Problem
A codex-engine workflow ("Avenger") terminated immediately without producing any output when run under AWF.
Context
Reported in github/gh-aw#57937 ("[aw] Avenger failed").
Root Cause
Likely transient: could be Squid blocking/dropping a required codex API/domain call at startup, or the API-proxy sidecar rejecting/timing out an early request, with no error surfaced to the agent logs. Insufficient AWF-side logging makes root cause hard to confirm from the issue alone.
Proposed Solution
- Cross-reference Squid
access.log/firewall_detailed entries for the failed run's timeframe to check for TCP_DENIED against a codex-required domain.
- If a domain is missing from the default allowlist for the
codex engine, add it to the engine's domain profile.
- Improve
awf logs summary/agent entrypoint to surface early proxy/connection failures more clearly so future occurrences are diagnosable without re-running.
Generated by Firewall Issue Dispatcher · copilot · auto · 28.7 AIC · ⊞ 9.4K · ◷
Problem
A
codex-engine workflow ("Avenger") terminated immediately without producing any output when run under AWF.Context
Reported in github/gh-aw#57937 ("[aw] Avenger failed").
Root Cause
Likely transient: could be Squid blocking/dropping a required codex API/domain call at startup, or the API-proxy sidecar rejecting/timing out an early request, with no error surfaced to the agent logs. Insufficient AWF-side logging makes root cause hard to confirm from the issue alone.
Proposed Solution
access.log/firewall_detailedentries for the failed run's timeframe to check forTCP_DENIEDagainst a codex-required domain.codexengine, add it to the engine's domain profile.awf logs summary/agent entrypoint to surface early proxy/connection failures more clearly so future occurrences are diagnosable without re-running.