OpenAI Codex Integration

Note: New and updated features may not be immediately available on your dedicated deployment due to participation in limited release availability, beta programs, or regional configurations.

If you don't see a feature you expect, please reach out to your Customer Success team — we're happy to help.

Overview

By default, the Codex application does not honor system-wide proxy settings, opting instead for direct outbound traffic. Consequently, WitnessAI is unable to intercept prompt and response traffic from devices integrated via Witness Anywhere. To ensure proper traffic routing through the WitnessAI proxy, administrators must define the proxy settings as an environment variable within the Codex environment.

Solutions for macOS and Windows

The following sections outline the recommended procedures for applying these configurations across macOS and Windows environments.

macOS Configuration

WitnessAI has integrated logic within the Witness Anywhere registration script to automatically insert the required proxy configuration into the Codex application's environment file. This ensures that only Codex-specific traffic is routed via the WitnessAI proxy, leaving other system traffic unaffected.

New Witness Anywhere Deployments

For new deployments, download the latest registration script from the WitnessAI console and distribute it via your Mobile Device Management (MDM) solution.

💡

Note: Codex must be installed on the target device prior to deploying Witness Anywhere, to ensure the script can successfully modify the environment file.

Existing Deployments

For previously registered devices, administrators should deploy the following shell script via MDM to append the proxy environment variable to the Codex configuration.


#!/bin/bash
# Run as root: set Codex http_proxy for the logged-in console user.
set -euo pipefail

PROXY_LINE='http_proxy="http://127.0.0.1:9411"'

log() { printf '[%s] %s\n' "$(date '+%Y-%m-%d %H:%M:%S')" "$*" >&2; }
die() { log "ERROR: $*"; exit 1; }

[[ "${EUID:-$(id -u)}" -eq 0 ]] || die "Must run as root."

user="$(stat -f '%Su' /dev/console 2>/dev/null || true)"
[[ -n "$user" && "$user" != "root" && -d "/Users/$user" ]] || die "No logged-in user found."

env_file="/Users/$user/.codex/.env"
as_user() { sudo -u "$user" "$@"; }

as_user mkdir -p "/Users/$user/.codex"
rest=""
as_user test -f "$env_file" && rest="$(as_user grep -Fxv "$PROXY_LINE" "$env_file" 2>/dev/null || true)"
{ printf '%s\n' "$PROXY_LINE"; [[ -n "$rest" ]] && printf '%s\n' "$rest"; } | as_user tee "$env_file" >/dev/null

log "SUCCESS: Codex proxy set for '$user' ($env_file)"

Windows Configuration

On Windows, there is currently no native method to apply an environment variable exclusively to the Codex application, nor does the application support proxy configuration via its standard config file.

Consequently, administrators must set the proxy variable at the user profile level. Please note that this may cause other proxy-aware applications within the user profile to route traffic through the WitnessAI proxy. It is recommended to validate this behavior in a staging environment prior to a fleet-wide rollout.

Manual Configuration (UI)

Open the Start Menu and search for Environment Variables.
Select Edit the system environment variables.
In the System Properties dialog, click Environment Variables...
Under the User variables section, click New...
Input the following values:

Variable name: HTTP_PROXY
Variable value: http://127.0.0.1:9411

Click OK to save changes.

Command-Line Configuration (PowerShell)

To apply the setting via PowerShell for the current user:


[Environment]::SetEnvironmentVariable("HTTP_PROXY","http://127.0.0.1:9411","User")

Enterprise Rollout Script

Once the configuration is verified, the following PowerShell script can be used to automate the deployment across the organization. This script identifies the logged-in user's SID and updates the registry accordingly.


function Get-LoggedInUserSid {
    $loggedInUser = (Get-WmiObject -Class Win32_ComputerSystem).UserName

    if (-not $loggedInUser) {
        Write-Output "No user is currently logged in."
        return $null
    }

    try {
        if ($loggedInUser -like "*\*") {
            $domain, $username = $loggedInUser.Split('\', 2)
            $ntAccount = New-Object System.Security.Principal.NTAccount($domain, $username)
        } else {
            $username = $loggedInUser
            $ntAccount = New-Object System.Security.Principal.NTAccount($username)
        }

        $userSID = $ntAccount.Translate([System.Security.Principal.SecurityIdentifier]).Value

        return [PSCustomObject]@{
            Username = $username
            FullUser = $loggedInUser
            SID      = $userSID
        }
    }
    catch {
        Write-Error "Could not retrieve SID for user $loggedInUser. Error: $($_.Exception.Message)"
        return $null
    }
}

$userInfo = Get-LoggedInUserSid

if ($userInfo) {
    $envPath = "Registry::HKEY_USERS\$($userInfo.SID)\Environment"

    New-Item -Path $envPath -Force | Out-Null

    Set-ItemProperty -Path $envPath -Name "HTTP_PROXY" -Value "http://127.0.0.1:9411" -Type String

    Write-Output "Set proxy environment variable for $($userInfo.FullUser) SID $($userInfo.SID)"
}

Following the application of the environment variable, restart the Codex application for changes to take effect.