Manage Codex CLI settings, permissions, models, sandbox behavior, and user preferences through a structured JSON configuration workflow.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install update-cli-config
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install update-cli-config using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Codex CLI Configuration Manager?
This Openclaw Skills capability provides a safe, structured workflow for viewing and modifying Codex CLI configuration stored in ~/.cursor/cli-config.json. It helps developers manage tool permissions, approval behavior, editor preferences, display settings, sandbox networking, model selection, release channels, and other CLI controls without manually guessing the configuration schema.
The skill also explains how project-level .cursor/cli.json files override home-level settings for the current session. It distinguishes editable preferences from internal cached fields that should remain untouched, helping users apply reliable configuration changes while preserving authentication, model-picker, and schema state.
Codex CLI Configuration Manager Use Cases
- Change Codex CLI tool permissions using
allowanddenypatterns. - Switch between approval-oriented workflows and automatic tool execution modes.
- Enable Vim keybindings, line numbers, thinking blocks, or status indicators.
- Configure sandbox execution, network access policies, and domain allowlists.
- Select release channels such as
prod,lab, orstatic. - Enable max mode or configure Explore subagent model inheritance, disabling, or pinning.
- Configure HTTP/1.1 agent connections for SSE-based streaming.
- Set up AWS Bedrock access, regions, test models, and team IAM role settings.
- Control whether agent-authored commits and pull requests receive attribution.
- Apply project-specific CLI overrides without changing the global home configuration.
How Codex CLI Configuration Manager Works
- Identify whether the requested change belongs in the global
~/.cursor/cli-config.jsonfile or a project-level.cursor/cli.jsonoverride. - Read the existing JSON configuration before making changes so unrelated settings are preserved.
- Validate the requested field against the supported Codex CLI schema, including booleans, enums, arrays, permission patterns, and nested model or sandbox objects.
- Update only the relevant editable settings, leaving internal or cached fields such as
authInfo,privacyCache, and model-picker state unchanged. - Write the valid JSON back to the appropriate configuration file.
- Restart the Codex CLI because configuration changes take effect after the CLI is restarted.
- Confirm precedence when project overrides are present: the CLI walks from the Git root to the current directory, with deeper
.cursor/cli.jsonfiles taking precedence for the current session.
Codex CLI Configuration Manager Setup
No package installation is required. The skill operates on the Codex CLI JSON configuration already present in the user environment.
- Back up the global configuration before editing:
cp ~/.cursor/cli-config.json ~/.cursor/cli-config.json.backup
- Inspect the current configuration:
cat ~/.cursor/cli-config.json
- For project-scoped settings, inspect or create the override file from the project directory:
mkdir -p .cursor
touch .cursor/cli.json
Apply valid JSON changes to the selected file. Preserve required
permissionssettings and use supported values for fields such asapprovalMode,sandbox.mode,channel, andeditor.defaultBehavior.Validate the JSON before restarting the CLI:
python -m json.tool ~/.cursor/cli-config.json
- Restart Codex CLI to activate the updated configuration. Do not manually modify internal fields including
version,model,selectedModel,modelParameters,privacyCache,authInfo, or other cached UI state.
Codex CLI Configuration Manager Data Schema & Taxonomy
Configuration locations
| Location | Scope | Precedence |
|---|---|---|
~/.cursor/cli-config.json |
Global user configuration | Base configuration |
.cursor/cli.json |
Project and directory-specific overrides | Deeper files override shallower files for the current session |
Editable setting groups
| Group | Important fields | Purpose |
|---|---|---|
permissions |
allow, deny |
Match permitted and denied tool calls such as Shell(**) or Mcp(server-name, tool-name) |
editor |
vimMode, defaultBehavior |
Configure input keybindings and default ide or agent behavior |
display |
showLineNumbers, showThinkingBlocks, showStatusIndicators |
Control CLI presentation and status visibility |
channel |
prod, lab, static |
Select the release channel |
maxMode |
Boolean | Enable higher-quality model responses |
subagentModels |
explore |
Use, inherit, disable, or pin the Explore subagent model and parameters |
approvalMode |
allowlist or documented non-allowlist mode |
Control whether tool calls require approval |
sandbox |
mode, networkAccess, networkAllowlist |
Restrict execution and network connectivity |
network |
useHttp1ForAgent |
Use HTTP/1.1 and SSE-based streaming for agent connections |
bedrock |
enabled, mode, region, testModel, role fields |
Configure AWS Bedrock integration |
attribution |
attributeCommitsToAgent, attributePRsToAgent |
Control Git commit and pull request attribution |
webFetchDomainAllowlist |
String array | Restrict web-fetch access to approved domains |
Protected internal state
Do not manually edit version, model, selectedModel, modelParameters, hasChangedDefaultModel, privacyCache, authInfo, showSandboxIntro, or conversationClassificationScoredConversations. These fields are managed by the CLI, model picker, authentication system, or internal caches.
Codex CLI Configuration Manager Advanced Features
- Hierarchical project overrides allow directory-specific behavior while keeping global settings unchanged.
- Permission patterns support granular allow and deny rules for shell commands and MCP tools.
- Explore subagent configuration supports default, inherited, disabled, or explicitly pinned models with optional parameters and max mode.
- Legacy
exploreSubagentModelcompatibility can be kept synchronized for older CLI versions. - Sandbox network policies support user-configured defaults, broader access, and explicit domain allowlists.
- AWS Bedrock configuration supports access-key and team-role modes, including IAM role ARN and STS external ID settings.
- Web-fetch domain allowlists can restrict access to exact domains, wildcard subdomains, or broader patterns.
- HTTP/1.1 agent connectivity enables SSE-based streaming where required.
- Git attribution controls make agent involvement in commits and pull requests explicit.
- Openclaw Skills guidance separates user-editable preferences from protected cached state to reduce configuration corruption.
SKILL.md
Loading
Related Openclaw Skills
Grilling
Grilling relentlessly stress-tests a plan, decision, or idea through structured, round-based questioning until every assumption is resolved.
PDF Summary and Translation Install Check
A reliable preflight and dependency installer for PDF OCR, summarization, translation, and rendering pipelines.
Work Handover Pack
Turn scattered responsibilities and undocumented operational knowledge into a clear, actionable work handover pack.
Client Follow-up Plan
Convert client meeting notes, chat excerpts, and visit records into a structured, evidence-based follow-up plan with owners, deadlines, risks, and completion criteria.
Update Codex/VSCode Settings
Safely modify Codex and VSCode user settings.json values while preserving existing configuration and validating the result.
Split to PRs
Split mixed Git changes into small, reviewer-aligned pull requests without risking the original work.
Featured*
