1
00:00:00,099 --> 00:00:04,079
So I- I was looking at the changelog for
the new Codex CLI release,

2
00:00:04,659 --> 00:00:10,679
the v0.144.8, and man, they are not
playing around with safety this time.

3
00:00:11,259 --> 00:00:16,039
It's like they looked at everyone
accidentally burning through their entire OpenAI

4
00:00:16,100 --> 00:00:21,200
or Anthropic API budget in a single
weekend because of runaway loops,

5
00:00:21,719 --> 00:00:24,260
and they finally put up some serious
guardrails.

6
00:00:24,732 --> 00:00:27,752
Oh, the loop crisis is so real.

7
00:00:28,333 --> 00:00:31,512
I mean, you set up a swarm, you think
they're just, you know,

8
00:00:31,572 --> 00:00:36,293
collaborating, and suddenly one sub-agent
decides it needs to spawn another,

9
00:00:36,492 --> 00:00:41,433
which spawns another, and before you know
it, you're five layers deep in a recursive

10
00:00:41,492 --> 00:00:42,732
nightmare.

11
00:00:42,872 --> 00:00:44,772
What did they actually set the hard limit
to?

12
00:00:45,208 --> 00:00:47,448
It's a strict three nested layers now.

13
00:00:47,541 --> 00:00:54,008
There's a new environment variable,
CODEX_MAX_AGENT_DEPTH=3,

14
00:00:54,028 --> 00:00:57,848
and if a child agent tries to spin up a
fourth-generation sub-agent,

15
00:00:57,888 --> 00:00:59,608
the runtime just...

16
00:00:59,656 --> 00:01:00,648
cuts it off.

17
00:01:00,755 --> 00:01:02,008
No questions asked.

18
00:01:02,399 --> 00:01:02,899
Three?

19
00:01:03,480 --> 00:01:05,079
That's actually pretty tight.

20
00:01:05,679 --> 00:01:09,799
I mean, if you're doing complex code
generation, you can hit three layers

21
00:01:09,940 --> 00:01:11,279
surprisingly fast.

22
00:01:12,119 --> 00:01:17,139
But, honestly, thank goodness, because the
inheritance problem was getting

23
00:01:17,279 --> 00:01:18,219
ridiculous.

24
00:01:18,879 --> 00:01:23,579
The way these sub-agents were silently
inheriting the parent's global execution

25
00:01:23,680 --> 00:01:25,253
state-- Yes!

26
00:01:25,308 --> 00:01:25,853
Exactly.

27
00:01:26,812 --> 00:01:27,932
It was a mess!

28
00:01:28,372 --> 00:01:32,652
They'd inherit the state, and then the
child processes would try to spin up their

29
00:01:32,732 --> 00:01:34,612
own local server instances.

30
00:01:35,232 --> 00:01:42,013
I saw a report where a single run
completely exhausted ports 8080 through 8095 in a

31
00:01:42,052 --> 00:01:47,272
developer's local sandbox because every
single child agent thought it needed its own

32
00:01:47,412 --> 00:01:48,052
web server.

33
00:01:48,432 --> 00:01:49,792
Wait, sixteen ports?

34
00:01:50,352 --> 00:01:50,672
Just...

35
00:01:51,232 --> 00:01:51,672
gone?

36
00:01:52,912 --> 00:01:53,572
That's wild.

37
00:01:54,192 --> 00:01:58,653
But it makes sense because the child agent
doesn't realize it's a child; it just

38
00:01:58,732 --> 00:02:02,312
copies the parent's homework, including
the port configuration.

39
00:02:02,972 --> 00:02:04,492
So how are they stopping that now?

40
00:02:04,902 --> 00:02:09,182
Well, under the hood, they actually
rewrote the process-tree tracking.

41
00:02:09,622 --> 00:02:11,442
It's all implemented in Rust now.

42
00:02:11,962 --> 00:02:18,122
It monitors the process group ID--the
PGID--of any subshell that an agent spawns.

43
00:02:18,222 --> 00:02:23,242
So if a child task tries to detach itself
to bypass the sandbox boundaries and run

44
00:02:23,282 --> 00:02:27,402
as an orphan, the Rust runtime catches it
instantly and...

45
00:02:27,462 --> 00:02:28,322
boom, killed.

46
00:02:28,708 --> 00:02:32,948
So no more zombie agents running in the
background after you think you've killed the

47
00:02:32,996 --> 00:02:34,068
main terminal window.

48
00:02:34,363 --> 00:02:35,242
Exactly.

49
00:02:35,662 --> 00:02:39,342
If the parent dies, or even if the parent
just loses track,

50
00:02:39,802 --> 00:02:45,202
that PGID tracking means the runtime
cleans up the entire family tree.

51
00:02:45,682 --> 00:02:50,142
It's a huge step up from the old
shell-based wrappers that just kind of hoped for

52
00:02:50,183 --> 00:02:50,642
the best.

53
00:02:50,958 --> 00:02:55,518
Which brings us to what happens when
things do inevitably crash,

54
00:02:55,568 --> 00:02:58,958
because even with the Rust safety net,
things fail.

55
00:02:59,086 --> 00:03:03,758
They've introduced this new command:
codex-cli session recover,

56
00:03:03,898 --> 00:03:06,158
and then you pass it the session ID.

57
00:03:06,398 --> 00:03:10,878
It's basically a lifeline for when your
local SQLite database gets corrupted

58
00:03:10,938 --> 00:03:11,518
mid-run.

59
00:03:11,879 --> 00:03:15,179
Wait, so it can actually reconstruct the
state?

60
00:03:15,719 --> 00:03:18,379
Like, without losing the tool-execution
history?

61
00:03:18,833 --> 00:03:22,113
Yeah, it- it reconstructs the whole
sequence of events.

62
00:03:22,300 --> 00:03:27,553
It pulls whatever survived from the SQLite
journal and rebuilds the agent's state

63
00:03:27,609 --> 00:03:28,193
variables.

64
00:03:28,406 --> 00:03:34,193
So if you were forty minutes into a
massive refactoring job and the CLI crashed,

65
00:03:34,233 --> 00:03:35,953
you don't have to start from scratch.

66
00:03:36,053 --> 00:03:38,993
You can pull the exact session history
back up.

67
00:03:39,359 --> 00:03:40,679
That is huge.

68
00:03:41,159 --> 00:03:46,119
I can't tell you how many times I've had a
run fail at the very end and had to

69
00:03:46,179 --> 00:03:51,039
manually piece together what the agent
actually wrote to disk versus what was still

70
00:03:51,079 --> 00:03:52,199
in its context window.

71
00:03:52,939 --> 00:03:58,039
But, okay, what if I don't even want to
risk multi-agent orchestration on a project?

72
00:03:58,559 --> 00:04:03,979
Like, say I have a junior developer
working on a sensitive internal repo and I only

73
00:04:04,019 --> 00:04:05,959
want them using single-agent tasks.

74
00:04:06,292 --> 00:04:12,212
Ah, then you want to go into your global
.codex/config.toml file and set

75
00:04:12,308 --> 00:04:17,012
CODEX_DISABLE_RECURSIVE_SPAWN=true.

76
00:04:17,140 --> 00:04:21,012
That completely blocks any child-agent
spawning whatsoever.

77
00:04:21,199 --> 00:04:26,612
It forces everything to stay strictly
single-agent, which is a great safeguard for

78
00:04:26,665 --> 00:04:27,652
local repos.

79
00:04:28,030 --> 00:04:28,549
Perfect.

80
00:04:28,829 --> 00:04:30,809
That's a simple, set-and-forget flag.

81
00:04:31,689 --> 00:04:35,589
But- okay, I do have one warning for
people trying this out.

82
00:04:36,250 --> 00:04:43,229
Even with the new v0.144.8 safety
features, there is still a major caveat

83
00:04:43,269 --> 00:04:44,329
with port conflicts.

84
00:04:44,850 --> 00:04:50,509
If you use SIGKILL--like a hard kill
-9--on a running agent instead of a clean

85
00:04:50,549 --> 00:04:54,709
SIGTERM, the local CLI still fails to
release those socket binds.

86
00:04:55,250 --> 00:04:59,129
The Rust process-tree tracker doesn't get
a chance to run its cleanup destructors.

87
00:04:59,458 --> 00:05:02,818
Ah, so the port stays blocked even though
the agent is dead.

88
00:05:03,212 --> 00:05:03,752
Yep.

89
00:05:03,833 --> 00:05:09,753
You'll end up having to manually run lsof
-i to find whatever is camping on port

90
00:05:09,912 --> 00:05:11,553
8080 and kill it yourself.

91
00:05:12,112 --> 00:05:18,572
So, please, use SIGTERM or just use Ctrl+C
and let the CLI shut down gracefully.

92
00:05:18,917 --> 00:05:19,717
Definitely.

93
00:05:19,797 --> 00:05:20,597
Good to know.

94
00:05:20,725 --> 00:05:24,997
Well, that's a quick look at v0.144.8.

95
00:05:25,077 --> 00:05:29,957
Definitely update if you haven't yet, if
only to save your API wallet.

96
00:05:30,337 --> 00:05:31,397
Yeah, seriously.

97
00:05:31,717 --> 00:05:32,617
Go do that now.

98
00:05:33,657 --> 00:05:34,838
Alright, talk to you next time.