# Codex Review

> >

- **Type:** Skill
- **Install:** `agentstack add skill-tonydzi-second-brain-starter-kit-codex-review`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [tonydzi](https://agentstack.voostack.com/s/tonydzi)
- **Installs:** 0
- **Category:** [Productivity](https://agentstack.voostack.com/c/productivity)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [tonydzi](https://github.com/tonydzi)
- **Source:** https://github.com/tonydzi/second-brain-starter-kit/tree/master/skills/codex-review

## Install

```sh
agentstack add skill-tonydzi-second-brain-starter-kit-codex-review
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# codex-review — "Claude checks Codex"

A thin broker for the review pair. Codex writes the code; Claude reviews its diff independently. (The old note "`codex exec` headless hangs on Windows" is obsolete: on codex-cli 0.141+ headless works natively — verified 2026-07-07 on the laptop and 2026-07-14 on the hub.) File handoff, no shared credentials, subscription (not a paid API).

## When to run it
The owner made a change through Codex (or there is simply a diff/edit in a repository) and wants an independent "second pair of eyes" check. Triggers: see `description`.

## What I do
1. **Identify the target.** Ask for / take the path to the repository where Codex made the change (or the path to a patch file). Default — the working repository the owner named.
2. **Run the engine** (deterministic, 0 of my tokens for the run itself — the review is done by headless `claude -p`):
   ```
   python "%USERPROFILE%\.claude\scripts\cc-review\cc_review.py" --repo "" --model sonnet
   ```
   - model: **Sonnet by default** (the free subscription bucket; in the test it caught both bugs in 25s); **Opus** for hard/safety-critical changes (`--model opus`) — the quality gate.
   - other modes: `--range "HEAD~1 HEAD"` (a specific commit), `--diff ""` (a ready patch), `--task ""` (what Codex was asked to do — gives the reviewer context).
3. **Report to the owner:** the verdict (`APPROVE` / `REQUEST_CHANGES`), the list of findings (file:line · severity · what is wrong · the fix), and the path to `review-.md`. If REQUEST_CHANGES — propose fixing the root cause (not the symptom).

## Boundaries
- The engine forcibly unsets `ANTHROPIC_API_KEY` → the review runs on the subscription, not on a paid key.
- A giant diff is truncated to 120k characters (with a note) — if you hit that, review it in parts / per file.
- This is a REVIEW, not an auto-fix: fixes are proposed/made separately per AK-47 (easy and reversible — do it yourself; a fork — ask).
- The full auto-pair (Codex headless as well) can be built later under WSL2/Docker — a separate step (not needed now).

> **2026-06-28 (hub):** the engine `cc_review.py` was lost (not in git / `.stversions` / on any disk) → **rebuilt** as a simple Windows-native "normal mode" (the call above). Run live (`/tt`): bugs → `REQUEST_CHANGES`, clean → `APPROVE`, empty/not-a-repo → graceful. Artifacts live outside the vault (`reviews/`), counter `reviews/_log.jsonl`. ⚠️ Canon update in [[decision-hermes-multivendor-arbitrage-rejected]] (addendum 06-28).

## ⭐ The two-way hetero pair (both sides run on the hub)
Full symmetry: both sides review each other, and the final check is always done by the OTHER vendor.
- **Claude → reviews Codex** (forward) — WORKS: `python "%USERPROFILE%\.claude\scripts\cc-review\cc_review.py" --repo "" --model sonnet` (see above).
- **Codex → reviews Claude** (reverse, the mirror) — WORKS ON THE HUB TOO: `python "%USERPROFILE%\.claude\scripts\cc-review\codex_review.py" --repo ""` — the engine was /tt-verified 2026-07-07 (laptop, codex-cli 0.141.0) and 2026-07-14 (hub, codex-cli 0.144.4: `npm i -g @openai/codex`, the ChatGPT-subscription login was already in `~/.codex/auth.json`; smoke: planted bugs → REQUEST_CHANGES with exact file:line in 16s · clean diff → APPROVE · empty diff → graceful without calling Codex). Native `codex exec -s read-only` on Windows without WSL2. Flags: `--range "HEAD~1 HEAD"`, `--diff `, `--task `, `--timeout 300`. Read-only sandbox: Codex only reasons over the diff. Output: `review-codex-.md` + `VERDICT: APPROVE|REQUEST_CHANGES`.

## Full auto mode under WSL2 (archived path — NOT deployed on the hub)
⚠️ The orchestrator `codex_pair.py` is missing from the hub's live tree (it survived only in the snapshot `_config-backup\snapshot-2026-07-04`), and WSL2 is not installed there → the mode does not start. To bring it up: restore `codex_pair.py` from the snapshot + install WSL2/Codex, then `/tt`.
Historical context (the machine where it was built, 2026-06-22): WSL2 Ubuntu-24.04 + Node22 + Codex 0.142.3 (logged into ChatGPT), `codex exec --full-auto` headless. What it did: Codex implements the task headless inside WSL → takes the git diff → Claude reviews it (`cc_review.py`) → verdict + `codex-change-*.diff` + `review-*.md`. The repo lived in the WSL Linux filesystem (`/root/...`); a path normalizer fixed the Git-Bash `/root/...` mangling.

## Extension — the reverse side is READY (the hub has been fully two-way since 2026-07-14)
The reverse side (Codex reviews Claude) is built = `codex_review.py` (see the "two-way hetero pair" block), native `codex exec` on Windows. The Codex CLI was installed on the hub 2026-07-14 (`npm i -g @openai/codex`, v0.144.4, login via the ChatGPT subscription) and the smoke test passed — the hetero pair works in both directions. The same day it was also deployed to the anchor VPS (headless: `auth.json` is copied over with scp, no browser OAuth needed; both engines + smoke ✅) — the anchor is an extra node, and live duo tests still run from the hub in the review chat.

---

## About & contact

Built and battle-tested at **Palo Alto AI Research Lab** — a fleet of Claude Code machines
running 24/7 as a second brain and synthetic cofounder. Every skill here survived real
production use before publication.

- 📦 All 101 skills: https://github.com/tonydzi/second-brain-starter-kit
- 👤 Author: **Anton Dziatkovskii** — Telegram [@tonydzi](https://t.me/tonydzi) · WhatsApp [+1 341 222 9178](https://wa.me/13412229178) · X [@Tony_Stef_](https://x.com/Tony_Stef_)
- 🧪 **Engineers: want to test-drive this setup?** Message me — I hand out free starter seeds to engineers who test and report back. Custom skill requests welcome.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [tonydzi](https://github.com/tonydzi)
- **Source:** [tonydzi/second-brain-starter-kit](https://github.com/tonydzi/second-brain-starter-kit)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-tonydzi-second-brain-starter-kit-codex-review
- Seller: https://agentstack.voostack.com/s/tonydzi
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.