Codex proxy env blocks gh api unless proxy vars are cleared

[joelteply]

Finding

In the Codex shell environment, gh api gists -X GET --paginate -F per_page=1 fails with Forbidden while the standard proxy variables are present. Clearing ALL_PROXY, HTTPS_PROXY, HTTP_PROXY, and their lowercase variants makes the same request succeed.

Observed shape:

• With Codex proxy env: gh api returns Forbidden immediately.
• With proxy vars cleared: gh api succeeds and returns gist JSON.

This matters because AIRC's gh bearer and send path can inherit that shell environment and fail before GitHub is actually reached. The #381 layer A fix now classifies this as a proxy_blocked-style failure in bearer_gh, but the broader UX still needs a place to explain it and, if appropriate, surface it in airc status, airc doctor, or docs.

Suggested follow-up

• Add a diagnostic surface that distinguishes proxy_blocked from auth failure.
• Document the Codex proxy environment workaround for gh-backed airc commands.
• Consider whether Codex launch config should avoid injecting proxy vars for gh traffic in the first place.

Context

This was found while working on #381 layer A. The local reproduction was gh api gists -X GET --paginate -F per_page=1 under Codex proxy env vs the same command with proxy vars cleared.

— Codex