Exec and Automation

Permission and execution changes in 0.163.0

Daybreak defaults on for eligible accounts, superseding the 0.161.0 opt-in guidance below. API-key authenticated codex exec can select a program when the server grants access. Resume restores saved permissions and network approvals while respecting explicit overrides and current managed policy.

/config searches settings, applies supported items live, and indicates changes needing a restart. Follow-up input now steers an active response immediately by default; interrupting a turn also stops Code Mode cells and nested tools. Independent read-only lookups can run in parallel. Patched zsh is no longer bundled and retired shell flags produce migration guidance.

0.163.0 release.

Automation checks for 0.161.0–0.162.1

• Cyber access program selection: 0.161.0 adds codex exec --cyber-access-program to select a Cyber access program per turn. According to the pull-request description the values are standard, daybreak_blue, and daybreak_red, and the flag is rejected for review and for forks without a prompt. The TypeScript SDK exposes the same choice as the cyberAccessProgram option. Automatic Daybreak selection in codex exec runs only when features.cli_daybreak is enabled, but this explicit override works with cli_daybreak disabled and leaves the saved choice unchanged. See Config for the setting.
• Retries and fallback: Responses retries and the WebSocket-to-HTTP fallback honor server retry guidance (0.161.0), and retryable Responses and WebSocket failures honor the server's Retry-After (0.162.0). Premature failures during overload drop, but waits can grow, so re-check CI job timeouts.
• Patch line endings: apply_patch updates preserve existing CRLF line endings without an opt-in (0.162.0). Check whether post-processing that filtered line-ending diffs in CRLF repositories is still needed.
• Code Mode: adds JavaScript helpers that stream promise results as they settle, plus opt-in ranked tool search (0.162.0).
• Sandbox and Windows: the Linux sandbox starts with multiple denied files, rejects writable sandbox-construction executables, and keeps ripgrep configuration from weakening deny-glob masks (0.162.0). Ordinary drive-letter file access is restored on Windows 10 (0.162.0), and elevated Windows terminal sessions can start using an embedded server (0.161.0).
• Resume and storage: thread resume includes the latest committed history. Startup detects recoverable SQLite corruption earlier and keeps damaged databases as backups (0.161.0).
• Background server: 0.162.1 fixes startup failures caused by differences between a running background server's feature settings and CLI defaults. Compatibility checks now apply only to explicit command-line feature overrides.

GitHub Releases · 2026-10-10 KST

Automation checks for 0.158.0–0.160.1

• Default model change: non-interactive runs with an unset model use GPT-6.1 Sol from CLI 0.159.1 (GPT-6 Astra through 0.159.0). Upgrading the CLI in CI also changes the model, so name it explicitly, for example codex exec -m gpt-6.1-sol "...".
• Terminal input approval: from 0.158.0, approval for sending terminal input to commands running with elevated permissions is on by default. Check how pipelines that run commands needing interactive input behave under your current approval_policy.
• Command events: command completion events now include early output and report process-launch failures to clients (0.158.0). Confirm that scripts parsing JSONL handle launch-failure events.
• exec-server and app-server: direct exec-server WebSocket connections can be protected with bearer tokens (0.158.0), and app-server clients can paginate thread history from a specific item (0.159.0).
• Sandbox: .aws under writable roots is a default protected path (0.159.0). Check whether automation that writes AWS configuration files needs an explicit rule.
• Windows: MCP servers, code-mode hosts, and background processes no longer open console windows (0.159.0–0.159.2), and remote stdio MCP servers keep SYSTEMROOT, TEMP, and TMP (0.160.1).

official changelog · 2026-10-07 KST

Automation checks for 0.155.0–0.157.1

• Version alignment: since 0.155.0 the Python SDK and runtime publish with the same version as the stable CLI, and runtime assets are verified before SDK publication. Pin CLI and SDK to the same version in CI.
• Pin the model: non-interactive runs should name a model, for example codex exec -m gpt-6-sol "...". In these releases an unset model used the bundled GPT-6 Astra default (GPT-6.1 Sol from 0.159.1), and gpt-5.5 on the ChatGPT-sign-in path retires on 2026-10-14.
• Network policy: from 0.157.0, network restrictions apply across redirects and to ongoing HTTP and WebSocket traffic, and connections are cancelled when a policy change revokes access. Re-check allowlists for downloads and searches that follow redirects. Standalone web search and realtime connections honor configured proxies.
• Uploads: the file-upload timeout grows from 60 seconds to five minutes, with retries for transient failures (0.157.0).

official changelog · 2026-09-26 KST

Python SDK 0.154.0 compatibility

The September 10 SDK release uses Python 3.10+ and a matching CLI runtime. ExternalMessage carries tool-level external content, not user authorization. include_turns changes returned history, not model context. Access HookMetadata through .root, such as hook.root.command, after checking the handler type. Late-attached turn handles do not replay earlier events; use thread.read(include_turns=True) for saved history. Custom codex_bin overrides need CLI 0.151.0+ for the new history/turn options.

official changelog · 2026-09-12 KST

Key takeaways

• Since 0.143.0, codex remote-control pair generates a manual pairing code for a running daemon, and Codex can route authentication and Responses traffic through macOS/Windows system proxies including PAC/WPAD.

• Use codex exec when a task is repeatable, scoped, and should produce structured evidence: dependency audits, doc checks, refactor plans, CI helpers, and batch reviews.

• Keep prompts deterministic, pin model, permissions, and working directory, and prefer JSON or line-oriented output when scripts consume the result.

• Log query time, sources, and network policy whenever automation depends on code-mode web search for fresh evidence.

• Pin --cd and artifact directories for image flows, and validate app-server v2 clients with a smoke test like codex debug app-server send-message-v2 --help.

• Never let exec make production-impacting changes automatically, and verify cloud exec provider behavior separately from local codex exec.

Interactive Codex is useful for exploration. exec is useful when the task is repeatable, scoped, and should produce structured evidence.

Good Exec Use Cases

Automation Rules

• Codex 0.147.0 removes deprecated codex exec --full-auto; select an explicit sandbox such as --sandbox workspace-write and keep approval policy in config or requirements.

• Codex 0.148.0 adds codex exec fork for a non-interactive branch of an existing thread. Record the fork's output, approval state, and working directory as separate artifacts.

• Keep prompts deterministic and scoped.

• Pin model, permissions, and working directory where practical.

• Prefer JSON or line-oriented output when consumed by scripts.

• Fail clearly when required context is missing.

• Archive outputs that support later review.

Current CLI Notes

• Code mode can call standalone web search directly, including from nested JavaScript tool calls. Automation that depends on fresh web evidence should log query time, sources, and network policy.
• codex exec --image and app/CLI image attachment flows now expose saved local file paths more reliably, so screenshot-based automation should pin --cd and artifact directories.
• App-server integrations can read account token usage, and CLI/app-server auth supports ChatGPT v2 personal access tokens.
• Include codex debug app-server send-message-v2 --help or an equivalent smoke test when validating internal app-server v2 clients.
• Plugin automation should consume codex plugin add/remove --json, codex plugin list --available --json, and marketplace JSON outputs for audit logs.
• Cloud exec provider behavior should be verified separately from local codex exec; do not assume identical permissions or environment requirements.

Anti-Patterns

• Running broad write tasks without an owner.
• Letting exec make production-impacting changes automatically.
• Treating generated summaries as verification without tests or diffs.