Codex CLI

Prerequisites

Install Edge, install Codex CLI, and sign in to the intended Kastra workspace. Use a test environment for initial policy checks.

Connect the hook

kastra-edge login
kastra-edge install-codex --dry-run
kastra-edge install-codex
kastra-edge doctor

The installer targets ~/.codex/config.toml (or CODEX_HOME/config.toml). Review its proposed change and restart the agent so it loads the new configuration. Keep unrelated hooks intact.

What is governed

The installer writes a Kastra-managed hook block for PreToolUse, PostToolUse, UserPromptSubmit, and SessionStart. Existing configuration is preserved and the result is validated as TOML.

The hook calls Kastra’s service before the supported action. Work outside the hook is not governed. Network or harness failures can allow work to continue under the integration’s failure behavior; read failure handling.

Verify the connection

Run a harmless action and inspect the exact decision in the console. Then test a narrow deny rule and a HOLD rule in your test environment. Confirm the actual side effect, not only the banner or notification. Verification checklist.

Operational notes

The reviewed Windows record does not establish Codex hook execution. Verify the actual Codex version and platform. To remove the managed block, use kastra-edge uninstall-codex.

If no decision appears, check the hook file, PATH, login, environment, agent restart, and troubleshooting guide. Installation detection alone cannot prove that the host invoked the hook.

Usage telemetry

Setup also writes the managed Codex telemetry configuration when logged in. Re-run setup after a credential change or an older hook-only install, then restart Codex. Review collection and reporting limits.