OpenAI Codex CLI rust-v0.161.0

New Features

• GPT-6.1 Sol is now the default model in the bundled and Amazon Bedrock catalogs. (#49318, #49339)

• Amazon Bedrock supports multi-agent V2 and Ultra reasoning on compatible models; Bedrock Mantle also accepts AWS GovCloud regions. (#49345, #49813)

• Sign in to MCP servers from an active terminal session with /mcp login <name>. (#49290)

• Choose your microphone, speaker, and microphone input channels for voice conversations, with preferences saved locally. (#49437, #49836)

• Daybreak is opt-in through --enable cli_daybreak or features.cli_daybreak=true; daybreak=true alone is insufficient. By default, controls and indicators are hidden, /daybreak is unavailable, and automatic Cyber routing is omitted—even for saved Daybreak threads. Saved preferences remain intact. Opt-in routing requires eligible ChatGPT sign-in, the OpenAI provider, and advertised model/program support. (#49856, #49858, #49859, #49861, #51207)

• Select a Cyber access program per turn with codex exec --cyber-access-program or the TypeScript SDK’s cyberAccessProgram option. The explicit exec override remains available with cli_daybreak disabled and leaves the saved choice unchanged. (#49939, #51207)

Bug Fixes

• Approved filesystem escalation can now grant broader write access while preserving denied reads and network restrictions. Background tasks retain their originating turn’s permissions. (#49353, #49880)

• Explicit launch permissions survive terminal reconnects and new sessions, while implicit client settings no longer overwrite server or saved-thread web-search settings. (#49809, #49799)

• Elevated Windows terminal sessions can start using an embedded server, and sandboxed PowerShell preserves relative paths beneath protected user profiles. (#49855, #49690)

• Enter correctly submits buffered input after paste detection expires, including in Vim insert mode. (#49810)

• Thread resume includes the latest committed history. Startup detects recoverable SQLite corruption earlier and preserves damaged databases as backups. (#49599, #49701)

• Responses retries and WebSocket-to-HTTP fallback honor server retry guidance, reducing premature failures during overload. (#49441)

Documentation

• Authentication guidance now accounts for keyring storage instead of implying credentials always reside in auth.json. (#49361)

Chores

• Publishing an older alpha or hotfix no longer moves npm alpha tags backward. (#49704)

Changelog

Full Changelog: https://github.com/openai/codex/compare/rust-v0.160.0...rust-v0.161.0

• #49246 Use executable fixture copying in the bundled bwrap test @felixxia-oai

• #49257 Allow Guardian cached approvals with incomplete root context @felixxia-oai

• #49260 Restrict enterprise MCP auth and fail closed on config refresh @nicksteele-oai

• #49261 Preserve Windows sandbox runner launch errors @zm-oai

• #49262 Trace turn phases and correlate accepted input with turns @jif-oai

• #49266 Remove the remote agent message board client README @jif-oai

• #49267 Support remote agent message boards in multi-agent sessions @jif-oai

• #49269 Preserve thread overrides and cloud policy validity during config reloads @nicksteele-oai

• #49275 Isolate realtime conversation tests from Responses prewarm connections @felixxia-oai

• #49276 Enable enterprise MCP sign-in and account-scoped grant cleanup @nicksteele-oai

• #49277 Avoid a turn teardown race in the Guardian agent message test @felixxia-oai

• #49280 Restrict capability roots to captured turn environments @miz-openai

• #49286 Model exec-server session attachment state as an enum @jif-oai

• #49290 Add /mcp login <name> to the TUI @nicksteele-oai

• #49294 Record Guardian context mode in review and classification telemetry @felixxia-oai

• #49295 Simplify configuration fingerprint canonicalization @jif-oai

• #49297 Scan the session index backwards for batch thread name lookups @jif-oai

• #49300 Compact the inline hidden tag buffer once per chunk @jif-oai

• #49305 Batch metadata reads when resolving thread names @jif-oai

• #49308 Run piped legacy Windows sandbox processes without a console @etraut-openai

• #49312 Notify parent agents when Guardian stops a subagent @jif-oai

• #49316 Bump taiki-e/install-action to v2.87.21 in CI setup @jgershen-oai

• #49318 Add GPT-6.1 Sol as the default catalog model @andrewgu-oai

• #49325 Retry Windows sandbox runner logon once on error 1056 @zm-oai

• #49330 Keep remote control reconnect backoff capped during sustained failures @yansenzhou-oai

• #49332 Clean up canceled exec-server RPC requests immediately @jif-oai

• #49339 Add GPT-6.1 Sol to Bedrock catalogs and make it the default @celia-oai

• #49345 Enable multi-agent V2 and Ultra reasoning on Amazon Bedrock @celia-oai

• #49353 Allow approved filesystem escalation while preserving denied reads @viyatb-oai

• #49357 Continue Markdown blockquotes when pasting multiline text @bc-openai

• #49360 Carry shell invocation metadata and report executor PATH directories @anp-oai

• #49361 Clarify credential storage wording across authentication UI and docs @celia-oai

• #49369 Update Bedrock GPT-6 Sol catalog tests to expect multi-agent V2 @celia-oai

• #49379 Compile hook matchers during discovery @jif-oai

• #49384 Track credential storage outcomes and redact sensitive errors @celia-oai

• #49388 Fix Windows path inference for opaque URIs with slash prefixes @dkovalenko-oai

• #49389 Serialize tests that share Windows sandbox accounts @jgershen-oai

• #49392 Add attributed MCP OAuth credential storage telemetry @celia-oai

• #49395 Remove randomized greetings from TUI session headers @etraut-openai

• #49401 Preserve live tool-call metadata across request windows @ningyi-oai

• #49403 Add an experimental flag for bundled tools in login shells @anp-oai

• #49406 Support explicit cyber access programs with OpenAI API keys @julee-oai

• #49407 Recover exec-server sessions after environment info timeouts @vivi