Setup and Login
Standardize Codex installation, updates, identity, and local developer setup.
Key takeaways
- Setup is the first governance layer; inconsistent install, login, and update habits cause team drift before any policy can help.
- Standardize five decisions: install path, authentication strategy, update cadence, shell support, and default repository trust.
- Use
@openai/codex@latestfor unmanaged local installs but pin@openai/codex@0.139.0in reproducible automation until the next review. - Distinguish shell
codex app <path>(opens Desktop from the shell) from slash/app(hands the active CLI thread into Desktop). - Treat plugin marketplace JSON output as the setup audit source of truth, and keep onboarding to one command block, one troubleshooting section, and a clear owner.
Setup is the first governance layer. If every developer installs, authenticates, and updates Codex differently, team behavior will drift before any policy can help.
Setup Decisions
| Area | Team standard |
|---|---|
| Install path | Decide CLI, app, IDE, or supported combination |
| Authentication | Define approved login and API key strategy |
| Update cadence | Choose automatic, scheduled, or pinned versions |
| Shell support | Standardize completions, aliases, and working directory rules |
| Repository trust | Define where Codex may read and write by default |
Baseline Checklist
- Codex version and install channel are documented.
- Current CLI baseline is
0.139.0from the 2026-06-09 Codex changelog. - Team members can reproduce the same local setup.
- Login method does not require sharing personal secrets.
- Local project instructions are visible from the repository root.
- New developers can run the standard verification command.
Current Setup Notes
- Use
@openai/codex@latestfor unmanaged local installs, but pin@openai/codex@0.139.0in reproducible automation until the next review. - Distinguish shell
codex app <path>from slash/app: the former opens Desktop from the shell, while the latter hands the active CLI thread into Desktop. - Include code-mode web search, MCP schema preservation, and
codex doctoreditor/pager diagnostics in upgrade reviews. - Re-check ChatGPT v2 personal access token handling, app-server account token usage, and remote-control grants in remote host runbooks.
- Treat plugin marketplace JSON output as the setup audit source of truth, not screenshots of the interactive
/pluginsUI.
Rollout Tip
Keep setup instructions short and executable. A long onboarding page that no one runs becomes a false control. Prefer one command block, one troubleshooting section, and a clear owner.