OpenAI

Using Daybreak in Codex CLI

Use this guide to enable Daybreak in Codex CLI, configure it for automated workflows and SDK integrations, and troubleshoot access or refusal issues. 

Updated: yesterday

Note that to access these changes, you’ll need to upgrade to Codex CLI 0.163.0 or later. CLI upgrades are opt-in: existing installations retain their current behavior until you update them.

  • If your automation installs @openai/codex@latest, it can pick up this change on its next install or update. If you installed Codex CLI globally with npm, run npm install -g @openai/codex@latest, then run codex --version to confirm the upgrade.

  • To defer the change, pin @openai/codex@0.162.0. A one-time installation using @latest does not update itself. Workflows pinned to older versions retain their previous behavior.

  • For TypeScript integrations, update @openai/codex-sdk and its bundled runtime. For Python integrations, update openai-codex and its Codex runtime. Updating the global CLI alone may not update an SDK's runtime. If you configure a custom executable path, update that executable too.

Manually configured model IDs absent from an otherwise available catalog will retain their previous automatic treatment in CLI and Codex Desktop, even when Daybreak is ON. Their absence from the catalog alone does not prevent a request from succeeding. 

Cyber model availability in the model picker may roll out separately. Once enabled, users already on a supported release do not need another download to see the newly available models. Reopen the model picker or restart Codex to refresh the list.

Enable Daybreak in interactive CLI

  1. Start Codex with your usual authentication.

  2. To turn Daybreak ON, enter /daybreak.

  3. Codex will report Daybreak on. Applies to new turns.

  4. This will apply to the active thread and be saved as the default for new sessions.

  5. To turn Daybreak OFF, run the same command (/daybreak) again.

Enable Daybreak in headless CLI

Headless workflows run without an interactive UI, commonly through codex exec in scripts, scheduled jobs, or CI. There is no interactive “Enable Daybreak” (/daybreak) prompt here. Instead, you can:

  1. Add Daybreak to a specific CLI run by adding -c daybreak=true to each command that should use reduced refusals. As an example, you might enter:

codex exec -c daybreak=true "Review the changes in this repository."

  1. Keep your existing prompt and other command options. Add this setting to each invocation that should use Daybreak, including commands in scripts, scheduled jobs, and CI configuration.

  2. Make Daybreak the default for new CLI sessions and runs by adding daybreak=true to the configuration file loaded by Codex.

  3. The default user configuration is ~/.codex/config.toml. If your automation sets CODEX_HOME, use $CODEX_HOME/config.toml instead. Place the setting at the top level, outside sections such as [features].

  4. Make the change in the environment where the automation actually runs. Updating your laptop's configuration does not update a CI runner or remote machine.

  5. The setting also applies to new interactive sessions that use the same configuration. Resumed and forked sessions retain their saved Daybreak choice; a new configuration default does not replace it.

  6. Note that a command-line setting overrides the saved configuration for that invocation. You can therefore keep daybreak = true in your configuration and use -c daybreak=false for an individual run.

Enabling Daybreak with a proxied inference provider

You can use Daybreak in Codex CLI while routing inference requests through your existing proxy. Codex uses a separate model catalog lookup to discover which models support Daybreak for your project.

Before you begin, make sure you have a working proxy provider in Codex CLI and an OpenAI API key from a project with access to Daybreak and the model you want to use; as well as v0.167.0 of Codex CLI. OpenAI Docs on Daybreak project access

  1. Update your proxy provider by opening ~/.codex/config.toml and finding the [model_providers.<id>] section for your proxy. Add the last two lines of the example below to that section. Keep your existing provider ID, proxy URL, and authentication settings.


    [model_providers.proxy]

    name = "Proxied with Cyber"

    base_url = "https://<your-proxy>/v1"

    model_catalog_url = "<https://chatgpt.com/backend-api/codex/models>"

    capabilities.cyber_access_programs = true

    If your configuration already has a [model_providers.<id>.capabilities] section, put cyber_access_programs = true there and keep model_catalog_url in the parent provider section. Codex configuration reference

  2. Authenticate the catalog lookup by choosing the option that matches the credentials your CLI uses.

    1. If Codex uses an OpenAI API key, keep the OpenAI catalog URL from step 1. Run Codex with the key from your Daybreak-enabled project so it can authenticate directly to the catalog.

    2. If Codex uses your proxy’s credentials, set model_catalog_url to the full URL of a catalog route on your proxy. Configure that route to:

      1. Authenticate the CLI request using your usual proxy credentials.

      2. Forward the request to https://chatgpt.com/backend-api/codex/models using the OpenAI API key from your Daybreak-enabled project.

      3. Return the catalog response to Codex.

  3. Turn on Daybreak by starting a new Codex CLI session with your proxy provider. Select a Daybreak-eligible model, then enter /daybreak to turn it on.

    1. If Daybreak is unavailable, check the catalog lookup first. Inference can succeed even when the catalog request fails. Verify that the request reaches OpenAI with a key from the intended project and that the project has access to both Daybreak and the selected model.

Enable Daybreak via TypeScript SDK

Pass the Daybreak setting through the client configuration:

import { Codex } from "@openai/codex-sdk";

const codex = new Codex({

  config: { daybreak: true },

});

const thread = codex.startThread();

const result = await thread.run("Review the changes in this repository.");

console.log(result.finalResponse);

Use daybreak: false to turn Daybreak off and use the normal refusal behavior. Keep your existing authentication configuration.

Enable Daybreak via the app server or Python SDK

1. Read the selected model’s availableAccessPrograms.cyber values from model/list, then set cyberAccessProgram in the turn/start parameters.

a. For a mainline model and account with Daybreak Blue access:

{ "cyberAccessProgram": "daybreakBlue" }

b. For a cyber model and account with Daybreak Red access:

{ "cyberAccessProgram": "daybreakRed" }

c. For normal refusal behavior:

{ "cyberAccessProgram": "standard" }

2. Include the selection on every turn that should use it; do not assume that omitting the parameter turns Daybreak off. Direct app-server clients must enable the experimentalApi capability during initialization to use this parameter.

3. The Python SDK's low-level CodexClient can pass the same parameter:

from openai_codex.client import CodexClient

with CodexClient() as client:

client.initialize()

thread = client.thread_start()

turn = client.turn_start(

thread.thread.id,

"Review the changes in this repository.",

params={"cyberAccessProgram": "daybreakBlue"},

)

client.wait_for_turn_completed(turn.turn.id)

4. This example assumes Daybreak Blue is available for the selected model. The Python client enables the experimental API capability by default. A saved thread preference alone does not select a program for an app-server turn.

If you added a local model catalog prior to these changes

If signing in with an API key previously didn’t show the models you expected, you may have added a local catalog using model_catalog_json in config.toml. Codex uses that local file instead of the automatic catalog, so your model list can become outdated. Once automatic catalog support is available for your environment, follow these steps to switch back:

  1. Open config.toml. For Codex CLI, open ~/.codex/config.toml (or $CODEX_HOME/config.toml if you set CODEX_HOME). In Codex Desktop, go to Settings > Configuration, then select Open config.toml.

  2. Temporarily disable the local catalog. Add # at the beginning of the model_catalog_json line, save the file, and restart Codex with the same account or API key. Leave any catalog URL your organization requires in place.

  3. Verify your access. In CLI, start codex, then enter /daybreak inside the session. In Desktop, open the Advanced model picker and turn on Daybreak. If you have Daybreak Red access, confirm that an expected cyber model appears and that you can send a request using it.

  4. Keep the working configuration. If the check succeeds, delete the line you disabled and save the file. If it fails, remove the #, save, and restart Codex to restore your previous setup.

Troubleshoot refusals in CLI

  • Run a representative job with the same credentials, model, and configuration used by your automation.

  • If Daybreak is unavailable, confirm that:

    • Your account or API project has Daybreak access.

    • The selected model supports Daybreak.

  • In interactive CLI, check that Daybreak is On. Interactive CLI can show a refusal message when Daybreak is available but OFF: Daybreak is currently off. If you’re doing authorized security work, turn it on and try your request again.

    • The prompt asks Turn on Daybreak for your next request? and offers Enable Daybreak or Not now.

    • Select Enable Daybreak to turn it on for your next request, then try the request again. Note that the refused request is not retried automatically; you must request again. Some requests may still be refused with Daybreak ON.

    • Select Not now to leave Daybreak OFF.

  • For automations, confirm that daybreak=true reaches the actual Codex process and is not overridden by another command-line setting.

Use Daybreak with Codex Security CLI

Codex Security CLI uses @openai/codex-security for security scans. Its access-program options are separate from the general Codex CLI examples above.


For API-key authentication, use a key from a Daybreak-enabled API project and explicitly select the program approved for that project. For Daybreak Blue:


npx @openai/codex-security scan . --auth api-key --cyber-access-program daybreak_blue

Use daybreak_red only when your project is approved for Daybreak Red, or standard for standard safeguards. Selecting a program does not grant access to that program or to additional models.

See the Codex Security CLI reference for authentication and scan options.

Use Daybreak with Codex Security SDK

The Codex Security TypeScript SDK (@openai/codex-security) runs security scans from an application or developer tool. It is separate from the general Codex SDK described above.


Use credentials for your approved account or API project. Some cybersecurity requests and protected findings require Trusted Access for Cyber. Installing the SDK or selecting a model does not grant Daybreak access.

Follow the Codex Security SDK guide for supported authentication, configuration, and scan examples.

Was this article helpful?