⬛ Codex CLI: OpenAI's terminal agent, with a sandbox and a local-model escape hatch

What Codex CLI is

Codex CLI is OpenAI’s coding agent for the terminal: it reads your repository, edits files, runs commands, and iterates until the task is done. Same shape as Claude Code, different opinions — and two features that make it interesting even if you don’t use OpenAI models:

1. Explicit sandbox modes. You choose, per run, how much of your machine the agent can touch.
2. --oss. It can drive a local open-source model through LM Studio or Ollama instead of OpenAI’s API.

That second point is the reason this page cross-links to the local track: Codex CLI is currently the easiest way to get a polished terminal agent on top of models running on your own GPU.

Step 1 — Install

Any OS (npm) — Node.js 16+:

npm install -g @openai/codex

macOS (Homebrew):

brew install --cask codex

Windows: the npm command above is the simplest path. There is also a PowerShell installer documented by OpenAI:

irm https://chatgpt.com/codex/install.ps1 | iex

Check:

codex --version
# codex-cli 0.167.0

Step 2 — Sign in

cd ~/projects/my-app
codex

First launch offers Sign in with ChatGPT (browser OAuth), device-code auth, or an API key. The subscription path is the cheap one: Codex is included in every ChatGPT plan, from Free upward.

Codex and ChatGPT Work share the same usage pool — hammering the agent eats your chat quota too. OpenAI’s own docs say not to estimate task cost from API token prices; subscriptions and API billing are separate worlds.

Step 3 — The sandbox model (the part that matters)

Codex gives you two independent dials: what the filesystem/network allows (sandbox) and when it must ask you (approval).

codex --sandbox read-only          # can read, cannot write or reach the network
codex --sandbox workspace-write    # can edit the current workspace (default for most work)
codex --sandbox danger-full-access # no filesystem sandbox at all

codex -a on-request   # asks before commands that need escalation (default)
codex -a never        # never asks — sandbox is the only guardrail

And the one to treat like a loaded gun:

codex --dangerously-bypass-approvals-and-sandbox   # alias: --yolo

--yolo means no sandbox, no approvals. It exists for disposable containers. On your laptop it’s how you get a wiped directory, a leaked .env, or a force-push to main. Why sandboxing is the real safety layer →

Step 4 — Your first task

Start in a git repo with a clean tree, so every change is visible and revertible:

cd ~/projects/my-app
git status          # should be clean
codex

Then:

> find why `npm test` fails on the auth module, fix it, and show me the diff

You’ll see commands proposed before they run, diffs as they’re applied, and a running transcript you can steer mid-turn. Useful session commands:

Step 5 — Teach it the repo

Codex reads AGENTS.md at the repo root — the same convention other agent tools now share:

# AGENTS.md
- Node 22, pnpm, Vitest
- Run `pnpm test` and `pnpm lint` before declaring success
- Do not edit `prisma/migrations/`
- Commit messages: conventional commits

Global defaults live in ~/.codex/config.toml (model, approval policy, sandbox, providers). Per-run overrides: codex -c key=value.

Step 6 — Headless and local models

Non-interactive, for scripts and CI:

codex exec "list every endpoint in src/api and write docs/api.md"
codex exec --json "summarize the diff since main" | jq .
codex resume        # continue the last session

And the local escape hatch — start LM Studio’s server (port 1234) or Ollama (port 11434), then:

codex --oss --local-provider lmstudio
codex --oss --local-provider ollama

Now the agent loop runs on your machine’s model. Quality drops compared to frontier models, but cost drops to electricity, and nothing leaves the laptop. Serve a model locally first →

Codex vs. Claude Code, honestly

If you already pay for Claude, Claude Code is the more polished experience. If you want one agent that works with both a frontier model and your own GGUF files, Codex CLI is the only one of the two that does it.