Codex-ChatGPT bridge trades ToS risk and UI fragility for zero API spend

The core trick here is routing Codex tasks through ChatGPT's web interface rather than its API, which means no per-token charges and access to whatever subscription tier the signed-in account already has. Free and Go accounts get a model called Luna; Pro accounts get the full effort ladder from Instant up through Extra High and Pro. The bridge works by compiling the current Codex task context, sending it into a ChatGPT Temporary Chat via an embedded browser, and streaming reasoning traces, tool activity, and Markdown back into Codex's native UI. From Codex's perspective, these appear as ordinary model picker entries.

The architecture is more careful than a quick-and-dirty browser hack usually is. Sequential messages reuse a single task-bound Temporary Chat rather than spawning fresh sessions, and at the context compaction boundary the retained agent writes a checkpoint before Codex starts a clean chat. If that chat was already closed, canonical Codex history provides the fallback. That's a real design decision, not an afterthought.

The full-harness mode goes further by connecting ChatGPT's tool calls back to the active Codex task through OpenAI's own tunnel client. The tunnel is outbound-only — no public IP, no inbound port — and the MCP connector must be named exactly Codex Native2 with Allow all actions set. The README is explicit that Allow low-risk actions silently blocks commands and patches before they reach the harness, which is the kind of footgun that usually only surfaces in a GitHub issue after the fact. The connector naming requirement exists because ChatGPT caches the public MCP contract by connector identity, so renaming or reusing an older connector breaks the turn-token contract this release expects.

The fail-closed posture is stated as a design principle: UI drift in ChatGPT produces explicit errors rather than a silent fallback to a different model or transport. That's the right call for a tool built on browser automation, where the alternative is mysterious capability degradation. The --auto-approve-tool-calls flag, when enabled, clicks Allow once only — never a permanent grant.

The honest limitations are right there in the README. This is unofficial browser automation, not an API. ChatGPT UI changes will break selectors. The browser state is a sensitive login artifact reachable by any process running as the same local user. Builds are not yet platform-signed, so Gatekeeper and SmartScreen will complain. Temporary Chat is a privacy mode, not local inference — prompts still go to OpenAI and are subject to the account's settings.

For anyone already paying for a ChatGPT Pro subscription and using Codex heavily, the cost arithmetic is straightforward: this trades engineering complexity and ToS risk for zero additional API spend. Whether that trade is wise depends entirely on how stable ChatGPT's web UI stays and how much the user values the Codex tool harness over raw API flexibility.