Codex picking your stack for you? Pin it in AGENTS.md and make it ask before new deps

#What changed

Wes Winder (@weswinder) posted a short Codex hygiene tip: don’t let the agent invent your package manager or libraries. Put the stack you actually want in AGENTS.md, and add a rule that Codex must ask before adding any new dependency. He says repos got much easier to maintain after that.

OpenAI’s AGENTS.md guide already models the same pattern in its global-guidance example (“Prefer pnpm when installing dependencies” and “Ask for confirmation before adding new production dependencies”), so the tip lines up with how Codex is meant to load project instructions.

#Who is affected

Anyone running Codex on repos where the agent has been quietly adding packages, switching package managers, or drifting from the team’s chosen stack. Especially useful for solo and small-team codebases without a rigid CI gate on dependency changes.

#What to do now

1. In the repo root AGENTS.md (or ~/.codex/AGENTS.md for personal defaults), name the package manager and allowed frameworks explicitly.
2. Add a hard rule: ask before adding any new production (and ideally any) dependency.
3. Keep the file short — Codex stops once combined AGENTS.md content hits the project_doc_max_bytes limit (32 KiB by default).
4. Start a fresh session and ask Codex to summarize active instructions so you confirm the stack rules loaded.

#What is not confirmed

How much “easier to maintain” improved is Wes’s field report, not a measured benchmark. Dotsfeed has not A/B’d repos with vs without the ask-first rule.