So, Maya, thanks to Jellypod to help make this daily show a reality.
I spent about three hours yesterday tearing my hair out over an OAuth loop with a
local MCP server, and it turns out, uh, it's a known architectural headache that
Codex finally addressed in v0.144.0.
You know how when you start a local auth flow, the OS usually just grabs whatever
random, dynamic port is free to handle the callback?
Oh, yeah.
The classic port lottery.
It's totally fine for a local script, but the second you try to register that with
GitHub or Google API consoles, they, like, completely block it.
They demand a strict, static callback URI.
Exactly.
You can't just put a wildcard port in your OAuth application settings for security
reasons.
So, if your local MCP client spins up on port, say, 59231 one
run and 61004 the next, the provider throws a redirect URI mismatch
error and kills the flow.
But in 0.144.0, they introduced a dedicated configuration parameter in
.codex/config.toml called mcp_oauth_callback_port.
Oh, nice.
So you can actually pin it down now?
How does that look in the config file?
It's simple.
You just open your .codex/config.toml and, under your MCP configuration
section, you add mcp_oauth_callback_port =
8000-or, you know, whatever port you want to dedicate.
That way, you can go to your GitHub developer settings, register a static redirect
URI like
http://localhost:8000/callback, and it
works every single time.
No more dynamic port roulette.
That makes so much sense.
But, wait, what happens if you're running this in, say, a remote container or a
headless environment like GitHub Codespaces?
Because if Codex spins up localhost:8000 inside a VM in the cloud,
and my browser is running on my local machine...
well, "This site can't be reached."
The redirect completely stalls.
Right!
That's the headless authentication problem.
And the way they solved this in 0.144.0 is honestly pretty elegant.
They set up a hosted redirect loopback mechanism using PKCE-that's Proof Key for
Code Exchange.
Instead of relying on a local web server to capture the redirect,
Codex routes the final step through a secure hosted page, like
console.openai.com/cli/callback.
Wait, so how does the local terminal find out that I successfully logged in on that
webpage if there's no direct connection?
Ah, the hosted page generates a short, single-use verification code once you
authenticate.
The terminal UI halts and prompts you with a message.
You just copy that code from the webpage, paste it back into your terminal prompt,
and the PKCE handshake completes the exchange securely.
It completely bypasses the need for local-to-remote network tunneling just to sign
in.
Okay, that is a massive lifesaver for cloud IDEs.
But speaking of pasting things into the terminal...
I saw there was a massive patch release cycle right after this.
Like, v0.144.1, .2, and .3 came out in rapid succession.
What was going on there?
Yeah, the post-release cleanup.
So, in 0.144.1, they ran into a nasty macOS bug-issue
number 32447.
Basically, the bundled node_repl MCP client started failing immediately on startup
with an "os error 2," which is just "file not found."
It turned out the runtime path lookup for Node was failing if Node wasn't globally
symlinked in a very specific way.
If you run into that, you have to verify your PATH or manually point to your Node
binary.
Classic path resolution issues.
And didn't Windows devs get hit by something weird in 0.144.3 too?
Yes, issue 32974.
Under Windows 11, if you were running heavy, multi-step goals with concurrent
"PostToolUse" hooks, the CLI would sometimes silently crash and drop you straight
back to the PowerShell prompt without throwing an actual error stack.
They patched that concurrency leak in .3.
Oh, and they also had to do a rollback in 0.144.2-issue
32672.
Wait, what did they roll back?
They restored the previous Guardian auto-review prompting behavior.
If you remember from yesterday's episode, the new strict checks were aggressively
blocking git pushes, so they backed that out to keep developers from getting
completely blocked while they refine the heuristics.
Yeah, blocking git pushes is a quick way to get developers angry.
I'm glad they walked that back quickly.
What about the general user interface?
Any nice quality of life tweaks in this batch?
A few really nice ones.
First, they added paste sanitization to the terminal UI.
It strips out raw control sequences if you copy-paste code snippets that contain
hidden characters, which used to completely scramble the rendering of the TUI.
Second, they added a new warning when you select the "Ultra" reasoning model,
basically reminding you of the high multi-agent token burn rate so you don't
accidentally blow through your budget.
Oh, that token burn is real.
And how are they handling the usage limits now?
Didn't they change the redemption flow?
They did.
Now, when you receive usage-limit reset credits, the terminal UI features an
interactive redeem picker.
It explicitly displays the expiration date and the type of credit before you apply
it, so you can choose exactly which credit to burn first directly from the CLI.
It's a lot cleaner.
Honestly, despite the rapid patch versions, these auth and terminal updates make
local MCP management so much more predictable.
Well, I think that covers the main 0.144 updates.
Good talking to you, Ethan.
Yeah, catch you tomorrow, Maya.