diff --git a/apps/codex-claude-workstation/README.md b/apps/codex-claude-workstation/README.md
new file mode 100644
index 000000000..9bb1ddeab
--- /dev/null
+++ b/apps/codex-claude-workstation/README.md
@@ -0,0 +1,113 @@
+# Codex Claude Workstation
+
+## 产品介绍
+
+浏览器可访问的 Codex AI 编程工作站，集成 code-server (VS Code) 和丰富的开发工具链。
+
+## 主要功能
+
+- **code-server (VS Code)** — 浏览器内完整 VS Code 体验
+- **Codex CLI** — OpenAI Codex AI 编程助手
+- **Claude Code** — Anthropic Claude Code CLI
+- **开发工具链** — Go, Rust, Bun, Docker CLI, yq, gh, shellcheck 等 30+ 工具
+- **代理支持** — 通过 supervisord 按需启用 Clash.Meta/sing-box/Xray
+
+## Introduction
+
+Browser-accessible Codex AI development workstation with code-server (VS Code) and rich dev toolchain.
+
+## Features
+
+- **code-server (VS Code)** — Full VS Code experience in browser
+- **Codex CLI** — OpenAI Codex AI coding assistant
+- **Claude Code** — Anthropic Claude Code CLI
+- **Dev Toolchain** — Go, Rust, Bun, Docker CLI, yq, gh, shellcheck, 30+ tools
+- **Proxy Support** — On-demand Clash.Meta/sing-box/Xray via supervisord
+
+## 安装说明
+
+镜像由 `codex-claude-workstation-builder` 预先编译，发布在：
+
+```
+ghcr.io/okxlin/codex-claude-workstation:latest
+```
+
+1Panel 安装时自动拉取，无需手动构建。
+
+## 参数填写指南
+
+### 必填参数
+
+**`PANEL_APP_PORT_HTTP`** — Web 访问端口
+- code-server 对外暴露的访问端口
+- 默认 `8080`，可改为任意未占用端口
+- 安装后通过 `http://你的IP:此端口` 访问
+
+**`CODE_SERVER_PASSWORD`** — code-server 密码
+- 登录 code-server 时使用的密码
+- 默认 `change-me`，请务必修改
+
+**`ROOT_PASSWORD`** — Root 用户密码
+- 容器 root 用户的密码（可通过 `su - root` 切换登录）
+- 默认 `codex2024`，建议修改为更强的密码
+
+**`APP_DATA_DIR`** — 数据目录
+- 工作区文件存放的宿主机目录
+- 默认 `./data`，建议填写绝对路径如 `/data/codex-workstation
+
+### 可选参数
+
+**`DOCKER_SOCK_SRC`** — Docker 套接字路径
+- 挂载宿主机 Docker Socket 到容器内 `/var/run/docker.sock`
+- 默认 `/var/run/docker.sock`，留空则禁用 Docker CLI
+- 必须先通过 ROOT_PASSWORD 切换至 root 才可使用 Docker CLI
+
+**`TZ`** — 时区
+- 默认 `Asia/Shanghai`
+- 可选，留空使用系统默认
+
+### 不在安装表单中的参数
+
+**`PROXY_ENABLED`** — 代理 (手动启用)
+- 默认不启动；内置 clash-meta / sing-box / xray 二进制
+- 通过 `supervisorctl start clash-meta|sing-box|xray` 按需启用
+- 代理配置文件放入 `/home/dev/proxy/`（持久化），如 `clash-meta.yaml` / `sing-box.json` / `xray.json`
+
+## 访问说明
+
+安装完成后通过分配的端口访问：
+
+- `http://IP:端口` — code-server (VS Code)，集成终端在 VS Code 内使用
+
+## 首次登录
+
+安装完成后进入容器执行 Codex 登录：
+
+```bash
+docker exec -it ${CONTAINER_NAME} bash
+codex login --device-auth
+```
+
+## 认证说明
+
+code-server 密码认证（单层）：
+
+1. **code-server 密码** — VS Code 登录时使用的密码
+
+## 数据持久化
+
+| 数据 | 路径 | 持久化方式 |
+|------|------|-----------|
+| 工作区 | `/workspace` | 绑定挂载到数据目录 |
+| Codex 配置 | `/home/dev/.codex` | Named volume `codex-home` |
+| 代理配置 | `/home/dev/proxy/` | Named volume `codex-home` |
+| code-server 配置 | `/home/dev/.config/code-server/` | Named volume `codex-home` |
+| 本地二进制 | `/home/dev/.local/bin/` | Named volume `codex-home` |
+
+## 注意事项
+
+- 不支持 Chat Completions-only API（必须支持 OpenAI Responses API）
+- 首次安装后需在 code-server 终端执行 `codex login` 认证
+- 不默认启动 Codex App Server
+- 容器以 `dev` 用户运行（非 root），可通过 ROOT_PASSWORD 切换至 root
+- 代理默认不启动，按需通过 `supervisorctl start clash-meta|sing-box|xray` 启用
diff --git a/apps/codex-claude-workstation/data.yml b/apps/codex-claude-workstation/data.yml
new file mode 100644
index 000000000..cca94eaff
--- /dev/null
+++ b/apps/codex-claude-workstation/data.yml
@@ -0,0 +1,29 @@
+name: Codex Claude Workstation
+tags:
+  - Tool
+title: Codex Claude Workstation
+description: 浏览器可访问的 Codex + Claude AI 编程工作站
+additionalProperties:
+  key: codex-claude-workstation
+  name: Codex Claude Workstation
+  tags:
+    - Tool
+  type: tool
+  website: https://github.com/openai/codex
+  document: https://github.com/openai/codex
+  architectures:
+    - amd64
+  github: https://github.com/okxlin/release-factory
+  shortDescZh: 浏览器可访问的 Codex + Claude AI 编程工作站
+  shortDescEn: Browser-accessible Codex + Claude AI workstation
+  description:
+    en: Browser-accessible Codex + Claude AI workstation with code-server (VS Code)
+    zh: 浏览器可访问的 Codex + Claude AI 编程工作站，集成 code-server (VS Code)
+    zh-Hant: 瀏覽器可訪問的 Codex + Claude AI 編程工作站，集成 code-server (VS Code)
+    ja: ブラウザからアクセス可能な Codex + Claude AI 開発ワークステーション
+    ko: 브라우저에서 접근 가능한 Codex + Claude AI 개발 워크스테이션
+    ru: Доступная через браузер рабочая станция Codex + Claude AI
+    ms: Stesen kerja pembangunan Codex + Claude AI yang boleh diakses melalui pelayar
+    pt-br: Estação de trabalho Codex + Claude AI acessível pelo navegador
+  crossVersionUpdate: false
+  limit: 1
\ No newline at end of file
diff --git a/apps/codex-claude-workstation/latest/.env.sample b/apps/codex-claude-workstation/latest/.env.sample
new file mode 100644
index 000000000..6510325e1
--- /dev/null
+++ b/apps/codex-claude-workstation/latest/.env.sample
@@ -0,0 +1,8 @@
+# codex-claude-workstation 1Panel environment variables
+PANEL_APP_PORT_HTTP=8080
+CODE_SERVER_PASSWORD=change-me
+ROOT_PASSWORD=codex2024
+DOCKER_SOCK_SRC=/var/run/docker.sock
+APP_DATA_DIR=./data
+CONTAINER_NAME=codex-claude-workstation
+TZ=Asia/Shanghai
diff --git a/apps/codex-claude-workstation/latest/data.yml b/apps/codex-claude-workstation/latest/data.yml
new file mode 100644
index 000000000..a0dc1f482
--- /dev/null
+++ b/apps/codex-claude-workstation/latest/data.yml
@@ -0,0 +1,101 @@
+additionalProperties:
+  formFields:
+    - envKey: PANEL_APP_PORT_HTTP
+      type: number
+      required: true
+      default: 8080
+      rule: paramPort
+      labelZh: Web 访问端口
+      labelEn: Web Port
+      label:
+        en: Web Port
+        zh: Web 访问端口
+        zh-Hant: Web 訪問端口
+        ja: Web ポート
+        ko: 웹 포트
+        ru: Веб-порт
+        ms: Port Web
+        pt-br: Porta Web
+      edit: true
+    - envKey: CODE_SERVER_PASSWORD
+      type: password
+      required: true
+      random: true
+      default: change-me
+      labelZh: code-server 密码
+      labelEn: Code-server Password
+      label:
+        en: Code-server Password
+        zh: code-server 密码
+        zh-Hant: code-server 密碼
+        ja: code-server パスワード
+        ko: code-server 비밀번호
+        ru: Пароль code-server
+        ms: Kata Laluan code-server
+        pt-br: Senha do code-server
+      edit: true
+    - envKey: ROOT_PASSWORD
+      type: password
+      required: false
+      random: true
+      default: codex2024
+      labelZh: Root 密码
+      labelEn: Root Password
+      label:
+        en: Root Password
+        zh: Root 密码
+        zh-Hant: Root 密碼
+        ja: Root パスワード
+        ko: Root 비밀번호
+        ru: Пароль Root
+        ms: Kata Laluan Root
+        pt-br: Senha do Root
+      edit: true
+    - default: /var/run/docker.sock
+      edit: true
+      envKey: DOCKER_SOCK_SRC
+      type: text
+      required: false
+      labelEn: Docker Socket Path (leave empty to disable)
+      labelZh: Docker 套接字路径（留空禁用）
+      label:
+        en: Docker Socket Path (leave empty to disable)
+        zh: Docker 套接字路径（留空禁用）
+        zh-Hant: Docker 套接字路徑（留空禁用）
+        ja: Docker ソケットパス（空欄で無効）
+        ko: Docker 소켓 경로 (비우면 비활성화)
+        ru: Путь к Docker-сокету (оставьте пустым для отключения)
+        ms: Laluan soket Docker (kosongkan untuk lumpuhkan)
+        pt-br: Caminho do socket Docker (deixe em branco para desabilitar)
+    - envKey: APP_DATA_DIR
+      type: text
+      required: true
+      default: ./data
+      labelZh: 数据目录
+      labelEn: Data Directory
+      label:
+        en: Data Directory
+        zh: 数据目录
+        zh-Hant: 數據目錄
+        ja: データディレクトリ
+        ko: 데이터 디렉토리
+        ru: Каталог данных
+        ms: Direktori Data
+        pt-br: Diretório de Dados
+      edit: true
+    - envKey: TZ
+      type: text
+      required: false
+      default: Asia/Shanghai
+      labelZh: 时区
+      labelEn: Timezone
+      label:
+        en: Timezone
+        zh: 时区
+        zh-Hant: 時區
+        ja: タイムゾーン
+        ko: 시간대
+        ru: Часовой пояс
+        ms: Zon Waktu
+        pt-br: Fuso Horário
+      edit: true
\ No newline at end of file
diff --git a/apps/codex-claude-workstation/latest/docker-compose.yml b/apps/codex-claude-workstation/latest/docker-compose.yml
new file mode 100644
index 000000000..3115efa39
--- /dev/null
+++ b/apps/codex-claude-workstation/latest/docker-compose.yml
@@ -0,0 +1,34 @@
+services:
+  workstation:
+    image: "ghcr.io/okxlin/codex-claude-workstation:latest"
+    container_name: ${CONTAINER_NAME}
+    hostname: workstation
+    restart: always
+    labels:
+      createdBy: "Apps"
+    environment:
+      - TZ=${TZ:-Asia/Shanghai}
+      - PASSWORD=${CODE_SERVER_PASSWORD:-change-me}
+      - ROOT_PASSWORD=${ROOT_PASSWORD:-codex2024}
+    volumes:
+      - ${APP_DATA_DIR:-./data}/workspace:/workspace
+      - codex-home:/home/dev
+      - ${DOCKER_SOCK_SRC:-/var/run/docker.sock}:/var/run/docker.sock
+    ports:
+      - ${PANEL_APP_PORT_HTTP}:8080
+    healthcheck:
+      test: ["CMD", "/usr/local/bin/healthcheck.sh"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 15s
+    networks:
+      - 1panel-network
+
+volumes:
+  codex-home:
+    name: codex-home
+
+networks:
+  1panel-network:
+    external: true
diff --git a/apps/codex-claude-workstation/latest/scripts/init.sh b/apps/codex-claude-workstation/latest/scripts/init.sh
new file mode 100755
index 000000000..aa05ecff9
--- /dev/null
+++ b/apps/codex-claude-workstation/latest/scripts/init.sh
@@ -0,0 +1,22 @@
+#!/bin/bash
+# init.sh — codex-claude-workstation 1Panel 初始化脚本
+set -eo pipefail
+
+echo "Codex Claude Workstation installed successfully."
+echo ""
+echo "Access:"
+echo "  http://<server-ip>:${PANEL_APP_PORT_HTTP}"
+echo "  Login: code-server password"
+echo "  Switch to root: su - root (password: ${ROOT_PASSWORD:-codex2024})"
+echo ""
+echo "AI Tools (run in code-server terminal):"
+echo "  codex --help          OpenAI Codex CLI"
+echo "  claude --help         Anthropic Claude Code"
+echo ""
+echo "Docker CLI (if DOCKER_SOCK_SRC set):"
+echo "  su - root"
+echo "  docker ps"
+echo ""
+echo "Proxy (manual enable):"
+echo "  supervisorctl start clash-meta  # or sing-box, xray"
+echo "  Configs: ~/proxy/"
diff --git a/apps/codex-claude-workstation/latest/scripts/uninstall.sh b/apps/codex-claude-workstation/latest/scripts/uninstall.sh
new file mode 100755
index 000000000..72bbb17be
--- /dev/null
+++ b/apps/codex-claude-workstation/latest/scripts/uninstall.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+# uninstall.sh — codex-claude-workstation cleanup
+docker-compose down --volumes
\ No newline at end of file
diff --git a/apps/codex-claude-workstation/latest/scripts/upgrade.sh b/apps/codex-claude-workstation/latest/scripts/upgrade.sh
new file mode 100755
index 000000000..c3042d497
--- /dev/null
+++ b/apps/codex-claude-workstation/latest/scripts/upgrade.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+# upgrade.sh — codex-claude-workstation upgrade placeholder
+set -eo pipefail
+echo "Upgrade placeholder: docker compose pull && docker compose up -d"
diff --git a/apps/codex-claude-workstation/logo.png b/apps/codex-claude-workstation/logo.png
new file mode 100644
index 000000000..9cec3e62d
Binary files /dev/null and b/apps/codex-claude-workstation/logo.png differ