/add-codex

name: add-codex
description: Use Codex (OpenAI's codex app-server) as a full agent provider — planning, tool orchestration, MCP tools, server-side history, session resume — alongside or instead of Claude. ChatGPT subscription or OpenAI API key, vault-only via the selected gateway. Per-group via `ncl groups config update --provider codex`. Distinct from using OpenAI as an MCP tool (where Claude remains the planner).
metadata:
  nanoclaw-provider: codex
  nanoclaw-provider-label: Codex
  nanoclaw-provider-hint: OpenAI — ChatGPT subscription or API key
  nanoclaw-provider-offered: 'true'
  nanoclaw-provider-image: local-required

Codex agent provider

> Shortcut: `pnpm exec tsx setup/index.ts --step provider-auth codex` performs this whole install (manifest-driven from this skill's payload: files, barrels, CLI manifest entry, image rebuild, host rebuild and restart) plus auth in one command. The steps below are the same operations, for agent-driven or manual application.

NanoClaw selects each group's agent backend from `container_configs.provider` (default `claude`). This skill installs the Codex provider: copy this skill's payload, append one import to each of the three provider barrels, add the pinned Codex CLI to the container manifest (`container/cli-tools.json`), rebuild, then run the vault auth walk-through.

The provider runs `codex app-server` as a child process speaking JSON-RPC over stdio: native streaming, MCP tools, server-side conversation history (the continuation is a thread id, no on-disk transcript). Credentials are **vault-only**: The selected gateway serves a sentinel `auth.json` stub into the container and swaps the real ChatGPT token or API key on the wire — no key in `.env`, nothing readable in the container.

The mechanical steps under **Install** carry `nc:` directive fences: an agent reads the prose and applies them, and a parser can apply them deterministically from the same document. Every directive is idempotent, so the whole skill is safe to re-run; anything a parser can't apply falls back to the prose beside it.

Install

Pre-flight

Requires `src/project-doc-compose.ts` and core's shared exchange archive (`container/agent-runner/src/provider-contracts/exchange-archive.ts`) on trunk. If either is missing, stop and tell the operator to run `/update-nanoclaw` first.

Check whether the payload is already wired (a prior apply, or a trunk that still carries it). All of these present means installed — skip to **Authenticate**:

• `src/providers/codex.ts` and `src/providers/codex-agents-md.ts`
• `container/agent-runner/src/providers/codex.ts` and `codex-app-server.ts`
• `setup/providers/codex.ts` and both `provider-contracts/codex.ts` declarations (host and container)
• `import './codex.js';` in the three provider barrels and both contract barrels
• an `@openai/codex` entry in `container/cli-tools.json`

1. Copy the payload

Copy the Codex payload from this skill's `payload/` into all three trees (additive — overwrite each file). The host files are the provider contribution + the AGENTS.md spec (composition itself lives in trunk's `src/project-doc-compose.ts`) + their guards; the container files are the provider runtime (turn loop, JSON-RPC wrapper, native memory SessionStart hook) + their guards, and the runtime contract archives each exchange through core's shared archive; the setup files are the picker entry + vault auth walk-through + their guards; `container/AGENTS.md` is the runtime-contract base the composed AGENTS.md embeds.

The host contract (`src/provider-contracts/codex.ts`) and the setup entry carry the authentication hook for the selected gateway: the same login choices, with custody delegated to the gateway. The setup screens and step sequence do not change.

payload/src/providers/codex.ts -> src/providers/codex.ts
payload/src/providers/codex-agents-md.ts -> src/providers/codex-agents-md.ts
payload/src/providers/codex-registration.test.ts -> src/providers/codex-registration.test.ts
payload/src/providers/codex-host-contribution.test.ts -> src/providers/codex-host-contribution.test.ts
payload/src/providers/codex-agents-md.test.ts -> src/providers/codex-agents-md.test.ts
payload/container/agent-runner/src/providers/codex.ts -> container/agent-runner/src/providers/codex.ts
payload/container/agent-runner/src/providers/codex-app-server.ts -> container/agent-runner/src/providers/codex-app-server.ts
payload/container/agent-runner/src/providers/codex-registration.test.ts -> container/agent-runner/src/providers/codex-registration.test.ts
payload/container/agent-runner/src/providers/codex.factory.test.ts -> container/agent-runner/src/providers/codex.factory.test.ts
payload/container/agent-runner/src/providers/codex.turns.test.ts -> container/agent-runner/src/providers/codex.turns.test.ts
payload/container/agent-runner/src/providers/codex-app-server.test.ts -> container/agent-runner/src/providers/codex-app-server.test.ts
payload/container/agent-runner/src/providers/codex-contract-parity.test.ts -> container/agent-runner/src/providers/codex-contract-parity.test.ts
payload/container/agent-runner/src/providers/codex.conformance.test.ts -> container/agent-runner/src/providers/codex.conformance.test.ts
payload/container/agent-runner/src/providers/codex-cli-tools.test.ts -> container/agent-runner/src/providers/codex-cli-tools.test.ts
payload/container/agent-runner/src/provider-contracts/codex.ts -> container/agent-runner/src/provider-contracts/codex.ts
payload/setup/providers/codex-registration.test.ts -> setup/providers/codex-registration.test.ts
payload/container/AGENTS.md -> container/AGENTS.md
payload/src/provider-contracts/codex.ts -> src/provider-contracts/codex.ts
payload/setup/providers/codex.ts -> setup/providers/codex.ts
payload/setup/providers/codex.test.ts -> setup/providers/codex.test.ts

The payload used to ship its own copy of the exchange archive. Once neither Codex file imports it, this step removes it, so a refreshed