1
00:00:00,099 --> 00:00:03,439
So I was, uh, looking through my local
setups yesterday, and,

2
00:00:03,480 --> 00:00:06,759
yeah, Jellypod is making this daily
episode possible today,

3
00:00:07,199 --> 00:00:13,779
shout out to them, but honestly, this new
update in Codex CLI zero point one five

4
00:00:13,799 --> 00:00:17,139
three point zero, it, it, it caught my eye
immediately.

5
00:00:18,607 --> 00:00:19,627
Let me guess.

6
00:00:19,648 --> 00:00:22,007
Is it the Model Context Protocol stuff?

7
00:00:22,417 --> 00:00:23,137
It is!

8
00:00:23,190 --> 00:00:24,097
It totally is.

9
00:00:24,167 --> 00:00:28,577
Because before this, right, if you
authorized an MCP server,

10
00:00:28,637 --> 00:00:33,697
say a custom database query tool or a
cloud script, and you clicked remember

11
00:00:33,768 --> 00:00:37,777
approval, that permission just lived
globally on your machine.

12
00:00:38,892 --> 00:00:44,391
Wait, so if you switched from your
personal side project over to a client or team

13
00:00:44,511 --> 00:00:47,071
account in the same CLI workspace...

14
00:00:47,375 --> 00:00:48,575
It just carried over!

15
00:00:48,735 --> 00:00:51,215
The remembered approval was global.

16
00:00:51,402 --> 00:00:56,495
So if your model wanted to run a
deployment script, it could execute that tool under

17
00:00:56,515 --> 00:00:59,335
the wrong environment without asking you
again.

18
00:00:59,407 --> 00:01:02,495
That is classic cross account tool
leakage.

19
00:01:02,819 --> 00:01:03,359
Wow.

20
00:01:03,720 --> 00:01:07,619
That is, uh, that is definitely a messy
security surface.

21
00:01:08,379 --> 00:01:12,059
So how does zero point one five three
point zero handle it now?

22
00:01:12,516 --> 00:01:18,216
Well, according to the release notes,
remembered MCP tool approvals are scoped to

23
00:01:18,256 --> 00:01:19,556
the selected app account.

24
00:01:20,196 --> 00:01:24,676
It binds them directly to your active
account ID and app link config.

25
00:01:25,149 --> 00:01:30,849
So if I hop from my personal profile to my
work profile, even if it is the exact

26
00:01:31,029 --> 00:01:33,010
same MCP binary on my disk...

27
00:01:33,292 --> 00:01:34,332
You have to re approve it.

28
00:01:34,442 --> 00:01:36,892
Exactly once per connected account.

29
00:01:37,052 --> 00:01:40,812
It will prompt you again because the
active account ID changed.

30
00:01:41,091 --> 00:01:43,731
That makes so much sense from a testing
perspective.

31
00:01:44,272 --> 00:01:49,032
I mean, back when I tested developer
tools, permission leakage across profiles was

32
00:01:49,071 --> 00:01:52,771
one of those subtle bugs that would bite
you right when you least expected it.

33
00:01:53,571 --> 00:01:56,672
But wait, what about relative paths on
macOS?

34
00:01:56,972 --> 00:01:58,091
Did they tweak that too?

35
00:01:58,576 --> 00:01:59,417
Yeah, they did!

36
00:02:00,037 --> 00:02:05,016
On macOS, if you were using relative
executable paths for MCP servers,

37
00:02:05,656 --> 00:02:07,556
starting them up could be pretty flaky.

38
00:02:08,196 --> 00:02:14,196
In zero point one five three point zero,
relative MCP executable paths start more

39
00:02:14,236 --> 00:02:20,816
reliably on macOS now, so running codex
mcp under multi tenant setups is much

40
00:02:20,856 --> 00:02:21,177
smoother.

41
00:02:21,527 --> 00:02:26,787
Okay, so relative binaries launch
reliably, but you just have to give that explicit

42
00:02:26,887 --> 00:02:29,007
approval one time when you switch
accounts.

43
00:02:29,375 --> 00:02:29,775
Right.

44
00:02:29,855 --> 00:02:30,575
Exactly.

45
00:02:30,882 --> 00:02:32,763
Okay, what else dropped in this release?

46
00:02:33,262 --> 00:02:37,342
I saw something about rollout compression
and session history?

47
00:02:37,708 --> 00:02:38,268
Oh, yeah.

48
00:02:38,375 --> 00:02:42,948
Under the hood, rollout compression now
includes shared histories.

49
00:02:43,068 --> 00:02:47,068
So all those saved transcript rollouts on
disk get compressed,

50
00:02:47,095 --> 00:02:50,188
which keeps your codex home directory size
down.

51
00:02:50,587 --> 00:02:55,628
Wait, if the rollouts are compressed on
disk, does codex exec resume still work if

52
00:02:55,668 --> 00:02:56,867
you select by directory?

53
00:02:57,167 --> 00:02:57,967
Yep!

54
00:02:57,983 --> 00:02:59,887
They specifically fixed that.

55
00:02:59,947 --> 00:03:05,487
codex exec resume handles compressed
rollouts when selecting by working directory,

56
00:03:05,540 --> 00:03:10,447
so your background tasks and thread forks
do not break even when disk compression is

57
00:03:10,516 --> 00:03:11,007
active.

58
00:03:11,379 --> 00:03:11,959
Nice.

59
00:03:12,539 --> 00:03:17,679
And speaking of background tasks, there is
a pretty noticeable change for Plus and

60
00:03:17,819 --> 00:03:20,039
Team users on usage limits, right?

61
00:03:20,375 --> 00:03:22,535
Oh, huge quality of life fix.

62
00:03:22,630 --> 00:03:27,255
Previously, you might be deep in a long
coding run and suddenly hit the wall.

63
00:03:27,455 --> 00:03:32,215
Now, Plus and Team users get an earlier
warning when less than half of their

64
00:03:32,263 --> 00:03:36,055
allowance remains in an approximately five
hour usage window.

65
00:03:36,421 --> 00:03:37,721
Oh, I love that!

66
00:03:38,222 --> 00:03:43,781
Getting warned at fifty percent left in a
five hour window gives you actual time to

67
00:03:43,982 --> 00:03:49,741
pause, review your agent's queue, or wrap
up before you get cut off mid execution.

68
00:03:50,502 --> 00:03:51,303
Exactly.

69
00:03:51,842 --> 00:03:56,402
No more surprise rate limit brick walls
while your subagent is halfway through a

70
00:03:56,462 --> 00:03:57,382
massive refactor.

71
00:03:57,717 --> 00:03:59,777
And what about configuration settings?

72
00:04:00,077 --> 00:04:04,097
Any breaking changes or deprecations we
should update in our config files?

73
00:04:04,500 --> 00:04:07,060
Just a clean migration for TUI settings.

74
00:04:07,160 --> 00:04:12,260
The old top level disable paste burst
setting is officially moved under the TUI

75
00:04:12,327 --> 00:04:16,100
block, so now it is tui point disable
paste burst.

76
00:04:16,240 --> 00:04:20,660
The old top level key still works as a
fallback for now, but you should move it

77
00:04:20,724 --> 00:04:21,060
over.

78
00:04:21,376 --> 00:04:26,736
So, looking at the big picture here,
Ethan, between account scoped approvals and

79
00:04:26,817 --> 00:04:33,316
earlier quota warnings, it feels like
OpenAI is really hardening Codex for serious

80
00:04:33,396 --> 00:04:35,557
enterprise multi account workflows.

81
00:04:36,236 --> 00:04:39,996
But do you think developers are going to
complain about the extra approval prompts

82
00:04:40,056 --> 00:04:41,017
when switching accounts?

83
00:04:41,534 --> 00:04:41,995
Honestly?

84
00:04:42,514 --> 00:04:44,534
Maybe a tiny bit of friction at first.

85
00:04:45,074 --> 00:04:49,615
But when the alternative is accidentally
running a production deployment tool using

86
00:04:49,635 --> 00:04:53,414
your client credentials while thinking you
are on a sandbox account...

87
00:04:54,215 --> 00:04:59,215
I, I, I think re approving a tool once per
account is a very small price to pay.

88
00:04:59,691 --> 00:05:01,551
Yeah, I am with you on that.

89
00:05:01,831 --> 00:05:04,391
Safety over silent leakage any day.

90
00:05:05,171 --> 00:05:10,651
Well, that wraps up our quick look at
Codex zero point one five three point zero.

91
00:05:11,151 --> 00:05:13,792
Thanks for tuning in, everyone, and we
will catch you next time!

92
00:05:14,083 --> 00:05:15,203
Take care, everybody!