diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
index 914184b..774cdb4 100644
--- a/.github/workflows/shellcheck.yml
+++ b/.github/workflows/shellcheck.yml
@@ -16,3 +16,6 @@ jobs:
       - name: Run shellcheck
         run: |
           shellcheck -x install-agent-notify.sh agent-notify
+      - name: Run regression tests
+        run: |
+          bash tests/setup-codex.sh
diff --git a/agent-notify b/agent-notify
index 61c2fbe..6bbe233 100755
--- a/agent-notify
+++ b/agent-notify
@@ -161,13 +161,34 @@ HELP
     self="$(cd "$(dirname "$0")" && pwd)/$(basename "$0")"
     config_dir="$HOME/.codex"
     config_file="$config_dir/config.toml"
-    mkdir -p "$config_dir"
-    if [[ -f "$config_file" ]] && grep -q '^notify' "$config_file"; then
-      echo "Codex CLI: notify hook already configured in $config_file"
-    else
-      printf '\nnotify = ["%s"]\n' "$self" >> "$config_file"
-      echo "Codex CLI: added notify hook to $config_file"
+    if ! command -v python3 >/dev/null 2>&1; then
+      echo "agent-notify: error: python3 required for Codex CLI setup" >&2
+      exit 1
     fi
+    mkdir -p "$config_dir"
+    python3 - "$self" "$config_file" <<'PYSETUP'
+import pathlib
+import re
+import sys
+
+script_path = sys.argv[1]
+config_path = pathlib.Path(sys.argv[2])
+content = config_path.read_text() if config_path.exists() else ""
+
+before_first_table = True
+for line in content.splitlines():
+    stripped = line.lstrip()
+    if stripped.startswith("["):
+        before_first_table = False
+    if before_first_table and re.match(r"notify\s*=", stripped):
+        print(f"Codex CLI: notify hook already configured in {config_path}")
+        sys.exit(0)
+
+prefix = f'notify = ["{script_path}"]\n'
+new_content = prefix if not content else f"{prefix}\n{content}"
+config_path.write_text(new_content)
+print(f"Codex CLI: added notify hook to {config_path}")
+PYSETUP
     exit 0
     ;;
   --setup-claude)
diff --git a/tests/setup-codex.sh b/tests/setup-codex.sh
new file mode 100644
index 0000000..1394655
--- /dev/null
+++ b/tests/setup-codex.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+script="$repo_root/agent-notify"
+
+tmp_home="$(mktemp -d)"
+trap 'rm -rf "$tmp_home"' EXIT
+
+mkdir -p "$tmp_home/.codex"
+cat > "$tmp_home/.codex/config.toml" <<'EOF'
+model = "gpt-5.4"
+
+[tui]
+status_line = ["model"]
+EOF
+
+config_file="$tmp_home/.codex/config.toml"
+
+HOME="$tmp_home" "$script" --setup-codex >/dev/null
+
+python3 - "$config_file" "$script" <<'PY'
+import pathlib
+import sys
+import tomllib
+
+config_path = pathlib.Path(sys.argv[1])
+script_path = sys.argv[2]
+data = tomllib.loads(config_path.read_text())
+
+assert data["notify"] == [script_path], data
+assert data["tui"]["status_line"] == ["model"], data
+assert "notify" not in data["tui"], data
+PY
+
+HOME="$tmp_home" "$script" --setup-codex >/dev/null
+
+notify_count="$(grep -c '^notify = \[' "$config_file")"
+if [[ "$notify_count" != "1" ]]; then
+  echo "expected one top-level notify entry, found $notify_count" >&2
+  exit 1
+fi