So, Maya, I was looking through the changelog for the new Codex CLI
v0.145.0 release, and they have officially marked Multi Agent v2 as
stable.
But, uh, there is a massive catch here that is going to drive developers crazy.
When a parent agent talks to a child agent, those instructions are now fully
encrypted.
Like, completely black boxed on your local machine.
Wait, what?
It is running locally on my machine, but I cannot see what the agents are saying to
each other?
How does that work?
Exactly.
If you dig into PR 33509 and PR 34383, the flow has completely
changed.
When a parent agent spawns a sub agent, OpenAI's Responses API encrypts the message
payload.
The locally running Codex CLI, it just receives and forwards raw ciphertext.
It literally carries that same ciphertext without being able to decrypt it.
Decryption only happens once it gets back to OpenAI's servers,
right before they hand it off to the child model.
So the local CLI is just acting like a blind courier.
It is passing a locked briefcase it does not have the key to.
But, wait, what about debugging?
If I am running a local SQLite database to track state, like we talked about in the
last episode, what actually gets written to the disk now?
Oh, it is a mess for debugging.
Under PR 33030 and PR 33841, the local
InterAgentCommunication table in SQLite literally writes the plaintext content field
as an empty string.
All the actual instructions, the prompts, the routing, they are stuffed into the
encrypted_content column.
And it gets worse.
The list_agents command?
They stripped the task text from it.
It only returns the name and the status indicators now.
No text.
That is incredibly frustrating.
If a sub agent spins out of control and, I don't know, runs a destructive tool like
deleting a database, you cannot even look at the local history to see *why* it did
that?
You cannot see the prompt that triggered it?
Nope.
You are completely blind in your own local logs.
And, uh, if you are wondering why they did this, it is not just some random security
hardening.
It is actually a direct move to stop API piracy.
Piracy?
How do you pirate an agent workflow?
Well, there are these unauthorized, low cost Codex API resellers,
especially active in some markets, that were hijacking these agent workflows.
They would intercept the parent agent's message to the child agent,
grab the reasoning, and then replay or route those sub agent tasks to cheaper
downstream accounts under different keys.
By encrypting the parent to child communication, OpenAI ties the cryptographic state
directly to the upstream session credentials.
If you do not have the original session's OAuth handshake, you cannot decrypt or
reuse those instructions.
Huh.
So they secured the business model, but they completely broke local auditability to
do it.
Thanks to Jellypod to help make this daily show a reality, because we are going to
need to unpack how developers are supposed to actually work with this.
Okay, so if we cannot see the messages, how does this actually feel to use in the
terminal?
Like, if I am using the TUI, the terminal user interface, what happens when a sub
agent is running?
Well, under PR 33841, those parent owned sub agent threads are now strictly read
only in the TUI.
You can watch them run, but you cannot touch them.
If a sub agent gets stuck in a runaway loop, or starts deviating from the task,
you cannot jump in and type a correction or override the prompt.
Your only option is to abort the entire task.
Man, that is a huge step back for developer experience.
I used to love nudging agents back on track.
And what about resuming sessions?
If I am working on a laptop, and then I push my state to a remote server or a
different machine, does that break the encryption?
It absolutely does if you are not careful.
Under PR 32229, the local OAuth credentials are managed by a highly specific
serialized storage system.
If you try to resume a multi agent thread on a different machine,
or even through a different proxy configuration, and those credentials do not match
perfectly, the session validation fails.
You get decryption errors, and the whole thing just grinds to a halt.
Okay, so it is super rigid.
But, to be fair, they did ship *some* quality of life updates in 0.145.0 to ease the
pain, right?
Yeah, they did.
They are trying to give us some sugar to help the medicine go down.
For instance, PR 33950 finally lets the CLI persist and remember your
exact working directory, the cwd, when you resume a thread.
That means no more local file system state drift where the agent thinks it is in one
folder, but your terminal is in another.
Okay, that is actually really helpful.
And didn't they add something for people migrating from other tools?
Yes!
PR 33426 adds the import command, which automates settings migration from Cursor.
So if you are moving your setup over, it pulls your config cleanly.
Oh, and they also bumped the packaged ripgrep to version 15.2.0 in PR 34384,
which speeds up local file searches during agent context building.
Fine, faster search is nice, but it does not solve the big observability problem.
Is the community just accepting this empty plaintext field in SQLite?
Definitely not.
There is a very active debate on GitHub right now, specifically Issue 28058.
Enterprise developers are pushing OpenAI to introduce a separate,
unencrypted audit field in the local SQLite tables.
The idea is to let the local CLI log a high level summary of the delegation,
without compromising the secure, encrypted upstream transport path.
But so far, OpenAI hasn't committed to it.
Yeah, because why make it easy to debug when you can make it secure,
right?
Alright, well, that is v0.145.0 for you.
Secure, stable, and completely opaque.
Catch you next time.
Talk soon.