Same agent.
Three places to
put it to work.

02 · The differences, up front

⚡ Claude Code vs Codex

They solve the same problem and they've converged hard. The differences that actually affect your day are in how you configure them, how they handle permissions, and what happens when you want to step away.

📊 Side by side

03 · The straight answer

🏆 What a developer should actually use

If you want to skip the deliberation: pick the one your subscription already covers, install both its CLI and its editor extension, and commit a memory file to the repo. That's 90% of the value. Everything else is refinement.

🗓️ What that looks like on a normal day

04 · Decide per task

🧭 Pick a surface by the shape of the task

Once both are installed, the live question is "how much of this do I need to watch?" That one answer picks your surface, and it changes several times a day.

05 · Before you install

📦 Versions & requirements

Most failed installs are one of three things: Node too old, a global npm install fought with permissions, or the account doesn't actually have access. Check these first.

🔧 Install, check and update

# --- Claude Code ---
npm install -g @anthropic-ai/claude-code   # install
claude --version                           # check
claude update                              # update
claude doctor                              # diagnose a broken install

# --- Codex ---
npm install -g @openai/codex               # install (brew also available)
codex --version
npm install -g @openai/codex@latest        # update

# --- sanity check your Node ---
node --version                             # must be v18.x or higher

💡 Version numbers here reflect what was current in mid-2026 and requirements do get raised — claude doctor and the official install docs are the authority if something won't start.

06 · Setup

🧩 Getting both running in VS Code

Fifteen minutes, once. The install is the boring part — the habits at the end are where the value is.

● Claude Code

Install the CLI first — the extension talks to it.

# 1 · install the CLI
npm install -g @anthropic-ai/claude-code

# 2 · go to your project root — this defines the workspace
cd ~/code/my-project

# 3 · first run signs you in
claude

Now install the Claude Code extension from the VS Code marketplace — or just run claude in VS Code's integrated terminal and it'll offer to install it for you. Then connect the two:

/ide          # attach this session to the editor
/init         # scan the repo and write a CLAUDE.md
/status       # confirm the IDE shows as connected

Press Ctrl+Esc (⌘+Esc on Mac) to open the panel from anywhere. With the IDE connection live you get three things a bare terminal can't:

• ✅ Your current selection is passed as context automatically
• ✅ Edits open in VS Code's native diff view instead of scrolling past as text
• ✅ Lint and type errors from the Problems panel are visible without pasting

● Codex

Install the Codex extension from the marketplace (it also works in Cursor and Windsurf), then sign in with your ChatGPT account or an API key. For long runs, add the CLI too:

npm install -g @openai/codex

cd ~/code/my-project
codex

Codex's defining setting is its approval mode. Set it deliberately on day one rather than clicking through prompts:

🎁 Make the editor part actually pay off

• Select before you ask. Highlight the function, then open the panel. "Why is this slow?" with a selection beats a paragraph describing where the code lives.
• Use @ to attach files instead of pasting — @src/auth/session.ts gives the live file, not a stale copy.
• Let it read your errors. If the Problems panel is red, say "fix the type errors in the Problems panel" rather than copying them one by one.

07 · The Windows / .NET case

🪟 Visual Studio 2022 is a different story

Worth being blunt: Visual Studio and VS Code are unrelated products, and the extensions above are VS Code only. As of writing there's no first-party Claude Code or Codex extension for Visual Studio 2022. If you live in VS for .NET or C++, here's what works.

# from the folder containing your .sln
claude

# give it the build commands up front — it can't discover MSBuild alone
> Build with: dotnet build MySolution.sln
> Test with:  dotnet test --no-build

💡 GitHub Copilot's agent mode is the natively integrated option inside Visual Studio if you want inline review without leaving the IDE. Extension availability moves fast — check the Visual Studio Marketplace before assuming the above still holds.

08 · Configuration

📁 Every file that matters, and why

This is the part that separates people who get a lot out of these tools from people who don't. The agent reads a handful of files at startup — and once you own those files, you're configuring behaviour instead of re-explaining yourself in every prompt.

🌳 What a well-set-up repo looks like

my-project/
├── CLAUDE.md                    ← project memory (Claude)   · commit ✅
├── AGENTS.md                    ← project memory (Codex)    · commit ✅
├── .mcp.json                    ← shared MCP servers        · commit ✅
├── .claude/
│   ├── settings.json            ← team permissions + env    · commit ✅
│   ├── settings.local.json     ← your personal overrides   · gitignore ❌
│   ├── commands/
│   │   ├── review-pr.md        ← becomes /review-pr        · commit ✅
│   │   └── add-endpoint.md     ← becomes /add-endpoint     · commit ✅
│   └── agents/
│       └── test-writer.md      ← a named subagent          · commit ✅
├── .gitignore                  ← must list the local files
└── src/

# and on your machine, outside any repo:
~/.claude/CLAUDE.md             ← your preferences, every project
~/.claude/settings.json        ← your global permissions
~/.codex/config.toml           ← Codex model, sandbox, approvals
~/.codex/AGENTS.md             ← your global Codex instructions

📄 CLAUDE.md — the one to write properly

Run /init for a first draft, then edit it hard. Generated versions describe the repo; useful versions describe your conventions and the traps.

# Project: payments-api

## Commands
- Install: pnpm install
- Test: pnpm test --filter=<package>   (never the full suite — 20 min)
- Lint: pnpm lint --fix
- Typecheck: pnpm typecheck        (must pass before you say you're done)

## Conventions
- Money is always integer minor units. Never floats. Never a Number for a balance.
- Errors: throw AppError from src/errors.ts. Never a bare Error.
- New endpoints need a zod schema in src/schemas/ or the router won't register them.

## Do not touch
- src/generated/**   (codegen output)
- migrations/*.sql   (already applied — write a new migration instead)

## Notes
- The "legacy" folder is still in production. It is not dead code.
- If a test needs the DB, use the testcontainers helper, not a mock.

🔐 .claude/settings.json — guardrails as code

Rules are matched by tool and command pattern. Deny rules win. This is how you stop an agent reading your .env without having to remember not to ask it to.

{
  "permissions": {
    "allow": [
      "Bash(pnpm test:*)",
      "Bash(pnpm lint:*)",
      "Bash(git status)",
      "Bash(git diff:*)",
      "Read(src/**)"
    ],
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./secrets/**)",
      "Bash(rm -rf:*)",
      "Bash(git push:*)"
    ]
  },
  "env": { "NODE_ENV": "development" }
}

⚡ Custom slash commands — the underused one

Any markdown file in .claude/commands/ becomes a slash command for everyone on the repo. $ARGUMENTS picks up whatever you type after it.

---
description: Review staged changes like a senior reviewer
---

Review the staged diff. Pay particular attention to: $ARGUMENTS

Check for:
- unhandled error paths
- behaviour changes for existing callers
- tests that assert less than they used to
- new dependencies that weren't requested

Rank findings by severity. Do NOT apply fixes.

Then anyone in the repo types /review-pr security and gets your review standard, not their own improvised one. This is how a team's review quality becomes consistent.

🔌 .mcp.json — give it your real systems

MCP servers let the agent query your database, read tickets, or search internal docs directly instead of you copy-pasting.

{
  "mcpServers": {
    "postgres": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-postgres",
               "postgresql://localhost:5432/dev"]
    }
  }
}

⚙️ ~/.codex/config.toml

# model names change — check `codex --help` or the docs for current values
model = "..."

# safe default: can edit inside the workspace, asks for anything else
approval_policy = "on-request"
sandbox_mode     = "workspace-write"

[sandbox_workspace_write]
network_access = false   # turn on only when a task truly needs it

🙈 .gitignore additions

# agent config — keep personal overrides out of the repo
.claude/settings.local.json
CLAUDE.local.md

09 · Workflow

🔁 The loop that separates useful from annoying

A real sequence — each step exists because skipping it causes a specific failure. Use it for anything bigger than a one-line fix.

1. 🗺️ Orient before you ask for code

   Open with a question, not a task. "Read the checkout flow and tell me where discount codes are validated." You get a map — and you find out immediately whether it understands your codebase, cheaply, before it writes 300 lines on a wrong assumption.

2. 📋 Get a plan in writing

   Say "plan only, don't write code yet." In Claude Code, Shift+Tab cycles into plan mode, which enforces it. Read the plan properly: correcting a plan costs one sentence, correcting an implementation costs a review cycle.

3. 🛡️ Set the blast radius

   Decide now what it may do unattended. Claude Code: /permissions. Codex: pick the approval mode. Familiar repo with clean git status → loosen it. Deploy scripts or real credentials → don't.

4. 👀 Let it run — read the diff, not the prose

   The agent's summary of what it did is the least reliable artefact in the session. The diff is the truth. In the editor extensions that's one click — which is the main argument for working there.

5. 🔎 Review it like a stranger's pull request

   Look specifically for: tests weakened to pass, error handling quietly swallowed, a new dependency you didn't ask for, and edits outside the scope you described. Those four cover most of what goes wrong.

6. 📝 Write down what it got wrong

   Corrected the same misunderstanding twice? That's a line in CLAUDE.md or AGENTS.md. Everyone skips this step, and it's the one that compounds.

10 · The other comparison

⚖️ In the IDE vs. the desktop app

Claude's desktop app bundles chat, Cowork (agentic work on files and documents) and Claude Code in one window. Codex has a comparable story with its cloud tasks. The temptation is to treat these as "the same thing, bigger window." They're not — they're built on a different assumption about whether you're watching.

11 · Copy these

🎯 Five prompts that work

Real prompts, not templates. The pattern behind all of them: state the goal, state the constraint, state how you'll know it worked.

Trace what happens when a user submits the signup form, from the
HTTP handler down to the database write. List the files in order,
one line each on what that layer is responsible for. Don't change
anything. Flag anything that looks like it's there for a reason
I wouldn't guess.

`pnpm test auth` fails on "rejects expired tokens".

Find the root cause in the source, not the test. Do not modify the
test file, and do not add skips. Explain the cause in two sentences
before you edit anything, then fix it and re-run that one test.

Replace every direct `process.env.X` read with the typed config
object in src/config.ts. Work package by package. After each
package: run typecheck, then commit with message
"refactor(config): <package>". If typecheck fails, stop and tell
me — don't move to the next package.

Review the diff against main as if you were the reviewer who has to
maintain this. Focus on: unhandled error paths, anything that
changes behaviour for existing callers, and tests that assert less
than the old ones did. Rank findings by severity. Suggest fixes
but don't apply them.

Every file in src/routes/ has a copy-pasted try/catch block. Extract
it into a single wrapper in src/lib/handler.ts and apply it
everywhere. Keep behaviour identical — same status codes, same log
lines. Run the full test suite at the end and show me the diff
summary grouped by file.

12 · Learn these cheaply

⚠️ Things that go wrong

🧠 Context rot

Long sessions get worse, not better. Once a conversation holds three abandoned approaches, the agent is reasoning over its own failed attempts. Start fresh at each new task — /clear, or a new conversation. Use /compact only when you genuinely need continuity.

🔐 Never let it commit unreviewed

An agent that can run git commit unattended will eventually commit something you didn't read. Let it stage, let it write the message — keep the commit as your keystroke.

💣 The skip-permissions flag

Claude Code's --dangerously-skip-permissions (and Codex's full-access mode) exist for sandboxed containers and CI. On your laptop, in a repo whose .env talks to production, they're a genuinely bad idea. If a run needs that much freedom, run it in a container.

🎭 It will confidently claim it's done

"All tests pass" is a claim, not a result. Put verification in the prompt — "run the tests and paste the output" — and actually read the output.

💸 Cost tracks context, not messages

A 40-message session on a small file is cheap. One message that pulls in a 4,000-line file isn't. Attach the specific file, not the folder. /cost shows where a session went.

13 · Reference

🗂️ Cheat sheet

⌨️ Claude Code — in-session

🎹 Keys worth memorising

🖥️ Terminal

📁 Files at a glance