Does tracing Codex (beta) with Rius send my code or prompts?

Rius traces Codex (beta) sessions as structure only by default, so no prompts, replies or tool output leave your machine. Prompts, replies and tool inputs and outputs are sent only from a folder you enable for content with $rius:rius-enable-content-here. Even then, the plugin replaces the secrets it recognizes before sending, on a best-effort basis. Everyone in the workspace you connect can read what is sent.

How it works

Tracing is off for every folder until you turn it on, and installing the plugin sends nothing. You choose one of two modes per folder:

Tool inputs and outputs are where code can appear, such as a command you ran or output it printed. In structure-only mode you get the shape of the session and none of that text.

With content on, the plugin replaces recognized secrets, such as cloud and API keys, tokens and private keys, with a marker before anything is sent. It also caps each value at 32 KB. Redaction is best effort: a secret in a format the plugin does not know is sent as it is.

A folder you disable always wins over an enabled parent folder. The Codex (beta) rules apply to every Codex session on the machine and are separate from the rules of the other coding agents. For the plugin agents (Claude Code, Codex in beta and Cursor in beta), content is sent only from folders you opt in. OpenHands works differently: it needs no plugin and always sends prompts and output.

The plugin contacts three hosts and nothing else: ingest.eu.console.rius-glassflow.com for traces, connect.console.rius-glassflow.com for sign-in and sign-out, and mcp.eu.console.rius-glassflow.com when you use the MCP tools.

Set it up

1. Install the plugin for Codex (beta). The Codex guide covers trusting the five hooks and signing in.

codex plugin marketplace add glassflow/rius-coding-agents
codex plugin add rius@rius-coding-agents

2. Choose the privacy level for each folder. Run the command inside the folder you want to trace.

$rius:rius-enable-here
$rius:rius-enable-content-here
$rius:rius-disable-here

• $rius:rius-enable-here traces the folder and everything under it, structure only. Start here.
• $rius:rius-enable-content-here does the same and also sends prompts, replies and tool output, with recognized secrets removed. Use it only in repos your team has agreed may send content.
• $rius:rius-disable-here stops tracing the folder.

3. Check what is in effect with $rius:rius-status. It shows whether the folder is traced and why, the account, the key and the hooks.
4. To force structure only everywhere, set RIUS_CAPTURE_CONTENT to false. It overrides every folder rule. The plugin’s environment variables can only turn things off or lower a limit, so RIUS_CODEX_ENABLED set to false turns Codex (beta) tracing off everywhere, and RIUS_CODEX_MAX_ATTR_BYTES lowers the 32 KB cap on each captured value.
5. When you stop, run $rius:rius-logout. It revokes the key and deletes it from the machine.

What you get

• Session traces with model calls, tokens, cost, timing, tool names and subagents, and no prompts or code in the default mode.
• Content in the specific folders you choose, with recognized secrets replaced by a marker and each value capped at 32 KB.
• A clear view of who can read it. Sign-in stores one key for your machine, readable only by you in ~/.codex/rius/credentials.json. The key sends traces and cannot query them. What you send goes to the workspace you picked at sign-in, and everyone in that workspace can read it. Each session is recorded under the email you signed in with, as user.id. A workspace admin can see the key under Settings, API keys, and revoke it.
• Cost figures that are list-price estimates from token counts at API rates, not what you pay on a ChatGPT plan.

For how a team agrees which repos send content, see Track Claude Code usage and cost across a team. It describes the same plugin and the same workspace-wide visibility.

When something else fits

• If you cannot accept any chance of an unrecognized secret leaving your machine, stay on structure only, or set RIUS_CAPTURE_CONTENT to false. Redaction is best effort.
• If you want to compare the privacy defaults of every agent Rius traces, the Coding agents page lays them side by side. OpenHands always sends prompts and output, so it suits cases where that is acceptable.

Related