1
00:00:00,000 --> 00:00:04,400
So, Maya, thanks to Jellypod to help make
this daily show a reality.

2
00:00:04,480 --> 00:00:09,368
I spent about three hours yesterday
tearing my hair out over an OAuth loop with a

3
00:00:09,421 --> 00:00:15,128
local MCP server, and it turns out, uh,
it's a known architectural headache that

4
00:00:15,208 --> 00:00:19,768
Codex finally addressed in v0.144.0.

5
00:00:19,908 --> 00:00:25,288
You know how when you start a local auth
flow, the OS usually just grabs whatever

6
00:00:25,368 --> 00:00:28,568
random, dynamic port is free to handle the
callback?

7
00:00:29,241 --> 00:00:29,861
Oh, yeah.

8
00:00:29,881 --> 00:00:32,161
The classic port lottery.

9
00:00:32,701 --> 00:00:37,481
It's totally fine for a local script, but
the second you try to register that with

10
00:00:37,521 --> 00:00:42,301
GitHub or Google API consoles, they, like,
completely block it.

11
00:00:42,341 --> 00:00:45,521
They demand a strict, static callback URI.

12
00:00:46,651 --> 00:00:47,118
Exactly.

13
00:00:47,188 --> 00:00:51,798
You can't just put a wildcard port in your
OAuth application settings for security

14
00:00:51,858 --> 00:00:52,918
reasons.

15
00:00:52,945 --> 00:00:59,558
So, if your local MCP client spins up on
port, say, 59231 one

16
00:00:59,658 --> 00:01:06,438
run and 61004 the next, the provider
throws a redirect URI mismatch

17
00:01:06,518 --> 00:01:08,198
error and kills the flow.

18
00:01:08,398 --> 00:01:15,078
But in 0.144.0, they introduced a
dedicated configuration parameter in

19
00:01:15,278 --> 00:01:21,638
.codex/config.toml called
mcp_oauth_callback_port.

20
00:01:21,944 --> 00:01:22,924
Oh, nice.

21
00:01:23,344 --> 00:01:25,105
So you can actually pin it down now?

22
00:01:25,204 --> 00:01:27,424
How does that look in the config file?

23
00:01:27,750 --> 00:01:28,390
It's simple.

24
00:01:28,530 --> 00:01:35,510
You just open your .codex/config.toml and,
under your MCP configuration

25
00:01:35,570 --> 00:01:42,043
section, you add mcp_oauth_callback_port =

26
00:01:42,177 --> 00:01:45,830
8000-or, you know, whatever port you want
to dedicate.

27
00:01:45,990 --> 00:01:51,190
That way, you can go to your GitHub
developer settings, register a static redirect

28
00:01:51,330 --> 00:01:52,150
URI like

29
00:01:52,390 --> 00:01:59,270
http://localhost:8000/callback, and it

30
00:01:59,323 --> 00:02:01,110
works every single time.

31
00:02:01,323 --> 00:02:03,510
No more dynamic port roulette.

32
00:02:03,840 --> 00:02:05,619
That makes so much sense.

33
00:02:06,359 --> 00:02:11,760
But, wait, what happens if you're running
this in, say, a remote container or a

34
00:02:11,800 --> 00:02:14,939
headless environment like GitHub
Codespaces?

35
00:02:14,979 --> 00:02:19,899
Because if Codex spins up localhost:8000
inside a VM in the cloud,

36
00:02:20,359 --> 00:02:22,920
and my browser is running on my local
machine...

37
00:02:23,539 --> 00:02:25,639
well, "This site can't be reached."

38
00:02:26,039 --> 00:02:28,239
The redirect completely stalls.

39
00:02:28,612 --> 00:02:29,332
Right!

40
00:02:29,396 --> 00:02:32,092
That's the headless authentication
problem.

41
00:02:32,182 --> 00:02:37,892
And the way they solved this in 0.144.0 is
honestly pretty elegant.

42
00:02:38,036 --> 00:02:44,692
They set up a hosted redirect loopback
mechanism using PKCE-that's Proof Key for

43
00:02:44,740 --> 00:02:45,652
Code Exchange.

44
00:02:45,762 --> 00:02:49,892
Instead of relying on a local web server
to capture the redirect,

45
00:02:49,952 --> 00:02:54,052
Codex routes the final step through a
secure hosted page, like

46
00:02:54,162 --> 00:02:58,772
console.openai.com/cli/callback.

47
00:02:59,231 --> 00:03:04,272
Wait, so how does the local terminal find
out that I successfully logged in on that

48
00:03:04,311 --> 00:03:06,851
webpage if there's no direct connection?

49
00:03:07,167 --> 00:03:12,367
Ah, the hosted page generates a short,
single-use verification code once you

50
00:03:12,422 --> 00:03:13,167
authenticate.

51
00:03:13,307 --> 00:03:16,607
The terminal UI halts and prompts you with
a message.

52
00:03:16,727 --> 00:03:21,807
You just copy that code from the webpage,
paste it back into your terminal prompt,

53
00:03:21,847 --> 00:03:26,047
and the PKCE handshake completes the
exchange securely.

54
00:03:26,234 --> 00:03:31,567
It completely bypasses the need for
local-to-remote network tunneling just to sign

55
00:03:31,647 --> 00:03:31,887
in.

56
00:03:32,274 --> 00:03:36,314
Okay, that is a massive lifesaver for
cloud IDEs.

57
00:03:36,894 --> 00:03:39,614
But speaking of pasting things into the
terminal...

58
00:03:40,034 --> 00:03:43,954
I saw there was a massive patch release
cycle right after this.

59
00:03:44,375 --> 00:03:50,475
Like, v0.144.1, .2, and .3 came out in
rapid succession.

60
00:03:51,074 --> 00:03:52,034
What was going on there?

61
00:03:52,861 --> 00:03:54,493
Yeah, the post-release cleanup.

62
00:03:54,680 --> 00:04:01,533
So, in 0.144.1, they ran into a nasty
macOS bug-issue

63
00:04:01,579 --> 00:04:03,933
number 32447.

64
00:04:04,053 --> 00:04:10,893
Basically, the bundled node_repl MCP
client started failing immediately on startup

65
00:04:10,925 --> 00:04:15,213
with an "os error 2," which is just "file
not found."

66
00:04:15,480 --> 00:04:21,133
It turned out the runtime path lookup for
Node was failing if Node wasn't globally

67
00:04:21,213 --> 00:04:23,373
symlinked in a very specific way.

68
00:04:23,613 --> 00:04:28,333
If you run into that, you have to verify
your PATH or manually point to your Node

69
00:04:28,413 --> 00:04:28,973
binary.

70
00:04:30,117 --> 00:04:32,397
Classic path resolution issues.

71
00:04:33,017 --> 00:04:37,958
And didn't Windows devs get hit by
something weird in 0.144.3 too?

72
00:04:38,605 --> 00:04:41,373
Yes, issue 32974.

73
00:04:41,453 --> 00:04:46,173
Under Windows 11, if you were running
heavy, multi-step goals with concurrent

74
00:04:46,333 --> 00:04:52,253
"PostToolUse" hooks, the CLI would
sometimes silently crash and drop you straight

75
00:04:52,285 --> 00:04:56,173
back to the PowerShell prompt without
throwing an actual error stack.

76
00:04:56,301 --> 00:04:59,453
They patched that concurrency leak in .3.

77
00:04:59,720 --> 00:05:05,213
Oh, and they also had to do a rollback in
0.144.2-issue

78
00:05:05,373 --> 00:05:06,893
32672.

79
00:05:07,774 --> 00:05:08,714
Wait, what did they roll back?

80
00:05:09,125 --> 00:05:12,725
They restored the previous Guardian
auto-review prompting behavior.

81
00:05:12,938 --> 00:05:17,845
If you remember from yesterday's episode,
the new strict checks were aggressively

82
00:05:17,907 --> 00:05:22,085
blocking git pushes, so they backed that
out to keep developers from getting

83
00:05:22,136 --> 00:05:25,285
completely blocked while they refine the
heuristics.

84
00:05:26,471 --> 00:05:31,131
Yeah, blocking git pushes is a quick way
to get developers angry.

85
00:05:31,591 --> 00:05:33,171
I'm glad they walked that back quickly.

86
00:05:33,811 --> 00:05:35,671
What about the general user interface?

87
00:05:35,691 --> 00:05:38,531
Any nice quality of life tweaks in this
batch?

88
00:05:38,792 --> 00:05:40,312
A few really nice ones.

89
00:05:40,445 --> 00:05:45,152
First, they added paste sanitization to
the terminal UI.

90
00:05:45,272 --> 00:05:50,952
It strips out raw control sequences if you
copy-paste code snippets that contain

91
00:05:50,998 --> 00:05:55,912
hidden characters, which used to
completely scramble the rendering of the TUI.

92
00:05:56,061 --> 00:06:01,192
Second, they added a new warning when you
select the "Ultra" reasoning model,

93
00:06:01,248 --> 00:06:05,752
basically reminding you of the high
multi-agent token burn rate so you don't

94
00:06:05,795 --> 00:06:07,432
accidentally blow through your budget.

95
00:06:13,196 --> 00:06:13,656
Oh, that token burn is real.

96
00:06:13,657 --> 00:06:13,737
And how are they handling the usage limits
now?

97
00:06:13,776 --> 00:06:15,436
Didn't they change the redemption flow?

98
00:06:15,750 --> 00:06:16,230
They did.

99
00:06:16,370 --> 00:06:21,590
Now, when you receive usage-limit reset
credits, the terminal UI features an

100
00:06:21,643 --> 00:06:23,110
interactive redeem picker.

101
00:06:23,297 --> 00:06:28,470
It explicitly displays the expiration date
and the type of credit before you apply

102
00:06:28,497 --> 00:06:33,910
it, so you can choose exactly which credit
to burn first directly from the CLI.

103
00:06:34,123 --> 00:06:35,430
It's a lot cleaner.

104
00:06:35,836 --> 00:06:41,056
Honestly, despite the rapid patch
versions, these auth and terminal updates make

105
00:06:41,196 --> 00:06:44,636
local MCP management so much more
predictable.

106
00:06:44,797 --> 00:06:48,616
Well, I think that covers the main 0.144
updates.

107
00:06:48,816 --> 00:06:49,776
Good talking to you, Ethan.

108
00:06:50,083 --> 00:06:51,843
Yeah, catch you tomorrow, Maya.