OpenAI Codex

All agent state is always on disk under the documented CODEX_HOME (~/.codex), and the docs describe pointing Codex at another home directory, so export is immediate. Restoring elsewhere means installing Codex, copying the directory by hand and signing in again; there is no single import action.

• Codex docs (full export) – CODEX_HOME usage
• Codex Advanced Config

CODEX_HOME holds config.toml, AGENTS.md, skills, session transcripts (JSONL, optionally zstd-compressed), memories, the state DB and local credentials. ChatGPT Apps connectors enabled by default (feature `apps`) are linked through OpenAI's hosted service, so those integrations can only be re-linked through a provider-registered client.

• features/src/lib.rs (apps default_enabled: true)
• Codex docs (full export)

The runtime is Apache-2.0, and OSS providers (Ollama, LM Studio) are defined with requires_openai_auth: false, so the login screen is skipped and no OpenAI account, licence key or server is needed to start or act. The update check goes to GitHub or Homebrew and can be switched off (check_for_update_on_startup). Hosted-only tool loss is graded in P4.

• LICENSE (Apache-2.0)
• model-provider-info/src/lib.rs
• config_toml.rs (check_for_update_on_startup)

Local open-weight models are supported through the documented `--oss` / `--local-provider` flags and custom providers. Some capabilities work only with OpenAI's hosted models: web search (supports_standalone_web_search is false for OSS providers), image generation, realtime voice, and remote compaction (only enabled for the OpenAI provider).

• model-provider-info/src/lib.rs
• model-provider/src/provider.rs (remote_compaction only for OpenAI)
• Codex CLI reference

Agent state lives locally under CODEX_HOME by default, so a current copy stays with the owner through account suspension, a lapsed plan or provider shutdown.

• Codex docs (full export) – session transcripts in $CODEX_HOME/sessions

Transcripts, config, memories and instructions are JSONL, TOML or Markdown, with types in open source. With the default OpenAI provider, compaction output (ContextCompaction) and reasoning items are stored as `encrypted_content` blobs that only OpenAI can decrypt.

• protocol/src/models.rs (encrypted_content fields)
• core/src/tasks/compact.rs

Base instructions, developer messages and settings are recorded in the session transcript (SessionMeta.base_instructions, ThreadSettingsApplied), and /status and /debug-config show the effective configuration. With remote compaction the compaction summary placed in context is an encrypted blob the owner cannot read (one shortfall). Server-delivered catalogue settings are cached locally but not shown in the UI, which is recorded here but not counted.

• protocol/src/protocol.rs (SessionMeta base_instructions)
• rollout/src/policy.rs
• tui/src/slash_command.rs

Requests use store:false, but analytics events go to OpenAI by default, and the Privacy Policy keeps Personal Data 'as long as we need… or for other legitimate business purposes' with further retention after deletion for safety, legal or fraud reasons. Retention is therefore not bounded, and held items are not visible to the owner one by one.

• core/src/client.rs (store: false)
• OpenAI US Privacy Policy (archived 2026-09-29; live page returned 403)

Tool suggestions (feature `tool_suggest`) and the remote plugin catalogue (`remote_plugin`) are on by default, surface OpenAI-catalogued plugins and connectors, and can be switched off in config. No evidence of paid placement was found, but no binding commitment rules it out.

• features/src/lib.rs (tool_suggest, remote_plugin default_enabled: true)

Transcripts record tool calls with arguments and outputs, but HookStarted and HookCompleted events are classed as non-durable and not persisted (hook entry path unrecorded). When a transcript write fails, persist_rollout_items only writes an error to the tracing log while the session continues, so the owner is not told (silent recording failure).

• rollout/src/policy.rs
• core/src/session/mod.rs (persist_rollout_items)

Session transcripts are plain JSONL or zstd files with no hash chain, signatures or external checkpoints, so edits or deletions leave no trace.

• rollout/src/recorder.rs

Transcripts are written by the Codex process to ~/.codex/sessions, which is outside the default workspace-write roots, and `.codex` stays read-only inside writable roots. MCP servers are launched with `sandbox: None`, so a tool path outside the sandbox could still alter the record.

• protocol/src/permissions.rs (protected .codex metadata)
• rmcp-client/src/stdio_server_launcher.rs (sandbox: None)
• Agent approvals & security

All runtime source is Apache-2.0. The release workflow signs Linux artifacts with Sigstore cosign (keyless, GitHub OIDC), but no documentation was found telling owners how to check the default npm or Homebrew binary against the source, and macOS/Windows builds rely on platform code signing.

• .github/workflows/rust-release.yml
• .github/actions/linux-code-sign/action.yml

On the default path the agent acts under the owner's ChatGPT account. The agent-identity module registers agent keys with OpenAI's backend and trusts JWTs issued by chatgpt.com/codex-backend/agent-identity, so the identity is provider-issued and revocable.

• agent-identity/src/lib.rs

Per-turn settings changes are recorded in transcripts (ThreadSettingsApplied), conversations can be rolled back or forked, and the memory workspace keeps a git baseline with a diff file. There is no attributed history or restore for config.toml, AGENTS.md, skills or permissions.

• rollout/src/policy.rs
• memories/README.md

The base prompt can be replaced with model_instructions_file, developer instructions and the compaction prompt are configurable, and several injected blocks can be toggled. Other behaviour-defining templates (memory pipeline prompts, review and guardian prompts, tool descriptions) are compiled into the binary and can only be changed by editing source (G3).

• config/src/config_toml.rs (model_instructions_file, include_* toggles, compact_prompt)
• memories/README.md (compiled templates)

Memories are off by default. When enabled, consolidated memories are editable Markdown under ~/.codex/memories, but per-thread stage-1 raw memories that feed consolidation are kept in the SQLite state DB with no itemised view or editor in the normal interface.

• memories/README.md
• Codex Memories docs

Owners can add any MCP server or tool without review and scope tools with enabled_tools/disabled_tools. Web search, update_plan, shell and multi-agent can be switched off, but no documented setting was found to remove apply_patch or view_image.

• config/src/config_toml.rs (ToolsToml)
• config/src/mcp_types.rs

The owner can switch off the sandbox (danger-full-access), approvals (never), analytics, feedback and history persistence through documented config or flags. As the owner is also the administrator, requirements.toml constraints are owner-editable.

• Agent approvals & security
• config/src/config_toml.rs

With no model pinned, the default model and per-model instruction templates, tool mode and guardian policy come from the backend /models catalogue, which is refreshed by ETag. Owners can pin these with `model`, model_catalog_json and model_instructions_file, and runtime updates are opt-in prompts. The hosted model behind a slug cannot be pinned: the server can reroute requests to another model (a warning is shown when this happens), and retirements for ChatGPT sign-in are announced with no stated notice period.

• protocol/src/openai_models.rs (ModelInfo from /models)
• models-manager/src/manager.rs
• core/src/session/mod.rs (server model reroute)
• Codex models page

File scope (writable roots, protected paths) and per-tool scope are supported. Network access in the supported configuration is on/off only; per-domain allow/deny needs the network proxy, which is an Experimental feature (G10). MCP servers run outside the sandbox (`sandbox: None`), so file and network limits do not bind that path. Spend is treated as met under G11 (no payment capability).

• features/src/lib.rs (network_proxy: Experimental)
• network-proxy/README.md
• rmcp-client/src/stdio_server_launcher.rs

Owners can gate commands (execpolicy prefix rules with `prompt`), MCP and app tools per tool (approval_mode), and all escalations (approval_policy), with approvals going to the user by default. Hosted web search, on by default in cached mode, can be switched off but not gated per call.

• execpolicy/src/decision.rs
• config/src/mcp_types.rs (approval_mode)
• protocol/src/config_types.rs (ApprovalsReviewer default user)

Esc/Ctrl+C interrupts the foreground turn, but background terminals need a separate `/stop` ('stop all background terminals'), and the local background daemon is managed separately (/daemon).

• tui/src/slash_command.rs

The consumer Terms and Privacy Policy allow OpenAI to use Content to train models unless the user opts out, and Codex docs say chat content 'may be used to improve OpenAI models if allowed by your ChatGPT data controls'. Analytics events go to OpenAI by default ([analytics] enabled defaults to true), and the Terms let non-material changes take effect on posting.

• OpenAI Terms of Use (archived 2026-09-29; live page returned 403)
• OpenAI US Privacy Policy (archived 2026-09-29)
• Codex computer-history docs
• analytics/src/client.rs
• Codex Advanced Config (analytics)

Local credentials are in auth.json or the OS keyring, disclosed in the auth docs and revocable with `codex logout` and per-server MCP logout. Grants for ChatGPT Apps connectors are held by OpenAI, and the public evidence I could open does not establish per-item visibility, immediate revocation or deletion of provider copies.

• Codex authentication docs

There is no single action that deletes the whole agent: local state must be removed by hand and the ChatGPT account deleted separately. The Privacy Policy removes deleted data within 30 days 'unless we need to retain it for longer' for legal, fraud, security or financial reasons, so provider-side copies may survive.

• OpenAI US Privacy Policy (archived 2026-09-29)
• Codex CLI reference (codex delete)