Codex CLI Worktrees Turn Agent Runs Into Durable Sessions

OpenAI shipped Codex CLI 0.154.0 on September 9, 2026. The obvious headline is that GPT-6 Astra is now available in the model picker and Amazon Bedrock catalogs. The more important developer story is smaller and more operational: Codex is adding experimental worktree support, inline answers during active runs, Windows daemon support, plugin refresh fixes, MCP OAuth handling, and approval-context hardening.

Last updated: September 10, 2026

If you use terminal agents for real repository work, that cluster matters more than another model menu entry. It points to a product direction where an agent session is no longer a disposable chat. It is a durable workspace with isolation, resumability, permissions, plugin state, and review boundaries.

That is the same direction behind Codex CLI Vim mode, Codex /goal workflows, and the broader move toward long-running agent harnesses. The agent is becoming part of the developer workbench.

What Shipped#

The release notes list six new feature groups:

• GPT-6 Astra in the model picker and Bedrock catalogs.
• Experimental worktree support through --worktree and /worktree.
• Inline answers while Codex keeps working.
• Shared background Codex server support for Windows sessions.
• Vim replace mode and better Escape handling.
• Richer copy behavior for responses, status output, and session fields.

The bug-fix section is just as telling. Existing sessions now pick up newly installed plugin tools and refresh skills and hooks after external plugin upgrades or rollbacks. MCP connections coordinate OAuth token refreshes and surface login challenges when refresh fails. Startup avoids running workspace-controlled helpers before trust is established. The macOS sandbox blocks terminal input injection. Remote resume and fork operations preserve saved permissions. Automatic approval reviews better preserve authorization context through compaction and reject approvals invalidated by newer user instructions or answers.

Those are not demo features. They are the kind of details that matter after the first week of using an agent daily.

Worktrees Are the Center of Gravity#

Git worktrees are already one of the best primitives for parallel agent work. They let you keep separate checkouts for separate tasks without cloning the whole repo or forcing every agent through the same working tree. Developers Digest already has a practical guide to Git worktrees for Claude Code and parallel agents, and the same logic applies to Codex.

The reason worktrees matter inside the CLI is control.

If an agent can create an isolated checkout for a new session or fork, browse those sessions, and resume them later, the unit of work becomes more concrete. It is no longer "some conversation that changed my files." It is a session attached to a checkout with a diff, permissions, model choice, plugin state, and history.

That gives teams a cleaner operating model:

1. Start risky or exploratory work in a separate worktree.
2. Let the agent run without polluting the main checkout.
3. Review the diff and session state together.
4. Merge only the useful output.
5. Delete or archive the workspace when the task is done.

This does not remove the need for discipline. Worktrees can still drift. Agents can still touch the wrong files if the scope is loose. But a first-party worktree flow gives the interface a better default than "hope the current checkout is clean."

Inline Answers Change Supervision#

The inline-answer feature is easy to underestimate. Codex can now ask questions while continuing work, and the user can answer with suggested choices or custom text without losing the main draft.

That matters because long agent runs often fail at interruption boundaries. The agent discovers ambiguity, asks a question, and the session stops cold. The developer returns later, answers, and the whole run has lost momentum. Or worse, the agent guesses because the interface made clarification too expensive.

Inline answers make supervision feel less like a modal interruption. The agent can keep gathering context, running safe checks, or drafting surrounding changes while the user resolves a decision. For real work, that is closer to how a teammate behaves: keep moving on reversible parts, stop only where a decision is genuinely blocking.

The hard part is policy. If a user gives a new answer, any older approval that depended on the previous assumption may be invalid. Codex 0.154.0 explicitly says automatic approval reviews now reject approvals invalidated by new user instructions or answers. That is the right coupling. Inline answers only work if the permission model understands that answers can change the security context.

The Security Fixes Are Product Direction#

The release also includes several security-adjacent fixes that should not be buried:

• Startup avoids running workspace-controlled helpers before trust is established.
• The macOS sandbox blocks terminal input injection.
• MCP OAuth refreshes coordinate across connections and expose login challenges instead of replaying rejected tool calls.
• Remote resume and fork operations preserve saved permissions.
• Approval reviews preserve authorization context through compaction.

This is exactly the shape described in AI agent containment needs a capability ledger. Agent safety is not one prompt, one sandbox, or one approval screen. It is a ledger of what the agent could read, write, run, call, remember, resume, and escalate.

Worktrees help with filesystem isolation. OAuth handling helps with external-tool identity. Approval-context preservation helps with review integrity. Plugin refresh behavior helps sessions stay honest about the tools they can actually call. None of these is sufficient alone. Together, they make the session boundary more factual.

That is the bar terminal agents need to clear.

Demand Signal: Real, But Not a Search Trend Yet#

The velocity signal is mostly product-driven right now. GitHub's API showed the openai/codex repository at more than 123,000 stars and active updates on September 10, 2026. Hacker News search for recent Codex CLI items showed related discussion but not a breakout thread for this exact release: a September 10 SWE-Bench Pro cost comparison had 1 point, a September 9 LittleSwitch Claude/Codex router post had 2 points and 3 comments, and a September 9 self-hosted company OS with Claude Code and Codex agents had 45 points and 12 comments at fetch time.

Google Trends was checked for Codex CLI, GPT-6 Astra, Claude Code, and AI coding agent, but the Trends endpoint returned HTTP 429. No numeric Google Trends claim is used here.

That means this is not a "everyone is searching for it" post. It is a product-architecture post. The release is worth covering because it changes how agent sessions are managed, not because one keyword spiked.

What to Try#

If you are already using Codex CLI, the practical test is simple:

1. Update Codex CLI.
2. Start a small non-critical task with --worktree or /worktree.
3. Fork or resume it and confirm the checkout boundary is visible.
4. Install or update a plugin and confirm the active session refreshes its tools.
5. Trigger a clarification and see whether inline answers preserve the work.
6. Review the diff as a workspace artifact, not just a transcript artifact.

For teams, pair this with a lightweight policy:

• Every long-running agent task gets its own checkout.
• Permissions are part of the review, not just the setup.
• Tool and plugin changes are logged in the task.
• Clarifying answers that change scope require fresh approval.
• Merged work must include the test or verification output that proves the agent did what it claimed.

That policy sounds boring. It is also how agent work becomes reviewable enough to trust.

Bottom Line#

Codex CLI 0.154.0 is not only a model-picker update.

GPT-6 Astra will get the attention, but worktrees, inline answers, daemon support, plugin refresh, OAuth coordination, trust-before-helper startup, terminal-injection protection, and approval-context preservation are the real developer story.

The next phase of coding agents is session infrastructure. The best terminal agents will not merely produce bigger diffs. They will make each run isolated, resumable, inspectable, and cheap to throw away when it takes the wrong path.

Codex is moving in that direction. What a model like GPT-6 Astra can do inside that harness: it built a full e-commerce site from one prompt, product photography and video hero included, and in the Blender build it drove Codex to assemble a playable 3D game scene before rendering trailers from the same assets.

Continue Reading#

• Codex CLI 0.162: Managed Worktrees and Pinned Tasks - the follow-up where the agent creates and lists its own worktrees
• Durable AI Agent Frameworks Compared - one crashing, two-day-approval run through LangGraph, Mastra, Pydantic AI and the OpenAI Agents SDK
• Codex CLI Vim Mode Is an Ergonomics Signal - why terminal-agent UX details matter
• Codex /goal vs Claude Managed Outcomes - how durable tasks differ across agent products
• Git Worktrees for Claude Code and Parallel Agents - the filesystem primitive behind isolated agent work
• Long-Running Agents Need Harnesses - why stop conditions, logs, and receipts matter
• AI Agent Containment Needs a Capability Ledger - the security model behind trustworthy agent sessions

FAQ#

What changed in Codex CLI 0.154.0?#

Codex CLI 0.154.0 added GPT-6 Astra in the model picker, experimental worktree support, inline answers while Codex keeps working, Windows background-server support, Vim replace mode improvements, richer copy behavior, plugin refresh fixes, MCP OAuth handling, startup trust hardening, macOS terminal-injection protection, and stronger approval-context preservation.

Why do worktrees matter for coding agents?#

Worktrees let each agent task run in an isolated checkout. That makes experiments easier to review, merge, abandon, or resume without polluting the developer's main working tree.

Is this release mainly about GPT-6 Astra?#

No. GPT-6 Astra is the most visible addition, but the more durable change is session infrastructure: worktrees, resumes, permissions, plugin state, OAuth handling, and approval integrity.

Should every agent task use a worktree?#

No. Tiny local edits can stay in the current checkout. Exploratory, long-running, risky, or parallel tasks should usually use a separate worktree so the review boundary is clear.

• Codex CLI Background Daemon: How to Turn It Off - the default-on daemon that arrived in 0.157.0 and the reported workaround

Sources#

• OpenAI Codex CLI 0.154.0 release notes - fetched September 10, 2026
• OpenAI Codex GitHub repository - repository stats fetched September 10, 2026
• Hacker News Algolia search for recent Codex CLI stories - fetched September 10, 2026
• Google Trends Explore request for Codex CLI, GPT-6 Astra, Claude Code, and AI coding agent - blocked with HTTP 429 on September 10, 2026