v1.6.0 — gpt-5.6-sol default

Changed

• Default Codex model is now gpt-5.6-sol (GPT-5.6 Sol, GA 2026-07-09). "latest" and unset model both resolve to it; gpt-5.5 is the documented fallback while Sol rolls out across account tiers.
• Recommended model pair advances from gpt-5.5/gpt-5.4 to gpt-5.6-sol/gpt-5.5 across the README, CLI --model help, MCP tool descriptions, and error tips. Explicitly configured model IDs are still forwarded unchanged (recommend-not-enforce policy).
• MODEL_ERROR fallback tips now derive the alternate model from the recommended list with a case-insensitive comparison, so the tip never recommends the model that just failed.
• @openai/codex-sdk exact pin bumped 0.128.0 → 0.144.0 (bundled Codex CLI 0.144.0), required for Sol.

Notes

• If Sol has not reached your Codex account tier yet, pin {"model": "gpt-5.5"} in .reviewbridge.json — the error tip will point you there too.
• 809 tests, lint, typecheck, build all green; live-verified end-to-end with Sol serving plan, code, and precommit reviews.

v1.5.2

Fixes

• Single-mode results now report the serving provider (ISS-023). Previously mode: "single" was the only composition whose results omitted the provider field; it now stamps it like failover and deliberation do.
• Quieter deliberate-deep stderr: the cross-review round no longer re-prints the resolved model narration already emitted by the same provider's primary review.

Both fixes verified live against real Codex + Gemini reviews. 809 tests.

v1.5.1 — Auto-discover a system codex (macOS XProtect fix)

Out-of-box Codex now works on macOS.

The fix

The @openai/codex-sdk spawns its own bundled codex binary — never the one on your PATH — and macOS XProtect false-positively quarantines that bundled copy, so on a fresh install every Codex review failed with PROVIDER_UNAVAILABLE (silently degrading to Gemini in failover/deliberate modes). The only way out was manually setting codex_path.

The bridge now auto-discovers a working system codex and retries. When a review fails PROVIDER_UNAVAILABLE and no explicit codex_path/CODEX_PATH is set, it scans your PATH and the usual install locations (~/.local/bin, /opt/homebrew/bin, /usr/local/bin), verifies the candidate actually runs (--version probe — a quarantined file can exist yet be killed on spawn), swaps it in, logs the substitution on stderr, and retries. Concurrent reviews share a single discovery. An explicit codex_path or CODEX_PATH always wins and disables discovery entirely.

Most macOS users already have a properly-notarized codex from OpenAI's standalone installer — the bridge now finds it instead of making you diagnose the quarantine maze.

Docs

• codex_path and the auto-discovery behavior are now documented in the README (config reference + troubleshooting).

Verified live against the real failure path; 807 tests passing.

v1.5.0 — Deliberation Hardening

Deliberation Hardening phase: the two-provider (Codex + Gemini) deliberation system is now correct, honest, and visible, plus a critical structured-output fix that unbreaks live Codex reviews.

Critical fix

• Live Codex structured reviews now work. An optional review_mode field had leaked into the model-facing response schema; OpenAI structured outputs reject any schema whose required omits a property, so every live Codex plan/code/precommit review was failing (silently degrading to Gemini). Fixed and locked with a recursive schema-validation test. This regression only ever existed on unreleased main — but if you were seeing Codex silently fall back to Gemini, upgrade.

New features

• Per-call deliberation toggle — --deliberate / --no-deliberate (CLI) and a deliberate input (MCP) to force or skip two-provider review for a single call, regardless of configured mode.
• review_mode in every result — single / failover / deliberate / deliberate-deep, so you can always tell which composition served a review.
• Semantic cross-provider agreement matching — findings the two providers both flag now actually merge into agreed[] (previously exact file:line:category matching left it near-empty). Uses a line-window + category-aware match derived from real two-provider data; no duplicates across agreed/divergent.
• Session ownership routing + cross-provider guard — a session created by one provider is routed back to it on resume, and resuming under a backend that doesn't serve that provider is rejected with a clear message instead of failing cryptically.

Fixes & polish

• Diff validation accepts binary-only and rename-only git diffs.
• Deliberate-deep cross-review slices the subject to the referenced files (bounded cost) and fails cleanly when still over budget.
• MODEL_ERROR now gives a distinct, accurate tip when the rejected model differs from the one actually sent (a Codex-internal subsystem call), instead of unhelpful "change your model" advice.
• Config audit: removed a dead max_file_size field, wired precommit.auto_diff (with --auto-diff / --no-auto-diff), and the loader now warns on unrecognized config keys instead of silently ignoring them.

Full test suite: 786 passing. Verified end-to-end against live Codex + Gemini.

1.0.0

1.0.0 — the advertised default model finally works end-to-end.

The review SDK ships its own bundled CLI binary at runtime and ignores anything on PATH. Pinning the SDK at 0.104.0 meant the bridge effectively ran a 0.104.0 CLI for the entire 0.3.x train — which outright rejects gpt-5.5. This release pins the SDK exactly to 0.128.0 (matching the current platform CLI), bundles two long-overdue reliability fixes, and aligns the MCP-advertised version with the package version.

What's in 1.0.0

• feat: bump review SDK to bundle current CLI (306b4c1) — @openai/codex-sdk: 0.128.0 exact-pin. Adds a regression test asserting the SDK + bundled CLI versions stay in lockstep.
• fix: mark session failed on multi-chunk partial failure (T-001) (a3b4bc1) — Multi-chunk reviews where chunk 1 succeeded but chunk 2 errored used to leave the session orphaned in_progress. The chunk-1 thread id now flows back on the error and the tool layer marks the session failed atomically.
• fix: wrap saveReview and session completion in a single transaction (T-002) (06ca8ce) — recordSuccess is now atomic. A failed review save will no longer leave the session marked complete with no review row.
• fix: read MCP server version from package.json (fc47e01) — The MCP server self-advertised '0.1.4' since 0.1.x. Now follows package.json automatically.

Upgrade

claude mcp add codex-bridge -- npx -y codex-claude-bridge@latest

The @latest pin means npx re-resolves on every launch, so 1.0.0 lands automatically without re-adding the server.

v0.3.6 — Discover .reviewbridge.json beyond cwd

What's new

Fixes a real-world failure mode where the bridge MCP server, launched by an MCP host (e.g. Claude Code) from a consumer project's working directory, never found its own .reviewbridge.json and silently fell back to the built-in default model. On ChatGPT-tier Codex installs that hadn't yet rolled out the default, every review call surfaced as MODEL_ERROR.

Discovery cascade

loadConfig now operates in two modes:

• Explicit (--config <dir> on the CLI): looks only at <dir>/.reviewbridge.json — preserves existing behavior.
• Implicit (no arg, e.g. MCP server startup): cascades through
  1. RB_CONFIG_PATH env var (exact path; missing/unreadable is fatal)
  2. Walk-up from process.cwd() to a .git boundary or filesystem root
  3. $HOME/.reviewbridge.json
  4. Built-in defaults

First match wins. A startup line on stderr ([codex-bridge] config source: project (/repo/.reviewbridge.json)) names the resolved source.

The CLI's --config flag still bypasses the cascade entirely and looks only at the supplied directory.

Behavior change worth noting

Previously, loadConfig errors were logged and silently swallowed in favor of built-in defaults. They now abort startup. ENOENT during cascade probing is silent (skip to next step), but any .reviewbridge.json that's found must parse cleanly — a malformed file aborts startup with the path in the error rather than running on defaults you didn't ask for. This is the very class of bug T-012 is fixing.

For users hitting the original story-maker case

After upgrading, you have three ways to ensure the bridge picks up your preferred model regardless of which directory the MCP host launches it from:

1. Set RB_CONFIG_PATH in your shell env to the exact .reviewbridge.json path.
2. Drop ~/.reviewbridge.json with {\"model\": \"gpt-5.4\"} for a per-machine default.
3. Add a .reviewbridge.json to each consumer project's root.

Install

claude mcp add codex-bridge -- npx -y codex-claude-bridge@latest

The @latest pin makes npx re-resolve on every launch.

Internals

• New LoadedConfig { config, source } return shape from loadConfig.
• server.ts and cli/commands.ts derive copilot-instructions root from the project source path when applicable.
• mcp.ts wraps createServer() to print a clean startup-error line and exit cleanly (no stack-trace double-print).
• 16 new tests; 508 total passing.

T-012.

v0.3.5 — Revert config model allowlist

Summary

Reverts the `.reviewbridge.json` `"model"` allowlist introduced in v0.3.4. The field is permissive again — any non-empty string is accepted and forwarded to Codex as-is.

Why

0.3.4 rejected any `model` value other than `gpt-5.5` or `gpt-5.4` at config parse time. That crossed the line from curating our recommendations into blocking user choice. Our position: don't advertise older Codex variants or mini models, but don't gate users who explicitly pick them either. Lesson L-006 captures the corrected policy.

What stays

• `gpt-5.5` remains the default model
• README still documents only `gpt-5.5` (current flagship) and `gpt-5.4` (fallback for ChatGPT-tier rollout gaps)
• Error-message tips still point at `gpt-5.5` / `gpt-5.4`
• The `RECOMMENDED_MODELS` constant (formerly `SUPPORTED_MODELS`) is retained as a documentation/tip-sourcing reference

What changes vs 0.3.4

• `config.model` schema: back to `z.string().default('gpt-5.5')` — no superRefine, no rejection
• README: clarifies that config, MCP param, and CLI flag all accept any string
• 2 rejection tests removed; 1 permissive acceptance test added (488 total vs 489 in 0.3.4)

Upgrade

```bash
claude mcp remove codex-bridge
claude mcp add codex-bridge -- npx -y codex-claude-bridge@latest
```

Anyone who hit the 0.3.4 rejection error with a non-allowlisted `"model"` value will find that config now loads cleanly again.

v0.3.4 — Config allowlist: gpt-5.5 or gpt-5.4 only

Summary

`.reviewbridge.json` now rejects any `"model"` value other than `gpt-5.5` or `gpt-5.4`. Unknown values produce a clear validation error at load time:

```
CONFIG_ERROR: Unsupported model "gpt-5.1-codex-mini". Supported values: gpt-5.5, gpt-5.4.
```

MCP tool schemas and the CLI `--model` flag remain permissive so Claude Code can experiment per call — the allowlist applies only to persisted config.

Why

The previous permissive `z.string()` on config.model meant anything could silently run in the background (`gpt-5.3-codex`, `gpt-5.2-codex`, `gpt-5.1-codex-mini`, etc.). Only the current flagship (`gpt-5.5`) and one fallback (`gpt-5.4`) are supported. Older Codex variants and mini models are out of scope and will be rejected at config load. See lessons L-006 and L-007 for the rationale.

Changes

• `src/config/types.ts`: new `SUPPORTED_MODELS` constant; `model` field gains a `superRefine` against the allowlist
• 2 new tests — unsupported rejection with descriptive message, both supported models accepted
• README documents the allowlist on `.reviewbridge.json`
• 489 tests passing (was 487)

Breaking changes (minor)

If you were running with a non-supported `"model"` in `.reviewbridge.json`, the bridge will now fail config load with a clear error. Fix: set `"model": "gpt-5.5"` or `"gpt-5.4"`, or omit the field to use the default (`gpt-5.5`).

Upgrade

```bash
claude mcp remove codex-bridge
claude mcp add codex-bridge -- npx -y codex-claude-bridge@latest
```

v0.3.3 — Per-call model override in MCP + CLI

Summary

Adds optional `model` to all three review tools so callers can switch models per request instead of relying on the startup-cached config value.

• MCP: `review_plan`, `review_code`, `review_precommit` each accept `model?: string`
• CLI: `--model ` on all three subcommands
• Resolution order: explicit tool-call `model` → `.reviewbridge.json` → built-in default
• Conflict rule: passing both `session_id` and `model` returns `INVALID_INPUT` — resumed threads are bound to their original model
• Multi-chunk aware: the override is applied on chunk 1 (`startThread`); chunks 2..N inherit via `resumeThread` without re-asserting the model

Why this matters

When OpenAI ships a new flagship model, it lands in the API tier immediately but lags a few days on the ChatGPT-subscription Codex tier. During that window, `v0.3.0`/`v0.3.1` users on ChatGPT auth hit `MODEL_ERROR: ... not supported when using Codex with a ChatGPT account`. `v0.3.2` shipped a targeted error tip. `v0.3.3` now lets Claude Code (or any caller) act on that tip directly — just pass `model: "gpt-5.4"` on the next call. No config edit, no MCP restart.

Also useful for per-tool model selection in general: cheaper model for precommit, heavier for plan review.

Usage

MCP (Claude Code calls this automatically after reading the error tip):
```
review_code({ diff, model: "gpt-5.4" })
```

CLI:
```bash
git diff HEAD | npx codex-claude-bridge@latest review-code --diff - --model gpt-5.4
npx codex-claude-bridge@latest review-precommit --model gpt-5.4
```

Safety

• The SDK forwards `--model` to `codex exec` unconditionally whenever set in `ThreadOptions`, including on `resumeThread`. This release strips `model` from the resume-path options entirely, so a thread's original model is preserved across multi-chunk reviews. Omitting the override on resume is correct-by-construction rather than relying on SDK behavior.
• `model: ""` is rejected at both the MCP (via `z.string().min(1)`) and CLI (via trim-and-coerce-to-undefined) layers.
• `session_id + model` is rejected at the handler layer before any session-tracker mutation, so invalid input never marks an active session `failed` in SQLite.
• `classifyError` now receives the resolved model (override or config default) on all failure paths, so error messages report the actually-running model even on chunks 2..N of chunked reviews.

Changes

Change	Detail
MCP schemas	`model?: string` added to review_plan, review_code, review_precommit (z.string().min(1).optional())
CLI flags	`--model ` on all three subcommands; empty-string normalization
Client plumbing	New `resumeThreadOpts` helper strips model on resume; `resolvedModel` threaded through `runReview` for error context
Tests	8 new (client-layer override paths, conflict rejection, multi-chunk inheritance for both reviewCode and reviewPrecommit, handler-level forwarding); 487 total
README	New `model` row per tool parameter table

Upgrading

```bash
claude mcp remove codex-bridge
claude mcp add codex-bridge -- npx -y codex-claude-bridge@latest
```

The `@latest` pin makes `npx` re-resolve on every launch, so future updates are automatic.

v0.3.2 — Targeted fallback tip for ChatGPT-account model rollout

Why this exists

When OpenAI announces a new flagship model, it lands in the API immediately but takes a few days to propagate to the ChatGPT-subscription tier that Codex CLI uses for $0 auth. During that window, the `gpt-5.5` default in v0.3.0 / v0.3.1 produced:

MODEL_ERROR: The 'gpt-5.5' model is not supported when using Codex with a ChatGPT account.

Users on the free tier were stuck until they edited `.reviewbridge.json`.

What changed

The error classifier now detects the specific `ChatGPT account` phrase in the raw Codex error and surfaces a targeted hint:

Fall back to gpt-5.4 by setting `"model": "gpt-5.4"` in .reviewbridge.json, or use an API key (OPENAI_API_KEY) instead of the ChatGPT subscription auth.

Claude Code reading this error can auto-apply the workaround. The generic MODEL_ERROR tip remains unchanged for every other model-not-supported case.

Scope

• 1-line patch to the classifier in `src/codex/client.ts` — no default-model change, no silent fallback, no schema changes
• 2 new regression tests (479 total, all passing)
• README troubleshooting table gains a row for the rolling-out case

Upgrade

```bash
claude mcp remove codex-bridge
claude mcp add codex-bridge -- npx -y codex-claude-bridge@latest
```

Once the ChatGPT-tier rollout of `gpt-5.5` completes, the tip stops firing on its own — no further action needed.