v0.1.4 — Executor Records, Tunnel DNS & Media Workflows / 执行者记录、隧道 DNS 与媒体工作流

Codex with ChatGPT v0.1.4

ChatGPT thinks. Codex works.

v0.1.4 is a correctness and docs update: execution records can name which agent ran an iteration; Quick Tunnel setup waits before the first health probe so fresh hostnames are not negatively cached; search truncation is reported accurately; Windows Named Tunnel credential gaps get clearer doctor diagnostics; ChatGPT can inspect workspace images safely; and install docs honor CODEX_HOME.

The core model remains unchanged: ChatGPT plans and reviews; Codex owns execution. No API key. No reverse proxy. No cookies or session extraction.

This release closes / includes:

• #412 — record which executor ran an iteration
• #416 — Quick Tunnel DNS negative-cache trap
• #448 — search truncation accuracy
• #446 — Windows Named Tunnel credential diagnostics
• #435 — safe read-only media workflows
• #434 — Web GPT / catalog support boundary docs
• #443 — honor CODEX_HOME in install paths

✨ Highlights

• Executor-aware execution records (#412)

  • Optional executor on execution records and c2c record --executor
  • Tool descriptions no longer hard-code Codex as the only runner

• Safer Quick Tunnel startup on aggressive DNS caches (#416)

  • Wait before the first /health probe so a fresh *.trycloudflare.com hostname is not negatively cached
  • Overridable via C2C_TUNNEL_HEALTH_INITIAL_DELAY_MS / C2C_TUNNEL_START_TIMEOUT_MS

• Accurate search truncation (#448)

  • Ripgrep and Node fallback no longer silently drop matches or mark exact-limit results as truncated

• Windows Named Tunnel credential diagnostics (#446)

  • Read-only doctor checks for missing / unreadable / mismatched tunnel credentials
  • Clear next steps without auto-restoring secrets

• Read-only media workflows (#435)

  • MCP read_image for workspace PNG/JPEG/GIF/WebP/SVG with containment and size bounds
  • Local c2c asset import for validated images/videos into a new workspace path
  • Connector stays read-only; import is an explicit local-executor action

• Docs: Web GPT catalog boundary (#434) and CODEX_HOME paths (#443)

🔐 Safety & correctness

• No new MCP write tools or reverse-proxy / cookie / session-extraction behavior
• Media import rejects path escapes, overwrites, signature mismatches, and active SVG
• Named Tunnel credential recovery remains a user-confirmed step

🙌 Contributors

Special thanks to:

• @terryhappyhome — #412 executor-neutral records
• @mitre88 — #416 Quick Tunnel DNS delay
• @UV26is — #448 search truncation
• @Oscar-Williams — #446 Named Tunnel credential diagnostics
• @TribalHouse — #435 media workflows
• @OrdoAbChao7 — #434 Web GPT support boundary
• @Kerwin-k — #443 CODEX_HOME docs

---

中文

这是 v0.1.4，重点是执行记录可标注执行者、Quick Tunnel 避免 DNS 负缓存误判、搜索截断标记更准、Windows Named Tunnel 凭据诊断更清楚、只读媒体检查/导入，以及文档对齐 CODEX_HOME。

核心理念仍然没变：

«ChatGPT 负责思考，Codex 负责干活。»

本版合入：

• #412 记录本次迭代由哪个执行者完成
• #416 Quick Tunnel 首次 health 前等待，避开负缓存
• #448 搜索截断报告更准确
• #446 Windows Named Tunnel 凭据缺失只读诊断
• #435 只读读图 + 本地安全导入
• #434 Web GPT / 目录边界说明
• #443 文档尊重 CODEX_HOME

感谢 @terryhappyhome、@mitre88、@UV26is、@Oscar-Williams、@TribalHouse、@OrdoAbChao7、@Kerwin-k 以及所有贡献者。❤️

最重要的一点仍然是：

能让 Agent 自己完成的事情，就不要让用户完成。

v0.1.3 — Connector Recovery, Hidden git_status & HTTP/2 / 连接器恢复、隐藏敏感路径与 HTTP/2

Codex with ChatGPT v0.1.3

ChatGPT thinks. Codex works.

v0.1.3 is a recovery and safety update: after a temporary address is replaced, ChatGPT is re-checked in the original conversation; pairing codes are no longer minted too early; git_status stops naming ignored files; and networks that drop idle QUIC can force HTTP/2.

The core model remains unchanged: ChatGPT plans and reviews; Codex owns execution. No API key. No reverse proxy. No cookies or session extraction.

This release closes / includes:

• #224 — stale ChatGPT thread after a reclaimed address
• #427 — doctor minting a pairing code too early
• #419 / #420 — INIT checkpoint before the message is visible
• #410 — git_status leaking ignored names (security half only)
• #426 — C2C_TUNNEL_PROTOCOL for cloudflared
• #418 / #422 — Windows background subprocess consoles still flashing

✨ Highlights

• Recover after a reclaimed Quick Tunnel address (#224)

  • After Delete + recreate of this workspace's connector, C2C re-checks workspace_info in the saved ChatGPT conversation
  • If that thread is still bound to the old connector, C2C opens a new Chat in the same Project and sends the existing HANDOFF
  • Never Reconnect when the public address has changed

• Pairing codes only when Authorize is on screen (#427)

  • c2c doctor no longer mints a pairing code when it only needs to report that the address changed
  • Codes still come from c2c pair --json (or c2c setup) once the Authorize / pairing form is visible
  • Expired codes from a doctor run will no longer race the user to the form

• Hidden names in git_status (#410)

  • Sensitive and .c2cignore'd paths are omitted from the file lists ChatGPT sees
  • Withheld entries are counted in hidden.changes / hidden.conflicts, so a merge is not reported as clean
  • Existing git_diff filtering is unchanged
  • The Windows Quick Tunnel timeout half of #410 was not merged

• INIT only after the message is visible (#419, #420)

  • A Project collection page that only shows Retry is treated as a navigation failure
  • C2C returns to the last working chat and opens the Project from there
  • The INIT checkpoint is written only after that message is visibly in the ChatGPT conversation
  • Computer Use is still forbidden; ChatGPT stays on the in-app browser
  • #420 was not squash-merged (it used Computer Use); the Skill on current main carries the same intent

• Optional HTTP/2 for cloudflared (#426)

  • On networks that drop idle QUIC, set C2C_TUNNEL_PROTOCOL=http2 and restart the bridge
  • Accepted values: auto, quic, http2 (case-insensitive)
  • Unset keeps cloudflared's default, so existing installs do not change
  • #426 was not squash-merged (it targeted another cloudflared tree); the env var is applied to the current spawn path

• Windows background probes no longer flash a console (#418, #422)

  • v0.1.2 hid long-running Bridge / tunnel processes; short-lived git / ripgrep / cloudflared probes still popped a window
  • #422 sets windowsHide: true on those background calls
  • Interactive login and foreground CLI paths are unchanged

🛠 Reliability & UX

• Troubleshooting now documents late pairing and the HTTP/2 transport switch
• Skill recovery after a reclaimed address no longer assumes the old ChatGPT thread is still bound to the new connector

🔐 Safety & correctness

• git_status no longer leaks ignored or sensitive filenames over MCP
• Hidden conflict counts stay separate so a withheld merge is not mistaken for a clean tree
• Doctor cannot burn a one-time pairing code before the user can type it
• No pairing-page, OAuth, or CSP changes
• No new MCP write tools or permissions
• No reverse proxy, cookie, session-extraction, or credential-sharing behavior was added

🧪 Tests

Regression coverage was expanded for:

• omitted sensitive paths in git_status
• git_status structured output including hidden
• C2C_TUNNEL_PROTOCOL parsing and --protocol spawn arguments
• Windows windowsHide on background git / ripgrep / cloudflared probes

175 tests passed, along with successful typecheck.

📚 Documentation

• Troubleshooting: do not mint a pairing code during c2c doctor
• Troubleshooting: C2C_TUNNEL_PROTOCOL=http2 on UDP-filtered networks
• README notes the HTTP/2 escape hatch next to the cloudflared requirement
• Skill: re-check workspace_info after recreate; Retry-only Project pages; persist INIT only when visible

🙌 Contributors

Thanks to everyone who reported issues, tested C2C across different environments, and contributed fixes or ideas.

Special thanks to:

• @ovobutican — #224 reclaim / stale-chat workspace_info
• @cawausokawaii — #427 late-mint pairing during recovery
• @joaodutra88 — #410 git_status leaking ignored names
• @aoyukkk — #419 / #420 Project navigation and INIT visibility
• @tindoantrong — #426 cloudflared transport environment variable
• @ll6071041-ship-it — #418 / #422 Windows background subprocess consoles

---

中文

这是 v0.1.3，重点是换地址之后还能接上、配对码不再提前作废、ChatGPT 看不见不该看见的文件名，以及公司网丢掉 QUIC 时可以改走 HTTP/2。

核心理念仍然没变：

«ChatGPT 负责思考，Codex 负责干活。»

本版关掉 / 收录：

• #224 临时地址换了，旧对话读不到仓库
• #427 doctor 提前发配对码
• #419 / #420 INIT 还没出现在对话里就写了 checkpoint
• #410 git_status 把忽略文件名漏给 ChatGPT（只收安全这一半）
• #426 C2C_TUNNEL_PROTOCOL
• #418 / #422 Windows 后台还在弹终端

这版重点

• 临时地址被换掉之后（#224）

  • Delete + 同名再建连接器后，先在原来的 Chat 里再验 workspace_info
  • 旧对话仍绑着失效状态：同一 Project 里新开 Chat，带上现有 HANDOFF
  • 地址换了不要点 Reconnect

• doctor 不再提前发配对码（#427）

  • 只提示「地址已更换，需要更新连接器」
  • 配对码仍在授权页出现后由 c2c pair --json（或 c2c setup）发放

• git_status 藏敏感路径（#410）

  • 忽略规则里的文件名不会出现在 ChatGPT 看到的列表里
  • 用 hidden.changes / hidden.conflicts 计数，合并冲突不会被报成干净
  • #410 的 Windows 隧道超时那一半没有合

• INIT 必须看得见再存档（#419、#420）

  • 合集页只有 Retry：当导航失败，回到旧对话点项目链接
  • 那条 INIT 出现在 ChatGPT 对话里之后才写 checkpoint
  • 仍然禁止 Computer Use，只用内置浏览器
  • #420 没有 squash 合（里面有 Computer Use），当前 Skill 收下了同一意图

• 可选 HTTP/2（#426）

  • 公司网丢掉空闲 QUIC 时设 C2C_TUNNEL_PROTOCOL=http2，再重启 Bridge
  • 不设则保持 cloudflared 默认
  • #426 没有 squash 合（对着另一份 cloudflared），环境变量加在现在的 spawn 上

• Windows 后台探测不再弹终端（#418、#422）

  • v0.1.2 只藏了长驻的 Bridge / 隧道；短时 git / ripgrep / cloudflared 还会闪一下
  • #422 给这些后台调用加了 windowsHide: true
  • 交互式登录和前台 CLI 没动

这次没有改配对页、OAuth、CSP，也没有扩大 MCP 权限。测试 175 条全过。

感谢 @ovobutican（#224）、@cawausokawaii（#427）、@joaodutra88（#410）、@aoyukkk（#419 / #420）、@tindoantrong（#426）、@ll6071041-ship-it（#418 / #422）以及所有提交 Issue、测试和贡献代码的人。❤️

最重要的一点仍然是：

能让 Agent 自己完成的事情，就不要让用户完成。

v0.1.2 — Structured MCP, Safer Tunnels & Windows Polish / 结构化 MCP、更可靠的隧道与 Windows 优化

Codex with ChatGPT v0.1.2

ChatGPT thinks. Codex works.

v0.1.2 is a reliability and interoperability update focused on making the bridge safer to start, quieter on Windows, and easier for MCP clients to consume correctly.

The core model remains unchanged: ChatGPT plans and reviews; Codex owns execution. No API key. No reverse proxy. No cookies or session extraction.

✨ Highlights

• Structured MCP outputs

  • Read-only MCP tools now advertise structured output schemas
  • Successful calls return matching "structuredContent" while keeping the existing text JSON content for compatibility
  • Workspace, file, search, Git, test status, execution summary, and execution output results are covered
  • This makes C2C easier and safer for MCP clients to consume without guessing response shapes

• Structured-output hardening

  • "c2c record" now validates numeric arguments before saving them
  • Execution records are validated on write
  • Malformed historical records are skipped safely on read instead of breaking otherwise read-only MCP calls
  • "test_status" and "execution_summary" now stay aligned with their advertised schemas
  • Workspace and package metadata returned by "workspace_info" are sanitized before entering structured output
  • "git_diff" documentation now uses the real pagination fields: "hasMore" and "nextOffset"

• Safer Windows Quick Tunnel startup

  • Quick Tunnel startup now fails closed instead of reporting success too early
  • Startup completes only after the public "/health" endpoint identifies a healthy C2C Bridge
  • Invalid or reserved "api.trycloudflare.com" URLs are rejected
  • Early "cloudflared" exits, invalid health responses, timeouts, and stopped startup are handled as failures
  • "C2C_CLOUDFLARED_PATH" can explicitly select a custom "cloudflared" executable

• A quieter Windows experience

  • Bridge daemon processes no longer open unnecessary console windows
  • Named Tunnel processes no longer flash console windows
  • Quick Tunnel processes are also hidden
  • C2C can now stay in the background without repeatedly popping terminal windows during normal Windows use

🛠 Reliability & UX

• "doctor" no longer assumes an inconclusive local bridge probe means the bridge process is dead
• If the process still exists, C2C will not start a second bridge or unnecessarily ask ChatGPT to delete the connector
• Quick Tunnel URL discovery and public-health verification are stricter
• Windows tunnel process handling is more predictable
• Several setup and troubleshooting wording issues were cleaned up

Idea for the bridge-probe reliability improvement from @AtlaxTech (#43).

Windows background-process improvements include contributions from @moonjun (#164).

🔐 Safety & correctness

• Structured MCP results now have explicit schemas instead of relying only on text conventions
• Malformed persisted execution data cannot silently violate the MCP output contract
• Invalid numeric execution metadata is rejected before persistence
• Unexpected values in ".c2c.json" and "package.json" are filtered before being exposed through "workspace_info"
• Quick Tunnel startup requires confirmation from the actual public C2C "/health" endpoint
• No new MCP permissions were introduced by these changes
• No reverse proxy, cookie, session-extraction, or credential-sharing behavior was added

🧪 Tests

Regression coverage was expanded for:

• structured MCP output schemas
• malformed persisted execution records
• invalid "c2c record" CLI arguments
• workspace metadata sanitization
• bridge runtime detection
• Windows Quick Tunnel startup and failure handling

The structured-output hardening follow-up reports 164 tests passed, along with successful typecheck, build, and "git diff --check".

📚 Documentation

• Fixed "login" / "log in" wording in the Skill and README
• Updated Quick Tunnel troubleshooting guidance
• Corrected "git_diff" pagination documentation to use "hasMore" / "nextOffset"
• Documentation now better reflects the stricter bridge and tunnel behavior

🙌 Contributors

Thanks to everyone who reported issues, tested C2C across different environments, and contributed fixes or ideas.

Special thanks to:

• @AtlaxTech — bridge-process diagnosis / reliability idea
• @moonjun — Windows background-process improvements
• @peak-xiong — structured MCP output schemas and hardening
• Contributors behind the documentation fixes and Windows tunnel testing

---

中文

这是 v0.1.2，重点是把 C2C 的稳定性、Windows 使用体验和 MCP 输出规范继续打磨扎实。

核心理念仍然没变：

«ChatGPT 负责思考，Codex 负责干活。»

这版重点

• MCP 正式加入 structured output schema

  • 只读 MCP 工具现在明确告诉客户端自己会返回什么格式
  • 同时保留原来的 JSON 文本输出，兼容已有使用方式
  • workspace、文件、搜索、Git、测试状态、execution summary / output 等结果都覆盖到了

• structured output 二次加固

  • "c2c record" 的数字输入会先检查再保存
  • execution record 写入前验证
  • 历史脏数据不会再把只读 MCP 工具直接搞崩，而是安全跳过
  • "test_status"、"execution_summary" 与 schema 保持一致
  • "workspace_info" 会过滤异常的项目配置和 package metadata
  • "git_diff" 分页说明修正为实际使用的 "hasMore" / "nextOffset"

• Windows Quick Tunnel 更可靠

  • 不再 tunnel 一启动就默认“成功”
  • 必须真正从公网 "/health" 确认这是正常运行的 C2C Bridge 才算启动完成
  • 拒绝错误的 "api.trycloudflare.com" 地址
  • cloudflared 提前退出、health 异常、启动超时等都会正确失败
  • 支持用 "C2C_CLOUDFLARED_PATH" 指定 cloudflared

• Windows 后台终于更安静

  • Bridge daemon 不再弹黑色控制台窗口
  • Named Tunnel 不再弹
  • Quick Tunnel 也不再弹
  • 正常使用 C2C 时后台进程不会疯狂闪终端窗口

• doctor 更聪明

  • 本地 probe 一时没有得到明确结果，不再直接认定 bridge 死了
  • 只要原进程还存在，就不会再启动第二个 bridge
  • 也不会因为一次模糊检测就让 ChatGPT 去删 connector

安全与正确性

这次没有扩大 MCP 权限，也没有加入 reverse proxy、cookie、session 提取之类的新行为。

主要是在原来的架构上继续收紧：

输入更严格、输出更确定、脏数据更难把系统搞崩、Tunnel 启动成功的判断更可信。

另外补了更多 regression tests；最新 structured-output 加固相关测试达到 164 tests passed。

感谢 @AtlaxTech、@moonjun、@peak-xiong 以及所有提交 Issue、测试 Windows / Tunnel 场景、修正文档和贡献代码的人。❤️

最重要的一点仍然是：

能让 Agent 自己完成的事情，就不要让用户完成。

v0.1.1 — Setup Choice, Checkpoints & Sanitized Output / 配置二选一、任务存档与受控输出

Codex with ChatGPT v0.1.1

ChatGPT thinks. Codex works.

This is a focused follow-up to the first public release. The collaboration model is unchanged: ChatGPT remains the planning and review brain; Codex keeps full ownership of execution. No API key. No reverse proxy. No cookies or session extraction.

✨ Highlights

• First-time setup is now a real choice

  • Before the first ChatGPT connection, C2C asks once: AI automated setup (preview) or guided manual setup
  • The choice is remembered on this machine and reused across workspaces
  • Automated setup still falls back to guided manual after two explicit failures of the same step (timeouts and waiting for login do not count)
  • Choosing manual starts hand-holding immediately — it no longer burns two slow automatic attempts first
  • Unanswered choice does not start ChatGPT configuration

• Developer mode is remembered

  • After C2C has confirmed ChatGPT developer mode is on, later setups skip the Security page
  • If creating a connector later requires developer mode, C2C opens that page, enables it, and remembers the result
  • A new computer asks / checks once; this is not bound to a single workspace

• Sanitized execution output for review

  • Codex may record test / build / lint / typecheck output after an iteration
  • A ninth read-only MCP tool, execution_output, lets ChatGPT list then read
  • A local sanitizer decides what ChatGPT may see: tokens and home paths are redacted; private-key blocks are withheld entirely; size is capped
  • Restricted items appear in the list with no body
  • Control messages still never paste logs
  • Older execution records without output remain valid

• Local checkpoints, not a new protocol state

  • Session files now store a short checkpoint (protocol position, waiting-for, goal, next step)
  • After a Codex restart, C2C resumes from the checkpoint instead of blindly sending INIT or re-running work
  • If the original ChatGPT chat is gone, C2C sends the existing HANDOFF — there is no STATE: RESUME
  • Checkpoint text is length-capped so it cannot become a log dump
  • Legacy sessions without a checkpoint keep the old loop

Idea for the review-output / resume diagnosis from @Jaymr1031-Z (#44). The shipped design is C2C’s own: local sanitizer, local checkpoint, existing HANDOFF.

🛠 Reliability & UX

• Portable Skill checkout path so installed copies are not tied to one machine layout
• Guided manual ChatGPT setup when automatic browser configuration fails twice at the same explicit step
• c2c prefs for machine-level setup choice and developer-mode memory (0600 state file, never stores tokens)
• c2c session set checkpoint flags (--protocol-state, --waiting-for, --goal, --clear-checkpoint)
• c2c record --command / --output-file for opt-in command output

🔐 Security hardening

• Execution output is nominated by Codex and gated locally — the model is not trusted to declare a log “safe”
• Private keys are refused as a whole; pairing-code-shaped strings, bearer tokens, and common secret prefixes are redacted
• Restricted output bodies are never written to disk and never returned over MCP
• execution_output is read-only and requires the existing execution.read scope
• Checkpoint fields are short protocol metadata only

📚 Documentation

• Protocol, architecture, security, and Skill docs cover checkpoints, execution_output, and the setup choice
• MCP tool count in the READMEs is now 9

⚠️ Platform note

The fully automated workflow currently targets environments where Codex has access to the ChatGPT in-app browser.

The underlying bridge contains cross-platform support, but combinations such as Linux + VS Code Codex extension are not yet guaranteed to support the complete browser-driven C2C workflow.

---

中文

这是 0.1.1，接在首个公开版后面的一次小版本更新。

核心理念没有变：

ChatGPT 负责思考，Codex 负责干活。

这版重点

• 首次连接 ChatGPT 前二选一：AI 自动化配置（预览版） 或 手动教学配置；选一次，这台机器沿用
• 选手动：一开始就手把手，不再先自动试两次
• 选自动：同一配置步骤明确失败两次后，仍会退回手动教学（超时、等登录不算失败）
• 确认开发人员模式已开启后记住，之后跳过 Security 页；换电脑再查一次
• 新增只读工具 execution_output：ChatGPT 可看 Codex 主动记下的测试/构建输出，本地脱敏，私钥整条拒绝
• 本地 checkpoint：Luna 重启可按存档续跑；原对话没了走现有 HANDOFF，没有 STATE: RESUME
• Skill 安装路径可移植；自动配置失败两次可转入手把手

#44 的问题诊断来自 @Jaymr1031-Z。落地实现是我们自己的优化版。

最重要的一点仍然是：

能让 Agent 自己完成的事情，就不要让用户完成。

感谢所有提交 Issue、测试不同环境、提出方案和贡献代码的人。❤️

v0.1.0 — First Public Release / 首个公开版本

Codex with ChatGPT v0.1.0

ChatGPT thinks. Codex works.

This is the first public release of Codex with ChatGPT — a collaboration layer that uses ChatGPT Web as the planning and review brain while Codex keeps full ownership of execution.

No API key. No reverse proxy. No cookies or session extraction.

Your repository stays local. ChatGPT reads only what it needs through an OAuth-protected, read-only MCP bridge, while Codex handles editing, shell commands, tests, Git, and recovery.

✨ Highlights

• ChatGPT ↔ Codex planning and review loop

  • Structured INIT → PLAN → EXECUTED → REVIEW → DONE workflow
  • ChatGPT independently inspects workspace state, diffs, tests, and execution summaries
  • Codex remains the only execution layer

• Read-only local workspace bridge

  • 8 read-only MCP tools for workspace inspection
  • Workspace-bound access control
  • OAuth 2.1 + PKCE
  • One-time pairing codes
  • Cloudflare-backed secure public connectivity

• One-paste, agent-driven setup

  • Environment detection
  • Automatic dependency installation
  • Build and Skill installation
  • Connector setup and pairing
  • Automatic diagnostics and repair
  • Users are only interrupted for things that genuinely require them, such as login, CAPTCHA, or 2FA

• Automatic updates

  • Installed Skills check for updates once per day
  • Codex can pull, rebuild, reinstall, restart, and continue the original task automatically
  • Manual update is always available by saying “Update Codex with ChatGPT”

🧠 Workspace & conversation improvements

• One ChatGPT connector per workspace
• Existing workspaces can preserve their long-running C2C conversation
• New workspaces can be organized into a dedicated ChatGPT Project
• New Codex sessions create their own chats inside the workspace Project
• C2C verifies workspace_info before accepting a new conversation binding
• New conversations are explicitly kept in Chat mode
• Multiple workspaces can remain isolated from one another

Special thanks to @AtlaxTech for the workspace → ChatGPT Project → session chat proposal that helped shape the new conversation model.

🛠 Reliability & UX

A large part of this release is about making C2C something users don't have to babysit.

• Added a doctor gate before entering the ChatGPT workflow
• Automatically repairs stale temporary public addresses
• Recreates dead ChatGPT connectors instead of attempting to reconnect to an expired address
• Keeps and reuses a single in-app ChatGPT tab
• Replaced long browser waits with short DOM checks so slow ChatGPT responses are not treated as failures
• Automatically allowlists the C2C state directory in the Codex sandbox
• Added optional stable Cloudflare hostnames so connectors can survive restarts
• Added update-first troubleshooting guidance for fast recovery from newly fixed issues

🔐 Security hardening

This release also contains several community-driven security improvements.

• Sensitive-file filtering is shared across MCP reads and Git diffs
• Directory-scoped diffs can no longer accidentally expose nested sensitive files
• Rename/copy provenance is checked before exposing Git patches
• Sensitive paths remain protected even when files move across directory boundaries
• Literal Git pathspecs prevent pathspec interpretation issues
• Diff execution uses bounded batching and fails closed on errors
• OAuth pairing-page dynamic content is HTML-escaped
• Added CSP, frame, content-type, referrer, and cache protections to OAuth HTML
• Fixed HTTPS OAuth callback navigation after pairing-page CSP hardening
• Expanded regression coverage around workspace boundaries, OAuth, sensitive files, and MCP behavior

Thanks to:

• @rtxmythically — sensitive-file protection for scoped diffs (#3)
• @catball912 — unified sensitive-file policy and rename provenance protection (#12)
• @SetraTheXX — OAuth pairing-page hardening (#26)

🪟 Compatibility fixes

• Fixed fresh installation and test behavior on Windows
• Fixed Windows dynamic ESM imports using file URLs
• Improved Windows sandbox/path normalization
• Fixed recursive Node fallback globs such as **/*.ts so workspace-root files are included
• Improved behavior on systems where symlink creation is unavailable

Thanks to:

• @EdisonJwa — Windows compatibility (#15)
• @vetrovk — recursive glob fallback fix (#20)

📚 Documentation

• Bilingual English / Simplified Chinese onboarding
• One-paste installation prompt for non-technical users
• Architecture, protocol, security, and troubleshooting documentation
• Update-first troubleshooting notice
• Installation philosophy: if the agent can safely do it, the user shouldn't have to

⚠️ Platform note

The fully automated workflow currently targets environments where Codex has access to the ChatGPT in-app browser.

The underlying bridge contains cross-platform support, but combinations such as Linux + VS Code Codex extension are not yet guaranteed to support the complete browser-driven C2C workflow.

---

中文

这是 Codex with ChatGPT 的第一个公开 Release。

核心理念没有变：

ChatGPT 负责思考，Codex 负责干活。

ChatGPT 负责理解需求、规划、Review 和 Debug 策略；Codex 保留完整执行权，负责修改代码、Shell、Git、测试和修复。

仓库不会被整体上传。ChatGPT 通过受 OAuth 保护的只读 MCP Bridge，只读取当前任务真正需要的工作区内容。

这版重点

• ChatGPT ↔ Codex 完整规划与审查闭环
• 只读 MCP Workspace Bridge
• OAuth 2.1 + PKCE + 一次性配对码
• 一段 Prompt 自动安装和配置
• 自动检测依赖、自动修复、自动更新、自动重启
• 每个 Workspace 独立 Connector
• ChatGPT Project + Session Chat 会话组织
• 可选固定 Cloudflare 域名
• Windows 兼容性改进
• Git Diff / 敏感文件 / OAuth 安全加固
• Browser workflow 稳定性改进
• 更完善的回归测试与故障恢复逻辑

最重要的一点：

能让 Agent 自己完成的事情，就不要让用户完成。

用户只需要表达自己想做什么；其余配置、检查、安装、修复和更新，应该尽可能由 Agent 自己处理。

感谢所有提交 Issue、测试不同环境、提出方案和贡献代码的人。❤️

This is only the beginning.