glen

Glen for Codex

Glen, shared memory for AI agents, gives every coding agent in your org one durable memory. This plugin wires it into OpenAI Codex CLI: a UserPromptSubmit hook ingests each turn and injects whatever Glen already knows that is relevant, and a glen-search skill handles targeted lookups. You sign in once in the browser; after that, memory is just on.

Install

codex plugin install Glen-Web-App/glen-codex-plugin

If you run more than one coding agent, npx @tryglen/cli install detects what is installed on your machine and sets up the matching plugins in one pass.

Then send any prompt. If you are not connected yet, the hook opens your browser to sign in at app.tryglen.com, and memory turns on as soon as you finish. You need a Glen account with an active org.

What happens on each prompt

1. You submit a prompt. Codex fires the UserPromptSubmit hook before the model sees it.
2. The hook (scripts/hook.mjs) pipes the event JSON to glen ingest.
3. The CLI posts the turn to Glen, which returns the relevant slice of your org's memory as a dated context block, lines like [2026-06-01] The user prefers TypeScript.
4. The hook prints that block to stdout, and Codex injects it as context for the turn.

The CLI's exit code drives reconnection. 1 means no stored credentials, so the hook spawns glen login and your browser opens. 2 means the stored key was rejected (revoked, or you left the org), same flow. Anything else fails open: the hook exits silently and your prompt goes through untouched. Glen being unreachable costs you recall on that turn, nothing more.

Managing the connection

The Codex plugin has no slash commands; you manage the connection with the CLI directly:

glen status    # connected? which org?
glen login     # connect via the browser
glen logout    # remove the stored credential

The hook recognizes a logout request in the prompt text and skips ingesting that turn.

The glen-search skill

Relevant memory is already injected every turn, so most of the time the agent never needs to search. The skill exists for targeted lookups, the "search your memory for the auth decision we made" case, and teaches the agent to run:

glen search "<a specific search phrase>"

It returns the same dated context block format, or says plainly that nothing was found.

The glen-private-mode skill

When the user asks to go off the record ("don't remember this", "stop recording"), the skill teaches the agent to run:

glen private on   # `glen private off` resumes recording

While on, Glen's server refuses to record any turn — the hook keeps firing but nothing is saved — until it's turned back off. Recall and search keep working. The flag is per account, so it holds across sessions and agents until explicitly disabled.

How this relates to the Glen CLI

The plugin contains no API logic at all. Auth, ingest, search, and the browser connect flow live in @tryglen/cli, the glen binary, which is developed in the Glen monorepo and shared with the Claude Code plugin. The hook resolves the binary in order:

1. GLEN_CLI_PATH, an explicit path for local development
2. glen on your PATH
3. auto-install via npm install -g @tryglen/cli, falling back to the plugin's data directory if a global install is not permitted

Credentials are a single org-scoped API key at ~/.glen/credentials.json (mode 0600, location overridable with GLEN_CREDENTIALS_PATH). Because the CLI owns the key, one login covers Codex, Claude Code, and glen search from your shell. When a newer CLI version is published, the hook prints a one-line update notice with the exact command to run.

The manifest ships in both .codex-plugin/ and .claude-plugin/ form, so tooling that reads either location resolves the same plugin.

Local development

export GLEN_BASE_URL=http://localhost:3000    # point the CLI at a local Glen server
export GLEN_CLI_PATH=/path/to/glen            # use a locally built CLI binary

Privacy and failure behavior

While connected, every prompt you send in Codex is ingested into your org's Glen memory; that is the product. Disconnect with glen logout and ingestion stops immediately. Every failure mode is silent by design: no credentials, no network, no CLI on the machine, the hook never blocks or delays your prompt.

License

MIT