LICENSE
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
APPENDIX: How to apply the Apache License to your work.
To apply the Apache License to your work, attach the following
boilerplate notice, with the fields enclosed by brackets "[]"
replaced with your own identifying information. (Don't include
the brackets!) The text should be enclosed in the appropriate
comment syntax for the file format. We also recommend that a
file or class name and description of purpose be included on the
same "printed page" as the copyright notice for easier
identification within third-party archives.
Copyright [yyyy] [name of copyright owner]
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
NOTICE
codex-cli skill
Copyright 2026 Hibiki Yonahara
This skill as a whole is licensed under the Apache License, Version 2.0.
The full license text is included in this directory as LICENSE.
This skill contains material derived from the Codex plugin for Claude Code
(openai/codex-plugin-cc, https://github.com/openai/codex-plugin-cc), which is
licensed under the Apache License, Version 2.0. A copy of that license is
included in this directory as LICENSE.
--------------------------------------------------------------------------
Attribution notices reproduced from the NOTICE file of
openai/codex-plugin-cc:
Copyright 2026 OpenAI
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
--------------------------------------------------------------------------
Provenance of the files in this directory:
references/adversarial-review-prompt.md
Unmodified copy of prompts/adversarial-review.md from
openai/codex-plugin-cc (plugin version 1.0.6). Only the file name and
location changed.
references/review-output.schema.json
Unmodified copy of schemas/review-output.schema.json from
openai/codex-plugin-cc (plugin version 1.0.6). Only the file location
changed.
references/code-review.md
Modified derivative work. The review workflow of openai/codex-plugin-cc
(target auto-selection, size estimation, adversarial review context
collection, and result presentation rules) was rewritten as plain Codex
CLI invocations so that it runs without the plugin's app-server runtime.
SKILL.md, references/advanced.md
Original work, documenting the Codex CLI itself (verified against
codex-cli 0.160.1). Not derived from openai/codex-plugin-cc.
references/advanced.md
# Advanced Codex CLI Usage
Verified against codex-cli 0.160.1. Flags churn between releases — on parse errors, check `codex exec --help` first.
## Approval
- Approval policy `-a/--ask-for-approval <on-request|never>` exists only on the interactive `codex` command, not on `codex exec`.
- `--approve-for-me` (interactive and `codex exec`) routes approval requests through automatic review with the workspace-write sandbox.
## Configuration Overrides
Use `-c key=value` for inline config overrides (dotted paths for nesting; value parsed as TOML):
```bash
codex exec -c model_reasoning_effort="high" "task" < /dev/null
codex exec -c 'sandbox_permissions=["disk-full-read-access"]' "task" < /dev/null
codex exec -c shell_environment_policy.inherit=all "task" < /dev/null
```
Reasoning effort values depend on the model: `low`, `medium`, `high`, `xhigh` are common, and some models add `max` and `ultra`. Check per-model support in the catalog (below).
## Models
- `-m <model>` overrides; unset inherits `model` from `~/.codex/config.toml`.
- `codex debug models` prints the model catalog as JSON, including each model's supported reasoning levels.
## Profiles
`-p <name>` layers `$CODEX_HOME/<name>.config.toml` on top of the base user config (profile-as-file, not a `[profiles]` section):
```bash
codex exec -p review "Review this code" < /dev/null # loads ~/.codex/review.config.toml
```
## Structured / machine-readable output
```bash
codex exec --output-schema schema.json -o /tmp/result.json "Analyze and return structured results" < /dev/null
codex exec --json "task" < /dev/null 2>/dev/null | jq . # JSONL event stream
```
## Session Management
```bash
codex exec resume --last "follow-up prompt" # continue the last exec session
codex resume --last # interactive: continue most recent interactive session
codex fork --last # interactive: fork most recent
codex apply <TASK_ID> # git-apply the diff of a Codex Cloud task
```
`codex resume --last` skips exec sessions unless `--include-non-interactive` is given.
`--ephemeral` skips session persistence entirely (no resume possible).
## Isolation and repo checks
| Flag | Effect |
|------|--------|
| `--skip-git-repo-check` | Allow running outside a Git repository |
| `--ignore-user-config` | Don't load `~/.codex/config.toml` (auth still works) |
| `--ignore-rules` | Don't load execpolicy `.rules` files |
| `--add-dir <dir>` | Extra writable directories alongside the workspace |
## Web search
`--search` enables the native `web_search` tool for the run (no per-call approval). It is a top-level flag: `codex exec --search` is rejected, so put it before the subcommand.
```bash
codex --search exec --sandbox read-only -C <dir> "task" < /dev/null
```
## Local/OSS Models
```bash
codex exec --oss --local-provider ollama "task" < /dev/null # or lmstudio
```
## Feature Flags
```bash
codex features list # inspect available flags and their stability
codex exec --enable <feature> --disable <feature> "task" < /dev/null
```
## Diagnostics
```bash
codex doctor # check installation, config, auth, runtime health
```
references/adversarial-review-prompt.md
<role>
You are Codex performing an adversarial software review.
Your job is to break confidence in the change, not to validate it.
</role>
<task>
Review the provided repository context as if you are trying to find the strongest reasons this change should not ship yet.
Target: {{TARGET_LABEL}}
User focus: {{USER_FOCUS}}
</task>
<operating_stance>
Default to skepticism.
Assume the change can fail in subtle, high-cost, or user-visible ways until the evidence says otherwise.
Do not give credit for good intent, partial fixes, or likely follow-up work.
If something only works on the happy path, treat that as a real weakness.
</operating_stance>
<attack_surface>
Prioritize the kinds of failures that are expensive, dangerous, or hard to detect:
- auth, permissions, tenant isolation, and trust boundaries
- data loss, corruption, duplication, and irreversible state changes
- rollback safety, retries, partial failure, and idempotency gaps
- race conditions, ordering assumptions, stale state, and re-entrancy
- empty-state, null, timeout, and degraded dependency behavior
- version skew, schema drift, migration hazards, and compatibility regressions
- observability gaps that would hide failure or make recovery harder
</attack_surface>
<review_method>
Actively try to disprove the change.
Look for violated invariants, missing guards, unhandled failure paths, and assumptions that stop being true under stress.
Trace how bad inputs, retries, concurrent actions, or partially completed operations move through the code.
If the user supplied a focus area, weight it heavily, but still report any other material issue you can defend.
{{REVIEW_COLLECTION_GUIDANCE}}
</review_method>
<finding_bar>
Report only material findings.
Do not include style feedback, naming feedback, low-value cleanup, or speculative concerns without evidence.
A finding should answer:
1. What can go wrong?
2. Why is this code path vulnerable?
3. What is the likely impact?
4. What concrete change would reduce the risk?
</finding_bar>
<structured_output_contract>
Return only valid JSON matching the provided schema.
Keep the output compact and specific.
Use `needs-attention` if there is any material risk worth blocking on.
Use `approve` only if you cannot support any substantive adversarial finding from the provided context.
Every finding must include:
- the affected file
- `line_start` and `line_end`
- a confidence score from 0 to 1
- a concrete recommendation
Write the summary like a terse ship/no-ship assessment, not a neutral recap.
</structured_output_contract>
<grounding_rules>
Be aggressive, but stay grounded.
Every finding must be defensible from the provided repository context or tool outputs.
Do not invent files, lines, code paths, incidents, attack chains, or runtime behavior you cannot support.
If a conclusion depends on an inference, state that explicitly in the finding body and keep the confidence honest.
</grounding_rules>
<calibration_rules>
Prefer one strong finding over several weak ones.
Do not dilute serious issues with filler.
If the change looks safe, say so directly and return no findings.
</calibration_rules>
<final_check>
Before finalizing, check that each finding is:
- adversarial rather than stylistic
- tied to a concrete code location
- plausible under a real failure scenario
- actionable for an engineer fixing the issue
</final_check>
<repository_context>
{{REVIEW_INPUT}}
</repository_context>
references/code-review.md
# Code Review with Codex CLI
Distilled from openai/codex-plugin-cc (the official Codex plugin for Claude Code), reduced to plain CLI invocations so it works without the plugin's app-server runtime.
> Modified derivative work: this file rewrites the review workflow of [openai/codex-plugin-cc](https://github.com/openai/codex-plugin-cc) (Apache License 2.0, Copyright 2026 OpenAI) as plain CLI invocations. See [../NOTICE](../NOTICE) and [../LICENSE](../LICENSE).
## Choosing the command
- `codex review` — built-in reviewer, human-readable report on stdout. No model/output flags.
- `codex exec review` — same reviewer with exec plumbing: `-m`, `-o <file>`, `--json`, `--output-schema`, `--ephemeral`. Prefer this when you need to capture or post-process the result.
- Neither accepts `-C`; run them from inside the target repository.
- Neither accepts `--sandbox`; the reviewer picks its own sandbox (`read-only`; the `sandbox:` line in the run header shows the effective one).
- Custom review instructions go in the positional `[PROMPT]` argument (or stdin via `-`). The plugin deliberately passes no custom text to the standard review and reserves focus text for the adversarial variant — mixing focus text into a standard review dilutes the built-in reviewer's own rubric.
## Target selection
Explicit targets:
| Target | Flag |
|--------|------|
| Staged + unstaged + untracked | `--uncommitted` |
| Branch diff against a base | `--base <ref>` (merge-base semantics, i.e. `<ref>...HEAD`) |
| Single commit | `--commit <sha>` |
Auto-selection logic (what the plugin does when the user doesn't specify):
1. If the working tree is dirty (any staged, unstaged, or untracked files) → `--uncommitted`.
2. Otherwise → `--base <default branch>`.
Detect the default branch in this order:
```bash
git symbolic-ref refs/remotes/origin/HEAD # refs/remotes/origin/<name> → <name>
```
Fallback: try `main`, `master`, `trunk` as local heads, then as `origin/<name>`. If none exist, ask the user for `--base`.
Untracked files count as reviewable work even when `git diff --shortstat` is empty. Only conclude "nothing to review" when the relevant scope is actually empty; when in doubt, run the review.
## Size estimation: wait vs background
Estimate before running so the user isn't blocked on a long review:
```bash
git status --short --untracked-files=all
git diff --shortstat --cached && git diff --shortstat # working-tree review
git diff --shortstat <base>...HEAD # branch review
```
- Clearly tiny (roughly 1–2 files, no directory-sized untracked additions) → run in the foreground.
- Anything larger or unclear → run as a background task (`run_in_background`) and report back when it finishes.
## Adversarial review
A distinct review mode that challenges the implementation approach, design choices, tradeoffs, and assumptions — not just a stricter pass over implementation defects. Run it as a plain `codex exec` with a purpose-built prompt and a JSON output contract:
```bash
SKILL_DIR=<absolute path of the directory holding this skill's SKILL.md>
codex exec --sandbox read-only --ephemeral \
--output-schema "$SKILL_DIR/references/review-output.schema.json" \
-o /tmp/adversarial-review.json \
- < /tmp/adversarial-prompt.md
```
`--output-schema` needs a real path, so resolve `references/review-output.schema.json` against wherever this skill is installed instead of hard-coding a location.
Build `/tmp/adversarial-prompt.md` from [adversarial-review-prompt.md](adversarial-review-prompt.md) by filling the placeholders:
| Placeholder | Value |
|-------------|-------|
| `{{TARGET_LABEL}}` | e.g. `working tree diff` or `branch diff against origin/main` |
| `{{USER_FOCUS}}` | The user's focus text, or `No extra focus provided.` |
| `{{REVIEW_COLLECTION_GUIDANCE}}` | See below — inline vs self-collect |
| `{{REVIEW_INPUT}}` | The repository context (see below) |
### Context collection: inline vs self-collect
The plugin inlines the full diff only for small changes (≤ 2 files and ≤ 256 KB of diff); larger changes get a summary plus an instruction for Codex to collect the diff itself. Self-collect is usually the better default from the CLI — Codex reads the repo directly and the prompt stays small.
- Inline mode — `{{REVIEW_COLLECTION_GUIDANCE}}` = `Use the repository context below as primary evidence.` and `{{REVIEW_INPUT}}` contains the full diff:
- working tree: `git status --short --untracked-files=all`, `git diff --cached --binary --no-ext-diff --submodule=diff`, `git diff --binary --no-ext-diff --submodule=diff`, plus untracked file bodies (skip binaries and files over ~24 KB)
- branch: `git log --oneline --decorate <merge-base>..HEAD`, `git diff --stat <merge-base>..HEAD`, `git diff --binary --no-ext-diff --submodule=diff <merge-base>..HEAD`
- Self-collect mode — `{{REVIEW_COLLECTION_GUIDANCE}}` = `The repository context below is a lightweight summary. Inspect the target diff yourself with read-only git commands before finalizing findings.` and `{{REVIEW_INPUT}}` contains only status, shortstat, and the changed-file list.
### Output
The schema ([review-output.schema.json](review-output.schema.json)) enforces:
- `verdict`: `approve` | `needs-attention`
- `summary`: terse ship/no-ship assessment
- `findings[]`: `severity` (critical/high/medium/low), `title`, `body`, `file`, `line_start`, `line_end`, `confidence` (0–1), `recommendation`
- `next_steps[]`
The `-o` file contains the final JSON message. Parse failures happen; keep the raw output (`tee` the run) instead of re-running.
## Presenting review results
Rules the plugin enforces on the Claude side, worth keeping:
- Present findings first, ordered by severity, preserving the verdict / summary / findings / next-steps structure.
- Use file paths and line numbers exactly as Codex reports them.
- Preserve evidence boundaries: if Codex marked something as an inference or open question, keep that distinction.
- No findings → say so explicitly, with a brief residual-risk note.
- After presenting findings, STOP. Do not fix anything — ask the user which issues, if any, they want fixed before touching a single file, even when the fix is obvious.
- Malformed output or a failed run → show the most actionable stderr lines and stop; don't guess or substitute your own review.
## Follow-up
For adversarial reviews run via `codex exec` (without `--ephemeral` if you plan this), continue the same session:
```bash
codex exec resume --last "Explain finding #2 in more depth and propose a concrete patch"
```
Native `codex review` runs don't advertise a resume path; re-run with sharper instructions instead.
references/review-output.schema.json
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"type": "object",
"additionalProperties": false,
"required": [
"verdict",
"summary",
"findings",
"next_steps"
],
"properties": {
"verdict": {
"type": "string",
"enum": [
"approve",
"needs-attention"
]
},
"summary": {
"type": "string",
"minLength": 1
},
"findings": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": false,
"required": [
"severity",
"title",
"body",
"file",
"line_start",
"line_end",
"confidence",
"recommendation"
],
"properties": {
"severity": {
"type": "string",
"enum": [
"critical",
"high",
"medium",
"low"
]
},
"title": {
"type": "string",
"minLength": 1
},
"body": {
"type": "string",
"minLength": 1
},
"file": {
"type": "string",
"minLength": 1
},
"line_start": {
"type": "integer",
"minimum": 1
},
"line_end": {
"type": "integer",
"minimum": 1
},
"confidence": {
"type": "number",
"minimum": 0,
"maximum": 1
},
"recommendation": {
"type": "string"
}
}
}
},
"next_steps": {
"type": "array",
"items": {
"type": "string",
"minLength": 1
}
}
}
}
SKILL.md
---
name: codex-cli
description: Delegate coding tasks to OpenAI Codex CLI agent for parallel execution. Use when the user asks to run Codex, use Codex for code analysis, code review, adversarial review, bug investigation, refactoring suggestions, or architecture analysis. Also use when the user wants a second opinion from another AI agent, or wants to offload a task to Codex. Triggers on mentions of "codex", "/codex", or requests to delegate work to Codex CLI.
license: Apache-2.0
---
# Codex CLI
Run OpenAI Codex CLI from Claude Code to delegate coding tasks to a separate AI agent.
Verified against codex-cli 0.160.1 (2026-10). After a `codex update`, re-check flags with `codex --help` before relying on this document.
## Quick Start
Execute a task with Codex:
```bash
codex exec --sandbox read-only -C <directory> "<prompt>" < /dev/null
```
For long prompts, write the prompt to a file and pass it via stdin with `-` (avoids heredoc quoting issues):
```bash
codex exec --sandbox read-only -C <directory> - < /tmp/prompt.md
```
Append to every `codex exec` task prompt: `確認や質問は不要です。具体的な提案・修正案・コード例まで自主的に出力してください。` (Not applicable to `codex review` / `codex exec review`, which take no custom text by default.)
## Commands
### `codex exec` — Non-interactive task execution
Primary command for delegating tasks. Key options:
| Option | Description |
|--------|-------------|
| `--sandbox <mode>` | `read-only`, `workspace-write`, `danger-full-access` |
| `-C <dir>` | Working directory for the agent |
| `-m <model>` | Model override. Unset = default from `~/.codex/config.toml` |
| `-o <file>` | Write the agent's last message to file |
| `--json` | Stream events as JSONL to stdout |
| `--output-schema <file>` | Force the final message to match a JSON Schema |
| `-i <file>` | Attach image(s) to prompt |
| `--ephemeral` | Do not persist session files to disk |
`codex exec` never asks for approval; failures are returned to the model. For write access use `--sandbox workspace-write`.
### `codex review` / `codex exec review` — Code review
Both run the built-in reviewer non-interactively against the current repo (no `-C`; cd into the repo first). Review commands accept no `--sandbox` flag — the reviewer uses its own sandbox (read-only).
```bash
codex review --uncommitted
codex review --base main
codex review --commit <sha>
codex review "<custom review instructions>"
codex exec review --base main -o /tmp/review.md # exec variant: adds -m, -o, --json, --output-schema
```
| Option | Description |
|--------|-------------|
| `--uncommitted` | Review staged, unstaged, and untracked changes |
| `--base <branch>` | Review changes against a base branch (merge-base semantics) |
| `--commit <sha>` | Review changes from a specific commit |
| `--title <title>` | Optional title for review summary |
For target auto-selection, adversarial (design-challenging) review, structured findings output, and how to present results, see [references/code-review.md](references/code-review.md).
## Usage Patterns
### Read-only analysis (safe default)
```bash
codex exec --sandbox read-only -C /path/to/project "Analyze the authentication flow and identify potential security issues" < /dev/null
```
### Code modification
```bash
codex exec --sandbox workspace-write -C /path/to/project "Add input validation to the user registration endpoint" < /dev/null
```
### Capture output to file
```bash
codex exec --sandbox read-only -o /tmp/codex-output.md -C /path/to/project "Explain the database schema and relationships" < /dev/null
```
### Follow-up on a previous run
```bash
codex exec resume --last "Apply the top recommendation from your analysis"
```
## Sandbox Modes
Choose the appropriate sandbox level:
- **`read-only`** (recommended default): Safe analysis, review, explanation tasks. Cannot modify files.
- **`workspace-write`**: When Codex needs to create or modify files in the project directory (add `--add-dir <dir>` for extra writable directories).
- **`danger-full-access`**: Full system access. Only use when explicitly requested by the user.
Never use `--dangerously-bypass-approvals-and-sandbox`.
## Best Practices
- Always close or supply stdin for `codex exec`: append `< /dev/null` when the prompt is an argument, or pass `- < prompt.md`. The Bash tool's stdin is a pipe, so `codex exec` tries to append it as a `<stdin>` block and hangs at `Reading additional input from stdin...` (`codex review`, `codex exec review`, and `codex exec resume` do not read stdin unless given `-`)
- For long runs, start with `run_in_background` and check the log tail after a few tens of seconds to confirm progress, so a stall is caught early
- Default to `--sandbox read-only` for analysis tasks
- Always specify `-C <dir>` for `codex exec` (review commands run against the cwd instead)
- Append the self-execution instruction to the prompt for autonomous operation
- Use `-o <file>` to capture output; for long runs also `tee` the full stdout/stderr to a non-committed location so a failed parse never forces a paid re-run
- Leave `-m` unset unless the user asks for a specific model; reasoning effort is `-c model_reasoning_effort="<level>"` (supported levels vary by model; see [references/advanced.md](references/advanced.md))
- For advanced options (profiles, feature flags, web search, local models), see [references/advanced.md](references/advanced.md)
## License
This skill contains material derived from [openai/codex-plugin-cc](https://github.com/openai/codex-plugin-cc), licensed under the Apache License, Version 2.0. See [NOTICE](NOTICE) for attribution and per-file provenance, and [LICENSE](LICENSE) for the license text.