Install and Update Codex CLI: Mac, Linux, Windows

Installing the OpenAI Codex CLI is one command per platform – curl -fsSL https://chatgpt.com/codex/install.sh | sh on macOS and Linux, powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex" on Windows – with npm and Homebrew as the supported alternatives, and updating is codex update, which recognizes script, npm, and Homebrew installs and runs that channel’s upgrade.¹⁴¹¹ The part most pages skip is what comes after the first command: which of the five install routes to pick, how to pin a version when a release breaks you, why the winget package runs days to weeks behind npm, and what an uninstall leaves behind in ~/.codex. This page is that reference, one table per job, current as of v0.163.0 (October 15, 2026).⁹

Updated October 15, 2026, for v0.163.0. Four things moved since this page’s September version. The winget index moved: after a summer in which its manifest requests sat for weeks, the twelve from 0.156.0 through 0.161.0 merged within a day of opening, but the 0.162.0 and 0.162.1 requests have waited since October 8 and 9, so on October 15 winget was three releases behind npm, against the fourteen (0.147.0 through 0.153.4) of September 6.³¹⁰ Windows releases ship a signed install.ps1 (its SHA-256 check is older; v0.162.0 fixed it under Windows PowerShell).¹⁸ Windows also gained a third sandbox implementation, Microsoft Execution Containers, with the two September modes as its fallbacks.⁸ And the background server Codex now starts by default for eligible interactive sessions runs its own updater, which on older script installs can move the CLI’s own package.²⁰ Every install, update and pin anchor below was re-read on October 15; the codex doctor reading is from 0.153.4.⁹¹⁰

TL;DR

• The standalone installer is the route OpenAI leads with in both the README and the CLI docs, with npm and Homebrew presented as alternatives (“you can also install” in the CLI docs, “can also be installed via” in the README): the install.sh script on macOS and Linux, the install.ps1 script on Windows. It downloads the compiled binary, so it needs no Node.¹¹¹
• npm and Homebrew are supported alternatives. npm install -g @openai/codex pins with a plain package spec (@<version>); brew install --cask codex was at the same 0.163.0 as npm when this was written; the cask bumped thirteen minutes after the release.¹²¹⁰
• winget works, days to weeks behind. OpenAI publishes the OpenAI.Codex package. After a summer in which its manifest pull requests sat unmerged for weeks, the twelve from 0.156.0 (September 22, 2026) through 0.161.0 (October 7) each merged within a day of opening; then the 0.162.0 and 0.162.1 requests stalled, open since October 8 and 9. On October 15 the newest installable version was 0.161.0 against npm’s 0.163.0, three stable releases behind, with the 0.163.0 request open as well.³¹⁰
• codex update covers the script, npm, and Homebrew installs (v0.128.0 and later): it reuses the install-channel detection the TUI already has and runs the matching upgrade. A winget install is not a channel it recognizes; update that one with winget upgrade OpenAI.Codex. The manual equivalents for the rest are re-running the installer, npm install -g @openai/codex@latest, or brew upgrade --cask codex.⁴¹¹
• The background server runs an updater, and on older script installs it can move your CLI. Since v0.157.0 (September 25, 2026 UTC) Codex starts a managed background server by default for eligible interactive sessions. When the installer selected the latest channel, that server checks for updates five minutes after it starts and then hourly, running the installer; a new daemon lives under ~/.codex/packages/app-server-daemon, but a daemon first launched from an older script install keeps using ~/.codex/packages/standalone/current, the CLI’s own package. The switch is "updater": { "autoUpdateEnabled": false } in ~/.codex/app-server-daemon/settings.json, applied by codex app-server daemon restart.²⁰¹²
• Pin with --release <version> on install.sh, $env:CODEX_RELEASE before the install.ps1 line, or @<version> on npm. Homebrew’s cask tracks one current version and cannot pin.²¹²
• Uninstalling the package does not remove your state, but on a script install rm -rf ~/.codex also deletes the CLI itself, because the installer keeps its releases under ~/.codex/packages/standalone.¹²

How Do I Install Codex CLI?

Four routes in the order OpenAI’s own docs present them,¹¹¹ plus winget on Windows, which OpenAI does not document:³

# Standalone installer, no Node required (macOS, Linux, WSL) -- the route OpenAI lists first
curl -fsSL https://chatgpt.com/codex/install.sh | sh

# Windows PowerShell
powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"

# npm (needs Node.js 16+; pins with a plain @version spec)
npm install -g @openai/codex

# Homebrew (macOS, Linux)
brew install --cask codex

# winget (Windows; lags npm, see the platform section)
winget install OpenAI.Codex

Then confirm it landed and sign in:

codex --version      # codex-cli 0.163.0
codex login          # ChatGPT account (recommended) or an API key

On a first script install the profile block only takes effect in new shells. If codex is not found in the terminal you installed from, run export PATH="$HOME/.local/bin:$PATH" there or open a new one; the installer prints the same two lines (“Current terminal” and “Future terminals”) when it finishes.¹²

Prefer a raw binary? Every GitHub release ships platform tarballs (codex-aarch64-apple-darwin.tar.gz, codex-x86_64-apple-darwin.tar.gz, codex-x86_64-unknown-linux-musl.tar.gz, codex-aarch64-unknown-linux-musl.tar.gz), and since v0.106.0 the same install.sh is attached to each release as an asset. Each archive holds a single entry with the platform baked into its name, so rename it to codex after extracting.¹⁵ The release page has grown around those tarballs: .zst and macOS .dmg siblings of each binary; codex-package-<target>.tar.gz bundles of the binary, the codex-code-mode-host helper and ripgrep, which are what the installer and the Homebrew cask download; the codex-app-server and codex-responses-api-proxy binaries; and openai_codex_cli_bin Python wheels, which are the pinned runtime for OpenAI’s Python SDK rather than a pip route to the CLI.⁵¹²

The installer fetches from OpenAI-hosted release infrastructure: chatgpt.com/codex/install.sh redirects to releases.openai.com, a change that landed in v0.146.0, with GitHub Releases kept as the fallback host.⁶ On a network that blocks or throttles OpenAI’s artifact host but allows GitHub, fetch the script from the release asset and tell it to pull the binary from GitHub too:¹¹²

curl -fsSL https://github.com/openai/codex/releases/latest/download/install.sh | CODEX_INSTALLER_USE_RELEASES_OPENAI_COM=false sh

The variable goes on the sh side of the pipe. A VAR=value curl ... | sh form applies the variable to curl only, so the script never sees it and quietly keeps the default. In PowerShell, set $env:CODEX_INSTALLER_USE_RELEASES_OPENAI_COM = 'false' before running the install line.

Which route should you choose?

Which Platforms Does Codex Support?

On Windows, Codex runs natively in PowerShell with a Windows sandbox, and as of October 2026 there are three implementations. The newest is Microsoft Execution Containers (MXC), the process isolation Microsoft introduced in Windows 11 24H2 and 25H2: the desktop app prefers it for consumer accounts when the device supports it, the CLI uses it when prefer_mxc = true is set under [features], with the legacy modes as the fallback, or when [windows] sandbox = "mxc" selects it explicitly, which fails rather than falls back where the capability is missing or policy blocks it; from v0.162.0 a one-command test (codex -c windows.sandbox=mxc sandbox ..., expected output MXC_OK) tries it without changing the saved selection. The two earlier modes are now the legacy fallbacks. elevated is the preferred one: it uses dedicated lower-privilege sandbox users, filesystem permission boundaries, firewall rules, and local policy changes, and needs an administrator-approved setup. unelevated runs commands with a restricted Windows token derived from your user and ACL-based filesystem boundaries, with weaker network isolation.⁸ You select the fallback in config.toml:

[windows]
sandbox = "elevated"   # or "unelevated"; "mxc" selects the containers explicitly

OpenAI’s guidance is to use the native sandbox by default and choose WSL when you need Linux-native tooling, when your workflow already lives in WSL2, or when none of the native Windows sandbox implementations meets your needs.⁸ One thing to keep straight: the Windows setup assumes winget is present on the machine for its own setup steps; that is separate from installing Codex through winget. OpenAI does publish that package – the release workflow has a winget job that opens a manifest pull request in microsoft/winget-pkgs for stable releases – and the index’s summer stall ended, though not for good. Dates here are UTC. The 0.148.0 through 0.152.0 requests, opened between August 18 and September 1, merged on September 11 (0.151.0 on September 30 and 0.149.1 on October 1); the 0.147.0 request closed unmerged, as did a community member’s 0.154.0 submission, and OpenAI’s workflow opened none for 0.152.1 or for 0.153.x through 0.155.x; from 0.156.0 (September 22) through 0.161.0 (October 7), twelve manifests in a row merged within a day of opening; then the 0.162.0 and 0.162.1 requests stalled, open since October 8 and 9. On October 15 the index held 138 versions, newest 0.161.0, three stable releases behind npm, with the 0.163.0 request open as well. Nothing about the CLI is broken; the package runs days to weeks behind.³⁸

Node.js is only a requirement for the npm route. The install scripts download the compiled binary, and the Homebrew cask declares no dependencies.¹²

How Do I Update Codex CLI?

The CLI you run does not update itself, unless a background-server updater is managing the same package (older script installs whose server was launched from packages/standalone, below). The TUI notices a newer release and offers the command for your install channel; running it is on you, and the built-in one covers the script, npm, and Homebrew installs.⁴ The startup check itself is a config key: check_for_update_on_startup = false in config.toml, which the reference describes as “Check for Codex updates on startup (set to false only when updates are centrally managed)”; fleets that manage updates centrally set features.in_app_updates = false in requirements.toml.¹⁶

codex --version                      # what you run now
npm view @openai/codex version       # newest published

codex update                         # built-in, v0.128.0+; detects your install channel

codex update arrived in v0.128.0 on April 30, 2026; the pull request that added it reused the install-channel detection and update runner the TUI already had for update prompts. The channel map covers npm (plus the bun, pnpm, and Vite+ variants), Homebrew, and the standalone installer on Unix and Windows; a winget install is not in it, so a winget-installed Codex updates through winget upgrade OpenAI.Codex only. Read again on October 15, the map has one new entry, a daemon action that replaces the local background server once the terminal is restored, and its standalone commands now run the installer with CODEX_NON_INTERACTIVE=1; winget is still absent.⁴ The manual equivalents, if you prefer them or are scripting a machine image:

curl -fsSL https://chatgpt.com/codex/install.sh | sh   # standalone: re-run the installer
npm install -g @openai/codex@latest                    # npm
brew upgrade --cask codex                              # Homebrew
winget upgrade OpenAI.Codex                            # winget (to whatever winget has)

irm https://chatgpt.com/codex/install.ps1 | iex           # standalone on Windows: re-run the installer

Releases land on a fast stable line – 0.160.0 through 0.163.0, six stable releases, shipped between October 1 and October 15, 2026 – so the gap between “what I run” and “newest” is often a week, not a quarter.⁹

The background server updates itself

The background server is the one thing that fetches new binaries on a schedule. Since v0.157.0 (September 25, 2026 UTC) Codex starts a managed background server by default for eligible interactive sessions, and when the installer selected the stable latest channel that server launches a detached updater loop: it checks for updates five minutes after it starts and then hourly, running the installer each time, and a running server restarts on the new binary. A daemon installed on 0.163.0 lives in its own package, ~/.codex/packages/app-server-daemon (the installer’s CODEX_INSTALL_DAEMON_ONLY=1 mode, which leaves the user’s CLI command and shell setup alone), but a daemon first launched from an older script install keeps using ~/.codex/packages/standalone/current, and its scheduled updates move that package, which is the CLI you type (on installs older than the installer’s channel marker, only after the next latest install, which codex update performs; until then the daemon serves without updating). A pinned release stays pinned: the installer writes an auto-update-version marker only for a latest install and removes it for an explicit release, and its own comment states the rule, “Scheduled updates still require the selected release to follow the latest channel.” The per-user switch is "updater": { "autoUpdateEnabled": false } in ~/.codex/app-server-daemon/settings.json, with an updateIntervalMinutes beside it; codex app-server daemon restart applies the enabled state, and a changed interval takes effect at the next wait; codex app-server daemon stop stops the server (a graceful termination request, then a forced one after the grace window; the updater loop is a separate pid-backed process, so check for it afterward), /daemon in the TUI restarts it (v0.163.0), and those updates obey the application’s network policy (v0.163.0). An explicit codex app-server daemon update selects the latest stable release even with automatic updates off and, once the installer and release support it, moves a legacy daemon onto its own package root; it also returns a pinned package to production update eligibility (the automatic-update setting itself is kept) and restarts a running server, which may interrupt active or queued work; a stopped server stays stopped. The daemon’s own README calls it experimental.²⁰¹²

How Do I Install a Specific Version?

npm and the install script both pin by version; Homebrew does not:²¹²

npm install -g @openai/[email protected]                                          # npm: exact version
curl -fsSL https://chatgpt.com/codex/install.sh | sh -s -- --release 0.162.1  # script: --release flag
curl -fsSL https://chatgpt.com/codex/install.sh | CODEX_RELEASE=0.162.1 sh    # script: env var, on the sh side
winget install OpenAI.Codex --version 0.161.0                                 # winget: only what it has
codex --version                                                               # verify the rollback took

Mind the placement in the env-var form: CODEX_RELEASE=0.162.1 must sit in front of sh, after the pipe. Written in front of curl, the variable applies to curl alone and the script installs latest while you believe you pinned.¹² On Windows the PowerShell script declares $Release = $env:CODEX_RELEASE as its only parameter and falls back to latest when it is empty, so the pin is the variable, set in the same session:¹⁷

$env:CODEX_RELEASE = '0.162.1'; irm https://chatgpt.com/codex/install.ps1 | iex

Clear it afterward (Remove-Item Env:CODEX_RELEASE): the variable stays set for the rest of that session, and a later installer run in it, including the one codex update launches, inherits the pin.¹⁷

npm also carries an alpha dist-tag for the prerelease line (0.163.0-alpha.11 on October 15, published October 14 UTC, nearly two days before the stable 0.163.0); npm install -g @openai/codex@alpha follows it, and since v0.161.0 publishing an older alpha or a hotfix no longer moves that tag backward.¹⁰²¹

Pinning is the right move when a release breaks you: file the issue, pin the last good version, move on. Verify with codex --version after every pin, because a second install elsewhere on your PATH keeps serving its own binary in silence. The install script checks for exactly this: when it finds a Homebrew-, npm-, or bun-managed codex already on your PATH, it warns that “Multiple managed Codex installs can be ambiguous because PATH order decides which one runs” and offers to run the matching uninstall for you; it recognizes the Homebrew case by the macOS prefixes /opt/homebrew and /usr/local, on macOS only, so a Linuxbrew codex is not caught.¹² codex doctor reports the same condition under Environment after the fact.⁷

How Do I Uninstall Codex CLI?

Stop the background server first, while codex is still on your PATH, then remove it with the route that installed it:

codex app-server daemon stop     # first; skip if no server runs
npm uninstall -g @openai/codex
brew uninstall --cask codex
winget uninstall OpenAI.Codex

A script install has no package manager to ask. The installer puts a codex symlink in ~/.local/bin (override with CODEX_INSTALL_DIR) that points at the binary inside ~/.codex/packages/standalone/current (current/bin/codex on current releases); current is itself a symlink into ~/.codex/packages/standalone/releases/, where each downloaded release lives. On macOS the installer adds a second symlink, codex-code-mode-host, beside the first.¹² Since v0.157.0 there may also be a background server: its package under ~/.codex/packages/app-server-daemon (or, for a server first launched from an older install, the standalone package itself) and its state under ~/.codex/app-server-daemon/ (settings.json, daemon.pid and daemon-updater.pid, or app-server.pid and app-server-updater.pid for a server running from the standalone package, and daemon.lock).²⁰ Stop it first, then remove all of it:

codex app-server daemon stop                                 # the background server; its updater is a separate process
pgrep -fl "app-server" || true                               # what is still running
grep -H . ~/.codex/app-server-daemon/*.pid 2>/dev/null       # the recorded pids, by file

The server runs as codex app-server --listen unix://, with --remote-control before --listen when remote control is on (the listen argument is the bare scheme; no socket path appears on the command line), and its updater as codex app-server daemon pid-update-loop; the pid files under ~/.codex/app-server-daemon/ are the test for which process belongs to the background server: daemon.pid and daemon-updater.pid for a dedicated daemon, app-server.pid and app-server-updater.pid for a server running from the standalone package. stop ends the server, not the updater, which keeps waking on its interval until a reboot, so if a pid recorded there is still alive, end it with kill <pid> now; any other codex app-server process belongs to something else you are running. Then remove the rest:¹²²⁰

rm -f ~/.local/bin/codex ~/.local/bin/codex-code-mode-host   # the second link exists on macOS installs only
rm -rf ~/.codex/packages/standalone ~/.codex/packages/app-server-daemon   # the CLI's package and the server's
rm -rf ~/.codex/app-server-daemon                            # the server's settings, pid files and lock

If ~/.local/bin was not on your PATH when you installed, or the installer found a competing Homebrew, npm, or bun install and rewrote the entry, the script also appended a marked block to your shell profile: # >>> Codex installer >>> through # <<< Codex installer <<< in ~/.zprofile (macOS zsh), ~/.bash_profile (macOS bash), ~/.zshrc (Linux zsh), ~/.bashrc (Linux bash), or ~/.profile (any other shell). Delete those three lines to finish.¹²

On Windows, install.ps1 keeps the same layout under %USERPROFILE%\.codex\packages\standalone (or %CODEX_HOME%\packages\standalone if you set that variable): downloaded releases in releases\, a current junction pointing at the active one. It exposes codex.exe through %LOCALAPPDATA%\Programs\OpenAI\Codex\bin (override with CODEX_INSTALL_DIR), which is itself a junction into current\bin, and instead of a profile block it writes that bin path into your user PATH for future PowerShell sessions. The background server keeps the same two folders there, packages\app-server-daemon and app-server-daemon.¹⁷²⁰ Stop it, remove the standalone directory and the server’s two folders, then the now-dangling bin junction, then take the entry back out of the user Path variable under Environment Variables:¹⁷

codex app-server daemon stop                                                  # the background server; its updater is a separate process
Get-Process codex* -ErrorAction SilentlyContinue                              # what is still running
Get-ChildItem "$env:USERPROFILE\.codex\app-server-daemon\*.pid" -ErrorAction SilentlyContinue | ForEach-Object { "$($_.Name): $(Get-Content $_)" }   # the recorded pids, by file

The same pid files decide here: if a process whose pid is recorded in %USERPROFILE%\.codex\app-server-daemon\daemon.pid or daemon-updater.pid (or app-server.pid and app-server-updater.pid for a server on the standalone package) is still alive, end it with Stop-Process -Id <pid> now; any other Codex process is something else you are running. Then remove the rest:²⁰

Remove-Item -Recurse -Force "$env:USERPROFILE\.codex\packages\standalone"   # releases plus the current junction
Remove-Item -Recurse -Force "$env:USERPROFILE\.codex\packages\app-server-daemon", "$env:USERPROFILE\.codex\app-server-daemon" -ErrorAction SilentlyContinue   # the server's package and state
cmd /c rmdir "$env:LOCALAPPDATA\Programs\OpenAI\Codex\bin"                  # the bin junction; rmdir removes the link, not a target

codex sandbox uninstall (v0.162.0) is the separate cleanup for the legacy Windows sandbox: it removes the machine-wide sandbox accounts and network rules with administrator privileges, leaves Codex home and the sandbox directories alone, and is rejected on other platforms.¹⁹

On any route, stop the background server first if one is running (codex app-server daemon stop) and look for ~/.codex/packages/app-server-daemon: the daemon’s README says bootstrap copies the invoking package into that folder when no daemon package exists and that a bare executable cannot supply one, and whether a Homebrew or npm install’s automatic start creates it was not tested here; if the folder exists, remove it and ~/.codex/app-server-daemon after the package-manager uninstall.²⁰ The package-manager uninstalls above do not touch ~/.codex/. Homebrew’s --zap does not either, in practice: the cask’s only zap stanza is rmdir: "~/.codex", and Homebrew applies rmdir: only to directories that are already empty.² That directory holds config.toml, your stored credentials, and every session, which is why a reinstall picks up your login and history where you left them. Delete it only when you want a genuinely clean slate, and know what that means on a script install:

rm -rf ~/.codex   # discards config.toml, credentials, all sessions -- AND the CLI itself on a script install

A clean reinstall that keeps your state is one line on npm: npm uninstall -g @openai/codex && npm install -g @openai/codex@latest. On the script route, re-running the installer adds the new release under ~/.codex/packages/standalone/releases, repoints current at it, leaves the older releases in place until you remove them, and leaves your config alone.¹²

The Whole Lifecycle in One Table

What Does codex doctor Check?

codex doctor is the command to run before filing a bug or debugging an install that “worked yesterday.” On 0.153.4 it captures seven sections in one report – Notes, Environment (runtime and install consistency), Configuration (config.toml load status, auth, MCP, sandbox policy), Desktop App (added in v0.149.0), Updates, Connectivity, and Background Server – with --summary for a compact view, --json for a redacted machine-readable form, --all to expand truncated lists, and --no-color for logs; codex doctor --help on 0.153.4 also lists --ascii; v0.162.0 added the configured TUI mode to the report.^7131522 Most “Codex is broken” reports resolve to something it names on the first screen: a stale auth mode, a config.toml that failed to parse, or a second install shadowing the one on your PATH. The full section-by-section breakdown lives in the guide.

What Changes After Install

The first thing a fresh install trips over is not the binary. Since v0.149.0 the CLI refuses to start on approval_policy = "untrusted", so a config.toml copied from an older machine needs one edit.¹³ Coming from Claude Code? The migration post maps the two configs side by side, and the hooks post covers what Codex runs around the model. The Codex CLI guide is the full reference: sandbox and approval modes, AGENTS.md, MCP, skills, and cloud tasks. And if you run both tools, the Claude Code install page is this page’s twin.

FAQ

How do I update Codex CLI to the latest version?

Run codex update (v0.128.0 and later); it detects whether you installed through the script, npm, or Homebrew and runs that channel’s upgrade. The manual equivalents are re-running the install script, npm install -g @openai/codex@latest, or brew upgrade --cask codex. A winget install is not a channel codex update recognizes; use winget upgrade OpenAI.Codex for that one.

Does Codex CLI update automatically?

The CLI does not, with one exception. The TUI checks for a newer release and offers the update command that matches your install channel, and codex update (v0.128.0 and later) runs it. The exception is the background server Codex starts by default since v0.157.0: on the latest channel it checks for updates five minutes after starting and then hourly, and a server first launched from an older script install updates ~/.codex/packages/standalone, the CLI’s own package, once a latest install has recorded the channel. Set "updater": { "autoUpdateEnabled": false } in ~/.codex/app-server-daemon/settings.json and run codex app-server daemon restart to stop that.

How do I uninstall Codex CLI?

Stop the background server first if one is running (codex app-server daemon stop), then use the route that installed it: npm uninstall -g @openai/codex, brew uninstall --cask codex, or winget uninstall OpenAI.Codex, and look for ~/.codex/packages/app-server-daemon and ~/.codex/app-server-daemon, which a package-manager uninstall leaves behind. For a script install, the same stop, then remove the ~/.local/bin/codex symlink (and ~/.local/bin/codex-code-mode-host on macOS), the ~/.codex/packages/standalone directory, and the server’s ~/.codex/packages/app-server-daemon and ~/.codex/app-server-daemon. On Windows the script install is %USERPROFILE%\.codex\packages\standalone (plus the server’s packages\app-server-daemon and app-server-daemon folders), the %LOCALAPPDATA%\Programs\OpenAI\Codex\bin junction, and an entry in your user PATH; remove all of them. Your config, credentials, and sessions stay in ~/.codex/ until you remove the rest of that directory yourself.

How do I install Codex CLI on Windows?

Run powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex". The CLI runs natively in PowerShell with a Windows sandbox (Microsoft Execution Containers when you set prefer_mxc = true and the device supports it, otherwise your configured legacy mode, elevated when none is set; selecting [windows] sandbox = "mxc" explicitly uses MXC or fails, with no fallback); WSL2 is an option when you need Linux tooling or none of the sandbox implementations fits, not a requirement. Windows 11 is the recommended baseline. winget install OpenAI.Codex also works but trails the stable line.

Do I need Node.js to install Codex?

Only for the npm route, and the package asks for Node 16 or later. The install script, the PowerShell script, and the Homebrew cask all provide the compiled codex binary, so a machine without Node can run Codex.

How do I check which version of Codex I have?

codex --version prints it (for example codex-cli 0.163.0). npm view @openai/codex version shows the newest published version, and codex doctor reports the install path and whether another copy on your PATH is shadowing it.