Install ChatGPT Codex

Confirm the product and access

Open the linked official source. Verify the product name Codex, your OS/architecture, and the account option available to you. Record the path you will use before installing.

Expected: The product, platform and eligible sign-in route are recorded; no plan upgrade is required by this course.

Set up the practice folder

Download the resource ZIP at the top of this Build. Extract it into a new folder you own (for example C:\BBBPractice on Windows, or ~/bbb-practice on macOS/Linux). Open a terminal in the extracted folder. Run the version command for your platform. All subsequent commands assume this folder.

Expected: Python reports version 3.10 or newer and the terminal is in the extracted resource folder.

windows

python --version
Get-Location
Get-ChildItem

macos

python3 --version
pwd
ls

linux

python3 --version
pwd
ls

Check installation prerequisites

For an npm route, install a current Node.js LTS from nodejs.org first. Run node --version and npm --version. The optional npm installation route needs Node.js; use the native installer below when you do not have Node. For a native installer, verify the shell and curl (macOS/Linux), and check the official platform prerequisites. Do not run a macOS/Linux script directly in native PowerShell.

Expected: The required runtime and shell are available; the directory is the extracted practice workspace.

windows

node --version
npm.cmd --version
Get-Location

macos

node --version
npm --version
pwd
command -v curl

linux

node --version
npm --version
pwd
command -v curl

Install Codex

Inspect the installer source or package publisher on the official page, then execute the command card for your platform. Reopen the terminal if PATH changed. Save the version output; do not run elevated npm unless the official package specifically requires it.

Expected: The codex version command exits successfully and prints a version.

windows

# Official native installer; inspect the downloaded script before running it.
powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"
codex --version

macos

npm install -g @openai/codex@latest
codex --version

linux

npm install -g @openai/codex@latest
codex --version

Complete the account sign-in

Run codex in the practice folder. Choose Sign in with ChatGPT and finish the browser flow yourself. Confirm the account and available model in /status. Do not paste tokens into a project.

Expected: The CLI is authenticated to your own account and accepts an interactive prompt; no credential is stored in the practice files.

windows

codex.cmd

macos

codex

linux

codex

Verify the rules are read

Open AGENTS.md in the resource folder and replace the workspace sentence with your real path. Start codex there. Ask the agent to list its rules, summarize app.py and say which files it may modify.

Expected: The agent names AGENTS.md, the practice path, the bounded scope and the verification command.

all

Read AGENTS.md and app.py. Summarize your permitted workspace, prohibited actions and the verification command. Do not change anything.

Delegate one small change

Ask Codex to add a docstring to total in app.py, keeping behavior unchanged. Require the agent to run verify.py and show the minimal diff. Review that only app.py changed, then run the command independently.

Expected: VERIFY PASS covers empty, ordinary, signed and repeated inputs; only the requested docstring changed.

windows

python verify.py

macos

python3 verify.py

linux

python3 verify.py

Inspect configuration and approval modes

Run the diagnostic command, then the CLI’s --help. Record the rules/settings locations and approval mode available in this installed version. Keep the ordinary permission prompts. For Codex, inspect --sandbox and --ask-for-approval in the installed help; do not assume another tool’s flags apply.

Expected: The effective configuration and permission mode are recorded; unexpected writes need review.

windows

codex.cmd doctor
codex.cmd --help

macos

codex doctor
codex --help

linux

codex doctor
codex --help

Run a read-only scripted task

Inspect --help for the headless command. Use the card to request only an explanation of app.py. Save stdout and the exit code. Headless mode still consumes provider usage and must not be treated as a free sandbox.

Expected: The output accurately describes sum(items), the process exits 0, and app.py is unchanged.

windows

codex exec "Read app.py and explain total. Do not edit files or run commands."

macos

codex exec "Read app.py and explain total. Do not edit files or run commands."

linux

codex exec "Read app.py and explain total. Do not edit files or run commands."

Plan one connector without granting access

Inspect the CLI’s help/configuration for MCP or tool extensions. Write the name of one needed tool, the exact directory/data it would expose, and the permission needed. Add no server until you review that scope. Codex users inspect current MCP/multi-directory help instead of assuming older --mcp-config flags still exist.

Expected: One connector plan contains purpose, scoped data, permissions, verification and a removal plan.

Record a reproducible incident

Use incident-template.md to document one real or deliberately introduced missing-file error in the practice project. Ask the agent to diagnose from the exact command, path and error, then repair only the practice input and rerun verification.

Expected: The incident contains the failure, one supported diagnosis, smallest fix and VERIFY PASS after recovery.

windows

python verify.py

macos

python3 verify.py

linux

python3 verify.py

Write a repeatable onboarding checklist

Fill onboarding-checklist.md for Codex. Rules: AGENTS.md. Memory/settings: ~/.codex (Windows: %USERPROFILE%\.codex). Guard: ~/.codex/hooks.json; review/trust changes in /hooks when supported by the installed version. Record permissions, backup schedule, restore and final verification. Record the active sandbox and approval settings separately. read-only restricts writes; workspace-write permits scoped project writes; danger-full-access removes that sandbox boundary. This BBB fleet uses danger-full-access by explicit user decision, one active user-folder PreToolUse guard, and independent backups. This is fleet policy, not an installer default. A prompt rule alone cannot enforce protection. The September 29 fleet incident found Windows Schannel TLS failures in sandboxed ODBC/sqlcmd/curl.exe while Python/OpenSSL HTTPS worked; do not assume your current version reproduces that historical failure. Diagnose the exact command, runtime, mode and redacted error before changing access. Optional execpolicy allow rules must pin the interpreter, script and identity, never a blanket python prefix. Do not enable unsupervised full-access jobs until the real workflow, active guard and recovery path are checked.

Expected: The checklist contains a concrete path and owner for rules, memory, permissions, guard, backup, restore and final verification.

Demonstrate the variable-path limit safely

Run workspace_guard.py --self-test. Read the source: the target is resolved before deciding. The variable_target case points at the home folder but performs no filesystem operation. Compare this with a hook that sees only command text.

Expected: GUARD PASS reports inside allowed and profile, outside, variable-derived profile and workspace root denied; no deletion was executed.

windows

python workspace_guard.py --self-test

macos

python3 workspace_guard.py --self-test

linux

python3 workspace_guard.py --self-test

Verify the actual protection in your tool

For CLI tools, open the hook/permissions screen and confirm the configured guard is active. Use your tool’s documented pre-command hook protocol; inspect workspace_guard.py from the resource pack; it is a demonstration, not an installed CLI hook. Run a harmless directory listing, then a guard dry-run targeting the profile. Do not execute a destructive profile probe. If you use a hosted agent, do not assume a local shell hook protects its remote computer: use project-only tasks and reviewed actions, with backups. If no agent is used in this course, record the demonstration only. A hook is active only after a real tool-specific refusal test; otherwise record NOT INSTALLED with the reason.

Expected: A harmless command runs, the guard dry-run returns DENY, and the checklist records the actual hook protocol and active state or the Grok Bot limitation.

windows

python workspace_guard.py --self-test
python workspace_guard.py --target "$env:USERPROFILE"

macos

python3 workspace_guard.py --self-test
python3 workspace_guard.py --target "$HOME"

linux

python3 workspace_guard.py --self-test
python3 workspace_guard.py --target "$HOME"

Enable a real backup of memory and project files

Connect a second backup drive. Windows: configure System Protection as additional recovery and use a scheduled copy/File History that explicitly includes hidden agent folders. macOS: configure Time Machine and verify dot folders are included. Linux: use a home backup such as restic/Deja Dup; Timeshift omits /home by default. Download the copy-only profile backup script for your platform, inspect it, and adapt the folder list to your tool. Record the last successful scheduled run; protect backup access because it may contain credentials. On Windows, review the script, unblock only that downloaded file, then run it with the shown process-only RemoteSigned policy. Group Policy can still refuse it; report that limitation without changing machine policy.

Expected: A backup on another drive includes the tool’s user settings and memory folder and this project, and a successful schedule/time is recorded.

windows

# Read the extracted script before unblocking this single file.
Get-Content .\profile-backup.ps1
Unblock-File -LiteralPath .\profile-backup.ps1
powershell.exe -NoProfile -ExecutionPolicy RemoteSigned -File .\profile-backup.ps1 -Destination D:\Backups\llm-profiles

macos

bash profile-backup.sh /Volumes/YourBackup/llm-profiles

linux

bash profile-backup.sh /media/YourBackup/llm-profiles

Practice a hash-verified restore

Run restore_drill.py with a separate backup directory. The script creates a new proof file, copies it, restores a second copy, and compares SHA256 hashes. Then restore one non-secret file from your actual agent memory backup into a separate scratch directory and open it; do not overwrite the live profile.

Expected: RESTORE PASS contains matching hashes; the actual memory file is readable after restoration into scratch.

windows

python restore_drill.py --backup-root D:\Backups\bbb-practice --work-root practice

macos

python3 restore_drill.py --backup-root /Volumes/YourBackup/bbb-practice --work-root practice

linux

python3 restore_drill.py --backup-root /media/YourBackup/bbb-practice --work-root practice

Restart from the right directory

Close the CLI normally. Reopen a terminal in this extracted folder. Run codex resume (or start a new session if the installed help lists a different continuation option). Ask it to reread AGENTS.md and summarize the last verification. Run verify.py independently again.

Expected: The correct workspace/rules are active after restart and VERIFY PASS is reproducible.

windows

codex resume
# After returning to your terminal:
python verify.py

macos

codex resume
# After returning to your terminal:
python3 verify.py

linux

codex resume
# After returning to your terminal:
python3 verify.py