Codex Fix

Codex Fix is a small diagnostic and mitigation toolkit for Codex Desktop and CLI resource-leak symptoms on macOS. It can be used from Codex, Claude Code, npm, or a one-time no-clone shell command.

It focuses on the issues reported around:

• oversized ~/.codex/logs_2.sqlite log databases
• stale code_sign_clone.* directories under macOS temp folders
• growing Codex Crashpad pending dump queues
• stale Codex helper processes, including SkyComputerUse, node_repl, and browser_crashpad_handler
• syspolicyd / trustd pressure that can contribute to app launch failures

Related upstream Codex issues:

• openai/codex#25667: code_sign_clone.* directory growth
• openai/codex#25882: syspolicyd file descriptor exhaustion
• openai/codex#25921: Crashpad pending dump growth
• openai/codex#25744: helper process and zombie accumulation

The bundled script is read-only by default. Any filesystem or process change requires --apply plus an explicit action flag.

Install

One-time use, no clone

Run the read-only report directly from GitHub:

curl -fsSL https://raw.githubusercontent.com/IchenDEV/codex-fix/main/scripts/codex_fix.sh | bash

Pass action flags after bash -s --:

curl -fsSL https://raw.githubusercontent.com/IchenDEV/codex-fix/main/scripts/codex_fix.sh | bash -s -- --clean-clones
curl -fsSL https://raw.githubusercontent.com/IchenDEV/codex-fix/main/scripts/codex_fix.sh | bash -s -- --apply --clean-clones

Use the same safety flow as the installed CLI: dry-run first, then re-run with --apply only when the output matches the intended change.

From npm

After the package is published:

npx codex-fix

Or install it globally:

npm install -g codex-fix
codex-fix

As a standalone script

git clone https://github.com/IchenDEV/codex-fix.git
cd codex-fix
scripts/codex_fix.sh

As a Codex skill

Clone this repository into your Codex skills directory:

mkdir -p ~/.codex/skills
git clone https://github.com/IchenDEV/codex-fix.git ~/.codex/skills/codex-fix

Then ask Codex to use $codex-fix when diagnosing Codex disk, process, or syspolicyd resource leaks.

As a Claude Code fallback

When Codex is wedged, use Claude Code (claude or your cc alias) to run the same one-time script:

cc "Codex is wedged. Run this read-only report first: curl -fsSL https://raw.githubusercontent.com/IchenDEV/codex-fix/main/scripts/codex_fix.sh | bash. Then show me the result and propose one narrow dry-run fix before applying anything."

To install it as a personal Claude Code skill:

mkdir -p ~/.claude/skills
git clone https://github.com/IchenDEV/codex-fix.git ~/.claude/skills/codex-fix

Then invoke /codex-fix in Claude Code.

The npm package exposes codex-fix as its CLI command.

Quick Start

Run a read-only report:

codex-fix

In a source checkout, use scripts/codex_fix.sh directly when the npm CLI has not been installed.

The report includes:

• Codex app version, when /Applications/Codex.app exists
• log database size, row count, and trigger state
• code_sign_clone.* directory count and size
• Crashpad pending dump and sidecar counts
• Codex-related helper process count, CPU, memory, RSS, and zombie count
• visible Codex file descriptors held by syspolicyd

Optional deeper checks:

codex-fix --gatekeeper-log-check
codex-fix --spctl-check

Safe Fix Workflow

Use the same flag twice: first as a dry run, then with --apply.

codex-fix --clean-clones
codex-fix --apply --clean-clones

After any fix, run the default report again:

codex-fix

Actions

Block future SQLite log inserts

codex-fix --install-log-trigger
codex-fix --apply --install-log-trigger

This adds a block_log_inserts SQLite trigger to ~/.codex/logs_2.sqlite. The script creates a timestamped database backup before modifying it.

To restore normal log writes:

codex-fix --apply --drop-log-trigger

Vacuum the Codex log database

codex-fix --vacuum-logs
codex-fix --apply --vacuum-logs

This backs up the database, deletes rows from the logs table, and runs VACUUM.

Clean stale code-sign clone directories

codex-fix --clean-clones
codex-fix --apply --clean-clones

The script only removes top-level code_sign_clone.* directories under paths ending in com.openai.codex.code_sign_clone.

Clean Crashpad pending dumps

codex-fix --clean-crashpad
codex-fix --apply --clean-crashpad

This deletes top-level .dmp and *_sidecar.json files from:

~/Library/Application Support/com.openai.codex/web/Crashpad/pending

Clean helper processes

codex-fix --kill-helpers
codex-fix --apply --kill-helpers

This targets Codex SkyComputerUse and Codex Crashpad helper processes.

For heavier cleanup:

codex-fix --kill-node-repl
codex-fix --apply --kill-node-repl

--kill-node-repl can interrupt active Codex tool sessions.

Emergency syspolicyd / trustd recovery

codex-fix --restart-security-daemons
codex-fix --apply --restart-security-daemons

This runs sudo killall syspolicyd trustd. Use it only when macOS app launches are failing or the report shows clear pressure around Gatekeeper-related services.

Combined Cleanup

codex-fix --all
codex-fix --apply --all

--all runs non-sudo cleanup: quit Codex, clean clones, install the log trigger, clean Crashpad, and kill safer helper processes.

Validation

npm test
npm run pack:check
bash -n scripts/codex_fix.sh
bash -n scripts/test_codex_fix.sh
scripts/test_codex_fix.sh

If this repository is installed as a Codex or Claude Code skill, validate the skill with the relevant agent's validator when available.

npm Publishing

The package is configured with:

• package name: codex-fix
• CLI binary: codex-fix
• package files limited by the files field in package.json
• public access through publishConfig.access

Before publishing:

npm test
npm run pack:check
npm whoami

Publish:

npm publish

After publishing, verify:

npm view codex-fix version
npx codex-fix --help

Background

The issue mapping used by this project lives in:

references/codex-resource-leaks.md

Those links were checked on 2026-06-23. Recheck upstream issue status before making current claims about affected Codex versions.

Safety Notes

• Default execution is read-only.
• Modifying actions require --apply.
• SQLite modifications create timestamped backups.
• Process cleanup can interrupt active Codex sessions.
• Sudo recovery is limited to the explicit --restart-security-daemons action.

License

MIT. See LICENSE.