6775| Runtime and resources | Lower | Higher |6775| Runtime and resources | Lower | Higher |
6776| Pull requests and diffs | Use the change-review workflow | Not supported; use the change-review workflow instead |6776| Pull requests and diffs | Use the change-review workflow | Not supported; use the change-review workflow instead |
6777 6777
6778#### Configure deep-scan runtime
6779
6780To control a deep scan's concurrency and duration, create or edit
6781`~/.codex/codex-security/config.toml`. If you set `CODEX_HOME`, use
6782`$CODEX_HOME/codex-security/config.toml` instead.
6783
6784For example, this profile runs a shorter scan with limited concurrency:
6785
6786```toml
6787[deep_scan]
6788workers = 2
6789subagents = 0
6790stop_after_no_new = 3
6791max_discovery_runs = 10
6792```
6793
6794| Setting | Default | Description |
6795| -------------------- | ------- | ------------------------------------------------------------------------------------------------ |
6796| `workers` | `auto` | Number of discovery workers allowed to run at the same time. Set a positive integer or `"auto"`. |
6797| `subagents` | `3` | Number of subagents each discovery worker may start. Set `0` to disable them. |
6798| `stop_after_no_new` | `6` | Stop discovery after this many consecutive runs produce no new candidates. |
6799| `max_discovery_runs` | `60` | Limit on discovery runs before the scan moves to validation. |
6800
6801Lower values can reduce scan time and token use but may miss findings.
6802Configuration changes apply to new deep scans, not scans already in progress.
6803
6778#### Start the deep scan6804#### Start the deep scan
6779 6805
6780In the desktop app, open **Security**, select **Scans**, and select **+ Scan**.6806In the desktop app, open **Security**, select **Scans**, and select **+ Scan**.
15533| [`/approve`](#approve-an-auto-review-denial-with-approve) | Approve one retry of a recent auto review denial. | Retry a command or action that the auto reviewer denied. |15559| [`/approve`](#approve-an-auto-review-denial-with-approve) | Approve one retry of a recent auto review denial. | Retry a command or action that the auto reviewer denied. |
15534| [`/memories`](#configure-memories-with-memories) | Configure memory use and generation. | Turn memory injection or memory generation on or off without leaving the TUI. |15560| [`/memories`](#configure-memories-with-memories) | Configure memory use and generation. | Turn memory injection or memory generation on or off without leaving the TUI. |
15535| [`/skills`](#use-skills-with-skills) | Browse and use skills. | Improve task-specific behavior by selecting a relevant local skill. |15561| [`/skills`](#use-skills-with-skills) | Browse and use skills. | Improve task-specific behavior by selecting a relevant local skill. |
15536| [`/import`](#import-claude-code-or-cursor-configuration-with-import) | Import Claude Code or Cursor setup, projects, and recent chats. | Migrate supported external-agent artifacts into Codex configuration and local files. |15562| [`/import`](#import-claude-code-setup-with-import) | Import Claude Code setup, projects, and recent chats. | Migrate supported external-agent artifacts into Codex configuration and local files. |
15537| [`/feedback`](#send-feedback-with-feedback) | Send logs to the Codex maintainers. | Report issues or share diagnostics with support. |15563| [`/feedback`](#send-feedback-with-feedback) | Send logs to the Codex maintainers. | Report issues or share diagnostics with support. |
15538| [`/init`](#generate-agentsmd-with-init) | Generate an `AGENTS.md` scaffold in the current directory. | Capture persistent instructions for the repository or subdirectory you're working in. |15564| [`/init`](#generate-agentsmd-with-init) | Generate an `AGENTS.md` scaffold in the current directory. | Capture persistent instructions for the repository or subdirectory you're working in. |
15539| [`/logout`](#sign-out-with-logout) | Sign out of Codex. | Clear local credentials when using a shared machine. |15565| [`/logout`](#sign-out-with-logout) | Sign out of Codex. | Clear local credentials when using a shared machine. |
15664Expected: Codex inserts the selected skill context so the next request follows15690Expected: Codex inserts the selected skill context so the next request follows
15665that skill's instructions.15691that skill's instructions.
15666 15692
15667#### Import Claude Code or Cursor configuration with `/import`15693#### Import Claude Code setup with `/import`
15668 15694
156691. Type `/import`.156951. Type `/import`.
156702. Choose **Claude Code** or **Cursor**.156962. Choose **Claude Code**.
156713. Select the setup, project files, or recent chats you want to migrate.156973. Select the setup, project files, or recent chats you want to migrate.
15672 15698
15673Expected: Codex opens the external-agent import picker and imports the selected15699Expected: Codex opens the external-agent import picker and imports the selected
26722 26748
26723Use the import flow to bring instructions, settings, skills, plugins, projects,26749Use the import flow to bring instructions, settings, skills, plugins, projects,
26724and recent work from another agent into the ChatGPT desktop app or Codex CLI.26750and recent work from another agent into the ChatGPT desktop app or Codex CLI.
26725Codex CLI can import from **Claude Code** or **Cursor**. The desktop app26751Codex CLI and the desktop app can import from **Claude Code**.
26726supports Claude Code, with Cursor import available as it rolls out.
26727 26752
26728The desktop app imports supported items directly and lets you finish setup for26753The desktop app imports supported items directly and lets you finish setup for
26729imported plugins or connections that need authorization.26754imported plugins or connections that need authorization.
26745#### Import in Codex CLI26770#### Import in Codex CLI
26746 26771
267471. Start a local Codex CLI session and type `/import`.267721. Start a local Codex CLI session and type `/import`.
267482. Choose **Claude Code** or **Cursor**.267732. Choose **Claude Code**.
267493. Select the supported setup, project files, and recent chats you want to267743. Select the supported setup, project files, and recent chats you want to
26750 import.26775 import.
267514. Review the imported configuration and continue working in Codex.267764. Review the imported configuration and continue working in Codex.
26753Codex CLI imports up to 50 chats from the last 30 days. The `/import` command26778Codex CLI imports up to 50 chats from the last 30 days. The `/import` command
26754isn't available during a running task, in a remote session, or while connected26779isn't available during a running task, in a remote session, or while connected
26755to a local app-server daemon. See [CLI slash26780to a local app-server daemon. See [CLI slash
26756commands](https://learn.chatgpt.com/docs/developer-commands?surface=cli#cli-import-claude-code-or-cursor-configuration-with-import).26781commands](https://learn.chatgpt.com/docs/developer-commands?surface=cli#cli-import-claude-code-setup-with-import).
26757 26782
26758#### How importing works26783#### How importing works
26759 26784
31694- [MECM deployment guide](https://1drv.ms/b/c/123ec1ed6c72a14a/IQB829f_TSbkR7-H9qA4Q9ntAa9D2He3qMjXksWi2ozdeg8?e=GTKgAl)31719- [MECM deployment guide](https://1drv.ms/b/c/123ec1ed6c72a14a/IQB829f_TSbkR7-H9qA4Q9ntAa9D2He3qMjXksWi2ozdeg8?e=GTKgAl)
31695- [Add Microsoft Store apps to Microsoft Intune](https://learn.microsoft.com/en-us/intune/app-management/deployment/add-microsoft-store)31720- [Add Microsoft Store apps to Microsoft Intune](https://learn.microsoft.com/en-us/intune/app-management/deployment/add-microsoft-store)
31696 31721
31722#### Manage app updates
31723
31724For setup instructions and rollout guidance, see
31725[Manage app updates](https://learn.chatgpt.com/docs/enterprise/manage-app-updates).
31726
31697#### Install without Microsoft distribution services31727#### Install without Microsoft distribution services
31698 31728
31699If your environment can't use Microsoft app-distribution services for the31729If your environment can't use Microsoft app-distribution services for the
31713or software-deployment platform.31743or software-deployment platform.
31714 31744
31715After the initial installation, devices that can reach31745After the initial installation, devices that can reach
31716`persistent.oaistatic.com` can install updates automatically, so you don't31746`persistent.oaistatic.com` can install updates automatically unless managed
31717need to redeploy newer packages through your management tool.31747configuration disables the app's built-in updater. If you disable in-app
31748updates, deploy newer packages through your MDM or software-deployment tool.
31718 31749
31719This deployment path:31750This deployment path:
31720 31751
31724 31755
31725#### Related resources31756#### Related resources
31726 31757
31758- [Manage app updates](https://learn.chatgpt.com/docs/enterprise/manage-app-updates)
31727- [ChatGPT desktop app for Windows](https://learn.chatgpt.com/docs/windows/windows-app)31759- [ChatGPT desktop app for Windows](https://learn.chatgpt.com/docs/windows/windows-app)
31728 31760
31729### Governance31761### Governance
31867- [Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration)31899- [Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration)
31868- [Admin rollout guide](https://learn.chatgpt.com/docs/enterprise/admin-setup)31900- [Admin rollout guide](https://learn.chatgpt.com/docs/enterprise/admin-setup)
31869 31901
31902### Manage app updates
31903
31904Source: [Manage app updates](https://learn.chatgpt.com/docs/enterprise/manage-app-updates.md)
31905
31906The ChatGPT desktop app normally checks for and installs updates on its own. If
31907your organization needs to review new releases before users receive them, you
31908can turn off the app's built-in updater and deploy approved versions through
31909your device management platform.
31910
31911The app's updater remains enabled by default. Turning it off doesn't stop
31912Microsoft Store, Microsoft Intune, mobile device management (MDM), package
31913managers, or other external deployment tools from installing updates.
31914
31915#### Before you begin
31916
31917Confirm that you have:
31918
31919- Codex administrator access to
31920 [Managed configuration](https://chatgpt.com/codex/settings/managed-configs)
31921 for your workspace.
31922- A ChatGPT desktop app release for macOS or Windows that supports
31923 organization-managed updates.
31924- An MDM or software-deployment platform that can install approved app packages
31925 on your managed devices.
31926- A process for testing new releases, deploying security updates, and tracking
31927 installed app versions.
31928
31929If you haven't deployed the app on Windows, start with
31930[Deploy the Windows app](https://learn.chatgpt.com/docs/enterprise/windows-deployment).
31931
31932#### Turn off in-app updates
31933
31934When you turn off in-app updates, your organization is responsible for
31935promptly deploying new app releases and security fixes. Delaying updates can
31936leave the app and its bundled components exposed to known security
31937vulnerabilities. Older app versions don't receive separate security patches or
31938extended support.
31939
31940Create a managed policy that disables the desktop app's own updater:
31941
319421. Open
31943 [Managed configuration](https://chatgpt.com/codex/settings/managed-configs).
319442. Select **Add policy**, or open an existing policy for the users, groups, or
31945 platforms you want to manage.
319463. Under **Targets**, select **Add target** to assign the policy to specific
31947 **Groups**, **Users**, or **Platforms**. Start with a small pilot group when
31948 possible.
319494. Open **Raw TOML** and find the **requirements.toml** editor.
319505. Add the following policy:
31951
31952 ```toml
31953 [features]
31954 in_app_updates = false
31955 ```
31956
31957 If your policy already contains a `[features]` table, add
31958 `in_app_updates = false` to that table. Don't add a second `[features]` table
31959 or put the setting in **config.toml**.
31960
319616. Select **Save changes**.
319627. Ask affected users to fully quit and reopen the ChatGPT desktop app. Closing
31963 the app window isn't always enough to restart the application.
31964
31965Some workspaces show a policy-list editor instead of the **Raw TOML** tab. In
31966that interface, add the same TOML block directly to the applicable policy, use
31967**Groups** to assign it when available, and select **Save**.
31968
31969For details about managed policy delivery and precedence, see
31970[Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration).
31971
31972#### Verify the managed setting
31973
31974After the app restarts, verify the policy from an affected user's device:
31975
319761. Sign in to the ChatGPT desktop app with an account covered by the policy.
319772. Open **Settings** > **General**.
319783. Find **In-app updates** and confirm that it shows **Managed** and the message
31979 “Your organization has turned off in-app updates.”
319804. Confirm that your device management platform can still deploy an approved app
31981 version.
31982
31983The **Check for Updates** menu option can remain visible even when the policy
31984blocks in-app updates. Use the **Managed** indicator to verify the policy
31985instead of checking whether that menu option appears.
31986
31987If the indicator doesn't appear after the first restart, the app might still
31988use a cached policy. Allow the policy to refresh, then fully quit and reopen the
31989app again. Don't rely on the update restriction until **Managed** appears.
31990
31991#### Deploy approved app versions
31992
31993After you turn off in-app updates, use your existing device management process
31994to deliver new releases:
31995
319961. Choose an app version that your organization plans to deploy.
319972. Get the supported installation package for each operating system and
31998 device architecture in your fleet.
319993. Test the release with a small group of representative users.
320004. Deploy the approved package through Microsoft Intune, your MDM platform, or
32001 another software-deployment tool.
320025. Check device inventory to confirm your platform installed the intended
32003 version, then expand the rollout to other groups.
32004
32005Your management platform determines how you stage releases, select versions,
32006and recover when a deployment doesn't complete. If your platform permits
32007rollback, returning to an older version doesn't extend support or guarantee
32008service compatibility.
32009
32010For macOS, download the
32011[ChatGPT desktop app installer](https://persistent.oaistatic.com/codex-app-prod/ChatGPT.dmg).
32012For Windows installation methods and architecture-specific packages, see
32013[Deploy the Windows app](https://learn.chatgpt.com/docs/enterprise/windows-deployment).
32014
32015#### Turn in-app updates back on
32016
32017To restore the app's normal update behavior:
32018
320191. Identify the managed policies, system `requirements.toml` files, and MDM
32020 profiles that turn off updates for the affected users.
320212. Remove `in_app_updates = false` from each applicable `[features]` table.
320223. Save the policy changes and redeploy any updated device-managed requirements.
320234. Ask affected users to fully quit and reopen the ChatGPT desktop app.
320245. Check **Settings** > **General** to confirm that the **In-app updates**
32025 managed row no longer appears.
32026
32027When no applicable policy sets `in_app_updates = false`, the app's built-in
32028updater follows its normal behavior. If the **Managed** indicator still
32029appears, review other workspace policies, MDM profiles, and system
32030`requirements.toml` files. See
32031[Locations and precedence](https://learn.chatgpt.com/docs/enterprise/managed-configuration#locations-and-precedence)
32032for the order in which managed sources apply.
32033
32034#### Understand security and support responsibilities
32035
32036After the app receives and applies it, the managed update policy:
32037
32038- Prevents the desktop app from checking for, downloading, or installing updates
32039 through its own updater.
32040- Doesn't provide OpenAI-managed version pinning, a separate release channel,
32041 or guaranteed service compatibility for older versions.
32042- Applies to the ChatGPT desktop app on supported macOS and Windows builds. It
32043 doesn't manage updates for mobile apps, Codex CLI, or the IDE extension.
32044
32045#### Troubleshoot common issues
32046
32047If an authentication problem, connection issue, or timeout prevents the app
32048from retrieving or applying the managed policy, its built-in updater can
32049remain enabled. Don't assume the app blocks updates unless **Managed** appears.
32050
32051If the **Managed** indicator doesn't appear, confirm that:
32052
32053- The affected user selected the intended workspace.
32054- The policy targets that user, group, or platform.
32055- The device runs a supported app version.
32056- The app can connect to the service that delivers managed policies.
32057- The setting is in **requirements.toml**, not **config.toml**.
32058- The user fully quit and reopened the app after you saved the policy.
32059
32060If you can't open Managed configuration or save a policy, confirm that you have
32061Codex administrator access for the workspace.
32062
32063If the app version changes after you disable in-app updates, check whether
32064Microsoft Store, Intune, MDM, a package manager, or another deployment system
32065installed the update. The policy controls only the app's built-in updater.
32066
32067#### Related docs
32068
32069- [Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration)
32070- [Deploy the Windows app](https://learn.chatgpt.com/docs/enterprise/windows-deployment)
32071- [`requirements.toml` configuration reference](https://learn.chatgpt.com/docs/config-file/config-reference#requirementstoml)
32072- [Admin rollout guide](https://learn.chatgpt.com/docs/enterprise/admin-setup)
32073
31870### Managed configuration32074### Managed configuration
31871 32075
31872Source: [Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration.md)32076Source: [Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration.md)
32207browser_use_full_cdp_access = false32411browser_use_full_cdp_access = false
32208browser_use_external = false32412browser_use_external = false
32209in_app_browser = false32413in_app_browser = false
32414in_app_updates = false
32210computer_use = false32415computer_use = false
32211```32416```
32212 32417
32216settings.32421settings.
32217 32422
32218- `in_app_browser = false` disables the built-in browser pane.32423- `in_app_browser = false` disables the built-in browser pane.
32424- `in_app_updates = false` disables the ChatGPT desktop app's own updater on
32425 restart, where supported. It doesn't affect external package deployment or
32426 extend support for older app versions. For setup and rollout guidance, see
32427 [Manage app updates](https://learn.chatgpt.com/docs/enterprise/manage-app-updates).
32219- `browser_use = false` disables Computer Use in browsers and Browser Agent availability.32428- `browser_use = false` disables Computer Use in browsers and Browser Agent availability.
32220- `browser_use_full_cdp_access = false` disables full CDP access in the local32429- `browser_use_full_cdp_access = false` disables full CDP access in the local
32221 runtime, including Browser Developer mode, and prevents the ChatGPT desktop32430 runtime, including Browser Developer mode, and prevents the ChatGPT desktop
32968 33177
32969#### Deployment and model providers33178#### Deployment and model providers
32970 33179
32971Deploy the Windows app, connect managed hosts, or configure a supported external model provider.33180Deploy and update desktop apps, connect managed hosts, or configure a supported external model provider.
33181
33182- [Manage app updates](https://learn.chatgpt.com/docs/enterprise/manage-app-updates): Control desktop app updates and deploy approved versions through your device management platform.
32972 33183
32973- [Windows app deployment](https://learn.chatgpt.com/docs/enterprise/windows-deployment): Choose an installation and update path for managed Windows devices.33184- [Windows app deployment](https://learn.chatgpt.com/docs/enterprise/windows-deployment): Choose an installation and update path for managed Windows devices.
32974 33185
