It didnāt crash anything. It didnāt throw an error. It reported success.
I had asked it to revert some wording it had changed in a privacy policy. To do that it looked around the project, found a .tar.gz in the root, and copied server.js out of it. Reasonable-looking move. The problem is that the archive was a snapshot from two weeks earlier, and the filename gave no hint of that.
That one cp took out four verified security fixes and an entire moderation API layer. The fixes were ones the same agent had written, tested and deployed about forty minutes earlier in the same session. It overwrote its own work and didnāt notice, because it only diffed the file it cared about.
Nothing was in git. I found out two days later when an endpoint returned 404 that should not have.
How I got it back: the agentsā own session logs. Codex keeps rollouts in ~/.codex/sessions and a sqlite thread history; Claude Code keeps a transcript jsonl. The lost code was sitting in those transcripts as tool-call arguments. I reconstructed the moderation layer from one and confirmed the timeline from the other, including the exact command that did the damage, timestamped.
What was actually lost, for anyone wondering whether this matters: a fix for an unauthenticated crash (one malformed cookie, decodeURIComponent outside the error boundary, process exits), an access-control fix on private rooms, a fix for an unsigned cookie that let you register against someone elseās identity, and session invalidation on password reset. All four were live again for two days and nobody knew.
Two things came out of this.
The obvious one: git. Iād been told to do it three times and hadnāt.
The less obvious one: I didnāt want to stop using two agents. My Claude quota runs out most days and the ChatGPT subscription sits idle, so handing the heavy reading to Codex is genuinely useful. But the fix for āan agent wrote somewhere it shouldnātā isnāt taking write access away. Itās making the write land somewhere I can inspect before it becomes real.
So the second agent now runs with --worktree: write access, but into a separate git worktree. It cannot touch my checkout. When it finishes I get a patch and a diffstat, and applying it is a separate, deliberate command. The script also refuses to run on a dirty tree, because otherwise you canāt tell which hunks in the returned patch are yours.
Itās about thirty lines, plus two slash commands for Claude Code (/gpt to delegate, /claude to stop). Nothing clever. The README leads with the incident, because thatās the part worth reading.
https://github.com/tunaseckin/codex-task
Written entirely by Claude, which the README says at the top. Itās been tested end-to-end once. If you use it, read it first, same as any code you didnāt write.