Codex adapter
Start with a conservative free local hard gate for Codex: read-only shell commands from a conservative allowlist; patch application, interpreters, chaining, redirection, and mutating commands are blocked by default. Upgrade to a paid path when you need governance through the Dexgate runtime for destructive actions, traces, and Passport-shaped evidence through the hosted runner / native approval-callback path.
Available free · controlled host coverage
Current availability
Free adapters: available now on npm
Paid governed workflows: early-access pilot
Coverage last validated: July 30, 2026
Validated free packages:
@dexgate/openclaw-trusted-mode@1.0.18,
@dexgate/codex-trusted-mode@0.1.16
See the compatibility matrix for coverage, limitations, and current versions.
Narrower host coverage than the OpenClaw free path. dexgate does not provide the Codex application. Readonly governance-gap results are a real host boundary when Codex does not expose a pre-execution readonly approval hook. Plain interactive codex (including Full Access / user-approved shell) is not the paid enforcement path—validate with codex-trusted-mode-run-turn, not a normal TUI session alone.
Free standalone posture (default allowlist)
- Allows read-only shell commands from a conservative allowlist only (for example read-oriented prefixes such as status/list/view-class commands).
- Allows lightweight non-mutating tools such as
functions.update_planandfunctions.view_imagewhen present. - Blocks by default:
functions.apply_patch, broad interpreters, shell chaining / control operators, redirection, and mutating commands such asgit commit/git push. - Free mode does not mint Action Passports and does not open patch or interpreter workflows “with constraints.”
Paid pilot / hosted runner
- Dexgate policy runtime authorization for destructive actions on the hosted runner / native approval-callback path (not plain interactive Codex Full Access).
config.tomladapter values are required for the runner/bridge; they do not intercept live interactive Codex CLI by themselves.- Governed trace output with stable reason codes and explicit governance-gap warnings.
- Readonly command execution is flagged when the current Codex build reports it only after completion.
- Same dexgate plan ladder as other adapters; maturity and evidence differ by runtime.