Codex Cheat Sheet

Codex is OpenAI’s coding agent, delivered across a CLI, IDE extension, cloud and app surfaces sharing one configuration. This is the reference for the Codex track. Re-verify commands, models and retirement dates against developers.openai.com/codex and developers.openai.com/codex/models.

Surfaces

Models and effort selection

Codex runs gpt-6-astra, gpt-5.6-sol, gpt-5.6-terra, gpt-5.6-luna, plus gpt-5.3-codex-spark (a text-only research preview for near-instant iteration, on ChatGPT Pro). gpt-5.5 and gpt-5.4 remain as “other models”.

codex --model gpt-5.6            # start with an explicit model
codex -m gpt-5.6                 # short flag
codex exec -m gpt-5.6 "fix the failing test in auth/"   # non-interactive

Inside an interactive session, /model switches model and effort.

The reasoning ladder (CLI)

Low → Medium (default) → High → Extra high → Max → Ultra
                                              │      │
                                    more thinking    automatic delegation to
                                    on one task      subagents in parallel

Max vs Ultra is the distinction to hold: Max thinks harder on one problem; Ultra fans the problem out to parallel subagents. In GUI clients the levels read Light/Medium/High/Extra High, and the Astra rollout exposes Power options (Terra Light, Sol Light, Sol Medium, Astra Light, Astra Medium, Astra Extra High). If Ultra is absent from the picker, enable it via Settings → Configuration → “Ultra in model picker slider”.

config.toml

One shared config.toml serves the desktop app, CLI and IDE extension. Config has basics/advanced/reference levels, environment variables and a sample config.

# ~/.codex/config.toml (illustrative — check the reference for the full key list)
model = "gpt-5.6"

[features]
context_management.experimental_mode = true   # Astra cross-context notes; opt-in

AGENTS.md

AGENTS.md is the standing instruction file Codex reads for a repository: how to build, test, and behave in this codebase. Keep it specific and current.

## Build & test
- Install: `pnpm install`
- Test: `pnpm test` — all tests must pass before you stop
- Lint: `pnpm lint` — fix, do not disable rules

## Conventions
- TypeScript strict mode; no `any`
- Prefer small, reviewable diffs
- Never edit files under `vendor/`

## Boundaries
- Do not push to `main`
- Ask for approval before deleting files

Agent configuration also covers subagents, speed, and rules.

Extending Codex

Permissions, profiles and sandboxing

Environments

Environment configuration covers modes plus local, cloud and git-worktree setups.

Codex Security

A dedicated security surface (plugin, CLI, cloud) covering scans, deep scans, a security workbench, triage, fixes, hardening, and vulnerability reports, with CI and GitLab CI integration, backed by cyber-safety models and trusted access. Use it to shift security review left into the agent’s workflow rather than bolting it on after.

The GPT-5.4 retirement map

Codex SDK, App Server, GitHub Action, non-interactive mode

• Codex SDK — build Codex into your own tooling.
• App Server — serve Codex capabilities to applications.
• GitHub Action — run Codex in CI pipelines.
• Non-interactive mode — codex exec -m <model> "<task>" for scripts and automation, no interactive session.

Administration and governance

Codex ships an extensive admin surface for governed teams:

Worked setup — a governed team adopts Codex

1. Standardise config — commit a shared config.toml (model = "gpt-5.6") and an AGENTS.md per repo with build/test commands and boundaries.
2. Migrate off 5.4 — before 31 August 2026, switch ChatGPT-sign-in defaults to gpt-5.6-terra (was 5.4) and gpt-5.6-luna (was 5.4-mini). API-key users are unaffected.
3. Set permissions — pick a permission mode with approvals on destructive actions; enable auto-review; use profiles for local vs cloud.
4. Sandbox — run cloud tasks in the sandbox with cloud internet access controls scoped to what the task needs.
5. Security — turn on Codex Security scans in CI (GitLab CI supported) so vulnerabilities are caught in the agent’s own workflow.
6. Govern — provision users via groups, set roles/workspace permissions, and export audit events via the Compliance API.

Key facts to memorise

• One shared config.toml across desktop app, CLI and IDE; AGENTS.md holds per-repo instructions.
• Model/effort: codex -m / codex --model / /model / codex exec -m; ladder Low → … → Max (one task) → Ultra (parallel subagents).
• gpt-5.4 / gpt-5.4-mini retire from Codex (ChatGPT sign-in) 31 Aug 2026 → gpt-5.6-terra / gpt-5.6-luna; API-key sign-in unaffected.
• Experimental context management is opt-in and Plus/Pro sign-in only at launch.
• Extend via skills, plugins, MCP, hooks, record & replay, site tools (WebMCP); govern via profiles, permission modes, sandboxing and the admin surface.