{"slug": "four-hidden-config-settings-that-stop-token-leaks-and-unapproved-writes-in-codex", "title": "Four Hidden Config Settings That Stop Token Leaks and Unapproved Writes in OpenAI Codex and Claude Code", "summary": "A developer published a set of four configuration changes for OpenAI Codex CLI (v0.166.0) and Claude Code (v2.1.277+) that reduce token waste and block unapproved file writes. The changes raise Codex's default command yield window from 30 seconds to five minutes and enforce a 30-second floor on subagent wait timeouts, while a locked-down Claude Code Explore subagent frontmatter pins it to Haiku with a read-only tools allowlist and omitClaudeMd. The writeup also recommends cross-vendor review, piping a branch diff into a stateless second-model pass, to catch bugs the authoring agent misses.", "body_md": "When you run OpenAI Codex CLI and Claude Code side by side across a real codebase, the biggest token drains and safety gaps come from default background settings that rarely show up in the terminal UI.\n\nHere are four production configuration changes, verified against `codex-cli 0.166.0` and Claude Code `v2.1.277+`, that cut wasted polling turns and lock down unapproved writes.\n\nBy default, when OpenAI Codex runs a build, test suite, or subagent task under `code_mode`, it yields control back to the model after 30,000 ms (` default_exec_yield_time_ms`) even if the command is still running. Every yield resends your entire conversation history. Worse, when the model calls `wait` to check on the running command, it frequently picks a 1,000 ms timeout and polls up to a hundred times during a single slow build.\n\nAdd these two blocks to `~/.codex/config.toml` (template: [`templates/codex/config.toml`](https://github.com/seankwon816/foragent-skills/blob/main/templates/codex/config.toml)):\n\n```\n[features.code_mode]\ndefault_exec_yield_time_ms = 300000\n\n[features.multi_agent_v2]\nmin_wait_timeout_ms = 30000\ndefault_wait_timeout_ms = 120000\nmax_wait_timeout_ms = 300000\n```\n\nSetting `default_exec_yield_time_ms = 300000` raises the initial command yield window to 5 minutes while still returning the instant the command exits. Under `[features.multi_agent_v2]`, `min_wait_timeout_ms = 30000` enforces a hard 30-second floor when waiting on subagents.\n\nFor shell builds that run longer than 5 minutes, add one line to your repository root `AGENTS.md`:\n\n```\nWhen calling wait on a running command, always pass yield_time_ms >= 60000 (never poll at 1000ms).\n```\n\nClaude Code's built-in `Explore` subagent skips your `CLAUDE.md` files on purpose so file lookups stay fast. However, two traps hit teams as soon as they use subagents heavily:\n\n`Explore` inherits your main session model unless you override it, which burns Opus or Sonnet quota on simple `Glob` and `Grep` calls.`.claude/agents/` reloads your full `CLAUDE.md` hierarchy on every spawn and inherits write permissions unless you lock down its frontmatter.\nCreate `.claude/agents/Explore.md` with these exact frontmatter fields (template: [`templates/subagents/Explore.md`](https://github.com/seankwon816/foragent-skills/blob/main/templates/subagents/Explore.md)):\n\n```\n---\nname: Explore\ndescription: \"Fast read-only codebase search and git history lookup\"\nmodel: haiku\neffort: low\nomitClaudeMd: true\ntools: Read, Grep, Glob, Bash(git log *), Bash(git blame *), Bash(git diff *)\n---\n```\n\nUsing an explicit `tools` allowlist instead of `disallowedTools: Write, Edit` prevents the search worker from mutating files via `sed` or shell redirection while still allowing read-only `git log` and `git blame` inspection.\n\nAsking the same coding agent session that wrote a feature branch to review its own changes misses obvious bugs because the agent still has its own reasoning trace and assumptions in context.\n\nRun a stateless, read-only review pass on a second model vendor so the reviewer only sees the raw `git diff` and the files on disk.\n\nWhen Claude Code writes the branch, run OpenAI Codex CLI's built-in `review` subcommand:\n\n```\ncodex exec review --base main --ephemeral -o /tmp/codex-review.txt \\\n  \"List only concrete bugs, race conditions, and unhandled edge cases with file:line references.\"\n```\n\nExample output from `/tmp/codex-review.txt`:\n\n```\n[codex-review] Comparing feat/orders-v2 against main (4 files changed, +142 -19)\n  1. [HIGH] src/routes/orders.ts:88: Missing await on releaseInventoryLock()\n      inside catch block leaves row lock active until connection timeout.\n  2. [MED]  src/schemas/order.ts:34: discountCents allows negative integers\n      when promoCode is omitted; add .nonnegative() to Zod schema.\n```\n\nWhen Codex writes the branch, pipe the branch diff into Claude Code in non-interactive mode with write tools stripped:\n\n```\ngit diff main...HEAD | claude -p \\\n  \"Review this diff against the codebase. Report only concrete bugs and missing edge cases with file:line numbers.\" \\\n  --tools \"Read,Grep,Glob\"\n```\n\nWhen two coding agents work across separate repositories or computers (for example, a frontend Claude Code session on a laptop and a backend Codex session on a desktop), you need both local execution guardrails and a structured channel for cross-agent questions:\n\n`exit 2` + `stderr`)` exit 1` from a `PreToolUse` hook only logs a non-blocking warning and lets the command run anyway. To block a destructive command and feed the reason back to the model, exit with code `2` and write the allowed alternative command to `>&2`). For full desktop runtime guardrails (` Security RA` through `RI` rules) across macOS and Windows, we built `12 messages per call`)` https://foragent.io/mcp`, listed in the Official MCP Registry as `io.foragent/foragent`) gives each coding agent a private phone number. One agent dials `@12`, you click", "url": "https://wpnews.pro/news/four-hidden-config-settings-that-stop-token-leaks-and-unapproved-writes-in-codex", "canonical_source": "https://dev.to/seanjhkwon/four-hidden-config-settings-that-stop-token-leaks-and-unapproved-writes-in-openai-codex-and-claude-md3", "published_at": "2026-11-06 16:41:37+00:00", "updated_at": "2026-11-06 16:53:51.935382+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "large-language-models"], "entities": ["OpenAI", "Codex CLI", "Claude Code", "Anthropic", "GitHub"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/four-hidden-config-settings-that-stop-token-leaks-and-unapproved-writes-in-codex", "markdown": "https://wpnews.pro/news/four-hidden-config-settings-that-stop-token-leaks-and-unapproved-writes-in-codex.md", "text": "https://wpnews.pro/news/four-hidden-config-settings-that-stop-token-leaks-and-unapproved-writes-in-codex.txt", "jsonld": "https://wpnews.pro/news/four-hidden-config-settings-that-stop-token-leaks-and-unapproved-writes-in-codex.jsonld"}}