中文 | English
CodexPanel is a local desktop control panel for controlling the Codex Desktop app from another device. The desktop app manages a local Node sidecar service, shows the local/remote entry points, and keeps secrets out of release bundles. The remote control surface is still opened from a phone or another browser.
This repository contains the open local-control implementation:
- Discussion address: linux.do
- Project name:
CodexPanel - Desktop package: Wails portable bundle plus Windows installer
- Windows installer:
CodexPanel-Setup-<version>.exe - Windows portable output:
CodexPanel.exepluscodexpanel-node-sidecar.exe - Local panel: desktop WebView, no browser jump required
- Remote control: browser/mobile page through LAN or Cloudflare relay
- Local service controls: start and stop are handled by the desktop client
flowchart LR
Desktop["CodexPanel Desktop<br/>Wails WebView"]
GoHost["Go host<br/>window + sidecar lifecycle"]
Sidecar["Node sidecar<br/>local HTTP service"]
Codex["Codex Desktop<br/>local GUI/session"]
Phone["Phone/browser<br/>remote UI"]
Relay["Cloudflare relay<br/>optional WAN bridge"]
Desktop --> GoHost
GoHost --> Sidecar
Sidecar --> Codex
Phone --> Sidecar
Phone --> Relay
Relay --> Sidecar
The desktop window serves public/control.html through the Wails asset server.
Go owns the sidecar process and proxies /codex/* requests to the local Node
service, so desktop buttons can start and stop the service without asking the
user to open a terminal.
The Node sidecar serves:
public/control.htmlfor the desktop control panel.public/index.htmlfor the remote/mobile control page./codex/control-statusfor service status./codex/control-configfor local panel configuration./codex/service-checkfor diagnostics.- Codex thread, send, stop, file, and automation endpoints used by the remote UI.
CodexPanel.exestarts.- Go reads the saved local panel config from
~/.codex/state.json. - Go generates a local control token for the WebView session.
- Go starts
codexpanel-node-sidecarwith runtime environment variables. - The sidecar runs the local HTTP service on the configured port.
- The desktop WebView opens the embedded control panel and receives the token through Wails bindings.
- The panel displays status, local entry, remote entry, PID, device ID, and uptime.
- The phone opens the LAN URL or the Cloudflare WAN URL in a browser.
- The sidecar talks to Codex Desktop in the current logged-in desktop session.
The local token is generated at runtime and is not packaged. The remote key and Cloudflare URL are user configuration values and are read from local state or environment variables when the sidecar starts.
The build scripts deliberately refuse to bundle user state or secrets:
.env.env.local.env.productionstate.json.codex/
Generated binaries and local deployment files are also ignored by git:
build/bin/build/tmp/frontend/wailsjs/.build/cloudflare/wrangler.tomlcloudflare/pages/wrangler.toml
Commit *.example files for deployment templates. Keep real keys and local
Cloudflare account configuration outside the repository.
Desktop development:
- Node.js 18+
- Go 1.23+
- Wails CLI v2.12+
- Windows: Microsoft Edge WebView2 Runtime
- Windows installer builds: Inno Setup 6
- Linux: GTK/WebKitGTK development packages
- macOS: Xcode command line tools
Ubuntu development support is documented in docs/UBUNTU_DEVELOPMENT.md.
Install dependencies:
npm ciRun syntax checks:
npm run check
node --check windows/node-sidecar.jsRun the Wails desktop app in development mode:
npm run wails:devBuild the desktop app:
npm run wails:build
npm run wails:sidecarThe portable desktop bundle is written to:
build/bin/
Build the Windows installer:
npm run installer:winThe installer is written to:
dist/CodexPanel-Setup-<version>.exe
The portable Windows bundle contains two executables by design:
CodexPanel.exe: the desktop control panel users launch.codexpanel-node-sidecar.exe: the bundled local service started and stopped byCodexPanel.exe; users do not run it manually.
For ordinary Windows users, publish the installer. Keep the portable zip for development, diagnostics, and no-install usage.
The desktop panel uses the Wails method App.ControlService.
Supported actions:
start: starts the local sidecar if it is not healthy.stop: stops the sidecar and, on Windows, kills the full sidecar process tree.
The frontend keeps one primary service button:
- Running: button shows
停止. - Stopped: button shows
启动.
Stopping the service immediately updates the panel state and releases the local HTTP port.
The local panel stores user configuration in Codex state:
~/.codex/state.json
Main fields:
port: local service port, default8787.relayUrl: Cloudflare service URL, entered by the user.remoteKey: remote control key, entered by the user.deviceId: local device ID, defaulting to the Windows user name.
Do not hard-code these values into source or release bundles.
LAN use does not require Cloudflare. For WAN access across different networks, deploy the relay from the dedicated repository:
Recommended setup flow:
- Deploy
CodexPanel-WANto Cloudflare Pages + Durable Object Worker by following that repository's README. - After deployment, record the Cloudflare service root URL, for example
https://codexpanel-wan.pages.devor your custom domain. - Open CodexPanel desktop settings and fill in:
- Cloudflare service URL: the root URL only, without
/remote/.... - Remote key: a strong key chosen by the user.
- Cloudflare service URL: the root URL only, without
- Keep the desktop Device ID consistent with the device ID allowed in
CodexPanel-WANwhenDEVICE_IDSis configured. - Start the local service. The remote entry becomes:
https://<cloudflare-domain>/remote/<deviceId>/?token=<remote-key>.
The computer is the controlled side and does not need an extra Cloudflare agent secret. The WAN relay only queues and forwards requests; CodexPanel on the local computer still validates the remote key and performs the actual Codex Desktop automation.
Legacy relay examples remain in this repository for reference:
Use CodexPanel-WAN as the source of truth for new WAN deployments.
Desktop release packaging is automated in:
.github/workflows/windows-release.yml
The workflow runs on every push to main and uploads desktop artifacts.
Windows publishes both an installer .exe and a portable .zip; Linux and
macOS are packaged as .tar.gz so executable permissions survive extraction.
It can also be run manually from the Actions tab.
When pushing a tag like v3.0.5, the workflow uploads the desktop bundles to a
GitHub Release automatically.
main.go Wails app entrypoint
app.go Go sidecar lifecycle and Wails bindings
assets.go Embedded control panel and /codex proxy
process_*.go Cross-platform process-tree handling
public/
control.html Desktop control panel
index.html Remote/mobile control page
icons/ App icons
server.js Local Node service
windows/node-sidecar.js Sidecar entrypoint
build/
appicon.png Wails app icon source
windows/ Windows Wails metadata, icon, installer script
scripts/
build-wails-sidecar.js Packages the Node sidecar
build-windows-installer.ps1 Builds the Windows installer
setup-ubuntu-dev.sh Ubuntu development bootstrap
cloudflare/
relay-worker.mjs Optional Durable Object relay
pages/_worker.js Optional Pages worker
Before publishing a desktop build:
- Run
npm run check. - Run
node --check windows/node-sidecar.js. - Run
go test ./.... - Run
npm run wails:build. - Run
npm run wails:sidecar. - On Windows, run
npm run installer:win. - Verify the desktop panel shows the correct icon and project name.
- Verify service diagnostics are
8/8. - Verify
启动and停止both work. - Verify no user keys or local state are present in the portable bundle or installer.
CodexPanel is source-available for non-commercial use unless a separate written commercial license is granted by the copyright holder. See LICENSE.