codex-preflight

Fast on-demand diagnostics for general Codex runtime readiness:

• socket() blocked by the sandbox (seccomp)
• DNS failures that are downstream of socket restrictions
• Python HTTPS/TLS trust failures on corporate MITM networks even when socket

and DNS are fine

• runtime interpreter/toolchain drift (Python, uv, venv, Node family)
• unclear host/runtime context (WSL vs Windows vs container)
• missing helper CLIs needed for common local workflows
• missing or partial provider auth for CLIs such as gh, gcloud, gws,

llm, aws, az, and oci

• proxy / CA env drift, including Node-oriented CA env vars
• missing sandbox_workspace_write.writable_roots entries for common XDG dirs

Usage

./scripts/codex-preflight.sh [--with-network] [--no-sandbox] [--json] [--cache-ttl SEC] [--verbose]

Compatibility note: ./scripts/codex-sandbox-preflight.sh remains as a shim, but ./scripts/codex-preflight.sh and the codex-preflight wrapper command are the canonical entrypoints.

Codex skill

This repo is also a Codex CLI skill; see SKILL.md.

Sample output

Output varies by machine and whether you run nested sandbox probes, but a typical --no-sandbox run looks like:

$ ./scripts/codex-preflight.sh --no-sandbox
codex-preflight

Network primitives (current process)
PASS- socket() syscall
PASS- dns github.com

Proxy environment
INFO- proxy env overrides: none

TLS / CA trust (current process)
PASS- system CA bundle readable: /etc/ssl/certs/ca-certificates.crt
INFO- trust env overrides: none (system CA only)
PASS- python TLS handshake chatgpt.com:443
     tls_version=TLSv1.3 issuer=organizationName=Google Trust Services,commonName=WE1

Codex CLI readiness
INFO- codex path=/home/user/.local/bin/codex version=codex 0.120.0 auth=ready

Runtime characteristics
INFO- platform wsl=yes windows_runtime=no windows_host=yes container=no container_hint=<none>
INFO- user=user uid=1000
INFO- wsl=yes distro=Ubuntu-24.04
INFO- repo root=/home/user/project branch=main clean=no staged=1 unstaged=2 untracked=3
INFO- env HOME=/home/user TMPDIR=<unset> UV_CACHE_DIR=/tmp/uv-cache XDG_CACHE_HOME=<unset> XDG_CONFIG_HOME=<unset> VIRTUAL_ENV=<unset>
INFO- python version=3.12.3 executable=/usr/bin/python3 venv_active=no virtual_env=<unset>
INFO- python prefixes prefix=/usr base_prefix=/usr

Toolchain
INFO- uv path=/home/user/.local/bin/uv version=uv 0.8.22
INFO- node path=/home/user/.nvm/versions/node/v22.17.0/bin/node version=v22.17.0
INFO- npm path=/home/user/.nvm/versions/node/v22.17.0/bin/npm version=10.9.2
INFO- pnpm=<missing>
INFO- bun=<missing>

Workflow tools
INFO- tk path=/home/user/.local/bin/tk identity=tk - minimal ticket system with dependency tracking
INFO- tk status open=20 in_progress=32 ready=52 blocked=0
INFO- read-pdf path=/home/user/.local/bin/read-pdf version=read-pdf 0.1.3
INFO- pdf-to-markdown path=/home/user/.local/bin/pdf-to-markdown version=nutrient 1.0.0
INFO- llm path=/home/user/.local/bin/llm version=llm, version 0.28
INFO- wbg-auth=<missing>
INFO- git path=/usr/bin/git version=git version 2.43.0 identity=yes

Provider auth readiness
PASS- codex auth ready
PASS- gh auth ready
PASS- gcloud auth ready (active_account=yes project=yes)
WARN- llm has no configured keys
INFO- aws=<missing>
INFO- az=<missing>

Current process checks
PASS- write cwd
PASS- write /tmp
PASS- write UV_CACHE_DIR (/tmp/uv-cache)
PASS- write wbg-auth config (/home/user/.config/wbg-auth)
PASS- write llm config (/home/user/.config/io.datasette.llm)

Config linkage
INFO- ~/.codex/config.toml is a regular file (if you manage it via symlinks, consider re-linking it)

Config sanity (sandbox writable_roots)
INFO- model=gpt-5.2 approval_presets=never sandbox_network_access=false
INFO writable_roots_count=6
PASS- has_writable_root=/home/user/.config/wbg-auth
PASS- has_writable_root=/tmp/uv-cache
PASS- has_writable_root=/home/user/tmp