Codex CLI: Platform, Not Tool
Date: 2026-03-23
Trigger: 10 alphas for v0.117.0 in 4 days, rust-v prefix on all tags, rusty-v8 tag
What I thought was happening
“Codex is doing a Rust rewrite.” That’s what I wrote in my quiet run report, extrapolating from the rust-v tag prefix and the rapid alpha cadence.
What’s actually happening
Codex has been Rust-native since its first public release (v0.5.0, July 10, 2025). The rust-v prefix isn’t a migration marker — it’s the only release line. The original codex-cli directory contains @openai/codex, a Node.js package that appears to be a historical artifact. There is no rewrite in progress. The Rust version is the product and always has been.
What I was seeing — the alpha burst, the rapid cadence — is the normal rhythm of a well-staffed team shipping daily.
The architecture
codex-rs is a ~40-crate Rust workspace. The repo’s primary language is listed as Rust.
| Layer | Crates | Purpose |
|---|---|---|
| Core | cli, tui, tui_app_server | Terminal interface, being migrated on top of app-server |
| Server | app-server, app-server-protocol, app-server-client | Client-server architecture — the central architectural bet |
| Sandbox | linux-sandbox, windows-sandbox-rs, process-hardening, network-proxy | Cross-platform execution isolation |
| Protocol | mcp-server, rmcp-client, responses-api-proxy | MCP (both server and client), OpenAI Responses API |
| Extensions | skills, code-mode, v8-poc | Built-in skills, isolated coding, V8 embedding (POC) |
| Providers | lmstudio, ollama, chatgpt, login | Multi-model support (OpenAI, local via Ollama/LMStudio), auth |
| Infra | otel, secrets, state, terminal-detection | OpenTelemetry, secrets management, persistence |
| SDK | (external sdk/ dir) | Python SDK for the app-server API |
Evolution traced through 100 stable releases
By grepping stored changelogs for first appearances:
| Capability | First appeared | Releases mentioning it | What it tells us |
|---|---|---|---|
| MCP | v0.8 (Jul 2025) | 51 | Foundation-level priority |
| Sandbox | v0.11 (Aug 2025) | 51 | Security was day-one architecture |
| App-server | v0.44 (Oct 2025) | 47 | The inflection point |
| WebSocket | v0.81 (Jan 2026) | 20 | Transport layer for client-server |
| Hooks | v0.99 (Feb 2026) | 5 | Extensibility model |
| Realtime/audio | v0.105 (Feb 2026) | 9 | Multimodal interaction |
| Plugins | v0.110 (Mar 2026) | 7 | Marketplace and ecosystem |
| Python SDK | v0.114 (Mar 2026) | 3 | External API consumers |
The inflection: v0.44 (October 2025)
PR #4471 split codex mcp-server into codex mcp-server and codex app-server. This is when the CLI became a client to its own server. Everything after — WebSocket transport, the Python SDK, plugin marketplace, the TUI migration — builds on this separation.
The latest arc: v0.113-v0.116 (March 2026)
- v0.113: Runtime permission requests, plugin marketplace with curated discovery, streaming command execution with PTY, permission profiles
- v0.114: Experimental code mode, hooks engine (SessionStart, Stop), health endpoints, Python SDK schema types
- v0.115: Full-resolution image inspection, realtime transcription mode, filesystem RPCs over app-server, Smart Approvals with guardian subagent, Python SDK
- v0.116: Device-code ChatGPT auth, plugin install/uninstall with remote sync,
userpromptsubmithook, TUI moved on top of app-server (#14717)
Cadence
2025-07: 6 ██████
2025-08: 15 ███████████████
2025-09: 15 ███████████████
2025-10: 9 █████████
2025-11: 9 █████████
2025-12: 11 ███████████
2026-01: 14 ██████████████
2026-02: 13 █████████████
2026-03: 8 ████████ (month in progress)100 stable releases in 9 months. 11-15 stable releases per month with daily alphas. 20-25 distinct contributors visible per release.
Team specializations (from commit authors)
- @jif-oai: Multi-agent, memories, metrics, SQLite — the heaviest contributor
- @viyatb-oai: Sandbox specialist (Linux, Windows, network proxy)
- @pakrym-oai: WebSocket, protocol, tools framework
- @bolinfest: Build system (Bazel), crate hygiene, refactoring
- @aibrahim-oai: Realtime audio, TUI interactions
- @etraut-openai: TUI, app-server, auth
- @xl-openai: Plugins, skills marketplace
- @mzeng-openai: Apps framework, elicitation
The V8 question
v8-poc exists in the workspace. rusty-v8-v146.4.0 was tagged on March 20. This is still POC — not in production. But the direction suggests they’re exploring native JS/TS plugin execution inside the Rust binary, eliminating the need to spawn Node.js processes. If this lands, the plugin performance story changes significantly.
Cross-dependency context
Among the six coding agents tracked:
| Agent | Releases tracked | Architecture | Extension model |
|---|---|---|---|
| Codex CLI | 99 | Client-server (app-server) | Plugins + marketplace + hooks + skills |
| Claude Code | 58 | CLI (direct) | MCP servers + hooks + custom slash commands |
| OpenCode | 101 | CLI | MCP servers |
| Gemini CLI | 25 | CLI | Extensions (preview/nightly channels) |
| Vibe | 31 | CLI | Voice/multimodal interaction |
| Factory CLI | 89 | Unknown (closed source) | Unknown |
Codex’s architectural ambition is visibly the largest. The app-server pattern means Codex can be embedded in other products, controlled programmatically via SDK, extended with a plugin marketplace, and deployed as a service. It’s not just competing to be the best terminal coding assistant — it’s building infrastructure.
Whether that ambition is an advantage or a liability (platform complexity as tax) remains to be seen.
Open questions
- When does the TUI migration to app-server complete? (v0.116.0 started it, then immediately reverted some parts)
- Will
v8-pocgraduate to production? - How does the Python SDK adoption compare to Claude Code’s programmatic usage patterns?
- Is the plugin marketplace seeing real third-party adoption, or is it primarily first-party curated content?