Install Codex Router with an AI Agent (AGENTS.md)

The cleanest way to install Codex Router is to let an AI agent do it. The repository ships a machine-readable procedure in AGENTS.md, and the guided installer handles provider selection, credential onboarding and verification. This page gives you the exact instruction to paste, explains what the agent will do, and lists the safety boundaries that keep your keys and existing setup untouched.

Paste this into a Codex task

Install the router from this public repository:
https://github.com/duolahypercho/codex-router

Follow AGENTS.md. Preserve my existing Codex models, profiles, settings, and
ChatGPT login. Use only the provider authentication I choose, safely migrate
only recognized older versions, run the Codex doctor, and leave the final app
restart to me. Never ask me to paste a token or API key into chat.

If compatible authentication already exists, an agent can finish everything except the final app restart. API keys are entered only through a hidden local terminal prompt — the agent never relays them through chat.

What the agent will do

Following AGENTS.md, the agent performs these steps in order:

1. Reads the host platform and checks for Codex, Git, Node.js 22.19+, and uv or Python 3.10+. Read-only checks are allowed; it will not install a package manager or runtime without your permission.
2. Uses a stable checkout — ~/.local/share/codex-router on macOS/Linux or %LOCALAPPDATA%\codex-router on Windows — never a temporary clone, because the service stores the checkout’s absolute path.
3. Determines which provider IDs you requested (for example deepseek, kimi-oauth, grok-api, anthropic-api) and uses configured when credentials already exist.
4. For Kimi OAuth, reuses a valid kimi login session or runs the official CLI only in an interactive terminal. For API providers, invokes provider-key PROVIDER set in a PTY so the hidden prompt receives the value directly.
5. Runs read-only legacy detection and passes --migrate-known only for a repository-recognized older installation. It never migrates, stops, deletes or replaces an unknown router automatically.
6. Runs the installer (./install.sh --target codex --auto --providers IDS --migrate-known, or the PowerShell equivalent on Windows).
7. Runs ./bin/model-router codex doctor. Core config, config privacy, catalog, caller capability, internal key, service, router health and selected credentials must be OK.
8. If a managed layer fails, runs doctor --fix (with --migrate-known only for a recognized older install), and creates a support bundle if repair still fails.
9. Does not terminate Codex. You fully quit it, reopen it, create a new task, and choose the new model.

Safety rules the agent follows

• It never asks you to paste OAuth tokens or API keys into chat, command arguments, logs, environment snippets or tracked files.
• It preserves reasoning settings, profiles, projects, trust, MCP configuration, features and ChatGPT authentication.
• It never kills unknown processes on ports 4100–4103 (or the Grok OAuth forwarder port 4108).
• It treats the generated /_codex-router/.../v1 config path as sensitive local authentication and never pastes the complete managed base URL into chat or a public issue.
• It does not restart or quit the Codex App as part of the installation task.

What to check afterwards

After the agent reports success:

1. Fully quit Codex, reopen it, and create a new task.
2. Open the model picker and confirm the routed model appears.
3. Run ./bin/model-router codex status (or the tray’s status view) if you want a redacted health summary.
4. If anything looks off, open the troubleshooting overview or run doctor --fix.

The agent-driven flow is exactly the flow documented in the repository’s AGENTS.md, so anything your agent says it did can be verified against that file.