Use ChatGPT Web (including Pro) as native Codex models.
Change the model tier, save your workflow.
Troubleshooting · Security · Contributing
Free and Go accounts get ChatGPT Web — Luna in Codex's native model picker. Accounts that expose the reasoning selector keep Instant, Medium, High, Extra High, and Pro as their subscription allows. The bridge sends the current compiled Codex task context to a fresh ChatGPT Temporary Chat, attaches images, and streams visible reasoning, tool activity, and Markdown back into the same Codex task.
Codex task ──Responses + SSE──▶ codex-chatgpt-web ──embedded browser──▶ ChatGPT
▲ │ │
└──────── native UI, context, images, tracing, and tool lifecycle ──────┘
Codex keeps the native task, context lifecycle, UI, and tool harness. The local Responses bridge routes only the selected model task through a task-bound ChatGPT Temporary Chat; in full mode, MCP connects ChatGPT back to the tools of that same Codex task until its next compaction boundary.
Tip
I also built ChatGPT Persona Voice, a local app that changes the ChatGPT/Codex voice in near real time. It never touches your account, browser session, or ChatGPT requests, so using it carries no account-blocking risk. If you like my work, give it a try.
- Native Codex models. ChatGPT Web runs from Codex's model picker while the original task UI, context lifecycle, streaming, tracing, and tool presentation stay intact.
- The full Codex harness over MCP. Full mode gives every effort exposed by the signed-in account, including Pro, the active task's filesystem, shell, images, approvals, and configured tools/apps.
- Live turn control stays native. Public ChatGPT work/status rows stream into Codex's Working timeline, same-turn Codex steering stops the superseded response and continues in the same Temporary Chat when that surface is proven retained, and Codex Interrupt explicitly stops the launcher-owned ChatGPT generation before teardown.
- Continuous task sessions and native compaction. Sequential messages reuse one task-bound Temporary Chat. At the context boundary, the retained agent writes the checkpoint before Codex starts a clean chat; if that chat was closed, canonical Codex history supplies the fallback.
- One cross-platform launcher. The macOS, Windows, and Linux app owns sign-in, model setup, MCP guidance, health checks, safe diagnostics, and up to five visible task-bound browser tabs.
- Fail-closed behavior. Missing models, tools, or changed ChatGPT UI produce explicit errors instead of silently switching route or capability. End-to-end coverage is documented in release validation.
Temporary Chat is a ChatGPT privacy mode, not anonymity or local-only inference: prompts are still processed by OpenAI and are subject to the account's settings and OpenAI's Temporary Chat policy. This project is unofficial; users remain responsible for complying with applicable OpenAI terms and workspace policies.
Important
This fork's custom branch is the installation source of truth. Install from
aoistar-kr/codex-chatgpt-web@custom; do not substitute the upstream
miuuyy/codex-chatgpt-web release installer when you want the custom WebGPT implementation.
Requirements: Git, 64-bit Windows, and Bun 1.4.0.
git clone --branch custom --single-branch https://github.com/aoistar-kr/codex-chatgpt-web.git
Set-Location codex-chatgpt-web
bun install --frozen-lockfile
Push-Location launcher
bun install --frozen-lockfile
Pop-Location
bun run app:package
$Installer = Get-ChildItem .\launcher\artifacts\codex-web-gpt-*-win-x64.exe |
Sort-Object LastWriteTime -Descending |
Select-Object -First 1
if (-not $Installer) { throw "Windows installer was not produced" }
$Process = Start-Process -FilePath $Installer.FullName -ArgumentList "/S", "/currentuser" -Wait -PassThru
if ($Process.ExitCode -ne 0) { throw "Installer exited with code $($Process.ExitCode)" }For an existing clone, update only from this fork's custom branch before rebuilding:
git fetch origin custom
git switch custom
git pull --ff-only origin customQuit Codex Web GPT before reinstalling or updating the packaged app. The installer preserves the launcher-owned ChatGPT profile and launcher configuration.
Then complete the three checks in the app:
- Sign in directly in the launcher's embedded ChatGPT browser. Login pages and identity-provider windows stay inside the same launcher-owned private browser profile; no session is copied between browsers.
- Run the browser smoke test.
- Press Install models, restart Codex once, and select a ChatGPT Web — … model.
The launcher detects the current account's ChatGPT controls during setup: Free/Go accounts expose only Luna, while Pro appears only when the signed-in account exposes it. The separate MCP page is optional and guides the full-harness setup without terminal commands.
The packaged launcher keeps sign-in and ChatGPT model turns in its embedded browser. Once packaged, the installed app needs no model API key, installed Chrome/Chromium, system Node/Bun, or project-managed browser download. Bun is required only to build this fork from source.
git clone --branch custom --single-branch https://github.com/aoistar-kr/codex-chatgpt-web.git && \
cd codex-chatgpt-web && \
bun run appThis development path requires Bun 1.4.0. The command installs the locked root and launcher dependencies and opens the launcher in development mode; use the Windows installation procedure above when you want the packaged desktop app installed from the current custom source.
| Mode | Models | Local Codex tools | Extra setup |
|---|---|---|---|
| Browser-only | Free/Go: Luna; Plus: Instant–High; Pro: adds Extra High and Pro | No; Codex shows a warning | None |
| Full harness | Free/Go: Luna; Plus: Instant–High; Pro: adds Extra High and Pro | Yes for every listed effort, including Pro | OpenAI tunnel + ChatGPT connector |
Every picker entry has one fixed ChatGPT mode. Codex still displays its built-in Effort and Speed rows, but changing them cannot silently change the selected browser model. In Full mode every available effort receives the same turn-bound MCP capability. Pro has no separate restriction or reduced tool contract.
Full mode connects ChatGPT's tool calls back to the current Codex task through the official OpenAI tunnel-client. The tunnel is outbound: it does not expose a public IP, open an inbound port, or require router forwarding.
Warning
Create a new connector named Codex Native2 and set its permissions to Allow all actions. Do not rename, refresh, or reuse an older Codex Native connector: ChatGPT caches the public MCP contract by connector identity, and Allow low-risk actions blocks commands and patches before they reach the Codex harness.
- Finish the required launcher setup.
- Open MCP in the launcher. Create the Tunnel and a regular API key on the same OpenAI account that will use the ChatGPT connector; creating the key is free and does not consume model API credits.
- Paste the Tunnel ID and API key, then press Connect harness.
- Enable Developer Mode in ChatGPT settings. Create a new connector using Tunnel, select that exact Tunnel, set Authentication to None, and name it exactly Codex Native2.
- If an older Codex Native connector exists, leave it untouched. Do not rename or refresh it: ChatGPT caches the public MCP contract by connector identity, and this release uses a new direct turn-token contract. Under Permissions on Codex Native2, choose Allow all actions; Allow low-risk actions blocks commands and patches before they reach this runtime. The outer Codex harness still enforces its sandbox and approvals.
- Run Verify runtime. It selects Codex Native2 exactly. If only Codex Native is found, verification fails with an explicit migration error instead of accepting the legacy connector.
Write/modify actions also require the ChatGPT workspace and its administrator policy to permit
them. See
developer mode and MCP apps.
Unexpected approval prompts fail closed unless --auto-approve-tool-calls is explicitly enabled;
that option clicks Allow once, never a permanent grant.
Use Activity for safe local diagnostics and Settings → Run doctor for end-to-end health.
Settings can also cancel a retained browser turn or remove the Codex integration before uninstall.
Set CODEX_CHATGPT_WEB_BROWSER_DIAGNOSTICS=1 only when every browser checkpoint needs a screenshot.
The Temporary Chat network stream observer is enabled by default and can be disabled with
CODEX_CHATGPT_WEB_NETWORK_STREAM_SHADOW=0. Network-primary return is also enabled by default for
all selectable efforts (Instant, Medium, High, Extra High, and Pro) inside its non-Luna-checkpoint
eligibility boundary, so a definitive captured SSE answer can return without waiting for ChatGPT's
final DOM controls. Set CODEX_CHATGPT_WEB_NETWORK_STREAM_PRIMARY=0
as an explicit rollback kill switch.
Incomplete-capture recovery is enabled by default for its narrow eligible launcher-owned simple-turn
path. If an already-submitted turn loses only its observation transport, the worker may prove the exact
same committed turn, rebind once to the same launcher surface, and continue the existing Markdown
buffer without resubmitting the prompt. Set CODEX_CHATGPT_WEB_INCOMPLETE_CAPTURE_RECOVERY=0 as an
explicit rollback kill switch; failed proof remains fail-closed and never authorizes prompt replay.
With the authenticated launcher running, bun run smoke:stream:live performs one browser-only
Temporary Chat shadow turn and prints content-free timing metrics. Set
CODEX_CHATGPT_WEB_STREAM_CANARY_RUNS=3 to collect a small median sample. The canary's local state is
created under the operating-system temporary directory and removed after the run. Set
CODEX_CHATGPT_WEB_STREAM_CANARY_PRIMARY=1 to verify the opt-in network return path.
Set CODEX_CHATGPT_WEB_REQUEST_INJECTION_SHADOW=1 to passively inspect the browser-created
conversation request before any future placeholder rewrite is enabled. The shadow never changes the
request body and logs only content-free shape metadata: whether the body was supported JSON and how
many JSON string values exactly matched the submitted prompt. The live stream canary enables this
shadow unless CODEX_CHATGPT_WEB_STREAM_CANARY_REQUEST_SHADOW=0 is set.
Request-injection primary is enabled by default for eligible simple fresh turns. Codex writes a
one-use random placeholder into the normal ChatGPT composer, ChatGPT's own SPA builds and submits the
request, and the wrapper replaces exactly one matching JSON string value immediately before fetch.
For every selectable Sol/Pro effort the fresh-turn fast path also owns the exact web wire mode, so it
can skip the model/effort UI round trip: Instant uses gpt-5-6 with no thinking_effort; Medium,
High, and Extra High use gpt-5-6-thinking with standard, extended, and max; Pro uses
gpt-5-6-pro with standard. When Full mode already has a verified cached connector identity, the
same one-use rewrite can carry that connector metadata without reopening the @mention picker.
Unsupported body transports, malformed/non-object JSON, duplicate value matches, or raw JSON-literal
collisions are blocked before network transmission; the worker retries through the verified full DOM
prompt/model/connector path only after proving the blocked optimistic submission left no new
user/assistant turn. Multipart, image/file, retained-conversation, and compaction turns remain on the
DOM-safe path. Set CODEX_CHATGPT_WEB_REQUEST_INJECTION_PRIMARY=0 as an explicit rollback kill switch.
Use CODEX_CHATGPT_WEB_STREAM_CANARY_REQUEST_PRIMARY=1 for a live Temporary Chat canary.
New installs use Compatibility V1 for cross-backend subagents. Native preserves Codex's own feature settings and enables plaintext Web-to-Web V2 delegation. Restart Codex and start a new task after changing the protocol:
codex-chatgpt-web subagents status
codex-chatgpt-web subagents compatibility-v1
codex-chatgpt-web subagents native- This is unofficial browser automation, not an OpenAI API. ChatGPT UI changes can break selectors; drift fails explicitly instead of silently switching model or transport.
- Browser state is a sensitive login artifact, and the loopback listener is reachable by processes running as the same local user. Never share the launcher profile; use a trusted workstation.
- Release packages currently target macOS 13+ (arm64/x64), Windows x64, and Linux x64. Runtime, tests, and packaging are gated on all three in CI; account-bound browser and MCP flows use the separate release validation.
- Builds are not yet platform-signed, so Gatekeeper or SmartScreen may warn. The installers verify the published SHA-256 manifest before installation.
Read the complete architecture and security model before enabling full mode. Report vulnerabilities through SECURITY.md.
bun run app
bun run dev:launcher
bun run src/cli.ts dev status
bun run dev:chat compaction-lab "Reply with exactly: DEV READY"
bun run verify
bun run smoke:subagents
bun run app:packagedev:launcher starts a second launcher profile under ~/.codex-chatgpt-web-dev: separate Electron
state, browser cookies/login, ChatGPT account, configuration, sandboxed CODEX_HOME, chats,
diagnostics, broker, and tunnel profile. It can run beside the normal launcher and never starts a
Responses daemon or changes Codex. Optional Full setup starts and supervises only its isolated MCP
tunnel, using the distinct ChatGPT connector name Codex Native2 DEV.
dev:chat is a named, persistent synthetic outer-Codex harness. It executes the current working
tree through that isolated launcher browser, Temporary Chat, prompt compiler, Responses parser, and
compaction handlers. Optional Full setup also exercises the MCP connector and broker; tool effects
are explicit simulation receipts. Browser-only chats expose no outer tools. It does
not open a Responses listener, change openai_base_url, stop the live daemon, or claim port 17841.
Run it without a message for /status, /fill 30000, /compact, /model, and /reset commands.
Sign in and initialize the profile once inside the window labelled DEV. Configure optional Full
harness only for simulated tool rounds; its launcher keeps the DEV tunnel ready while named chats
attach their broker on demand. Production credentials and the Codex Native2 connector are never
reused implicitly. See
DEV chat harness.
This is independent software and is not affiliated with or endorsed by OpenAI. Use it only with your own account and in accordance with applicable Terms of Use and workspace policies; it does not bypass authentication or access controls.