omp-codex-computer

Local OMP extension that exposes OpenAI Codex Computer Use and a constrained first-party Chrome automation surface through codex app-server.

Requirements

• macOS
• Codex CLI on PATH as codex
• Codex.app or ChatGPT.app build with Codex Computer Use enabled/available
• OMP installed
• Accessibility and Screen Recording permissions granted when Codex Computer Use asks
• Bundled computer-use Codex plugin available through app-server; this extension cannot operate without it
• First-party Chrome support additionally requires Google Chrome, the official ChatGPT Chrome extension connected to the ChatGPT desktop app, and a validated Codex app-server version (built-in allowlist: 0.149.0, 0.151.0). The bundled Chrome plugin is not version-pinned: any installed version is accepted as long as its identity, artifacts, and automation contract validate, and a plugin update that breaks the contract fails closed. An untrusted app-server version can be validated and persisted per machine with /codex-computer trust, or trusted per session with OMP_CODEX_CHROME_TRUST (comma-separated app-server versions, e.g. OMP_CODEX_CHROME_TRUST=0.150.0); malformed entries are ignored and add no trust, and /codex-computer status shows the effective allowlist.

Installation

Install the npm package through OMP:

omp install omp-codex-computer

For private pre-release testing from GitHub over SSH:

omp install [email protected]:mastertyko/omp-codex-computer.git

For local development, link the working tree into OMP and keep checks green:

omp install .
bun install
bun run check

Inside OMP:

/codex-computer status
/codex-computer diagnose

The extension registers computer_use_* tools for native macOS app inspection and interaction through Codex Computer Use, plus a local computer_use_resolve_app diagnostic tool that helps identify bad app targets before control actions.

It also registers chrome_open, chrome_observe, and chrome_act against OpenAI's bundled first-party Chrome browser client. This is intentionally narrower than Codex @Chrome: it owns one new blank tab per OMP agent run and never enumerates, selects, or attaches to the user's existing tabs.

Use omp -e . for a local smoke test without installing the package.

Uninstallation

Uninstall the OMP plugin by package/plugin name:

omp plugin uninstall omp-codex-computer

Use omp plugin list to confirm the plugin is no longer installed.

Commands

• /codex-computer status — checks both native Computer Use routing and static Chrome transport compatibility. Chrome extension connectivity is checked only when chrome_open runs.
• /codex-computer diagnose — prints the same detailed readiness and compatibility report.
• /codex-computer trust — contract-checks the installed stack, live-probes it (open/observe/reload/close on https://example.com/ plus cleanup), and persists the observed app-server version only after every step passes. /codex-computer trust clear removes the persisted trust store.
• /codex-computer enable — enables both computer_use_* and chrome_* tools.
• /codex-computer disable — disables both tool families and shuts down both runtimes.
• /codex-computer restart — stops both dedicated app-server children; they reconnect on the next tool call.
• /codex-computer hide-status — hides the 💻 codex: … footer status for the current extension instance.
• /codex-computer show-status — shows the footer status again.

Set OMP_CODEX_COMPUTER_STATUS=off before starting OMP to default the footer status to hidden.

Compatibility routes

Native Computer Use

The adapter negotiates the native-app transport from capabilities reported by Codex app-server:

• Current Codex: app-server → node_repl/js → @oai/sky → Sky.
• Legacy Codex: direct computer-use MCP, only when that server advertises all required tools.

Sky is preferred when both routes are available. Fallback is allowed only when Sky bootstrap fails before an action is dispatched; the adapter never falls back after dispatch because that could repeat a click or typed text.

Chrome

Chrome uses a separate path: app-server → node_repl/js → bundled Chrome browser client → first-party browser service → official Chrome extension. The adapter accepts only the explicitly validated Chrome plugin/app-server tuple, a canonical local plugin directory, the matching manifest, and an unambiguous node_repl/js tool. It never aliases Chrome to generic Computer Use, CDP, or another browser.

chrome_open creates the one agent-owned tab and can optionally load an initial http(s) URL in the same call. chrome_observe returns a capped semantic page snapshot and accepts a 1-indexed line offset for paging past the cap. chrome_act supports HTTPS/HTTP navigation, back/forward/reload, semantic-locator click/fill/keypress/select/check actions, and close. Agent-end cleanup closes any remaining tab before stopping the dedicated app-server child.

Safety

The extension does not automate the desktop or browser directly. It calls Codex app-server, which owns bundled plugin lifecycles, node_repl, native permissions, and the first-party browser connection. Native Computer Use permission requests fail closed when OMP has no UI. Chrome elicitation requests are always declined rather than reflecting page-derived text into a trusted prompt.

Desktop tasks should start with read-only discovery such as computer_use_list_apps, computer_use_resolve_app, or computer_use_get_app_state. Sky app listings expose only the model-relevant id, displayName, and isRunning fields while retaining the full structured response internally for target resolution. If an app-state diff lacks the required context, request a complete accessibility tree with disableDiff: true. If get_app_state returns Invalid app, the adapter enriches the error with target-resolution guidance for cases like unbundled local GUI processes launched as raw executables. Mutating tools are registered with write approval, reject clicks without an element index or complete coordinate pair, and are never automatically replayed after a user-stopped Computer Use session.

computer_use_paste inserts text, Markdown, or HTML by transiently replacing the clipboard; upstream restores the previous clipboard contents after the paste.

Chrome remains isolated to one opaque tab for one agent run. Page snapshots are untrusted content and capped at 50 KiB/3,000 lines per window. The public schema exposes no arbitrary JavaScript, CDP, CSS selectors, coordinates, browser/tab IDs, existing-tab discovery, file URLs, credential-bearing URLs, uploads, downloads, or unrestricted key chords. chrome_open and chrome_act require write approval; chrome_observe is read-only. Locator actions require an unambiguous target before acting — exactly one match, or exactly one visible match among a few duplicates; a miss or a still-ambiguous locator fails without side effects and without ending the Chrome run. Only failures with an uncertain outcome after an action was dispatched — timeouts mid-action, lost or invalid responses, interrupts — poison the Chrome runtime for the rest of that agent run, so a possible side effect is never retried or routed elsewhere.

Contributing and security

• See CONTRIBUTING.md for the local development workflow and pull request expectations.
• See SECURITY.md for supported versions and responsible disclosure guidance.

Verification

Local automated checks:

bun run check

Local OMP smoke:

omp -e .

Inside OMP:

/codex-computer diagnose

Verified on 2026-08-22 with OMP v17.3.4, Codex CLI/app-server 0.149.0, bundled Chrome plugin 26.818.31338, and bundled Computer Use plugin 1.0.1000816:

• bun run check passed with 198 tests across 17 files.
• npm pack --dry-run completed successfully.
• The Chrome compatibility probe reported ready for the exact trusted plugin/app-server tuple; it did not bootstrap the browser.
• A live ChromeRuntime opened a blank extension-backed tab, returned an empty snapshot, navigated to https://example.com/, clicked Learn more with a semantic text locator, returned the IANA snapshot, closed the tab, and completed cleanup.
• An end-to-end omp -e . agent run loaded the extension's real OMP-compatible schemas, used only chrome_open/chrome_act, reported the Example Domain heading, and closed the tab.

Re-verified on 2026-08-23 for the extended Chrome surface, same stack:

• bun run check passed with 213 tests across 17 files.
• A live ChromeRuntime opened https://www.selenium.dev/selenium/web/web-form.html directly through chrome_open with a URL, then exercised select-by-label, checkbox setChecked, fill with multibyte text, navigate, back, forward, reload, offset-paged observe, and close — three consecutive full runs green.
• A missing locator returned element_not_found and a two-match locator returned ambiguous_locator; both were side-effect free and the same Chrome run continued and completed cleanup afterwards.
• A raw bridge probe confirmed strict-mode Playwright semantics upstream and working nth()/isVisible() primitives for the visible-aware locator resolver.
• An end-to-end omp -e . -p agent run enabled the tools with /codex-computer enable, loaded the extended schemas through OMP's real Zod surface, opened https://example.com/ via chrome_open with its url parameter, reported the Example Domain heading, and closed the tab.

Extended on 2026-08-23 with the computer_use_paste tool, same stack:

• bun run check passed with 213 tests across 17 files.
• A live omp -e . -p agent run activated TextEdit with computer_use_get_app_state, pasted through Sky with computer_use_paste (format: "text"), saved with computer_use_press_key (Super_L+s), and the follow-up app state showed the exact pasted value.
• The saved document on disk contained exactly the pasted string, and a pre-activation paste was rejected upstream with the documented activation error and no side effects.

Re-verified on 2026-08-26 after the bundled Chrome plugin auto-updated to 26.818.61809, Codex CLI/app-server still 0.149.0:

• The previous allowlist correctly failed closed with unsupported_version_tuple before the tuple review.
• A static contract review of the new browser-client.mjs confirmed the unchanged surface the transport depends on: the single setupBrowserRuntime export, browsers.get, nameSession, tabs.new, tab.playwright semantic locators, and domSnapshot.
• A live ChromeRuntime probe with [email protected] opened https://example.com/, observed, clicked the sole link through a role locator (post-action snapshot showed the navigation), closed the tab, and completed cleanup.
• The tuple [email protected] was then added to the built-in allowlist; bun run check passed with 215 tests across 17 files.

Redesigned on 2026-08-26: the Chrome gate contract-validates the bundled plugin instead of pinning its version, and app-server trust is expandable without a release:

• Plugin gate: the identity and artifact checks are unchanged; a static contract check over browser-client.mjs (single setupBrowserRuntime export plus every method marker the transport calls) and an in-program shape handshake before any tab or action replace the version pin. A contract-breaking plugin update fails closed as plugin_contract_mismatch.
• App-server gate: exact built-in allowlist (0.149.0 at the time; 0.149.0, 0.151.0 today), expandable per machine via /codex-computer trust — which persists only after a green live probe — or per session via OMP_CODEX_CHROME_TRUST.
• bun run check passed with 243 tests across 19 files; npm pack --dry-run completed successfully.
• Live against Codex app-server 0.149.0 and bundled Chrome plugin 26.818.61809: the status probe reported ready through the contract gate with no version pin, a default-wired ChromeRuntime ran open → observe → role-locator click → close → cleanup green with the shape handshake active, and the trust probe ran open/observe/reload/close/cleanup green and correctly declined to persist the already-trusted version.

Re-verified on 2026-09-02 after Codex updated to CLI/app-server 0.151.0 (bundled Chrome plugin 26.831.21537, bundled Computer Use plugin 1.0.1000926), OMP v18.1.2:

• Native Computer Use needed no change: the status probe selected the Sky/node_repl route, and live list_apps plus get_app_state (Finder, disableDiff: true) returned real data through the new Computer Use plugin.
• The Chrome gate correctly failed closed with unsupported_app_server_version for 0.151.0 while the plugin contract check passed unchanged for 26.831.21537. A review of the new browser-client.mjs confirmed every surface the generated program calls (setupBrowserRuntime, browsers.get, nameSession, tabs.new, tab goto/back/forward/reload/close, tab.playwright locator factories, domSnapshot, and locator first/waitFor/count/nth/isVisible/click/fill/press/selectOption/setChecked with timeoutMs).
• The app-server protocol was diffed exactly: generate-json-schema from a temp install of @openai/[email protected] against 0.151.0, over the transitive closure of the used methods (initialize, plugin/list, mcpServerStatus/list, thread/start, mcpServer/tool/call, mcpServer/elicitation/request). The unresolved request and response root schemas, the JSON-RPC envelopes, the elicitation request/response, and the server-request method set are identical. Eleven transitively referenced definitions changed, all additively: optional McpServerStatus.runtimeStatus and defaulted Thread.historyMode (both present in the responses this extension reads), plus enum/union/definition additions under Thread.turns (TurnError.misalignment, CodexErrorInfo, ThreadItem, collab/sub-agent enums) that it never reads; nothing was removed, retyped, or made required. New notifications (mcpServer/event/stream/notification, thread/realtime/item/*) are logged and ignored by the client. Fixtures mirroring the live 0.151.0 mcpServerStatus/list and thread/start payloads were added to the Sky-route, Chrome-gate, and thread-manager tests to pin that the consumed fields still evaluate correctly.
• A live ChromeRuntime probe with a probe-only trust override ran open (https://example.com/) → observe → reload → role-locator click (post-action snapshot showed the IANA page) → back → missing locator (element_not_found, run continued) → observe → close → cleanup, all green.
• 0.151.0 was then added to the built-in allowlist; the default-wired status probe reported ready, and bun run check passed with 263 tests across 19 files.
• End-to-end omp -e . -p runs on OMP v18.1.2 made real chrome_open (with url), chrome_act click (role: link, name: Learn more), and chrome_act close calls and reported the Example Domain heading; a second run listed apps through computer_use_list_apps only.