1 00:00:00,140 --> 00:00:04,679 So, Maya, I was looking through the changelog for the new Codex CLI 2 00:00:04,799 --> 00:00:11,560 v0.145.0 release, and they have officially marked Multi Agent v2 as 3 00:00:11,599 --> 00:00:11,960 stable. 4 00:00:12,799 --> 00:00:16,859 But, uh, there is a massive catch here that is going to drive developers crazy. 5 00:00:17,520 --> 00:00:22,079 When a parent agent talks to a child agent, those instructions are now fully 6 00:00:22,119 --> 00:00:22,719 encrypted. 7 00:00:23,340 --> 00:00:26,319 Like, completely black boxed on your local machine. 8 00:00:26,836 --> 00:00:27,736 Wait, what? 9 00:00:28,296 --> 00:00:33,036 It is running locally on my machine, but I cannot see what the agents are saying to 10 00:00:33,056 --> 00:00:33,476 each other? 11 00:00:34,076 --> 00:00:34,877 How does that work? 12 00:00:35,292 --> 00:00:36,012 Exactly. 13 00:00:36,172 --> 00:00:43,132 If you dig into PR 33509 and PR 34383, the flow has completely 14 00:00:43,202 --> 00:00:43,852 changed. 15 00:00:43,980 --> 00:00:50,412 When a parent agent spawns a sub agent, OpenAI's Responses API encrypts the message 16 00:00:50,482 --> 00:00:51,052 payload. 17 00:00:51,232 --> 00:00:56,972 The locally running Codex CLI, it just receives and forwards raw ciphertext. 18 00:00:57,185 --> 00:01:01,612 It literally carries that same ciphertext without being able to decrypt it. 19 00:01:01,832 --> 00:01:06,332 Decryption only happens once it gets back to OpenAI's servers, 20 00:01:06,372 --> 00:01:08,652 right before they hand it off to the child model. 21 00:01:09,086 --> 00:01:13,506 So the local CLI is just acting like a blind courier. 22 00:01:14,006 --> 00:01:17,686 It is passing a locked briefcase it does not have the key to. 23 00:01:18,547 --> 00:01:20,826 But, wait, what about debugging? 24 00:01:21,386 --> 00:01:25,566 If I am running a local SQLite database to track state, like we talked about in the 25 00:01:25,626 --> 00:01:29,046 last episode, what actually gets written to the disk now? 26 00:01:29,494 --> 00:01:31,474 Oh, it is a mess for debugging. 27 00:01:31,994 --> 00:01:37,854 Under PR 33030 and PR 33841, the local 28 00:01:37,954 --> 00:01:43,875 InterAgentCommunication table in SQLite literally writes the plaintext content field 29 00:01:44,094 --> 00:01:44,974 as an empty string. 30 00:01:45,795 --> 00:01:50,834 All the actual instructions, the prompts, the routing, they are stuffed into the 31 00:01:50,914 --> 00:01:52,814 encrypted_content column. 32 00:01:53,494 --> 00:01:54,475 And it gets worse. 33 00:01:54,974 --> 00:01:56,434 The list_agents command? 34 00:01:57,034 --> 00:01:58,854 They stripped the task text from it. 35 00:01:59,414 --> 00:02:02,375 It only returns the name and the status indicators now. 36 00:02:02,875 --> 00:02:03,494 No text. 37 00:02:05,737 --> 00:02:07,617 That is incredibly frustrating. 38 00:02:08,157 --> 00:02:13,237 If a sub agent spins out of control and, I don't know, runs a destructive tool like 39 00:02:13,298 --> 00:02:18,277 deleting a database, you cannot even look at the local history to see *why* it did 40 00:02:18,338 --> 00:02:18,577 that? 41 00:02:19,117 --> 00:02:21,077 You cannot see the prompt that triggered it? 42 00:02:21,458 --> 00:02:22,138 Nope. 43 00:02:22,208 --> 00:02:25,378 You are completely blind in your own local logs. 44 00:02:25,598 --> 00:02:30,818 And, uh, if you are wondering why they did this, it is not just some random security 45 00:02:30,866 --> 00:02:31,458 hardening. 46 00:02:31,591 --> 00:02:35,138 It is actually a direct move to stop API piracy. 47 00:02:35,465 --> 00:02:36,304 Piracy? 48 00:02:36,944 --> 00:02:39,304 How do you pirate an agent workflow? 49 00:02:39,667 --> 00:02:44,947 Well, there are these unauthorized, low cost Codex API resellers, 50 00:02:45,005 --> 00:02:49,587 especially active in some markets, that were hijacking these agent workflows. 51 00:02:49,715 --> 00:02:53,987 They would intercept the parent agent's message to the child agent, 52 00:02:54,067 --> 00:02:59,507 grab the reasoning, and then replay or route those sub agent tasks to cheaper 53 00:02:59,565 --> 00:03:01,827 downstream accounts under different keys. 54 00:03:02,067 --> 00:03:07,827 By encrypting the parent to child communication, OpenAI ties the cryptographic state 55 00:03:07,925 --> 00:03:10,787 directly to the upstream session credentials. 56 00:03:11,054 --> 00:03:16,787 If you do not have the original session's OAuth handshake, you cannot decrypt or 57 00:03:16,894 --> 00:03:18,627 reuse those instructions. 58 00:03:19,087 --> 00:03:19,427 Huh. 59 00:03:20,047 --> 00:03:25,087 So they secured the business model, but they completely broke local auditability to 60 00:03:25,107 --> 00:03:26,307 do it. 61 00:03:26,367 --> 00:03:30,287 Thanks to Jellypod to help make this daily show a reality, because we are going to 62 00:03:30,307 --> 00:03:34,367 need to unpack how developers are supposed to actually work with this. 63 00:03:35,819 --> 00:03:41,839 Okay, so if we cannot see the messages, how does this actually feel to use in the 64 00:03:41,920 --> 00:03:42,259 terminal? 65 00:03:42,879 --> 00:03:47,880 Like, if I am using the TUI, the terminal user interface, what happens when a sub 66 00:03:48,039 --> 00:03:48,859 agent is running? 67 00:03:49,266 --> 00:03:56,167 Well, under PR 33841, those parent owned sub agent threads are now strictly read 68 00:03:56,266 --> 00:03:57,446 only in the TUI. 69 00:03:58,106 --> 00:04:00,766 You can watch them run, but you cannot touch them. 70 00:04:01,426 --> 00:04:06,066 If a sub agent gets stuck in a runaway loop, or starts deviating from the task, 71 00:04:06,587 --> 00:04:10,386 you cannot jump in and type a correction or override the prompt. 72 00:04:11,066 --> 00:04:14,046 Your only option is to abort the entire task. 73 00:04:15,625 --> 00:04:19,844 Man, that is a huge step back for developer experience. 74 00:04:20,444 --> 00:04:22,864 I used to love nudging agents back on track. 75 00:04:23,644 --> 00:04:25,764 And what about resuming sessions? 76 00:04:26,264 --> 00:04:31,465 If I am working on a laptop, and then I push my state to a remote server or a 77 00:04:31,504 --> 00:04:34,084 different machine, does that break the encryption? 78 00:04:34,417 --> 00:04:37,057 It absolutely does if you are not careful. 79 00:04:37,177 --> 00:04:43,457 Under PR 32229, the local OAuth credentials are managed by a highly specific 80 00:04:43,530 --> 00:04:45,217 serialized storage system. 81 00:04:45,430 --> 00:04:50,097 If you try to resume a multi agent thread on a different machine, 82 00:04:50,150 --> 00:04:54,657 or even through a different proxy configuration, and those credentials do not match 83 00:04:54,713 --> 00:04:57,457 perfectly, the session validation fails. 84 00:04:57,597 --> 00:05:01,537 You get decryption errors, and the whole thing just grinds to a halt. 85 00:05:01,882 --> 00:05:05,121 Okay, so it is super rigid. 86 00:05:05,781 --> 00:05:12,641 But, to be fair, they did ship *some* quality of life updates in 0.145.0 to ease the 87 00:05:12,681 --> 00:05:13,441 pain, right? 88 00:05:13,833 --> 00:05:14,873 Yeah, they did. 89 00:05:14,953 --> 00:05:18,073 They are trying to give us some sugar to help the medicine go down. 90 00:05:18,233 --> 00:05:24,873 For instance, PR 33950 finally lets the CLI persist and remember your 91 00:05:24,953 --> 00:05:29,273 exact working directory, the cwd, when you resume a thread. 92 00:05:29,401 --> 00:05:34,473 That means no more local file system state drift where the agent thinks it is in one 93 00:05:34,542 --> 00:05:37,033 folder, but your terminal is in another. 94 00:05:37,382 --> 00:05:40,661 Okay, that is actually really helpful. 95 00:05:40,721 --> 00:05:44,061 And didn't they add something for people migrating from other tools? 96 00:05:44,738 --> 00:05:45,157 Yes! 97 00:05:45,617 --> 00:05:51,697 PR 33426 adds the import command, which automates settings migration from Cursor. 98 00:05:52,337 --> 00:05:56,177 So if you are moving your setup over, it pulls your config cleanly. 99 00:05:56,838 --> 00:06:03,657 Oh, and they also bumped the packaged ripgrep to version 15.2.0 in PR 34384, 100 00:06:04,218 --> 00:06:07,697 which speeds up local file searches during agent context building. 101 00:06:08,229 --> 00:06:14,289 Fine, faster search is nice, but it does not solve the big observability problem. 102 00:06:14,929 --> 00:06:18,989 Is the community just accepting this empty plaintext field in SQLite? 103 00:06:19,417 --> 00:06:20,657 Definitely not. 104 00:06:20,704 --> 00:06:27,577 There is a very active debate on GitHub right now, specifically Issue 28058. 105 00:06:27,628 --> 00:06:32,217 Enterprise developers are pushing OpenAI to introduce a separate, 106 00:06:32,297 --> 00:06:36,297 unencrypted audit field in the local SQLite tables. 107 00:06:36,397 --> 00:06:41,577 The idea is to let the local CLI log a high level summary of the delegation, 108 00:06:41,627 --> 00:06:46,297 without compromising the secure, encrypted upstream transport path. 109 00:06:46,457 --> 00:06:49,897 But so far, OpenAI hasn't committed to it. 110 00:06:51,076 --> 00:06:55,456 Yeah, because why make it easy to debug when you can make it secure, 111 00:06:55,576 --> 00:06:55,916 right? 112 00:06:56,696 --> 00:07:00,316 Alright, well, that is v0.145.0 for you. 113 00:07:00,636 --> 00:07:03,576 Secure, stable, and completely opaque. 114 00:07:03,996 --> 00:07:04,616 Catch you next time. 115 00:07:04,958 --> 00:07:06,078 Talk soon.