1 00:00:00,110 --> 00:00:03,420 So, I was updating some of our local dev tooling yesterday, 2 00:00:04,040 --> 00:00:10,760 and I- I noticed Codex CLI quiet- quietly pushed version 0.143.0 3 00:00:10,860 --> 00:00:11,100 out. 4 00:00:11,780 --> 00:00:15,540 And, uh, there's a pretty massive architectural shift in how they're handling 5 00:00:15,580 --> 00:00:16,230 plugins now. 6 00:00:16,920 --> 00:00:22,380 By default, it's now pulling remote plugins directly from the npm marketplace. 7 00:00:22,420 --> 00:00:24,680 It just, you know, auto-resolves them. 8 00:00:27,623 --> 00:00:27,624 Wait, wait, wait. 9 00:00:27,623 --> 00:00:28,253 It pulls them by default? 10 00:00:28,823 --> 00:00:31,293 Like, without an explicit opt-in first? 11 00:00:31,933 --> 00:00:33,643 Because npm is... 12 00:00:33,713 --> 00:00:38,803 I mean, we've all seen the typosquatting and dependency confusion attacks on there. 13 00:00:38,833 --> 00:00:43,253 That sounds like a massive supply chain risk out of the box. 14 00:00:43,314 --> 00:00:44,094 Yeah, it is. 15 00:00:44,134 --> 00:00:50,594 They- they do show this really nice, clean, rich local versus remote versioning 16 00:00:50,614 --> 00:00:54,974 comparison right in the terminal now, which is, uh, helpful for debugging. 17 00:00:55,634 --> 00:00:59,674 But the underlying reality is that if you run a command that triggers a plugin you 18 00:00:59,734 --> 00:01:02,854 don't have locally, it's gonna go fetch it. 19 00:01:02,954 --> 00:01:07,414 Huge thanks to Jellypod, by the way, for helping us get this daily analysis out to 20 00:01:07,474 --> 00:01:07,894 everyone. 21 00:01:08,574 --> 00:01:12,054 But, yeah, if you're in an enterprise environment with strict compliance, 22 00:01:12,694 --> 00:01:17,394 this default-on remote plugin behavior is probably going to trigger some security 23 00:01:17,454 --> 00:01:17,854 alarms. 24 00:01:18,953 --> 00:01:20,073 Oh, absolutely. 25 00:01:20,643 --> 00:01:24,693 If I'm an IT auditor, I'm- I'm losing my mind over this. 26 00:01:25,223 --> 00:01:30,003 You can't just have dev machines pulling arbitrary execution code from public 27 00:01:30,123 --> 00:01:31,523 registries at runtime. 28 00:01:32,223 --> 00:01:35,183 Is there an easy way to, like, lock this down? 29 00:01:35,563 --> 00:01:36,703 Like a- a kill switch? 30 00:01:37,512 --> 00:01:37,952 There is. 31 00:01:38,472 --> 00:01:39,602 Actually, two ways. 32 00:01:40,292 --> 00:01:43,312 If you're just running one-off commands and you want to be safe, 33 00:01:43,832 --> 00:01:47,272 you can pass the --safe-mode flag. 34 00:01:47,332 --> 00:01:51,032 That completely blocks any remote plugin resolution. 35 00:01:51,072 --> 00:01:54,142 But if you want to set a permanent policy for your project, 36 00:01:54,632 --> 00:02:00,822 you'll want to drop into your local .codex/config.toml file and set the 37 00:02:00,892 --> 00:02:02,712 remote_plugins key to false. 38 00:02:04,101 --> 00:02:10,651 Okay, so setting remote_plugins to false in .codex/config.toml is 39 00:02:10,690 --> 00:02:13,531 basically the corporate compliance team's best friend here. 40 00:02:14,071 --> 00:02:19,011 It's good they gave us the config file override, but I still- I still really don't 41 00:02:19,271 --> 00:02:21,570 love that they made "on" the default. 42 00:02:22,131 --> 00:02:26,451 It feels like they prioritized a seamless hobbyist experience over enterprise 43 00:02:26,461 --> 00:02:26,861 safety. 44 00:02:27,695 --> 00:02:29,655 It's a classic product tension, right? 45 00:02:30,375 --> 00:02:33,885 Frictionless onboarding versus zero-trust security. 46 00:02:34,595 --> 00:02:38,515 But at least the fix is a simple, single line in a config file. 47 00:02:39,447 --> 00:02:43,837 Now, speaking of corporate environments, did they do anything to address the 48 00:02:43,877 --> 00:02:46,417 nightmare of enterprise firewalls? 49 00:02:46,457 --> 00:02:51,457 Because normally, when you lock down outbound traffic, these developer CLI tools 50 00:02:51,477 --> 00:02:53,597 just break catastrophically. 51 00:02:54,577 --> 00:02:57,837 Actually, yes, and this is a huge win. 52 00:02:58,437 --> 00:03:05,177 Version 0.143.0 now natively respects system proxy settings on 53 00:03:05,217 --> 00:03:07,117 both macOS and Windows. 54 00:03:07,647 --> 00:03:12,377 And I'm not just talking about reading the standard HTTP_PROXY environment 55 00:03:12,397 --> 00:03:12,597 variables. 56 00:03:13,137 --> 00:03:18,437 It actually integrates with PAC-- proxy auto-config-- and WPAD, 57 00:03:18,817 --> 00:03:21,357 the Web Proxy Auto-Discovery protocol. 58 00:03:22,151 --> 00:03:22,880 Oh, wow. 59 00:03:23,300 --> 00:03:26,940 PAC and WPAD support is actually a big deal. 60 00:03:27,600 --> 00:03:32,680 Usually, you have to manually parse those files or feed the proxy IP directly into 61 00:03:32,720 --> 00:03:33,160 the tool. 62 00:03:33,800 --> 00:03:38,400 If it's routing Auth and Responses API traffic natively through the system proxy... 63 00:03:38,980 --> 00:03:41,780 that- that genuinely saves a lot of setup headache. 64 00:03:42,546 --> 00:03:42,755 Right. 65 00:03:43,086 --> 00:03:44,676 It just works behind the firewall now. 66 00:03:45,276 --> 00:03:49,866 And speaking of API traffic, they also expanded their LLM integrations. 67 00:03:50,506 --> 00:03:54,386 Remember back in July when we talked about how they were bringing Bedrock into the 68 00:03:54,426 --> 00:03:54,696 mix? 69 00:03:55,506 --> 00:04:00,366 Well, this update officially adds first-class support for the new Amazon Bedrock 70 00:04:00,566 --> 00:04:04,806 GPT-5.6 Sol, Terra, and Luna models. 71 00:04:06,395 --> 00:04:08,565 Ah, the Sol, Terra, and Luna models. 72 00:04:09,025 --> 00:04:13,085 And these actually expose the "max reasoning effort" controls, 73 00:04:13,145 --> 00:04:13,705 right? 74 00:04:13,745 --> 00:04:16,875 For those deep-thinking, multi-step planning tasks. 75 00:04:17,764 --> 00:04:18,384 Exactly. 76 00:04:18,944 --> 00:04:22,624 You can set the reasoning effort directly in your requests now, 77 00:04:22,664 --> 00:04:27,304 so the model knows how much compute to burn on a complex planning path before 78 00:04:27,344 --> 00:04:28,444 returning the response. 79 00:04:29,104 --> 00:04:31,484 It's fully native in the Codex config now. 80 00:04:33,008 --> 00:04:34,058 Perfect. 81 00:04:34,118 --> 00:04:36,478 And I saw there were some terminal fixes too? 82 00:04:36,978 --> 00:04:40,998 Because Windows users always seem to get the short end of the stick with interactive 83 00:04:41,098 --> 00:04:41,978 CLI tools. 84 00:04:43,307 --> 00:04:44,327 Yeah, they do. 85 00:04:44,747 --> 00:04:49,047 But they finally fixed the ConPTY terminal input bug on Windows. 86 00:04:49,607 --> 00:04:53,707 It used to drop characters or choke on certain key sequences during interactive 87 00:04:53,787 --> 00:04:55,827 sessions, but that's resolved. 88 00:04:56,447 --> 00:05:00,187 Plus, they added a new command: codex remote-control pair. 89 00:05:00,867 --> 00:05:04,967 It lets you manually pair the background daemon if the auto-discovery fails. 90 00:05:07,613 --> 00:05:07,614 Nice. 91 00:05:07,613 --> 00:05:11,123 Sounds like a really solid utility release, even with the security caveat. 92 00:05:11,743 --> 00:05:16,803 Well, that's our quick look at Codex CLI 0.143.0. 93 00:05:17,243 --> 00:05:17,963 Good chatting, Ethan. 94 00:05:18,762 --> 00:05:20,352 Yeah, catch you tomorrow, Maya.