Zhenyu98/codex-chatgpt-bridge

What it claims

This repository is a Codex skill plus PowerShell scripts. It drives DevSpace (@waishnav/devspace from npm), which it uses unmodified rather than forking, patching or proxying it. DevSpace owns the MCP server, OAuth, the file tools and run_shell. This repo adds two things: routing guidance for the agent, and an external lifecycle controller. The controller lets you close the public endpoint when idle without re-linking the ChatGPT app. It is released under the MIT License.

How it works

Routing. The router decides by marginal cost. Work goes to ChatGPT when it saves "far more Codex tokens than the cost of one slow bridge round-trip."

• In CHATGPT_ARCHITECT mode, ChatGPT can also act as the pool for parallel subagents. Codex stays the single orchestrator that integrates and verifies.
• By default, Codex applies every change.
• With an explicit L3 grant, ChatGPT writes over the bridge directly. Codex then reviews the diff, runs an independent check, and owns Git operations.

Lifecycle.

• The controller keeps a non-secret desired-state profile separate from runtime state, so "off on purpose" is recorded rather than guessed.
• Reboot and Restart are the same mutex-protected transaction: stop, start, refresh Worker KV, then verify the local, Quick Tunnel and Worker endpoints against a 200/401 health contract.
• Reboot refuses to reopen a bridge that was stopped with Off.
• Off keeps the app's authorization material. Only Rotate revokes tokens and mints a new Owner password.
• The stable-URL chain is: fixed ChatGPT app URL → Cloudflare Worker (upstream stored in KV) → rotating Quick Tunnel → local DevSpace.

Hardening details.

• The Cloudflare token is stored with DPAPI. The helper verifies an encrypt/decrypt round trip before saving and migrates away any plaintext cf-api.json. On and Reboot reject plaintext legacy credentials.
• A downloaded cloudflared binary must carry a valid Authenticode signature from Cloudflare, Inc.
• Public base URLs must be HTTPS, with no embedded credentials, query string or fragment.
• An unrelated process on the configured port is reported and left running; recovery fails instead of killing it.

How to use it

Windows/PowerShell only. Install the skill:

git clone https://github.com/Zhenyu98/codex-chatgpt-bridge.git
cd codex-chatgpt-bridge
powershell -ExecutionPolicy Bypass -File .\install.ps1

Installer flags:

• An existing install is moved to a timestamped backup automatically.
• -ForceOverwrite discards the installed copy instead.
• -RegisterRestartTask adds the optional Reboot task.

Install the upstream bridge, then check the environment (this starts no tunnel):

npm install -g @waishnav/devspace
$skill = "$env:USERPROFILE\.codex\skills\codex-chatgpt-bridge"
powershell -ExecutionPolicy Bypass -File "$skill\scripts\local_bridge.ps1" -Action Doctor

Set up a stable Worker:

$controller = "$skill\scripts\bridge_controller.ps1"
powershell -ExecutionPolicy Bypass -File $controller -Action Configure -ProjectRoot "D:\your\project" -Tunnel cloudflare-worker -PublicBaseUrl https://bridge.example.workers.dev -InstallCloudflared
powershell -ExecutionPolicy Bypass -File "$skill\scripts\set_cf_api_config.ps1" -Action Set -AccountId <account-id> -KvNamespaceId <namespace-id>
powershell -ExecutionPolicy Bypass -File $controller -Action On

Day-to-day operation:

• Use On, Off, Reboot, Status and Doctor on the controller.
• Avoid DevSpace's raw Start/Stop. They bypass the desired-state record and the health checks.
• -AllowedRoots "A;B;C" authorizes several roots, stored in profile schema v2. ProjectRoot must sit inside one of them.
• The scheduled task (restart_task.ps1 -Action Install|Run) has no automatic trigger and runs asynchronously. Check %LOCALAPPDATA%\devspace-bridge\controller-result.json and then run Doctor to confirm the result.

Limits

• The permission levels are not enforced. L0–L5 are policy that Codex asks ChatGPT to follow; the bridge does not enforce them.
• run_shell is not confined to the root. An authorized ChatGPT app effectively has code execution as your local user.
• Only three boundaries are enforced:
• OAuth approval with the Owner password (DevSpace).
• allowedRoots, which applies to file tools only (DevSpace).
• Reachability, closed via Off (this repo).
• The scheduled task is not a security boundary. It runs as the same interactive user, who must be logged on. Real isolation needs a separate least-privilege account with ACL-separated scripts, state, logs and credentials, or a VM.
• Some generated files hold sensitive details:
• worker-proxy.json holds the Worker URL and KV namespace ID; keep it out of git.
• Controller logs contain paths, PIDs and tunnel URLs; redact them before sharing.
• Shell-command logging is off by default. Set DEVSPACE_LOG_SHELL_COMMANDS=true if you need an audit trail.
• Broad roots are flagged. Doctor.securityWarnings flags drive roots, the user profile, and its ancestors.
• Raw Quick Tunnel URLs suit smoke tests only. They rotate on every restart, so a saved app needs a Worker or other stable proxy.
• No token-savings figures are given. The page publishes no measurements to back up its routing claims.