Codex CLI 0.162.0-alpha.2

• [new] codex exec (including resume and fork) accepts --cyber-access-program to request an experimental Cyber access program for the turn: standard, daybreak_blue, or daybreak_red. OpenAI provider only; omit the flag to keep server defaults. Not supported with review, and fork still requires a prompt.
• [new] The TUI adds a /daybreak slash command for the same experimental Daybreak/Cyber programs.
• [new] codex tcp-tunnel accepts --diagnostics-json to emit credential-safe JSON diagnostics on stderr instead of human-readable errors.

Under the hood

• App-server daemon diagnostics and stderr logging, with feedback able to include daemon logs.
• Amazon Bedrock GovCloud requirements checks and region handling, plus workspace-aware model-provider routing.
• Guardian v2 configuration and retained-instruction handling.
• Shell snapshots in the exec server and snapshots in file search.
• TUI work for security setup, realtime audio settings, a transcript search footer, and web search in app-server sessions.
• Core session state handling and richer sandbox state.
• App-server updates for accounts and installed apps, thread queue/unarchive notifications, thread attachment owners, and filesystem helpers (open, canonicalize, metadata, byte-range reads, block writes).
• Exec-server network policy decisions, MCP tool and prompt hook handlers, and weekly scheduled tasks.
• Bash, fish, and zsh completions cover the new flags.

Upgrade notes

• --cyber-access-program is experimental and OpenAI-only. Leave it unset unless you mean to opt in; it is not supported with exec review, and exec fork still needs a prompt.
• --diagnostics-json is opt-in. When set, tcp-tunnel prints machine-readable diagnostics on stderr rather than human-readable errors.
• Refresh shell completions so the new flags complete correctly.