$ the-wire · showcase
Guardian auth survives compaction, update_plan becomes opt-in
By RepoJournal · Filed · About OpenAI
Codex now preserves Guardian authorization across history compaction and moves the update_plan tool behind an opt-in flag, changing how users enable planning and how reviews persist.
Guardian authorization is now preserved across compaction and host-injected context, so model-visible rewrites no longer invalidate a valid review; the fix tracks a host-owned user-message revision separately from conversation history [1]. The update_plan tool is now opt-in: defaulting `tools.update_plan.enabled` to `false` means users must explicitly enable it, and the bundled guidance is stripped from prompts unless the tool is on [2]. MCP server names now support package-style syntax with `:`, `@`, `/`, and `.`, so names like `npm:@modelcontextprotocol/server-sequential.thinking` work across CLI and runtime, including OAuth lookup and config recovery hints [3]. The TUI now renders backend-owned rate-limit banners above the composer when they match the authenticated account, with actions for usage, credits, and resets, and refreshes usage after limit errors [4]. The MCP naming change was developed in parallel, reinforcing the shift toward package-style server references [5].
Action items
- → Review configs that rely on update_plan being active by default and enable tools.update_plan.enabled explicitly if needed openai/codex [plan]
- → If you use MCP servers with package-style names, verify they still resolve after the naming update openai/codex [monitor]
- → Watch for new rate-limit banners in the TUI to stay informed of usage and plan actions openai/codex [monitor]
References
- [1] Preserve Guardian authorization across history compaction (#41660) ↗ openai/codex
- [2] Make the update_plan tool opt-in ↗ openai/codex
- [3] Support package-style MCP server names (#41700) ↗ openai/codex
- [4] Show actionable rate-limit banners in the TUI ↗ openai/codex
- [5] Support package-style MCP server names ↗ openai/codex