Originally published at pilothouse.dev/blog/codex-claude-code-grok-side-by-side.
The pattern everyone running more than one agent knows: you start three sessions, go make lunch, and come back to find two of them stuck on a permission prompt since minute four. Or you switch everything to "approve all" to avoid that, and one of them does something you'd never have allowed.
Here's how I run Claude Code, Codex CLI and Grok Build in parallel without either problem. (I build Pilothouse, the tool doing most of the work below.)
brew install sabr-software/tap/pilothouse
pilothouse setup
setup installs hooks into each agent it finds and shows you the exact diff before writing anything:
| Agent | What Pilothouse installs |
|---|---|
| Claude Code | hooks in ~/.claude/settings.json |
| Codex CLI | ~/.codex/hooks.json , plus the trust entries Codex needs in~/.codex/config.toml |
| OpenCode | a plugin at ~/.config/opencode/plugins/pilothouse.js |
| Grok Build | ~/.grok/hooks/pilothouse.json (trust each project once with/hooks-trust ) |
It merges with hooks you already have and writes a backup first. After that, every session on the machine shows up in one place, in any terminal, sorted by what needs you:
pilothouse # the inbox: y allow · a allow for session · n deny · r reply
pilothouse ls # sessions and waiting requests
pilothouse explain s_3fq9 # why is this session "blocked"? shows the evidence
You can keep starting agents the way you do now, and the hooks still apply. Starting them through Pilothouse adds two things: replies from your phone get typed straight into the agent's terminal, and the agent keeps running if you close that terminal.
pilothouse run claude
pilothouse run -n review -d -- codex "review the diff on this branch"
pilothouse run grok
pilothouse attach s_3fq9 # reattach from any terminal; ctrl+\ detaches
Or give each agent its own git worktree, so they never touch each other's files:
pilothouse task new "add a --json flag to the export command"
pilothouse task new --agent codex --base main "fix the flaky login test"
pilothouse task diff t_8d1x
pilothouse task done t_8d1x --pr # push and open a PR with gh
If you use herdr, tap Open in herdr on a task in the Pilothouse app and that agent appears in a herdr tab on the computer.
The reason you babysit agents is that their prompts don't tell safe from dangerous. A rule check before every tool call does:
pilothouse policy preset guarded-autopilot on # routine repo work runs; destructive stuff is blocked; pushes, deploys, secrets and sudo ask
pilothouse policy preset protect-main on # pushes to main need you; force-pushes are blocked
When you approve the same thing over and over, the approval card offers to turn it into a rule ("Always allow npm test in api-server") with one tap.
pilothouse remote tailscale # your phone reaches your machine over your tailnet; nothing public
pilothouse pair
At the desk, each agent's own prompt appears as usual. When you're away (keyboard idle, or pilothouse away), approval requests from Claude Code and Codex are held and pushed to your phone. Each one shows the command, a diff for edits, risk labels like Force-pushes to main or Reads .env, and the agent's last words before it asked. You hold to allow or tap Deny. Answer it anywhere and the other places close.
My desktop runs the long jobs and my laptop runs whatever I'm doing on the couch. Since Pilothouse 0.4 they share one inbox:
pilothouse remote tailscale # on every machine
pilothouse link add # on the hub (the machine your phone is paired with)
pilothouse link join https://studio.tailnet.ts.net XXXX-XXXX-XXXX # on each other machine, with the printed code
The join command shows the hub's paired devices with a fingerprint for each key; you confirm the ones you recognise. After that, Today shows every machine's sessions, labelled by machine. Approvals, replies and the live terminal go to the machine running the agent, and that machine checks your phone's signature itself, so the hub can't approve anything on your behalf. Revoke a device on the hub and it's revoked everywhere.
Rules, tasks and budgets live on each machine, so add rules on the machine that needs them.
I stopped checking terminals. Agents that are doing routine work keep going, the dangerous stuff gets blocked before it runs, and when Claude Code or Codex needs me, it shows up on my phone with enough context to decide in a few seconds. Grok Build sits behind the same deny rules and shows up in the same inbox.
Setup guide: pilothouse.dev/docs. Multi-machine: pilothouse.dev/docs/machines. Source: github.com/sabr-software/pilothouse.