CodexFlowFLOW 7 / TECH
中文 GitHub

Local agent infrastructure / Flow7 Tech

One command.Every project.Any chat.

CodexFlow gives ChatGPT a serious local coding backend. Projects, live task and subagent progress, worktrees, Git, persistent terminals, native review, scheduled runs, Computer Use, and an annotatable ephemeral browser become available through one deliberate connection.

npm install -g https://github.com/tarunspandit/codexflow/releases/download/v0.50.2/tarunspandit-codexflow-0.50.2.tgz
See the path
  • 01No setup wizard
  • 02No Codex CLI execution
  • 03MIT licensed

Broker ready

Connection
Token protected
Projects
Auto-discovered
Sessions
Independently routed

The operating idea

The model stays on the web.
The work stays on your machine.

CodexFlow is the exact layer between the two: project-aware, inspectable, and bounded to the folder each conversation chooses.

01 / MODEL SURFACE

ChatGPT thinks and converses.

Your existing ChatGPT account supplies the model, reasoning, and conversation. When ChatGPT Work creates subagents, CodexFlow gives each one a private project route; it never starts or proxies the model.

02 / EXECUTION SURFACE

Your computer holds the truth.

Repository instructions, current files, git state, project skills, and bounded commands remain local until the active conversation requests them.

03 / CONNECTION LAYER

One broker keeps the relationship clear.

A single authenticated MCP endpoint serves many chats while preserving one private, durable project route for every conversation.

From zero to useful

Three movements.
No ceremony.

Install once. The bare command handles discovery, the broker, authentication, and the tunnel. Each new chat only chooses where it should work.

  1. 01

    Start

    Run codexflow.

    Recent projects are discovered, the local MCP broker starts, a private token is created, and a secure URL is prepared.

    $ codexflowready
  2. 02

    Connect

    Add the URL to ChatGPT once.

    Create a Developer Mode app, paste the generated Server URL, and choose no additional authentication—the token is already in the URL.

    Settings→Apps→Create
  3. 03

    Choose

    Bind the chat to a project.

    Pick inside the conversation or reply with an exact project name. Either path keeps files, git, edits, and commands routed there for that session.

    ~/DEV/atlas-web

Independent routing

One connection.
Separate working memory.

Every ChatGPT conversation owns its selected project. Change the active preview to see the same broker route a different task without crossing workspace boundaries.

01broker
∞chats
Nprojects
SESSION ROUTERLOCAL / READY
CHATGPT SESSION Polish onboarding conversation_01
CFtoken protected
SELECTED PROJECT atlas-web ~/DEV/atlas-web
›workspace bound · skills loaded · ready✓

The native desktop app

Your machine.
One clear surface.

CodexFlow opens as a native app on your Mac or Windows PC. Supervise routed web tasks, paired computers, nested Active/Done agents, plans, blockers, environments, worktrees, diffs, Computer Use, and website-origin approvals from one surface.

CodexFlow / NowLive on this computer
CURRENT RUN

Everything in motion.

Projects
Discovered
Environments
Shared
Chat routes
Independent
Terminal
Route-persistent
01 / LIVE PROGRESSTasks in motion
  1. Onboardingatlas-web
    2 agents · livechat-a40c97f2
  2. Auth refactorsignal-api
    reviewer · donechat-7eac13b8
  3. Release auditcodexflow
    git status · livechat-29d1f640

This is a representative native-app preview. The real desktop app reads only your authenticated local CodexFlow broker; this public website cannot see your projects or chats. The browser page remains a small recovery fallback.

The tool surface

Enough agency to work.
Enough structure to trust.

CodexFlow exposes a focused coding surface instead of an unbounded shell. The model gets the context and actions it needs, with each operation scoped to the chosen workspace.

01

Discover

Projects are already there.

Reads recent local project metadata and configured roots, then presents a clean picker in each new conversation.

AUTOMATIC
02

Understand

Repository context before action.

Loads AGENTS.md, maps files and symbols, locates tests, reads git state, and identifies likely impact before changing code.

PROJECT NATIVE
03

Change

Precise edits inside one root.

Search, read, write, edit, and apply guarded patches without exposing another project or wandering through the machine.

WORKSPACE SCOPED
04

Parallelize

One task, one managed checkout.

Creates isolated worktrees locally or on a paired CodexFlow machine, carries current changes in safely, and refuses to overwrite a destination that changed independently.

GUARDED HANDOFF
05

Coordinate

Every real child gets its own route.

When ChatGPT Work spawns subagents, the parent allocates independent project routes, children report only their own bounded state, and native Tasks mirrors Active and Done work without starting another model backend.

CHATGPT WORK / ROUTE ISOLATED
06

Verify

Git and terminal state that continue.

Stages and commits only the selected project, runs bounded verification, and keeps a private route terminal alive across tool transports.

PERSISTENT
07

Review

The diff belongs on your machine.

Separates staged and unstaged files, stages or reverts one hunk at a time, and carries line-anchored review notes into the web chat’s next change review.

NATIVE
08

Adapt

Your project environment travels too.

Uses the same checked-in Codex environment format for setup, cleanup, named actions, skills, plugins, and MCP inventory—without running Codex.

INTEROPERABLE
09

Schedule

Recurring work keeps its project.

Prepares durable ChatGPT Scheduled runs that reacquire a private route and use a clean managed worktree without adding another model backend.

CHATGPT NATIVE
10

Pair

One code reaches another machine.

Install CodexFlow, enter one short code, and its projects appear in the same picker with encrypted files, terminals, environments, analysis, worktrees, Git transfer, and verified synchronization—without another ChatGPT connector.

CLOUDFLARE RELAY / END-TO-END ENCRYPTED
11

Operate

Visual work still asks first.

Request one identity-bound native app from chat, approve it on this computer, inspect a fresh app-only window snapshot, and confirm each sensitive element-targeted action locally.

COMPUTER USE / CONSENTED
12

Browse

Review and debug the rendered page together.

Approve one website origin, inspect its semantic DOM, capture bounded console, resource, and source diagnostics, then leave exact-element comments for the web chat. Redirects, downloads, credentials, payload bodies, and sensitive actions stay out or ask locally.

WEBKIT + WEBVIEW2 / ROUTE PRIVATE

Power with edges

Local access should feel serious.

The connection is useful because its limits are explicit. The public route requires a generated token, every file operation is root-checked, secrets are redacted, and dangerous capabilities remain opt-in.

Read the security model
  1. 01
    Token-protected public URL

    Unauthenticated requests never reach the tool surface.

  2. 02
    Workspace root enforcement

    Path and symlink checks keep every operation in scope.

  3. 03
    Secret-aware output

    Credentials and common secret patterns are blocked or redacted.

  4. 04
    Guarded writes and terminal

    Safe defaults stay active until you deliberately widen them.

  5. 05
    Conflict-aware worktrees

    Handoffs fingerprint both checkouts before any destination state is replaced.

  6. 06
    Contained SSH project routing

    Concrete aliases and existing host-key trust are required; every call rechecks the destination, canonical project root, blocked paths, symlinks, and policy.

  7. 07
    Ephemeral browser isolation

    Each tab has a non-persistent WebKit or WebView2 profile. Actions bind to fresh snapshots; exact-element comments and query-free console/resource/source diagnostics stay bounded and private to their chat route.

Straight answers

Before you connect.

Does CodexFlow run the Codex CLI?

No. ChatGPT supplies the model and conversation. CodexFlow supplies the local project context and tool backend through MCP. It never starts, resumes, or impersonates a Codex session.

Do I register every project manually?

No. Running codexflow discovers recent project folders and configured roots automatically. Each conversation chooses one project for itself.

Can several chats work at once?

Yes. One broker and one tunnel can serve many conversations. Each chat gets a private route that survives separate tool transports and broker restarts.

Can one task use subagents?

Yes, when ChatGPT Work provides them. ChatGPT owns the child threads and model usage; CodexFlow gives each actual child an isolated project route, collects bounded status and results, and shows Active/Done state in the native app.

Can scheduled tasks use my local project?

Yes. ChatGPT Scheduled owns the model turn and cadence; CodexFlow prepares each run to reacquire the project, environment, and an optional clean worktree. Keep the computer and broker running.

Why is CodexFlow missing when I use Pro?

ChatGPT’s Pro model variants do not expose Apps. Use Extra High or another non-Pro model. Your Pro subscription is still supported.

Is this a quota or model proxy?

No. Requests still use your own ChatGPT account and its normal product limits. CodexFlow does not pool accounts, resell access, or bypass quotas.

What does installation require?

Node.js 20 or newer and ChatGPT Apps / Developer Mode access. The normal launcher includes Cloudflare quick tunnel support and also offers stable tunnel modes.

Your projects are already here

Meet them in the conversation.

Install once. Run from anywhere. Choose the workspace when the chat begins.

npm install -g https://github.com/tarunspandit/codexflow/releases/download/v0.50.2/tarunspandit-codexflow-0.50.2.tgz

Then run codexflow