From 2cbf2a6f08fc5471f6cff44ad5f0f0b515e6d5e9 Mon Sep 17 00:00:00 2001
From: Alexandre <44178713+alexbelgium@users.noreply.github.com>
Date: Tue, 14 Jul 2026 14:51:06 +0200
Subject: [PATCH 01/11] Add ChatGPT Codex add-on with Headroom and RTK

---
 chatgpt_codex/CHANGELOG.md                    |   8 +
 chatgpt_codex/Dockerfile                      | 158 ++++++++++++++++++
 chatgpt_codex/README.md                       | 111 ++++++++++++
 chatgpt_codex/build.json                      |   6 +
 chatgpt_codex/config.yaml                     |  69 ++++++++
 .../rootfs/etc/cont-init.d/20-folders.sh      |  46 +++++
 .../etc/cont-init.d/80-configuration.sh       |  33 ++++
 .../rootfs/etc/cont-init.d/82-codex-tools.sh  |  55 ++++++
 .../rootfs/etc/cont-init.d/83-github_cli.sh   |  29 ++++
 .../dependencies.d/init-services              |   0
 .../s6-overlay/s6-rc.d/svc-codex-terminal/run |  54 ++++++
 .../s6-rc.d/svc-codex-terminal/type           |   1 +
 .../user/contents.d/svc-codex-terminal        |   0
 .../rootfs/usr/local/bin/codex-direct         |   4 +
 .../rootfs/usr/local/bin/codex-headroom       |  15 ++
 .../rootfs/usr/local/bin/codex-login          |   4 +
 .../rootfs/usr/local/bin/codex-terminal-shell |  33 ++++
 chatgpt_codex/updater.json                    |   9 +
 18 files changed, 635 insertions(+)
 create mode 100644 chatgpt_codex/CHANGELOG.md
 create mode 100644 chatgpt_codex/Dockerfile
 create mode 100644 chatgpt_codex/README.md
 create mode 100644 chatgpt_codex/build.json
 create mode 100644 chatgpt_codex/config.yaml
 create mode 100644 chatgpt_codex/rootfs/etc/cont-init.d/20-folders.sh
 create mode 100644 chatgpt_codex/rootfs/etc/cont-init.d/80-configuration.sh
 create mode 100644 chatgpt_codex/rootfs/etc/cont-init.d/82-codex-tools.sh
 create mode 100644 chatgpt_codex/rootfs/etc/cont-init.d/83-github_cli.sh
 create mode 100644 chatgpt_codex/rootfs/etc/s6-overlay/s6-rc.d/svc-codex-terminal/dependencies.d/init-services
 create mode 100644 chatgpt_codex/rootfs/etc/s6-overlay/s6-rc.d/svc-codex-terminal/run
 create mode 100644 chatgpt_codex/rootfs/etc/s6-overlay/s6-rc.d/svc-codex-terminal/type
 create mode 100644 chatgpt_codex/rootfs/etc/s6-overlay/s6-rc.d/user/contents.d/svc-codex-terminal
 create mode 100644 chatgpt_codex/rootfs/usr/local/bin/codex-direct
 create mode 100644 chatgpt_codex/rootfs/usr/local/bin/codex-headroom
 create mode 100644 chatgpt_codex/rootfs/usr/local/bin/codex-login
 create mode 100644 chatgpt_codex/rootfs/usr/local/bin/codex-terminal-shell
 create mode 100644 chatgpt_codex/updater.json

diff --git a/chatgpt_codex/CHANGELOG.md b/chatgpt_codex/CHANGELOG.md
new file mode 100644
index 0000000000..9bc5b05de6
--- /dev/null
+++ b/chatgpt_codex/CHANGELOG.md
@@ -0,0 +1,8 @@
+## 0.1.0 (14-07-2026)
+
+- Initial ChatGPT Codex add-on.
+- Added a persistent Home Assistant ingress terminal backed by tmux.
+- Made `headroom wrap codex` the default launch path.
+- Added baked-in RTK with native Codex initialization and savings reporting.
+- Added device-code authentication and direct Codex fallback helpers.
+- Added persistent configuration, GitHub CLI integration, mount support, and safe defaults.
diff --git a/chatgpt_codex/Dockerfile b/chatgpt_codex/Dockerfile
new file mode 100644
index 0000000000..dec58d61f0
--- /dev/null
+++ b/chatgpt_codex/Dockerfile
@@ -0,0 +1,158 @@
+#============================#
+#  ALEXBELGIUM'S DOCKERFILE  #
+#============================#
+#=== Home Assistant Addon ===#
+
+#################
+# 1 Build Image #
+#################
+
+ARG BUILD_FROM
+ARG BUILD_VERSION
+ARG RTK_VERSION="v0.43.0"
+ARG RTK_COMMIT="5a7880d404db8364d602f2ecdc41dd790f64013f"
+
+FROM rust:1.91-bookworm AS rtk-builder
+ARG RTK_VERSION
+ARG RTK_COMMIT
+RUN git clone --depth 1 --branch "${RTK_VERSION}" https://github.com/rtk-ai/rtk.git /src/rtk && \
+    test "$(git -C /src/rtk rev-parse HEAD)" = "${RTK_COMMIT}" && \
+    cd /src/rtk && \
+    cargo build --release --locked && \
+    install -D -m 0755 target/release/rtk /out/rtk && \
+    /out/rtk --version
+
+FROM ${BUILD_FROM}
+
+##################
+# 2 Modify Image #
+##################
+
+ENV S6_CMD_WAIT_FOR_SERVICES=1 \
+    S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0 \
+    S6_SERVICES_GRACETIME=0 \
+    HEADROOM_CONTEXT_TOOL=rtk
+
+USER root
+VOLUME [ "/sys/fs/cgroup" ]
+
+ARG TEMPLATE_BASE_URL="https://raw.githubusercontent.com/alexbelgium/hassio-addons/master/.templates"
+ARG TTYD_VERSION="1.7.7"
+
+##################
+# 3 Install apps #
+##################
+
+COPY rootfs/ /
+RUN find /etc/cont-init.d /etc/s6-overlay /usr/local/bin \
+        -type f \( -name "*.sh" -o -name "run" -o -name "finish" -o -path "/usr/local/bin/*" \) \
+        -print -exec chmod +x {} \;
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        git \
+        gh \
+        jq \
+        less \
+        nano \
+        openssh-client \
+        python3-pip \
+        ripgrep \
+        tmux && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
+
+# Install the official Codex static binary for the target architecture.
+RUN set -eux; \
+    case "$(dpkg --print-architecture)" in \
+        amd64) codex_arch="x86_64" ;; \
+        arm64) codex_arch="aarch64" ;; \
+        *) echo "Unsupported architecture: $(dpkg --print-architecture)" >&2; exit 1 ;; \
+    esac; \
+    archive="/tmp/codex.tar.gz"; \
+    curl -fsSL --retry 3 --retry-delay 2 \
+        -o "$archive" \
+        "https://github.com/openai/codex/releases/latest/download/codex-${codex_arch}-unknown-linux-musl.tar.gz"; \
+    tar -xzf "$archive" -C /tmp; \
+    install -m 0755 "/tmp/codex-${codex_arch}-unknown-linux-musl" /usr/local/bin/codex; \
+    rm -f "$archive" "/tmp/codex-${codex_arch}-unknown-linux-musl"; \
+    codex --version
+
+# ttyd provides the Home Assistant ingress terminal.
+RUN set -eux; \
+    case "$(dpkg --print-architecture)" in \
+        amd64) ttyd_arch="x86_64" ;; \
+        arm64) ttyd_arch="aarch64" ;; \
+        *) echo "Unsupported architecture: $(dpkg --print-architecture)" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL --retry 3 --retry-delay 2 \
+        -o /usr/local/bin/ttyd \
+        "https://github.com/tsl0922/ttyd/releases/download/${TTYD_VERSION}/ttyd.${ttyd_arch}"; \
+    chmod 0755 /usr/local/bin/ttyd; \
+    ttyd --version
+
+COPY --from=rtk-builder /out/rtk /usr/local/bin/rtk
+RUN rtk --version && \
+    pip3 install --break-system-packages --no-cache-dir "headroom-ai[proxy,code,mcp]" && \
+    headroom --version
+
+ARG MODULES="00-banner.sh 00-global_var.sh 01-custom_script.sh 00-local_mounts.sh 00-smb_mounts.sh 90-dns_set.sh"
+RUN curl -fsSL --retry 3 --retry-delay 2 \
+        -o /ha_automodules.sh "${TEMPLATE_BASE_URL}/ha_automodules.sh" && \
+    chmod 744 /ha_automodules.sh && \
+    /ha_automodules.sh "$MODULES" && \
+    rm /ha_automodules.sh
+
+################
+# 4 Entrypoint #
+################
+
+RUN curl -fsSL --retry 3 --retry-delay 2 \
+        -o /ha_entrypoint.sh "${TEMPLATE_BASE_URL}/ha_entrypoint.sh" && \
+    curl -fsSL --retry 3 --retry-delay 2 \
+        -o /usr/local/lib/bashio-standalone.sh "${TEMPLATE_BASE_URL}/bashio-standalone.sh" && \
+    chmod 0777 /ha_entrypoint.sh && \
+    chmod 0755 /usr/local/lib/bashio-standalone.sh
+
+ENTRYPOINT [ "/usr/bin/env" ]
+CMD [ "/ha_entrypoint.sh" ]
+
+############
+# 5 Labels #
+############
+
+ARG BUILD_ARCH
+ARG BUILD_DATE
+ARG BUILD_DESCRIPTION
+ARG BUILD_NAME
+ARG BUILD_REF
+ARG BUILD_REPOSITORY
+ARG BUILD_VERSION
+ENV BUILD_VERSION="${BUILD_VERSION}"
+LABEL \
+    io.hass.name="${BUILD_NAME}" \
+    io.hass.description="${BUILD_DESCRIPTION}" \
+    io.hass.arch="${BUILD_ARCH}" \
+    io.hass.type="addon" \
+    io.hass.version=${BUILD_VERSION} \
+    maintainer="alexbelgium (https://github.com/alexbelgium)" \
+    org.opencontainers.image.title="${BUILD_NAME}" \
+    org.opencontainers.image.description="${BUILD_DESCRIPTION}" \
+    org.opencontainers.image.vendor="Home Assistant Add-ons" \
+    org.opencontainers.image.authors="alexbelgium (https://github.com/alexbelgium)" \
+    org.opencontainers.image.licenses="MIT" \
+    org.opencontainers.image.url="https://github.com/alexbelgium" \
+    org.opencontainers.image.source="https://github.com/${BUILD_REPOSITORY}" \
+    org.opencontainers.image.documentation="https://github.com/${BUILD_REPOSITORY}/blob/master/chatgpt_codex/README.md" \
+    org.opencontainers.image.created=${BUILD_DATE} \
+    org.opencontainers.image.revision=${BUILD_REF} \
+    org.opencontainers.image.version=${BUILD_VERSION}
+
+#################
+# 6 Healthcheck #
+#################
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s \
+    CMD curl -fsS http://127.0.0.1:7681/ > /dev/null || exit 1
diff --git a/chatgpt_codex/README.md b/chatgpt_codex/README.md
new file mode 100644
index 0000000000..c14fe43a15
--- /dev/null
+++ b/chatgpt_codex/README.md
@@ -0,0 +1,111 @@
+# Home Assistant add-on: ChatGPT Codex
+
+![Supports aarch64 Architecture][aarch64-shield]
+![Supports amd64 Architecture][amd64-shield]
+![Project Maintenance][maintenance-shield]
+
+Run the official OpenAI Codex CLI in a persistent Home Assistant ingress terminal. The optimized path uses `headroom wrap codex`, with RTK handling command-output compression before results reach Codex.
+
+> The repository already contains an unrelated add-on named **Codex** for comic archives. This coding-agent add-on therefore uses the slug `chatgpt_codex`.
+
+## Features
+
+- Official Codex CLI static binary for `amd64` and `aarch64`.
+- Home Assistant authenticated ingress; no unauthenticated terminal port is exposed.
+- Persistent `$HOME`, Codex authentication, settings, sessions, Headroom state, and RTK statistics.
+- Persistent `tmux` session that survives browser disconnects.
+- `headroom wrap codex` as the default launch path.
+- Baked-in RTK with native Codex initialization.
+- Optional Headroom output shaping and code-aware compression.
+- Direct Codex fallback for troubleshooting.
+- Device-code login helper designed for a remote or headless container.
+- Baked-in Git, GitHub CLI, ripgrep, jq, SSH client, and common terminal tools.
+- Optional GitHub CLI authentication and Git author configuration.
+- Optional extra apt and pip packages.
+- Local and SMB mount support through the repository standard modules.
+
+## Installation and first login
+
+1. Install **ChatGPT Codex** from this add-on repository.
+2. Keep the default `data_location` and `workspace`, or select writable mounted paths.
+3. Start the add-on and open its web UI.
+4. Codex starts automatically through Headroom.
+5. When prompted to authenticate, follow the device-code instructions. You can also exit Codex and run:
+
+```shell
+codex-login
+```
+
+Codex supports ChatGPT sign-in and API-key authentication. The device-code flow is the recommended option for this headless add-on.
+
+## Launch commands
+
+Optimized default:
+
+```shell
+codex-headroom
+```
+
+This runs:
+
+```shell
+headroom wrap codex
+```
+
+Headroom starts its local proxy, configures Codex routing and MCP support, and uses RTK as the CLI context tool.
+
+Direct troubleshooting path:
+
+```shell
+codex-direct
+```
+
+Check optimization status and measured savings:
+
+```shell
+headroom doctor
+headroom perf
+rtk gain
+```
+
+## Persistence
+
+The terminal attaches every browser connection to the same `tmux` session. Closing the browser detaches the client but does not stop Codex or commands running in the session.
+
+Persistent data is stored below `data_location`:
+
+- Codex state: `~/.codex`
+- Headroom state and metrics: `~/.headroom`
+- RTK state: its normal paths below the persistent home
+- Default workspace: `~/workspace`
+
+## Options
+
+| Option | Default | Description |
+| --- | --- | --- |
+| `data_location` | `/data/data` | Persistent home. Must be below `/data`, `/share`, `/media`, `/config`, or `/mnt`. |
+| `workspace` | `/data/data/workspace` | Initial project directory used by the persistent terminal. |
+| `PUID` / `PGID` | `0` / `0` | Runtime user and group used by the LinuxServer `abc` account. |
+| `TZ` | | Optional timezone, for example `Europe/Brussels`. |
+| `auto_start_codex` | `true` | Start Codex automatically when the tmux session is first created. |
+| `use_headroom` | `true` | Use `headroom wrap codex`; disabling this starts Codex directly. |
+| `headroom_output_shaper` | `true` | Enable Headroom output-token shaping. |
+| `headroom_code_aware` | `true` | Enable Headroom AST-aware code compression. |
+| `github_token` | | Authenticate GitHub CLI and Git operations. |
+| `github_username` / `github_email` | | Configure the global Git author. |
+| `additional_apps` | | Comma-separated Debian packages installed at startup. |
+| `additional_pip` | | Comma-separated Python packages installed at startup. |
+| `localdisks` / `networkdisks` | | Optional local-disk and SMB mounts supported by the repository modules. |
+| `env_vars` | `[]` | Additional environment variables exported in the container. |
+
+Configuration changes affecting the launch command apply to a newly created tmux session. To recreate it, exit Codex and run `tmux kill-session -t codex`, then reopen the add-on web UI.
+
+## Security
+
+The add-on deliberately does not enable Codex approval or sandbox bypass flags. Codex can execute commands and edit files available inside the configured workspace, so only mount locations you intend it to access.
+
+The terminal is exposed only through Home Assistant ingress. Do not add an unauthenticated direct port mapping. Treat `github_token`, Codex authentication data, and the persistent home as secrets and include them only in trusted backups.
+
+[aarch64-shield]: https://img.shields.io/badge/aarch64-yes-green.svg
+[amd64-shield]: https://img.shields.io/badge/amd64-yes-green.svg
+[maintenance-shield]: https://img.shields.io/maintenance/yes/2026.svg
diff --git a/chatgpt_codex/build.json b/chatgpt_codex/build.json
new file mode 100644
index 0000000000..e144598697
--- /dev/null
+++ b/chatgpt_codex/build.json
@@ -0,0 +1,6 @@
+{
+  "build_from": {
+    "aarch64": "ghcr.io/linuxserver/baseimage-debian:arm64v8-bookworm",
+    "amd64": "ghcr.io/linuxserver/baseimage-debian:amd64-bookworm"
+  }
+}
diff --git a/chatgpt_codex/config.yaml b/chatgpt_codex/config.yaml
new file mode 100644
index 0000000000..186bb80702
--- /dev/null
+++ b/chatgpt_codex/config.yaml
@@ -0,0 +1,69 @@
+arch:
+  - aarch64
+  - amd64
+description: "Persistent OpenAI Codex web terminal optimized with Headroom and RTK"
+devices:
+  - /dev/fuse
+environment:
+  HOME: /data/data
+  PGID: "0"
+  PUID: "0"
+  TERM: xterm-256color
+image: ghcr.io/alexbelgium/chatgpt_codex-{arch}
+ingress: true
+ingress_port: 7681
+ingress_stream: true
+init: false
+map:
+  - addon_config:rw
+  - share:rw
+  - media:rw
+  - ssl
+name: ChatGPT Codex
+options:
+  env_vars: []
+  DNS_server: 8.8.8.8
+  data_location: /data/data
+  workspace: /data/data/workspace
+  PUID: 0
+  PGID: 0
+  auto_start_codex: true
+  use_headroom: true
+  headroom_output_shaper: true
+  headroom_code_aware: true
+  github_token: ""
+  github_username: ""
+  github_email: ""
+  additional_apps: ""
+  additional_pip: ""
+panel_admin: false
+panel_icon: mdi:code-braces-box
+privileged:
+  - SYS_ADMIN
+  - DAC_READ_SEARCH
+schema:
+  env_vars:
+    - name: match(^[A-Za-z0-9_]+$)
+      value: str?
+  DNS_server: str?
+  data_location: str?
+  workspace: str?
+  PUID: int
+  PGID: int
+  TZ: match([A-Z][a-z]*./[A-Z][a-z]*.)?
+  auto_start_codex: bool
+  use_headroom: bool
+  headroom_output_shaper: bool
+  headroom_code_aware: bool
+  github_token: password?
+  github_username: str?
+  github_email: str?
+  additional_apps: str?
+  additional_pip: str?
+  localdisks: str?
+  networkdisks: str?
+slug: chatgpt_codex
+tmpfs: true
+udev: true
+url: https://github.com/alexbelgium/hassio-addons
+version: "0.1.0"
diff --git a/chatgpt_codex/rootfs/etc/cont-init.d/20-folders.sh b/chatgpt_codex/rootfs/etc/cont-init.d/20-folders.sh
new file mode 100644
index 0000000000..e9a763da7e
--- /dev/null
+++ b/chatgpt_codex/rootfs/etc/cont-init.d/20-folders.sh
@@ -0,0 +1,46 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+set -o pipefail
+
+PUID="$(bashio::config 'PUID')"
+PGID="$(bashio::config 'PGID')"
+LOCATION="$(bashio::config 'data_location')"
+
+if [ -z "$LOCATION" ] || [ "$LOCATION" = "null" ]; then
+    LOCATION="/data/data"
+fi
+
+case "$LOCATION" in
+    /data/* | /share/* | /media/* | /config/* | /mnt/*)
+        ;;
+    *)
+        bashio::log.fatal "data_location must be below /data, /share, /media, /config, or /mnt"
+        exit 1
+        ;;
+esac
+
+if [ -L "$LOCATION" ]; then
+    bashio::log.fatal "data_location must not be a symbolic link"
+    exit 1
+fi
+
+bashio::log.info "Using persistent home: $LOCATION"
+install -d -m 0750 -o "$PUID" -g "$PGID" "$LOCATION"
+install -d -m 0750 -o "$PUID" -g "$PGID" "$LOCATION/.codex" "$LOCATION/.headroom"
+install -d -m 0755 /tmp/cache /run/s6/container_environment
+
+sed -i "s|^\(abc:[^:]*:[^:]*:[^:]*:[^:]*:\)[^:]*|\1$LOCATION|" /etc/passwd
+
+for variable in HOME CODEX_HOME HEADROOM_WORKSPACE_DIR XDG_CACHE_HOME; do
+    case "$variable" in
+        HOME) value="$LOCATION" ;;
+        CODEX_HOME) value="$LOCATION/.codex" ;;
+        HEADROOM_WORKSPACE_DIR) value="$LOCATION/.headroom" ;;
+        XDG_CACHE_HOME) value="/tmp/cache" ;;
+    esac
+    printf '%s' "$value" > "/run/s6/container_environment/$variable"
+done
+
+chown -R "$PUID:$PGID" "$LOCATION/.codex" "$LOCATION/.headroom"
+chown "$PUID:$PGID" "$LOCATION"
diff --git a/chatgpt_codex/rootfs/etc/cont-init.d/80-configuration.sh b/chatgpt_codex/rootfs/etc/cont-init.d/80-configuration.sh
new file mode 100644
index 0000000000..e84fe7d441
--- /dev/null
+++ b/chatgpt_codex/rootfs/etc/cont-init.d/80-configuration.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+set -o pipefail
+
+if bashio::config.has_value 'additional_apps'; then
+    packages="$(bashio::config 'additional_apps')"
+    apt-get update -o Acquire::http::Timeout=10 -o Acquire::https::Timeout=10
+    for package in ${packages//,/ }; do
+        bashio::log.info "Installing apt package: $package"
+        apt-get install -y --no-install-recommends "$package"
+    done
+    apt-get clean
+    rm -rf /var/lib/apt/lists/*
+fi
+
+if bashio::config.has_value 'additional_pip'; then
+    packages="$(bashio::config 'additional_pip')"
+    for package in ${packages//,/ }; do
+        bashio::log.info "Installing pip package: $package"
+        pip3 install --break-system-packages "$package"
+    done
+fi
+
+if bashio::config.has_value 'TZ'; then
+    timezone="$(bashio::config 'TZ')"
+    if [ ! -e "/usr/share/zoneinfo/$timezone" ]; then
+        bashio::log.fatal "Invalid timezone: $timezone"
+        exit 1
+    fi
+    ln -snf "/usr/share/zoneinfo/$timezone" /etc/localtime
+    printf '%s\n' "$timezone" > /etc/timezone
+fi
diff --git a/chatgpt_codex/rootfs/etc/cont-init.d/82-codex-tools.sh b/chatgpt_codex/rootfs/etc/cont-init.d/82-codex-tools.sh
new file mode 100644
index 0000000000..5b4cac52f8
--- /dev/null
+++ b/chatgpt_codex/rootfs/etc/cont-init.d/82-codex-tools.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+set -o pipefail
+
+PUID="$(bashio::config 'PUID')"
+PGID="$(bashio::config 'PGID')"
+
+if ! command -v codex > /dev/null 2>&1; then
+    bashio::log.fatal "Codex CLI is not available"
+    exit 1
+fi
+if ! command -v headroom > /dev/null 2>&1; then
+    bashio::log.fatal "Headroom is not available"
+    exit 1
+fi
+if ! command -v rtk > /dev/null 2>&1; then
+    bashio::log.fatal "RTK is not available"
+    exit 1
+fi
+
+bashio::log.info "Codex: $(codex --version 2>&1 | head -n 1)"
+bashio::log.info "Headroom: $(headroom --version 2>&1 | head -n 1)"
+bashio::log.info "RTK: $(rtk --version 2>&1 | head -n 1)"
+
+# Configure RTK's native Codex integration ahead of the first wrapped session.
+if ! s6-setuidgid abc env \
+    HOME="$HOME" \
+    CODEX_HOME="${CODEX_HOME:-$HOME/.codex}" \
+    PATH="$HOME/.local/bin:/usr/local/bin:/usr/bin:/bin" \
+    RTK_NONINTERACTIVE=1 \
+    rtk init -g --codex; then
+    bashio::log.warning "RTK Codex initialization failed; Headroom will retry when wrapping Codex"
+fi
+
+for key in CODEX_AUTO_START CODEX_USE_HEADROOM HEADROOM_OUTPUT_SHAPER HEADROOM_CODE_AWARE_ENABLED; do
+    case "$key" in
+        CODEX_AUTO_START)
+            bashio::config.true 'auto_start_codex' && value="1" || value="0"
+            ;;
+        CODEX_USE_HEADROOM)
+            bashio::config.true 'use_headroom' && value="1" || value="0"
+            ;;
+        HEADROOM_OUTPUT_SHAPER)
+            bashio::config.true 'headroom_output_shaper' && value="1" || value="0"
+            ;;
+        HEADROOM_CODE_AWARE_ENABLED)
+            bashio::config.true 'headroom_code_aware' && value="1" || value="0"
+            ;;
+    esac
+    printf '%s' "$value" > "/run/s6/container_environment/$key"
+done
+printf '%s' 'rtk' > /run/s6/container_environment/HEADROOM_CONTEXT_TOOL
+
+chown -R "$PUID:$PGID" "$HOME/.codex" "$HOME/.headroom"
diff --git a/chatgpt_codex/rootfs/etc/cont-init.d/83-github_cli.sh b/chatgpt_codex/rootfs/etc/cont-init.d/83-github_cli.sh
new file mode 100644
index 0000000000..63cbe8ad64
--- /dev/null
+++ b/chatgpt_codex/rootfs/etc/cont-init.d/83-github_cli.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+set -o pipefail
+
+if bashio::config.has_value 'github_username'; then
+    s6-setuidgid abc git config --global user.name "$(bashio::config 'github_username')"
+fi
+
+if bashio::config.has_value 'github_email'; then
+    s6-setuidgid abc git config --global user.email "$(bashio::config 'github_email')"
+fi
+
+if bashio::config.has_value 'github_token'; then
+    token="$(bashio::config 'github_token')"
+    if s6-setuidgid abc env -u GH_TOKEN -u GITHUB_TOKEN gh auth status --hostname github.com > /dev/null 2>&1; then
+        bashio::log.info "GitHub CLI is already authenticated"
+    else
+        bashio::log.info "Authenticating GitHub CLI"
+        printf '%s\n' "$token" | s6-setuidgid abc env -u GH_TOKEN -u GITHUB_TOKEN \
+            gh auth login --hostname github.com --with-token || \
+            bashio::log.warning "GitHub CLI authentication failed"
+    fi
+    s6-setuidgid abc env -u GH_TOKEN -u GITHUB_TOKEN \
+        gh auth setup-git --hostname github.com || \
+        bashio::log.warning "GitHub CLI git credential setup failed"
+else
+    bashio::log.info "Set github_token to authenticate gh and Git operations"
+fi
diff --git a/chatgpt_codex/rootfs/etc/s6-overlay/s6-rc.d/svc-codex-terminal/dependencies.d/init-services b/chatgpt_codex/rootfs/etc/s6-overlay/s6-rc.d/svc-codex-terminal/dependencies.d/init-services
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/chatgpt_codex/rootfs/etc/s6-overlay/s6-rc.d/svc-codex-terminal/run b/chatgpt_codex/rootfs/etc/s6-overlay/s6-rc.d/svc-codex-terminal/run
new file mode 100644
index 0000000000..d89e100562
--- /dev/null
+++ b/chatgpt_codex/rootfs/etc/s6-overlay/s6-rc.d/svc-codex-terminal/run
@@ -0,0 +1,54 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+set -o pipefail
+
+port=7681
+workspace="$(bashio::config 'workspace')"
+
+if [ -z "$workspace" ] || [ "$workspace" = "null" ]; then
+    workspace="$HOME/workspace"
+fi
+
+if [[ "$workspace" != /* ]]; then
+    bashio::log.fatal "workspace must be an absolute path"
+    exec sleep infinity
+fi
+if [ -L "$workspace" ]; then
+    bashio::log.fatal "workspace must not be a symbolic link"
+    exec sleep infinity
+fi
+
+workspace="$(realpath -m -- "$workspace")"
+case "$workspace" in
+    "$HOME" | "$HOME"/* | /share/* | /media/* | /mnt/* | /data/* | /config/*)
+        ;;
+    *)
+        bashio::log.fatal "workspace must be below the persistent home, /share, /media, /mnt, /data, or /config"
+        exec sleep infinity
+        ;;
+esac
+
+if [ ! -e "$workspace" ]; then
+    install -d -m 0750 -o abc -g abc "$workspace"
+elif [ ! -d "$workspace" ]; then
+    bashio::log.fatal "workspace is not a directory: $workspace"
+    exec sleep infinity
+fi
+
+if ! s6-setuidgid abc test -r "$workspace" || \
+    ! s6-setuidgid abc test -w "$workspace" || \
+    ! s6-setuidgid abc test -x "$workspace"; then
+    bashio::log.fatal "workspace must be readable, writable, and searchable by user abc: $workspace"
+    exec sleep infinity
+fi
+
+export CODEX_TERMINAL_WORKSPACE="$workspace"
+bashio::log.info "Starting persistent Codex terminal on Home Assistant ingress port $port"
+exec s6-setuidgid abc ttyd \
+    -p "$port" \
+    -W \
+    -O \
+    -t disableLeaveAlert=true \
+    -t fontSize=14 \
+    /usr/local/bin/codex-terminal-shell
diff --git a/chatgpt_codex/rootfs/etc/s6-overlay/s6-rc.d/svc-codex-terminal/type b/chatgpt_codex/rootfs/etc/s6-overlay/s6-rc.d/svc-codex-terminal/type
new file mode 100644
index 0000000000..5883cff0cd
--- /dev/null
+++ b/chatgpt_codex/rootfs/etc/s6-overlay/s6-rc.d/svc-codex-terminal/type
@@ -0,0 +1 @@
+longrun
diff --git a/chatgpt_codex/rootfs/etc/s6-overlay/s6-rc.d/user/contents.d/svc-codex-terminal b/chatgpt_codex/rootfs/etc/s6-overlay/s6-rc.d/user/contents.d/svc-codex-terminal
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/chatgpt_codex/rootfs/usr/local/bin/codex-direct b/chatgpt_codex/rootfs/usr/local/bin/codex-direct
new file mode 100644
index 0000000000..a6eb886dcc
--- /dev/null
+++ b/chatgpt_codex/rootfs/usr/local/bin/codex-direct
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+export PATH="${HOME}/.local/bin:/usr/local/bin:/usr/bin:/bin:${PATH:-}"
+exec codex "$@"
diff --git a/chatgpt_codex/rootfs/usr/local/bin/codex-headroom b/chatgpt_codex/rootfs/usr/local/bin/codex-headroom
new file mode 100644
index 0000000000..1e86dc6102
--- /dev/null
+++ b/chatgpt_codex/rootfs/usr/local/bin/codex-headroom
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+export PATH="${HOME}/.local/bin:/usr/local/bin:/usr/bin:/bin:${PATH:-}"
+export HEADROOM_CONTEXT_TOOL="rtk"
+
+if ! command -v headroom > /dev/null 2>&1; then
+    echo "Headroom is unavailable; launching Codex directly." >&2
+    exec codex "$@"
+fi
+
+if [ "$#" -eq 0 ]; then
+    exec headroom wrap codex
+fi
+exec headroom wrap codex -- "$@"
diff --git a/chatgpt_codex/rootfs/usr/local/bin/codex-login b/chatgpt_codex/rootfs/usr/local/bin/codex-login
new file mode 100644
index 0000000000..954f654a6e
--- /dev/null
+++ b/chatgpt_codex/rootfs/usr/local/bin/codex-login
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+export PATH="${HOME}/.local/bin:/usr/local/bin:/usr/bin:/bin:${PATH:-}"
+exec codex login --device-auth "$@"
diff --git a/chatgpt_codex/rootfs/usr/local/bin/codex-terminal-shell b/chatgpt_codex/rootfs/usr/local/bin/codex-terminal-shell
new file mode 100644
index 0000000000..7e6d3cd972
--- /dev/null
+++ b/chatgpt_codex/rootfs/usr/local/bin/codex-terminal-shell
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+export SHELL="/bin/bash"
+export PATH="${HOME}/.local/bin:/usr/local/bin:/usr/bin:/bin:${PATH:-}"
+
+workspace="${CODEX_TERMINAL_WORKSPACE:-${HOME}/workspace}"
+session_name="${CODEX_TMUX_SESSION:-codex}"
+
+if [ ! -d "$workspace" ]; then
+    echo "Codex workspace does not exist: $workspace" >&2
+    exit 1
+fi
+
+new_session=0
+if ! tmux has-session -t "$session_name" 2> /dev/null; then
+    tmux new-session -d -s "$session_name" -c "$workspace" /bin/bash -l
+    new_session=1
+fi
+
+if [ "$new_session" -eq 1 ]; then
+    tmux send-keys -t "$session_name" \
+        "printf '\\nChatGPT Codex add-on\\n  login: codex-login\\n  optimized: codex-headroom\\n  direct: codex-direct\\n  savings: rtk gain && headroom perf\\n\\n'" C-m
+    if [ "${CODEX_AUTO_START:-1}" = "1" ]; then
+        if [ "${CODEX_USE_HEADROOM:-1}" = "1" ]; then
+            tmux send-keys -t "$session_name" "codex-headroom" C-m
+        else
+            tmux send-keys -t "$session_name" "codex-direct" C-m
+        fi
+    fi
+fi
+
+exec tmux attach-session -t "$session_name"
diff --git a/chatgpt_codex/updater.json b/chatgpt_codex/updater.json
new file mode 100644
index 0000000000..245fd3e67a
--- /dev/null
+++ b/chatgpt_codex/updater.json
@@ -0,0 +1,9 @@
+{
+  "github_beta": false,
+  "last_update": "2026-07-14",
+  "repository": "alexbelgium/hassio-addons",
+  "slug": "chatgpt_codex",
+  "source": "github",
+  "upstream_repo": "openai/codex",
+  "upstream_version": "0.1.0"
+}

From df0dacf6b99a4fad1803cbc9cd23f943aed3a42e Mon Sep 17 00:00:00 2001
From: Alexandre <44178713+alexbelgium@users.noreply.github.com>
Date: Tue, 14 Jul 2026 14:53:30 +0200
Subject: [PATCH 02/11] Restrict Codex ingress to administrators

---
 chatgpt_codex/config.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/chatgpt_codex/config.yaml b/chatgpt_codex/config.yaml
index 186bb80702..874b41e359 100644
--- a/chatgpt_codex/config.yaml
+++ b/chatgpt_codex/config.yaml
@@ -36,7 +36,7 @@ options:
   github_email: ""
   additional_apps: ""
   additional_pip: ""
-panel_admin: false
+panel_admin: true
 panel_icon: mdi:code-braces-box
 privileged:
   - SYS_ADMIN

From 12384ee606bf02c272e215723cbd4c7305445fa5 Mon Sep 17 00:00:00 2001
From: Alexandre <44178713+alexbelgium@users.noreply.github.com>
Date: Tue, 14 Jul 2026 14:55:02 +0200
Subject: [PATCH 03/11] Follow custom data location for Codex workspace

---
 chatgpt_codex/README.md   | 6 +++---
 chatgpt_codex/config.yaml | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/chatgpt_codex/README.md b/chatgpt_codex/README.md
index c14fe43a15..f55a170d85 100644
--- a/chatgpt_codex/README.md
+++ b/chatgpt_codex/README.md
@@ -11,7 +11,7 @@ Run the official OpenAI Codex CLI in a persistent Home Assistant ingress termina
 ## Features
 
 - Official Codex CLI static binary for `amd64` and `aarch64`.
-- Home Assistant authenticated ingress; no unauthenticated terminal port is exposed.
+- Home Assistant authenticated, administrator-only ingress; no unauthenticated terminal port is exposed.
 - Persistent `$HOME`, Codex authentication, settings, sessions, Headroom state, and RTK statistics.
 - Persistent `tmux` session that survives browser disconnects.
 - `headroom wrap codex` as the default launch path.
@@ -84,7 +84,7 @@ Persistent data is stored below `data_location`:
 | Option | Default | Description |
 | --- | --- | --- |
 | `data_location` | `/data/data` | Persistent home. Must be below `/data`, `/share`, `/media`, `/config`, or `/mnt`. |
-| `workspace` | `/data/data/workspace` | Initial project directory used by the persistent terminal. |
+| `workspace` | `<data_location>/workspace` | Initial project directory. Leave empty to follow `data_location`. |
 | `PUID` / `PGID` | `0` / `0` | Runtime user and group used by the LinuxServer `abc` account. |
 | `TZ` | | Optional timezone, for example `Europe/Brussels`. |
 | `auto_start_codex` | `true` | Start Codex automatically when the tmux session is first created. |
@@ -104,7 +104,7 @@ Configuration changes affecting the launch command apply to a newly created tmux
 
 The add-on deliberately does not enable Codex approval or sandbox bypass flags. Codex can execute commands and edit files available inside the configured workspace, so only mount locations you intend it to access.
 
-The terminal is exposed only through Home Assistant ingress. Do not add an unauthenticated direct port mapping. Treat `github_token`, Codex authentication data, and the persistent home as secrets and include them only in trusted backups.
+The terminal is exposed only through Home Assistant administrator-only ingress. Do not add an unauthenticated direct port mapping. Treat `github_token`, Codex authentication data, and the persistent home as secrets and include them only in trusted backups.
 
 [aarch64-shield]: https://img.shields.io/badge/aarch64-yes-green.svg
 [amd64-shield]: https://img.shields.io/badge/amd64-yes-green.svg
diff --git a/chatgpt_codex/config.yaml b/chatgpt_codex/config.yaml
index 874b41e359..748c842a50 100644
--- a/chatgpt_codex/config.yaml
+++ b/chatgpt_codex/config.yaml
@@ -24,7 +24,7 @@ options:
   env_vars: []
   DNS_server: 8.8.8.8
   data_location: /data/data
-  workspace: /data/data/workspace
+  workspace: ""
   PUID: 0
   PGID: 0
   auto_start_codex: true

From 78f5289518ba21a8b62808e86efcf606e7a5ed83 Mon Sep 17 00:00:00 2001
From: Alexandre <44178713+alexbelgium@users.noreply.github.com>
Date: Tue, 14 Jul 2026 14:59:11 +0200
Subject: [PATCH 04/11] Fix Codex add-on lint metadata

---
 chatgpt_codex/CHANGELOG.md | 3 ++-
 chatgpt_codex/config.yaml  | 1 -
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/chatgpt_codex/CHANGELOG.md b/chatgpt_codex/CHANGELOG.md
index 9bc5b05de6..3ff9e8f518 100644
--- a/chatgpt_codex/CHANGELOG.md
+++ b/chatgpt_codex/CHANGELOG.md
@@ -1,8 +1,9 @@
 ## 0.1.0 (14-07-2026)
 
 - Initial ChatGPT Codex add-on.
-- Added a persistent Home Assistant ingress terminal backed by tmux.
+- Added a persistent, administrator-only Home Assistant ingress terminal backed by tmux.
 - Made `headroom wrap codex` the default launch path.
 - Added baked-in RTK with native Codex initialization and savings reporting.
 - Added device-code authentication and direct Codex fallback helpers.
 - Added persistent configuration, GitHub CLI integration, mount support, and safe defaults.
+- Made the default workspace follow a custom `data_location`.
diff --git a/chatgpt_codex/config.yaml b/chatgpt_codex/config.yaml
index 748c842a50..3a3be1bf19 100644
--- a/chatgpt_codex/config.yaml
+++ b/chatgpt_codex/config.yaml
@@ -36,7 +36,6 @@ options:
   github_email: ""
   additional_apps: ""
   additional_pip: ""
-panel_admin: true
 panel_icon: mdi:code-braces-box
 privileged:
   - SYS_ADMIN

From 652be8b13cc641d74343ebaf4cd4c17122116006 Mon Sep 17 00:00:00 2001
From: Alexandre <44178713+alexbelgium@users.noreply.github.com>
Date: Tue, 14 Jul 2026 15:03:34 +0200
Subject: [PATCH 05/11] Pin Codex and Headroom releases

---
 chatgpt_codex/CHANGELOG.md |  6 +++---
 chatgpt_codex/Dockerfile   | 10 +++++++---
 chatgpt_codex/config.yaml  |  2 +-
 chatgpt_codex/updater.json |  5 ++++-
 4 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/chatgpt_codex/CHANGELOG.md b/chatgpt_codex/CHANGELOG.md
index 3ff9e8f518..af2bb098ca 100644
--- a/chatgpt_codex/CHANGELOG.md
+++ b/chatgpt_codex/CHANGELOG.md
@@ -1,9 +1,9 @@
-## 0.1.0 (14-07-2026)
+## 0.144.3 (14-07-2026)
 
-- Initial ChatGPT Codex add-on.
+- Initial ChatGPT Codex add-on based on Codex `0.144.3`.
 - Added a persistent, administrator-only Home Assistant ingress terminal backed by tmux.
 - Made `headroom wrap codex` the default launch path.
-- Added baked-in RTK with native Codex initialization and savings reporting.
+- Pinned Headroom `0.31.0` and baked-in RTK `0.43.0` with native Codex initialization and savings reporting.
 - Added device-code authentication and direct Codex fallback helpers.
 - Added persistent configuration, GitHub CLI integration, mount support, and safe defaults.
 - Made the default workspace follow a custom `data_location`.
diff --git a/chatgpt_codex/Dockerfile b/chatgpt_codex/Dockerfile
index dec58d61f0..db7df5ecae 100644
--- a/chatgpt_codex/Dockerfile
+++ b/chatgpt_codex/Dockerfile
@@ -9,6 +9,8 @@
 
 ARG BUILD_FROM
 ARG BUILD_VERSION
+ARG BUILD_UPSTREAM="0.144.3"
+ARG HEADROOM_VERSION="0.31.0"
 ARG RTK_VERSION="v0.43.0"
 ARG RTK_COMMIT="5a7880d404db8364d602f2ecdc41dd790f64013f"
 
@@ -38,6 +40,8 @@ VOLUME [ "/sys/fs/cgroup" ]
 
 ARG TEMPLATE_BASE_URL="https://raw.githubusercontent.com/alexbelgium/hassio-addons/master/.templates"
 ARG TTYD_VERSION="1.7.7"
+ARG BUILD_UPSTREAM
+ARG HEADROOM_VERSION
 
 ##################
 # 3 Install apps #
@@ -64,7 +68,7 @@ RUN apt-get update && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
 
-# Install the official Codex static binary for the target architecture.
+# Install the pinned official Codex static binary for the target architecture.
 RUN set -eux; \
     case "$(dpkg --print-architecture)" in \
         amd64) codex_arch="x86_64" ;; \
@@ -74,7 +78,7 @@ RUN set -eux; \
     archive="/tmp/codex.tar.gz"; \
     curl -fsSL --retry 3 --retry-delay 2 \
         -o "$archive" \
-        "https://github.com/openai/codex/releases/latest/download/codex-${codex_arch}-unknown-linux-musl.tar.gz"; \
+        "https://github.com/openai/codex/releases/download/rust-v${BUILD_UPSTREAM}/codex-${codex_arch}-unknown-linux-musl.tar.gz"; \
     tar -xzf "$archive" -C /tmp; \
     install -m 0755 "/tmp/codex-${codex_arch}-unknown-linux-musl" /usr/local/bin/codex; \
     rm -f "$archive" "/tmp/codex-${codex_arch}-unknown-linux-musl"; \
@@ -95,7 +99,7 @@ RUN set -eux; \
 
 COPY --from=rtk-builder /out/rtk /usr/local/bin/rtk
 RUN rtk --version && \
-    pip3 install --break-system-packages --no-cache-dir "headroom-ai[proxy,code,mcp]" && \
+    pip3 install --break-system-packages --no-cache-dir "headroom-ai[proxy,code,mcp]==${HEADROOM_VERSION}" && \
     headroom --version
 
 ARG MODULES="00-banner.sh 00-global_var.sh 01-custom_script.sh 00-local_mounts.sh 00-smb_mounts.sh 90-dns_set.sh"
diff --git a/chatgpt_codex/config.yaml b/chatgpt_codex/config.yaml
index 3a3be1bf19..1e25674567 100644
--- a/chatgpt_codex/config.yaml
+++ b/chatgpt_codex/config.yaml
@@ -65,4 +65,4 @@ slug: chatgpt_codex
 tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "0.1.0"
+version: "0.144.3"
diff --git a/chatgpt_codex/updater.json b/chatgpt_codex/updater.json
index 245fd3e67a..ad08b16d81 100644
--- a/chatgpt_codex/updater.json
+++ b/chatgpt_codex/updater.json
@@ -1,9 +1,12 @@
 {
   "github_beta": false,
+  "github_fulltag": false,
+  "github_havingasset": true,
+  "github_tagfilter": "rust-v",
   "last_update": "2026-07-14",
   "repository": "alexbelgium/hassio-addons",
   "slug": "chatgpt_codex",
   "source": "github",
   "upstream_repo": "openai/codex",
-  "upstream_version": "0.1.0"
+  "upstream_version": "0.144.3"
 }

From 34e8a75bf8ea96547fb87d70be892839e29bf8e0 Mon Sep 17 00:00:00 2001
From: Alexandre <44178713+alexbelgium@users.noreply.github.com>
Date: Tue, 14 Jul 2026 15:58:55 +0200
Subject: [PATCH 06/11] Install latest tool releases at build time

---
 chatgpt_codex/Dockerfile | 35 +++++++++++++++--------------------
 1 file changed, 15 insertions(+), 20 deletions(-)

diff --git a/chatgpt_codex/Dockerfile b/chatgpt_codex/Dockerfile
index db7df5ecae..7288a6ae0b 100644
--- a/chatgpt_codex/Dockerfile
+++ b/chatgpt_codex/Dockerfile
@@ -9,19 +9,17 @@
 
 ARG BUILD_FROM
 ARG BUILD_VERSION
-ARG BUILD_UPSTREAM="0.144.3"
-ARG HEADROOM_VERSION="0.31.0"
-ARG RTK_VERSION="v0.43.0"
-ARG RTK_COMMIT="5a7880d404db8364d602f2ecdc41dd790f64013f"
 
-FROM rust:1.91-bookworm AS rtk-builder
-ARG RTK_VERSION
-ARG RTK_COMMIT
-RUN git clone --depth 1 --branch "${RTK_VERSION}" https://github.com/rtk-ai/rtk.git /src/rtk && \
-    test "$(git -C /src/rtk rev-parse HEAD)" = "${RTK_COMMIT}" && \
-    cd /src/rtk && \
-    cargo build --release --locked && \
-    install -D -m 0755 target/release/rtk /out/rtk && \
+FROM rust:bookworm AS rtk-builder
+RUN set -eux; \
+    rtk_version="$(git ls-remote --tags --refs --sort=-v:refname \
+        https://github.com/rtk-ai/rtk.git 'refs/tags/v*' \
+        | awk -F/ '$3 ~ /^v[0-9]+\.[0-9]+\.[0-9]+$/ { print $3; exit }')"; \
+    test -n "$rtk_version"; \
+    git clone --depth 1 --branch "$rtk_version" https://github.com/rtk-ai/rtk.git /src/rtk; \
+    cd /src/rtk; \
+    cargo build --release --locked; \
+    install -D -m 0755 target/release/rtk /out/rtk; \
     /out/rtk --version
 
 FROM ${BUILD_FROM}
@@ -39,9 +37,6 @@ USER root
 VOLUME [ "/sys/fs/cgroup" ]
 
 ARG TEMPLATE_BASE_URL="https://raw.githubusercontent.com/alexbelgium/hassio-addons/master/.templates"
-ARG TTYD_VERSION="1.7.7"
-ARG BUILD_UPSTREAM
-ARG HEADROOM_VERSION
 
 ##################
 # 3 Install apps #
@@ -68,7 +63,7 @@ RUN apt-get update && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
 
-# Install the pinned official Codex static binary for the target architecture.
+# Install the latest stable official Codex static binary for the target architecture.
 RUN set -eux; \
     case "$(dpkg --print-architecture)" in \
         amd64) codex_arch="x86_64" ;; \
@@ -78,13 +73,13 @@ RUN set -eux; \
     archive="/tmp/codex.tar.gz"; \
     curl -fsSL --retry 3 --retry-delay 2 \
         -o "$archive" \
-        "https://github.com/openai/codex/releases/download/rust-v${BUILD_UPSTREAM}/codex-${codex_arch}-unknown-linux-musl.tar.gz"; \
+        "https://github.com/openai/codex/releases/latest/download/codex-${codex_arch}-unknown-linux-musl.tar.gz"; \
     tar -xzf "$archive" -C /tmp; \
     install -m 0755 "/tmp/codex-${codex_arch}-unknown-linux-musl" /usr/local/bin/codex; \
     rm -f "$archive" "/tmp/codex-${codex_arch}-unknown-linux-musl"; \
     codex --version
 
-# ttyd provides the Home Assistant ingress terminal.
+# Install the latest stable ttyd binary for the Home Assistant ingress terminal.
 RUN set -eux; \
     case "$(dpkg --print-architecture)" in \
         amd64) ttyd_arch="x86_64" ;; \
@@ -93,13 +88,13 @@ RUN set -eux; \
     esac; \
     curl -fsSL --retry 3 --retry-delay 2 \
         -o /usr/local/bin/ttyd \
-        "https://github.com/tsl0922/ttyd/releases/download/${TTYD_VERSION}/ttyd.${ttyd_arch}"; \
+        "https://github.com/tsl0922/ttyd/releases/latest/download/ttyd.${ttyd_arch}"; \
     chmod 0755 /usr/local/bin/ttyd; \
     ttyd --version
 
 COPY --from=rtk-builder /out/rtk /usr/local/bin/rtk
 RUN rtk --version && \
-    pip3 install --break-system-packages --no-cache-dir "headroom-ai[proxy,code,mcp]==${HEADROOM_VERSION}" && \
+    pip3 install --upgrade --break-system-packages --no-cache-dir "headroom-ai[proxy,code,mcp]" && \
     headroom --version
 
 ARG MODULES="00-banner.sh 00-global_var.sh 01-custom_script.sh 00-local_mounts.sh 00-smb_mounts.sh 90-dns_set.sh"

From 7de4789196ca7f741957e23b51c8eef4926381f8 Mon Sep 17 00:00:00 2001
From: Alexandre <44178713+alexbelgium@users.noreply.github.com>
Date: Tue, 14 Jul 2026 15:59:05 +0200
Subject: [PATCH 07/11] Document unpinned tool installation

---
 chatgpt_codex/CHANGELOG.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/chatgpt_codex/CHANGELOG.md b/chatgpt_codex/CHANGELOG.md
index af2bb098ca..976fc0e07a 100644
--- a/chatgpt_codex/CHANGELOG.md
+++ b/chatgpt_codex/CHANGELOG.md
@@ -1,9 +1,10 @@
 ## 0.144.3 (14-07-2026)
 
-- Initial ChatGPT Codex add-on based on Codex `0.144.3`.
+- Initial ChatGPT Codex add-on.
 - Added a persistent, administrator-only Home Assistant ingress terminal backed by tmux.
 - Made `headroom wrap codex` the default launch path.
-- Pinned Headroom `0.31.0` and baked-in RTK `0.43.0` with native Codex initialization and savings reporting.
+- Configured Docker builds to install the latest stable Codex, Headroom, RTK, ttyd, and Rust toolchain versions without hard-coded tool version pins.
+- Added RTK native Codex initialization and savings reporting.
 - Added device-code authentication and direct Codex fallback helpers.
 - Added persistent configuration, GitHub CLI integration, mount support, and safe defaults.
 - Made the default workspace follow a custom `data_location`.

From bf97abdb4fde8e9d2fc28537002b45eceff64be5 Mon Sep 17 00:00:00 2001
From: Alexandre <44178713+alexbelgium@users.noreply.github.com>
Date: Tue, 14 Jul 2026 16:00:44 +0200
Subject: [PATCH 08/11] Document latest-version build policy

---
 chatgpt_codex/README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/chatgpt_codex/README.md b/chatgpt_codex/README.md
index f55a170d85..4b11570b7f 100644
--- a/chatgpt_codex/README.md
+++ b/chatgpt_codex/README.md
@@ -10,6 +10,7 @@ Run the official OpenAI Codex CLI in a persistent Home Assistant ingress termina
 
 ## Features
 
+- Latest stable Codex, Headroom, RTK, ttyd, and Rust toolchain versions are resolved during every Docker build; tool versions are not pinned in the Dockerfile.
 - Official Codex CLI static binary for `amd64` and `aarch64`.
 - Home Assistant authenticated, administrator-only ingress; no unauthenticated terminal port is exposed.
 - Persistent `$HOME`, Codex authentication, settings, sessions, Headroom state, and RTK statistics.

From 2b6c9eace7532f6cd67c36b04cef21ce4b6d0258 Mon Sep 17 00:00:00 2001
From: Alexandre <44178713+alexbelgium@users.noreply.github.com>
Date: Tue, 14 Jul 2026 16:04:13 +0200
Subject: [PATCH 11/11] Release latest-version build policy

---
 chatgpt_codex/CHANGELOG.md | 2 +-
 chatgpt_codex/config.yaml  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/chatgpt_codex/CHANGELOG.md b/chatgpt_codex/CHANGELOG.md
index 976fc0e07a..74222091ca 100644
--- a/chatgpt_codex/CHANGELOG.md
+++ b/chatgpt_codex/CHANGELOG.md
@@ -1,4 +1,4 @@
-## 0.144.3 (14-07-2026)
+## 0.144.3-2 (14-07-2026)
 
 - Initial ChatGPT Codex add-on.
 - Added a persistent, administrator-only Home Assistant ingress terminal backed by tmux.
diff --git a/chatgpt_codex/config.yaml b/chatgpt_codex/config.yaml
index 1e25674567..306ca11475 100644
--- a/chatgpt_codex/config.yaml
+++ b/chatgpt_codex/config.yaml
@@ -65,4 +65,4 @@ slug: chatgpt_codex
 tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "0.144.3"
+version: "0.144.3-2"