Alpha prerelease 0.151.0-alpha.4 — small incremental build with trusted/verified access groundwork, richer turn and token-usage modeling, and a few config/model cleanups.
Changelog
[new] Trusted/verified access grants and programs, including verified-access response handling for tighter control over what the agent is allowed to do.
[new] Guardian warning notifications so safety or policy warnings can be surfaced in-session.
[new] Goals configuration support (GoalsToml) for declaring goal-oriented settings.
[new] o1 added to the known model identifiers.
[new] Token usage profiles with daily buckets for more structured usage tracking over time.
[changed] Turn start handling is richer (expanded turn-start parameters, assistant-turn and turn tool-output shapes) so turns carry more context into execution.
[changed] Function call outputs are modeled as first-class thread items rather than only generic tool summaries.
[changed] Collaboration sessions emit a waiting-end signal when a collab wait completes.
[removed] The exclude_slash_tmp config key is no longer supported.
Under the hood
New MCP trusted-access plumbing (verified access grants/programs and related response types) lays groundwork for access-checked tool and session behavior.
Apply-patch can optionally preserve line endings via CODEX_APPLY_PATCH_PRESERVE_LINE_ENDINGS.
Exec-server lifecycle and escalation hooks expand slightly (CODEX_EXEC_SERVER_EXIT_ON_STDIN_CLOSE, escalate socket message handling) for cleaner CI and embedded-server use.
Cloud-tasks and CI-oriented environment flags were reshaped (including CODEX_CI / internal cloud-tasks forcing); older CIWS-proxy and home-directory override knobs were dropped.
Feedback upload responses, proxy route specs, rollout line typing, and list/argument payloads were tightened in the data model.
Marketplace plugin source handling prefers git subdirectory specs over a looser local/url shape.
Scheduled-task schedules gain an explicit daily variant, including waiting-on-approval / waiting-on-user-input states.
Internal TUI and remote-session code paths were slimmed (token chart palette and turn-runtime helpers folded or removed; remote session command driver simplified).
Upgrade notes
If you still set exclude_slash_tmp in config, remove it; the key is no longer recognized.
Review any scripts or wrappers that depended on removed environment variables such as CODEX_CIWS_PROXY, CODEX_HOMED, or CODEX_SANDBOX_NETWORK_DISABLED, and switch to the current CI/cloud-tasks and sandbox controls.
content/
Browse captured content/
Same tree as codex-cli/latest/content for this version. Open the full browser for sidebar navigation between docs and other files.
