Open-source the Codex VS Code extension (to complement the Apache-2.0 Codex CLI)

What feature would you like to see?

Summary

Please consider (again, if applicable) open-sourcing the Codex VS Code extension.

Filing this here because the CLI is already open, references the extension (including non-existent directories), and the extension’s source isn’t publicly discoverable; happy to re-file wherever you prefer.

Motivation

• Transparency & trust The extension runs code actions and can request elevated permissions; source availability allows organizations to audit exactly what the extension does. Recent waves of malicious or compromised extensions in the VS Code ecosystem highlight why auditability matters.
• Internal alignment The existing codebase heavily references the VS Code extension and even alludes to a codex-vscode directory. The extension is documented as being “built around the open source Codex CLI”, which already lives here under Apache-2.0. Open-sourcing the extension would align the IDE experience with the CLI’s openness; enable community review, contributions, and reproducible builds; and better comport with OpenAI's company name and origins.
• Ecosystem alignment Many flagship VS Code extensions (e.g., Microsoft’s Python extension) are fully open-source, which fosters healthy external contributions and faster issue turnaround. In my experience, a closed-source VS Code extension is unusual.
• Distribution parity An open repo would make it easier to ship the extension to both the Microsoft Marketplace and Open VSX for users of compatible editors (Theia, Gitpod, VSCodium).
• Community velocity The Codex CLI and related docs actively encourage community engagement; extending that to the IDE plugin lets contributors fix bugs, add features (e.g., MCP tooling, model toggles, approval modes), and improve platform compatibility (Windows/WSL, Cursor/Windsurf).

Scope requested

• Contents & location codex-vscode directory in this monorepo, per the existing reference above. (Alternatively a public repo: e.g., at openai/codex-vscode, with full TypeScript source, build pipeline, contribution guidelines and a Apache-2.0 [to match this repo] or similarly permissive license.)
• Build & release Document reproducible builds that produce the published .vsix; publish SHA256 checksums for release artifacts. (Marketplace listing currently points to the extension but no source is linked.)
• Telemetry & permissions Document any telemetry and all requested VS Code permissions (filesystem, network, shell), with configuration flags to disable telemetry entirely.
• Registries Publish to both Visual Studio Marketplace and Open VSX.

Benefits

• Auditable supply chain for security-sensitive orgs, addressing, e.g., TechRadar.
• Community fixes for platform quirks and IDE forks (VS Code Insiders, Cursor, Windsurf).
• Faster iteration on IDE-specific UX beyond what’s practical in the CLI alone.

Prior art / references

• Codex CLI (Apache-2.0): this repo.
• Docs: “The VS Code extension is built around the open source Codex CLI.”

(OpenAI Developers.)

• VS Code Marketplace entry for “Codex – OpenAI’s coding agent.”
• Open VSX (vendor-neutral extension registry) for broader distribution.

(ona.com.)

• Example of open-sourced major extension: microsoft/vscode-python.

Proposed acceptance criteria

• Contents (see above) containing the extension’s full source and build scripts.
• A CI pipeline that produces a .vsix whose hash matches the artifact published to the Marketplace/Open VSX.
• A short SECURITY.md describing the release process and how to verify builds.
• A PRIVACY.md describing telemetry and how to disable it.

Thank you for considering open-sourcing the IDE extension—doing so would meaningfully strengthen Codex’s security posture and accelerate community contributions alongside the already-open CLI.

Additional information

_No response_