Codex app

One Connect command covers the Codex app, CLI, and IDE extension. Mechanics: Desktop reference.

1

Run Connect

anyray-connect --tools codex

It writes the provider into ~/.codex/config.toml, shared by all three, so plain codex routes through the gateway:

~/.codex/config.toml (written by anyray-connect)

model_provider = "anyray"

[model_providers.anyray]
name = "Anyray Gateway"
base_url = "https://gateway.example.com/v1"
wire_api = "responses"

2

Restart Codex

A running app, CLI session, or IDE window keeps its old config until restarted.

3

Verify

anyray-connect doctor --verify

Auth follows how your seat was enrolled:

Enrollment	How it authenticates	Billed as
API key	Codex sends your personal gateway key; the gateway uses the server-held provider key	api-key, full cost and savings, no seat fee
ChatGPT sign-in	Codex keeps its own ChatGPT login; the gateway passes it through	subscription seat

Requests hit POST /v1/responses. If a model picker omits custom-provider models, set ANYRAY_CODEX_MODEL to the model id and rerun Connect.

On a ChatGPT sign-in, the gateway relays Codex's requests to OpenAI unchanged and records each turn's usage, as skipped with the reason seat_passthrough. Your org's guardrails still run on it, and a redaction changes what is sent. Both lanes forward the bytes Codex wrote, so the part OpenAI cached stays cached.

• The gateway does not trim Codex's tool output on this lane.
• It loads the ChatGPT app connectors on demand instead of sending their schemas with every request. Set codexSeatAppsDefer to false to turn that off.
• A trace's declines name code_mode.opaque_kib when the script wrapped part of a command's output in a shape the gateway cannot read, so nothing could trim it.

When the gateway supports it, Connect also:

• sets supports_websockets = true, so Codex keeps one socket open to /v1/responses and sends only each turn's new input. Older gateways leave it off and Codex uses HTTPS.
• names the provider "OpenAI" instead of "Anyray Gateway". Codex then sends the same request it sends to OpenAI, so OpenAI's prompt cache misses far less often (no guarantee of identical cache reads). Older gateways keep the old name.

Tool-output trimming

Connect installs a Codex PreToolUse hook that runs bulky-output commands (test runs, searches, git log) through Connect, which trims the output before Codex sees it and keeps a full copy Codex can read back. Under the workspace-write sandbox the copy goes to your temp directory; under read-only there is nowhere to keep it, so the output is left whole. Codex runs the hook only after you review it once in Codex. There is no PostToolUse hook, because Codex can replace a finished result only by marking the tool as failed. Details: Codex source trims. Retrieval through anyray_retrieve still works.

Codex asks before every MCP tool call, and unattended codex exec fails the call instead. Connect pre-approves every Anyray tool Codex is offered, except one you already configured yourself. anyray-connect doctor flags a missing anyray_retrieve approval.

Turn it off

anyray-connect --revert --tools codex

This removes the Anyray route from config.toml and moves your Anyray-era threads to the provider Codex uses next, so they still open in Codex and the ChatGPT app. Quit Codex first. A thread it holds open is reported; run the command again to move it.