1
00:00:01,419 --> 00:00:07,579
Um, remember last time when we were
staring at Codex CLI and all our external tools

2
00:00:07,659 --> 00:00:10,179
just disappeared into thin air after an
hour?

3
00:00:11,703 --> 00:00:12,642
Oh, I remember.

4
00:00:12,982 --> 00:00:18,923
We traced it down to that bug where HTTP
400 invalid grant errors were basically

5
00:00:18,963 --> 00:00:22,442
getting ignored, and the client just
dropped the tools silently.

6
00:00:23,043 --> 00:00:25,782
No error, no warning, just gone.

7
00:00:26,254 --> 00:00:26,894
Right!

8
00:00:27,394 --> 00:00:32,114
You go to run a database query or fetch a
ticket, and suddenly Codex is like,

9
00:00:32,714 --> 00:00:33,315
what tools?

10
00:00:33,694 --> 00:00:34,234
I don't know her.

11
00:00:34,744 --> 00:00:36,564
Well, OpenAI fixed it.

12
00:00:37,105 --> 00:00:43,704
Codex CLI 0.154.0 is out, and they updated
the core rmcp

13
00:00:43,804 --> 00:00:50,544
library to version 3.2.0, adding a
dedicated RMCP OAuth credential store adapter.

14
00:00:51,284 --> 00:00:55,305
And, uh, it fundamentally changes how
token expiration is handled.

15
00:00:55,694 --> 00:01:01,174
Okay, so what actually happens now when
that one hour access token expires?

16
00:01:01,679 --> 00:01:05,299
A couple of things, but the big one is
coordinated OAuth refresh.

17
00:01:05,960 --> 00:01:11,720
In the old build, if you had, say, three
parallel subagents or tool calls firing at

18
00:01:11,760 --> 00:01:16,819
the exact same millisecond when the token
expired, all three would independently try

19
00:01:16,839 --> 00:01:18,279
to hit the refresh endpoint.

20
00:01:18,736 --> 00:01:19,637
Oh no!

21
00:01:20,296 --> 00:01:26,076
That triggers token family revocation on
identity providers like Okta or Auth0!

22
00:01:26,696 --> 00:01:31,476
Because the server sees three simultaneous
refresh requests using the exact same

23
00:01:31,556 --> 00:01:37,036
refresh token, assumes a replay attack,
and revokes the whole refresh token family!

24
00:01:37,552 --> 00:01:38,592
Exactly.

25
00:01:38,693 --> 00:01:43,432
One token expires, three tasks try to
refresh it at once, and boom,

26
00:01:43,912 --> 00:01:45,372
you are completely logged out.

27
00:01:46,093 --> 00:01:52,773
Pulling ticket 42413 in this release
introduces a mutex lock around the refresh

28
00:01:52,852 --> 00:01:53,372
process.

29
00:01:54,052 --> 00:01:58,912
The first call initiates the refresh,
while the other pending calls wait and share

30
00:01:58,972 --> 00:02:00,972
the new credentials once it succeeds.

31
00:02:01,301 --> 00:02:04,401
That is huge for multi agent workflows!

32
00:02:05,042 --> 00:02:09,941
But wait, what if the refresh token itself
is expired or revoked?

33
00:02:09,981 --> 00:02:11,502
What happens to the running turn?

34
00:02:12,119 --> 00:02:17,859
That brings us to challenge preservation,
under pull request 42552.

35
00:02:18,559 --> 00:02:23,619
Previously, if authentication failed,
Codex might either auto replay the request

36
00:02:23,679 --> 00:02:26,219
with dead credentials or just crash out.

37
00:02:26,920 --> 00:02:32,619
Now, it preserves the tool execution
handle and surfaces an interactive login prompt

38
00:02:32,760 --> 00:02:34,979
right in the terminal UI or app server.

39
00:02:35,421 --> 00:02:41,681
Wait, so it pauses execution instead of
just dropping the task or replaying broken

40
00:02:41,721 --> 00:02:42,681
requests in a loop?

41
00:02:43,382 --> 00:02:43,641
Yeah.

42
00:02:43,901 --> 00:02:48,181
It holds the handle, presents the auth
challenge, lets you log in,

43
00:02:48,641 --> 00:02:51,382
and then resumes the exact turn with the
fresh token.

44
00:02:52,061 --> 00:02:58,161
And for stdio servers, pull request 43428
adds dynamic state

45
00:02:58,261 --> 00:03:02,421
synchronization over app slash installed
notifications.

46
00:03:02,859 --> 00:03:04,259
Wait, say that again.

47
00:03:05,019 --> 00:03:06,419
Stdio servers?

48
00:03:07,157 --> 00:03:07,497
Right.

49
00:03:07,757 --> 00:03:13,737
If an opted in stdio MCP server is
running, it receives a real time notification

50
00:03:13,777 --> 00:03:18,677
that credentials changed without you
having to restart your whole session or kill

51
00:03:18,717 --> 00:03:19,777
the CLI process.

52
00:03:20,314 --> 00:03:25,574
Okay, so for anyone who was constantly
doing that annoying workaround where you had

53
00:03:25,594 --> 00:03:32,494
to manually delete dot codex slash mcp
oauth dot json or run codex mcp

54
00:03:32,534 --> 00:03:33,034
logout...

55
00:03:33,614 --> 00:03:34,494
how do we upgrade?

56
00:03:35,054 --> 00:03:36,074
It is straightforward.

57
00:03:36,554 --> 00:03:43,354
If you are on npm, run npm install g at
openai slash codex

58
00:03:43,654 --> 00:03:46,554
at 0.154.0.

59
00:03:47,274 --> 00:03:53,854
If you are using Python, run pip install
upgrade openai codex equal equal

60
00:03:54,434 --> 00:03:56,954
0.154.0.

61
00:03:57,875 --> 00:04:02,555
According to the release notes on GitHub,
the Python package automatically includes

62
00:04:02,594 --> 00:04:08,494
the matching 0.154.0 CLI binary runtime.

63
00:04:08,863 --> 00:04:12,202
Okay, but what about headless
environments?

64
00:04:12,722 --> 00:04:18,722
Like, if I am running codex exec inside a
CI CD pipeline or an automated background

65
00:04:18,782 --> 00:04:23,862
worker, there is no human sitting there to
answer an interactive login prompt.

66
00:04:24,307 --> 00:04:25,428
Ah, good catch.

67
00:04:26,007 --> 00:04:31,487
In non interactive mode under codex exec,
when an unresolvable login challenge

68
00:04:31,587 --> 00:04:37,048
occurs, the process does not hang forever
or spin in an infinite retry loop.

69
00:04:37,727 --> 00:04:44,027
It pauses or fails gracefully with a
explicit exit code and diagnostic output,

70
00:04:44,548 --> 00:04:47,208
so your CI pipeline catches it
immediately.

71
00:04:48,069 --> 00:04:49,110
Thank goodness.

72
00:04:49,430 --> 00:04:54,009
Infinite loops in GitHub Actions burn
through build minutes so fast.

73
00:04:54,771 --> 00:04:55,931
Absolutely.

74
00:04:56,011 --> 00:05:01,051
Now, outside of the auth overhaul, there
are some really slick terminal quality of

75
00:05:01,111 --> 00:05:04,931
life updates in 0.154.0 too.

76
00:05:05,301 --> 00:05:05,901
Oh yeah?

77
00:05:06,181 --> 00:05:06,641
Like what?

78
00:05:07,182 --> 00:05:12,181
First, formatted copying under pull
request 42847.

79
00:05:12,921 --> 00:05:18,141
When you copy assistant responses out of
the terminal, rich text Markdown formatting

80
00:05:18,181 --> 00:05:22,841
is preserved when pasting into apps like
Slack, Notion, or Google Docs.

81
00:05:23,572 --> 00:05:24,751
Oh, finally!

82
00:05:25,091 --> 00:05:29,391
No more losing code blocks and bold
headers when pasting into documentation!

83
00:05:29,991 --> 00:05:30,211
Right!

84
00:05:30,731 --> 00:05:35,971
And pull request 43055 expanded the slash
copy command.

85
00:05:36,591 --> 00:05:39,792
You can now target specific session state
fields directly.

86
00:05:40,351 --> 00:05:45,871
Like slash copy status to grab your system
status, or slash copy model to copy the

87
00:05:45,991 --> 00:05:47,331
current model configuration.

88
00:05:48,436 --> 00:05:53,436
And I saw Vim mode got some love too in
pull 42194?

89
00:05:53,971 --> 00:05:54,412
Yes!

90
00:05:54,931 --> 00:05:59,232
The TUI composer now supports Vim replace
mode with capital R,

91
00:05:59,772 --> 00:06:03,111
full undo with u, and dot repeat with dot.

92
00:06:03,851 --> 00:06:07,071
So if you edit text using modal bindings
in the prompt box,

93
00:06:07,632 --> 00:06:09,911
your Vim muscle memory actually works now.

94
00:06:10,238 --> 00:06:16,837
Man, from fixing silent tool drops to
proper token refresh locks and Vim replace

95
00:06:16,898 --> 00:06:17,117
mode...

96
00:06:18,197 --> 00:06:22,577
0.154.0 feels like a really mature
stability release.

97
00:06:23,057 --> 00:06:23,857
It really is.

98
00:06:24,458 --> 00:06:30,197
Grab the update, stop deleting your
credential files, and enjoy reliable MCP tools.

99
00:06:30,530 --> 00:06:31,849
Alright, good chatting!

100
00:06:32,250 --> 00:06:33,969
Go upgrade your CLI, everyone.