aiclass
~/aiclass/assignments/04-codex-cli

curl -fsSL chatgpt.com/codex/install.sh | sh

Codex in Your Terminal

· ~40 min

contents · 10 sections
  1. Before you start
  2. Mac
  3. Windows
  4. If that didn’t work — the other routes
  5. School network
  6. Both: is it actually working?
  7. When it breaks
  8. Understand it when you can answer
  9. On a Codespace instead
  10. What this is for

Codex is OpenAI’s coding agent that runs in your terminal, in your actual project folder, on your actual files. Not a chat window you copy out of — it reads the repo, writes to it, runs commands, and you approve or reject what it does.

This page is unusual for this class: it tells you the how. Not because the how matters, but because a broken install is a bad place to practice figuring things out. Getting it running is twenty minutes. What you do with it afterwards is the rest of the year.

Before you start

Know which machine you’re setting up, and stop if the answer is “the school one.”

MacFollow the Mac path. You’ll install Apple’s command line tools first, for Git.
Windows 10 (build 19041+) or 11Follow the Windows path. You’ll install WSL first — that’s most of the work.
Chromebook / school-managed laptopYou probably can’t install this. Use a Codespace instead — see the bottom of the page.

Codex itself has almost no prerequisites. It’s a single compiled program — no Node, no Python, no npm install, no admin password. The installer needs curl and tar, which both systems already have.

What you do need is Git and a copy of your repo on the machine, and that’s the part people get stuck on. Assignment 01 lived in a Codespace, so your code is on GitHub, not on your laptop. Codex reads the folder you launch it in — point it at an empty one and it has nothing to work with. Both paths below clone the repo first, deliberately.


Mac

Codex installed, signed in, and answering questions about your own repo.

  1. Open Terminal (⌘ Space, type “terminal”, Enter).

  2. Install Apple’s command line tools — this is what gives you git:

    xcode-select --install

    A dialog box appears; click Install and wait. If it says the tools are already installed, good, move on.

  3. Confirm Git works:

    git --version

    A version number means you’re set. A popup asking to install developer tools means step 2 didn’t finish.

  4. Install Codex:

    curl -fsSL https://chatgpt.com/codex/install.sh | sh

    No sudo, and it won’t ask for your password — it installs to ~/.local/bin inside your own home folder. If you already use Homebrew, brew install --cask codex does the same job.

  5. Read the last two lines the installer printed. They tell you exactly what to do next — either codex works right now, or it says PATH was added to a file and you need a fresh terminal. If in doubt, close the window and open a new one: the installer put codex in ~/.local/bin and added that folder to your PATH, and a shell that was already running never sees that change.

  6. Check it’s really there:

    codex --version

    A version number means installed. command not found means step 5 — or the PATH problem below.

  7. Get your repo onto the machine and move into it:

    cd ~
    git clone https://github.com/YOUR-NAME/YOUR-REPO.git
    cd YOUR-REPO
  8. Launch it:

    codex
  9. Pick Sign in with ChatGPT. A browser tab opens, you log in, it hands the session back to the terminal. Same ChatGPT account as your plan.

  10. Ask it something about the code that’s in front of it:

    Read this repo and explain what it does, file by file. Don't change anything.
what that curl command actually does, and why you should be suspicious of it

curl -fsSL <url> | sh means: download a script and immediately run it, without reading it. That is a real risk, and the instinct to distrust it is correct — it is exactly how people get compromised.

What makes this one OK is where it comes from: chatgpt.com is OpenAI’s own domain, over HTTPS, and it’s the command printed in their own documentation. The trust isn’t in the syntax, it’s in the hostname. Change the hostname and the same command is an attack.

Want to see it first? Drop the pipe and read it:

curl -fsSL https://chatgpt.com/codex/install.sh | less

It’s worth actually skimming. You’ll see it check for curl, tar and a checksum tool, verify what it downloaded against a published hash, unpack into ~/.codex/, symlink a codex command into ~/.local/bin, and append an export PATH=... line to your shell profile. Nothing hidden, nothing needing root. That’s what a trustworthy installer looks like — which is exactly why you should look before running one.


Windows

WSL2 installed, then Codex inside it — signed in and reading your repo.

OpenAI’s supported setup on Windows is through WSL2, and that’s what you should use. WSL is a real Linux system running inside Windows: same terminal, same commands, same everything as the Mac instructions above, on the machine you already own.

You need Windows 11, or Windows 10 build 19041 or newer. Winver in the Start menu tells you. The good news is the Ubuntu that WSL installs already includes Git and curl, so there’s no equivalent of the Mac’s command-line-tools step.

  1. Open PowerShell as Administrator — Start menu, type “powershell”, right-click, Run as administrator.

  2. Install WSL with Ubuntu:

    wsl --install

    Two things that go wrong here. If it prints a wall of help text instead of installing, WSL is already on the machine — run wsl --install -d Ubuntu instead. If the download hangs at 0.0%, run wsl --install --web-download -d Ubuntu.

  3. Restart your computer. Not optional, and not “later.”

  4. After the reboot, Ubuntu opens on its own and asks you to create a username and password. This is a Linux account, separate from your Windows login. The password is invisible as you type it — no dots, no stars. That’s normal, keep typing.

  5. From now on, everything happens in the Ubuntu terminal, not PowerShell. Find it in the Start menu as “Ubuntu”, or open Windows Terminal and pick Ubuntu from the tab dropdown.

  6. Update the fresh system once. It’ll ask for the Linux password you just made:

    sudo apt update && sudo apt upgrade -y
  7. Install Codex — the same command Mac users run, because you’re on Linux now. No sudo this time:

    curl -fsSL https://chatgpt.com/codex/install.sh | sh
  8. Close the Ubuntu window, open a new one, and check:

    codex --version
  9. Get your project into WSL. Clone it fresh inside Linux — don’t reach across to your Windows C: drive:

    cd ~
    git clone https://github.com/YOUR-NAME/YOUR-REPO.git
    cd YOUR-REPO
    codex
  10. Pick Sign in with ChatGPT. A browser opens on the Windows side and hands the session back to the Ubuntu terminal.

why cloning into Linux beats opening /mnt/c/Users/you/...

WSL can see your Windows drive at /mnt/c/, so working there looks like it should be fine. It isn’t. Files on /mnt/c cross a translation layer on every read and write — file operations are dramatically slower, file-watching breaks, and Windows and Linux disagree about line endings and file permissions in ways that produce Git diffs where you changed nothing.

Keep Linux work in the Linux filesystem (~/, which is /home/yourname). Your repo lives on GitHub anyway — cloning it twice costs you nothing, and that’s the whole argument for Git.


If that didn’t work — the other routes

There is no single correct installer. There are four, they all end with the same program on your machine, and if one is blocked or broken you switch. Try them in this order.

MacWindows
1. Official installercurl -fsSL https://chatgpt.com/codex/install.sh | shSame command, inside WSL
2. Package managerbrew install --cask codexnpm install -g @openai/codex (needs Node)
3. npmnpm install -g @openai/codex (needs Node)
4. Native Windowspowershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"
5. Manual binaryDownload from GitHub Releases, unpack, rename to codex, put it somewhere on your PATHSame
do you need npm first? No — and here's why it looks like you would

Reasonable question, because npm install -g is how you install most command-line tools these days. Not this one.

npm install -g @openai/codex genuinely works — but the package is a 12KB wrapper. The real program is a compiled binary that npm pulls in as a platform-specific dependency, and it’s byte for byte the same binary the curl installer downloads. npm isn’t building anything or adding anything; it’s just a delivery van.

Which means installing Node and npm first doesn’t help the official installer at all — that one doesn’t use Node, doesn’t look for it, and doesn’t care whether it’s there. For a machine that doesn’t already have Node, going the npm route means installing an entire JavaScript runtime in order to download one file. That’s the only reason it’s not the headline instruction.

Use npm if you already have Node and you’d rather manage versions the way you manage your other global tools. It’s a completely legitimate choice, just not a shortcut.

Use the installer if you’re starting from a clean machine — which is most of you.


School network

Know whether the network is the problem before you blame the instructions.

This is a real possibility and worth checking first, because a filtered network produces errors that look like broken instructions. Codex needs to reach:

HostFor
chatgpt.comthe installer script, and the agent’s traffic
releases.openai.comthe download (it falls back to github.com if that’s blocked)
auth.openai.comsigning in
api.openai.comthe model itself
github.comcloning your repo

Test it in ten seconds, before installing anything:

curl -I https://chatgpt.com
curl -I https://auth.openai.com

Any response at all — even 403 or 404 — means you got through; that’s the server talking. No response, a timeout, or a certificate error means the network stopped you. After installing, codex doctor checks the same ground and reports it in English.

The workaround is a Codespace, and it’s a genuinely interesting one. In a Codespace the agent isn’t running on the school network at all — it runs in Microsoft’s data centre, and that machine talks to OpenAI. The only thing crossing the school firewall is your browser talking to github.com. If GitHub is allowed and ChatGPT isn’t, that gap is the whole reason to work there. Which is also the answer to “why do we use Codespaces in this class” — see the bottom of this page.

Failing that: install it at home, or on a phone hotspot. Once it’s installed and signed in, it still needs network to run — the model isn’t on your laptop.


Both: is it actually working?

Not “did it install.” Working.

Codex ships with a self-check. Run it from inside your repo:

codex doctor

It reports on your install, whether it can find Git, whether you’re authenticated, and whether it can reach the network — with a , or on each. Read the failures; they’re written in plain English and they tell you which of the steps above didn’t take.

Then the part doctor can’t check for you:

  1. codex launches and shows you a prompt, in a folder that contains a real project.

  2. codex login status says you’re signed in with ChatGPT — not with an API key.

  3. It has read your repo and explained it back to you, and the explanation was right. You are the one who can check that, which is the point.

  4. It has made one change you asked for, and you read the diff line by line before accepting it.

Later on, codex update pulls down new versions — worth knowing, because this tool changes fast enough that a guide written today will be slightly wrong by the time you read it. Including this one.

When it breaks

Run codex doctor first — it names most of these for you.

What you seeWhat’s actually wrong
codex: command not foundYou’re in the shell that was open before you installed. Open a new terminal. If it persists, ~/.local/bin isn’t on your PATH — that’s the thing to go read about.
git: command not found, or a developer-tools popup (Mac)Step 2 of the Mac path. Codex works without Git, but it works far better with it, and you can’t clone a repo without it.
It bills your API key instead of your planAn OPENAI_API_KEY environment variable is set, and Codex prefers it over your ChatGPT login. Unset it, or codex logout and sign in again.
Browser opens, login never comes backYou’re in a container or a remote machine and the callback can’t reach you. See the Codespaces note below — same trap as Assignment 01.
Confidently wrong answers about your codeIt only knows what it has read. Tell it what to read first.
wsl --install does nothing (Windows)Virtualization is off in your BIOS, or you weren’t running PowerShell as Administrator.
The installer times out, or a certificate errorThe network, not the command. See School network above.
git clone asks for a username and passwordCloning a public repo needs neither — so either the URL is wrong, or the repo is private and you need a token. GitHub stopped accepting account passwords here years ago; typing yours will fail no matter how right it is.
Author identity unknown when something commitsFresh machine, so Git doesn’t know who you are yet: git config --global user.name and user.email.
Make it debug its own install

I’m setting up the OpenAI Codex CLI on [Mac / Windows 11 with WSL2]. Here is exactly what I ran and exactly what came back:

[paste the command and the full error text, not a summary of it]

Don’t give me a list of five things to try. Tell me what this specific error means, what the most likely single cause is, how I can confirm that’s the cause before changing anything, and then the fix. If you’re guessing, say you’re guessing.

Understand it when you can answer

Installing something is not knowledge. These are.

The thingThe question
The agent runs locallyWhat is Codex reading, and what is it sending to OpenAI?
WSLWhat is it, and why isn’t it the same as a virtual machine or a dual boot?
PATHWhy does a brand-new terminal find codex when the old one couldn’t?
Approval promptsWhat could a coding agent do to your machine if you approved everything without looking?
Plan vs API keyWhy is one a flat monthly fee and the other a number that can keep going up?
.gitignore and ~/.codex/Your credentials are in a file on your disk. Which files must never reach a commit?
Why doesn't the terminal find `codex` right after the installer says it succeeded? reveal

PATH is the list of folders your shell searches for commands, and it’s read when the shell starts. The installer added a folder to that list — but your already-running shell is still using the copy it loaded on launch. A new terminal reads the new list.

Codex just told you a function does X. How do you know it's true? reveal

You read the function. The agent is fast and confident and sometimes wrong, and confidence isn’t evidence. This is the same job as the Evaluate slot in a plan: you supply the standard, because the tool can’t.

What's the difference between this and pasting your code into chatgpt.com? reveal

Access and scope. Codex reads whole files across the project without you choosing them, and it can edit and run things. That’s more useful and more dangerous — which is why it asks first.

done when Codex is installed on your own machine, signed in with your plan, and it has explained your repo back to you correctly — and you rejected at least one thing it wanted to do, on purpose, because you read it.

On a Codespace instead

No paid plan, or a locked-down laptop? A Codespace is Linux, so the Mac commands work as-is — run the curl installer in the Codespace terminal.

The sign-in is where it gets interesting, and it’s the same trap as the Assignment 01 extra: the normal login hands credentials back to a browser on localhost, and localhost inside a container is not your laptop. So the link you’re given goes nowhere.

There are two ways out. One is to forward the port so the container’s localhost reaches your browser. The other is a flag on codex login built for exactly this situation — machines with no browser of their own. codex login --help lists it. Which one you use is up to you; working out why the default fails is the part worth having.

The other thing to know: a new Codespace is a new machine, so your login is gone again. Figuring out where credentials live and how to stop re-doing this is the follow-up.

What this is for

The tool isn’t the point. Being able to hand work to something that will do it without you watching is the point, and that only works if you can say what you want and tell whether you got it.

Which is the same three boxes as always — Goal, Scaffold, Evaluate. A terminal agent makes the cost of skipping them obvious and immediate: vague goal, and it builds the wrong thing in four seconds instead of four days. No Evaluate, and it announces it’s finished and you have nothing to argue with.

Point it at your own repo properly

Read this entire repository before answering anything.

Then tell me, in plain English: what this project is, how it’s structured, and the three things about it that would most confuse someone seeing it for the first time.

Then — don’t fix them — tell me what you’d change and why, and which of your suggestions you’re least confident about.