Codex

On 23 October 2026, Codex 0.164.0 began saving compaction summaries only after completion, resuming compressed histories and restoring saved thread settings.

Start with stable 0.164.0: npm install -g @openai/codex@0.164.0, then codex --no-daemon for a fixed interactive baseline. Prioritize recovery, permissions and plugin-hook checks during rollout.

Preview alpha.1 adds the marketplace repair and Google Cloud provider; the Windows helper and approval-policy repairs remain main-only. Avoid unauthenticated remote listeners and secret-bearing execution paths where unmasked fallback is unacceptable.

Where it stands, 2026-10-24

Channel. At the 24 October 2026 read, TypeScript is also 0.164.0, but Python remains 0.163.0; check SDKs separately. The newest published preview is 0.165.0-alpha.1. In stable, credential masking, ranked tool discovery in Code Mode and inheritance of client-defined dynamic tools by fresh V2 subagents remain off by default.

Keep a second boundary around marketplace installs. Stable 0.164.0 lacks alpha.1’s repair for URL forms that policy parsing and Git can interpret as different destinations. Constrain inputs and destinations separately until a stable tag contains the patch and passes rejection tests.

Check the bundled CLI when Windows resume fails. The desktop report names bundled CLI 0.163.0-alpha.11.2. The matching SystemRoot helper patch is main-only, absent from stable and alpha.1. Require a release containing the patch, then test resume on the affected desktop/bundled-CLI pair.

Test recovery before replacing a supervisor

For long coding runs, compare native resume with your current supervisor. Interrupt compaction, restart from a compressed history, and compare restored model, effort and permissions. Record completed jobs and human repair minutes. Retire recovery code only if completed work per hour of human attention improves. Check the outcome of interrupted external writes before retrying them.

Vercel’s 19 October description of its Codex adapter puts intent/outcome logging and replay outside the harness, with Vercel Sandbox required and built-in tools opt-in. That addresses a different layer from restoring conversation state. Include a process crash after an external write in the comparison before treating the approaches as substitutes.

Pin the runtime that does the work

Pin the process doing the work. Eligible interactive sessions use a shared background daemon whose package selection is independent of the CLI. Use codex --no-daemon for a fixed interactive baseline. Otherwise, disable automatic updates in CODEX_HOME/app-server-daemon/settings.json and restart; explicit updates can still select stable and interrupt work. Record CLI and daemon versions separately. Restart after changing credentials: the daemon keeps its startup environment.

Test saved network policy before enabling automatic updates. Codex 0.163.0 and the current stable enforce the updater’s loaded network policy and propagate configuration failures. Test blocked destinations and broken configuration. Invoking CLI overrides do not configure this updater; inspect its saved settings.

Check approval and isolation boundaries

Retest an approved command that asks for more authority. In 0.164.0, a prior approval from Guardian, Codex’s automatic reviewer, no longer exempts an escalated retry from fresh review. Test that review covers the retry’s authority when an approved command fails inside the sandbox and requests escalation.

Reinspect plugin-hook approvals. 0.164.0 binds hook trust to file contents as well as the declaration; changed contents require approval again. Older declaration-only approvals acquire their content baseline on first use. Inspect those files before migration, then test that a later edit stops the hook.

Credential masking is off by default; verify it after enabling. When enabled, masking covers supported remote Bash commands and Zsh snapshot sessions, but unsupported execution paths can warn and run with unmasked credentials. Inspect tool environments and fallback warnings before treating masking as secret isolation. Keep secrets off paths where that fallback is unacceptable.

Include runtime and sandbox integrations in the upgrade canary. 0.164.0 backports a V8 repair for invalid array-storage writes during sort, protects macOS repository metadata against case aliases and checks replaceable Linux helper paths and ancestors. Test case variants and replaceable paths on the relevant platform. Windows integrations must also pass the new installed-package identity requirement for sandbox provisioning; debug foreground mode retains an exception. Check unpackaged clients before rollout.

Keep clients ready for approvals after shell launch. Active matching grants can let terminal input reach review with granular sandbox prompts disabled; each input still needs review, while expired grants are rejected under that granular policy; Never’s early rejection has an exception when strict automatic review is active. Test input after grant expiry.

Govern automatic review through policy and sampled decisions. Guardian approval defaults on; the newer Guardian V2 and optional Decisions comparison remain off. Full Access skips the older model reviewer. Set managed review policy and sample opt-in, best-effort OTLP assessments, which exclude cached V2 approvals and cap rationale length. Before relying on complete audit coverage, require a tested export that accounts for cached decisions too.

Authenticate remote execution before exposure. exec-server still permits unauthenticated listeners; app-server rejects unauthenticated non-loopback WebSocket listeners. Verify the deployed listener’s authentication instead of assuming the other server’s rules apply.

Measure what native coordination replaces

Compare native delegation with context-copying glue. Eligible read-only calls can overlap, and full-history forks preserve their prefix by default, with a legacy-compaction exception. Before deleting your wrapper, measure accepted work, context volume and human repair time. Measure cache lifetime and quota cost separately.

Retest tool integrations with the new defaults. Tool catalogs sent incrementally to the model in Responses Lite and MCP OAuth credential renewal coordinated across clients now default on. Test catalog-history compatibility and multi-client credential renewal before retiring synchronization code. Within-turn MCP catalog refresh remains a separate default-off feature, mcp_tool_list_changed.

Clean up configuration before rollout

Remove obsolete configuration. Codex stopped bundling patched zsh and retired worktree/realtime feature switches. Remove those assumptions from templates and test shell snapshots and permissions on the supported path.

Confirm service access

Confirm account and model approval before planning cyber work. Both cli_daybreak and api_key_cyber_access_programs now default on in stable. Identity, organization, model and surface approvals remain separate.

Test the Google Cloud route in preview. Alpha.1 contains the gcp provider, while OpenAI’s 21 October 2026 announcement places general availability in coming weeks. Confirm service access before building against it.

What is unresolved

• The recovery benefit remains unmeasured. Settle whether native resume reduces human repair work with the recovery comparison.
• Check server defaults setting by setting. Stable defers unselected model/effort to the server, with explicit-profile exceptions. Reviewer precedence is repaired in alpha.1; approval-policy precedence is repaired only on main. Require stable tags and first-turn tests with overrides, profiles and queued prompts. Set model and effort explicitly for evaluations.
• Get a versioned provider commitment before embedding the daemon. Its lifecycle contract remains experimental. On a test machine, trace selected packages and interruption costs before embedding those lifecycle assumptions.
• Price optional API comparison separately. Current documentation says ChatGPT-authenticated auto-review checks are free and outside plan limits. Decisions comparison selects a separate API credential path. Provider terms and request-matched billing would establish its account and cost.