Agent IDE — Codex fork for AI-native development environment
Find a file
Curtis 'Fjord' Hawthorne 73fd939296
js_repl: block wrapped payload prefixes in grammar (#12300)
## Summary

Tighten the `js_repl` freeform Lark grammar to block the most common
malformed payload wrappers before they reach runtime validation.

## What Changed

- Replaced the overly permissive `js_repl` freeform grammar (`start:
/[\s\S]*/`) with a structured grammar that still supports:
  - plain JS source
  - optional first-line `// codex-js-repl:` pragma followed by JS source
- Added grammar-level filtering for common bad payload shapes by
rejecting inputs whose first significant token starts with:
  - `{` (JSON object wrapper like `{"code":"..."}`)
  - `"` (quoted code string)
  - `` ``` `` (markdown code fences)
- Implemented the grammar without regex lookahead/lookbehind because the
API-side Lark regex engine does not support look-around.
- Added a unit test to validate the grammar shape and guard against
reintroducing unsupported lookaround.

## Why

`js_repl` is a freeform tool, but the model sometimes emits wrapped
payloads (JSON, quoted strings, markdown fences) instead of raw
JavaScript. We already reject those at runtime, but this change moves
the constraint into the tool grammar so the model is less likely to
generate invalid tool-call payloads in the first place.

## Testing

- `cargo test -p codex-core
js_repl_freeform_grammar_blocks_common_non_js_prefixes`
- `cargo test -p codex-core parse_freeform_args_rejects_`

## Notes

- This intentionally over-blocks a few uncommon valid JS starts (for
example top-level `{ ... }` blocks or top-level quoted directives like
`"use strict";`) in exchange for preventing the common wrapped-payload
mistakes.



#### [git stack](https://github.com/magus/git-stack-cli)
- 👉 `1` https://github.com/openai/codex/pull/12300
-  `2` https://github.com/openai/codex/pull/12275
-  `3` https://github.com/openai/codex/pull/12205
-  `4` https://github.com/openai/codex/pull/12185
-  `5` https://github.com/openai/codex/pull/10673
2026-02-20 10:47:07 -08:00
.codex/skills/test-tui Teach codex to test itself (#11531) 2026-02-11 20:03:19 -08:00
.devcontainer chore: install an extension for TOML syntax highlighting in the devcontainer (#1650) 2025-07-22 10:58:09 -07:00
.github fix(linux-sandbox): mount /dev in bwrap sandbox (#12081) 2026-02-18 23:27:32 -08:00
.vscode Move rust analyzer target dir (#5328) 2025-10-18 17:31:46 -07:00
codex-cli Update pnpm versions to fix cve-2026-24842 (#12009) 2026-02-19 14:27:55 -08:00
codex-rs js_repl: block wrapped payload prefixes in grammar (#12300) 2026-02-20 10:47:07 -08:00
docs [js_repl] paths for node module resolution can be specified for js_repl (#11944) 2026-02-17 23:29:49 -08:00
patches [bazel] Upgrade some rulesets in preparation for enabling windows, part 2 (#11197) 2026-02-09 20:08:10 +00:00
scripts bazel: enforce MODULE.bazel.lock sync with Cargo.lock (#11790) 2026-02-14 02:11:19 +00:00
sdk/typescript Update pnpm versions to fix cve-2026-24842 (#12009) 2026-02-19 14:27:55 -08:00
shell-tool-mcp Update pnpm versions to fix cve-2026-24842 (#12009) 2026-02-19 14:27:55 -08:00
third_party Add feature-gated freeform js_repl core runtime (#10674) 2026-02-11 12:05:02 -08:00
.bazelignore [bazel] Improve runfiles handling (#10098) 2026-01-29 00:15:44 +00:00
.bazelrc [bazel] Upgrade some rulesets in preparation for enabling windows (#11109) 2026-02-08 13:40:32 -08:00
.bazelversion [bazel] Upgrade to bazel9 (#9576) 2026-01-21 13:25:36 +00:00
.codespellignore feat(network-proxy): structured policy signaling and attempt correlation to core (#11662) 2026-02-13 09:01:11 +00:00
.codespellrc feat(network-proxy): structured policy signaling and attempt correlation to core (#11662) 2026-02-13 09:01:11 +00:00
.gitignore gitignore bazel-* (#8911) 2026-01-08 07:50:58 -08:00
.markdownlint-cli2.yaml fix(tui): document paste-burst state machine (#9020) 2026-01-13 11:48:31 -08:00
.npmrc chore: migrate to pnpm for improved monorepo management (#287) 2025-04-18 16:25:15 -07:00
.prettierignore [apply-patch] Clean up apply-patch tool definitions (#2539) 2025-08-21 20:07:41 -07:00
.prettierrc.toml Initial commit 2025-04-16 12:56:08 -04:00
AGENTS.md bazel: enforce MODULE.bazel.lock sync with Cargo.lock (#11790) 2026-02-14 02:11:19 +00:00
announcement_tip.toml nit: test an (#10892) 2026-02-06 14:41:53 +01:00
BUILD.bazel [bazel] Upgrade some rulesets in preparation for enabling windows (#11109) 2026-02-08 13:40:32 -08:00
CHANGELOG.md Documentation improvement: add missing period (#3754) 2025-10-30 13:01:33 -07:00
cliff.toml docs(changelog): update install command to @openai/codex@<version> (#2073) 2025-10-18 11:02:22 -07:00
defs.bzl [bazel] Fix proc_macro_dep libs (#12274) 2026-02-19 13:38:37 -08:00
flake.lock fix(nix): update flake for newer Rust toolchain requirements (#10302) 2026-01-31 11:34:53 -08:00
flake.nix fix(nix): use correct version from Cargo.toml in flake build (#11770) 2026-02-13 12:19:25 -08:00
justfile bazel: enforce MODULE.bazel.lock sync with Cargo.lock (#11790) 2026-02-14 02:11:19 +00:00
LICENSE Initial commit 2025-04-16 12:56:08 -04:00
MODULE.bazel fix: simplify macOS sleep inhibitor FFI (#12340) 2026-02-20 09:52:21 -08:00
MODULE.bazel.lock app-server: add JSON tracing logs (#12287) 2026-02-20 10:10:51 -08:00
NOTICE Add feature-gated freeform js_repl core runtime (#10674) 2026-02-11 12:05:02 -08:00
package.json Update pnpm versions to fix cve-2026-24842 (#12009) 2026-02-19 14:27:55 -08:00
pnpm-lock.yaml chore: ensure pnpm-workspace.yaml is up-to-date (#10140) 2026-01-29 10:49:03 -08:00
pnpm-workspace.yaml chore: ensure pnpm-workspace.yaml is up-to-date (#10140) 2026-01-29 10:49:03 -08:00
rbe.bzl fix: support remote arm64 builds, as well (#9018) 2026-01-10 18:41:08 -08:00
README.md docs: mention Codex app in README intro (#11926) 2026-02-16 17:35:05 +01:00
SECURITY.md docs: add codex security policy (#12193) 2026-02-19 09:12:59 -08:00

npm i -g @openai/codex
or brew install --cask codex

Codex CLI is a coding agent from OpenAI that runs locally on your computer.

Codex CLI splash


If you want Codex in your code editor (VS Code, Cursor, Windsurf), install in your IDE.
If you want the desktop app experience, run codex app or visit the Codex App page.
If you are looking for the cloud-based agent from OpenAI, Codex Web, go to chatgpt.com/codex.


Quickstart

Installing and running Codex CLI

Install globally with your preferred package manager:

# Install using npm
npm install -g @openai/codex
# Install using Homebrew
brew install --cask codex

Then simply run codex to get started.

You can also go to the latest GitHub Release and download the appropriate binary for your platform.

Each GitHub Release contains many executables, but in practice, you likely want one of these:

  • macOS
    • Apple Silicon/arm64: codex-aarch64-apple-darwin.tar.gz
    • x86_64 (older Mac hardware): codex-x86_64-apple-darwin.tar.gz
  • Linux
    • x86_64: codex-x86_64-unknown-linux-musl.tar.gz
    • arm64: codex-aarch64-unknown-linux-musl.tar.gz

Each archive contains a single entry with the platform baked into the name (e.g., codex-x86_64-unknown-linux-musl), so you likely want to rename it to codex after extracting it.

Using Codex with your ChatGPT plan

Run codex and select Sign in with ChatGPT. We recommend signing into your ChatGPT account to use Codex as part of your Plus, Pro, Team, Edu, or Enterprise plan. Learn more about what's included in your ChatGPT plan.

You can also use Codex with an API key, but this requires additional setup.

Docs

This repository is licensed under the Apache-2.0 License.