codex-review

Codex Review Skill

Invoke OpenAI Codex CLI as a second-opinion bug reviewer. Codex analyzes the PR diff with full codebase read access, then Claude Code evaluates each finding, filters false positives, and auto-fixes confirmed bugs. A verification re-pass ensures fixes didn't introduce new issues.

This skill is rigid — follow the phases in order. Do not skip the evaluation phase.

---

Prerequisites Check

Before anything else, verify the environment:

# 1. Codex CLI installed?
which codex || echo "MISSING"

# 2. Auth configured?
codex login status 2>/dev/null || echo "NO_AUTH"

# 3. Changes exist?
git diff $(git merge-base main HEAD)...HEAD --stat

If Codex not installed:

Codex CLI is not installed. Install it with: npm install -g @openai/codex Then authenticate with: codex login (browser) or set CODEX_API_KEY env var.

If no auth:

Codex is not authenticated. Run codex login to authenticate via browser.

If no diff:

No changes found against the base branch. Nothing to review.

Stop and inform the user if any prerequisite fails. Do not proceed.

---

Phase 1: Gather Context

Prepare the inputs for Codex:

1. Detect base branch:

   # If a PR exists, use its base
   BASE_BRANCH=$(gh pr view --json baseRefName -q '.baseRefName' 2>/dev/null || echo "main")
   

2. Generate diff:

   MERGE_BASE=$(git merge-base $BASE_BRANCH HEAD)
   git diff $MERGE_BASE...HEAD > /tmp/codex-review-diff.patch
   

3. List changed files:

   git diff --name-only $MERGE_BASE...HEAD
   

4. Get PR info (if available):

   PR_TITLE=$(gh pr view --json title -q '.title' 2>/dev/null || echo "N/A")
   PR_DESC=$(gh pr view --json body -q '.body' 2>/dev/null || echo "N/A")
   BRANCH_NAME=$(git branch --show-current)
   

5. Write project context for Codex: Use your existing knowledge of this project from the conversation to write a rich context block. You already know this project — you've been reading files, writing code, and talking with the user. Include:

   • What the project is — language, framework, key technologies, architecture
   • What was built in this PR — what changed and why (you know this from the conversation)
   • Key conventions — anything from CLAUDE.md or patterns you've observed (multi-tenant scoping, validation approach, error handling patterns, etc.)
   • What Codex should watch for — based on the stack and conventions, note specific patterns relevant to this project