1
00:00:00,000 --> 00:00:04,320
Let's get straight into the build, and
first, thanks to Jellypod to help make this

2
00:00:04,373 --> 00:00:05,920
daily show a reality.

3
00:00:06,067 --> 00:00:13,040
Today is Codex CLI 0.162.0, which went out
on October 8,

4
00:00:13,107 --> 00:00:17,280
about 27 hours after 0.161.0.

5
00:00:17,440 --> 00:00:22,800
The release notes are long, so we're
picking one topic: two fixes to the Linux

6
00:00:22,890 --> 00:00:23,600
sandbox.

7
00:00:23,760 --> 00:00:29,520
One of them is a ripgrep configuration
problem that's simple to explain and simple

8
00:00:29,573 --> 00:00:30,960
to check on your own machine.

9
00:00:31,320 --> 00:00:33,920
Start with the mechanism, because it's the
interesting part.

10
00:00:34,580 --> 00:00:39,060
On Linux, Codex runs shell commands inside
a sandbox built with bubblewrap,

11
00:00:39,240 --> 00:00:40,420
the bwrap binary.

12
00:00:40,960 --> 00:00:43,560
Part of that sandbox is a deny list.

13
00:00:43,940 --> 00:00:47,720
You give Codex deny globs, patterns for
files the agent shouldn't touch,

14
00:00:48,320 --> 00:00:52,000
and Codex turns those patterns into masks
over the actual files.

15
00:00:52,580 --> 00:00:55,920
To find which files match, it asks
ripgrep.

16
00:00:56,440 --> 00:01:00,260
It runs rg against each glob and uses the
list that comes back.

17
00:01:00,812 --> 00:01:04,192
The problem is that ripgrep reads a user
config file.

18
00:01:04,612 --> 00:01:10,632
If you've set RIPGREP_CONFIG_PATH, ripgrep
loads flags from that file on every run,

19
00:01:11,072 --> 00:01:12,612
including when Codex calls it.

20
00:01:13,152 --> 00:01:20,012
The pull request, number 51527, merged
October 7, says it directly: user ripgrep

21
00:01:20,052 --> 00:01:24,832
configuration can suppress the file list
used to construct Linux sandbox deny masks.

22
00:01:25,352 --> 00:01:27,772
Its example is a quiet flag in that config
file.

23
00:01:28,172 --> 00:01:31,852
Quiet silences ripgrep's output, so the
list comes back empty,

24
00:01:32,292 --> 00:01:37,812
so nothing gets masked, and files matching
your deny globs are left unmasked.

25
00:01:38,208 --> 00:01:40,688
And that's a failure with no error
attached.

26
00:01:40,778 --> 00:01:42,048
Nothing crashes.

27
00:01:42,168 --> 00:01:47,488
The sandbox starts, the deny list looks
configured, and the masks are quietly

28
00:01:47,548 --> 00:01:48,048
missing.

29
00:01:48,228 --> 00:01:49,728
The fix is small.

30
00:01:49,908 --> 00:01:56,128
Codex now passes the no config flag to the
ripgrep call that expands those globs,

31
00:01:56,208 --> 00:02:01,408
so your dotfiles and your
RIPGREP_CONFIG_PATH can't change what that call returns.

32
00:02:01,588 --> 00:02:07,008
The regression test feeds the tool a
config containing the quiet flag and checks

33
00:02:07,040 --> 00:02:12,048
that denied files stay unreadable and
unwritable while allowed files stay

34
00:02:12,099 --> 00:02:12,688
accessible.

35
00:02:12,832 --> 00:02:18,048
That's from the pull request itself, and
it was reported in an analysis by Mixed

36
00:02:18,144 --> 00:02:18,608
News.

37
00:02:18,965 --> 00:02:22,485
The second fix is about how Codex finds
bwrap in the first place.

38
00:02:23,005 --> 00:02:29,025
Pull request 51211, merged October 6,
describes it this way: bubblewrap discovery

39
00:02:29,185 --> 00:02:31,745
probes executables before confinement.

40
00:02:32,325 --> 00:02:35,965
At that point, the only exclusion was the
command's current directory.

41
00:02:36,385 --> 00:02:41,325
So a bwrap candidate sitting in some other
writable directory on your PATH was still

42
00:02:41,405 --> 00:02:43,485
eligible to run outside the sandbox.

43
00:02:44,245 --> 00:02:49,625
Now Codex filters the canonical PATH
candidates against the filesystem policy and

44
00:02:49,665 --> 00:02:51,025
the effective user permissions.

45
00:02:51,545 --> 00:02:56,105
That covers writable ancestors, symlinked
roots, and full disk write access.

46
00:02:56,645 --> 00:03:00,625
It keeps protected system installations,
rejects replaceable paths,

47
00:03:00,945 --> 00:03:02,865
and falls back to the bundled bubblewrap.

48
00:03:03,445 --> 00:03:07,505
The tests cover writable bwrap candidates
that are neither probed nor launched,

49
00:03:07,905 --> 00:03:10,705
including when the command runs in a
workspace subdirectory.

50
00:03:11,000 --> 00:03:13,800
Two more sandbox fixes shipped alongside
those.

51
00:03:13,900 --> 00:03:18,920
One fixes Linux sandbox startup when there
are multiple denied files,

52
00:03:18,954 --> 00:03:21,400
number 50059.

53
00:03:21,520 --> 00:03:28,120
The other, 51407, protects the ripgrep
lookup Codex makes while it builds the

54
00:03:28,210 --> 00:03:29,320
sandbox.

55
00:03:29,373 --> 00:03:33,240
Together that's four repairs in the same
area of the release.

56
00:03:33,342 --> 00:03:35,042
Now how to use this.

57
00:03:35,107 --> 00:03:40,042
Upgrade by installing the openai codex
package from npm globally,

58
00:03:40,145 --> 00:03:44,682
pinned to version 0.162.0.

59
00:03:44,842 --> 00:03:48,962
As far as the release notes show, you
don't need to change your config,

60
00:03:49,007 --> 00:03:54,282
because the no config invocation and the
bwrap validation happen inside Codex.

61
00:03:54,458 --> 00:03:57,962
Then, if you want to know whether you were
in the affected group,

62
00:03:58,042 --> 00:03:59,242
run two checks.

63
00:03:59,375 --> 00:04:06,042
First, echo RIPGREP_CONFIG_PATH in your
shell and see whether it's set,

64
00:04:06,082 --> 00:04:09,082
and if it is, look at what flags the file
contains.

65
00:04:09,208 --> 00:04:14,042
Second, use which to see where bwrap
resolves on your PATH,

66
00:04:14,102 --> 00:04:18,682
and check whether any directory ahead of
your system install is writable by your

67
00:04:18,762 --> 00:04:19,402
user.

68
00:04:20,153 --> 00:04:24,113
Which brings us to the caveats, and they
matter, because this isn't a drive by

69
00:04:24,173 --> 00:04:25,073
compromise story.

70
00:04:25,613 --> 00:04:27,933
Both cases need something already on the
machine.

71
00:04:28,313 --> 00:04:34,253
The ripgrep case needs a config file you
pointed RIPGREP_CONFIG_PATH at,

72
00:04:34,693 --> 00:04:36,473
with output suppressing flags in it.

73
00:04:37,193 --> 00:04:42,393
The bubblewrap case needs a writable bwrap
binary on PATH ahead of a protected one.

74
00:04:43,053 --> 00:04:47,313
The Mixed News write up also notes that
the ripgrep test is skipped when no

75
00:04:47,353 --> 00:04:50,433
protected rg executable is available on
the test machine.

76
00:04:51,153 --> 00:04:54,573
We haven't seen anything in the sources
about this being exploited in the wild,

77
00:04:55,033 --> 00:04:58,153
and I'd treat any severity ranking as
interpretation.

78
00:04:58,553 --> 00:05:01,013
The facts are the mechanisms and the
fixes.

79
00:05:01,375 --> 00:05:06,735
One practical note: if you maintain a
shared dev image or a CI runner with a global

80
00:05:06,815 --> 00:05:12,175
ripgrep config and a messy PATH, that's
the combination worth auditing,

81
00:05:12,215 --> 00:05:14,095
whether or not you upgrade today.

82
00:05:14,255 --> 00:05:18,815
And upgrading is still the right move,
since the fix doesn't depend on your config

83
00:05:18,855 --> 00:05:19,615
being clean.

84
00:05:19,925 --> 00:05:21,885
A few smaller things in the same release.

85
00:05:22,305 --> 00:05:26,285
In the agent Command Center, you can now
press p to pin a task.

86
00:05:26,825 --> 00:05:30,705
Pinned tasks go into a shared Pinned
group, when the server supports it.

87
00:05:31,305 --> 00:05:36,205
And URLs are now clickable in approval
headers, questions, MCP prompts,

88
00:05:36,425 --> 00:05:41,405
warnings, banners, and verification
prompts, including when the link wraps across

89
00:05:41,445 --> 00:05:41,745
lines.

90
00:05:42,325 --> 00:05:45,485
If you've ever copied half a URL out of an
approval prompt,

91
00:05:45,905 --> 00:05:46,525
that one's for you.

92
00:05:46,833 --> 00:05:51,873
On the transcript side, you can navigate
and copy transcript blocks with the slash

93
00:05:51,953 --> 00:05:58,113
copy command, use Control Insert to copy a
selection, and tune mouse wheel scrolling

94
00:05:58,177 --> 00:06:03,027
with tui.mouse_scroll_speed in your
config.

95
00:06:03,096 --> 00:06:10,033
For Windows users, apply_patch now
preserves existing CRLF line endings without

96
00:06:10,113 --> 00:06:14,673
any opt in, so patches stop flipping line
endings on files that use them.

97
00:06:14,813 --> 00:06:20,513
Windows also gets a signed PowerShell
installer, restored drive letter file access

98
00:06:20,593 --> 00:06:26,993
on Windows 10, and a fix for archive
checksum verification when PowerShell 7 module

99
00:06:27,060 --> 00:06:30,913
paths were present, which had stopped Get
File Hash from loading.

100
00:06:31,197 --> 00:06:34,197
And one for anyone running against an
overloaded backend.

101
00:06:34,677 --> 00:06:40,177
Codex now honors the server's Retry After
guidance on retryable Responses and

102
00:06:40,217 --> 00:06:43,637
WebSocket failures, instead of retrying on
its own schedule.

103
00:06:44,177 --> 00:06:47,797
That should mean fewer premature failures
when the service is under load.

104
00:06:48,083 --> 00:06:54,803
So the takeaway: upgrade to 0.162.0, check
whether you have a ripgrep config

105
00:06:54,903 --> 00:06:57,683
set, and check what's writable on your
PATH.

106
00:06:57,816 --> 00:07:00,003
Those two checks take under a minute.

107
00:07:00,131 --> 00:07:02,083
That's the changelog for today.