Alpha patch release: drops the untrusted approval-policy option, trims a few login/sandbox knobs, and lands internal work on exec isolation, TUI session start, and related config.
Changelog
[removed] The untrusted value is no longer offered for --ask-for-approval / -a. Completions for bash, fish, and zsh now only complete on-request and never.
[removed] Amazon Bedrock is no longer available as a login-account path; ChatGPT auth-token login remains.
[removed] The CODEX_SANDBOX_NETWORK_DISABLED environment variable is gone.
[changed] Shell completions are updated in line with the approval-policy change above.
[new] Optional control to preserve original line endings when applying patches (CODEX_APPLY_PATCH_PRESERVE_LINE_ENDINGS).
[new] TUI support around session start and an unarchive prompt when opening archived content.
[changed] Hook configuration recognizes a prompt-hooks handler path in place of the previous command/prompt hook variants.
[changed] Editor/TUI input gains a delete-to-line-end action; the old TUI suspend-failed path is cleaned up.
[changed] Guardian v2 and filesystem tool parameter models are extended (metadata, create/remove/write paths, and related review-scope settings).
[changed] Stored OAuth token shape and related thread/app read responses are updated for current session and apps APIs.
Under the hood
Exec-server gains a no-follow path mode so filesystem access can avoid following symlinks where that matters for isolation.
Git trust helpers land in git-utils for clearer trust evaluation of repositories.
MCP protocol version can be set via CODEX_MCP_PROTOCOL_VERSION; escalate-socket and exec-server account-id env wiring are adjusted.
OpenTelemetry exporter and host/client handshake enums are refined (including version-compatibility rejection).
Skill dependency metadata and npm package version info are modeled for upcoming skill/package flows.
Vim normal-mode keymap configuration is expanded; background-terminal thread state is represented explicitly.
Dependencies add wildmatch and color_quant for matching and image-related paths.
Thread event handling in the TUI is reorganized (session-start focused modules replace the older thread-events module).
Upgrade notes
If you still pass -a untrusted / --ask-for-approval untrusted, switch to on-request or never.
Drop any use of CODEX_SANDBOX_NETWORK_DISABLED; configure sandbox/network behavior through the supported options instead.
Anything integrating Amazon Bedrock login through Codex’s account params needs another auth path.
content/
Browse captured content/
Same tree as codex-cli/latest/content for this version. Open the full browser for sidebar navigation between docs and other files.
