CLI, IDE Extension, and Cloud Sandbox

Why three modes exist

Codex doesn't ship as a single monolithic tool. Instead, OpenAI offers three deployment options, each optimized for a different workflow. Some teams run it locally via CLI; others want it wired into VSCode or JetBrains; still others prefer a remote sandbox so secrets and source code never leave their machines. The choice matters because it affects latency, what context Codex can see, how you review changes, and your attack surface for security.

The three modes at a glance

Mode 1: Command-line interface (CLI)

The CLI mode is the most direct: you run a codex command with a task description and a target directory, and Codex produces a diff on stdout or writes it to a patch file.

Setup: Install the CLI tool, authenticate with your OpenAI API key, and you're ready to use it in any project.

Context: The CLI sees your entire directory, all files in the scope you specify. Codex reads the task description, lists the files, and reasons over them all at once. This is powerful for understanding your codebase structure but requires that all the context fit within Codex's context window.

Workflow: You write a task description in a file or pass it as an argument, run codex --task task.txt --dir ./src, and get a diff back. You review it using git diff or your favorite tool, then decide to apply it (git apply) or make manual adjustments.

Security: All code stays local until you explicitly apply the diff. Codex runs on OpenAI's infrastructure, so your code and task descriptions are sent to OpenAI's servers. If that's unacceptable, this mode isn't for you.

Latency: API latency is 1-3 seconds for simple tasks, 5-15 seconds for larger ones, plus network round-trip time.

Best for: CI/CD pipelines, one-off refactors, or workflows where you're comfortable with API calls.

Mode 2: IDE extension

The IDE extension (available for VSCode and JetBrains IDEs) embeds Codex directly into your editor. You select a code block or a file, right-click "Generate with Codex," write a task description in a sidebar panel, and the generated diff appears as a suggestion in your editor.

Setup: Install from the IDE's extension marketplace, authenticate, and Codex suggestions appear inline.

Context: The extension sees your open files and the currently edited file. You can optionally expand the context by telling Codex which other files to consider ("here's my schema definition, use it") or by selecting multiple files before running a task.

Workflow: This is the most interactive mode. You write a task, see the diff in real time, accept individual hunks or ask Codex to refine a specific file. The diff is immediately applicable; you can accept parts of it and edit others without leaving the editor.

Security: Code and tasks are sent to OpenAI's API, same as CLI. The advantage is that you typically share less context at once (just the files you're actively working on), so sensitive data is less likely to be uploaded.

Latency: Usually 2-5 seconds for small files, longer for whole-file context.

Best for: Daily development, exploratory coding, or teaching (since you see each step in the IDE).

Mode 3: Cloud sandbox

The cloud sandbox is a remote execution environment. You upload your code to a secure, ephemeral container hosted by OpenAI, describe your task, and Codex modifies the code in that container. The changes come back to you as a diff, and your local code is never shared.

Setup: Authenticate and run codex --cloud --dir ./src. Your code is compressed and uploaded to a temporary container.

Context: Codex sees the entire uploaded directory structure. It can run tests in the container to validate its changes. This is the most powerful context but requires uploading your code.

Workflow: Upload, describe the task, wait for results, download the diff. The container is ephemeral; after you get the diff, the uploaded code is deleted.

Security: Your code is encrypted in transit and at rest on OpenAI's infrastructure, in an isolated container. No secrets or source code remain on OpenAI's servers after the session ends. This is the most secure option if you don't trust local tools but do trust OpenAI's infrastructure.

Latency: Upload/download overhead (usually 2-10 seconds) plus compute time. Slower than local CLI but acceptable for complex tasks that benefit from being able to run tests.

Best for: Large codebases, projects with sensitive IP, or when you want Codex to run tests as part of the task.

Comparing the three modes

Context flowing through each mode

Understanding how context flows helps you set up Codex correctly. In CLI mode, you specify files explicitly or a directory, and Codex includes their full text. In IDE mode, Codex automatically includes open tabs and the active file but needs you to explicitly add others. In cloud-sandbox mode, you upload a tarball of your project, and Codex has access to all of it plus can run scripts.

This matters for security and cost. If your task is "add a retry loop to the payment handler" and you give Codex your entire src/ directory, it reads 500KB of code to find the payment handler. If you're in IDE mode and just select the payment handler file, Codex only sees that file and has to infer the broader context from your task description.

Common mistake

Assuming that one mode is universally better than the others. Teams often use the CLI mode for automated refactors (CI/CD pipelines), the IDE extension for daily development, and the cloud sandbox for sensitive or complex work -- all three in the same project, chosen based on the specific task. Pick the mode that matches the task's scope, your security requirements, and your workflow that week.