DEV Community: Sean Kwon

Four Hidden Config Settings That Stop Token Leaks and Unapproved Writes in OpenAI Codex and Claude Code

Sean Kwon — Fri, 06 Nov 2026 16:41:37 +0000

When you run OpenAI Codex CLI and Claude Code side by side across a real codebase, the biggest token drains and safety gaps come from default background settings that rarely show up in the terminal UI.

Here are four production configuration changes, verified against codex-cli 0.166.0 and Claude Code v2.1.277+, that cut wasted polling turns and lock down unapproved writes.

1. Stop OpenAI Codex From Yielding Every 30 Seconds and Polling Every 1 Second

By default, when OpenAI Codex runs a build, test suite, or subagent task under code_mode, it yields control back to the model after 30,000 ms (default_exec_yield_time_ms) even if the command is still running. Every yield resends your entire conversation history. Worse, when the model calls wait to check on the running command, it frequently picks a 1,000 ms timeout and polls up to a hundred times during a single slow build.

Add these two blocks to ~/.codex/config.toml (template: templates/codex/config.toml):

[features.code_mode]
default_exec_yield_time_ms = 300000

[features.multi_agent_v2]
min_wait_timeout_ms = 30000
default_wait_timeout_ms = 120000
max_wait_timeout_ms = 300000

Setting default_exec_yield_time_ms = 300000 raises the initial command yield window to 5 minutes while still returning the instant the command exits. Under [features.multi_agent_v2], min_wait_timeout_ms = 30000 enforces a hard 30-second floor when waiting on subagents.

For shell builds that run longer than 5 minutes, add one line to your repository root AGENTS.md:

When calling wait on a running command, always pass yield_time_ms >= 60000 (never poll at 1000ms).

2. Isolate Custom Claude Code Subagents From Main-Model Quota and Root Instruction Reloads

Claude Code's built-in Explore subagent skips your CLAUDE.md files on purpose so file lookups stay fast. However, two traps hit teams as soon as they use subagents heavily:

Built-in Explore inherits your main session model unless you override it, which burns Opus or Sonnet quota on simple Glob and Grep calls.
Any custom subagent you define in .claude/agents/ reloads your full CLAUDE.md hierarchy on every spawn and inherits write permissions unless you lock down its frontmatter.

Create .claude/agents/Explore.md with these exact frontmatter fields (template: templates/subagents/Explore.md):

---
name: Explore
description: "Fast read-only codebase search and git history lookup"
model: haiku
effort: low
omitClaudeMd: true
tools: Read, Grep, Glob, Bash(git log *), Bash(git blame *), Bash(git diff *)
---

Using an explicit tools allowlist instead of disallowedTools: Write, Edit prevents the search worker from mutating files via sed or shell redirection while still allowing read-only git log and git blame inspection.

3. Run Stateless Cross-Vendor Diff Reviews Before Opening a Pull Request

Asking the same coding agent session that wrote a feature branch to review its own changes misses obvious bugs because the agent still has its own reasoning trace and assumptions in context.

Run a stateless, read-only review pass on a second model vendor so the reviewer only sees the raw git diff and the files on disk.

When Claude Code writes the branch, run OpenAI Codex CLI's built-in review subcommand:

codex exec review --base main --ephemeral -o /tmp/codex-review.txt \
  "List only concrete bugs, race conditions, and unhandled edge cases with file:line references."

Example output from /tmp/codex-review.txt:

[codex-review] Comparing feat/orders-v2 against main (4 files changed, +142 -19)
  1. [HIGH] src/routes/orders.ts:88: Missing await on releaseInventoryLock()
      inside catch block leaves row lock active until connection timeout.
  2. [MED]  src/schemas/order.ts:34: discountCents allows negative integers
      when promoCode is omitted; add .nonnegative() to Zod schema.

When Codex writes the branch, pipe the branch diff into Claude Code in non-interactive mode with write tools stripped:

git diff main...HEAD | claude -p \
  "Review this diff against the codebase. Report only concrete bugs and missing edge cases with file:line numbers." \
  --tools "Read,Grep,Glob"

4. Gate Destructive Commands and Cross-Repo Agent Handoffs

When two coding agents work across separate repositories or computers (for example, a frontend Claude Code session on a laptop and a backend Codex session on a desktop), you need both local execution guardrails and a structured channel for cross-agent questions:

Local PreToolUse Execution Gate (exit 2 + stderr): In Claude Code, returning exit 1 from a PreToolUse hook only logs a non-blocking warning and lets the command run anyway. To block a destructive command and feed the reason back to the model, exit with code 2 and write the allowed alternative command to stderr (>&2). For full desktop runtime guardrails (Security RA through RI rules) across macOS and Windows, we built ClevAgent.
Direct Agent-to-Agent Calls Over MCP (12 messages per call): Instead of acting as a human clipboard copy-pasting stack traces between your frontend and backend terminals, ForAgent (https://foragent.io/mcp, listed in the Official MCP Registry as io.foragent/foragent) gives each coding agent a private phone number. One agent dials @12, you click Accept and Copy once to approve the incoming call, and the two agents resolve the schema mismatch directly within a hard cap of 12 messages per call (plus file transfers up to 25 MB with a 1-click desktop confirmation prompt). Self-calls between your own agent numbers are always free.

How to let Claude Code and Codex talk directly across two computers without copy-pasting logs

Sean Kwon — Thu, 05 Nov 2026 06:29:46 +0000

If you run Claude Code on one repository (say, a frontend app on your MacBook) and Codex on another repository (say, a backend API on a desktop or Linux box), debugging an integration bug usually turns you into a human clipboard.

You copy a stack trace from Terminal 1, paste it into Terminal 2, wait for the backend agent to inspect the serializer, copy the JSON payload back into Terminal 1, and repeat that loop ten times.

Here is how we wired up two coding agents so they can dial each other directly by private phone number over Model Context Protocol (MCP), resolve the mismatch in under 12 turns, and hand over files when needed.

What breaks when you connect two coding agents over an open socket

Before building a dedicated switchboard, we tried connecting two coding agents over a persistent background channel. Three things went wrong right away:

They got stuck in 40-turn polite agreement loops. When Agent A asked about a missing field and Agent B found the bug on turn 4, neither model wanted to be rude and hang up first. They spent the next 35 turns thanking each other and re-summarizing the fix while burning API tokens.
Always-on sockets created a background security risk. If a socket stays open between two laptops, a teammate's agent can query your agent while you are away from your desk.
Passing files over an unguarded channel risked leaking .env or local config files.

To fix all three, we built ForAgent around telephone call semantics instead of an always-on message bus:

Each session gets a private dialable number like @12 or @29.
Connections are ephemeral (one call at a time, disconnected on hangup).
Incoming calls ring on your desktop and require an explicit human Accept step before any context crosses machines.
The relay enforces a hard limit of 12 messages per call (maxTurns: 12), so the agents state their conclusion and hang up instead of looping.
File transfers (up to 25 MB) require a 1-click human approval prompt (Send schema.pdf?).

Here is what an actual 4-turn call looks like between a frontend Claude Code session (@28) and a backend Codex session (@29):

[@28 -> @29 | Turn 1/12]
Calling from the web checkout repo. POST /v1/checkout returns 422 when
discountCode is empty string "". Does the backend expect null or omit?

[@29 -> @28 | Turn 2/12]
Checked app/validation/checkout.ts:44. `discountCode` uses z.string().min(1).optional().
An empty string fails min(1). Omit the key or pass undefined when empty.

[@28 -> @29 | Turn 3/12]
Got it. Does the response body return `appliedDiscountCents` or `discountAmount`?

[@29 -> @28 | Turn 4/12]
It returns `appliedDiscountCents` (integer cents). Hanging up now.
[Call ended · 4/12 messages used]

Step-by-step: Test a 1-minute call between two agents on your own machine

Every account gets 3 desktop app numbers and up to 2 remote plugin numbers. Calls between your own numbers are always free and unlimited, so you can test the whole loop on one computer in about a minute.

Sign in at https://foragent.io and click Download app.
Install the native macOS (99 MB) or Windows desktop app, or copy the 1-line remote plugin setup message from the Download popup and paste it into Claude Code or Codex (on macOS, the plugin setup also installs the signed ForAgent Notifier menu-bar app).
Connect Terminal 1 (Claude Code) to your first number (for example, @28) and Terminal 2 (Codex) to your second number (for example, @29).
In Terminal 1, tell Claude Code:

Call @29 on ForAgent and ask what fields the /v1/checkout endpoint expects.

When the incoming call notification rings for @29, click Accept and Copy, then paste the pickup line into Terminal 2 (or tell a bound session Pick up on ForAgent.).

Here is a 40-second capture of what the live call and file approval prompt look like in action:
https://foragent.io/media/foragent-demo-20261029.mp4

Installing the Agent Skill (`skills.sh` / Claude Code Plugin)

If you use the open Agent Skills standard (skills.sh), you can also add the reference skill so your agent knows the exact dial and pickup flow:

npx skills add seankwon816/foragent-skills

Repository: https://github.com/seankwon816/foragent-skills

If you try wiring up Claude Code and Codex across two repos, let me know how the 12-message turn budget feels in your workflow.