Codex Gets Enterprise OAuth and Smoother Agent Approvals
This episode breaks down the latest Codex Rust release, including support for confidential OAuth client secrets in MCP setups, so autonomous agents can authenticate with enterprise systems without browser-based login loops. It also covers fixes for Guardian review handling, elevated terminal approval, bearer token protection for WebSocket exec servers, and a handful of usability improvements in the fullscreen TUI.
Chapter 1
Confidential MCP Auth Landed in Codex 0.158.0
Ethan Park
If you have ever tried hooking up an enterprise tool to an autonomous coding agent, you probably ran face first into a wall about five minutes in.
Maya
Oh, the classic OAuth redirect loop of doom. Where it tries to open a browser window on a headless remote server and just sits there forever.
Ethan Park
Every single time. Well, Jellypod helps make tracking these daily changelogs possible, and in Codex rust version 0.158.0, OpenAI quietly dropped a fix for this exact problem. In the release notes, they added support for pre registered OAuth client secrets via a new flag on the command line: codex mcp add with oauth client secret.
Maya
Wait, so Model Context Protocol servers can finally do confidential client authentication directly in the tool?
Ethan Park
Exactly. Because up until now, MCP setups mostly assumed, you know, a desktop user sitting there clicking allow, or a simple public client setup.
Maya
Right, like PKCE, Proof Key for Code Exchange. Which, if you think about it, makes total sense for a person in a browser. You generate a secret on the fly, you bounce through Okta or Azure AD, the browser handles your cookie, and you get back a short lived token. But, an autonomous agent running in a terminal doesn't have a human eyes session attached to it.
Ethan Park
And enterprise security teams hate public client flows for backend services anyway. If you go to corporate IT and say, hey, I need an automated script to talk to our internal database API via MCP, they will flatly refuse to allow a public client without a pre shared secret.
Maya
They want a confidential client. A real, pre registered application identity with a stored secret that can issue tokens non interactively.
Ethan Park
Precisely. So the new syntax lets you run codex mcp add, give it the server name, specify the url endpoint, and then pass oauth client id and oauth client secret directly.
Maya
Though, please tell me people aren't literally pasting their production corporate client secrets into raw bash commands.
Ethan Park
You know someone will! But yes, huge operational warning here. If you paste oauth client secret right into the shell, that secret lives in your dot bash history or your zsh history forever. Anyone with read access to your dotfiles or your terminal session has your service account. Codex does offer interactive prompt capture, or environment variables, which is what you really ought to be using if you share your machine or log shell sessions.
Maya
Treat your command history like a public document, folks. But architecturally, this unblocks a lot of real corporate internal tool integrations that were just stalled out before.
Chapter 2
Smarter Guardian Approvals and Fullscreen TUI Ergonomics
Ethan Park
Now, the auth change wasn't the only big fix under the hood. There was this infuriating edge case in pull request 47819 around Guardian reviews.
Maya
Oh, I read that pull request description! It was so funny and so painful. You know how when Codex is about to do something dangerous, it pauses and waits for Guardian authorization or user approval?
Ethan Park
Right. It is sitting there waiting for you to review a proposed action.
Maya
And naturally, because you are human, you might type something like, wait, what is the current test status? Or, did the lint pass? And in 0.157, the system would look at your new text, treat it as a state invalidation, and completely abort the pending task execution!
Ethan Park
It just wiped the board. You asked a status question, and Codex threw out the entire run. With pull request 47819, the approval reviews now retry when new user input arrives. So the pending action stays alive in the queue while the agent absorbs the new context.
Maya
That is such a relief for anyone who talks to their agent while it is working. Speaking of approvals though, they also tightened up terminal permissions, didn't they?
Ethan Park
Yeah, pull request 47799. Terminal input approval is now enabled by default whenever commands run with elevated permissions. And tied right into that, pull requests 47601 and 47648 added bearer token authentication for exec server WebSocket connections.
Maya
That is actually huge for remote dev containers and shared compute boxes. If your background execution server is listening on a WebSocket socket, you cannot just leave it wide open to any local process on the machine.
Ethan Park
Exactly. You need a bearer token isolating that socket. And on the surface side, for anyone living in the fullscreen terminal UI, pull request 47639 finally fixed the clipboard formatting.
Maya
Wait, did they fix the Markdown stripping?
Ethan Park
They did! You now have configurable copy on select and right click paste in the fullscreen TUI, and when you copy text out of the transcript, it actually preserves the Markdown blocks instead of flattening everything into unformatted mush.
Maya
As a tester who copies code snippets out of agent runs twenty times a day, thank goodness. Oh, and Mermaid flowcharts stop crashing on quoted labels and ampersands now too. Little quality of life wins that make the terminal feel like a finished product.
Ethan Park
Small details, but they add up to a much more stable daily driver.