#Config & CLI Reference

#Configuration layers

Codex config stacks from outer to inner:

1. ~/.codex/config.toml — user defaults
2. .codex/config.toml — project overrides (after trusting the project)
3. requirements.toml — org-enforced policy (managed devices)
4. CLI flags — per-session overrides

CLI and IDE extensions share the same configuration model.

#Common config.toml settings

# Model (example; depends on account)
model = "gpt-5.3-codex"

# Sandbox and approvals
sandbox_mode = "workspace-write"
approval_policy = "on-request"

# AGENTS.md discovery
project_doc_fallback_filenames = ["TEAM_GUIDE.md"]
project_doc_max_bytes = 32768

# Skills
# [[skills.config]]
# path = "/path/to/skill"
# enabled = false

# MCP
[mcp_servers.my_server]
command = "npx"
args = ["-y", "some-mcp-server"]
enabled = true

Full key list: Configuration Reference.

#Common CLI flags

#Subcommands overview

Details: CLI Reference.

#Model switching

In the TUI:

/model

Pick GPT-5.x, Codex-tuned models, etc. Use stronger reasoning for long tasks; faster models for simple scripts.

#Logging and sessions

codex -c log_dir=./.codex-log

• TUI log: codex-tui.log
• Session JSONL (if enabled): session-*.jsonl

Useful to audit AGENTS.md loading and tool call sequences.

#Scripting example

#!/usr/bin/env bash
set -euo pipefail

codex exec \
  --sandbox workspace-write \
  --ask-for-approval never \
  --json \
  --output-last-message \
  "Run go test ./... and fix test failures only; do not change go.mod"

#CODEX_HOME multi-profile

export CODEX_HOME="$HOME/.codex-work"
codex exec "..."

Separates work vs. personal accounts, or CI bot users.

#Next steps

• Sandbox & Security: risk of each preset
• Practical Examples: exec + CI patterns