# Behavior traces — openai/codex

> Canonical page: https://codevetter.com/unpack/codex/behavior-traces

# Behavior traces — openai/codex

Scanned commit a1f40f3f1326eff7c81b860a4f4e27c1be186e10 (2026-09-22). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

Three flows dominate. Startup parses CLI args, loads config and auth, builds a Codex session, and either enters the TUI event loop or the exec one-shot loop. A primary turn submits user input, streams a model response, dispatches tool calls under approval and sandbox, and records rollout items until `TurnComplete`. Persistence is continuous during the turn (rollout appends) and finalized on shutdown or resume. App-server clients follow the same core path after a JSON-RPC translation step.
- Process startup: `cli::main` → `arg0_dispatch_or_else` (so sandbox helpers can re-exec under a different argv0) → `MultitoolCli::parse` → match on `Subcommand`. For the default path, `tui_main` loads config, builds `TuiConfig`, and calls `codex_tui::run_main` → `App::run`. — [codex-rs/cli/src/main.rs#L1-L120](https://github.com/openai/codex/blob/a1f40f3f1326eff7c81b860a4f4e27c1be186e10/codex-rs/cli/src/main.rs#L1-L120) [codex-rs/tui/src/lib.rs#L1-L120](https://github.com/openai/codex/blob/a1f40f3f1326eff7c81b860a4f4e27c1be186e10/codex-rs/tui/src/lib.rs#L1-L120) [codex-rs/tui/src/app.rs](https://github.com/openai/codex/blob/a1f40f3f1326eff7c81b860a4f4e27c1be186e10/codex-rs/tui/src/app.rs)
- Exec one-shot: `codex exec` → `exec::run_main` builds a `Codex` with the prompt as the initial `Op::UserTurn`, reads the event channel until `TurnComplete` or `Error`, prints human text or JSONL, and exits non-zero on error. `--output-schema` validates the final message. — [codex-rs/exec/src/lib.rs#L1-L200](https://github.com/openai/codex/blob/a1f40f3f1326eff7c81b860a4f4e27c1be186e10/codex-rs/exec/src/lib.rs#L1-L200) [docs/exec.md](https://github.com/openai/codex/blob/a1f40f3f1326eff7c81b860a4f4e27c1be186e10/docs/exec.md) [codex-rs/cli/src/main.rs](https://github.com/openai/codex/blob/a1f40f3f1326eff7c81b860a4f4e27c1be186e10/codex-rs/cli/src/main.rs)
- Tool call with approval: model emits a function call → router looks up the handler → if policy is `on-request` and execpolicy does not pre-approve, core emits `ExecApprovalRequest` → TUI modal or exec auto-decision returns `Op::ExecApproval` → sandbox spawn → `ExecCommandEnd` → function output appended → model continues. — [codex-rs/core/src/tools/router.rs](https://github.com/openai/codex/blob/a1f40f3f1326eff7c81b860a4f4e27c1be186e10/codex-rs/core/src/tools/router.rs) [codex-rs/protocol/src/protocol.rs](https://github.com/openai/codex/blob/a1f40f3f1326eff7c81b860a4f4e27c1be186e10/codex-rs/protocol/src/protocol.rs) [codex-rs/tui/src/chatwidget.rs](https://github.com/openai/codex/blob/a1f40f3f1326eff7c81b860a4f4e27c1be186e10/codex-rs/tui/src/chatwidget.rs)
- SDK run: `Codex` constructor starts `codex app-server` with `--stdio` → `initialize` JSON-RPC → `startThread` calls `thread/start` → `run` calls `turn/start` and demultiplexes notifications into typed `ThreadEvent`s until `turn/completed`. — [sdk/typescript/src/codex.ts](https://github.com/openai/codex/blob/a1f40f3f1326eff7c81b860a4f4e27c1be186e10/sdk/typescript/src/codex.ts) [sdk/typescript/src/thread.ts](https://github.com/openai/codex/blob/a1f40f3f1326eff7c81b860a4f4e27c1be186e10/sdk/typescript/src/thread.ts) [sdk/typescript/README.md](https://github.com/openai/codex/blob/a1f40f3f1326eff7c81b860a4f4e27c1be186e10/sdk/typescript/README.md)
- Login flow: `codex login` → login crate starts device-code or localhost callback → tokens written via `AuthManager` to `$CODEX_HOME/auth.json` with mode `chatgpt` or `apikey`. Later `ModelClient` calls `AuthManager::auth()` on each request and refreshes when the access token is near expiry. — [docs/authentication.md](https://github.com/openai/codex/blob/a1f40f3f1326eff7c81b860a4f4e27c1be186e10/docs/authentication.md) [codex-rs/login/src/auth/manager.rs](https://github.com/openai/codex/blob/a1f40f3f1326eff7c81b860a4f4e27c1be186e10/codex-rs/login/src/auth/manager.rs) [codex-rs/core/src/client.rs](https://github.com/openai/codex/blob/a1f40f3f1326eff7c81b860a4f4e27c1be186e10/codex-rs/core/src/client.rs)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)