Codex CLI reference

Set what Codex can do without asking first. Relax or tighten approval requirements mid-session, such as switching between Auto and Read Only.

Include open files, current selection, and other IDE context. Pull editor context into the next prompt without re-explaining what’s open in your IDE.

Remap TUI keyboard shortcuts. Inspect and persist custom shortcut bindings in config.toml.

Toggle Vim mode for the composer. Switch between Vim normal/insert behavior and the default composer editing mode.

Set up the elevated agent sandbox (Windows only). Replace the degraded Windows sandbox after Codex offers the elevated setup.

Open the agent command center. Browse chats and switch between agents on the connected server.

Switch the active subagent thread. Inspect or continue work in a subagent from the current session.

Browse apps (connectors) and insert them into your prompt. Attach an app as $app-slug before asking Codex to use it.

Browse installed and discoverable plugins. Inspect plugin tools, install suggested plugins, or manage plugin availability.

View and manage lifecycle hooks. Inspect configured hooks, trust new or changed hooks, or disable non-managed hooks before they run.

Clear the terminal and start a fresh chat. Reset the visible UI and chat context together when you want a fresh start.

/clear [name]

Rename the current chat. Give a saved session a recognizable name without leaving the TUI.

Archive the current session. Remove the current session from active session lists without deleting its transcript.

Permanently delete the current session. Remove the transcript and descendant sessions when archiving isn’t enough.

Summarize the visible chat to free tokens. Use after long runs so Codex retains key points without blowing the context window.

Copy the latest completed Codex output. Grab the latest finished response or plan text without manually selecting it. You can also press Ctrl+O.

Show the Git diff, including files Git isn’t tracking yet. Review Codex’s edits before you commit or run tests.

Exit the CLI (same as /quit). Alternative spelling; both commands exit the session.

same as /quit

Toggle experimental features. Enable options such as Network proxy or Prevent sleep while running.

Approve one retry of a recent auto review denial. Retry a command or action that the auto reviewer denied.

Configure memory use and generation. Turn memory injection or memory generation on or off without leaving the TUI.

Browse and use skills. Improve task-specific behavior by selecting a relevant local skill.

Import Claude Code or Cursor setup, projects, and chats. Migrate supported external-agent artifacts into Codex configuration and local files.

Send logs to the Codex maintainers. Report issues or share diagnostics with support.

Generate an AGENTS.md scaffold in the current directory. Capture persistent instructions for the repository or subdirectory you’re working in.

Sign out of Codex. Clear local credentials when using a shared machine.

List configured Model Context Protocol (MCP) tools. Check which external tools Codex can call during the session; add verbose for server details.

/mcp verbose; /mcp login <name>

Attach a file to the chat. Point Codex at specific files or folders you want it to inspect next.

Choose the active model (and reasoning effort, when available). Use gpt-6-luna or gpt-6.1-sol if shown.

Toggle a Fast service tier when the model catalog exposes one. Turn the current model’s Fast tier on or off and persist the selection.

Switch to plan mode and optionally send a prompt. Ask Codex to propose an execution plan before implementation work starts.

/plan [prompt]

Set, edit, pause, resume, view, or clear a task goal. Give Codex a persistent target to track while a larger task runs.

/goal <objective>, /goal edit, /goal pause, /goal resume, /goal clear; objectives must be non-empty and at most 4,000 characters

Show background terminals and their recent output. Check long-running commands without leaving the main transcript.

Stop all background terminals. Cancel background terminal work started by the current session.

alias: /clean

Fork the current chat into a new chat. Branch the active session to explore a new approach without losing the current transcript.

Continue the current session in the ChatGPT desktop app. Move from the TUI to the desktop app on macOS or Windows.

Start an ephemeral side chat. Ask a focused follow-up without disrupting the main chat’s transcript.

alias: /btw

Toggle raw scrollback mode. Make terminal selection and copying less formatted while reviewing long output.

/raw, /raw on, /raw off

Resume a saved chat from your session list. Continue work from a previous CLI session without starting over.

Start a new chat inside the same CLI session. Reset the chat context without leaving the CLI when you want a fresh prompt in the same repo.

/new [name]

Exit the CLI. Leave the session immediately.

Ask Codex to review your working tree. Run after Codex completes work or when you want a second set of eyes on local changes.

Display session configuration and token usage. Confirm the active model, approval policy, writable roots, and remaining context capacity.

View account token usage or use a rate-limit reset. Inspect daily, weekly, or cumulative ChatGPT token activity from inside the TUI.

/usage daily | weekly | cumulative

Print config layer and requirements diagnostics. Debug precedence and policy requirements, including experimental network constraints.

Configure TUI status-line fields interactively. Pick and reorder footer items (model/context/limits/git/tokens/session) and persist in config.toml.

Configure terminal window or tab title fields interactively. Pick and reorder title items such as project, status, thread, branch, model, and task progress.

Choose a syntax-highlighting theme. Preview and persist a terminal syntax-highlighting theme.

Choose or hide a terminal pet. Personalize the TUI with a built-in or custom ambient pet.

alias: /pet; /pets off

Choose the terminal mode for the next launch. Switch between terminal scrollback and a fullscreen transcript.

Export the conversation as Markdown. Save a complete transcript to a file or copy it to the clipboard.

/export [file]

Generate a summary of the current conversation. Catch up on the chat without compacting its context.

Change the session’s working directory. Continue an idle primary chat in another directory.

/cd <path>; /cd alone uses your home directory

Show the working directory. Check the directory the active session uses.

alias: /cwd

Start or continue a chat in a managed Git worktree. Work in a separate checkout of a local repository.

Open background server controls. Inspect the connection and manage a local server owned by Codex.

View retained warnings and diagnostics. Revisit warnings that appeared during the session.

Experimental /voice command in the Codex CLI. Admins can disable it by setting features.realtime_conversation to false in requirements.toml.

Grant additional directories write access alongside the main workspace. Repeat for multiple paths.

path

Use automatic approval review with on-request approvals and the workspace-write sandbox. Conflicts with --sandbox and --yolo; the interactive CLI also rejects --ask-for-approval.

boolean

Control when Codex pauses for human approval before running a command.

on-request | never

Set the working directory for the agent before it starts processing your request.

path

Override configuration values. Values parse as TOML if possible; otherwise the literal string is used.

key=value

Run every command without approvals or sandboxing. Only use inside an externally hardened environment.

boolean

Run enabled hooks without requiring persisted hook trust for this invocation. Intended only for automation that already vets hook sources.

boolean

Force-disable a feature flag (translates to -c features.<name>=false). Repeatable.

feature

Force-enable a feature flag (translates to -c features.<name>=true). Repeatable.

feature

Attach one or more image files to the initial prompt. Separate multiple paths with commas or repeat the flag.

path[,path...]

Choose the local provider used with --oss, overriding oss_provider for this run.

lmstudio | ollama

Override the model set in configuration (for example gpt-6.1-sol).

string

Disable alternate screen mode for the TUI (overrides tui.alternate_screen for this run).

boolean

Run the interactive CLI without the shared background server. Can't be combined with --remote or codex agents.

boolean

Use a local open source model provider. Codex uses --local-provider, your configured oss_provider, or prompts you to choose between LM Studio and Ollama.

boolean

Layer $CODEX_HOME/profile-name.config.toml on top of the base user config.

string

Connect to a remote app-server endpoint over WebSocket or a Unix socket. Supported for codex, codex agents, codex queue, codex resume, codex fork, codex archive, codex delete, and codex unarchive; other subcommands reject remote mode.

ws://host:port | wss://host:port | unix:// | unix://PATH

Read a bearer token from this environment variable and send it when connecting with --remote. Requires --remote; tokens are only sent over wss:// URLs or local-only ws:// URLs.

ENV_VAR

Select the sandbox policy for model-generated shell commands.

read-only | workspace-write | danger-full-access

Enable live web search (sets web_search = "live" instead of the default "cached").

boolean

Error when config.toml contains fields this Codex version does not recognize. Supported by runtime commands such as codex, exec, review, resume, fork, app-server, and exec-server.

boolean

Start in a new managed Git worktree. Supports new interactive sessions, codex fork <SESSION_ID>, codex exec, and codex exec fork; requires local execution.

boolean

Positional arg of codex: Optional text instruction to start the session. Omit to launch the TUI without a pre-filled message.

string

codex app-server: Defaults analytics to enabled for first-party app-server clients unless the user opts out in config.

boolean

codex app-server: Connect to a remote Code Mode host instead of starting a local host. This outbound connection is shared across threads and is separate from --listen; use wss:// for remote hosts.

ws://HOST/PATH | wss://HOST/PATH

codex app-server: Transport listener URL. Use stdio:// for JSONL, ws://IP:PORT for a TCP WebSocket endpoint, unix:// for the default Unix socket, unix://PATH for a custom Unix socket, or off to disable the local transport.

stdio:// | ws://IP:PORT | unix:// | unix://PATH | off

codex app-server: Use stdio transport. Equivalent to --listen stdio:// and mutually exclusive with --listen.

boolean

codex app-server: Expected aud claim for signed bearer tokens. Requires --ws-auth signed-bearer-token.

string

codex app-server: Authentication mode for app-server WebSocket clients. If omitted, WebSocket auth is disabled; non-local listeners warn during startup.

capability-token | signed-bearer-token

codex app-server: Expected iss claim for signed bearer tokens. Requires --ws-auth signed-bearer-token.

string

codex app-server: Clock skew allowance when validating signed bearer token exp and nbf claims. Requires --ws-auth signed-bearer-token.

number

codex app-server: File containing the HMAC shared secret used to validate signed JWT bearer tokens. Required with --ws-auth signed-bearer-token.

absolute path

codex app-server: File containing the shared capability token. Use with --ws-auth capability-token unless you provide --ws-token-sha256 instead.

absolute path

codex app-server: Expected SHA-256 digest for capability-token authentication. Use instead of --ws-token-file when the client token comes from another source.

hexadecimal SHA-256 digest

codex app: Advanced override for the ChatGPT desktop app installer URL used during install.

url

Positional arg of codex app: Workspace path for the ChatGPT desktop app. On macOS, Codex opens this path; on Windows, Codex prints the path.

path

Positional arg of codex debug app-server send-message-v2: Message text sent to app-server through the built-in V2 test-client flow.

string

codex debug models: Skip refresh and print only the model catalog bundled with the current Codex binary.

boolean

codex debug prompt-input: Attach one or more images to the user prompt. Separate multiple paths with commas or repeat the flag.

path[,path...]

Positional arg of codex debug prompt-input: Optional user prompt appended after the session context.

string

Positional arg of codex apply: Identifier of the Codex cloud chat whose diff should be applied.

string

codex review: Review changes against the specified base branch.

branch

codex review: Review the changes introduced by the specified commit.

SHA

codex review: Error when config.toml contains fields this Codex version does not recognize.

boolean

codex review: Set the commit title shown in the review summary. Requires --commit.

string

codex review: Review staged, unstaged, and untracked changes.

boolean

Positional arg of codex review: Custom review instructions. Use - to read the instructions from stdin.

string | - (read stdin)

codex archive / codex unarchive: Connect to a remote app-server endpoint before changing archive state.

ws://host:port | wss://host:port | unix:// | unix://PATH

codex archive / codex unarchive: Read a bearer token from this environment variable when --remote requires authentication.

ENV_VAR

Positional arg of codex archive / codex unarchive: Saved session to archive or restore. Session IDs take precedence over session names.

session ID | session name

codex delete: Delete without prompting. The session argument must be a UUID; names still require interactive confirmation.

boolean

codex delete: Connect to a remote app-server endpoint before deleting the session.

ws://host:port | wss://host:port | unix:// | unix://PATH

codex delete: Read a bearer token from this environment variable when --remote requires authentication.

ENV_VAR

Positional arg of codex delete: Saved session to delete. Session IDs take precedence over session names.

session ID | session name

codex cloud: Number of assistant attempts (best-of-N) Codex cloud should run.

1-4

codex cloud: Target Codex cloud environment identifier (required). Use codex cloud to list options.

ENV_ID

Positional arg of codex cloud: Task prompt. If omitted, Codex prompts interactively for details.

string

codex cloud list: Pagination cursor returned by a previous request.

string

codex cloud list: Filter tasks by environment identifier.

ENV_ID

codex cloud list: Emit machine-readable JSON instead of plain text.

boolean

codex cloud list: Maximum number of tasks to return.

1-20

Positional arg of codex completion: Shell to generate completions for. Output prints to stdout.

bash | zsh | fish | power-shell | elvish

codex doctor: Expand long lists in the detailed human-readable report.

boolean

codex doctor: Use ASCII status labels and separators in human-readable output.

boolean

codex doctor: Emit a redacted machine-readable support report.

boolean

codex doctor: Disable ANSI color in human-readable output.

boolean

codex doctor: Show grouped check rows and the final count summary only.

boolean

codex exec: Use automatic approval review with on-request approvals and the workspace-write sandbox. Conflicts with --sandbox and --yolo; the interactive CLI also rejects --ask-for-approval.

boolean

codex exec: Set the workspace root before executing the task.

path

codex exec: Control ANSI color in stdout.

always | never | auto

codex exec: Bypass approval prompts and sandboxing. Dangerous - only use inside an isolated runner.

boolean

codex exec: Run enabled hooks without requiring persisted hook trust for this invocation. Intended only for automation that already vets hook sources.

boolean

codex exec: Run without persisting session rollout files to disk.

boolean

codex exec: Do not load user or project execpolicy .rules files for this run.

boolean

codex exec: Do not load $CODEX_HOME/config.toml. Authentication still uses CODEX_HOME.

boolean

codex exec: Attach images to the first message. Repeatable; supports comma-separated lists.

path[,path...]

codex exec: Print newline-delimited JSON events instead of formatted text.

boolean

codex exec: Choose the local provider used with --oss, overriding oss_provider for this run.

lmstudio | ollama

codex exec: Override the configured model for this run.

string

codex exec: Use a local open source provider. Codex uses --local-provider or your configured oss_provider, and exits with an error if neither is set.

boolean

codex exec: Write the assistant’s final message to a file. Useful for downstream scripting.

path

codex exec: JSON Schema file describing the expected final response shape. Codex validates tool output against it.

path

codex exec: Layer $CODEX_HOME/profile-name.config.toml on top of the base user config.

string

codex exec: Sandbox policy for model-generated commands. Defaults to configuration.

read-only | workspace-write | danger-full-access

codex exec: Allow running outside a Git repository (useful for one-off directories).

boolean

codex exec: Run a new or forked session in a managed Git worktree. Requires local execution; can't be combined with resume, review, --ephemeral, or --ignore-user-config.

boolean

codex exec: Inline configuration override for the non-interactive run (repeatable).

key=value

Positional arg of codex exec: Initial instruction for the task. Use - to pipe the prompt from stdin.

string | - (read stdin)

codex exec resume: Include sessions outside the current working directory when selecting the most recent session.

boolean

codex exec resume: Attach one or more images to the follow-up prompt. Separate multiple paths with commas or repeat the flag.

path[,path...]

codex exec resume: Resume the most recent chat from the current working directory.

boolean

Positional arg of codex exec resume: Optional follow-up instruction sent immediately after resuming.

string | - (read stdin)

Positional arg of codex exec resume: Resume the specified session. Omit and use --last to continue the most recent session.

uuid | session name

codex execpolicy: Pretty-print the JSON result.

boolean

codex execpolicy: Path to an execpolicy rule file to evaluate. Provide multiple flags to combine rules across files.

path (repeatable)

Positional arg of codex execpolicy: Command to be checked against the specified policies.

var-args

codex login: Use OAuth device code flow instead of launching a browser window.

boolean

codex login: Read an access token from stdin (for example printenv CODEX_ACCESS_TOKEN | codex login --with-access-token).

boolean

codex login: Read an API key from stdin (for example printenv OPENAI_API_KEY | codex login --with-api-key).

boolean

codex mcp add: Environment variable whose value is sent as a bearer token when connecting to a streamable HTTP server.

ENV_VAR

codex mcp add: Environment variable assignments applied when launching a stdio server.

repeatable

codex mcp add: OAuth client identifier for a streamable HTTP MCP server. Requires --url.

CLIENT_ID

codex mcp add: OAuth resource parameter to include during login for a streamable HTTP MCP server. Requires --url.

RESOURCE

codex mcp add: Register a streamable HTTP server instead of stdio. Mutually exclusive with COMMAND....

https://…

Positional arg of codex mcp add: Executable plus arguments to launch the MCP server. Provide after --.

stdio transport

codex resume: Include sessions outside the current working directory when selecting the most recent session.

boolean

codex resume: Include non-interactive sessions in the picker and --last selection.

boolean

codex resume: Skip the picker and resume the most recent chat from the current working directory.

boolean

Positional arg of codex resume: Resume the specified session. Omit and use --last to continue the most recent session.

uuid | session name

codex fork: Show sessions beyond the current working directory in the picker.

boolean

codex fork: Skip the picker and fork the most recent chat automatically.

boolean

Positional arg of codex fork: Fork the specified session. Omit and use --last to fork the most recent session.

uuid

codex sandbox (macOS seatbelt): Allow the sandboxed command to bind or connect Unix sockets rooted at this path. Repeat to allow multiple paths.

path

codex sandbox (macOS seatbelt): Working directory used for profile resolution and command execution. Requires --permission-profile.

DIR

codex sandbox (macOS seatbelt): Pass configuration overrides into the sandboxed run (repeatable).

key=value

codex sandbox (macOS seatbelt): Include managed requirements while resolving an explicit permissions profile. Requires --permission-profile.

boolean

codex sandbox (macOS seatbelt): Capture macOS sandbox denials with log stream while the command runs and print them after exit.

boolean

codex sandbox (macOS seatbelt): Apply a named permissions profile from the active configuration stack.

NAME

codex sandbox (macOS seatbelt): Layer $CODEX_HOME/NAME.config.toml on top of the base user config.

NAME

Positional arg of codex sandbox (macOS seatbelt): Shell command to execute under macOS Seatbelt. Everything after -- is forwarded.

var-args

codex sandbox (Linux sandbox): Working directory used for profile resolution and command execution. Requires --permission-profile.

DIR

codex sandbox (Linux sandbox): Configuration overrides applied before launching the sandbox (repeatable).

key=value

codex sandbox (Linux sandbox): Include managed requirements while resolving an explicit permissions profile. Requires --permission-profile.

boolean

codex sandbox (Linux sandbox): Apply a named permissions profile from the active configuration stack.

NAME

codex sandbox (Linux sandbox): Layer $CODEX_HOME/NAME.config.toml on top of the base user config.

NAME

Positional arg of codex sandbox (Linux sandbox): Command to execute with bubblewrap filesystem isolation and seccomp filtering. Provide the executable after --.

var-args

codex sandbox (Windows): Working directory used for profile resolution and command execution. Requires --permission-profile.

DIR

codex sandbox (Windows): Configuration overrides applied before launching the sandbox (repeatable).

key=value

codex sandbox (Windows): Include managed requirements while resolving an explicit permissions profile. Requires --permission-profile.

boolean

codex sandbox (Windows): Apply a named permissions profile from the active configuration stack.

NAME

codex sandbox (Windows): Layer $CODEX_HOME/NAME.config.toml on top of the base user config.

NAME

Positional arg of codex sandbox (Windows): Command to execute under the native Windows sandbox. Provide the executable after --.

var-args

codex queue: Session to queue the message for; accepts a UUID or exact session name. Use a UUID when sessions share the same name.

UUID | exact session name

codex queue: Text message to queue for the existing session; image attachments are not supported.

string

codex remote-control: Machine-readable output for any remote-control command.

boolean

codex remote-control: Run remote control in the foreground explicitly. Applies only to the bare remote-control command; do not combine it with start, stop, or pair.

boolean

Launch the terminal UI. Accepts the global flags above plus an optional prompt or image attachments.

Maturity: Stable

Open the agent command center on a shared local or remote server.

Maturity: Stable

Launch the ChatGPT desktop app on macOS or Windows. On macOS, Codex can open a workspace path; on Windows, Codex prints the path to open.

Maturity: Stable

Launch the Codex app server for local development or debugging over stdio, WebSocket, or a Unix socket.

Maturity: Experimental

Apply the latest diff generated by a Codex cloud chat to your local working tree. Alias: codex a.

Maturity: Stable; alias: codex a

Archive a saved interactive session by session ID or session name.

Maturity: Stable

Browse or execute Codex cloud chats from the terminal without opening the TUI. Alias: codex cloud-tasks.

Maturity: Experimental; alias: codex cloud-tasks

Generate shell completion scripts for Bash, Zsh, Fish, or PowerShell.

Maturity: Stable

Debug app-server by sending a single V2 message through the built-in test client.

Maturity: Experimental

Print the raw model catalog Codex sees, including an option to inspect only the bundled catalog.

Maturity: Experimental

Render the model-visible prompt input list as JSON, optionally with a prompt and images.

Maturity: Experimental

Permanently delete a saved interactive session by session ID or session name.

Maturity: Stable

Generate a diagnostic report for local installation, config, auth, runtime, Git, terminal, app-server, and thread inventory issues.

Maturity: Stable

Run Codex non-interactively. Alias: codex e.

Maturity: Stable; alias: codex e

Evaluate execpolicy rule files and see whether a command would be allowed, prompted, or blocked.

Maturity: Experimental

List feature flags and persistently enable or disable them in config.toml.

Maturity: Stable

Fork a previous interactive session into a new chat, preserving the original transcript.

Maturity: Stable

Authenticate Codex using ChatGPT OAuth, device auth, an API key, or an access token piped over stdin.

Maturity: Stable

Remove stored authentication credentials.

Maturity: Stable

Manage Model Context Protocol servers (list, add, remove, authenticate).

Maturity: Stable

Install, list, and remove plugins from configured marketplace sources.

Maturity: Stable

Add, list, upgrade, or remove plugin marketplaces from Git or local sources.

Maturity: Stable

Queue a text message for an existing session by UUID or exact name.

Maturity: Stable

Run or manage remote control for the local app-server, or create a short-lived pairing code.

Maturity: Experimental

Continue a previous interactive session by ID or resume the most recent chat.

Maturity: Stable

Run a non-interactive review of uncommitted changes, a base branch diff, a commit, or custom review instructions.

Maturity: Stable

Run arbitrary commands inside Codex-provided macOS, Linux, or Windows sandboxes.

Maturity: Stable

Restore an archived interactive session by session ID or session name.

Maturity: Stable

Check for and apply a Codex CLI update when the installed release supports self-update.

Maturity: Stable

Persistently disable a feature flag in $CODEX_HOME/config.toml.

codex features disable <feature>

Persistently enable a feature flag in $CODEX_HOME/config.toml.

codex features enable <feature>

Show known feature flags, their maturity stage, and their effective state.

codex features list

Resume an exec session by ID or add --last to continue the most recent session from the current working directory. Add --all to consider sessions from any directory.

codex exec resume [SESSION_ID]

Print the active authentication mode and exit with 0 when logged in.

codex login status

Register a server using a stdio launcher command or a streamable HTTP URL. Supports --env KEY=VALUE for stdio transports.

add <name> -- <command...> | --url <value>

Show a specific server configuration. --json prints the raw config entry.

get <name> --json

List configured MCP servers. Add --json for machine-readable output.

list --json

Start an OAuth login for a streamable HTTP server (servers that support OAuth only).

login <name> --scopes scope1,scope2

Remove stored OAuth credentials for a streamable HTTP server.

logout <name>

Delete a stored MCP server definition.

remove <name>

Install a plugin from a configured marketplace. Use --marketplace or -m when the plugin argument omits @marketplace.

add <plugin[@marketplace]> [--marketplace, -m NAME] [--json]

List installed plugins. With --json, output has installed and available arrays; --available includes uninstalled marketplace plugins and requires --json.

list [--marketplace, -m NAME] [--available --json] [--json]

Remove an installed plugin from local config and cache. Use --json for automation-friendly output.

remove <plugin[@marketplace]> [--marketplace, -m NAME] [--json]

Install a plugin marketplace from GitHub shorthand, a Git URL, an SSH URL, or a local marketplace root directory. --sparse is supported only for Git sources and can be repeated.

add <source> [--ref REF] [--sparse PATH] [--json]

Show plugin marketplaces Codex is currently considering and the root path for each marketplace.

list [--json]

Remove a configured plugin marketplace.

remove <marketplace-name> [--json]

Refresh one configured Git marketplace, or all configured Git marketplaces when no name is provided.

upgrade [marketplace-name] [--json]

Submits a Codex cloud task directly from the terminal (the default codex cloud command opens an interactive picker).

List recent cloud chats with optional filtering and pagination.

Start the local app-server daemon with remote control enabled.

Stop the local app-server daemon started for remote control.

After the daemon is running, create and print a short-lived manual pairing code. With --json, the response includes pairingCode, manualPairingCode, environmentId, and expiresAt.

Evaluate one or more --rules files against a command and emit JSON showing the strictest decision and any matching rules. The execpolicy command is currently in preview.

[--pretty] --rules <path> -- <command...>

codex exec can resume sessions or fork them into new sessions; codex exec fork is listed among the commands that support --worktree (requires local execution).

Type @ to search for a file in the workspace and add its path to the prompt.

Press Up or Down to restore draft history.

Search prompt history, then press Enter to use a match or Escape to cancel.

Copy the latest completed Codex output from the main TUI (same as /copy).

Prefix a line with ! to run a local shell command under the current approval and sandbox settings.

Queue a follow-up prompt, slash command, or shell command for the next turn.

Inject new instructions into the current turn.

Press Escape twice with an empty composer to edit the previous user message and fork the chat from that point.

Close the session (same as /exit).

Clears only the terminal view and keeps the current chat (unlike /clear, which starts a new chat). Disabled while a task is in progress.

Default binding to toggle raw scrollback mode (same as /raw).

Type / in the composer to open the slash command popup.

Press Space on an installed plugin in the plugin browser to toggle its enabled state.

Open the editor configured by VISUAL (or EDITOR when VISUAL is not set) to write a longer prompt; save and close to return the text to the composer.

Multi-agent settings and custom role declarations.

table

Path to a TOML config layer for that role; relative paths resolve from the config file that declares the role.

string (path)

Role guidance shown to Codex when choosing and spawning that agent type.

string

Default model for spawned agents. An explicit spawn model takes precedence.

string

Default reasoning effort for spawned agents.

string

Enable or disable multi-agent tools (default: true).

boolean

Record a model-visible message when an agent turn is interrupted (default: true).

boolean

Maximum number of spawned-agent threads that can be open concurrently, excluding the primary thread.

number

Legacy alias for agents.max_concurrent_threads_per_session.

number

Allow shell-based tools to use login-shell semantics.

boolean

Enable or disable analytics for this machine/profile.

boolean

Controls when Codex pauses for approval before executing commands.

on-request | never | { granular = { sandbox_approval = bool, rules = bool, mcp_elicitations = bool, request_permissions = bool, skill_approval = bool } }

When true, MCP elicitation prompts are allowed to surface instead of being auto-rejected.

boolean

When true, prompts from the request_permissions tool are allowed to surface.

boolean

When true, approvals triggered by execpolicy prompt rules are allowed to surface.

boolean

When true, sandbox escalation approval prompts are allowed to surface.

boolean

When true, skill-script approval prompts are allowed to surface.

boolean

Who reviews eligible approval prompts under on-request or granular approval policies.

user | auto_review

Default reviewer for app tool approval prompts unless overridden per app.

user | auto_review

Default approval behavior for app tools without per-app or per-tool overrides.

auto | prompt | writes | approve

Default allow/deny for app tools with destructive_hint = true.

boolean

Default app enabled state for all apps unless overridden per app.

boolean

Default allow/deny for app tools with open_world_hint = true.

boolean

Reviewer for this app's tool approval prompts.

user | auto_review

Default approval behavior for tools in this app unless a per-tool override exists.

auto | prompt | writes | approve

Default enabled state for tools in this app unless a per-tool override exists.

boolean

Allow or block tools in this app that advertise destructive_hint = true.

boolean

Enable or disable a specific app/connector by id (default: true).

boolean

Allow or block tools in this app that advertise open_world_hint = true.

boolean

Per-tool approval behavior override for a single app tool.

auto | prompt | writes | approve

Per-tool enabled override for an app tool (for example repos/list).

boolean

Additional local Markdown policy for automatic review, included alongside the main policy.

string

Local Markdown policy instructions for automatic review.

string

Maximum poll window in milliseconds for empty write_stdin polls (background terminal polling).

number

Set to false to restrict browser-history access.

boolean

Fallback browser-origin restrictions. Supports access, uploads, downloads, and full_cdp_access, each set to allow or deny.

table

Per-origin browser restrictions with the same fields as browser_use.default_origin_policy.

table

Override the base URL used during the ChatGPT login flow.

string

Check for Codex updates on startup (set to false only when updates are centrally managed).

boolean

Control where the CLI stores cached credentials.

file | keyring | auto | ephemeral

Inline override for the history compaction prompt.

string

Fallback native-app access policy for Computer Use.

allow | deny

Native macOS app access keyed by bundle identifier.

map<string, allow | deny>

Windows app identifiers that Computer Use can open without prompting.

array<string>

Packaged Windows app access keyed by Application User Model ID (AUMID).

map<string, allow | deny>

Windows executable access rules. Each rule requires publisher_name, product_name, and access (allow or deny); binary_name is optional.

array<table>

Name of the default permissions profile to apply to sandboxed tool calls.

string

User-level only. Defines an additional **Open in** target for the ChatGPT desktop app.

table

Arguments inserted between the command and file input (default: []).

array<string>

Executable path or command name to detect and launch.

string

Bundled asset path, Base64-encoded data:image/... URL, file URI, or absolute local path for the handler icon.

string

How the app sends file input to the handler (default: path).

path | json_argument | json_stdin

Display name shown in **Open in** menus.

string

Offer the handler for files in SSH workspaces (default: false).

boolean

Additional developer instructions injected into the session (optional).

string

Legacy fallback for tui.disable_paste_burst.

boolean

Load the compaction prompt override from a file (experimental).

string (path)

Legacy name for enabling unified exec; prefer [features].unified_exec or codex --enable unified_exec.

boolean

Enable app (connector) integrations (stable; on by default).

boolean

Tool namespaces code mode can use only through direct tool calls.

array<string>

Enable code mode feature configuration. This feature is under development and off by default.

boolean

Tool namespaces code mode excludes from nested code-mode tool guidance and executor exposure.

array<string>

Experimental context-management setting.

boolean

Compress streaming request bodies with zstd when supported (stable; on by default).

boolean

Enable Fast mode controls advertised by the active model (stable; on by default), independently of features.ultrafast_mode.

boolean

Enable persisted goals and automatic continuation (stable; on by default).

boolean

Enable lifecycle hooks loaded from hooks.json or inline [hooks] config.

boolean

Enable Memories (off by default).

boolean

Enable multi-agent collaboration tools (spawn_agent, send_input, resume_agent, wait_agent, and close_agent) (stable; on by default).

boolean

Start the network proxy for sandboxed commands (experimental; off by default).

boolean | table

Allow broader local/private-network access.

boolean

Allow chaining through an upstream proxy from the environment.

boolean

Permit arbitrary Unix socket destinations instead of allowlist-only access.

boolean

Permit non-loopback listener addresses. Defaults to false; enabling it can expose proxy listeners beyond localhost.

boolean

Domain policy for sandboxed networking. Unset by default, which means no external destinations are allowed until you add allow rules.

map<string, allow | deny>

Expose SOCKS5 support. Defaults to true.

boolean

Allow UDP over SOCKS5. Defaults to true.

boolean

Start the sandboxed-command network proxy when command network access is enabled.

boolean

HTTP listener URL for sandboxed networking.

string

SOCKS5 listener URL. Defaults to "http://127.0.0.1:8081".

string

Unix socket policy for sandboxed networking.

map<string, allow | deny>

Removed feature flag. Accepted for compatibility and ignored.

boolean

Prefer MXC for local Windows execution when native capabilities and policy allow it; otherwise retain the configured legacy sandbox and setup.

boolean

Prevent the machine from sleeping while a turn is actively running (experimental; off by default).

boolean

Enable the remote plugin catalog (stable; on by default).

boolean

Enable rollout budget tracking. This feature is under development and off by default.

boolean

Positive token limit for rollout budget tracking.

integer

Finite non-negative multiplier for prefill tokens in rollout budget accounting.

number

Positive token interval between rollout budget reminders.

integer

Finite non-negative multiplier for sampled tokens in rollout budget accounting.

number

Snapshot shell environment to speed up repeated commands (stable; on by default).

boolean

Enable command execution tools (stable; on by default).

boolean

Allow prompting and installing missing MCP dependencies for skills (stable; on by default).

boolean

Enable Ultrafast mode controls (stable; on by default), independently of features.fast_mode.

boolean

Use resumable command execution (stable; enabled on all platforms).

boolean

Deprecated legacy toggle; prefer the top-level web_search setting.

boolean

Deprecated legacy toggle. When web_search is unset, true maps to web_search = "cached".

boolean

Deprecated legacy toggle. When web_search is unset, true maps to web_search = "live".

boolean

Enable feedback submission via /feedback across local clients (default: true).

boolean

URI scheme used to open citations from Codex output (default: vscode).

vscode | vscode-insiders | windsurf | cursor | none

Limit ChatGPT logins to a specific workspace identifier.

string (uuid)

Restrict Codex to a specific authentication method.

chatgpt | api

Suppress reasoning events in both the TUI and codex exec output.

boolean

If set, caps the history file size in bytes by dropping oldest entries.

number

Control whether Codex saves session transcripts to history.jsonl.

save-all | none

Lifecycle hooks configured inline in config.toml.

table

Matcher groups for hook events such as PreToolUse, PermissionRequest, PostToolUse, PreCompact, PostCompact, SessionStart, SessionEnd, SubagentStart, SubagentStop, UserPromptSubmit, Stop, or Interrupt.

array<table>

Hook handlers for a matcher group. Command and MCP tool hooks are supported while prompt and agent hook handlers are parsed but skipped.

array<table>

Approximate per-handler token threshold for saving oversized additionalContext to disk and showing the model a shorter preview.

integer

Run a command hook in the background without delaying the triggering operation.

boolean

Windows-only command override for command hooks.

string

Reserved for future use; prefer model_instructions_file or AGENTS.md.

string

Directory where Codex writes log files; defaults to $CODEX_HOME/log.

string (path)

Optional Git branch, tag, or commit for the marketplace.

string

Git repository location or local marketplace root directory.

string

Source kind for a configured plugin marketplace.

git | local

Optional sparse checkout paths for a Git marketplace.

array<string>

Optional global fixed port for the local HTTP callback server used during MCP OAuth login.

integer

Optional base callback URL for MCP OAuth login, such as a devbox ingress URL.

string

Preferred store for MCP OAuth credentials.

auto | file | keyring

Shared wait for optional MCP servers when building the initial tool catalog.

integer (milliseconds)

Arguments passed to the MCP stdio server command.

array<string>

Authentication fallback for an MCP HTTP server after configured bearer tokens and authorization headers.

oauth | chatgpt

Environment variable sourcing the bearer token for an MCP HTTP server.

string

Launcher command for an MCP stdio server.

string

Working directory for the MCP stdio server process.

string

Default approval behavior for MCP tools on this server unless a per-tool override exists.

auto | prompt | writes | approve

Deny list applied after enabled_tools for the MCP server.

array<string>

Disable an MCP server without removing its configuration.

boolean

Allow list of tool names exposed by the MCP server.

array<string>

Environment variables forwarded to the MCP stdio server.

map<string,string>

HTTP headers populated from environment variables for an MCP HTTP server.

map<string,string>

Additional environment variables to whitelist for an MCP stdio server.

array<string | { name = string, source = "local" | "remote" }>

Experimental placement for an MCP server.

local | remote

Static HTTP headers included with each MCP HTTP request.

map<string,string>

Local command that prints a JSON object of HTTP header names and values.

string (command)

Optional RFC 8707 OAuth resource parameter to include during MCP login.

string

Fixed OAuth callback listener port for this MCP server.

integer

Server-specific OAuth callback. Pre-registered clients reuse it when issuer identification is supported or the URL already ends in the server-specific callback ID.

string

Pre-registered OAuth client ID used for authorization and token exchange with this MCP server.

string

OAuth client secret for token exchange with a pre-registered client.

string

When true, fail startup/resume if this enabled MCP server cannot initialize.

boolean

OAuth scopes to request when authenticating to that MCP server.

array<string>

Alias for startup_timeout_sec in milliseconds.

number

Override the default 10s startup timeout for an MCP server.

number

Override the default 60s per-tool timeout for an MCP server.

number

Per-tool approval behavior override for one MCP tool on this server.

auto | prompt | writes | approve

Token budget for one MCP tool's output, before the standard 20% serialization allowance.

integer (positive)

Endpoint for an MCP streamable HTTP server.

string

Optional model override for global memory consolidation.

string

When true, threads that use external context such as MCP tool calls, web search, or tool search are kept out of memory generation.

boolean

Optional model override for per-thread memory extraction.

string

When false, newly created threads are not stored as memory-generation inputs.

boolean

Maximum recent raw memories retained for global consolidation.

number

Maximum age of threads considered for memory generation.

number

Maximum rollout candidates processed per startup pass.

number

Maximum days since a memory was last used before it becomes ineligible for consolidation.

number

Minimum remaining percentage required in Codex rate-limit windows before memory generation starts.

number

Minimum idle time before a thread is considered for memory generation.

number

When false, Codex skips injecting existing memories into future sessions.

boolean

Model to use (e.g., gpt-6.1-sol).

string

Token threshold that triggers automatic history compaction (unset uses model defaults).

number

Controls whether the auto-compaction threshold counts the full active context (total, the default) or only growth after the carried compaction-window prefix (body_after_prefix).

total | body_after_prefix

Optional path to a JSON model catalog loaded on startup.

string (path)

Context window tokens available to the active model.

number

Replacement for built-in instructions instead of AGENTS.md.

string (path)

Provider id from model_providers (default: openai).

string

Custom provider definition. Built-in provider IDs (openai, ollama, and lmstudio) are reserved and cannot be overridden.

table

Command-backed bearer token configuration for a custom provider.

table

Arguments passed to the token command.

array<string>

Command to run when Codex needs a bearer token.

string

Working directory for the token command.

string (path)

How often Codex proactively refreshes the token in milliseconds (default: 300000).

number

Maximum token command runtime in milliseconds (default: 5000).

number

API base URL for the model provider.

string

Whether the provider's hosted web search can access the live web.

boolean

Provider compaction protocol. unsupported uses local compaction; v2 sends compaction triggers through Responses.

unsupported | v2

HTTP headers populated from environment variables when present.

map<string,string>

Environment variable supplying the provider API key.

string

Optional setup guidance for the provider API key.

string

Direct bearer token for the provider (discouraged; use env_key).

string

Static HTTP headers added to provider requests.

map<string,string>

Full URL for a Codex-native model catalog.

string

Display name for a custom model provider.

string

Extra query parameters appended to provider requests.

map<string,string>

Retry count for HTTP requests to the provider (default: 4).

number

The provider uses OpenAI authentication (defaults to false).

boolean

Idle timeout for SSE streams in milliseconds (default: 300000).

number

Retry count for SSE streaming interruptions (default: 5).

number

Advertise support for a compatible standalone web search endpoint (default: false).

boolean

Whether that provider supports the Responses API WebSocket transport.

boolean

Protocol used by the provider. responses is the only supported value, and it is the default when omitted.

responses

AWS profile name used by the built-in amazon-bedrock provider.

string

AWS region used by the built-in amazon-bedrock provider.

string

Reasoning effort advertised by the selected model, such as low, medium, high, xhigh, max, or ultra.

string

Select reasoning summary detail or disable summaries entirely.

auto | concise | detailed | none

Force Codex to send or not send reasoning metadata.

boolean

Optional GPT-5 Responses API verbosity override; when unset, the selected model/preset default is used.

low | medium | high

Track acknowledgement of the full access warning prompt.

boolean

Track acknowledgement of the gpt-5.1-codex-max migration prompt.

boolean

Track acknowledgement of the GPT-5.1 migration prompt.

boolean

Track opt-out of the rate limit model switch reminder.

boolean

Track acknowledgement of the Windows world-writable directories warning.

boolean

Track acknowledged model migrations as old->new mappings.

map<string,string>

Command invoked for notifications; receives a JSON payload from Codex.

array<string>

Base URL override for the built-in openai model provider.

string

Default local provider used when running with --oss (defaults to prompting if unset).

lmstudio | ollama

Environment tag applied to emitted OpenTelemetry events (default: dev).

string

Select the OpenTelemetry exporter and provide any endpoint metadata.

none | otlp-http | otlp-grpc

Exporter endpoint for OTEL logs.

string

Static headers included with OTEL exporter requests.

map<string,string>

Protocol used by the OTLP/HTTP exporter.

binary | json

CA certificate path for OTEL exporter TLS.

string

Client certificate path for OTEL exporter TLS.

string

Client private key path for OTEL exporter TLS.

string

Opt in to exporting raw user prompts with OpenTelemetry logs.

boolean

Select the OpenTelemetry metrics exporter (defaults to statsig).

none | statsig | otlp-http | otlp-grpc

Select the OpenTelemetry trace exporter and provide any endpoint metadata.

none | otlp-http | otlp-grpc

Trace exporter endpoint for OTEL logs.

string

Static headers included with OTEL trace exporter requests.

map<string,string>

Protocol used by the OTLP/HTTP trace exporter.

binary | json

CA certificate path for OTEL trace exporter TLS.

string

Client certificate path for OTEL trace exporter TLS.

string

Client private key path for OTEL trace exporter TLS.

string

Human-readable description for this named profile.

string

Optional parent profile applied before this named profile.

string

Named filesystem permission profile. Each key is an absolute path or special token such as :minimal or :workspace_roots.

table

Scoped filesystem access relative to each effective workspace root.

"read" | "write" | "deny"

Grant direct access for a path, glob pattern, or special token, or scope nested entries under that root.

"read" | "write" | "deny" | table

Maximum depth for expanding deny-read glob patterns on platforms that snapshot matches before sandbox startup.

number

Permit broader local/private-network access through sandboxed networking.

boolean

Allow sandboxed networking to chain through another upstream proxy.

boolean

Allow arbitrary Unix socket destinations instead of the default restricted set.

boolean

Permit non-loopback bind addresses for sandboxed networking listeners.

boolean

Domain rules for sandboxed commands. Enforced only when features.network_proxy or enabled administrator-managed networking requirements activate the proxy.

table

Allow or deny an exact host or scoped wildcard pattern such as *.example.com or **.example.com.

allow | deny

Expose SOCKS5 support when this permissions profile enables sandboxed networking.

boolean

Allow UDP over the SOCKS5 listener when enabled.

boolean

Enable network access for commands in this permission profile.

boolean

Network proxy mode used for subprocess traffic.

limited | full

HTTP listener URL used when this permissions profile enables sandboxed networking.

string

SOCKS5 proxy endpoint used by this permissions profile.

string

Unix socket allowlist overrides for sandboxed networking.

table

Add an absolute Unix socket path to the effective allowlist with allow, or reject it with deny.

allow | deny

Profile-defined workspace roots that receive :workspace_roots filesystem rules alongside the session's runtime workspace roots.

table

Opt a path into the profile's workspace root set when true.

boolean

Deprecated compatibility setting. friendly and pragmatic no longer select a style.

none | friendly | pragmatic

Plan-mode-specific reasoning override using a level supported by the selected model.

string

Enable or disable a local-marketplace plugin using a plugin-name@marketplace-name key.

boolean

Default approval behavior for tools on a plugin-provided MCP server.

auto | prompt | writes | approve

Deny list applied after enabled_tools for a plugin-provided MCP server.

array<string>

Enable or disable an MCP server bundled by an installed plugin without changing the plugin manifest.

boolean

Allow list of tools exposed from a plugin-provided MCP server.

array<string>

Per-tool approval behavior override for a plugin-provided MCP tool.

auto | prompt | writes | approve

Additional filenames to try when AGENTS.md is missing.

array<string>

Maximum bytes read from AGENTS.md when building project instructions.

number

List of project root marker filenames; used when searching parent directories for the project root.

array<string>

Mark a project or worktree as trusted or untrusted ("trusted" | "untrusted"). Untrusted projects skip project-scoped .codex/ layers, including project-local config, hooks, and rules.

string

Optional model override used by /review (defaults to the current session model).

string

Sandbox policy for filesystem and network access during command execution.

read-only | workspace-write | danger-full-access

Exclude /tmp from writable roots in workspace-write mode.

boolean

Exclude $TMPDIR from writable roots in workspace-write mode.

boolean

Allow outbound network access inside the workspace-write sandbox.

boolean

Additional writable roots when sandbox_mode = "workspace-write".

array<string>

Preferred service tier for new turns. Use fast or another tier advertised by the active model; fast maps to the request value priority.

string

Legacy environment-variable exclusion patterns.

array<string>

Use the user shell profile when spawning subprocesses.

boolean

Canonical case-insensitive environment-variable pattern filters.

map<string, include | exclude>

Keep variables containing KEY, SECRET, or TOKEN before other filters run (default: true).

boolean

Legacy allowlist of environment-variable patterns.

array<string>

Baseline environment inheritance when spawning subprocesses.

all | core | none

Explicit environment values injected after exclusions; include filters can still remove them.

map<string,string>

Surface raw reasoning content when the active model emits it.

boolean

Per-skill enablement overrides stored in config.toml.

array<object>

Enable or disable the referenced skill.

boolean

Path to a skill folder containing SKILL.md.

string (path)

Token budget for the available-skills catalog.

integer (positive)

Directory where Codex stores the SQLite-backed state DB used by agent jobs and other resumable runtime state.

string (path)

Suppress the warning that appears when under-development feature flags are enabled.

boolean

Token budget for storing individual tool/function outputs in history.

number

Disable suggestions for specific discoverable connectors or plugins.

array<table>

Allow tool suggestions for additional discoverable connectors or plugins.

array<table>

Enable the local-image attachment tool view_image.

boolean

Optional web search tool configuration. The object form can set search context size, allowed search domains, and approximate user location.

boolean | { context_size = "low|medium|high", allowed_domains = [string], location = { country, region, city, timezone } }

TUI-specific options such as enabling inline desktop notifications.

table

Control alternate screen usage for the TUI (default: auto; auto skips it in Zellij to preserve scrollback).

auto | always | never

Enable terminal animations (welcome screen, shimmer, spinner) (default: true).

boolean

Generate automatic conversation recaps while the terminal is unfocused (default: true).

boolean

Disable burst-paste detection in the TUI (default: false).

boolean

Keyboard shortcut binding for a TUI action. Supported contexts include global, chat, composer, editor, vim_normal, vim_operator, vim_text_object, pager, list, and approval.

string | array<string>

Unbind the action in that keymap context. Key names use normalized strings such as ctrl-a, shift-enter, page-down, or minus.

empty array

Internal startup-tooltip state keyed by model slug.

integer

Control whether TUI notifications fire only when the terminal is unfocused or regardless of focus.

unfocused | always

Notification method for terminal notifications (default: auto).

auto | osc9 | bel

Enable TUI notifications; optionally restrict to specific event types.

boolean | array<string>

Start the TUI in raw scrollback mode for copy-friendly terminal selection (default: false).

boolean

Working directory to use when resuming or forking a session.

current | session

Show informational notices about connected app-server version differences (default: true).

boolean

Show onboarding tooltips in the TUI welcome screen (default: true).

boolean

Ordered list of TUI footer status-line item identifiers. null disables the status line.

array<string> | null

Ordered list of terminal window/tab title item identifiers. Defaults to ["spinner", "project"]; null disables title updates.

array<string> | null

Syntax-highlighting theme override (kebab-case theme name).

string

Start the composer in Vim normal mode instead of insert mode (default: false). You can still toggle it per session with /vim.

boolean

Web search mode (default: "cached"; cached uses an OpenAI-maintained index without external web access; indexed permits external access only when gated by the search index; if you use --yolo or another full access sandbox setting, it defaults to "live").

disabled | cached | indexed | live

Track Windows onboarding acknowledgement (Windows only).

boolean

Native Windows sandbox implementation. Explicit mxc selection fails when MXC is unavailable or prohibited by managed requirements.

mxc | elevated | unelevated

requirements.toml: Managed developer instructions added as a separate developer message. Codex rejects instructions that exceed a limit of 10,000 estimated tokens, including context markers.

string

requirements.toml: Set to false to disable Appshots for managed users.

boolean

requirements.toml: Set to false to block both agent-driven Browser Use and native-app Computer Use.

boolean

requirements.toml: Enforce whether shell tools can start a login shell.

boolean

requirements.toml: When true, Codex skips user, project, session, and plugin hooks while still allowing managed hooks from requirements.toml and other managed config layers.

boolean

requirements.toml: Set to false to disable device remote control for managed users.

boolean

requirements.toml: Allowed approval policies, such as on-request, never, and granular.

array<string>

requirements.toml: Allowed values for approvals_reviewer, such as user and auto_review.

array<string>

requirements.toml: Restrict ChatGPT login, including Codex access tokens, to the listed workspace IDs.

array<string>

requirements.toml: Allow chatgpt, api, or both. If omitted, this setting doesn't restrict login methods.

array<string>

requirements.toml: Complete list of allowed permission profiles.

table<boolean>

requirements.toml: Allow or deny a built-in or custom permission profile defined in a loaded config or requirements source.

boolean

requirements.toml: Allowed values for sandbox_mode.

array<string>

requirements.toml: Allowed values for web_search (disabled, cached, indexed, live).

array<string>

requirements.toml: Managed desktop application requirements.

table

requirements.toml: Destination restrictions for desktop app network requests, separate from command networking and browser origin rules.

table

requirements.toml: Exact domain rules for desktop app requests.

table<allow | deny>

requirements.toml: Allow or deny an exact domain. Use domain names without URL schemes, ports, or wildcards.

allow | deny

requirements.toml: Defaults to true when the table is present. When true, external desktop app requests require an explicitly allowed domain.

boolean

requirements.toml: Managed app requirements keyed by app identifier.

table

requirements.toml: Set to false to disable an app. A disabled requirement remains restrictive when multiple requirements sources are merged.

boolean

requirements.toml: Set the managed approval mode for one app tool.

auto | prompt | writes | approve

requirements.toml: Managed automatic-review requirements.

table

requirements.toml: Full model slugs for which Codex ignores allow prefix rules in command execution policy.

array<string>

requirements.toml: Model slugs that must use automatic review.

array<string>

requirements.toml: Managed requirements for agent-driven Browser Use.

table

requirements.toml: Set to false to prevent Browser Use from creating or honoring Always allow approvals that cover every site, such as allowing downloads from any site.

boolean

requirements.toml: Set to false to prevent Browser Use from reading browser history.

boolean

requirements.toml: Set to true to opt the desktop app's built-in browser into site tools (WebMCP).

boolean

requirements.toml: Fallback for each Browser Use setting when no matching entry under browser_use.origins defines it.

table

requirements.toml: Use deny to block Browser Use on origins that use the fallback.

allow | deny

requirements.toml: Set how long a non-persistent site-access approval lasts: turn limits it to the current turn, and thread keeps it for the rest of the current thread.

turn | thread

requirements.toml: Use deny to skip automatic review on origins that use the fallback and ask the user for approval instead.

allow | deny

requirements.toml: Use deny to block Browser Use downloads on origins that use the fallback.

allow | deny

requirements.toml: Use deny to block full Chrome DevTools Protocol (CDP) access on origins that use the fallback.

allow | deny

requirements.toml: Set to false to prevent Browser Use from saving or honoring an Always allow approval on origins that use the fallback.

boolean

requirements.toml: Use deny to block Browser Use uploads on origins that use the fallback.

allow | deny

requirements.toml: Set to true to skip automatic review for Browser Use and ask the user for approval instead.

boolean

requirements.toml: Origin-specific Browser Use policies. Keys use <scheme>://<host-pattern>[:<port>] with http or https.

map<string, table>

requirements.toml: Policy for origins matching this pattern.

table

requirements.toml: Use deny to block Browser Use on matching origins.

allow | deny

requirements.toml: Set how long a non-persistent site-access approval for matching origins lasts: turn limits it to the current turn, and thread keeps it for the rest of the current thread.

turn | thread

requirements.toml: Use deny to skip automatic review on matching origins and ask the user for approval instead.

allow | deny

requirements.toml: Use deny to block Browser Use downloads on matching origins.

allow | deny

requirements.toml: Use deny to block full Chrome DevTools Protocol (CDP) access on matching origins.

allow | deny

requirements.toml: Set to false to prevent Browser Use from saving or honoring an Always allow approval on matching origins.

boolean