ChatGPT ↔ Codex Create-Only Bridge

简体中文 · Installation · Security model · Upstream attribution

Let ChatGPT read a registered local project through Codex and publish complete documents into new version directories. Existing files stay read-only. The web conversation owns the writing and language style; the local worker reads sources, saves supplied text, and verifies the result.

This repository contains the create-only extensions and deployment kit, plus patches for an independently maintained upstream MCP bridge. It is not a standalone ChatGPT client, a replacement Codex implementation, or an official OpenAI product.

ChatGPT web
    │ MCP over an authenticated connection / separately operated tunnel
    ▼
Protocol adapter (loopback, bearer token by default)
    ▼
Patched upstream bridge (projects, agents, persisted background jobs)
    ▼
Operator runtime guard → Codex app-server (read-only / never)
    │ confirmed active turn, exact publish_document function
    ▼
Publisher → output-root/document-name-<new UUID>/index.md + index.html

What is included

• Create-only publisher: a fixed output root, fresh UUID directories, exclusive file creation, optional hash-verified source copying, and accurate complete/partial receipts. No overwrite, deletion, rename, shell, or networking interface.

• Native runtime guard: verifies the effective read-only configuration, owns fresh threads and active turns, rejects old execution contexts and arbitrary tool/configuration overrides, and dispatches one operator-owned publication function.

• MCP compatibility adapter: official SDK v2 frontend and legacy SDK backend; preserves schemas and caller metadata, enforces loopback Host/Origin and auth checks, rejects unsupported protocol semantics, and does not cancel background work when an observer disconnects.

• Deployment configuration generator: creates a new private runtime directory, native wrapper, isolated Codex home, and core launcher. It does not change an existing installation or start/restart services.

• Upstream patches: certificate-only CA bundle recognition, job retention, native asynchronous input/provenance, and named permission checks. Create-only publishing itself uses no writable sandbox/profile.

Related MCP server: docs2mcp

Quick start

Requires Node.js 22+, Python 3.11+, Git, the tested Codex CLI 0.153.3, and your own working Codex sign-in. Native sandbox behavior depends on the host OS; the end-to-end reference deployment was tested on macOS. ChatGPT custom-plugin access and a remote connection/tunnel must be available to your account.

git clone https://github.com/tokaka22/chatgpt-codex-create-only-bridge.git
cd chatgpt-codex-create-only-bridge
npm ci --ignore-scripts --no-audit --no-fund
npm test

Follow the installation guide to prepare the pinned upstream core, generate a private policy, authenticate your own isolated Codex home, and connect ChatGPT. This is an operator-oriented v0.1 deployment kit; tunnel/account provisioning is deliberately separate.

An example request after connecting:

Read the latest registered project materials. Write the complete document in this conversation's style, publish a new Markdown and standalone HTML version through Mini/local Codex, and verify the actual files and navigation. Do not modify, delete or overwrite any existing file. Return the new directory and verification results when finished.

Ordinary checks do not ask for shell approval because they stay read-only. Publication uses the narrow create-only function. Configure the ChatGPT connector's confirmation preference for this trusted tool yourself; this repository does not change the web account's permission settings.

Publication contract

{
  "slug": "research-design",
  "files": [
    {"path": "index.md", "content": "# Complete new document\n"},
    {"path": "index.html", "content": "<!doctype html><meta charset=utf-8><h1>Document</h1>"}
  ]
}

Each successful call creates another research-design-<uuid> directory. A published file is never edited again. Revision means publishing a complete new version. To copy a permitted existing source without repeating a long body, provide source_path and its exact expected_sha256 instead of content.

Defaults are 32 UTF-8 text files / 4 MiB total per publication. Supported suffixes: Markdown, HTML, TXT, CSS, JSON, CSV and TSV. All source hashes are checked before creating a publication. complete confirms writes and fsyncs succeeded; partial preserves already-created output and reports it accurately. There is no automatic rollback or idempotent publication retry. After a connection failure, inspect the original job/result before considering another publication.

Verification

The source release includes 22 publisher checks, 36 guard checks, 26 adapter checks, and configuration-generator checks. Tests use retained local fixtures and mock HTTP services; they make no model calls or tunnel/account changes.

A private reference deployment additionally published a complete nine-chapter document twice through the actual ChatGPT web connector with zero interaction requests, verified the previous version's hashes, and completed a 70-second job while the independent tunnel was restarted. This is historical integration evidence, not a promise about every OS, future CLI version or account. No private documents, credentials, screenshots, job identifiers or databases are included here. See validation notes.

The guard is pinned to an observed native app-server contract. Audit and test new CLI versions before changing the pin. See OpenAI's explanation of app-server as the integration layer.

License

MIT for this repository. Retain upstream notices when redistributing the patch or upstream code; see UPSTREAM.md and licenses/upstream-MIT.txt. Model access, accounts and managed services are separate from this code license.