Codex is OpenAI’s coding agent that runs in your terminal, in your actual project folder, on your actual files. Not a chat window you copy out of — it reads the repo, writes to it, runs commands, and you approve or reject what it does.
This page is unusual for this class: it tells you the how. Not because the how matters, but because a broken install is a bad place to practice figuring things out. Getting it running is twenty minutes. What you do with it afterwards is the rest of the year.
Before you start
Know which machine you’re setting up, and stop if the answer is “the school one.”
| Mac | Follow the Mac path. You’ll install Apple’s command line tools first, for Git. |
| Windows 10 (build 19041+) or 11 | Follow the Windows path. You’ll install WSL first — that’s most of the work. |
| Chromebook / school-managed laptop | You probably can’t install this. Use a Codespace instead — see the bottom of the page. |
Codex itself has almost no prerequisites. It’s a single compiled program — no Node, no
Python, no npm install, no admin password. The installer needs curl and tar, which both
systems already have.
What you do need is Git and a copy of your repo on the machine, and that’s the part people get stuck on. Assignment 01 lived in a Codespace, so your code is on GitHub, not on your laptop. Codex reads the folder you launch it in — point it at an empty one and it has nothing to work with. Both paths below clone the repo first, deliberately.
Mac
Codex installed, signed in, and answering questions about your own repo.
-
Open Terminal (
⌘ Space, type “terminal”, Enter). -
Install Apple’s command line tools — this is what gives you
git:xcode-select --installA dialog box appears; click Install and wait. If it says the tools are already installed, good, move on.
-
Confirm Git works:
git --versionA version number means you’re set. A popup asking to install developer tools means step 2 didn’t finish.
-
Install Codex:
curl -fsSL https://chatgpt.com/codex/install.sh | shNo
sudo, and it won’t ask for your password — it installs to~/.local/bininside your own home folder. If you already use Homebrew,brew install --cask codexdoes the same job. -
Read the last two lines the installer printed. They tell you exactly what to do next — either
codexworks right now, or it saysPATH was added toa file and you need a fresh terminal. If in doubt, close the window and open a new one: the installer putcodexin~/.local/binand added that folder to yourPATH, and a shell that was already running never sees that change. -
Check it’s really there:
codex --versionA version number means installed.
command not foundmeans step 5 — or the PATH problem below. -
Get your repo onto the machine and move into it:
cd ~ git clone https://github.com/YOUR-NAME/YOUR-REPO.git cd YOUR-REPO -
Launch it:
codex -
Pick Sign in with ChatGPT. A browser tab opens, you log in, it hands the session back to the terminal. Same ChatGPT account as your plan.
-
Ask it something about the code that’s in front of it:
Read this repo and explain what it does, file by file. Don't change anything.
what that curl command actually does, and why you should be suspicious of it
curl -fsSL <url> | sh means: download a script and immediately run it, without reading it.
That is a real risk, and the instinct to distrust it is correct — it is exactly how people get
compromised.
What makes this one OK is where it comes from: chatgpt.com is OpenAI’s own domain, over
HTTPS, and it’s the command printed in their own documentation. The trust isn’t in the syntax,
it’s in the hostname. Change the hostname and the same command is an attack.
Want to see it first? Drop the pipe and read it:
curl -fsSL https://chatgpt.com/codex/install.sh | lessIt’s worth actually skimming. You’ll see it check for curl, tar and a checksum tool, verify
what it downloaded against a published hash, unpack into ~/.codex/, symlink a codex command
into ~/.local/bin, and append an export PATH=... line to your shell profile. Nothing hidden,
nothing needing root. That’s what a trustworthy installer looks like — which is exactly why you
should look before running one.
Windows
WSL2 installed, then Codex inside it — signed in and reading your repo.
OpenAI’s supported setup on Windows is through WSL2, and that’s what you should use. WSL is a real Linux system running inside Windows: same terminal, same commands, same everything as the Mac instructions above, on the machine you already own.
You need Windows 11, or Windows 10 build 19041 or newer. Winver in the Start menu tells you. The good news is the Ubuntu that WSL installs already includes Git and curl, so there’s no equivalent of the Mac’s command-line-tools step.
-
Open PowerShell as Administrator — Start menu, type “powershell”, right-click, Run as administrator.
-
Install WSL with Ubuntu:
wsl --installTwo things that go wrong here. If it prints a wall of help text instead of installing, WSL is already on the machine — run
wsl --install -d Ubuntuinstead. If the download hangs at 0.0%, runwsl --install --web-download -d Ubuntu. -
Restart your computer. Not optional, and not “later.”
-
After the reboot, Ubuntu opens on its own and asks you to create a username and password. This is a Linux account, separate from your Windows login. The password is invisible as you type it — no dots, no stars. That’s normal, keep typing.
-
From now on, everything happens in the Ubuntu terminal, not PowerShell. Find it in the Start menu as “Ubuntu”, or open Windows Terminal and pick Ubuntu from the tab dropdown.
-
Update the fresh system once. It’ll ask for the Linux password you just made:
sudo apt update && sudo apt upgrade -y -
Install Codex — the same command Mac users run, because you’re on Linux now. No
sudothis time:curl -fsSL https://chatgpt.com/codex/install.sh | sh -
Close the Ubuntu window, open a new one, and check:
codex --version -
Get your project into WSL. Clone it fresh inside Linux — don’t reach across to your Windows
C:drive:cd ~ git clone https://github.com/YOUR-NAME/YOUR-REPO.git cd YOUR-REPO codex -
Pick Sign in with ChatGPT. A browser opens on the Windows side and hands the session back to the Ubuntu terminal.
why cloning into Linux beats opening /mnt/c/Users/you/...
WSL can see your Windows drive at /mnt/c/, so working there looks like it should be fine.
It isn’t. Files on /mnt/c cross a translation layer on every read and write — file operations
are dramatically slower, file-watching breaks, and Windows and Linux disagree about line
endings and file permissions in ways that produce Git diffs where you changed nothing.
Keep Linux work in the Linux filesystem (~/, which is /home/yourname). Your repo lives on
GitHub anyway — cloning it twice costs you nothing, and that’s the whole argument for Git.
If that didn’t work — the other routes
There is no single correct installer. There are four, they all end with the same program on your machine, and if one is blocked or broken you switch. Try them in this order.
| Mac | Windows | |
|---|---|---|
| 1. Official installer | curl -fsSL https://chatgpt.com/codex/install.sh | sh | Same command, inside WSL |
| 2. Package manager | brew install --cask codex | npm install -g @openai/codex (needs Node) |
| 3. npm | npm install -g @openai/codex (needs Node) | — |
| 4. Native Windows | — | powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex" |
| 5. Manual binary | Download from GitHub Releases, unpack, rename to codex, put it somewhere on your PATH | Same |
do you need npm first? No — and here's why it looks like you would
Reasonable question, because npm install -g is how you install most command-line tools these
days. Not this one.
npm install -g @openai/codex genuinely works — but the package is a 12KB wrapper. The real
program is a compiled binary that npm pulls in as a platform-specific dependency, and it’s byte
for byte the same binary the curl installer downloads. npm isn’t building anything or adding
anything; it’s just a delivery van.
Which means installing Node and npm first doesn’t help the official installer at all — that one doesn’t use Node, doesn’t look for it, and doesn’t care whether it’s there. For a machine that doesn’t already have Node, going the npm route means installing an entire JavaScript runtime in order to download one file. That’s the only reason it’s not the headline instruction.
Use npm if you already have Node and you’d rather manage versions the way you manage your other global tools. It’s a completely legitimate choice, just not a shortcut.
Use the installer if you’re starting from a clean machine — which is most of you.
School network
Know whether the network is the problem before you blame the instructions.
This is a real possibility and worth checking first, because a filtered network produces errors that look like broken instructions. Codex needs to reach:
| Host | For |
|---|---|
chatgpt.com | the installer script, and the agent’s traffic |
releases.openai.com | the download (it falls back to github.com if that’s blocked) |
auth.openai.com | signing in |
api.openai.com | the model itself |
github.com | cloning your repo |
Test it in ten seconds, before installing anything:
curl -I https://chatgpt.com
curl -I https://auth.openai.com
Any response at all — even 403 or 404 — means you got through; that’s the server talking.
No response, a timeout, or a certificate error means the network stopped you. After
installing, codex doctor checks the same ground and reports it in English.
The workaround is a Codespace, and it’s a genuinely interesting one. In a Codespace the agent
isn’t running on the school network at all — it runs in Microsoft’s data centre, and that
machine talks to OpenAI. The only thing crossing the school firewall is your browser talking to
github.com. If GitHub is allowed and ChatGPT isn’t, that gap is the whole reason to work there.
Which is also the answer to “why do we use Codespaces in this class” — see the bottom of this page.
Failing that: install it at home, or on a phone hotspot. Once it’s installed and signed in, it still needs network to run — the model isn’t on your laptop.
Both: is it actually working?
Not “did it install.” Working.
Codex ships with a self-check. Run it from inside your repo:
codex doctor
It reports on your install, whether it can find Git, whether you’re authenticated, and whether
it can reach the network — with a ✓, ⚠ or ✗ on each. Read the failures; they’re written in
plain English and they tell you which of the steps above didn’t take.
Then the part doctor can’t check for you:
-
codexlaunches and shows you a prompt, in a folder that contains a real project. -
codex login statussays you’re signed in with ChatGPT — not with an API key. -
It has read your repo and explained it back to you, and the explanation was right. You are the one who can check that, which is the point.
-
It has made one change you asked for, and you read the diff line by line before accepting it.
Later on, codex update pulls down new versions — worth knowing, because this tool changes fast
enough that a guide written today will be slightly wrong by the time you read it. Including
this one.
When it breaks
Run codex doctor first — it names most of these for you.
| What you see | What’s actually wrong |
|---|---|
codex: command not found | You’re in the shell that was open before you installed. Open a new terminal. If it persists, ~/.local/bin isn’t on your PATH — that’s the thing to go read about. |
git: command not found, or a developer-tools popup (Mac) | Step 2 of the Mac path. Codex works without Git, but it works far better with it, and you can’t clone a repo without it. |
| It bills your API key instead of your plan | An OPENAI_API_KEY environment variable is set, and Codex prefers it over your ChatGPT login. Unset it, or codex logout and sign in again. |
| Browser opens, login never comes back | You’re in a container or a remote machine and the callback can’t reach you. See the Codespaces note below — same trap as Assignment 01. |
| Confidently wrong answers about your code | It only knows what it has read. Tell it what to read first. |
wsl --install does nothing (Windows) | Virtualization is off in your BIOS, or you weren’t running PowerShell as Administrator. |
| The installer times out, or a certificate error | The network, not the command. See School network above. |
git clone asks for a username and password | Cloning a public repo needs neither — so either the URL is wrong, or the repo is private and you need a token. GitHub stopped accepting account passwords here years ago; typing yours will fail no matter how right it is. |
Author identity unknown when something commits | Fresh machine, so Git doesn’t know who you are yet: git config --global user.name and user.email. |
I’m setting up the OpenAI Codex CLI on [Mac / Windows 11 with WSL2]. Here is exactly what I ran and exactly what came back:
[paste the command and the full error text, not a summary of it]
Don’t give me a list of five things to try. Tell me what this specific error means, what the most likely single cause is, how I can confirm that’s the cause before changing anything, and then the fix. If you’re guessing, say you’re guessing.
Understand it when you can answer
Installing something is not knowledge. These are.
| The thing | The question |
|---|---|
| The agent runs locally | What is Codex reading, and what is it sending to OpenAI? |
| WSL | What is it, and why isn’t it the same as a virtual machine or a dual boot? |
PATH | Why does a brand-new terminal find codex when the old one couldn’t? |
| Approval prompts | What could a coding agent do to your machine if you approved everything without looking? |
| Plan vs API key | Why is one a flat monthly fee and the other a number that can keep going up? |
.gitignore and ~/.codex/ | Your credentials are in a file on your disk. Which files must never reach a commit? |
Why doesn't the terminal find `codex` right after the installer says it succeeded? reveal
PATH is the list of folders your shell searches for commands, and it’s read when the shell
starts. The installer added a folder to that list — but your already-running shell is still
using the copy it loaded on launch. A new terminal reads the new list.
Codex just told you a function does X. How do you know it's true? reveal
You read the function. The agent is fast and confident and sometimes wrong, and confidence isn’t evidence. This is the same job as the Evaluate slot in a plan: you supply the standard, because the tool can’t.
What's the difference between this and pasting your code into chatgpt.com? reveal
Access and scope. Codex reads whole files across the project without you choosing them, and it can edit and run things. That’s more useful and more dangerous — which is why it asks first.
done when Codex is installed on your own machine, signed in with your plan, and it has explained your repo back to you correctly — and you rejected at least one thing it wanted to do, on purpose, because you read it.
On a Codespace instead
No paid plan, or a locked-down laptop? A Codespace is Linux, so the Mac commands work as-is —
run the curl installer in the Codespace terminal.
The sign-in is where it gets interesting, and it’s the same trap as the
Assignment 01 extra: the normal login hands
credentials back to a browser on localhost, and localhost inside a container is not your
laptop. So the link you’re given goes nowhere.
There are two ways out. One is to forward the port so the container’s localhost reaches your
browser. The other is a flag on codex login built for exactly this situation — machines
with no browser of their own. codex login --help lists it. Which one you use is up to you;
working out why the default fails is the part worth having.
The other thing to know: a new Codespace is a new machine, so your login is gone again. Figuring out where credentials live and how to stop re-doing this is the follow-up.
What this is for
The tool isn’t the point. Being able to hand work to something that will do it without you watching is the point, and that only works if you can say what you want and tell whether you got it.
Which is the same three boxes as always — Goal, Scaffold, Evaluate. A terminal agent makes the cost of skipping them obvious and immediate: vague goal, and it builds the wrong thing in four seconds instead of four days. No Evaluate, and it announces it’s finished and you have nothing to argue with.
Read this entire repository before answering anything.
Then tell me, in plain English: what this project is, how it’s structured, and the three things about it that would most confuse someone seeing it for the first time.
Then — don’t fix them — tell me what you’d change and why, and which of your suggestions you’re least confident about.