Codex Cowork

Codex Cowork turns the Codex CLI into a customizable GPT-5.6 pipeline, seamlessly delegating each task across Sol, Terra, and Luna while preserving one native, user-controlled workflow.

Comment

posted an update —

Here are the results from the prompt I put in on the video. Sorry for the last minute video and poor script and obvious script reading. The due date for me was 7PM and if you look at the time. I was cutting it extremely close as I always do haha... Still working on getting actual good results but the concept and execution is extremely cool and I think with enough tweaking this can become something legitimately useful. Stay tuned for more updates on actual statistics on token saving or solution improvement.

Sol findings

  • [Medium] MCP fallback instructs Sol to call an unavailable tool — src/cowork/controller.mjs:29, bin/cowork-mcp.mjs:48

Foreign-thread resumes use MCP controls named cowork_accept, cowork_decline, and so on, but both the injected instructions and proposals require cowork_control. This can prevent explicit proposal decisions.

Current MCP integration tests exercise only cowork_status. Expose cowork_control through MCP or generate transport-aware instructions, with an accept/decline integration test.

  • [Medium] Resume transport selection ignores the stored transport — src/runtime/launcher.mjs:124, src/cowork/controller.mjs:442

The registry stores controlTransport, but the launcher checks only whether an entry exists. A thread previously resumed through MCP—or launched with Cowork off—is subsequently treated as dynamic, although no dynamic tool was attached to that thread.

Read the stored transport and select dynamic only for dynamic-origin threads. Add MCP-to-auto and off-to-auto resume tests.

  • [Medium] The promised recovery after skills/changed cannot occur — src/cowork/controller.mjs:395, src/cowork/controller.mjs:1469

The notification invalidates the privacy lock and tells the user to start another turn, but #mcpConfigRequested remains true. No new inventory request occurs, while #mcpConfigLoaded = false permanently blocks the watcher.

Reset or rerun preflight on the next turn and test successful recovery.

  • [Low] Signal exits are collapsed to status 128 — src/runtime/launcher.mjs:215

SIGINT, SIGTERM, and SIGHUP all return 128 instead of the conventional 130, 143, and 129. This obscures the shutdown cause for shells and supervisors.

Map the signal number and add launcher lifecycle coverage.

Cowork findings

  • [High] MCP isolation becomes stale after initial preflight — src/cowork/controller.mjs:554

A newly added or enabled MCP server is absent from later background-thread deny configurations.

Refresh or revision-bind the capability lock before every background-thread start, and test post-preflight configuration changes.

  • [High] Skill discovery can omit a requested root without failing closed — src/cowork/skill-isolation.mjs:10

Validation compares entry counts rather than exact canonical roots. Duplicate /watcher results were accepted for expected /watcher and /repo roots, potentially leaving repository skills enabled.

Reject duplicate, missing, and unexpected roots.

  • [Medium] Free-form trace fields bypass redaction — src/cowork/trace.mjs:4, src/cowork/controller.mjs:882

reason, error, and message can persist verbatim user-derived text.

Use allowlisted operational codes or redact all free-form strings. Add nested canary tests.

  • [Medium] Benchmark containment is symlink-bypassable — src/workspace.mjs:9, src/evaluator.mjs:9

path.resolve provides only lexical containment.

Canonicalize paths with realpath, recheck them after creation, and reject symlinked seed paths.

  • [Medium] Nested fields can deanonymize blinded results — src/blinding.mjs:41

Nested metrics and checks can contain strategy, condition, or model identities.

Enforce strict recursive schemas and add nested identity canaries.

Combined conclusion

Not release-ready.

The two high-severity privacy-boundary defects should block release. The fallback and resume control defects also undermine documented core behavior.

A fresh npm test run passed all 81 unit tests and 7 integration tests, confirming that these are coverage gaps rather than existing test failures. Live, cost-bearing App Server smoke tests were not run.

No files were modified. The pre-existing executable-bit changes to bin/cowork.mjs and bin/cowork-eval.mjs remain unchanged.

Log in or sign up for Devpost to join the conversation.