v19.0.0

What's Changed

Breaking Changes

• Codex CLI permissions: read-deny coverage gaps closed, :workspace_roots access preserved, and workspace-relative keys normalized. Review the regenerated .codex/config.toml after upgrading. Closes #3152. by @dyoshikawa in #3157
  • A direct ":workspace_roots" rule is no longer dropped when workspace-relative rules turn :workspace_roots into a table; it is kept as the table's "." = <access> entry (the more restrictive access wins if an explicit . rule also exists). For example, read: { ":workspace_roots": "deny" } + edit: { "src/a.ts": "deny" } now emits { "." = "deny", "src/a.ts" = "deny" } instead of { "src/a.ts" = "read" }.
  • A write-side allow under a broader read deny/ask (with the read side unspecified) now generates "deny" with a warning instead of "write", which re-opened reads. For example, read: { ":root": "deny" } + edit: { ":workspace_roots": "allow" } now denies the workspace. Add an explicit read: allow on the same pattern to keep "write".
  • Only the most specific covering read rule decides whether a write-side rule is covered, so read: { "/x/**": "deny", "/x/y": "allow" } + edit: { "/x/y/z": "deny" } now gives "/x/y/z" = "read". Coverage only matches patterns of the same kind (absolute/drive/~ vs workspace-relative), treats ., ./, ./** and :workspace_roots as covering the whole workspace, compares Windows drive paths case-insensitively with \ as a separator, and lexically resolves ./.. segments of absolute, drive and ~ paths. ~ is not expanded.
  • Leading ./ segments are stripped from workspace-relative keys (./ and ./** become ., ./src/** becomes src/**), because Codex rejects ./-prefixed :workspace_roots subpaths. Rules that differ only by ./ are merged, with the more restrictive action winning.
  • Workspace-relative patterns Codex rejects (a .. segment, or an empty leading segment such as .//src) and Windows device paths that would land under :workspace_roots are now skipped with a warning (including deny rules) instead of producing a config Codex refuses to load. The warning states that the path is not protected.
  • On import, a Codex "write" entry now becomes read: allow + edit: allow (previously edit: allow only), matching Codex semantics where write includes read. Tools generated from an imported Codex config therefore receive explicit read allows.

Other Changes

• Update the Homebrew formula to v18.0.0 in #3154

Contributors

• @dyoshikawa

Full Changelog

v18.0.0...v19.0.0