Codex CLI 0.158.0-alpha.5

• [new] codex exec-server can authenticate incoming WebSocket connections. Choose a mode with --ws-auth (capability-token or signed-bearer-token), and configure tokens and JWT checks via --ws-token-file, --ws-token-sha256, --ws-shared-secret-file, --ws-issuer, --ws-audience, and --ws-max-clock-skew-seconds.
• [changed] Bash, fish, and zsh completions cover the new exec-server WebSocket auth flags and values.
• [removed] The exclude_slash_tmp config key is no longer recognized.

Under the hood

• Exec-server gains a relay protobuf path and richer wire/exec and filesystem-sandbox parameter models for remote execution.
• OpenTelemetry picks up agent-response handling, and OTEL/environment TOML config models carry additional fields.
• App-server adds feedback rollout-history request processing; the tools layer adds catalog-parameter support.
• Model-provider workspace routing is removed, along with a small set of unused data types and the event-listener-strategy dependency.
• Hook configuration, process identity, and related tool/trace payload shapes are tightened; sandbox network and session-id environment handling are adjusted in line with those internals.