config-codex

Configures and recovers a public-safe local Codex home with hooks, agents, and validation.

7|5|Updated Jul 22, 2025
One-click install
npx skills add https://github.com/nebius/nebius-ps-services --skill config-codex-nebius
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: config-codex
Source: https://github.com/nebius/nebius-ps-services/tree/main/skills/config-codex
Command: npx skills add https://github.com/nebius/nebius-ps-services --skill config-codex-nebius

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve? Setting up or recovering a local Codex runtime environment (config.toml, AGENTS.md, hooks, custom agents, task-state storage) is error-prone and risks leaking private paths, secrets, or machine-specific state into shared templates. This Skill bootstraps or aligns that setup from public-safe templates while preserving existing user configuration. ## Core Features & Use Cases - Patch-only configuration: Inspects existing AGENTS.md and config.toml, backs up only files that will change, and patches missing keys, hooks, and read-only agent entries without overwriting user content. - Missing-config recovery: Recreates a missing config.toml from a reviewed, allowlisted public-safe baseline using an atomic no-clobber renderer that rejects symlinks and sets mode 0600. - Idempotency preflight and validation: Runs a read-only check script that verifies hooks, multi_agent features, read-only custom agents, managed AGENTS.md blocks, and optional task-implementer workspace access without printing secrets. - Use Case: A developer on a new laptop asks Codex to configure their local setup; the skill renders templates, preserves existing MCP servers and preferences, validates TOML/JSON/hook syntax, and reports an alignment report before restart. ## Quick Start Ask Codex to configure my local Codex setup using the public templates, backing up existing files, keeping secrets out of config, and validating everything before reporting it is ready.

Frequently Asked Questions about config-codex

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I recover a missing Codex config.toml file?

Run the create-recovery-config.py script with your Codex home and project root. It renders the public-safe baseline template through an exclusive no-clobber write, rejects symlink targets, sets mode 0600, and excludes private or plugin-managed state.

How do I set up Codex hooks and custom read-only agents?

Copy the hook script and agent TOML templates into $CODEX_HOME/hooks and $CODEX_HOME/agents, then enable the hooks and multi_agent feature flags in config.toml. Restart Codex and review the hooks in /hooks before trusting them.

Will this overwrite my existing Codex configuration?

No. Existing AGENTS.md and config.toml are patch-only: the workflow parses them, adds only missing required keys or managed sections, preserves user values and comments, and reports conflicts instead of overwriting. An idempotency preflight runs first and stops if nothing needs changing.

Does the config template store API keys or secrets?

No. The template references only secret environment variable names such as CONTEXT7_API_KEY and GITHUB_TOKEN. Actual values belong in your shell profile, password manager, or secret manager and are never printed or committed.

Why does the idempotency preflight fail on my AGENTS.md?

The check fails when the managed config-codex block is missing, stale, or contains duplicate live-product-validation headings. Update only the content between the managed markers to match the current template guidance rather than replacing the whole file.

When should I not use the full-access profile in the template?

The approval_policy never and danger-full-access sandbox settings are intended only for trusted local developer machines. On shared or new machines, tighten these settings before enabling the setup, and the skill will never change your sandbox or approval policy without explicit request.