codex-keysmith

// Overview

codex-keysmith installs a standing instruction onto a local Codex setup and, just as importantly, takes it back off again. Its whole premise is that changing how your coding agent behaves should be a reviewable operation: every command prints the write plan first and touches nothing until you confirm, and removal follows the same preview-then-confirm path back to the original state.

It does not patch Codex itself and it never reads accounts or API keys — it writes into the Codex configuration directory you point it at, and the effect applies to conversations you open afterwards, not the one you are in. A default install ships a single prompt. The project describes the surrounding machinery as versioned deployment with ownership manifests, hook isolation, scenario evaluation and recovery, which is what separates it from copying a prompt file into place by hand.

Distribution is deliberately conservative: a single-file Python script attached to each stable GitHub Release, published alongside a SHA256SUMS file so you can verify the download before running it. Unsigned desktop builds exist for Apple Silicon and Windows x64. Keysmith is a family — sibling installers cover Claude Code, Grok Build and ZCode — with one installer per tool. It needs Python 3.10+ and is MIT-licensed.

// What it does

• Dry-run first: every command shows the target directory, the prompt source and the write plan before anything is written
• Reversible by design — review the removal plan, confirm, and the machine returns to its previous state
• Leaves the Codex app untouched and never reads accounts or keys; only the configuration directory you name is written
• Versioned deployment with ownership manifests, hook isolation, scenario evaluation and recovery
• Shipped as a single-file script per release with a SHA256SUMS companion for integrity checking
• One installer per agent: sibling projects cover Claude Code (claude-keysmith), Grok Build and ZCode

// Getting started

Codex must already be installed. The recommended path is the single-file script from the latest stable release; download it with its checksum file and verify before running.

base='https://github.com/Jia-Ethan/codex-keysmith/releases/download/vX.Y.Z'
curl --fail --location --remote-name "$base/codex-instruct-vX.Y.Z.py"
curl --fail --location --remote-name "$base/SHA256SUMS"
awk '$2 == "codex-instruct-vX.Y.Z.py"' SHA256SUMS | shasum -a 256 -c -

python3 codex-instruct-vX.Y.Z.py --version
python3 codex-instruct-vX.Y.Z.py --codex-dir ~/.codex --status

python3 codex-instruct-vX.Y.Z.py --codex-dir ~/.codex --dry-run

Commands and code are distilled from the project's own documentation — always check the official repo for the latest.

// When to use it

• Roll a shared team instruction out to Codex on many machines and be able to prove what each write changed
• Try a new standing prompt knowing the removal path is the same reviewed, reversible operation
• Keep agent instructions versioned and verifiable instead of hand-edited config files that drift
• Audit what a prompt install would touch before allowing it on a work machine

// How codex-keysmith compares

codex-keysmith alongside other open-source coding-agent harnesses & runtimes tools AI/TLDR tracks, ranked by GitHub stars.