q", "/dev/null", signalCLIExecutable(), "--config", configDir, "link", "-n", "OpenMessage")
+		tmpDir, cleanupTmp, tmpErr := newSignalRunTmpDir(configDir)
+		if tmpErr == nil {
+			cmd.Env = signalCLIEnv(os.Environ(), tmpDir)
+		}
+		configureSignalCancel(cmd)
 		stdout, err := cmd.StdoutPipe()
 		if err != nil {
+			if tmpErr == nil {
+				cleanupTmp()
+			}
 			return nil, nil, err
 		}
 		if err := cmd.Start(); err != nil {
+			if tmpErr == nil {
+				cleanupTmp()
+			}
 			return nil, nil, err
 		}
-		return stdout, cmd.Wait, nil
+		wait := func() error {
+			err := cmd.Wait()
+			if tmpErr == nil {
+				cleanupTmp()
+			}
+			return err
+		}
+		return stdout, wait, nil
 	}
 )
 
+// configureSignalCancel asks for a graceful stop before the hard kill so
+// the JVM gets a chance to run its shutdown hooks (which include libsignal
+// temp cleanup) and flush output when a context deadline fires.
+func configureSignalCancel(cmd *exec.Cmd) {
+	cmd.Cancel = func() error {
+		if err := cmd.Process.Signal(syscall.SIGTERM); err != nil {
+			return cmd.Process.Kill()
+		}
+		return nil
+	}
+	cmd.WaitDelay = 3 * time.Second
+}
+
 type Callbacks struct {
 	OnConversationsChange func()
 	OnIncomingMessage     func(*db.Message)
@@ -165,6 +203,7 @@ type Bridge struct {
 		importedMessages      int
 	}
 	lastReceiveRecoveryAt int64
+	lastTmpSweep          time.Time
 }
 
 type signalReceiveRecoveryRecord struct {
@@ -326,6 +365,14 @@ func New(configDir string, store *db.Store, logger zerolog.Logger, callbacks Cal
 		contactByACI: map[string]string{},
 	}
 	bridge.account = bridge.firstStoredAccount()
+	bridge.lastTmpSweep = now()
+	go sweepSignalTmpRoot(logger, configDir, signalRunTmpMaxAge)
+	if bridge.account != "" {
+		// Only a paired install can have produced libsignal litter, so the
+		// legacy system-temp sweep stays scoped to installs that ran the
+		// bridge before per-run temp dirs existed.
+		go sweepLegacyLibsignalTemp(logger)
+	}
 	return bridge, nil
 }
 
@@ -839,6 +886,8 @@ func (b *Bridge) startReceiveLoop(account string, requestSync bool) {
 		default:
 		}
 
+		b.maybeSweepTmp()
+
 		callCtx, callCancel := context.WithTimeout(ctx, time.Duration(receiveTimeoutSeconds+3)*time.Second)
 		b.commandMu.Lock()
 		output, err := runSignalCLI(callCtx, b.configDir, "-a", probedAccount, "--output", "json", "receive", "--timeout", strconv.Itoa(receiveTimeoutSeconds), "--max-messages", strconv.Itoa(receiveMaxMessages))
@@ -901,6 +950,25 @@ func (b *Bridge) startReceiveLoop(account string, requestSync bool) {
 	}
 }
 
+// maybeSweepTmp runs the crash-backstop sweeps at most once per
+// signalTmpSweepInterval. Normal runs clean up after themselves, so the
+// app-tmp sweep usually finds nothing; the legacy sweep keeps reaping
+// system-temp dirs leaked by older builds as they age past the gate.
+func (b *Bridge) maybeSweepTmp() {
+	b.mu.Lock()
+	due := now().Sub(b.lastTmpSweep) >= signalTmpSweepInterval
+	if due {
+		b.lastTmpSweep = now()
+	}
+	b.mu.Unlock()
+	if due {
+		go func() {
+			sweepSignalTmpRoot(b.logger, b.configDir, signalRunTmpMaxAge)
+			sweepLegacyLibsignalTemp(b.logger)
+		}()
+	}
+}
+
 func (b *Bridge) refreshMetadataAndReplay(account string) {
 	b.refreshContacts()
 	b.refreshGroupNames()

internal/signallive/tmpdir.go

@@ -0,0 +1,180 @@
+package signallive
+
+import (
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/rs/zerolog"
+)
+
+// signal-cli runs on the JVM; libsignal-client extracts ~21MB of native
+// libraries into a fresh java.io.tmpdir subdirectory (libsignal*) on every
+// invocation and does not reliably remove it on exit. Because the bridge
+// invokes signal-cli repeatedly (receive polling, sends, metadata refresh),
+// leaked directories can fill the disk (issue #27). Three defenses:
+//
+//  1. Every invocation runs with TMPDIR/java.io.tmpdir pointed at a private
+//     per-run directory under <configDir>/tmp, removed as soon as the
+//     process exits — no accumulation by construction.
+//  2. <configDir>/tmp is swept at startup and periodically for entries old
+//     enough that no live invocation can still own them (crash backstop).
+//  3. A one-time sweep of the system temp dir removes libsignal* dirs
+//     abandoned by earlier versions, so existing installs recover their
+//     disk space without manual cleanup.
+
+const (
+	// signalRunTmpMaxAge must exceed the longest legitimate signal-cli run.
+	// Receive polls finish in seconds and sends within sendTimeout, but a
+	// `link` session can stay open while the user fetches their phone, so
+	// keep a generous margin.
+	signalRunTmpMaxAge = 30 * time.Minute
+
+	signalTmpSweepInterval = 10 * time.Minute
+
+	// legacyLibsignalMaxAge gates the one-time system temp dir sweep. A day
+	// is far older than any live signal-cli process while young enough to
+	// recover a runaway leak quickly.
+	legacyLibsignalMaxAge = 24 * time.Hour
+
+	signalTmpSweepEnvVar = "OPENMESSAGES_SIGNAL_TMP_SWEEP"
+)
+
+func signalTmpRoot(configDir string) string {
+	return filepath.Join(configDir, "tmp")
+}
+
+// newSignalRunTmpDir creates a private temp dir for one signal-cli
+// invocation. The returned cleanup removes it; callers must invoke cleanup
+// only after the subprocess has exited.
+func newSignalRunTmpDir(configDir string) (string, func(), error) {
+	root := signalTmpRoot(configDir)
+	if err := os.MkdirAll(root, 0o700); err != nil {
+		return "", nil, err
+	}
+	dir, err := os.MkdirTemp(root, "run-")
+	if err != nil {
+		return "", nil, err
+	}
+	return dir, func() { _ = os.RemoveAll(dir) }, nil
+}
+
+// signalCLIEnv rebases the subprocess's temp space onto dir. TMPDIR covers
+// signal-cli itself plus anything it spawns; java.io.tmpdir (appended last
+// to SIGNAL_CLI_OPTS so it wins) covers JVMs that derive their temp dir from
+// the platform default instead of TMPDIR.
+func signalCLIEnv(base []string, dir string) []string {
+	javaOpt := "-Djava.io.tmpdir=" + dir
+	opts := javaOpt
+	env := make([]string, 0, len(base)+2)
+	for _, kv := range base {
+		switch {
+		case strings.HasPrefix(kv, "TMPDIR="):
+			continue
+		case strings.HasPrefix(kv, "SIGNAL_CLI_OPTS="):
+			if existing := strings.TrimSpace(strings.TrimPrefix(kv, "SIGNAL_CLI_OPTS=")); existing != "" {
+				opts = existing + " " + javaOpt
+			}
+			continue
+		}
+		env = append(env, kv)
+	}
+	return append(env, "TMPDIR="+dir, "SIGNAL_CLI_OPTS="+opts)
+}
+
+func signalTmpSweepDisabled() bool {
+	return strings.TrimSpace(os.Getenv(signalTmpSweepEnvVar)) == "0"
+}
+
+// sweepSignalTmpRoot removes entries under <configDir>/tmp older than
+// maxAge. The bridge owns this directory outright, so every stale entry is
+// a leftover from a crashed run regardless of its name.
+func sweepSignalTmpRoot(logger zerolog.Logger, configDir string, maxAge time.Duration) {
+	if signalTmpSweepDisabled() {
+		return
+	}
+	removed, bytes := sweepDirEntries(signalTmpRoot(configDir), maxAge, func(string) bool { return true })
+	if removed > 0 {
+		logger.Info().
+			Int("dirs", removed).
+			Str("reclaimed", humanBytes(bytes)).
+			Msg("Swept stale signal-cli temp dirs left by interrupted runs")
+	}
+}
+
+// sweepLegacyLibsignalTemp clears libsignal* dirs that earlier OpenMessage
+// versions leaked into the system temp dir (issue #27). Only dirs beyond
+// legacyLibsignalMaxAge are touched: anything that old cannot belong to a
+// live signal-cli run, and libsignal re-extracts on demand if another app
+// somehow still references one.
+func sweepLegacyLibsignalTemp(logger zerolog.Logger) {
+	if signalTmpSweepDisabled() {
+		return
+	}
+	removed, bytes := sweepDirEntries(os.TempDir(), legacyLibsignalMaxAge, func(name string) bool {
+		return strings.HasPrefix(name, "libsignal")
+	})
+	if removed > 0 {
+		logger.Warn().
+			Int("dirs", removed).
+			Str("reclaimed", humanBytes(bytes)).
+			Msg("Removed libsignal temp dirs leaked by earlier versions (see issue #27)")
+	}
+}
+
+func sweepDirEntries(root string, maxAge time.Duration, match func(name string) bool) (int, int64) {
+	entries, err := os.ReadDir(root)
+	if err != nil {
+		return 0, 0
+	}
+	cutoff := now().Add(-maxAge)
+	removed := 0
+	var reclaimed int64
+	for _, entry := range entries {
+		if !entry.IsDir() || !match(entry.Name()) {
+			continue
+		}
+		info, err := entry.Info()
+		if err != nil || info.ModTime().After(cutoff) {
+			continue
+		}
+		path := filepath.Join(root, entry.Name())
+		size := dirSize(path)
+		if err := os.RemoveAll(path); err != nil {
+			continue
+		}
+		removed++
+		reclaimed += size
+	}
+	return removed, reclaimed
+}
+
+func dirSize(root string) int64 {
+	var total int64
+	_ = filepath.WalkDir(root, func(_ string, d fs.DirEntry, err error) error {
+		if err != nil || d.IsDir() {
+			return nil
+		}
+		if info, err := d.Info(); err == nil {
+			total += info.Size()
+		}
+		return nil
+	})
+	return total
+}
+
+func humanBytes(n int64) string {
+	const unit = 1024
+	if n < unit {
+		return strconv.FormatInt(n, 10) + " B"
+	}
+	div, exp := int64(unit), 0
+	for m := n / unit; m >= unit; m /= unit {
+		div *= unit
+		exp++
+	}
+	return strconv.FormatFloat(float64(n)/float64(div), 'f', 1, 64) + " " + string("KMGTPE"[exp]) + "iB"
+}