1 00:00:00,420 --> 00:00:05,680 Quick housekeeping first: thanks to Jellypod for helping make this daily show a 2 00:00:05,740 --> 00:00:06,300 reality. 3 00:00:07,160 --> 00:00:13,820 Now, Codex CLI 0.164.0 shipped on October 23rd, and the 4 00:00:14,060 --> 00:00:19,500 change worth your time is that the Amazon Bedrock setup wizard is now enabled by 5 00:00:19,560 --> 00:00:19,980 default. 6 00:00:21,000 --> 00:00:26,000 If your team runs OpenAI models through Bedrock, this changes how you onboard 7 00:00:26,100 --> 00:00:26,380 people. 8 00:00:27,258 --> 00:00:28,718 Here's the exact behavior. 9 00:00:29,158 --> 00:00:35,038 When Codex detects AWS credentials or an existing AWS configuration on the machine, 10 00:00:35,618 --> 00:00:40,838 the wizard now groups API key entry right next to the other AWS sign in methods. 11 00:00:41,418 --> 00:00:46,678 That means the Bedrock API key, which lives in the AWS_BEARER_TOKEN_BEDROCK 12 00:00:46,718 --> 00:00:51,778 variable, sits beside IAM profile credentials and IAM Identity Center sign in. 13 00:00:52,338 --> 00:00:57,038 The release notes list pull requests 56033 and 56023. 14 00:00:57,618 --> 00:01:02,058 Before this, you had to hand build a custom provider entry in your config.toml, 15 00:01:02,578 --> 00:01:05,578 or chain several config override flags on the command line. 16 00:01:06,258 --> 00:01:08,438 The reason that matters is drift. 17 00:01:09,118 --> 00:01:13,878 Plenty of teams want inference to stay inside their AWS perimeter, 18 00:01:14,478 --> 00:01:17,518 with their own cost allocation tags on the usage. 19 00:01:18,658 --> 00:01:22,798 Getting each developer there used to mean a specific TOML block, 20 00:01:23,378 --> 00:01:30,258 bearer token wiring, and an endpoint mapping, and every one of those is a place for 21 00:01:30,338 --> 00:01:32,398 two laptops to end up different. 22 00:01:33,498 --> 00:01:38,717 The wizard discovers what's already on the machine, so people start from detected 23 00:01:38,838 --> 00:01:41,318 profiles instead of from a copied snippet. 24 00:01:41,940 --> 00:01:46,400 One piece of architecture is worth knowing, because it explains some gotchas later. 25 00:01:47,080 --> 00:01:52,500 Codex doesn't use Bedrock's classic runtime endpoint, the one behind InvokeModel and 26 00:01:52,580 --> 00:01:53,100 Converse. 27 00:01:53,660 --> 00:01:58,200 It talks to the newer Bedrock Mantle endpoint, at bedrock mantle, 28 00:01:58,500 --> 00:02:05,440 then your region, dot api dot aws, with the path slash openai slash v1 slash 29 00:02:05,480 --> 00:02:06,240 responses. 30 00:02:07,020 --> 00:02:12,400 Mantle serves OpenAI compatible Responses and Chat Completions APIs natively. 31 00:02:12,880 --> 00:02:16,300 So the models come through an API shape Codex already speaks. 32 00:02:16,925 --> 00:02:18,265 Now how to use it. 33 00:02:19,185 --> 00:02:25,225 Interactive path: start an unconfigured session, or enter provider setup, 34 00:02:25,785 --> 00:02:31,345 and you get a prompt with detected AWS profiles, or you can paste an API key 35 00:02:31,425 --> 00:02:31,945 directly. 36 00:02:32,625 --> 00:02:34,485 That's the whole workflow for a laptop. 37 00:02:35,562 --> 00:02:40,422 For CI runners, containers, and throwaway sandboxes, there's no wizard, 38 00:02:40,942 --> 00:02:42,962 so you use environment variables. 39 00:02:43,862 --> 00:02:49,122 Set AWS_REGION, for example us east 1, and set 40 00:02:49,342 --> 00:02:54,122 AWS_BEARER_TOKEN_BEDROCK to your key. 41 00:02:55,122 --> 00:03:00,362 Per the brief, Codex checks the bearer token first, and only then falls back to the 42 00:03:00,482 --> 00:03:06,982 standard AWS SDK credential chain: your credentials file, your AWS config, 43 00:03:07,402 --> 00:03:08,682 or instance metadata. 44 00:03:09,280 --> 00:03:13,520 If you'd rather pin it in config, two settings in your user config.toml. 45 00:03:14,040 --> 00:03:18,160 First, model_provider set to the built in Bedrock provider, 46 00:03:18,600 --> 00:03:22,580 whose ID is amazon bedrock, with a hyphen between the two words. 47 00:03:23,040 --> 00:03:29,500 Second, under the table model_providers dot amazon bedrock dot aws, 48 00:03:29,960 --> 00:03:35,840 a region key set to us east 1, again spelled with hyphens. 49 00:03:36,400 --> 00:03:40,160 For a one off run, the same thing works as flags: codex exec, 50 00:03:40,580 --> 00:03:45,700 the skip git repo check flag if you're outside a repo, then c flags setting 51 00:03:45,880 --> 00:03:48,880 model_provider, the region key, and the model. 52 00:03:49,460 --> 00:03:56,260 The Sol model ID is openai dot gpt 5.6 sol, 53 00:03:56,620 --> 00:03:57,840 hyphenated as you'd expect. 54 00:03:58,360 --> 00:04:01,020 Add a prompt like hello and you have a smoke test. 55 00:04:01,695 --> 00:04:05,675 Now the caveats, and the first one will cost somebody an afternoon. 56 00:04:06,555 --> 00:04:08,635 Model availability differs by region. 57 00:04:09,015 --> 00:04:12,635 Sol is available only in us east 1 and us east 2. 58 00:04:13,075 --> 00:04:18,955 Call it in us west 2 and you get an HTTP 404 saying the model does not exist. 59 00:04:19,455 --> 00:04:22,495 Terra and Luna are available in all three of those regions. 60 00:04:22,875 --> 00:04:27,195 So if you see a 404 after a clean setup, check the region before you touch your 61 00:04:27,215 --> 00:04:27,755 credentials. 62 00:04:28,402 --> 00:04:30,542 Related trap: discovery. 63 00:04:31,642 --> 00:04:38,622 If you run aws bedrock list foundation models, you won't see the GPT 5.6 64 00:04:38,682 --> 00:04:42,422 models, because they live only on the Mantle endpoint. 65 00:04:43,582 --> 00:04:49,482 To verify regional access, probe the Mantle models path, slash v1 slash models, 66 00:04:50,002 --> 00:04:55,862 on that regional host using bearer token authentication, or check the model cards in 67 00:04:55,902 --> 00:04:57,082 the Bedrock console. 68 00:04:57,555 --> 00:04:59,215 Third: token lifetime. 69 00:04:59,735 --> 00:05:03,935 Short term API keys generated in the Bedrock console cap at twelve hours, 70 00:05:04,395 --> 00:05:06,275 or when the browser console session ends. 71 00:05:06,735 --> 00:05:08,815 Fine for a demo, wrong for automation. 72 00:05:09,275 --> 00:05:14,655 For automated workflows, generate tokens dynamically with the AWS Bedrock token 73 00:05:14,695 --> 00:05:17,415 generator package, or use IAM roles. 74 00:05:17,875 --> 00:05:22,035 And whichever identity you use needs the AWS managed policy 75 00:05:22,515 --> 00:05:24,495 AmazonBedrockLimitedAccess. 76 00:05:24,935 --> 00:05:28,715 It covers both the runtime API and the Mantle bearer token calls, 77 00:05:29,115 --> 00:05:32,575 so a role scoped only to the classic API will fail here. 78 00:05:33,257 --> 00:05:34,897 Last caveat is budgeting. 79 00:05:35,897 --> 00:05:42,797 A one word hello prompt through Codex on Bedrock used 9,580 tokens in 80 00:05:42,857 --> 00:05:45,657 an example from an AWS community write up. 81 00:05:46,737 --> 00:05:51,577 Codex serializes its system instructions and tool definitions on every turn, 82 00:05:52,117 --> 00:05:57,097 roughly 9,400 to 9,500 tokens before your content. 83 00:05:58,117 --> 00:06:02,977 Put that into your rate limit and cost models, especially if you run many short exec 84 00:06:03,077 --> 00:06:03,437 calls. 85 00:06:04,152 --> 00:06:06,052 A few smaller items from the same release. 86 00:06:06,552 --> 00:06:11,692 On Windows, HTTPS and WebSocket connections now answer proxy authentication 87 00:06:11,752 --> 00:06:15,972 challenges using the signed in user's Negotiate or NTLM identity, 88 00:06:16,332 --> 00:06:18,352 which targets corporate firewall failures. 89 00:06:18,832 --> 00:06:23,472 On macOS, the sandbox now handles case variant metadata paths and replaceable 90 00:06:23,572 --> 00:06:25,572 symlinks used to locate executables. 91 00:06:26,152 --> 00:06:30,252 Resuming a session whose history was compressed now finds that history and restores 92 00:06:30,292 --> 00:06:33,312 saved thread settings instead of falling back to global defaults. 93 00:06:33,732 --> 00:06:37,932 And the app server daemon prunes unused installs and bounds its log growth. 94 00:06:38,590 --> 00:06:40,530 One more, on the desktop app. 95 00:06:41,110 --> 00:06:47,410 A GitHub issue tracked bundled Node.js runtimes lagging behind the October 21st Node 96 00:06:47,510 --> 00:06:51,510 security release, version 24.22.1. 97 00:06:52,250 --> 00:06:59,090 One user on desktop build 26.1021.22027 reported 98 00:06:59,210 --> 00:07:04,570 both the primary and the Computer Use runtimes on 24.22.1. 99 00:07:05,410 --> 00:07:10,470 But other reports in that thread were mixed: one still saw the primary bundle on 100 00:07:10,670 --> 00:07:17,650 24.19.0, and as of the last check we saw there was no maintainer confirmation in the 101 00:07:17,690 --> 00:07:18,010 issue. 102 00:07:18,630 --> 00:07:21,590 So check your own runtime versions rather than assume. 103 00:07:22,470 --> 00:07:23,730 That's the changelog for today.