Codex Delegation

Table of Contents

• Overview
• When To Use
• When NOT To Use
• Prerequisites
• Quick Start
• Smart Delegation
• Codex-Specific Details
• Exit Criteria

Codex CLI Delegation

Overview

OpenAI's Codex CLI ships as npm @openai/codex and installs a codex binary. Its headless entry point is codex exec, which takes the prompt as a positional argument and reuses saved CLI credentials.

When To Use

• delegation-core selected codex for the task
• OpenAI credentials are already configured on the machine
• The work suits a second opinion from a non-Anthropic, non-Google model

When NOT To Use

• The host is headless and codex login has never succeeded there. See the login caveat below
• The job checks out untrusted repository code. OpenAI's own docs warn against exposing the key as a job-level environment variable in that case

Prerequisites

Installation

npm install -g @openai/codex

Homebrew and a curl installer are also documented upstream.

Authentication

Either persist an API key or log in interactively:

printenv OPENAI_API_KEY | codex login --with-api-key

Verification runs codex login status, which reports one of "Logged in using an API key", "Logged in using ChatGPT", "Logged in using Agent Identity", or "Not logged in". The service uses that probe rather than checking a single variable, because either credential path is valid and only the probe sees both.

CODEX_API_KEY scopes a credential to a single codex exec run.

Quick Start

Using the shared delegation executor

uv run python scripts/delegation_executor.py codex "Explain this module" \
  --files src/

Through the Makefile

make -C plugins/conjure delegate-codex PROMPT='Explain this module'

Direct CLI usage

codex exec "Explain the retry logic in this package"

Smart Delegation

codex declares the code_execution strength and ranks behind gemini, qwen, minimax, glm and muse in the candidate order. It declares no model ids, so smart_delegate leaves model selection to the CLI.

Codex-Specific Details

Login caveat worth knowing before scripting this: an open issue (openai/codex#9253) reports that codex login fails outright on headless hosts, over SSH or in containers, unless a workspace administrator has separately enabled device-code auth. That is a single reporter's account with no maintainer confirmation, but it is the failure mode to check first when codex exec will not run unattended. Persisting an API key beforehand avoids it.

Exit Criteria

• codex resolves on PATH and answers codex --version
• codex login status reports a logged-in state rather than "Not logged in"
• The built command is codex exec <prompt> with the prompt last and no prompt flag before it
• File context was inlined into the prompt
• Output saved to delegations/codex/YYYYMMDD_HHMMSS.md
• This skill ran because delegation-core selected codex