一次事务切换完整状态Switch complete state in one transaction
settings、provider config、目录与指针共同提交，任一步失败都恢复完整上一代。Commit settings, provider config, catalogs, and pointers together, then restore the complete prior generation on failure.
Codex Minus
安全切换供应商，管理模型目录，不交出你的 OAuth 与 Context。 Switch providers and manage model catalogs without surrendering OAuth or Context.
arm64 + x64
macOS + Windows 双平台macOS + Windows dual platform
3
受保护的 Context 表protected Context tables
4
模型目录模式model catalog modes
AGPL
开源许可open-source license
把 Codex 管理缩到必要范围。Keep Codex management deliberately small.
保留供应商切换、模型目录、会话生命周期、配置诊断与签名校验的应用内更新。删除渲染注入、launcher 与市场。Keep provider switching, model catalogs, session lifecycle, diagnostics, and signed in-app updates. Remove injection, launchers, and marketplaces.
用 Codex 原生语义整理会话Manage sessions with native semantics
活动与归档分页、可恢复归档、首次预览确认，以及每 24 小时一次的安全检查。Paginated active and archived views, reversible archives, consent preview, and a safe daily check.
official + custom
官方列表保持完整Keep the official list intact
官方元数据、供应商证据和自定义模型分开管理。供应商遗漏不会隐藏官方条目。Manage official metadata, provider evidence, and custom models separately. Provider omissions never hide official entries.
写供应商与目录，不接管 OAuth。Write providers and catalogs. Leave OAuth official.
认证由官方客户端管理，Context 表先快照后回植，所有 live 写入共同回滚。The official client owns auth, Context tables are preserved, and every live write shares one rollback boundary.
OAuth 归官方所有Official client owns OAuth供应商 profile 不保存或回填认证，live
auth.json 保持只读。Provider profiles never persist or restore credentials, and live auth.json stays read-only.Context 失败即关闭Context protection fails closed快照、解析、回植或校验任一步失败，整条命令失败。The complete command fails if snapshot, parsing, grafting, or verification fails.
完整一代共同回滚Roll back one complete generationsettings、配置、目录、指针和重启状态保持同一个事务边界。Settings, config, catalogs, pointers, and restart state share one transaction boundary.
~/.codex/config.toml
# snapshot before provider write
[mcp_servers]
transport = "preserved"
[skills]
enabled = "preserved"
[plugins]
state = "preserved"
# grafted back verbatim
下载，校验，放进 Applications。Download, verify, move to Applications.
支持 macOS（Apple Silicon）和 Windows（x86_64）。更新由应用内完成：下载、验签、安装、重启一键走完；用户设置保留在独立目录。Supports macOS (Apple Silicon) and Windows (x86_64). Updates run in-app — download, signature check, install, relaunch — while user settings remain in a separate directory.
首次安装First install
前往 Release 页面，下载对应平台的最新版本。Go to the Release page and download the latest version for your platform.
shasum -a 256 -c SHA256SUMS
日常更新Updates左下角横幅一键「更新并重启」，或随时点「检查更新」。One click on the sidebar banner, or Check for updates any time.
Windows 安装Windows install运行 -setup.exe（NSIS）安装程序，按提示完成。Run the -setup.exe (NSIS) installer and follow the prompts.
设置保留Settings
~/.codex-session-delete/ 不会随覆盖安装删除。remains outside the app bundle.macOS 首次打开macOS first launch先用 Finder 把 app 拖入「应用程序」再启动（避免隔离导致更新报只读）；未公证，必要时在「隐私与安全性」选「仍要打开」。Drag the app into Applications with Finder before launching (quarantine otherwise breaks in-app updates); not notarized — use Open Anyway when required.
边界写在页面上。The boundaries are part of the product.
Codex Minus 宁可禁用不安全路径，也不假装已经解决。Codex Minus disables unsafe paths instead of pretending they are solved.
无 Intel 与签名No Intel build or signing
当前没有 Intel 构建、Developer ID 签名或 Apple 公证。There is no Intel build, Developer ID signature, or Apple notarization yet.
不实现本地协议代理No local protocol proxy
Chat Completions 与聚合供应商依赖已删除的上游 launcher，请勿使用。Chat Completions and aggregator profiles depend on the removed upstream launcher and should not be used.
文件型 OAuth 刷新File-backed OAuth refresh
官方目录刷新要求可读取的 ChatGPT 文件凭证，暂不支持 keyring-only。Official refresh requires readable ChatGPT file credentials and does not yet support keyring-only stores.
只管理你明确选择的部分。Manage only what you explicitly choose.
下载可校验的 macOS 或 Windows 应用，或直接阅读完整 AGPL 源码。Download the verifiable macOS or Windows app or inspect the complete AGPL source.