OpenAI Codex release notes: Sites needs a rollout check before publishing

OpenAI Codex release notes from June 2 are not just another app-feature note. Sites in the Codex app shows how quickly a prompted draft can become a hosted web app. For a team testing a small dashboard, request view or internal demo, that is useful. For a team without a release routine, it is also where mistakes can become public.

The practical answer is: use Sites as a reviewable prototyping path, not as a shortcut around ownership. Save versions, check access, review changes and publish only when someone can own support.

Source: Codex changelog, June 2, 2026

OpenAI Codex release notes: what Sites changes

The Codex app is OpenAI’s desktop app for coding-agent work in local projects. A coding agent can read project files, propose changes and sometimes run commands. Sites is a Codex plugin that can create, save, deploy and inspect websites, web apps and games hosted by OpenAI.

That does not only change the developer workflow. It changes the handoff between idea and production. An internal prompt can become something colleagues actually click. That is why every Sites test needs a clear boundary between saved version, reviewed version and published URL.

Source: Sites – Codex | OpenAI Developers

When Sites is useful for Hammer readers

Sites is best when the work is concrete but still bounded. Do not think “new business system.” Think “can we show the right data, the right form and the right decision step before anyone builds a permanent integration?”

Good first candidates:

• Internal request list: a simple view of incoming requests, owner and next step.
• Mini dashboard: a way to show status, risk or handling time without connecting the full data stack.
• Training or onboarding tool: a small web app where staff test a flow before it reaches live operations.
• Customer demo: a prototype that shows a process, but only with test data and limited access.

Then Sites becomes a Tool Forge problem: build something small enough to review, change and throw away if it does not hold up.

The control point belongs before publishing

OpenAI describes how a new site can stay limited to the owner and workspace admins before wider sharing. That is a good default even for smaller organizations: start with the narrowest access and open it only after content, data sources and ownership are checked.

Before anyone shares a Sites URL, check:

• Public or internal? Who should actually be able to open the link?
• Which version? Is this the saved version you reviewed, or a later agent change?
• Which secrets? API keys, environment variables and customer data should not be pasted into chat or committed in source files.
• Which changes? Review file changes and any database logic before publishing.
• Who owns support? Someone must be able to stop, change or unpublish the app if users get stuck.

Source: Sites access and review guidance

A better prompt for a safer Codex test

If the team wants to try Sites, start with a prompt that slows down publishing:

@Sites Review this project as a Sites candidate. Check whether it can be saved as a version without being deployed. List the smallest changes, data sources, environment variables and risks. Stop before deployment and give me a decision: save, change or skip.

A useful answer should not only say “it works.” It should show what changed, which access is needed, how test data is used and which decision a human needs to make.

Why we are refreshing this release-note page

Search Console shows that Hammer already appears for Codex release-note searches, but the click-through rate is weak. That means the page has to answer the real question faster: “What changed, does it affect my rollout, and what should I test before I update or publish?”

For the Codex pages, the goal is not more news recaps. The goal is better decision support:

• version or date,
• which surface changed: CLI, app, remote, plugin or mobile,
• risk around login, MCP/plugin access, file writes, logs or publishing,
• a small test repo or test project,
• rollback if something goes wrong.

Related Hammer Codex pages: CLI 0.135.0 and diagnostics, app 26.602 as a rollout check and Codex 0.143.0 with plugins and remote flows.

Practical rollout check for Sites

Use this check before Codex does anything public:

• Choose a test project: no customer data, no real payments, no live permissions.
• Ask for a saved version first: do not publish in the same prompt that creates the prototype.
• Review diff and dependencies: especially environment variables, database, auth and external calls.
• Keep access narrow: owner/admin first, then workspace or selected group.
• Document the decision: why did you publish, who approved it and what should be followed up?
• Plan unpublishing: an internal web app without a stop routine is not ready.

If that feels heavy for a small prototype, that is the point. A prototype nobody owns quickly becomes an internal system without support. Hammer can help make the first Sites or Codex routine small enough to test, but clear enough to operate.