fix: preserve caller-owned Hugging Face cache sidecars

[mldangelo-oai]

Summary

• Preserve pre-existing Hugging Face and ONNX sidecar files stored in caller-owned cache directories, including directories whose names begin with modelaudit_hf_.
• Replace filename-based cache ownership inference with explicit provenance supplied only for CLI-created temporary cache roots.
• Require resolved containment of both the download directory and individual sidecar before deleting owned temporary files; fail closed for symlink escapes and path-resolution errors.
• Preserve normal and interrupted cleanup of genuinely invocation-owned temporary downloads and document the fix under [Unreleased].

Validation

• Reproduced the customer-owned ONNX sidecar deletion on current main before the fix.
• Full Hugging Face source suite: 554 passed, with two explicitly disabled large-artifact tests skipped.
• Hugging Face streaming CLI suite: 50 passed; focused ownership, symlink, error, generator-close, and ONNX sidecar regression suite passed.
• Independent native reviews additionally ran 1,030 tests, including optional ONNX malicious/benign cases, with no findings.
• Ruff lint and formatting plus changed-file Python 3.12 mypy passed.
• Three independent exact-head native Codex security reviews and fresh verifier receipt completed without findings.

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 685f5d7fc9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Workflow run and artifacts

Performance Benchmarks

Compared 13 shared benchmarks with a regression threshold of 15%.
Status: 0 regressions, 0 improved, 13 stable, 0 new, 0 missing.
Aggregate shared-benchmark median: 4.234s -> 4.263s (+0.7%).

Workload	Benchmark	Target	Size	Files	Baseline	Current	Change	Status
single-checkpoint-preflight	tests/benchmarks/test_scan_benchmarks.py::test_scan_single_checkpoint_before_load	single_checkpoint.pkl	183.0 KiB	1	106.24ms	110.04ms	+3.6%	stable
suspicious-pickle-intake	tests/benchmarks/test_scan_benchmarks.py::test_scan_suspicious_pickle_intake	suspicious-intake	183.8 KiB	4	146.46ms	150.21ms	+2.6%	stable
mixed-model-repository	tests/benchmarks/test_scan_benchmarks.py::test_scan_release_candidate_repository	release-candidate	547.3 KiB	32	619.32ms	633.02ms	+2.2%	stable
nested-payload-review	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_nested_payload_review[nested_hex]	nested_hex	130 B	1	258.9us	263.3us	+1.7%	stable
nested-payload-review	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_nested_payload_review[nested_base64]	nested_base64	98 B	1	253.1us	249.0us	-1.6%	stable
warm-cache-rescan	tests/benchmarks/test_scan_benchmarks.py::test_scan_warm_cached_repository_rescan	release-candidate	547.3 KiB	32	134.64ms	136.75ms	+1.6%	stable
chunked-upload-stream	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_chunked_upload_stream	chunked_stream	278.2 KiB	1	116.26ms	117.95ms	+1.5%	stable
duplicate-heavy-registry	tests/benchmarks/test_scan_benchmarks.py::test_scan_duplicate_registry_snapshot	registry-snapshot	915.2 KiB	13	580.61ms	585.93ms	+0.9%	stable
padded-multi-stream-upload	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_padded_multi_stream_upload	multi_stream_padded	4.1 KiB	1	290.3us	291.6us	+0.4%	stable
nested-payload-review	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_nested_payload_review[nested_raw]	nested_raw	78 B	1	236.3us	237.3us	+0.4%	stable
clean-training-checkpoint	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_clean_training_checkpoint	safe_large	278.2 KiB	1	114.11ms	114.39ms	+0.2%	stable
direct-malicious-upload	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_direct_malicious_upload	malicious_reduce	52 B	1	186.0us	186.4us	+0.2%	stable
rejected-basic-auth-candidates	tests/benchmarks/test_scan_benchmarks.py::test_rejected_basic_auth_candidates_scan_linearly	-	371.1 KiB	1	2.415s	2.413s	-0.1%	stable

[Copilot]

Pull request overview

This PR hardens Hugging Face streaming download cleanup to avoid deleting caller-owned cache sidecar files (notably ONNX external data), by replacing directory-name heuristics with explicit provenance and by enforcing resolved-path containment checks before any cleanup.

Changes:

• Introduces explicit cache ownership provenance (_cache_dir_owned) for Hugging Face streaming downloads and requires it for sidecar cleanup decisions.
• Strengthens cleanup safety by requiring strict path resolution and containment checks (failing closed on resolution/symlink issues).
• Adds regression tests covering ownership, symlink escape, resolution-failure behavior, and generator-close cleanup behavior; documents the fix in the changelog.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
tests/utils/sources/test_huggingface.py	Adds focused tests ensuring streaming cleanup only removes invocation-owned sidecars and fails closed on symlink/resolution edge cases.
modelaudit/utils/sources/huggingface.py	Reworks _should_cleanup_hf_streaming_context_file to require explicit ownership and strict containment; threads ownership through streaming flow.
modelaudit/cli.py	Marks CLI-created temporary HF cache roots as owned (_cache_dir_owned) and resolves the temp path strictly.
CHANGELOG.md	Records the behavior fix under [Unreleased] bug fixes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 685f5d7fc9

View security finding report

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 53101456b7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Clean up newly downloaded persistent-cache sidecars

When --stream runs with caching enabled (the default), modelaudit/cli.py passes _cache_dir_owned=False, so this branch prevents cleanup of every context-only ONNX external-data file, including files freshly downloaded by this invocation. Those sidecars are never yielded to scan_model_streaming, so its delete_after_scan handling cannot remove them; large external-data files therefore accumulate in ~/.modelaudit/cache despite scan-and-delete mode. Track whether each sidecar predated the download and preserve only those preexisting files rather than treating the entire persistent cache as caller-owned.

Useful? React with 👍 / 👎.