OpenAI - Codex Docs Changes 2026-03-11 00:31 UTC → 2026-05-07 20:02 UTC

9By default, the agent runs with network access turned off. Locally, Codex uses an OS-enforced sandbox that limits what it can touch (typically to the current workspace), plus an approval policy that controls when it must stop and ask you before acting.9By default, the agent runs with network access turned off. Locally, Codex uses an OS-enforced sandbox that limits what it can touch (typically to the current workspace), plus an approval policy that controls when it must stop and ask you before acting.

10 10 

11For a high-level explanation of how sandboxing works across the Codex app, IDE11For a high-level explanation of how sandboxing works across the Codex app, IDE

12extension, and CLI, see [Sandboxing](https://developers.openai.com/codex/concepts/sandboxing).12extension, and CLI, see [sandboxing](https://developers.openai.com/codex/concepts/sandboxing).

13For a broader enterprise security overview, see the [Codex security white paper](https://trust.openai.com/?itemUid=382f924d-54f3-43a8-a9df-c39e6c959958&source=click).

13 14 

14## Sandbox and approvals15## Sandbox and approvals

15 16 

23- **Codex cloud**: Runs in isolated OpenAI-managed containers, preventing access to your host system or unrelated data. Uses a two-phase runtime model: setup runs before the agent phase and can access the network to install specified dependencies, then the agent phase runs offline by default unless you enable internet access for that environment. Secrets configured for cloud environments are available only during setup and are removed before the agent phase starts.24- **Codex cloud**: Runs in isolated OpenAI-managed containers, preventing access to your host system or unrelated data. Uses a two-phase runtime model: setup runs before the agent phase and can access the network to install specified dependencies, then the agent phase runs offline by default unless you enable internet access for that environment. Secrets configured for cloud environments are available only during setup and are removed before the agent phase starts.

24- **Codex CLI / IDE extension**: OS-level mechanisms enforce sandbox policies. Defaults include no network access and write permissions limited to the active workspace. You can configure the sandbox, approval policy, and network settings based on your risk tolerance.25- **Codex CLI / IDE extension**: OS-level mechanisms enforce sandbox policies. Defaults include no network access and write permissions limited to the active workspace. You can configure the sandbox, approval policy, and network settings based on your risk tolerance.

25 26 

26In the `Auto` preset (for example, `--full-auto`), Codex can read files, make edits, and run commands in the working directory automatically.27In the `Auto` preset (for example, `--sandbox workspace-write --ask-for-approval on-request`), Codex can read files, make edits, and run commands in the working directory automatically.

27 28 

28Codex asks for approval to edit files outside the workspace or to run commands that require network access. If you want to chat or plan without making changes, switch to `read-only` mode with the `/permissions` command.29Codex asks for approval to edit files outside the workspace or to run commands that require network access. If you want to chat or plan without making changes, switch to `read-only` mode with the `/permissions` command.

29 30 

30Codex can also elicit approval for app (connector) tool calls that advertise side effects, even when the action isn't a shell command or file change. Destructive app/MCP tool calls always require approval when the tool advertises a destructive annotation, even if it also advertises other hints (for example, read-only hints).31Codex can also elicit approval for app (connector) tool calls that advertise side effects, even when the action isn't a shell command or file change. Destructive app/MCP tool calls always require approval when the tool advertises a destructive annotation, even if it also advertises other hints (for example, read-only hints).

31 32 

32## Network access [Elevated Risk](https://help.openai.com/articles/20001061)33## Network access <ElevatedRiskBadge class="ml-2" />

33 34 

34For Codex cloud, see [agent internet access](https://developers.openai.com/codex/cloud/internet-access) to enable full internet access or a domain allow list.35For Codex cloud, see [agent internet access](https://developers.openai.com/codex/cloud/internet-access) to enable full internet access or a domain allow list.

35 36 

72- `<writable_root>/.codex` is protected as read-only when it exists as a directory.73- `<writable_root>/.codex` is protected as read-only when it exists as a directory.

73- Protection is recursive, so everything under those paths is read-only.74- Protection is recursive, so everything under those paths is read-only.

74 75 

76### Deny reads with filesystem profiles

77 

78Named permission profiles can also deny reads for exact paths or glob patterns.

79This is useful when a workspace should stay writable but specific sensitive

80files, such as local environment files, must stay unreadable:

81 

82```toml

83default_permissions = "workspace"

84 

85[permissions.workspace.filesystem]

86":project_roots" = { "." = "write", "**/*.env" = "none" }

87glob_scan_max_depth = 3

88```

89 

90Use `"none"` for paths or globs that Codex shouldn't read. The sandbox policy

91evaluates globs for local macOS and Linux command execution. On platforms that

92pre-expand glob matches before the sandbox starts, set `glob_scan_max_depth` for

93unbounded `**` patterns, or list explicit depths such as `*.env`, `*/*.env`, and

94`*/*/*.env`.

95 

75### Run without approval prompts96### Run without approval prompts

76 97 

77You can disable approval prompts with `--ask-for-approval never` or `-a never` (shorthand).98You can disable approval prompts with `--ask-for-approval never` or `-a never` (shorthand).

80 101 

81If you need Codex to read files, make edits, and run commands with network access without approval prompts, use `--sandbox danger-full-access` (or the `--dangerously-bypass-approvals-and-sandbox` flag). Use caution before doing so.102If you need Codex to read files, make edits, and run commands with network access without approval prompts, use `--sandbox danger-full-access` (or the `--dangerously-bypass-approvals-and-sandbox` flag). Use caution before doing so.

82 103 

83For a middle ground, `approval_policy = { reject = { ... } }` lets you auto-reject specific approval prompt categories (sandbox escalation, execpolicy-rule prompts, or MCP elicitations) while keeping other prompts interactive.104For a middle ground, `approval_policy = { granular = { ... } }` lets you keep specific approval prompt categories interactive while automatically rejecting others. The granular policy covers sandbox approvals, execpolicy-rule prompts, MCP prompts, `request_permissions` prompts, and skill-script approvals.

105 

106### Automatic approval reviews

107 

108By default, approval requests route to you:

109 

110```toml

111approvals_reviewer = "user"

112```

113 

114Automatic approval reviews apply when approvals are interactive, such as

115`approval_policy = "on-request"` or a granular approval policy. Set

116`approvals_reviewer = "auto_review"` to route eligible approval requests

117through a reviewer agent before Codex runs the request:

118 

119```toml

120approval_policy = "on-request"

121approvals_reviewer = "auto_review"

122```

123 

124The reviewer evaluates only actions that already need approval, such as sandbox

125escalations, network requests, `request_permissions` prompts, or side-effecting

126app and MCP tool calls. Actions that stay inside the sandbox continue without an

127extra review step.

128 

129The reviewer policy checks for data exfiltration, credential probing, persistent

130security weakening, and destructive actions. Low-risk and medium-risk actions

131can proceed when policy allows them. The policy denies critical-risk actions.

132High-risk actions require enough user authorization and no matching deny rule.

133Timeouts, parse failures, and review errors fail closed.

134 

135The [default reviewer policy](https://github.com/openai/codex/blob/main/codex-rs/core/src/guardian/policy.md)

136is in the open-source Codex repository. Enterprises can replace its

137tenant-specific section with `guardian_policy_config` in managed requirements.

138Local `[auto_review].policy` text is also supported, but managed requirements

139take precedence. For setup details, see

140[Managed configuration](https://developers.openai.com/codex/enterprise/managed-configuration#configure-automatic-review-policy).

141 

142In the Codex app, these reviews appear as automatic review items with a status such

143as Reviewing, Approved, Denied, Stopped, or Timed out. They can also include a

144risk level for the reviewed request.

145 

146Automatic review uses extra model calls, so it can add to Codex usage. Admins

147can constrain it with `allowed_approvals_reviewers`.

84 148 

85### Common sandbox and approval combinations149### Common sandbox and approval combinations

86 150 

87| Intent | Flags | Effect |151| Intent | Flags | Effect |

88| ----------------------------------------------------------------- | ------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------ |152| ----------------------------------------------------------------- | ------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------ |

89| Auto (preset) | *no flags needed* or `--full-auto` | Codex can read files, make edits, and run commands in the workspace. Codex requires approval to edit outside the workspace or to access network. |153| Auto (preset) | _no flags needed_ or `--sandbox workspace-write --ask-for-approval on-request` | Codex can read files, make edits, and run commands in the workspace. Codex requires approval to edit outside the workspace or to access network. |

90| Safe read-only browsing | `--sandbox read-only --ask-for-approval on-request` | Codex can read files and answer questions. Codex requires approval to make edits, run commands, or access network. |154| Safe read-only browsing | `--sandbox read-only --ask-for-approval on-request` | Codex can read files and answer questions. Codex requires approval to make edits, run commands, or access network. |

91| Read-only non-interactive (CI) | `--sandbox read-only --ask-for-approval never` | Codex can only read files; never asks for approval. |155| Read-only non-interactive (CI) | `--sandbox read-only --ask-for-approval never` | Codex can only read files; never asks for approval. |

92| Automatically edit but ask for approval to run untrusted commands | `--sandbox workspace-write --ask-for-approval untrusted` | Codex can read and edit files but asks for approval before running untrusted commands. |156| Automatically edit but ask for approval to run untrusted commands | `--sandbox workspace-write --ask-for-approval untrusted` | Codex can read and edit files but asks for approval before running untrusted commands. |

93| Dangerous full access | `--dangerously-bypass-approvals-and-sandbox` (alias: `--yolo`) | [Elevated Risk](https://help.openai.com/articles/20001061) No sandbox; no approvals *(not recommended)* |157| Dangerous full access | `--dangerously-bypass-approvals-and-sandbox` (alias: `--yolo`) | <ElevatedRiskBadge /> No sandbox; no approvals _(not recommended)_ |

94 158 

95`--full-auto` is a convenience alias for `--sandbox workspace-write --ask-for-approval on-request`.159For non-interactive runs, use `codex exec --sandbox workspace-write`; Codex keeps older `codex exec --full-auto` invocations as a deprecated compatibility path and prints a warning.

96 160 

97With `--ask-for-approval untrusted`, Codex runs only known-safe read operations automatically. Commands that can mutate state or trigger external execution paths (for example, destructive Git operations or Git output/config-override flags) require approval.161With `--ask-for-approval untrusted`, Codex runs only known-safe read operations automatically. Commands that can mutate state or trigger external execution paths (for example, destructive Git operations or Git output/config-override flags) require approval.

98 162 

110[sandbox_workspace_write]174[sandbox_workspace_write]

111network_access = true175network_access = true

112 176 

113# Optional: granular approval prompt auto-rejection177# Optional: granular approval policy

114# approval_policy = { reject = { sandbox_approval = true, rules = false, mcp_elicitations = false } }178# approval_policy = { granular = {

179# sandbox_approval = true,

180# rules = true,

181# mcp_elicitations = true,

182# request_permissions = false,

183# skill_approval = false

184# } }

115```185```

116 186 

117You can also save presets as profiles, then select them with `codex --profile <name>`:187You can also save presets as profiles, then select them with `codex --profile <name>`:

132 202 

133```bash203```bash

134# macOS204# macOS

135codex sandbox macos [--full-auto] [--log-denials] [COMMAND]...205codex sandbox macos [--permissions-profile <name>] [--log-denials] [COMMAND]...

136# Linux206# Linux

137codex sandbox linux [--full-auto] [COMMAND]...207codex sandbox linux [--permissions-profile <name>] [COMMAND]...

208# Windows

209codex sandbox windows [--permissions-profile <name>] [COMMAND]...

138```210```

139 211 

140The `sandbox` command is also available as `codex debug`, and the platform helpers have aliases (for example `codex sandbox seatbelt` and `codex sandbox landlock`).212The `sandbox` command is also available as `codex debug`, and the platform helpers have aliases (for example `codex sandbox seatbelt` and `codex sandbox landlock`).

144Codex enforces the sandbox differently depending on your OS:216Codex enforces the sandbox differently depending on your OS:

145 217 

146- **macOS** uses Seatbelt policies and runs commands using `sandbox-exec` with a profile (`-p`) that corresponds to the `--sandbox` mode you selected. When restricted read access enables platform defaults, Codex appends a curated macOS platform policy (instead of broadly allowing `/System`) to preserve common tool compatibility.218- **macOS** uses Seatbelt policies and runs commands using `sandbox-exec` with a profile (`-p`) that corresponds to the `--sandbox` mode you selected. When restricted read access enables platform defaults, Codex appends a curated macOS platform policy (instead of broadly allowing `/System`) to preserve common tool compatibility.

147- **Linux** uses `Landlock` plus `seccomp` by default. You can opt into the alternative Linux sandbox pipeline with `features.use_linux_sandbox_bwrap = true` (or `-c use_linux_sandbox_bwrap=true`). In managed proxy mode, the bwrap pipeline routes egress through a proxy-only bridge and fails closed if it cannot build valid loopback proxy routes; landlock-only flows do not use that bridge behavior.219- **Linux** uses `bwrap` plus `seccomp` by default.

148- **Windows** uses the Linux sandbox implementation when running in [Windows Subsystem for Linux (WSL)](https://developers.openai.com/codex/windows#windows-subsystem-for-linux). When running natively on Windows, Codex uses a [Windows sandbox](https://developers.openai.com/codex/windows#windows-sandbox) implementation.220- **Windows** uses the Linux sandbox implementation when running in [Windows Subsystem for Linux 2 (WSL2)](https://developers.openai.com/codex/windows#windows-subsystem-for-linux). WSL1 was supported through Codex `0.114`; starting in `0.115`, the Linux sandbox moved to `bwrap`, so WSL1 is no longer supported. When running natively on Windows, Codex uses a [Windows sandbox](https://developers.openai.com/codex/windows#windows-sandbox) implementation.

149 221 

150If you use the Codex IDE extension on Windows, it supports WSL directly. Set the following in your VS Code settings to keep the agent inside WSL whenever it’s available:222If you use the Codex IDE extension on Windows, it supports WSL2 directly. Set the following in your VS Code settings to keep the agent inside WSL2 whenever it's available:

151 223 

152```json224```json

153{225{

162```toml234```toml

163[windows]235[windows]

164sandbox = "unelevated" # or "elevated"236sandbox = "unelevated" # or "elevated"

237# sandbox_private_desktop = true # default; set false only for compatibility

165```238```

166 239 

167See the [Windows setup guide](https://developers.openai.com/codex/windows#windows-sandbox) for details.240See the [Windows setup guide](https://developers.openai.com/codex/windows#windows-sandbox) for details.

168 241 

169When you run Linux in a containerized environment such as Docker, the sandbox may not work if the host or container configuration doesn’t support the required `Landlock` and `seccomp` features.242When you run Linux in a containerized environment such as Docker, the sandbox may not work if the host or container configuration blocks the namespace, setuid `bwrap`, or `seccomp` operations that Codex needs.

170 243 

171In that case, configure your Docker container to provide the isolation you need, then run `codex` with `--sandbox danger-full-access` (or the `--dangerously-bypass-approvals-and-sandbox` flag) inside the container.244In that case, configure your Docker container to provide the isolation you need, then run `codex` with `--sandbox danger-full-access` (or the `--dangerously-bypass-approvals-and-sandbox` flag) inside the container.

172 245 

246### Run Codex in Dev Containers

247 

248If your host cannot run the Linux sandbox directly, or if your organization already standardizes on containerized development, run Codex with Dev Containers and let Docker provide the outer isolation boundary. This works with Visual Studio Code Dev Containers and compatible tools.

249 

250Use the [Codex secure devcontainer example](https://github.com/openai/codex/tree/main/.devcontainer) as a reference implementation. The example installs Codex, common development tools, `bubblewrap`, and firewall-based outbound controls.

251 

252Devcontainers provide substantial protection, but they do not prevent every

253 attack. If you run Codex with `--sandbox danger-full-access` or

254 `--dangerously-bypass-approvals-and-sandbox` inside the container, a malicious

255 project can exfiltrate anything available inside the devcontainer, including

256 Codex credentials. Use this pattern only with trusted repositories, and

257 monitor Codex activity as you would in any other elevated environment.

258 

259The reference implementation includes:

260 

261- an Ubuntu 24.04 base image with Codex and common development tools installed;

262- an allowlist-driven firewall profile for outbound access;

263- VS Code settings and extension recommendations for reopening the workspace in a container;

264- persistent mounts for command history and Codex configuration;

265- `bubblewrap`, so Codex can still use its Linux sandbox when the container grants the needed capabilities.

266 

267To try it:

268 

2691. Install Visual Studio Code and the [Dev Containers extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-containers).

2702. Copy the Codex example `.devcontainer` setup into your repository, or start from the Codex repository directly.

2713. In VS Code, run **Dev Containers: Open Folder in Container...** and select `.devcontainer/devcontainer.secure.json`.

2724. After the container starts, open a terminal and run `codex`.

273 

274You can also start the container from the CLI:

275 

276```bash

277devcontainer up --workspace-folder . --config .devcontainer/devcontainer.secure.json

278```

279 

280The example has three main pieces:

281 

282- `.devcontainer/devcontainer.secure.json` controls container settings, capabilities, mounts, environment variables, and VS Code extensions.

283- `.devcontainer/Dockerfile.secure` defines the Ubuntu-based image and installed tools.

284- `.devcontainer/init-firewall.sh` applies the outbound network policy.

285 

286The reference firewall is intentionally a starting point. If you depend on domain allowlisting for isolation, implement DNS rebinding and DNS refresh protections that fit your environment, such as TTL-aware refreshes or a DNS-aware firewall.

287 

288Inside the container, choose one of these modes:

289 

290- Keep Codex's Linux sandbox enabled if the Dev Container profile grants the capabilities needed for `bwrap` to create the inner sandbox.

291- If the container is your intended security boundary, run Codex with `--sandbox danger-full-access` inside the container so Codex does not try to create a second sandbox layer.

292 

173## Version control293## Version control

174 294 

175Codex works best with a version control workflow:295Codex works best with a version control workflow:

4 4 

5ChatGPT Plus, Pro, Business, Edu, and Enterprise plans include Codex. Learn more about [what's included](https://developers.openai.com/codex/pricing).5ChatGPT Plus, Pro, Business, Edu, and Enterprise plans include Codex. Learn more about [what's included](https://developers.openai.com/codex/pricing).

6 6 

7![Codex app for Windows showing a project sidebar, active thread, and review pane](/images/codex/windows/codex-windows-light.webp)7<PlatformSpecificContent>

8 8 <CodexScreenshot

9![Codex app window with a project sidebar, active thread, and review pane](/images/codex/app/app-screenshot-light.webp)9 slot="windows"

10 alt="Codex app for Windows showing a project sidebar, active thread, and review pane"

11 lightSrc="/images/codex/windows/codex-windows-light.webp"

12 darkSrc="/images/codex/windows/codex-windows-dark.webp"

13 variant="no-wallpaper"

14 maxHeight="300px"

15 />

16 <CodexScreenshot

17 alt="Codex app window with a project sidebar, active thread, and review pane"

18 lightSrc="/images/codex/app/app-screenshot-light.webp"

19 darkSrc="/images/codex/app/app-screenshot-dark.webp"

20 variant="no-wallpaper"

21 maxHeight="300px"

22 />

23</PlatformSpecificContent>

10 24 

11## Getting started25## Getting started

12 26 

13The Codex app is available on macOS (Apple Silicon).27The Codex app is available on macOS and Windows.

28 

29Most Codex app features are available on both platforms. Platform-specific

30exceptions are noted in the relevant docs.

14 31 

32<WorkflowSteps variant="headings">

151. Download and install the Codex app331. Download and install the Codex app

16 34 

17 Download the Codex app for Windows or macOS.35 Download the Codex app for macOS or Windows. Choose the Intel build if you're using an Intel-based Mac.

18 36 

19 [Download for macOS](https://persistent.oaistatic.com/codex-app-prod/Codex.dmg)37 <CodexAppDownloadCta client:load className="mb-4" />

20 38 

39 <div class="text-sm">

21 [Get notified for Linux](https://openai.com/form/codex-app/)40 [Get notified for Linux](https://openai.com/form/codex-app/)

41 </div>

42 

222. Open Codex and sign in432. Open Codex and sign in

23 44 

24 Once you downloaded and installed the Codex app, open it and sign in with your ChatGPT account or an OpenAI API key.45 Once you downloaded and installed the Codex app, open it and sign in with your ChatGPT account or an OpenAI API key.

36 58 

37 You can ask Codex anything about the project or your computer in general. Here are some examples:59 You can ask Codex anything about the project or your computer in general. Here are some examples:

38 60 

39- Tell me about this project61 <ExampleGallery>

40- Build a classic Snake game in this repo.62 <ExampleTask

41- Find and fix bugs in my codebase with minimal, high-confidence changes.63 client:load

42 64 id="intro"

43 If you need more inspiration, check out the [explore section](https://developers.openai.com/codex/explore).65 prompt="Tell me about this project"

66 iconName="brain"

67 />

68 <ExampleTask

69 client:load

70 id="snake-game"

71 shortDescription="Build a classic Snake game in this repo."

72 prompt={[

73 "Build a classic Snake game in this repo.",

74 "",

75 "Scope & constraints:",

76 "- Implement ONLY the classic Snake loop: grid movement, growing snake, food spawn, score, game-over, restart.",

77 "- Reuse existing project tooling/frameworks; do NOT add new dependencies unless truly required.",

78 "- Keep UI minimal and consistent with the repo’s existing styles (no new design systems, no extra animations).",

79 "",

80 "Implementation plan:",

81 "1) Inspect the repo to find the right place to add a small interactive game (existing pages/routes/components).",

82 "2) Implement game state (snake positions, direction, food, score, tick timer) with deterministic, testable logic.",

83 "3) Render: simple grid + snake + food; support keyboard controls (arrow keys/WASD) and on-screen controls if mobile is present in the repo.",

84 "4) Add basic tests for the core game logic (movement, collisions, growth, food placement) if the repo has a test runner.",

85 "",

86 "Deliverables:",

87 "- A small set of files/changes with clear names.",

88 "- Short run instructions (how to start dev server + where to navigate).",

89 "- A brief checklist of what to manually verify (controls, pause/restart, boundaries).",

90 ].join("\n")}

91 iconName="gamepad"

92 />

93 <ExampleTask

94 client:load

95 id="fix-bugs"

96 shortDescription="Find and fix bugs in my codebase with minimal, high-confidence changes."

97 prompt={[

98 "Find and fix bugs in my codebase with minimal, high-confidence changes.",

99 "",

100 "Method (grounded + disciplined):",

101 "1) Reproduce: run tests/lint/build (or follow the existing repo scripts). If I provided an error, reproduce that exact failure.",

102 "2) Localize: identify the smallest set of files/lines involved (stack traces, failing tests, logs).",

103 "3) Fix: implement the minimal change that resolves the issue without refactors or unrelated cleanup.",

104 "4) Prove: add/update a focused test (or a tight repro) that fails before and passes after.",

105 "",

106 "Constraints:",

107 "- Do NOT invent errors or pretend to run commands you cannot run.",

108 "- No scope drift: no new features, no UI embellishments, no style overhauls.",

109 "- If information is missing, state what you can confirm from the repo and what remains unknown.",

110 "",

111 "Output:",

112 "- Summary (3–6 sentences max): what was broken, why, and the fix.",

113 "- Then ≤5 bullets: What changed, Where (paths), Evidence (tests/logs), Risks, Next steps.",

114 ].join("\n")}

115 iconName="search"

116 />

117 </ExampleGallery>

118 

119 If you need more inspiration, explore [Codex use cases](https://developers.openai.com/codex/use-cases).

44 If you're new to Codex, read the [best practices guide](https://developers.openai.com/codex/learn/best-practices).120 If you're new to Codex, read the [best practices guide](https://developers.openai.com/codex/learn/best-practices).

45 121 

122</WorkflowSteps>

123 

46---124---

47 125 

48## Work with the Codex app126## Work with the Codex app

49 127 

50[### Multitask across projects128<BentoContainer class="mt-6">

129 <BentoContent href="/codex/app/features#multitask-across-projects">

130 

131### Multitask across projects

132 

133Run project threads side by side and switch between them quickly.

134 

135 </BentoContent>

136 <BentoContent href="/codex/app/worktrees">

137 

138### Worktrees

139 

140Keep parallel code changes isolated with built-in Git worktree support.

141 

142 </BentoContent>

143 <BentoContent href="/codex/app/computer-use">

144 

145### Computer use

146 

147Let Codex use macOS apps for GUI tasks, browser flows, and native app testing.

148 

149 </BentoContent>

150 <BentoContent href="/codex/app/review">

151 

152### Review and ship changes

153 

154Inspect diffs, address PR feedback, stage files, commit, and push.

155 

156 </BentoContent>

157 <BentoContent href="/codex/app/features#integrated-terminal">

158 

159### Terminal and actions

160 

161Run commands in each thread and launch repeatable project actions.

162 

163 </BentoContent>

164 <BentoContent href="/codex/app/browser">

165 

166### In-app browser

167 

168Open rendered pages, leave comments, or let Codex operate local browser flows.

169 

170 </BentoContent>

171 <BentoContent href="/codex/app/chrome-extension">

172 

173### Chrome extension

174 

175Add the Chrome plugin so Codex can use Chrome for signed-in browser tasks while you manage website approvals.

176 

177 </BentoContent>

178 <BentoContent href="/codex/app/features#image-generation">

179 

180### Image generation

181 

182Generate or edit images in a thread while you work on the surrounding code and assets.

183 

184 </BentoContent>

185 <BentoContent href="/codex/app/automations">

186 

187### Automations

188 

189Schedule recurring tasks, or wake up the same thread for ongoing checks.

190 

191 </BentoContent>

192 <BentoContent href="/codex/app/features#skills-support">

193 

194### Skills

195 

196Reuse instructions and workflows across the app, CLI, and IDE Extension.

197 

198 </BentoContent>

199 <BentoContent href="/codex/app/features#richer-outputs-and-artifacts">

51 200 

52Run multiple tasks in parallel and switch quickly between them.](https://developers.openai.com/codex/app/features#multitask-across-projects)[### Built-in Git tools201### Sidebar and artifacts

53 202 

54Review diffs, comment inline, stage or revert chunks, and commit without leaving the app.](https://developers.openai.com/codex/app/features#built-in-git-tools)[### Worktrees for parallel tasks203Follow plans, sources, task summaries, and generated file previews.

55 204 

56Isolate changes of multiple Codex threads using built-in Git worktree support.](https://developers.openai.com/codex/app/worktrees)[### Skills support205 </BentoContent>

206 <BentoContent href="/codex/plugins">

57 207 

58Give your Codex agent additional capabilities and reuse skills across App, CLI, and IDE Extension.](https://developers.openai.com/codex/app/features#skills-support)[### Automations208### Plugins

59 209 

60Pair skills with automations to automate recurring tasks in the background. Codex adds findings to the inbox, or automatically archives runs if there’s nothing to report.](https://developers.openai.com/codex/app/automations)[### Built-in terminal210Connect apps, skills, and MCP servers to extend what Codex can do.

61 211 

62Open a terminal per thread to test your changes, run dev servers, scripts, and custom commands.](https://developers.openai.com/codex/app/features#integrated-terminal)[### Local environments212 </BentoContent>

213 <BentoContent href="/codex/app/features#sync-with-the-ide-extension">

63 214 

64Define worktree setup scripts and common project actions for easy access.](https://developers.openai.com/codex/app/local-environments)[### Sync with the IDE extension215### IDE Extension sync

65 216 

66Share Auto Context and active threads across app and IDE sessions.](https://developers.openai.com/codex/app/features#sync-with-the-ide-extension)[### MCP support217Share Auto Context and active threads across app and IDE sessions.

67 218 

68Connect your Codex agent to additional services using MCP.](https://developers.openai.com/codex/app/features#mcp-support)219 </BentoContent>

220</BentoContainer>

69 221 

70---222---

71 223 

3Codex app-server is the interface Codex uses to power rich clients (for example, the Codex VS Code extension). Use it when you want a deep integration inside your own product: authentication, conversation history, approvals, and streamed agent events. The app-server implementation is open source in the Codex GitHub repository ([openai/codex/codex-rs/app-server](https://github.com/openai/codex/tree/main/codex-rs/app-server)). See the [Open Source](https://developers.openai.com/codex/open-source) page for the full list of open-source Codex components.3Codex app-server is the interface Codex uses to power rich clients (for example, the Codex VS Code extension). Use it when you want a deep integration inside your own product: authentication, conversation history, approvals, and streamed agent events. The app-server implementation is open source in the Codex GitHub repository ([openai/codex/codex-rs/app-server](https://github.com/openai/codex/tree/main/codex-rs/app-server)). See the [Open Source](https://developers.openai.com/codex/open-source) page for the full list of open-source Codex components.

4 4 

5If you are automating jobs or running Codex in CI, use the5If you are automating jobs or running Codex in CI, use the

6[Codex SDK](https://developers.openai.com/codex/sdk) instead.6 <a href="/codex/sdk">Codex SDK</a> instead.

7 7 

8## Protocol8## Protocol

9 9 

12Supported transports:12Supported transports:

13 13 

14- `stdio` (`--listen stdio://`, default): newline-delimited JSON (JSONL).14- `stdio` (`--listen stdio://`, default): newline-delimited JSON (JSONL).

15- `websocket` (`--listen ws://IP:PORT`, experimental): one JSON-RPC message per WebSocket text frame.15- `websocket` (`--listen ws://IP:PORT`, experimental and unsupported): one JSON-RPC message per WebSocket text frame.

16- `off` (`--listen off`): don't expose a local transport.

17 

18When you run with `--listen ws://IP:PORT`, the same listener also serves basic HTTP health probes:

19 

20- `GET /readyz` returns `200 OK` once the listener accepts new connections.

21- `GET /healthz` returns `200 OK` when the request doesn't include an `Origin` header.

22- Requests with an `Origin` header are rejected with `403 Forbidden`.

23 

24WebSocket transport is experimental and unsupported. Loopback listeners such as `ws://127.0.0.1:PORT` are appropriate for localhost and SSH port-forwarding workflows. Non-loopback WebSocket listeners currently allow unauthenticated connections by default during rollout, so configure WebSocket auth before exposing one remotely.

25 

26Supported WebSocket auth flags:

27 

28- `--ws-auth capability-token --ws-token-file /absolute/path`

29- `--ws-auth capability-token --ws-token-sha256 HEX`

30- `--ws-auth signed-bearer-token --ws-shared-secret-file /absolute/path`

31 

32For signed bearer tokens, you can also set `--ws-issuer`, `--ws-audience`, and `--ws-max-clock-skew-seconds`. Clients present the credential as `Authorization: Bearer <token>` during the WebSocket handshake, and app-server enforces auth before JSON-RPC `initialize`.

33 

34Prefer `--ws-token-file` over passing raw bearer tokens on the command line. Use `--ws-token-sha256` only when the client keeps the raw high-entropy token in a separate local secret store; the hash is only a verifier, and clients still need the original token.

16 35 

17In WebSocket mode, app-server uses bounded queues. When request ingress is full, the server rejects new requests with JSON-RPC error code `-32001` and message `"Server overloaded; retry later."` Clients should retry with an exponentially increasing delay and jitter.36In WebSocket mode, app-server uses bounded queues. When request ingress is full, the server rejects new requests with JSON-RPC error code `-32001` and message `"Server overloaded; retry later."` Clients should retry with an exponentially increasing delay and jitter.

18 37 

21Requests include `method`, `params`, and `id`:40Requests include `method`, `params`, and `id`:

22 41 

23```json42```json

24{ "method": "thread/start", "id": 10, "params": { "model": "gpt-5.1-codex" } }43{ "method": "thread/start", "id": 10, "params": { "model": "gpt-5.4" } }

25```44```

26 45 

27Responses echo the `id` with either `result` or `error`:46Responses echo the `id` with either `result` or `error`:

56Example (Node.js / TypeScript):75Example (Node.js / TypeScript):

57 76 

58```ts77```ts

59import { spawn } from "node:child_process";78 

60import readline from "node:readline";79 

61 80 

62const proc = spawn("codex", ["app-server"], {81const proc = spawn("codex", ["app-server"], {

63 stdio: ["pipe", "pipe", "inherit"],82 stdio: ["pipe", "pipe", "inherit"],

99 },118 },

100});119});

101send({ method: "initialized", params: {} });120send({ method: "initialized", params: {} });

102send({ method: "thread/start", id: 1, params: { model: "gpt-5.1-codex" } });121send({ method: "thread/start", id: 1, params: { model: "gpt-5.4" } });

103```122```

104 123 

105## Core primitives124## Core primitives

123 142 

124Clients must send a single `initialize` request per transport connection before invoking any other method on that connection, then acknowledge with an `initialized` notification. Requests sent before initialization receive a `Not initialized` error, and repeated `initialize` calls on the same connection return `Already initialized`.143Clients must send a single `initialize` request per transport connection before invoking any other method on that connection, then acknowledge with an `initialized` notification. Requests sent before initialization receive a `Not initialized` error, and repeated `initialize` calls on the same connection return `Already initialized`.

125 144 

126The server returns the user agent string it will present to upstream services. Set `clientInfo` to identify your integration.145The server returns the user agent string it will present to upstream services plus `platformFamily` and `platformOs` values that describe the runtime target. Set `clientInfo` to identify your integration.

127 146 

128`initialize.params.capabilities` also supports per-connection notification opt-out via `optOutNotificationMethods`, which is a list of exact method names to suppress for that connection. Matching is exact (no wildcards/prefixes). Unknown method names are accepted and ignored.147`initialize.params.capabilities` also supports per-connection notification opt-out via `optOutNotificationMethods`, which is a list of exact method names to suppress for that connection. Matching is exact (no wildcards/prefixes). Unknown method names are accepted and ignored.

129 148 

159 },178 },

160 "capabilities": {179 "capabilities": {

161 "experimentalApi": true,180 "experimentalApi": true,

162 "optOutNotificationMethods": [181 "optOutNotificationMethods": ["thread/started", "item/agentMessage/delta"]

163 "codex/event/session_configured",

164 "item/agentMessage/delta"

165 ]

166 }182 }

167 }183 }

168}184}

202- `thread/resume` - reopen an existing thread by id so later `turn/start` calls append to it.218- `thread/resume` - reopen an existing thread by id so later `turn/start` calls append to it.

203- `thread/fork` - fork a thread into a new thread id by copying stored history; emits `thread/started` for the new thread.219- `thread/fork` - fork a thread into a new thread id by copying stored history; emits `thread/started` for the new thread.

204- `thread/read` - read a stored thread by id without resuming it; set `includeTurns` to return full turn history. Returned `thread` objects include runtime `status`.220- `thread/read` - read a stored thread by id without resuming it; set `includeTurns` to return full turn history. Returned `thread` objects include runtime `status`.

205- `thread/list` - page through stored thread logs; supports cursor-based pagination plus `modelProviders`, `sourceKinds`, `archived`, and `cwd` filters. Returned `thread` objects include runtime `status`.221- `thread/list` - page through stored thread logs; supports cursor-based pagination plus `modelProviders`, `sourceKinds`, `archived`, `cwd`, and `searchTerm` filters. Returned `thread` objects include runtime `status`.

222- `thread/turns/list` - page through a stored thread's turn history without resuming it.

206- `thread/loaded/list` - list the thread ids currently loaded in memory.223- `thread/loaded/list` - list the thread ids currently loaded in memory.

224- `thread/name/set` - set or update a thread's user-facing name for a loaded thread or a persisted rollout; emits `thread/name/updated`.

225- `thread/goal/set` - set the goal for a loaded thread (experimental; requires `capabilities.experimentalApi`); emits `thread/goal/updated`.

226- `thread/goal/get` - read the current goal for a loaded thread (experimental; requires `capabilities.experimentalApi`).

227- `thread/goal/clear` - clear the goal for a loaded thread (experimental; requires `capabilities.experimentalApi`); emits `thread/goal/cleared`.

228- `thread/metadata/update` - patch SQLite-backed stored thread metadata; currently supports persisted `gitInfo`.

207- `thread/archive` - move a thread's log file into the archived directory; returns `{}` on success and emits `thread/archived`.229- `thread/archive` - move a thread's log file into the archived directory; returns `{}` on success and emits `thread/archived`.

208- `thread/unsubscribe` - unsubscribe this connection from thread turn/item events. If this was the last subscriber, the server unloads the thread and emits `thread/closed`.230- `thread/unsubscribe` - unsubscribe this connection from thread turn/item events. If this was the last subscriber, the server unloads the thread after a no-subscriber inactivity grace period and emits `thread/closed`.

209- `thread/unarchive` - restore an archived thread rollout back into the active sessions directory; returns the restored `thread` and emits `thread/unarchived`.231- `thread/unarchive` - restore an archived thread rollout back into the active sessions directory; returns the restored `thread` and emits `thread/unarchived`.

210- `thread/status/changed` - notification emitted when a loaded thread's runtime `status` changes.232- `thread/status/changed` - notification emitted when a loaded thread's runtime `status` changes.

211- `thread/compact/start` - trigger conversation history compaction for a thread; returns `{}` immediately while progress streams via `turn/*` and `item/*` notifications.233- `thread/compact/start` - trigger conversation history compaction for a thread; returns `{}` immediately while progress streams via `turn/*` and `item/*` notifications.

234- `thread/shellCommand` - run a user-initiated shell command against a thread. This runs outside the sandbox with full access and doesn't inherit the thread sandbox policy.

235- `thread/backgroundTerminals/clean` - stop all running background terminals for a thread (experimental; requires `capabilities.experimentalApi`).

212- `thread/rollback` - drop the last N turns from the in-memory context and persist a rollback marker; returns the updated `thread`.236- `thread/rollback` - drop the last N turns from the in-memory context and persist a rollback marker; returns the updated `thread`.

213- `turn/start` - add user input to a thread and begin Codex generation; responds with the initial `turn` and streams events. For `collaborationMode`, `settings.developer_instructions: null` means "use built-in instructions for the selected mode."237- `turn/start` - add user input to a thread and begin Codex generation; responds with the initial `turn` and streams events. For `collaborationMode`, `settings.developer_instructions: null` means "use built-in instructions for the selected mode."

238- `thread/inject_items` - append raw Responses API items to a loaded thread's model-visible history without starting a user turn.

214- `turn/steer` - append user input to the active in-flight turn for a thread; returns the accepted `turnId`.239- `turn/steer` - append user input to the active in-flight turn for a thread; returns the accepted `turnId`.

215- `turn/interrupt` - request cancellation of an in-flight turn; success is `{}` and the turn ends with `status: "interrupted"`.240- `turn/interrupt` - request cancellation of an in-flight turn; success is `{}` and the turn ends with `status: "interrupted"`.

216- `review/start` - kick off the Codex reviewer for a thread; emits `enteredReviewMode` and `exitedReviewMode` items.241- `review/start` - kick off the Codex reviewer for a thread; emits `enteredReviewMode` and `exitedReviewMode` items.

217- `command/exec` - run a single command under the server sandbox without starting a thread/turn.242- `command/exec` - run a single command under the server sandbox without starting a thread/turn.

243- `command/exec/write` - write `stdin` bytes to a running `command/exec` session or close `stdin`.

244- `command/exec/resize` - resize a running PTY-backed `command/exec` session.

245- `command/exec/terminate` - stop a running `command/exec` session.

246- `command/exec/outputDelta` (notify) - emitted for base64-encoded stdout/stderr chunks from a streaming `command/exec` session.

218- `model/list` - list available models (set `includeHidden: true` to include entries with `hidden: true`) with effort options, optional `upgrade`, and `inputModalities`.247- `model/list` - list available models (set `includeHidden: true` to include entries with `hidden: true`) with effort options, optional `upgrade`, and `inputModalities`.

248- `modelProvider/capabilities/read` - read provider capability bounds for model/provider combinations (experimental; requires `capabilities.experimentalApi`).

219- `experimentalFeature/list` - list feature flags with lifecycle stage metadata and cursor pagination.249- `experimentalFeature/list` - list feature flags with lifecycle stage metadata and cursor pagination.

250- `experimentalFeature/enablement/set` - patch in-memory runtime enablement for supported feature keys such as `apps` and `plugins`.

220- `collaborationMode/list` - list collaboration mode presets (experimental, no pagination).251- `collaborationMode/list` - list collaboration mode presets (experimental, no pagination).

221- `skills/list` - list skills for one or more `cwd` values (supports `forceReload` and optional `perCwdExtraUserRoots`).252- `skills/list` - list skills for one or more `cwd` values (supports `forceReload` and optional `perCwdExtraUserRoots`).

253- `skills/changed` (notify) - emitted when watched local skill files change.

254- `marketplace/add` - add a remote plugin marketplace and persist it into the user's marketplace config.

255- `marketplace/upgrade` - refresh a configured Git marketplace, or all configured Git marketplaces when you omit the marketplace name.

256- `plugin/list` - list discovered plugin marketplaces and plugin state, including install/auth policy metadata, marketplace load errors, featured plugin ids, and local, Git, or remote plugin source metadata.

257- `plugin/read` - read one plugin by marketplace path or remote marketplace name and plugin name, including bundled skills, apps, and MCP server names when those details are available.

258- `plugin/install` - install a plugin from a marketplace path or remote marketplace name.

259- `plugin/uninstall` - uninstall an installed plugin.

222- `app/list` - list available apps (connectors) with pagination plus accessibility/enabled metadata.260- `app/list` - list available apps (connectors) with pagination plus accessibility/enabled metadata.

223- `skills/config/write` - enable or disable skills by path.261- `skills/config/write` - enable or disable skills by path.

224- `mcpServer/oauth/login` - start an OAuth login for a configured MCP server; returns an authorization URL and emits `mcpServer/oauthLogin/completed` on completion.262- `mcpServer/oauth/login` - start an OAuth login for a configured MCP server; returns an authorization URL and emits `mcpServer/oauthLogin/completed` on completion.

225- `tool/requestUserInput` - prompt the user with 1-3 short questions for a tool call (experimental); questions can set `isOther` for a free-form option.263- `tool/requestUserInput` - prompt the user with 1-3 short questions for a tool call (experimental); questions can set `isOther` for a free-form option.

226- `config/mcpServer/reload` - reload MCP server configuration from disk and queue a refresh for loaded threads.264- `config/mcpServer/reload` - reload MCP server configuration from disk and queue a refresh for loaded threads.

227- `mcpServerStatus/list` - list MCP servers, tools, resources, and auth status (cursor + limit pagination).265- `mcpServerStatus/list` - list MCP servers, tools, resources, and auth status (cursor + limit pagination). Use `detail: "full"` for full data or `detail: "toolsAndAuthOnly"` to omit resources.

266- `mcpServer/resource/read` - read a single MCP resource through an initialized MCP server.

267- `mcpServer/tool/call` - call a tool on a thread's configured MCP server.

268- `mcpServer/startupStatus/updated` (notify) - emitted when a configured MCP server's startup status changes for a loaded thread.

228- `windowsSandbox/setupStart` - start Windows sandbox setup for `elevated` or `unelevated` mode; returns quickly and later emits `windowsSandbox/setupCompleted`.269- `windowsSandbox/setupStart` - start Windows sandbox setup for `elevated` or `unelevated` mode; returns quickly and later emits `windowsSandbox/setupCompleted`.

229- `feedback/upload` - submit a feedback report (classification + optional reason/logs + conversation id, plus optional `extraLogFiles` attachments).270- `feedback/upload` - submit a feedback report (classification + optional reason/logs + conversation id, plus optional `extraLogFiles` attachments).

230- `config/read` - fetch the effective configuration on disk after resolving configuration layering.271- `config/read` - fetch the effective configuration on disk after resolving configuration layering.

231- `externalAgentConfig/detect` - detect migratable external-agent artifacts with `includeHome` and optional `cwds`; each detected item includes `cwd` (`null` for home).272- `externalAgentConfig/detect` - detect external-agent artifacts that can be migrated with `includeHome` and optional `cwds`; each detected item includes `cwd` (`null` for home).

232- `externalAgentConfig/import` - apply selected external-agent migration items by passing explicit `migrationItems` with `cwd` (`null` for home).273- `externalAgentConfig/import` - apply selected external-agent migration items by passing explicit `migrationItems` with `cwd` (`null` for home). Supported item types include config, skills, `AGENTS.md`, plugins, MCP server config, subagents, hooks, commands, and sessions; plugin imports emit `externalAgentConfig/import/completed`.

233- `config/value/write` - write a single configuration key/value to the user's `config.toml` on disk.274- `config/value/write` - write a single configuration key/value to the user's `config.toml` on disk.

234- `config/batchWrite` - apply configuration edits atomically to the user's `config.toml` on disk.275- `config/batchWrite` - apply configuration edits atomically to the user's `config.toml` on disk.

235- `configRequirements/read` - fetch requirements from `requirements.toml` and/or MDM, including allow-lists, pinned `featureRequirements`, and residency/network requirements (or `null` if you haven't set any up).276- `configRequirements/read` - fetch requirements from `requirements.toml` and/or MDM, including allow-lists, pinned `featureRequirements`, and residency/network requirements (or `null` if you haven't set any up).

277- `fs/readFile`, `fs/writeFile`, `fs/createDirectory`, `fs/getMetadata`, `fs/readDirectory`, `fs/remove`, `fs/copy`, `fs/watch`, `fs/unwatch`, and `fs/changed` (notify) - operate on absolute filesystem paths through the app-server v2 filesystem API.

278 

279Plugin summaries include a `source` union. Local plugins return

280`{ "type": "local", "path": ... }`, Git-backed marketplace entries return

281`{ "type": "git", "url": ..., "path": ..., "refName": ..., "sha": ... }`,

282and remote catalog entries return `{ "type": "remote" }`. For remote-only

283catalog entries, `PluginMarketplaceEntry.path` can be `null`; pass

284`remoteMarketplaceName` instead of `marketplacePath` when reading or installing

285those plugins.

236 286 

237## Models287## Models

238 288 

301## Threads351## Threads

302 352 

303- `thread/read` reads a stored thread without subscribing to it; set `includeTurns` to include turns.353- `thread/read` reads a stored thread without subscribing to it; set `includeTurns` to include turns.

304- `thread/list` supports cursor pagination plus `modelProviders`, `sourceKinds`, `archived`, and `cwd` filtering.354- `thread/turns/list` pages through a stored thread's turn history without resuming it.

355- `thread/list` supports cursor pagination plus `modelProviders`, `sourceKinds`, `archived`, `cwd`, and `searchTerm` filtering.

305- `thread/loaded/list` returns the thread IDs currently in memory.356- `thread/loaded/list` returns the thread IDs currently in memory.

306- `thread/archive` moves the thread's persisted JSONL log into the archived directory.357- `thread/archive` moves the thread's persisted JSONL log into the archived directory.

307- `thread/unsubscribe` unsubscribes the current connection from a loaded thread and can trigger `thread/closed`.358- `thread/metadata/update` patches stored thread metadata, currently including persisted `gitInfo`.

359- `thread/unsubscribe` unsubscribes the current connection from a loaded thread and can trigger `thread/closed` after an inactivity grace period.

308- `thread/unarchive` restores an archived thread rollout back into the active sessions directory.360- `thread/unarchive` restores an archived thread rollout back into the active sessions directory.

309- `thread/compact/start` triggers compaction and returns `{}` immediately.361- `thread/compact/start` triggers compaction and returns `{}` immediately.

310- `thread/rollback` drops the last N turns from the in-memory context and records a rollback marker in the thread's persisted JSONL log.362- `thread/rollback` drops the last N turns from the in-memory context and records a rollback marker in the thread's persisted JSONL log.

363- `thread/inject_items` appends raw Responses API items to a loaded thread's model-visible history without starting a user turn.

311 364 

312### Start or resume a thread365### Start or resume a thread

313 366 

315 368 

316```json369```json

317{ "method": "thread/start", "id": 10, "params": {370{ "method": "thread/start", "id": 10, "params": {

318 "model": "gpt-5.1-codex",371 "model": "gpt-5.4",

319 "cwd": "/Users/me/project",372 "cwd": "/Users/me/project",

320 "approvalPolicy": "never",373 "approvalPolicy": "never",

321 "sandbox": "workspaceWrite",374 "sandbox": "workspaceWrite",

378 431 

379Unlike `thread/resume`, `thread/read` doesn't load the thread into memory or emit `thread/started`.432Unlike `thread/resume`, `thread/read` doesn't load the thread into memory or emit `thread/started`.

380 433 

434### List thread turns

435 

436Use `thread/turns/list` to page a stored thread's turn history without resuming it. Results default to newest-first so clients can fetch older turns with `nextCursor`. The response also includes `backwardsCursor`; pass it as `cursor` with `sortDirection: "asc"` to fetch turns newer than the first item from the earlier page.

437 

438```json

439{ "method": "thread/turns/list", "id": 20, "params": {

440 "threadId": "thr_123",

441 "limit": 50,

442 "sortDirection": "desc"

443} }

444{ "id": 20, "result": {

445 "data": [],

446 "nextCursor": "older-turns-cursor-or-null",

447 "backwardsCursor": "newer-turns-cursor-or-null"

448} }

449```

450 

381### List threads (with pagination & filters)451### List threads (with pagination & filters)

382 452 

383`thread/list` lets you render a history UI. Results default to newest-first by `createdAt`. Filters apply before pagination. Pass any combination of:453`thread/list` lets you render a history UI. Results default to newest-first by `createdAt`. Filters apply before pagination. Pass any combination of:

389- `sourceKinds` - restrict results to specific thread sources. When omitted or `[]`, the server defaults to interactive sources only: `cli` and `vscode`.459- `sourceKinds` - restrict results to specific thread sources. When omitted or `[]`, the server defaults to interactive sources only: `cli` and `vscode`.

390- `archived` - when `true`, list archived threads only. When `false` or omitted, list non-archived threads (default).460- `archived` - when `true`, list archived threads only. When `false` or omitted, list non-archived threads (default).

391- `cwd` - restrict results to threads whose session current working directory exactly matches this path.461- `cwd` - restrict results to threads whose session current working directory exactly matches this path.

462- `searchTerm` - search stored thread summaries and metadata before pagination.

392 463 

393`sourceKinds` accepts the following values:464`sourceKinds` accepts the following values:

394 465 

422 493 

423When `nextCursor` is `null`, you have reached the final page.494When `nextCursor` is `null`, you have reached the final page.

424 495 

496### Update stored thread metadata

497 

498Use `thread/metadata/update` to patch stored thread metadata without resuming the thread. Today this supports persisted `gitInfo`; omitted fields are left unchanged, and explicit `null` clears a stored value.

499 

500```json

501{ "method": "thread/metadata/update", "id": 21, "params": {

502 "threadId": "thr_123",

503 "gitInfo": { "branch": "feature/sidebar-pr" }

504} }

505{ "id": 21, "result": {

506 "thread": {

507 "id": "thr_123",

508 "gitInfo": { "sha": null, "branch": "feature/sidebar-pr", "originUrl": null }

509 }

510} }

511```

512 

425### Track thread status changes513### Track thread status changes

426 514 

427`thread/status/changed` is emitted whenever a loaded thread's runtime status changes. The payload includes `threadId` and the new `status`.515`thread/status/changed` is emitted whenever a loaded thread's runtime status changes. The payload includes `threadId` and the new `status`.

450`thread/unsubscribe` removes the current connection's subscription to a thread. The response status is one of:538`thread/unsubscribe` removes the current connection's subscription to a thread. The response status is one of:

451 539 

452- `unsubscribed` when the connection was subscribed and is now removed.540- `unsubscribed` when the connection was subscribed and is now removed.

453- `notSubscribed` when the connection was not subscribed to that thread.541- `notSubscribed` when the connection wasn't subscribed to that thread.

454- `notLoaded` when the thread is not loaded.542- `notLoaded` when the thread isn't loaded.

455 543 

456If this was the last subscriber, the server unloads the thread and emits a `thread/status/changed` transition to `notLoaded` plus `thread/closed`.544If this was the last subscriber, the server keeps the thread loaded until it has no subscribers and no thread activity for 30 minutes. When the grace period expires, app-server unloads the thread and emits a `thread/status/changed` transition to `notLoaded` plus `thread/closed`.

457 545 

458```json546```json

459{ "method": "thread/unsubscribe", "id": 22, "params": { "threadId": "thr_123" } }547{ "method": "thread/unsubscribe", "id": 22, "params": { "threadId": "thr_123" } }

460{ "id": 22, "result": { "status": "unsubscribed" } }548{ "id": 22, "result": { "status": "unsubscribed" } }

549```

550 

551If the thread later expires:

552 

553```json

461{ "method": "thread/status/changed", "params": {554{ "method": "thread/status/changed", "params": {

462 "threadId": "thr_123",555 "threadId": "thr_123",

463 "status": { "type": "notLoaded" }556 "status": { "type": "notLoaded" }

498{ "id": 25, "result": {} }591{ "id": 25, "result": {} }

499```592```

500 593 

594### Run a thread shell command

595 

596Use `thread/shellCommand` for user-initiated shell commands that belong to a thread. The request returns immediately with `{}` while progress streams through standard `turn/*` and `item/*` notifications.

597 

598This API runs outside the sandbox with full access and doesn't inherit the thread sandbox policy. Clients should expose it only for explicit user-initiated commands.

599 

600If the thread already has an active turn, the command runs as an auxiliary action on that turn and its formatted output is injected into the turn's message stream. If the thread is idle, app-server starts a standalone turn for the shell command.

601 

602```json

603{ "method": "thread/shellCommand", "id": 26, "params": { "threadId": "thr_b", "command": "git status --short" } }

604{ "id": 26, "result": {} }

605```

606 

607### Clean background terminals

608 

609Use `thread/backgroundTerminals/clean` to stop all running background terminals associated with a thread. This method is experimental and requires `capabilities.experimentalApi = true`.

610 

611```json

612{ "method": "thread/backgroundTerminals/clean", "id": 27, "params": { "threadId": "thr_b" } }

613{ "id": 27, "result": {} }

614```

615 

501### Roll back recent turns616### Roll back recent turns

502 617 

503Use `thread/rollback` to remove the last `numTurns` entries from the in-memory context and persist a rollback marker in the rollout log. The returned `thread` includes `turns` populated after the rollback.618Use `thread/rollback` to remove the last `numTurns` entries from the in-memory context and persist a rollback marker in the rollout log. The returned `thread` includes `turns` populated after the rollback.

504 619 

505```json620```json

506{ "method": "thread/rollback", "id": 26, "params": { "threadId": "thr_b", "numTurns": 1 } }621{ "method": "thread/rollback", "id": 28, "params": { "threadId": "thr_b", "numTurns": 1 } }

507{ "id": 26, "result": { "thread": { "id": "thr_b", "name": "Bug bash notes", "ephemeral": false } } }622{ "id": 28, "result": { "thread": { "id": "thr_b", "name": "Bug bash notes", "ephemeral": false } } }

508```623```

509 624 

510## Turns625## Turns

570 "writableRoots": ["/Users/me/project"],685 "writableRoots": ["/Users/me/project"],

571 "networkAccess": true686 "networkAccess": true

572 },687 },

573 "model": "gpt-5.1-codex",688 "model": "gpt-5.4",

574 "effort": "medium",689 "effort": "medium",

575 "summary": "concise",690 "summary": "concise",

576 "personality": "friendly",691 "personality": "friendly",

584{ "id": 30, "result": { "turn": { "id": "turn_456", "status": "inProgress", "items": [], "error": null } } }699{ "id": 30, "result": { "turn": { "id": "turn_456", "status": "inProgress", "items": [], "error": null } } }

585```700```

586 701 

702### Inject items into a thread

703 

704Use `thread/inject_items` to append prebuilt Responses API items to a loaded thread's prompt history without starting a user turn. These items are persisted to the rollout and included in subsequent model requests.

705 

706```json

707{ "method": "thread/inject_items", "id": 31, "params": {

708 "threadId": "thr_123",

709 "items": [

710 {

711 "type": "message",

712 "role": "assistant",

713 "content": [{ "type": "output_text", "text": "Previously computed context." }]

714 }

715 ]

716} }

717{ "id": 31, "result": {} }

718```

719 

587### Steer an active turn720### Steer an active turn

588 721 

589Use `turn/steer` to append more user input to the active in-flight turn.722Use `turn/steer` to append more user input to the active in-flight turn.

713- The server rejects empty `command` arrays.846- The server rejects empty `command` arrays.

714- `sandboxPolicy` accepts the same shape used by `turn/start` (for example, `dangerFullAccess`, `readOnly`, `workspaceWrite`, `externalSandbox`).847- `sandboxPolicy` accepts the same shape used by `turn/start` (for example, `dangerFullAccess`, `readOnly`, `workspaceWrite`, `externalSandbox`).

715- When omitted, `timeoutMs` falls back to the server default.848- When omitted, `timeoutMs` falls back to the server default.

849- Set `tty: true` for PTY-backed sessions, and use `processId` when you plan to follow up with `command/exec/write`, `command/exec/resize`, or `command/exec/terminate`.

850- Set `streamStdoutStderr: true` to receive `command/exec/outputDelta` notifications while the command is running.

716 851 

717### Read admin requirements (`configRequirements/read`)852### Read admin requirements (`configRequirements/read`)

718 853 

763- `elevated` - run the elevated Windows sandbox setup path.898- `elevated` - run the elevated Windows sandbox setup path.

764- `unelevated` - run the legacy setup/preflight path.899- `unelevated` - run the legacy setup/preflight path.

765 900 

901## Filesystem

902 

903The v2 filesystem APIs operate on absolute paths. Use `fs/watch` when a client needs to invalidate UI state after a file or directory changes.

904 

905```json

906{ "method": "fs/watch", "id": 54, "params": {

907 "watchId": "0195ec6b-1d6f-7c2e-8c7a-56f2c4a8b9d1",

908 "path": "/Users/me/project/.git/HEAD"

909} }

910{ "id": 54, "result": { "path": "/Users/me/project/.git/HEAD" } }

911{ "method": "fs/changed", "params": {

912 "watchId": "0195ec6b-1d6f-7c2e-8c7a-56f2c4a8b9d1",

913 "changedPaths": ["/Users/me/project/.git/HEAD"]

914} }

915{ "method": "fs/unwatch", "id": 55, "params": {

916 "watchId": "0195ec6b-1d6f-7c2e-8c7a-56f2c4a8b9d1"

917} }

918{ "id": 55, "result": {} }

919```

920 

921Watching a file emits `fs/changed` for that file path, including updates delivered by replace or rename operations.

922 

766## Events923## Events

767 924 

768Event notifications are the server-initiated stream for thread lifecycles, turn lifecycles, and the items within them. After you start or resume a thread, keep reading the active transport stream for `thread/started`, `thread/archived`, `thread/unarchived`, `thread/closed`, `thread/status/changed`, `turn/*`, `item/*`, and `serverRequest/resolved` notifications.925Event notifications are the server-initiated stream for thread lifecycles, turn lifecycles, and the items within them. After you start or resume a thread, keep reading the active transport stream for `thread/started`, `thread/archived`, `thread/unarchived`, `thread/closed`, `thread/status/changed`, `turn/*`, `item/*`, and `serverRequest/resolved` notifications.

773 930 

774- Exact-match only: `item/agentMessage/delta` suppresses only that method.931- Exact-match only: `item/agentMessage/delta` suppresses only that method.

775- Unknown method names are ignored.932- Unknown method names are ignored.

776- Applies to both legacy (`codex/event/*`) and v2 (`thread/*`, `turn/*`, `item/*`, etc.) notifications.933- Applies to the current `thread/*`, `turn/*`, `item/*`, and related v2 notifications.

777- Doesn't apply to requests, responses, or errors.934- Doesn't apply to requests, responses, or errors.

778 935 

779### Fuzzy file search events (experimental)936### Fuzzy file search events (experimental)

983} }1141} }

984```1142```

985 1143 

1144The server also emits `skills/changed` notifications when watched local skill files change. Treat this as an invalidation signal and rerun `skills/list` with your current params when needed.

1145 

986To enable or disable a skill by path:1146To enable or disable a skill by path:

987 1147 

988```json1148```json

1149 1309 

1150### Detect and import external agent config1310### Detect and import external agent config

1151 1311 

1152Use `externalAgentConfig/detect` to discover migratable external-agent artifacts, then pass the selected entries to `externalAgentConfig/import`.1312Use `externalAgentConfig/detect` to discover external-agent artifacts that can be migrated, then pass the selected entries to `externalAgentConfig/import`.

1153 1313 

1154Detection example:1314Detection example:

1155 1315 

1189{ "id": 64, "result": {} }1349{ "id": 64, "result": {} }

1190```1350```

1191 1351 

1192Supported `itemType` values are `AGENTS_MD`, `CONFIG`, `SKILLS`, and `MCP_SERVER_CONFIG`. Detection returns only items that still have work to do. For example, AGENTS migration is skipped when `AGENTS.md` already exists and is non-empty, and skill imports do not overwrite existing skill directories.1352When a request includes plugin imports, the server emits `externalAgentConfig/import/completed` after the import finishes. This notification may arrive immediately after the response or after background remote imports complete.

1353 

1354Supported `itemType` values are `AGENTS_MD`, `CONFIG`, `SKILLS`, `PLUGINS`,

1355and `MCP_SERVER_CONFIG`. For `PLUGINS` items, `details.plugins` lists each

1356`marketplaceName` and the `pluginNames` Codex can try to migrate. Detection

1357returns only items that still have work to do. For example, Codex skips AGENTS

1358migration when `AGENTS.md` already exists and is non-empty, and skill imports

1359don't overwrite existing skill directories.

1360 

1361When detecting plugins from `.claude/settings.json`, Codex reads configured

1362marketplace sources from `extraKnownMarketplaces`. If `enabledPlugins` contains

1363plugins from `claude-plugins-official` but the marketplace source is missing,

1364Codex infers `anthropics/claude-plugins-official` as the source.

1193 1365 

1194## Auth endpoints1366## Auth endpoints

1195 1367 

1196The JSON-RPC auth/account surface exposes request/response methods plus server-initiated notifications (no `id`). Use these to determine auth state, start or cancel logins, logout, and inspect ChatGPT rate limits.1368The JSON-RPC auth/account surface exposes request/response methods plus server-initiated notifications (no `id`). Use these to determine auth state, start or cancel logins, logout, inspect ChatGPT rate limits, and notify workspace owners about depleted credits or usage limits.

1197 1369 

1198### Authentication modes1370### Authentication modes

1199 1371 

1200Codex supports three authentication modes. `account/updated.authMode` shows the active mode, and `account/read` also reports it.1372Codex supports these authentication modes. `account/updated.authMode` shows the active mode and includes the current ChatGPT `planType` when available. `account/read` also reports account and plan details.

1201 1373 

1202- **API key (`apikey`)** - the caller supplies an OpenAI API key and Codex stores it for API requests.1374- **API key (`apikey`)** - the caller supplies an OpenAI API key with `type: "apiKey"`, and Codex stores it for API requests.

1203- **ChatGPT managed (`chatgpt`)** - Codex owns the ChatGPT OAuth flow, persists tokens, and refreshes them automatically.1375- **ChatGPT managed (`chatgpt`)** - Codex owns the ChatGPT OAuth flow, persists tokens, and refreshes them automatically. Start with `type: "chatgpt"` for the browser flow or `type: "chatgptDeviceCode"` for the device-code flow.

1204- **ChatGPT external tokens (`chatgptAuthTokens`)** - a host app supplies `idToken` and `accessToken` directly. Codex stores these tokens in memory, and the host app must refresh them when asked.1376- **ChatGPT external tokens (`chatgptAuthTokens`)** - experimental and intended for host apps that already own the user's ChatGPT auth lifecycle. The host app supplies an `accessToken`, `chatgptAccountId`, and optional `chatgptPlanType` directly, and must refresh the token when asked.

1205 1377 

1206### API overview1378### API overview

1207 1379 

1208- `account/read` - fetch current account info; optionally refresh tokens.1380- `account/read` - fetch current account info; optionally refresh tokens.

1209- `account/login/start` - begin login (`apiKey`, `chatgpt`, or `chatgptAuthTokens`).1381- `account/login/start` - begin login (`apiKey`, `chatgpt`, `chatgptDeviceCode`, or experimental `chatgptAuthTokens`).

1210- `account/login/completed` (notify) - emitted when a login attempt finishes (success or error).1382- `account/login/completed` (notify) - emitted when a login attempt finishes (success or error).

1211- `account/login/cancel` - cancel a pending ChatGPT login by `loginId`.1383- `account/login/cancel` - cancel a pending managed ChatGPT login by `loginId`.

1212- `account/logout` - sign out; triggers `account/updated`.1384- `account/logout` - sign out; triggers `account/updated`.

1213- `account/updated` (notify) - emitted whenever auth mode changes (`authMode`: `apikey`, `chatgpt`, `chatgptAuthTokens`, or `null`).1385- `account/updated` (notify) - emitted whenever auth mode changes (`authMode`: `apikey`, `chatgpt`, `chatgptAuthTokens`, or `null`) and includes `planType` when available.

1214- `account/chatgptAuthTokens/refresh` (server request) - request fresh externally managed ChatGPT tokens after an authorization error.1386- `account/chatgptAuthTokens/refresh` (server request) - request fresh externally managed ChatGPT tokens after an authorization error.

1215- `account/rateLimits/read` - fetch ChatGPT rate limits.1387- `account/rateLimits/read` - fetch ChatGPT rate limits.

1216- `account/rateLimits/updated` (notify) - emitted whenever a user's ChatGPT rate limits change.1388- `account/rateLimits/updated` (notify) - emitted whenever a user's ChatGPT rate limits change.

1389- `account/sendAddCreditsNudgeEmail` - ask ChatGPT to email a workspace owner about depleted credits or a reached usage limit.

1217- `mcpServer/oauthLogin/completed` (notify) - emitted after a `mcpServer/oauth/login` flow finishes; payload includes `{ name, success, error? }`.1390- `mcpServer/oauthLogin/completed` (notify) - emitted after a `mcpServer/oauth/login` flow finishes; payload includes `{ name, success, error? }`.

1391- `mcpServer/startupStatus/updated` (notify) - emitted when a configured MCP server's startup status changes for a loaded thread; payload includes `{ name, status, error }`.

1218 1392 

1219### 1) Check auth state1393### 1) Check auth state

1220 1394 

1286 ```1462 ```

1287 1463 

1288 ```json1464 ```json

1289 { "method": "account/updated", "params": { "authMode": "apikey" } }1465 {

1466 "method": "account/updated",

1467 "params": { "authMode": "apikey", "planType": null }

1468 }

1290 ```1469 ```

1291 1470 

1292### 3) Log in with ChatGPT (browser flow)1471### 3) Log in with ChatGPT (browser flow)

1318 ```1498 ```

1319 1499 

1320 ```json1500 ```json

1321 { "method": "account/updated", "params": { "authMode": "chatgpt" } }1501 {

1502 "method": "account/updated",

1503 "params": { "authMode": "chatgpt", "planType": "plus" }

1504 }

1505 ```

1506 

1507### 3b) Log in with ChatGPT (device-code flow)

1508 

1509Use this flow when your client owns the sign-in ceremony or when a browser callback is brittle.

1510 

15111. Start:

1512 

1513 ```json

1514 {

1515 "method": "account/login/start",

1516 "id": 4,

1517 "params": { "type": "chatgptDeviceCode" }

1518 }

1519 ```

1520 

1521 ```json

1522 {

1523 "id": 4,

1524 "result": {

1525 "type": "chatgptDeviceCode",

1526 "loginId": "<uuid>",

1527 "verificationUrl": "https://auth.openai.com/codex/device",

1528 "userCode": "ABCD-1234"

1529 }

1530 }

1531 ```

1532 

15332. Show `verificationUrl` and `userCode` to the user; the frontend owns the UX.

15343. Wait for notifications:

1535 

1536 ```json

1537 {

1538 "method": "account/login/completed",

1539 "params": { "loginId": "<uuid>", "success": true, "error": null }

1540 }

1541 ```

1542 

1543 ```json

1544 {

1545 "method": "account/updated",

1546 "params": { "authMode": "chatgpt", "planType": "plus" }

1547 }

1322 ```1548 ```

1323 1549 

1324### 3b) Log in with externally managed ChatGPT tokens (`chatgptAuthTokens`)1550### 3c) Log in with externally managed ChatGPT tokens (`chatgptAuthTokens`)

1325 1551 

1326Use this mode when a host application owns the user’s ChatGPT auth lifecycle and supplies tokens directly.1552Use this experimental mode only when a host application owns the user's ChatGPT auth lifecycle and supplies tokens directly. Clients must set `capabilities.experimentalApi = true` during `initialize` before using this login type.

1327 1553 

13281. Send:15541. Send:

1329 1555 

1333 "id": 7,1559 "id": 7,

1334 "params": {1560 "params": {

1335 "type": "chatgptAuthTokens",1561 "type": "chatgptAuthTokens",

1336 "idToken": "<jwt>",1562 "accessToken": "<jwt>",

1337 "accessToken": "<jwt>"1563 "chatgptAccountId": "org-123",

1564 "chatgptPlanType": "business"

1338 }1565 }

1339 }1566 }

1340 ```1567 ```

1355 ```json1584 ```json

1356 {1585 {

1357 "method": "account/updated",1586 "method": "account/updated",

1358 "params": { "authMode": "chatgptAuthTokens" }1587 "params": { "authMode": "chatgptAuthTokens", "planType": "business" }

1359 }1588 }

1360 ```1589 ```

1361 1590 

1367 "id": 8,1596 "id": 8,

1368 "params": { "reason": "unauthorized", "previousAccountId": "org-123" }1597 "params": { "reason": "unauthorized", "previousAccountId": "org-123" }

1369}1598}

1370{ "id": 8, "result": { "idToken": "<jwt>", "accessToken": "<jwt>" } }1599{ "id": 8, "result": { "accessToken": "<jwt>", "chatgptAccountId": "org-123", "chatgptPlanType": "business" } }

1371```1600```

1372 1601 

1373The server retries the original request after a successful refresh response. Requests time out after about 10 seconds.1602The server retries the original request after a successful refresh response. Requests time out after about 10 seconds.

1384```json1613```json

1385{ "method": "account/logout", "id": 5 }1614{ "method": "account/logout", "id": 5 }

1386{ "id": 5, "result": {} }1615{ "id": 5, "result": {} }

1387{ "method": "account/updated", "params": { "authMode": null } }1616{ "method": "account/updated", "params": { "authMode": null, "planType": null } }

1388```1617```

1389 1618 

1390### 6) Rate limits (ChatGPT)1619### 6) Rate limits (ChatGPT)

1396 "limitId": "codex",1625 "limitId": "codex",

1397 "limitName": null,1626 "limitName": null,

1398 "primary": { "usedPercent": 25, "windowDurationMins": 15, "resetsAt": 1730947200 },1627 "primary": { "usedPercent": 25, "windowDurationMins": 15, "resetsAt": 1730947200 },

1399 "secondary": null1628 "secondary": null,

1629 "rateLimitReachedType": null

1400 },1630 },

1401 "rateLimitsByLimitId": {1631 "rateLimitsByLimitId": {

1402 "codex": {1632 "codex": {

1403 "limitId": "codex",1633 "limitId": "codex",

1404 "limitName": null,1634 "limitName": null,

1405 "primary": { "usedPercent": 25, "windowDurationMins": 15, "resetsAt": 1730947200 },1635 "primary": { "usedPercent": 25, "windowDurationMins": 15, "resetsAt": 1730947200 },

1406 "secondary": null1636 "secondary": null,

1637 "rateLimitReachedType": null

1407 },1638 },

1408 "codex_other": {1639 "codex_other": {

1409 "limitId": "codex_other",1640 "limitId": "codex_other",

1410 "limitName": "codex_other",1641 "limitName": "codex_other",

1411 "primary": { "usedPercent": 42, "windowDurationMins": 60, "resetsAt": 1730950800 },1642 "primary": { "usedPercent": 42, "windowDurationMins": 60, "resetsAt": 1730950800 },

1412 "secondary": null1643 "secondary": null,

1644 "rateLimitReachedType": null

1413 }1645 }

1414 }1646 }

1415} }1647} }

1430- `usedPercent` is current usage within the quota window.1662- `usedPercent` is current usage within the quota window.

1431- `windowDurationMins` is the quota window length.1663- `windowDurationMins` is the quota window length.

1432- `resetsAt` is a Unix timestamp (seconds) for the next reset.1664- `resetsAt` is a Unix timestamp (seconds) for the next reset.

1665- `planType` is included when the backend returns the ChatGPT plan associated with a bucket.

1666- `credits` is included when the backend returns remaining workspace credit details.

1667- `rateLimitReachedType` identifies the backend-classified limit state when one has been reached.

1668 

1669### 7) Notify a workspace owner about a limit

1670 

1671Use `account/sendAddCreditsNudgeEmail` to ask ChatGPT to email a workspace owner when credits are depleted or a usage limit has been reached.

1672 

1673```json

1674{ "method": "account/sendAddCreditsNudgeEmail", "id": 7, "params": { "creditType": "credits" } }

1675{ "id": 7, "result": { "status": "sent" } }

1676```

1677 

1678Use `creditType: "credits"` when workspace credits are depleted, or `creditType: "usage_limit"` when the workspace usage limit has been reached. If the owner was already notified recently, the response status is `cooldown_active`.

1# Automations1# Automations

2 2 

3<div class="feature-grid">

4 

5<div>

6 

3Automate recurring tasks in the background. Codex adds findings to the inbox, or automatically archives the task if there's nothing to report. You can combine automations with [skills](https://developers.openai.com/codex/skills) for more complex tasks.7Automate recurring tasks in the background. Codex adds findings to the inbox, or automatically archives the task if there's nothing to report. You can combine automations with [skills](https://developers.openai.com/codex/skills) for more complex tasks.

4 8 

5Automations run locally in the Codex app. The app needs to be running, and the9For project-scoped automations, the app needs to be running, and the selected

6selected project needs to be available on disk.10project needs to be available on disk.

7 11 

8In Git repositories, each automation run starts in a new12In Git repositories, you can choose whether an automation runs in your local

9[worktree](https://developers.openai.com/codex/app/worktrees) so it doesn’t interfere with your main13project or on a new [worktree](https://developers.openai.com/codex/app/worktrees). Both options run in the

10checkout. In non-version-controlled projects, automations run directly in the14background. Worktrees keep automation changes separate from unfinished local

15work, while running in your local project can modify files you are still

16working on. In non-version-controlled projects, automations run directly in the

11project directory.17project directory.

12 18 

13![Automation creation form with schedule and prompt fields](/images/codex/app/create-automation-light.webp)19You can also leave the model and reasoning effort on their default settings, or

20choose them explicitly if you want more control over how the automation runs.

21 

22</div>

23 

24<CodexScreenshot

25 alt="Automation creation form with schedule and prompt fields"

26 lightSrc="/images/codex/app/codex-automations-light.webp"

27 darkSrc="/images/codex/app/codex-automations-dark.webp"

28 maxHeight="400px"

29/>

30 

31</div>

14 32 

15## Managing tasks33## Managing tasks

16 34 

17All automations and their runs can be found in the automations pane inside your Codex app sidebar.35Find all automations and their runs in the automations pane inside your Codex app sidebar.

18 36 

19The "Triage" section acts as your inbox. Automation runs with findings show up there, and you can filter your inbox to show all automation runs or only unread ones.37The "Triage" section acts as your inbox. Automation runs with findings show up there, and you can filter your inbox to show all automation runs or only unread ones.

20 38 

21When an automation runs in a Git repository, Codex uses a dedicated background [worktree](https://developers.openai.com/codex/app/features#worktree-support). In non-version-controlled projects, automations run directly in the project directory. Consider using Git to enable running on background worktrees. You can have the same automation run on multiple projects.39Standalone automations start fresh runs on a schedule and report results in

40Triage. Use them when each run should be independent or when one automation

41should run across one or more projects. If you need a custom cadence, choose a

42custom schedule and enter cron syntax.

43 

44For Git repositories, each automation can run either in your local project or

45on a dedicated background [worktree](https://developers.openai.com/codex/app/features#worktree-support). Use

46worktrees when you want to isolate automation changes from unfinished local

47work. Use local mode when you want the automation to work directly in your main

48checkout, keeping in mind that it can change files you are actively editing.

49In non-version-controlled projects, automations run directly in the project

50directory. You can have the same automation run on more than one project.

22 51 

23Automations use your default sandbox settings. In read-only mode, tool calls fail if they require modifying files, network access, or working with apps on your computer. With full access enabled, background automations carry elevated risk. You can adjust sandbox settings in [Settings](https://developers.openai.com/codex/app/settings) and selectively allowlist commands with [rules](https://developers.openai.com/codex/rules).52Automations use your default sandbox settings. In read-only mode, tool calls fail if they require modifying files, network access, or working with apps on your computer. With full access enabled, background automations carry elevated risk. You can adjust sandbox settings in [Settings](https://developers.openai.com/codex/app/settings) and selectively allowlist commands with [rules](https://developers.openai.com/codex/rules).

24 53 

25To keep automations maintainable and shareable across teams, you can use [skills](https://developers.openai.com/codex/skills) to define the action and provide tools and context to Codex. You can explicitly trigger a skill as part of an automation by using `$skill-name` inside your automation.54Automations can use the same plugins and skills available to Codex. To keep

55automations maintainable and shareable across teams, use [skills](https://developers.openai.com/codex/skills)

56to define the action and provide tools and context. You can explicitly trigger a

57skill as part of an automation by using `$skill-name` inside your automation.

58 

59## Ask Codex to create or update automations

60 

61You can create and update automations from a regular Codex thread. Describe the

62task, the schedule, and whether the automation should stay attached to the

63current thread or start fresh runs. Codex can draft the automation prompt, choose

64the right automation type, and update it when the scope or cadence changes.

65 

66For example, ask Codex to remind you in this thread while a deployment finishes,

67or ask it to create a standalone automation that checks a project on a recurring

68schedule.

69 

70Skills can also create or update automations. For example, a skill for

71babysitting a pull request could set up a recurring automation that checks the

72PR status with the GitHub plugin and fixes new review feedback.

73 

74## Thread automations

75 

76Thread automations are heartbeat-style recurring wake-up calls attached to the

77current thread. Use them when you want Codex to keep returning to the same

78conversation on a schedule.

79 

80Use a thread automation when the scheduled work should preserve the thread's

81context instead of starting from a new prompt each time.

82 

83Thread automations can use minute-based intervals for active follow-up loops,

84or daily and weekly schedules when you need a check-in at a specific time.

85 

86Thread automations are useful for:

87 

88- checking a long-running command until it finishes

89- polling Slack, GitHub, or another connected source when the results should

90 stay in the same thread

91- reminding Codex to continue a review loop at a fixed cadence

92- running a skill-driven workflow that uses plugins, such as checking PR status

93 and addressing new feedback

94- keeping a chat focused on an ongoing research or triage task

95 

96Use a standalone or project automation when each run should be independent,

97when it should run across more than one project, or when findings should appear

98as separate automation runs in Triage.

99 

100When you create a thread automation, make the prompt durable. It should

101describe what Codex should do each time the thread wakes up, how to decide

102whether there is anything important to report, and when to stop or ask you for

103input.

26 104 

27## Testing automations safely105## Test automations

28 106 

29Before you schedule an automation, test the prompt manually in a regular thread107Before you schedule an automation, test the prompt manually in a regular thread

30first. This helps you confirm:108first. This helps you confirm:

31 109 

32- The prompt is clear and scoped correctly.110- The prompt is clear and scoped correctly.

33- The selected model and tools behave as expected.111- The selected or default model, reasoning effort, and tools behave as expected.

34- The resulting diff is reviewable.112- The resulting diff is reviewable.

35 113 

36When you start scheduling runs, review the first few outputs closely and adjust114When you start scheduling runs, review the first few outputs and adjust the

37the prompt or cadence as needed.115prompt or cadence as needed.

38 116 

39## Worktree cleanup for automations117## Worktree cleanup for automations

40 118 

41For Git repositories, automations run in worktrees. Frequent schedules can119If you choose worktrees for Git repositories, frequent schedules can create

42create many worktrees over time. Archive automation runs you no longer need,120many worktrees over time. Archive automation runs you no longer need, and avoid

43and avoid pinning runs unless you intend to keep their worktrees.121pinning runs unless you intend to keep their worktrees.

44 122 

45## Permissions and security model123## Permissions and security model

46 124 

47Automations are designed to run unattended and use your default sandbox125Automations run unattended and use your default sandbox settings.

48settings.

49 126 

50- If your sandbox mode is **read-only**, tool calls fail if they require127- If your sandbox mode is **read-only**, tool calls fail if they require

51 modifying files, accessing network, or working with apps on your computer.128 modifying files, accessing network, or working with apps on your computer.

55 on your computer. You can selectively allowlist commands to run outside the132 on your computer. You can selectively allowlist commands to run outside the

56 sandbox using [rules](https://developers.openai.com/codex/rules).133 sandbox using [rules](https://developers.openai.com/codex/rules).

57- If your sandbox mode is **full access**, background automations carry134- If your sandbox mode is **full access**, background automations carry

58 elevated risk, as Codex may modify files, run commands, and access network135 elevated risk, as Codex may change files, run commands, and access network

59 without asking. Consider updating sandbox settings to workspace write, and136 without asking. Consider updating sandbox settings to workspace write, and

60 using [rules](https://developers.openai.com/codex/rules) to selectively define which commands the agent137 using [rules](https://developers.openai.com/codex/rules) to selectively define which commands the agent

61 can run with full access.138 can run with full access.

62 139 

63If you are in a managed environment, admins can restrict these behaviors using140If you are in a managed environment, admins can restrict these behaviors using

64admin-enforced requirements. For example, they can disallow `approval_policy = "never"` or constrain allowed sandbox modes. See141admin-enforced requirements. For example, they can disallow `approval_policy =

142"never"` or constrain allowed sandbox modes. See

65[Admin-enforced requirements (`requirements.toml`)](https://developers.openai.com/codex/enterprise/managed-configuration#admin-enforced-requirements-requirementstoml).143[Admin-enforced requirements (`requirements.toml`)](https://developers.openai.com/codex/enterprise/managed-configuration#admin-enforced-requirements-requirementstoml).

66 144 

67Automations use `approval_policy = "never"` when your organization policy145Automations use `approval_policy = "never"` when your organization policy

68allows it. If `approval_policy = "never"` is disallowed by admin requirements,146allows it. If admin requirements disallow `approval_policy = "never"`,

69automations fall back to the approval behavior of your selected mode.147automations fall back to the approval behavior of your selected mode.

70 148 

71## Examples149## Examples

1# In-app browser

2 

3The in-app browser gives you and Codex a shared view of rendered web pages

4inside a thread. Use it when you're building or debugging a web app and want to

5preview pages and attach visual comments.

6 

7Use it for local development servers, file-backed previews, and public pages

8that don't require sign-in. For anything that depends on login state or browser

9extensions, use your regular browser or the

10[Codex Chrome extension](https://developers.openai.com/codex/app/chrome-extension).

11 

12Open the in-app browser from the toolbar, by clicking a URL, by navigating

13manually in the browser, or by pressing <kbd>Cmd</kbd>+<kbd>Shift</kbd>+<kbd>B</kbd>

14(<kbd>Ctrl</kbd>+<kbd>Shift</kbd>+<kbd>B</kbd> on Windows).

15 

16The in-app browser does not support authentication flows, signed-in pages,

17 your regular browser profile, cookies, extensions, or existing tabs. Use it

18 for pages Codex can open without logging in.

19 

20Treat page content as untrusted context. Don't paste secrets into browser flows.

21 

22<CodexScreenshot

23 alt="Codex app showing a browser comment on a local web app preview"

24 lightSrc="/images/codex/app/in-app-browser-light.webp"

25 darkSrc="/images/codex/app/in-app-browser-dark.webp"

26 maxHeight="420px"

27 variant="no-wallpaper"

28/>

29 

30## Browser use

31 

32Browser use lets Codex operate the in-app browser directly. Use it for local

33development servers and file-backed previews when Codex needs to click, type,

34inspect rendered state, take screenshots, or verify a fix in the page.

35 

36To use it, install and enable the Browser plugin. Then ask Codex to use the

37browser in your task, or reference it directly with `@Browser`. The app keeps

38browser use inside the in-app browser and lets you manage allowed and blocked

39websites from settings.

40 

41Example:

42 

43```text

44Use the browser to open http://localhost:3000/settings, reproduce the layout

45bug, and fix only the overflowing controls.

46```

47 

48Codex asks before using a website unless you've allowed it. Removing a site from

49the allowed list means Codex asks again before using it; removing a site from the

50blocked list means Codex can ask again instead of treating it as blocked.

51 

52For signed-in websites in Chrome, see

53[Codex Chrome extension](https://developers.openai.com/codex/app/chrome-extension).

54 

55## Preview a page

56 

571. Start your app's development server in the [integrated terminal](https://developers.openai.com/codex/app/features#integrated-terminal) or with a [local environment action](https://developers.openai.com/codex/app/local-environments#actions).

582. Open an unauthenticated local route, file-backed page, or public page by

59 clicking a URL or navigating manually in the browser.

603. Review the rendered state alongside the code diff.

614. Leave browser comments on the elements or areas that need changes.

625. Ask Codex to address the comments and keep the scope narrow.

63 

64Example feedback:

65 

66```text

67I left comments on the pricing page in the in-app browser. Address the mobile

68layout issues and keep the card structure unchanged.

69```

70 

71## Comment on the page

72 

73When a bug is visible only in the rendered page, use browser comments to give

74Codex precise feedback on the page.

75 

76- Turn on comment mode, select an element or area, and submit a comment.

77- In comment mode, hold <kbd>Shift</kbd> and click to select an area.

78- Hold <kbd>Cmd</kbd> while clicking to send a comment immediately.

79 

80After you leave comments, send a message in the thread asking Codex to address

81them. Comments are most useful when Codex needs to make a precise visual change.

82 

83Good feedback is specific:

84 

85```text

86This button overflows on mobile. Keep the label on one line if it fits,

87otherwise wrap it without changing the card height.

88```

89 

90```text

91This tooltip covers the data point under the cursor. Reposition the tooltip so

92it stays inside the chart bounds.

93```

94 

95## Keep browser tasks scoped

96 

97The in-app browser is for review and iteration. Keep each browser task small

98enough to review in one pass.

99 

100- Name the page, route, or local URL.

101- Name the visual state you care about, such as loading, empty, error, or

102 success.

103- Leave comments on the exact elements or areas that need changes.

104- Review the updated route after Codex changes the code.

105- Ask Codex to start or check the dev server before it uses the browser.

106 

107For repository changes, use the [review pane](https://developers.openai.com/codex/app/review) to inspect the

108changes and leave comments.

1# Codex Chrome extension

2 

3The Codex Chrome extension lets Codex use Chrome for browser tasks that need

4your signed-in browser state. Use it when Codex needs to read or act on sites

5such as LinkedIn, Salesforce, Gmail, or internal tools.

6 

7For local development servers, file-backed previews, and public pages that do

8not require sign-in, use the [in-app browser](https://developers.openai.com/codex/app/browser) first. The

9in-app browser keeps preview and verification work inside Codex without using

10your Chrome profile.

11 

12Codex can also switch between tools as a task requires, using plugins when a

13dedicated integration is available, Chrome when it needs logged-in browser

14context, and the in-app browser for localhost.

15 

16<div className="not-prose my-4">

17 <Alert

18 client:load

19 color="warning"

20 variant="soft"

21 description="Treat page content as untrusted context, and review the website before allowing Codex to continue."

22 />

23</div>

24 

25## Set up Chrome from Plugins

26 

27Set up the extension from Codex:

28 

291. Open Codex and go to **Plugins**.

302. Add the **Chrome** plugin.

313. Follow the setup flow. It guides you through installing or connecting the

32 Chrome extension and approving Chrome's permission prompts.

334. Open Chrome and confirm the Codex extension shows **Connected**.

34 

35After the plugin setup is complete, start a new Codex thread. Codex can suggest

36Chrome when a task needs a signed-in website. You can also invoke it directly in

37a prompt:

38 

39```text

40@Chrome open Salesforce and update the account from these call notes.

41```

42 

43If Chrome isn't already open, Codex can open it. Chrome browser tasks run in

44Chrome tab groups so the work for a thread stays grouped together.

45 

46## Control website access

47 

48By default, Codex asks before it interacts with each new website. Codex bases

49the prompt on the website host, such as `example.com`.

50 

51When Codex asks to use a website, you can choose the option that matches the

52task and your risk tolerance:

53 

54- Allow the website for the current chat.

55- Always allow the host so Codex can use that website again without asking.

56- Decline the website.

57 

58### Manage the allowlist and blocklist

59 

60In Computer Use settings, you can manage an allowlist and blocklist for

61domains. The allowlist contains domains Codex can use without asking again. The

62blocklist contains domains Codex shouldn't use.

63 

64Removing a domain from the allowlist means Codex asks again before using it.

65Removing a domain from the blocklist means Codex can ask again instead of

66treating the domain as blocked.

67 

68#### Always allow browser content <ElevatedRiskBadge class="ml-2" />

69 

70If you turn on always allow browser content, Codex no longer asks for

71confirmation before using websites.

72 

73#### Browser history <ElevatedRiskBadge class="ml-2" />

74 

75Browser history can include sensitive telemetry, internal URLs, search terms,

76and activity from Chrome sessions on signed-in devices. If you allow Codex to

77access browser history, relevant history entries can become part of the context

78Codex uses for the task. Malicious or misleading page content can increase the

79risk that Codex copies this data somewhere unintended.

80 

81Codex asks when it wants to use browser history. Codex scopes history access to

82the request, and history doesn't have an always-allow option.

83 

84## Data and security

85 

86### Chrome extension permissions

87 

88Chrome asks you to accept extension permissions when you install the extension.

89The permission prompt may include:

90 

91- Access the page debugger

92- Read and change all your data on all websites

93- Read and change your browsing history on all your signed-in devices

94- Display notifications

95- Read and change your bookmarks

96- Manage your downloads

97- Communicate with cooperating native applications

98- View and manage your tab groups

99 

100These Chrome permissions make the extension capable of operating browser

101workflows. Codex still uses its own confirmations, settings, allowlists, and

102blocklists before using websites or browser history during a task.

103 

104### Memories

105 

106Browser use follows your Codex Memories setting. If Memories is on, Codex can

107use relevant saved memories while working in Chrome. If Memories is off, browser

108use doesn't use memories.

109 

110### What OpenAI stores from browsing

111 

112OpenAI doesn't store a separate complete record of your Chrome actions from the

113extension. OpenAI stores browser activity only when it becomes part of the Codex

114context, such as text Codex reads from a page, screenshots, tool calls,

115summaries, messages, or other content included in the thread.

116 

117Your ChatGPT and Codex data controls apply to content processed in context.

118Avoid sending secrets or highly sensitive data through browser tasks unless

119they're required and you are present to review each prompt.

120 

121## Troubleshooting

122 

123If Codex can't connect to Chrome, first confirm the website Codex is trying to

124access isn't in the blocklist in Settings. If the website isn't blocked, work

125through these checks:

126 

1271. Open the Codex extension from the Chrome toolbar or Chrome's extensions

128 menu. Make sure it shows **Connected**. If it shows disconnected or mentions

129 a missing native host, remove and re-add the Chrome plugin from **Plugins**

130 in Codex, then follow the setup flow again.

1312. In Codex, open **Plugins** and confirm that the Chrome plugin is on. If the

132 plugin is off, turn it on and try the task again.

1333. Make sure you are using the same Chrome profile where the Codex extension is

134 installed. If you use more than one Chrome profile, install and enable the

135 extension in the active profile.

1364. Start a new Codex thread and try the Chrome task again. This can clear a

137 thread-specific connection state.

1385. Restart Chrome and Codex, then try again. If the extension still doesn't

139 connect, uninstall the Codex Chrome extension, remove and re-add the Chrome

140 plugin from **Plugins**, and follow the setup flow again.

1416. If the extension shows **Connected** but Codex still can't use Chrome, run

142 `/feedback` in the Codex app and include the thread ID when you contact

143 support.

144 

145<CodexScreenshot

146 alt="Codex Chrome extension showing connected status"

147 lightSrc="/images/codex/app/chrome-connected-light.png"

148 darkSrc="/images/codex/app/chrome-connected-dark.png"

149 maxHeight="300px"

150 class="mt-4"

151/>

152 

153### Upload Files

154 

155If a Chrome task needs to upload a file from your computer, allow the Codex

156extension to access file URLs in Chrome:

157 

1581. In Chrome, open the extensions icon in the toolbar, then click **Manage

159 Extensions**.

1602. On the Codex extension card, click **Details**.

1613. Turn on **Allow access to file URLs**.

162 

163After you change the setting, start the Chrome task again.

164 

165<CodexScreenshot

166 alt="Chrome extension settings showing Allow access to file URLs enabled for Codex"

167 lightSrc="/images/codex/app/chrome-file-url-access-light.webp"