Skip to content

feat: add Codex subagent format support#260

Merged
khaliqgant merged 1 commit into
mainfrom
feature/codex-subagents
Mar 17, 2026
Merged

feat: add Codex subagent format support#260
khaliqgant merged 1 commit into
mainfrom
feature/codex-subagents

Conversation

@khaliqgant
Copy link
Copy Markdown
Collaborator

@khaliqgant khaliqgant commented Mar 17, 2026

User description

Adds support for Codex subagents as an AI format in PRPM.

What

Codex (OpenAI) now supports subagents — specialized agents spawned in parallel for complex tasks. Custom agents are defined as TOML files under .codex/agents/ (project) or ~/.codex/agents/ (global).

Changes

  • Converters: from-codex.ts / to-codex.ts — parse and generate TOML agent definitions
  • Schema: codex-agent-role.schema.json — validates subagent fields (name, description, developer_instructions, nickname_candidates, model, sandbox_mode, mcp_servers, skills.config)
  • Docs: codex.md — format specification and conversion notes
  • Canonical types: Extended with Codex-specific metadata (model_reasoning_effort, sandbox_mode, etc.)
  • Tests: from-codex, to-codex, and cross-converter tests (920 tests passing)

Codex Agent Format

name = "security-reviewer"
description = "Reviews code for security vulnerabilities"
developer_instructions = "Focus on injection, auth bypass, data exposure..."
model = "o3"
sandbox_mode = "read-only"
nickname_candidates = ["sec", "guard"]

Built-in agents: default, worker, explorer

Typecheck and all 920 tests pass.


CodeAnt-AI Description

Add Codex subagent support and preserve subagent fields through conversion

What Changed

  • Codex agent role TOML now requires name, description, and developer_instructions and validates them via an updated JSON schema.
  • Converters now parse and emit subagent fields (name, description, developer_instructions, nickname_candidates, mcp_servers, and skills.config) so these values are preserved when importing from TOML and exporting back to TOML.
  • Canonical package metadata gained fields to store Codex subagent info for roundtrip fidelity; tests added/expanded to cover parsing, validation, and roundtrip of subagent fields.
  • Documentation updated to describe the subagent TOML format, required fields, optional MCP/skills settings, and conversion behavior; registry README entries updated.

Impact

✅ Clearer subagent validation errors
✅ Preserve subagent metadata across import/export
✅ Easier creation of Codex subagents with required fields enforced

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@codeant-ai
Copy link
Copy Markdown

codeant-ai Bot commented Mar 17, 2026

CodeAnt AI is reviewing your PR.


Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

@codeant-ai codeant-ai Bot added the size:XL This PR changes 500-999 lines, ignoring generated files label Mar 17, 2026
@codeant-ai
Copy link
Copy Markdown

codeant-ai Bot commented Mar 17, 2026

Sequence Diagram

This PR adds full Codex subagent support by mapping required agent fields and new optional subagent metadata into canonical form, then restoring them back to TOML. It also enforces schema validation for required fields and valid sandbox values.

sequenceDiagram
    participant Caller
    participant FromCodex
    participant Canonical
    participant ToCodex
    participant SchemaValidator

    Caller->>FromCodex: Submit Codex agent TOML
    FromCodex->>Canonical: Parse name description and developer instructions
    FromCodex->>Canonical: Preserve nickname model sandbox mcp servers and skills config
    Caller->>ToCodex: Convert canonical package to Codex agent TOML
    ToCodex->>ToCodex: Emit required fields and optional subagent fields
    ToCodex->>SchemaValidator: Validate generated agent structure
    SchemaValidator-->>Caller: Return schema valid result
Loading

Generated by CodeAnt AI

@my-senior-dev-pr-review
Copy link
Copy Markdown

🤖 My Senior Dev — Analysis Complete

👤 For @khaliqgant

📁 Expert in packages/ (207 edits) • ⚡ 6th PR this month

View your contributor analytics →


📊 9 files reviewed • 1 high risk • 2 need attention

🚨 High Risk:

  • packages/converters/schemas/codex-agent-role.schema.json — This schema is crucial for data integrity and input validation for Codex agent role configurations. Any misconfiguration could lead to significant application vulnerabilities.

⚠️ Needs Attention:

  • packages/converters/docs/codex.md — This new documentation file provides specifications for the Codex format and needs clarity and thoroughness to ensure users understand its use.
  • packages/converters/docs/README.md — The README file needs to reflect the security measures and input validation relevant to the new Codex format support.

🚀 Open Interactive Review →

The full interface unlocks features not available in GitHub:

  • 💬 AI Chat — Ask questions on any file, get context-aware answers
  • 🔍 Smart Hovers — See symbol definitions and usage without leaving the diff
  • 📚 Code Archeology — Understand how files evolved over time (/archeology)
  • 🎯 Learning Insights — See how this PR compares to similar changes

💬 Chat here: @my-senior-dev explain this change — or try @chaos-monkey @security-auditor @optimizer @skeptic @junior-dev

📖 View all 12 personas & slash commands

You can interact with me by mentioning @my-senior-dev in any comment:

In PR comments or on any line of code:

  • Ask questions about the code or PR
  • Request explanations of specific changes
  • Get suggestions for improvements

Slash commands:

  • /help — Show all available commands
  • /archeology — See the history and evolution of changed files
  • /profile — Performance analysis and suggestions
  • /expertise — Find who knows this code best
  • /personas — List all available AI personas

AI Personas (mention to get their perspective):

Persona Focus
@chaos-monkey 🐵 Edge cases & failure scenarios
@skeptic 🤨 Challenge assumptions
@optimizer Performance & efficiency
@security-auditor 🔒 Security vulnerabilities
@accessibility-advocate Inclusive design
@junior-dev 🌱 Simple explanations
@tech-debt-collector 💳 Code quality & shortcuts
@ux-champion 🎨 User experience
@devops-engineer 🚀 Deployment & scaling
@documentation-nazi 📚 Documentation gaps
@legacy-whisperer 🏛️ Working with existing code
@test-driven-purist Testing & TDD

For the best experience, view this PR on myseniordev.com — includes AI chat, file annotations, and interactive reviews.

@khaliqgant
Copy link
Copy Markdown
Collaborator Author

Code Review: Codex Subagent Format Support

Checklist Verification (adding-new-ai-format skill)

Verified all steps from the integration checklist:

Step Status Notes
Types Package (Format type, FORMATS array) codex in Format type, FORMAT_ALL_SUPPORTED, subtypes defined
Schema (codex-agent-role.schema.json) Correct $id, additionalProperties: false, all fields from Codex docs
Format Docs (converters/docs/codex.md) Comprehensive — subagent TOML + skill SKILL.md + conversion notes
README.md updates Format Matrix, Available Formats, Schema Validation, Frontmatter, File Org tables all updated
Canonical Types (metadata.codexAgent, MetadataSection.data.codexAgent) Both CanonicalPackage.metadata and MetadataSection.data have codexAgent with all fields
From Converter (from-codex.ts) fromCodex (SKILL.md) + fromCodexAgentRole (TOML)
To Converter (to-codex.ts) Handles skill→SKILL.md, agent→TOML, slash-command→AGENTS.md
Index exports fromCodex, fromCodexAgentRole, toCodex, generateCodexFilename
Validation (subtypeSchemaMap) codex:skill and codex:agent both mapped
Taxonomy (normalizeFormat) codex in Format type
CLI filesystem getDestinationDir and autoDetectFormat
CLI search/install (icons, labels) Both files have codex entries
Webapp (FORMAT_SUBTYPES, dropdown) Codex in search dropdown
Registry routes (download, search, analytics) All three route files updated

All 13 checklist steps: COMPLETE


TOML Parsing Correctness

  • Uses @iarna/toml (v2.2.5) — the standard, well-maintained TOML parser for Node.js. Good choice.
  • Invalid TOML is gracefully caught (silent fallback to empty role at from-codex.ts:211-213).
  • toml.stringify() used for output (to-codex.ts:180).

Schema Completeness

codex-agent-role.schema.json covers all fields from the Codex multi-agent docs:

  • Required: name, description, developer_instructions
  • Optional: nickname_candidates, model, model_reasoning_effort (enum), sandbox_mode (enum), mcp_servers, skills
  • additionalProperties: false on root — catches typos/invalid fields ✅

Roundtrip Conversion Fidelity

Excellent roundtrip coverage:

  • canonical → TOML → canonical: preserves model, reasoning effort, sandbox mode, developer_instructions, nickname_candidates, mcp_servers, skills.config
  • TOML → canonical → TOML: reproduces equivalent TOML
  • Claude agent → Codex agent: cross-format with proper lossy conversion tracking
  • All three sandbox_mode enum values roundtrip tested

Test Coverage

90 tests, all passing:

  • from-codex.test.ts (30 tests): basic parsing, optional fields, name validation, description handling, content structure, taxonomy, roundtrip
  • to-codex.test.ts (35 tests): basic conversion, slash commands, arguments, append mode, section conversion, skill/agent TOML conversion, roundtrip
  • cross-converters/codex-agent-role.test.ts (25 tests): full roundtrip both directions, schema validation, subagent fields, cross-format, data integrity

Edge Cases Covered

  • Empty/invalid TOML (from-codex.ts:211) — graceful fallback
  • Content without frontmatter (from-codex.test.ts:64)
  • Long descriptions truncated to 1024 chars (to-codex.ts:277)
  • Namespace stripping (@prpm/self-improvingself-improving)
  • Tool deduplication from patterns like Bash(git:*) Bash(npm:*)
  • Windows CRLF line endings
  • Regex metacharacter escaping in append mode (to-codex.ts:446)

TypeScript Type Safety

  • CodexAgentRoleToml interface properly typed with union types for enums
  • AgentSkillsFrontmatter interface covers all spec fields
  • Type narrowing used correctly (section.type === 'metadata' guards)
  • No any types in the converter logic

Notable Positives

  1. escapeRegex() at to-codex.ts:446 — prevents command names with regex metacharacters from breaking appendToExistingAgentsMd
  2. Defensive TOML parsing at from-codex.ts:211 — matches pattern used for YAML in parseFrontmatter
  3. additionalProperties: false in schema — strict validation catches invalid fields

Verdict

This is a thorough, well-structured integration. The converters follow established patterns (matches OpenCode/Droid reference implementations), roundtrip fidelity is well-tested, and all integration points across the monorepo are covered. No missing steps from the checklist. LGTM

Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

7 issues found across 9 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/converters/src/__tests__/cross-converters/codex-agent-role.test.ts">

<violation number="1" location="packages/converters/src/__tests__/cross-converters/codex-agent-role.test.ts:213">
P2: The invalid `sandbox_mode` test is now vacuous because it still omits required fields, so it can pass without exercising the enum validation.</violation>
</file>

<file name="packages/converters/docs/README.md">

<violation number="1" location="packages/converters/docs/README.md:31">
P2: The Codex `rule` entry links to the skills docs instead of the AGENTS.md instructions guide.</violation>
</file>

<file name="packages/converters/docs/codex.md">

<violation number="1" location="packages/converters/docs/codex.md:8">
P2: The `.opencommands` slash-command location is inaccurate for Codex. Codex's reusable command mechanism is user-scoped prompts under `~/.codex/prompts/`, and this repo already treats slash commands as an AGENTS.md fallback, so these lines would direct users to files Codex never loads.</violation>
</file>

<file name="packages/converters/src/to-codex.ts">

<violation number="1" location="packages/converters/src/to-codex.ts:133">
P2: Use the canonical display title as the fallback for Codex `name`; `pkg.name` is the registry slug, not the agent's display name.</violation>

<violation number="2" location="packages/converters/src/to-codex.ts:144">
P2: This conditional can omit required `developer_instructions` when the package has no instructions section and an empty description, producing invalid Codex agent TOML.</violation>
</file>

<file name="packages/converters/schemas/codex-agent-role.schema.json">

<violation number="1" location="packages/converters/schemas/codex-agent-role.schema.json:40">
P2: `mcp_servers` entries need a required launcher (`command` or `url`), otherwise malformed MCP configs pass schema validation.</violation>

<violation number="2" location="packages/converters/schemas/codex-agent-role.schema.json:62">
P2: `skills.config` should be an array of tables, not a single object, or valid Codex agent files using `[[skills.config]]` will be rejected.</violation>
</file>

Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.

for (const mode of validModes) {
const result = validateFormat('codex', { sandbox_mode: mode }, 'agent');
const result = validateFormat('codex', {
name: 'test-agent',
Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: The invalid sandbox_mode test is now vacuous because it still omits required fields, so it can pass without exercising the enum validation.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At packages/converters/src/__tests__/cross-converters/codex-agent-role.test.ts, line 213:

<comment>The invalid `sandbox_mode` test is now vacuous because it still omits required fields, so it can pass without exercising the enum validation.</comment>

<file context>
@@ -209,7 +209,12 @@ describe('Codex Agent Role — schema validation', () => {
     for (const mode of validModes) {
-      const result = validateFormat('codex', { sandbox_mode: mode }, 'agent');
+      const result = validateFormat('codex', {
+        name: 'test-agent',
+        description: 'Test agent',
+        developer_instructions: 'Do something.',
</file context>
Fix with Cubic

| | `agents-md` | Agent configurations in markdown | [docs.factory.ai](https://docs.factory.ai/cli/configuration/agents-md) |
| **Codex** | `skill` | Agent Skills SKILL.md format | [developers.openai.com](https://developers.openai.com/codex/skills) |
| | `agent` | Subagent TOML configs with MCP and skills | [developers.openai.com](https://developers.openai.com/codex/multi-agent/) |
| | `rule` | AGENTS.md project instructions | [developers.openai.com](https://developers.openai.com/codex/skills) |
Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: The Codex rule entry links to the skills docs instead of the AGENTS.md instructions guide.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At packages/converters/docs/README.md, line 31:

<comment>The Codex `rule` entry links to the skills docs instead of the AGENTS.md instructions guide.</comment>

<file context>
@@ -26,6 +26,9 @@ Complete overview of all supported formats, their subtypes, and official documen
 | | `agents-md` | Agent configurations in markdown | [docs.factory.ai](https://docs.factory.ai/cli/configuration/agents-md) |
+| **Codex** | `skill` | Agent Skills SKILL.md format | [developers.openai.com](https://developers.openai.com/codex/skills) |
+| | `agent` | Subagent TOML configs with MCP and skills | [developers.openai.com](https://developers.openai.com/codex/multi-agent/) |
+| | `rule` | AGENTS.md project instructions | [developers.openai.com](https://developers.openai.com/codex/skills) |
 | **OpenCode** | `agent` | AI agents with mode, tools, and permissions | [opencode.ai](https://opencode.ai/docs/agents/) |
 | | `slash-command` | User-triggered prompts with templates and placeholders | [opencode.ai](https://opencode.ai/docs/commands/) |
</file context>
Suggested change
| | `rule` | AGENTS.md project instructions | [developers.openai.com](https://developers.openai.com/codex/skills) |
| | `rule` | AGENTS.md project instructions | [developers.openai.com](https://developers.openai.com/codex/guides/agents-md/) |
Fix with Cubic

- Agents/Subagents (project): `.codex/agents/*.toml`
- Agents/Subagents (global): `~/.codex/agents/*.toml`
- Rules/Instructions: `AGENTS.md`
- Slash Commands: `.opencommands/*.md`
Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: The .opencommands slash-command location is inaccurate for Codex. Codex's reusable command mechanism is user-scoped prompts under ~/.codex/prompts/, and this repo already treats slash commands as an AGENTS.md fallback, so these lines would direct users to files Codex never loads.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At packages/converters/docs/codex.md, line 8:

<comment>The `.opencommands` slash-command location is inaccurate for Codex. Codex's reusable command mechanism is user-scoped prompts under `~/.codex/prompts/`, and this repo already treats slash commands as an AGENTS.md fallback, so these lines would direct users to files Codex never loads.</comment>

<file context>
@@ -0,0 +1,181 @@
+- Agents/Subagents (project): `.codex/agents/*.toml`
+- Agents/Subagents (global): `~/.codex/agents/*.toml`
+- Rules/Instructions: `AGENTS.md`
+- Slash Commands: `.opencommands/*.md`
+
+**Format:** TOML (agents), Markdown with YAML frontmatter (skills), plain Markdown (AGENTS.md)
</file context>
Fix with Cubic

: undefined;

// Required subagent fields: name, description, developer_instructions
const agentName = codexAgent?.name || pkg.name;
Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Use the canonical display title as the fallback for Codex name; pkg.name is the registry slug, not the agent's display name.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At packages/converters/src/to-codex.ts, line 133:

<comment>Use the canonical display title as the fallback for Codex `name`; `pkg.name` is the registry slug, not the agent's display name.</comment>

<file context>
@@ -129,6 +129,27 @@ function convertToAgentRoleToml(
     : undefined;
 
+  // Required subagent fields: name, description, developer_instructions
+  const agentName = codexAgent?.name || pkg.name;
+  role['name'] = agentName;
+
</file context>
Fix with Cubic

Comment on lines +144 to +146
} else if (pkg.description) {
// Fall back to package description
role['developer_instructions'] = pkg.description;
Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: This conditional can omit required developer_instructions when the package has no instructions section and an empty description, producing invalid Codex agent TOML.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At packages/converters/src/to-codex.ts, line 144:

<comment>This conditional can omit required `developer_instructions` when the package has no instructions section and an empty description, producing invalid Codex agent TOML.</comment>

<file context>
@@ -129,6 +129,27 @@ function convertToAgentRoleToml(
+  // Map instructions section to developer_instructions
+  if (instructionsSection?.type === 'instructions') {
+    role['developer_instructions'] = instructionsSection.content;
+  } else if (pkg.description) {
+    // Fall back to package description
+    role['developer_instructions'] = pkg.description;
</file context>
Suggested change
} else if (pkg.description) {
// Fall back to package description
role['developer_instructions'] = pkg.description;
} else {
// Fall back to package description so the required field is always present
role['developer_instructions'] = pkg.description || '';
}
Fix with Cubic

"enum": ["read-only", "workspace-write", "danger-full-access"],
"description": "Filesystem/network sandbox policy: read-only (default), workspace-write, or danger-full-access (no sandbox)"
},
"mcp_servers": {
Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: mcp_servers entries need a required launcher (command or url), otherwise malformed MCP configs pass schema validation.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At packages/converters/schemas/codex-agent-role.schema.json, line 40:

<comment>`mcp_servers` entries need a required launcher (`command` or `url`), otherwise malformed MCP configs pass schema validation.</comment>

<file context>
@@ -14,14 +32,40 @@
       "enum": ["read-only", "workspace-write", "danger-full-access"],
       "description": "Filesystem/network sandbox policy: read-only (default), workspace-write, or danger-full-access (no sandbox)"
+    },
+    "mcp_servers": {
+      "type": "object",
+      "description": "MCP server configurations available to this agent",
</file context>
Fix with Cubic

Comment on lines +62 to +66
"config": {
"type": "object",
"description": "Skill-specific configuration key-value pairs",
"additionalProperties": true
}
Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: skills.config should be an array of tables, not a single object, or valid Codex agent files using [[skills.config]] will be rejected.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At packages/converters/schemas/codex-agent-role.schema.json, line 62:

<comment>`skills.config` should be an array of tables, not a single object, or valid Codex agent files using `[[skills.config]]` will be rejected.</comment>

<file context>
@@ -14,14 +32,40 @@
+      "type": "object",
+      "description": "Skills configuration for this agent",
+      "properties": {
+        "config": {
+          "type": "object",
+          "description": "Skill-specific configuration key-value pairs",
</file context>
Suggested change
"config": {
"type": "object",
"description": "Skill-specific configuration key-value pairs",
"additionalProperties": true
}
"config": {
"type": "array",
"description": "List of skill-specific configuration tables",
"items": {
"type": "object",
"additionalProperties": true
}
}
Fix with Cubic

...metadata,
id: metadata.id,
name: metadata.name || metadata.id,
name: role.name || metadata.name || metadata.id,
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: pkg.name is a package identifier used across CLI/registry paths and manifest validation, but this line overwrites it with the TOML name display field (which can contain spaces or non-slug text). That breaks the package-name contract and can cause invalid package names downstream. Keep pkg.name sourced from metadata (metadata.name/metadata.id) and store the subagent display name only in metadataSection.data.title / codexAgent.name. [logic error]

Severity Level: Major ⚠️
- ⚠️ Codex agent parser can emit non-slug canonical names.
- ⚠️ Name constraints mismatch registry/package validation rules.
- ⚠️ Future codex-agent CLI integration risks invalid package identifiers.
Suggested change
name: role.name || metadata.name || metadata.id,
name: metadata.name || metadata.id,
Steps of Reproduction ✅
1. Use the existing Codex agent-role parsing path exercised in
`packages/converters/src/__tests__/cross-converters/codex-agent-role.test.ts:332-339`,
where TOML includes `name = "My Custom Agent"` and calls `fromCodexAgentRole(...)`.

2. In `packages/converters/src/from-codex.ts:257-263`, `pkg.name` is assigned from
`role.name`, so the canonical package name becomes `"My Custom Agent"` (contains
spaces/casing).

3. Verify Codex schema allows display-style names
(`packages/converters/schemas/codex-agent-role.schema.json:9-12` defines `name` as
unrestricted string), so this input is realistic and valid for source TOML.

4. Compare with package-name constraints used elsewhere
(`packages/registry/src/validation/package-validator.ts:87-93` rejects spaces/uppercase in
package names): this shows the parsed canonical `pkg.name` can violate downstream
package-name expectations.
Prompt for AI Agent 🤖
This is a comment left during a code review.

**Path:** packages/converters/src/from-codex.ts
**Line:** 259:259
**Comment:**
	*Logic Error: `pkg.name` is a package identifier used across CLI/registry paths and manifest validation, but this line overwrites it with the TOML `name` display field (which can contain spaces or non-slug text). That breaks the package-name contract and can cause invalid package names downstream. Keep `pkg.name` sourced from metadata (`metadata.name`/`metadata.id`) and store the subagent display name only in `metadataSection.data.title` / `codexAgent.name`.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
👍 | 👎

Comment on lines +142 to +147
if (instructionsSection?.type === 'instructions') {
role['developer_instructions'] = instructionsSection.content;
} else if (pkg.description) {
// Fall back to package description
role['developer_instructions'] = pkg.description;
}
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: developer_instructions is marked as required for Codex agent-role output, but this branch skips setting it when there is no instructions section and pkg.description is empty. That produces TOML missing a required field and can fail schema validation or downstream loading. Always write developer_instructions with a deterministic fallback value. [logic error]

Severity Level: Major ⚠️
- ❌ Codex agent TOML can fail schema validation.
- ⚠️ Registry codex downloads may emit invalid agent files.
- ⚠️ CLI codex conversion may write missing required fields.
Suggested change
if (instructionsSection?.type === 'instructions') {
role['developer_instructions'] = instructionsSection.content;
} else if (pkg.description) {
// Fall back to package description
role['developer_instructions'] = pkg.description;
}
if (instructionsSection?.type === 'instructions' && instructionsSection.content.trim()) {
role['developer_instructions'] = instructionsSection.content;
} else {
// Ensure required field is always present
role['developer_instructions'] = agentDescription;
}
Steps of Reproduction ✅
1. Trigger Codex conversion through real entrypoints that call `toCodex(canonicalPkg)`:
registry download conversion (`packages/registry/src/services/conversion.ts:127`, called
from `packages/registry/src/routes/download.ts:130`) or CLI conversion
(`packages/cli/src/commands/convert.ts:476`).

2. Provide an agent canonical package with no `instructions` section and empty description
sources (`pkg.description === ''`, metadata description empty). This is allowed by current
parsers that default description to empty string
(`packages/converters/src/from-codex.ts:43`, `:165`).

3. In `convertToAgentRoleToml`, execution reaches the branch at
`packages/converters/src/to-codex.ts:142-147`; because there is no instructions section
and `pkg.description` is empty, `role['developer_instructions']` is never assigned.

4. Validate the emitted TOML object with the existing validator path used in tests
(`validateFormat('codex', parsed, 'agent')` at
`packages/converters/src/__tests__/cross-converters/codex-agent-role.test.ts:203-204`):
schema requires `developer_instructions`
(`packages/converters/schemas/codex-agent-role.schema.json:7`), so output is invalid.
Prompt for AI Agent 🤖
This is a comment left during a code review.

**Path:** packages/converters/src/to-codex.ts
**Line:** 142:147
**Comment:**
	*Logic Error: `developer_instructions` is marked as required for Codex agent-role output, but this branch skips setting it when there is no instructions section and `pkg.description` is empty. That produces TOML missing a required field and can fail schema validation or downstream loading. Always write `developer_instructions` with a deterministic fallback value.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
👍 | 👎

@codeant-ai
Copy link
Copy Markdown

codeant-ai Bot commented Mar 17, 2026

CodeAnt AI finished reviewing your PR.

@khaliqgant khaliqgant merged commit ef58f78 into main Mar 17, 2026
12 checks passed
@khaliqgant khaliqgant deleted the feature/codex-subagents branch March 17, 2026 12:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size:XL This PR changes 500-999 lines, ignoring generated files

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant