1 00:00:00,280 --> 00:00:05,000 If you've ever wondered what stops a coding agent from quietly phoning home to some 2 00:00:05,060 --> 00:00:10,320 random endpoint, version 0.167.0 has an actual answer. 3 00:00:11,040 --> 00:00:14,760 And before I get into it, thanks to Jellypod AI for sponsoring this episode. 4 00:00:16,219 --> 00:00:21,960 Okay, the security side of Codex CLI 0.167.0, released November 6th. 5 00:00:23,173 --> 00:00:26,993 We covered session management and the daemon flags from this release recently. 6 00:00:27,493 --> 00:00:31,073 This episode is about the other half: enterprise policy controls. 7 00:00:31,713 --> 00:00:32,173 Two things. 8 00:00:32,573 --> 00:00:37,653 Managed network constraints under permissions dot network, and prompt-user command 9 00:00:37,693 --> 00:00:38,033 rules. 10 00:00:38,713 --> 00:00:42,493 Both show up in the release notes as documentation in the app-server README, 11 00:00:42,733 --> 00:00:47,093 tied to pull requests 58182 and 58045. 12 00:00:47,837 --> 00:00:48,997 First, what changed. 13 00:00:49,497 --> 00:00:53,477 The app-server now documents managed network requirements under the 14 00:00:53,537 --> 00:00:55,456 permissions.network section. 15 00:00:56,037 --> 00:01:00,257 The idea is that an administrator, not the agent and not the individual user, 16 00:01:00,657 --> 00:01:02,857 defines the outbound network boundary. 17 00:01:03,636 --> 00:01:05,757 The second piece is the prompt-user rule. 18 00:01:06,377 --> 00:01:10,757 The release notes describe it as command rules that require fresh human approval. 19 00:01:11,377 --> 00:01:15,857 The pull request title is, quote, add managed command checkpoints requiring fresh 20 00:01:15,917 --> 00:01:16,737 human approval. 21 00:01:18,298 --> 00:01:19,018 Why does that matter? 22 00:01:20,518 --> 00:01:23,338 An agent can run shell commands and make network calls. 23 00:01:23,758 --> 00:01:27,358 In a regulated environment, you can't rely on every developer setting the right 24 00:01:27,438 --> 00:01:28,218 session flag. 25 00:01:28,878 --> 00:01:32,798 And you really don't want a cached approval, one you clicked yes on an hour ago, 26 00:01:33,317 --> 00:01:36,018 quietly covering a command you'd never have approved today. 27 00:01:36,878 --> 00:01:39,878 A prompt-user checkpoint is meant to ask every time. 28 00:01:40,238 --> 00:01:41,778 That's the point of the word fresh. 29 00:01:42,673 --> 00:01:43,493 How would you use it? 30 00:01:44,233 --> 00:01:44,993 The shape is this. 31 00:01:45,333 --> 00:01:50,433 In your managed configuration, you add a permissions.network section that spells out 32 00:01:50,473 --> 00:01:51,513 your network requirements. 33 00:01:52,053 --> 00:01:56,413 Then, in your command rules, you mark the sensitive commands with prompt-user. 34 00:01:57,433 --> 00:02:01,293 I'll be upfront: the release notes only point to the app-server README for the exact 35 00:02:01,353 --> 00:02:03,773 syntax, and I'm not going to invent keys for you. 36 00:02:04,373 --> 00:02:07,573 So read that README, and test on a throwaway repo first. 37 00:02:08,358 --> 00:02:14,138 What you'll see in the terminal is an approval prompt, and 0.167.0 improved that 38 00:02:14,178 --> 00:02:14,758 experience. 39 00:02:15,498 --> 00:02:21,258 Pull request 58281 lets you expand patch details directly in the transcript while an 40 00:02:21,298 --> 00:02:22,498 approval prompt is open. 41 00:02:23,838 --> 00:02:28,118 So you can actually read the diff before you say yes, instead of approving blind. 42 00:02:28,677 --> 00:02:30,377 There's a related fix worth knowing. 43 00:02:30,977 --> 00:02:34,077 Network approval prompts now close when their requests end, 44 00:02:34,337 --> 00:02:37,777 and concurrent requests to the same endpoint prompt one at a time. 45 00:02:38,797 --> 00:02:42,997 That's pull requests 58350 and 58351. 46 00:02:43,777 --> 00:02:46,877 Before, overlapping prompts meant you could approve something stale, 47 00:02:47,117 --> 00:02:48,177 or click the wrong one. 48 00:02:49,237 --> 00:02:52,717 Serializing them per endpoint is a small change with real safety value. 49 00:02:53,403 --> 00:02:55,183 Now the caveats. 50 00:02:55,903 --> 00:03:00,043 First, a checkpoint that requires a human needs a human. 51 00:03:00,733 --> 00:03:05,813 My interpretation, not something the notes say: if you run Codex in an unattended 52 00:03:05,893 --> 00:03:10,713 job, a prompt-user rule will probably leave that run waiting for someone. 53 00:03:11,233 --> 00:03:14,173 So test your CI path before you roll the rule out. 54 00:03:15,005 --> 00:03:18,245 Second, network policy is only as good as its list. 55 00:03:19,045 --> 00:03:22,605 If you're too strict, expect provider calls or tool lookups to fail, 56 00:03:23,165 --> 00:03:26,865 and the failure may look like a flaky tool rather than a policy block. 57 00:03:27,385 --> 00:03:31,505 That's an inference on my part, so check your logs when something odd happens. 58 00:03:32,625 --> 00:03:34,345 Roll out narrow, then widen. 59 00:03:35,147 --> 00:03:36,707 A few smaller things in this release. 60 00:03:36,987 --> 00:03:41,707 Control plus L now clears the terminal display, but your earlier messages are still 61 00:03:41,747 --> 00:03:43,267 reachable with Control plus T. 62 00:03:43,987 --> 00:03:44,347 Handy. 63 00:03:44,887 --> 00:03:49,247 Deleting text that exposes a leading exclamation mark keeps your draft in chat mode 64 00:03:49,307 --> 00:03:50,707 instead of flipping into shell mode. 65 00:03:51,287 --> 00:03:55,367 And automatic context compaction now accounts for retained output from failed 66 00:03:55,407 --> 00:03:59,597 responses and missing token usage data, so long sessions should compact more 67 00:03:59,697 --> 00:04:00,137 accurately. 68 00:04:00,880 --> 00:04:06,640 One more note: there are 0.169.0 alpha builds out, but 69 00:04:06,900 --> 00:04:10,120 0.167.0 is still tagged latest. 70 00:04:10,960 --> 00:04:15,740 So if you manage Codex for a team, the practical homework is simple. 71 00:04:16,420 --> 00:04:21,260 Read the app-server README, pick one command you'd never want auto-approved, 72 00:04:21,480 --> 00:04:22,740 and put a checkpoint on it. 73 00:04:24,120 --> 00:04:25,100 That's the whole episode. 74 00:04:25,680 --> 00:04:28,340 Thanks again to Jellypod AI, and we'll see you tomorrow.