Codex CLI 0.169: codex exec Trust, Side Chats and Model Providers

Last updated: November 13, 2026

Codex CLI 0.169.0 changes what codex exec does in a directory you have not trusted: it now "keeps project configuration and MCP servers disabled in untrusted directories, even with --sandbox workspace-write", and a new --trust flag saves trust explicitly. If a CI job or script runs codex exec in a fresh checkout and relies on the repo's .codex/config.toml or its MCP servers, check it before you upgrade. OpenAI shipped 0.168.0 and 0.169.0 within hours of each other on November 13, 2026, and this post covers both, from the 0.169.0 and 0.168.0 release notes and the 0.169.0 binary from npm.

codex exec and untrusted directories (0.169.0)#

The release notes list this under bug fixes: "codex exec keeps project configuration and MCP servers disabled in untrusted directories, even with --sandbox workspace-write. Use --trust with codex exec ... to explicitly save project trust." The point is that a sandbox mode is not the same as trusting the repository: a writable sandbox no longer implies that the checkout's own config and MCP commands get to run.

The 0.169.0 help text for the new flag:

--trust
    Save trust for this project and future chats, including MCP commands outside the sandbox.
    Persists even with --ephemeral. Does not override an explicitly untrusted project

I ran codex exec --skip-git-repo-check --sandbox workspace-write --trust "say ok" from an empty scratch project with no sign-in. The run itself stalled at authentication, but the flag had already done its work: ~/.codex/config.toml gained

[projects."/path/to/proj"]
trust_level = "trusted"

with my scratch path in place of /path/to/proj. The same command without --trust wrote nothing. I could not observe the model side of the change without signing in, so the "project configuration and MCP servers disabled" behavior is from the release notes, not my run.

%% title: What codex exec loads from a project in Codex CLI 0.169.0
flowchart TD
  A[codex exec in a directory] --> B{Project trusted?}
  B -->|Yes| C[Project config and MCP servers load]
  B -->|No| D{--trust passed?}
  D -->|Yes| E[Trust saved to config.toml, project config and MCP load]
  D -->|No| F[Project config and MCP servers stay disabled, even with --sandbox workspace-write]
  B -->|Explicitly untrusted| G[--trust does not override it]

What to do:

• CI on repos you control: add --trust to the codex exec call, or pre-seed the [projects."<path>"] entry in the runner's config.toml. Our codex exec CI guide covers the rest of the headless setup.
• CI on code you do not control (pull requests from forks, third-party repos): leave it off. This change is the protection you want there, because "including MCP commands outside the sandbox" is exactly what an untrusted repo should not get.
• Explicitly untrusted projects stay untrusted. Per the help text, --trust "does not override an explicitly untrusted project".

Also in 0.169.0#

• Multiple side-chat tabs in the opt-in terminal workspace, switchable with keyboard or mouse, and saved local side chats reopen after a restart.
• Search older tasks in the agent command center by name, prompt preview or working directory.
• "Collapse turn details" in the full-screen transcript folds completed activity under each prompt while keeping answers visible.
• Custom gateway onboarding can create a provider during sign-in and use a device code over SSH or without a local browser. In the 0.169.0 binary the related feature, gateway_setup_wizard, is listed as stable and off by default.
• Ctrl+S in the report editor saves a diagnostic ZIP locally, even when uploads are disabled.
• "Yes, clear context and implement" now hands the full approved plan to the fresh session and keeps the current session open if the handoff fails.

What 0.168.0 added#

• A model provider picker. "Browse model providers under Sessions → Model providers and choose the default for new chats." Open and resumed chats keep their saved provider after you change the default. If you configure providers by hand today, our Codex custom model providers guide covers the config.toml side.
• The side-chat workspace, behind features.tui_workspace. codex features list on 0.169.0 shows it as "under development" and off by default.
• Animated GIFs from image generation, behind features.image_generation_animation (also "under development" in 0.169.0), "with optional frame count and timing controls".
• Terminal notifications over OSC 777 with tui.notification_method = "osc777".
• Audio attachments when using an audio-capable model.

The 0.168.0 fixes worth knowing: local history and resume pickers now filter new threads by the signed-in ChatGPT account, and steering messages reach running turns during the final transcript save.

Upgrade checklist#

1. Grep your CI for codex exec and decide, per job, whether the repo is trusted. Add --trust only where it is.
2. If a job depended on project MCP servers, run it once on 0.169.0 and confirm the tools are present.
3. Try the side-chat workspace and the provider picker on a laptop before rolling them out; both feature flags are still marked under development.

For the release before these, see Codex CLI 0.164: presets and inline model permissions, and for the background server that codex agents --no-daemon avoids, how to turn off the Codex daemon.

FAQ#

Why does codex exec ignore my project config and MCP servers?#

Since Codex CLI 0.169.0, codex exec keeps project configuration and MCP servers disabled in untrusted directories, even with --sandbox workspace-write. Pass --trust to save trust for the project, or trust it from the interactive CLI first.

What does codex exec --trust do?#

Per the 0.169.0 help text, it saves trust for this project and future chats, including MCP commands outside the sandbox, persists even with --ephemeral, and does not override an explicitly untrusted project. In our test it wrote trust_level = "trusted" for the project path to ~/.codex/config.toml.

How do I turn on the Codex side chat workspace?#

Enable the tui_workspace feature, which 0.168.0 added and 0.169.0 lists as under development and off by default. 0.169.0 adds multiple side-chat tabs and reopening saved local side chats after a restart.

When did Codex CLI 0.168 and 0.169 ship?#

Both on November 13, 2026: 0.168.0 at 03:54 UTC and 0.169.0 at 08:37 UTC per the GitHub release pages, with npm publish times a few minutes later.

Sources#

• Codex CLI 0.169.0 release notes - November 13, 2026
• Codex CLI 0.168.0 release notes - November 13, 2026
• @openai/codex on npm - version 0.169.0, the binary tested here

Continue Reading#

• Codex exec in CI - the headless setup this change affects
• Codex CLI 0.164: Presets and Inline Model Permissions - the previous release post
• Codex CLI Background Daemon: How to Turn It Off - --no-daemon and daemon_auto_start