PDF plugin should set writable XDG_CACHE_HOME for Poppler/fontconfig in sandboxed workspaces

What is the type of issue?

Documentation is missing

What is the issue?

The PDF plugin skill should document the sandbox-safe Fontconfig cache pattern when using Poppler tools such as pdftoppm.

When using the PDF plugin in a sandboxed Codex workspace, Poppler can trigger Fontconfig writes under:

~/.cache/fontconfig

In a workspace-write sandbox, that path may not be writable. The result is noisy repeated Fontconfig warnings and/or interrupted rendering, even though Poppler itself is available from the bundled runtime.

A reliable workaround is to set XDG_CACHE_HOME to a writable temp path before invoking Poppler:

mkdir -p /tmp/codex-fontconfig-cache
XDG_CACHE_HOME=/tmp/codex-fontconfig-cache pdftoppm -png "$INPUT_PDF" "$OUTPUT_PREFIX"

Could the PDF plugin skill/instructions recommend setting XDG_CACHE_HOME to a writable temp path when running Poppler tools in sandboxed environments?

Suggested edit for skills/pdf/SKILL.md:

````markdown

Sandboxed Rendering

When rendering with Poppler in a sandboxed workspace, set XDG_CACHE_HOME to a writable temp directory before running pdftoppm or pdfinfo. Fontconfig may otherwise try to write cache files under ~/.cache/fontconfig, which can be outside the workspace sandbox.

Prefer a temp cache path such as:

mkdir -p /tmp/codex-fontconfig-cache
XDG_CACHE_HOME=/tmp/codex-fontconfig-cache pdftoppm -png "$INPUT_PDF" "$OUTPUT_PREFIX"

Use a repo-local cache such as tmp/codex-cache only when /tmp is unavailable or the workflow needs all intermediate files under the workspace.

````

This would make PDF rendering more reliable and avoid nudging agents toward unnecessary package installs or repo venv changes. It also keeps generated font caches out of the user's home directory and out of repo dependency environments.

Where did you find it?

Observed while using the pdf@openai-primary-runtime plugin in Codex Desktop with a workspace-write sandbox on macOS.

Version information from the environment where this was observed:

Codex Desktop: 26.611.62324
Codex CLI: codex-cli 0.141.0
Primary runtime/plugin bundle: 26.614.11602
PDF plugin: pdf@openai-primary-runtime
Sandbox mode: workspace-write
OS: macOS 26.5.1 (25F80)

The relevant bundled skill is the PDF plugin skill:

pdf@openai-primary-runtime
skills/pdf/SKILL.md