1
00:00:00,000 --> 00:00:00,680
Morning.

2
00:00:00,727 --> 00:00:04,800
Quick thanks to Jellypod for helping make
this daily show a reality.

3
00:00:04,853 --> 00:00:09,920
Today's change is small to type and useful
if you work with MCP servers.

4
00:00:10,140 --> 00:00:16,960
Codex CLI 0.161.0 shipped on October 7,
and it

5
00:00:17,024 --> 00:00:22,480
adds a slash command: /mcp login, followed
by the server name.

6
00:00:22,840 --> 00:00:27,200
The release notes say you can sign in to
MCP servers from an active terminal

7
00:00:27,300 --> 00:00:27,680
session.

8
00:00:27,900 --> 00:00:32,400
So instead of handling authentication
somewhere else, you do it from inside the

9
00:00:32,440 --> 00:00:33,560
session you're already in.

10
00:00:34,020 --> 00:00:39,400
For example, /mcp login and then the name
of a server you've configured.

11
00:00:40,040 --> 00:00:43,900
I'd use the exact name from your config,
since that's what the command takes.

12
00:00:44,208 --> 00:00:47,328
The enterprise side of the release
explains why this matters.

13
00:00:47,448 --> 00:00:52,368
The changelog lists several pull requests
around enterprise MCP auth.

14
00:00:52,548 --> 00:00:58,448
One restricts enterprise MCP
authentication and makes it fail closed when the config

15
00:00:58,508 --> 00:00:59,248
refreshes.

16
00:00:59,368 --> 00:01:04,608
Another enables enterprise sign in and
adds account scoped grant cleanup.

17
00:01:04,968 --> 00:01:11,488
A third discovers and validates MCP
authorization servers before the token exchange.

18
00:01:11,760 --> 00:01:12,540
Let me translate.

19
00:01:13,100 --> 00:01:18,100
Fail closed means if the config refresh
goes wrong, you get a refusal instead of a

20
00:01:18,180 --> 00:01:19,060
quiet fallback.

21
00:01:19,760 --> 00:01:23,100
Account scoped grant cleanup means grants
are tied to the account,

22
00:01:23,320 --> 00:01:24,980
so they get cleaned up per account.

23
00:01:25,740 --> 00:01:30,280
Validating the authorization server first
means Codex checks where it's sending you

24
00:01:30,320 --> 00:01:31,680
before the exchange happens.

25
00:01:32,500 --> 00:01:35,720
Those are the release's titles, and the
details sit in the pull requests,

26
00:01:36,020 --> 00:01:38,440
so read them before you rely on specifics.

27
00:01:38,750 --> 00:01:41,710
One more related change is about
documentation.

28
00:01:41,811 --> 00:01:47,150
Authentication guidance now accounts for
keyring storage, instead of implying your

29
00:01:47,197 --> 00:01:50,190
credentials always live in auth.json.

30
00:01:50,430 --> 00:01:55,470
If you audit where secrets sit on
developer machines, check that your assumptions

31
00:01:55,537 --> 00:01:56,030
match.

32
00:01:56,282 --> 00:01:57,642
Practical caveat, then.

33
00:01:58,122 --> 00:02:01,782
This is a terminal session command, so it
assumes you're in the interactive

34
00:02:01,842 --> 00:02:02,282
interface.

35
00:02:02,862 --> 00:02:06,982
And the enterprise hardening is aimed at
managed setups, so behavior may differ

36
00:02:07,022 --> 00:02:09,122
depending on your organization's
configuration.

37
00:02:09,962 --> 00:02:11,162
Now the smaller items.

38
00:02:11,942 --> 00:02:16,822
Approved filesystem escalation can grant
broader write access while preserving

39
00:02:16,862 --> 00:02:18,782
denied reads and network restrictions.

40
00:02:19,462 --> 00:02:22,882
Background tasks also keep the permissions
of the turn that started them.

41
00:02:23,462 --> 00:02:25,662
If you run long background work, that's
worth knowing.

42
00:02:25,958 --> 00:02:27,558
Daybreak is now opt in.

43
00:02:27,698 --> 00:02:33,478
You enable it with the enable flag naming
cli_daybreak, or set

44
00:02:33,549 --> 00:02:37,558
features.cli_daybreak to true in config.

45
00:02:37,688 --> 00:02:40,758
Setting daybreak to true alone is not
enough.

46
00:02:40,858 --> 00:02:45,878
Without it, the controls are hidden and
the slash daybreak command is unavailable.

47
00:02:46,025 --> 00:02:52,758
Separately, codex exec has a cyber access
program flag, and the TypeScript SDK has a

48
00:02:52,851 --> 00:02:56,918
cyberAccessProgram option, for choosing a
program per turn.

49
00:02:57,318 --> 00:02:59,358
A few quality of life fixes too.

50
00:02:59,838 --> 00:03:02,538
Voice conversations let you choose your
microphone, speaker,

51
00:03:02,658 --> 00:03:04,698
and input channels, saved locally.

52
00:03:05,498 --> 00:03:09,118
Enter now submits buffered input after
paste detection expires,

53
00:03:09,498 --> 00:03:11,798
including in Vim insert mode.

54
00:03:12,298 --> 00:03:17,058
And startup detects recoverable SQLite
corruption earlier and keeps the damaged

55
00:03:17,098 --> 00:03:18,158
database as a backup.

56
00:03:18,500 --> 00:03:25,140
Also, GPT 6.1 Sol is now the default model
in the bundled and Amazon Bedrock

57
00:03:25,211 --> 00:03:25,860
catalogs.

58
00:03:26,073 --> 00:03:30,260
If you pin models in scripts, check what
your defaults resolve to.

59
00:03:30,386 --> 00:03:36,820
Update to 0.161.0, run /mcp login on one

60
00:03:36,877 --> 00:03:38,820
server, and see how it goes.