1
00:00:00,280 --> 00:00:01,300
Hey, it's Ethan.

2
00:00:02,000 --> 00:00:05,560
Quick thanks to Jellypod for helping make
this daily show a reality.

3
00:00:06,360 --> 00:00:10,340
Today is about the thing that happens when
you're deep in a Codex session,

4
00:00:10,940 --> 00:00:14,700
everything's going fine, and then a turn
just dies on a safety block.

5
00:00:15,513 --> 00:00:15,973
I'm Maya.

6
00:00:16,313 --> 00:00:18,533
And this connects to a couple of earlier
episodes.

7
00:00:19,013 --> 00:00:23,913
We covered queue automation, standalone
exec packaging, and transcript selection,

8
00:00:24,233 --> 00:00:26,833
all in 0.166.0.

9
00:00:27,393 --> 00:00:31,093
Today's topic is from that same release,
and it's for anyone who has hit a sudden

10
00:00:31,133 --> 00:00:33,213
refusal and lost the thread of their work.

11
00:00:34,218 --> 00:00:34,838
Here's the change.

12
00:00:35,478 --> 00:00:42,338
Codex CLI 0.166.0 adds an interactive
recovery flow for safety triggered policy

13
00:00:42,418 --> 00:00:42,738
blocks.

14
00:00:43,558 --> 00:00:50,118
It landed through two pull requests from
etraut-openai, number 57363 and number

15
00:00:50,518 --> 00:00:51,498
57365.

16
00:00:52,378 --> 00:00:56,398
Before this, when a prompt or an execution
turn tripped a safety policy,

17
00:00:56,918 --> 00:00:59,138
the turn ended with a generic rejection.

18
00:00:59,738 --> 00:01:02,258
You got a hard stop and not much to act
on.

19
00:01:02,923 --> 00:01:07,083
The policies in question, per the release
notes, are the biological and cyber

20
00:01:07,163 --> 00:01:08,103
security guardrails.

21
00:01:08,543 --> 00:01:10,083
So this isn't about every error.

22
00:01:10,303 --> 00:01:12,643
It's specifically about those two policy
areas.

23
00:01:13,243 --> 00:01:17,903
And now, when one of them trips, the TUI
does three things instead of just stopping.

24
00:01:18,638 --> 00:01:20,038
First, it explains.

25
00:01:20,858 --> 00:01:26,458
The TUI gives you context on why the
guardrail tripped, instead of an opaque error.

26
00:01:27,418 --> 00:01:32,498
Second, it offers selectable safer
rewrites of your prompt as follow up options.

27
00:01:33,378 --> 00:01:38,138
Third, and this is the part I'd focus on,
picking one of those rewrites forks the

28
00:01:38,278 --> 00:01:40,018
session from before the blocked turn.

29
00:01:40,745 --> 00:01:43,385
Let's slow down on the fork, because
that's the mechanism.

30
00:01:43,925 --> 00:01:48,065
When you pick a recommended rewrite, Codex
doesn't append a new message after the

31
00:01:48,105 --> 00:01:48,625
refusal.

32
00:01:49,165 --> 00:01:52,725
It branches from the point immediately
before the turn that got blocked.

33
00:01:53,145 --> 00:01:55,705
So the blocked turn isn't in the new
branch's history.

34
00:01:56,265 --> 00:01:59,825
And per the notes, that branch preserves
your unsubmitted composer drafts,

35
00:01:59,945 --> 00:02:03,205
your workspace context, and your
configured model parameters.

36
00:02:03,993 --> 00:02:05,853
That matters for a practical reason.

37
00:02:06,693 --> 00:02:09,792
Think about the kind of work that tends to
brush against these guardrails.

38
00:02:10,412 --> 00:02:13,933
Testing penetration tools, writing network
discovery scripts,

39
00:02:14,433 --> 00:02:16,013
parsing sensitive system files.

40
00:02:16,713 --> 00:02:20,933
Those are legitimate developer tasks that
can look risky to a policy layer.

41
00:02:21,673 --> 00:02:26,533
Previously, a block there could stall the
whole thread, or leave denial artifacts

42
00:02:26,593 --> 00:02:27,773
sitting in the context window.

43
00:02:28,363 --> 00:02:31,043
And I want to separate fact from
interpretation here.

44
00:02:31,543 --> 00:02:36,643
The fact, from the release notes, is that
the branch starts before the blocked turn

45
00:02:36,863 --> 00:02:40,023
and keeps your drafts, workspace context,
and model settings.

46
00:02:40,823 --> 00:02:46,323
My interpretation is that this keeps
refusal text out of the context the model sees

47
00:02:46,363 --> 00:02:50,803
going forward, which is why the notes
frame it as preventing context poisoning.

48
00:02:51,503 --> 00:02:56,043
The practical upside is you don't hand
edit a transcript or rebuild a long prompt

49
00:02:56,083 --> 00:02:56,643
from scratch.

50
00:02:57,543 --> 00:02:59,223
So what do you actually do with it?

51
00:02:59,783 --> 00:03:00,643
The workflow is short.

52
00:03:01,143 --> 00:03:02,443
One, work as usual.

53
00:03:02,903 --> 00:03:06,223
Two, when a turn gets blocked, read the
explanation.

54
00:03:06,923 --> 00:03:11,943
Treat it as information about what in your
request or in the execution turn crossed

55
00:03:11,963 --> 00:03:12,363
the line.

56
00:03:12,903 --> 00:03:17,983
Three, look at the safer rewrite options
the TUI surfaces and pick the one closest

57
00:03:18,023 --> 00:03:19,063
to what you actually need.

58
00:03:19,623 --> 00:03:21,543
Four, keep going on the new branch.

59
00:03:22,337 --> 00:03:25,297
The reading step is the one people will
skip, so I'd push on it.

60
00:03:25,897 --> 00:03:28,137
The explanation tells you what tripped.

61
00:03:28,597 --> 00:03:31,997
If your prompt was a broad ask like scan
this entire network,

62
00:03:32,457 --> 00:03:33,917
the rewrite may narrow it.

63
00:03:34,537 --> 00:03:38,937
Use that to tighten how you phrase the
next request, so you hit fewer blocks over

64
00:03:38,977 --> 00:03:39,837
the life of the project.

65
00:03:40,443 --> 00:03:42,143
Now, the caveats.

66
00:03:42,743 --> 00:03:45,883
The first one is about what the rewrites
contain.

67
00:03:46,623 --> 00:03:51,563
The notes say these safer prompts are
automatically stripped of patterns that

68
00:03:51,743 --> 00:03:57,123
trigger raw system commands, external
skill execution, app integrations,

69
00:03:57,363 --> 00:03:58,983
or plugin side effects.

70
00:03:59,968 --> 00:04:02,368
Right, and that has a direct consequence.

71
00:04:02,948 --> 00:04:08,288
If your original workflow depended on a
skill, a plugin, or an app integration doing

72
00:04:08,328 --> 00:04:11,748
something, the rewritten prompt is not
going to do that part.

73
00:04:12,268 --> 00:04:16,428
So don't assume the branch is the same
task with the scary bits removed.

74
00:04:17,047 --> 00:04:21,287
Read the rewrite before you accept it, and
check that it still asks for what you

75
00:04:21,328 --> 00:04:21,528
need.

76
00:04:22,008 --> 00:04:26,368
If it doesn't, you may need to take that
step manually, or rethink the task.

77
00:04:27,527 --> 00:04:28,267
Second caveat.

78
00:04:28,827 --> 00:04:31,347
This is a recovery tool, not an override.

79
00:04:32,127 --> 00:04:36,827
Nothing in the release notes says the
policy changes, or that the blocked request

80
00:04:36,947 --> 00:04:37,487
gets through.

81
00:04:38,387 --> 00:04:41,827
It gives you a clean path to a different,
safer request.

82
00:04:42,667 --> 00:04:48,007
If your task truly sits inside a
restricted area, you should expect the rewrites to

83
00:04:48,107 --> 00:04:49,127
steer away from it.

84
00:04:49,787 --> 00:04:51,587
And third, I'll be straightforward.

85
00:04:51,947 --> 00:04:56,127
The notes we have don't spell out specific
key bindings or flags for the selector.

86
00:04:56,607 --> 00:05:00,767
So when you update, just trigger a block
in a throwaway session and see what the TUI

87
00:05:00,847 --> 00:05:02,727
shows you, rather than guessing at
commands.

88
00:05:03,267 --> 00:05:05,147
That's a better use of two minutes than
assuming.

89
00:05:05,890 --> 00:05:09,110
A few smaller things in 0.166.0 worth a
mention.

90
00:05:09,790 --> 00:05:13,510
First, Markdown rendering is now
consistent across TUI elements.

91
00:05:13,830 --> 00:05:17,790
That's pull requests 57259 and 57292.

92
00:05:18,330 --> 00:05:23,330
Async question prompts, choice selectors,
and replies now render formatted Markdown

93
00:05:23,390 --> 00:05:25,070
instead of showing raw formatting tags.

94
00:05:25,938 --> 00:05:30,598
Second, and this one has a real cost
angle: pull request 57839.

95
00:05:31,178 --> 00:05:35,678
Forking or resuming a thread now keeps the
flag that says token usage already

96
00:05:35,738 --> 00:05:36,958
includes reasoning tokens.

97
00:05:37,378 --> 00:05:41,358
Without it, reasoning tokens were counted
twice, which caused premature,

98
00:05:41,578 --> 00:05:43,158
aggressive context compaction.

99
00:05:43,798 --> 00:05:47,378
If you've noticed long resumed sessions
compacting earlier than they should,

100
00:05:47,938 --> 00:05:50,018
that's the bug, and it's fixed in this
release.

101
00:05:50,705 --> 00:05:54,805
It also fits nicely with today's topic,
since the new recovery flow forks sessions,

102
00:05:55,145 --> 00:05:57,765
and forks are exactly where that flag
needed to survive.

103
00:05:58,310 --> 00:06:03,430
Third, pull request 57513 changes the npm
wrapper.

104
00:06:04,210 --> 00:06:10,170
It now uses execve, which replaces the
wrapper Node process with the native binary

105
00:06:10,270 --> 00:06:10,770
directly.

106
00:06:11,590 --> 00:06:15,590
The stated benefits are faster startup and
proper OS signal handling.

107
00:06:16,410 --> 00:06:20,650
If you run Codex under scripts or process
supervisors that send signals,

108
00:06:21,070 --> 00:06:21,830
that's worth knowing.

109
00:06:22,467 --> 00:06:25,567
And fourth, pull request 57820.

110
00:06:26,127 --> 00:06:31,647
You can now cleanly use /quit or /exit
from the TUI even when you're completely

111
00:06:31,727 --> 00:06:33,187
offline, without it freezing.

112
00:06:33,827 --> 00:06:37,907
Small, but anyone who has been stuck in a
terminal on a flaky train connection will

113
00:06:37,967 --> 00:06:38,727
appreciate it.

114
00:06:39,403 --> 00:06:46,083
So the takeaway: update to 0.166.0, and
the next time a safety block interrupts you,

115
00:06:46,483 --> 00:06:49,483
read the explanation, check what the safer
rewrite dropped,

116
00:06:49,843 --> 00:06:51,123
and continue on the fork.

117
00:06:51,843 --> 00:06:52,763
That's the show for today.