Alpha pre-release (0.154.0-alpha.8 → 0.154.0-alpha.11) focused on network-proxy credential brokering, Amazon Bedrock credential export, and shell/environment snapshot groundwork.
Changelog
[new] Amazon Bedrock can export credentials for use with the model provider, including STS-style credential output and related AWS auth configuration.
[changed] The network proxy credential broker is reworked around brokered tunnels, configured matching, a registry, and credential replacement instead of the previous per-provider layout.
[changed] Network proxy configuration is expanded (additional settings on the proxy config surface).
[new] Sandbox runs can disable network access via CODEX_SANDBOX_NETWORK_DISABLED.
[changed] Shell/environment snapshot handling for the network proxy is broadened (original, protected, replayed, and brokered env snapshots for bash/POSIX and related paths).
[changed] Realtime history presentation and executed-tool-call request metadata are refined on the agent/core side.
[removed] The exec JSONL event-processor path is dropped in favor of the remaining output pipelines.
[changed] TUI turn-runtime wiring is simplified (dedicated turn-runtime module removed).
Under the hood
Credential-broker internals move to a shared broker/tunnel model; dedicated GitHub and OpenAI provider modules under the old layout are gone as part of that reshape.
New config/data shapes land for analytics, experimental features, permission profiles, plugin share context, app/marketplace summaries, thread search, user-input tool requests, and agent interrupt/resume args—mostly wiring for upcoming or in-progress surfaces.
Model-provider AWS auth info grows an extra field to match the Bedrock export path; rand_regex is added as a dependency.
Additional snapshot and proxy-related environment hooks support brokered and protected env capture/replay during proxied runs.
Minor event renames and error paths (client message results, spawn/output failures, TUI suspend failures, MITM hook denial) tighten runtime signaling.
Upgrade notes
If you maintain custom network-proxy or credential-broker integration, recheck config against the expanded proxy settings and the brokered-tunnel flow; provider-specific broker modules are no longer laid out the old way.
Bedrock users who want exported/STS credentials should confirm AWS auth configuration after upgrading.
Exec consumers that depended on the removed JSONL event-processor path should use the supported output/event APIs instead.
content/
Browse captured content/
Same tree as codex-cli/latest/content for this version. Open the full browser for sidebar navigation between docs and other files.
