Codex CLI 0.160.0: Projectless Sessions and Saved Permissions

Ethan Park

Picture this. You've got a pile of log files in var log, or a folder of CSVs that isn't a repo and never will be, and you want an agent to help for ten minutes. Thanks to Jellypod for helping make this daily show a reality. Today it's Codex CLI 0.160.0, released October 1st, 2026, and one change in it: pull request 49160, from etraut-openai. The release note reads: start sessions outside a project with workspace defaults when policy permits, and restore saved permissions when resuming.

Maya

Let's unpack that, because it's two changes in one sentence. The first is where you can launch. As this change is described, Codex CLI was built around the idea of a project root. If you started it from your home directory, or from tmp, it had trouble working out which workspace defaults applied. Those defaults are things like rules, skills, and configuration layers. You could hit path errors, or you ended up making a dummy Git repo just to give the tool somewhere to stand.

Ethan Park

And the second change is the one that bites in practice. Say you were in one of those sessions, you granted some permissions over several turns, and then your terminal closed or your connection dropped. When you came back with codex resume, those grants were gone, and you were clicking through the same approvals again. In 0.160.0, the saved permissions are restored when you resume.

Maya

So here's how it looks at the keyboard. You make a scratch directory, say mkdir slash tmp slash scratch, and cd into it. No git init. Then you just run codex. The TUI starts without a project. Per the description of this release, the workspace defaults come from your global configuration, which is the config.toml file inside your home directory's dot codex folder, or from system level configuration under slash etc slash codex.

Ethan Park

That's the practical part. If you've set a default model, a reasoning effort, or a set of allowed skills in your global config, a projectless session picks them up. So the habit is to make sure your global file is what you want, because it's now the only layer in play. There's no repo level config in a scratch directory.

Maya

Then resume. If the session gets interrupted, you run codex resume, which picks up your recent session, or codex resume followed by the session ID to target a specific one. The file and tool permissions you granted earlier come back with it. Say you approved writes in that scratch folder while parsing logs. After a restart you don't re-approve them. It makes a throwaway session behave like a repo session did already.

Ethan Park

Now the caveats, and there are real ones. First, the phrase in the release note: when policy permits. In managed environments, if administrators enforce repository containment through requirements.toml, the expectation is that a projectless launch fails closed. So if you're on a managed machine and codex refuses to start outside a repo, that's probably policy working as intended, not a bug. Talk to whoever owns the configuration.

Maya

Second, and this is the one I'd underline: blast radius. Inside a Git project, the agent is bounded by the repository root. Launch from your home directory and grant broad write access, and that grant now covers your documents, your dotfiles, everything your user can touch. And since those grants persist across resume, a broad approval you made on Monday is still alive when you resume on Wednesday. My advice is to launch from the narrowest directory that works, like a dedicated scratch folder, and grant the narrowest permissions you can.

Ethan Park

Third, the Git based features aren't there. No automatic worktrees, no branch switching, no commit diffing, unless you point the agent at a specific nested repository. If your task is really code change tracking, make it a repo. Projectless is for the jobs where a repo would be overhead: diagnostics, log parsing, file shuffling, scratch scripts.

Maya

One more practical note. 0.160.0 is marked latest on the releases page. There are 0.162.0 alpha builds being cut as we speak, with several published on October 2nd, but those are pre releases. If you want this behavior on a stable channel, 0.160.0 is the one.

Ethan Park

A few smaller items from the same release. Pull request 49105: unsent queued messages in the TUI now resume after a reconnection, once uncertain submissions are resolved. The point is that you don't lose drafts and you don't get duplicate sends after a network blip.

Maya

Also opt in: Guardian reviews can now retrieve earlier user instructions from the conversation history, and carry root context across agent handoffs. That's from pull requests 49036 and 49057. Emphasis on opt in, so nothing changes unless you turn it on.

Ethan Park

Linux users on X11 terminals get something small but nice in fullscreen mode. You can select transcript text and paste it with a middle click, using the primary selection. That applies to supported local X11 terminals. There's also a keyboard accessible Show more action in the agent command center, so you can page back through older tasks.

Maya

On Windows, the sandbox got several fixes. PowerShell fallbacks are repaired, permission repairs on long runtime paths work, and background helpers no longer flash console windows. Under the hood, unused space in the SQLite log database is now reclaimed in the background, and the same release fixed SQLite stalls during connection setup. And explicit provider model catalogs are now treated as authoritative, so unsupported bundled models don't show up in them, and stale entries aren't reused after a refresh failure.

Ethan Park

So the takeaway: update to 0.160.0, cd into a scratch folder, run codex, and see that your global config carries over. Then review what you approve, because it now sticks around. That's the changelog for today.