v20.0.0

What's Changed

Breaking Changes

• Codex CLI permissions: the default .git/** write carve-out is skipped under a workspace-wide restriction. Closes #3158. by @dyoshikawa in #3161
  • Rulesync used to add ".git/**" = "write" to the :workspace_roots table even when a workspace-wide relative rule such as read: { "**": "deny" }, read: { ".": "deny" } or edit: { "**": "deny" } restricted the workspace. Codex gives the more specific .git/** entry priority, so .git was reopened for reads and writes.
  • The carve-out is now left out, with a warning, when the most specific other entry of the emitted table that covers .git/** is "deny" or "read". To keep git writes, author read and edit allows for .git/**. To silence the warning, set codexcli.git_write_rules to false.
  • :root and /** denies do not suppress the carve-out. The common ":root" = "deny" setup keeps a working git.
  • On import, a ".git/**" = "write" entry in a table that restricts .git becomes a user-authored rule, so generate → import → generate stays stable.

Bug Fixes

• Hermes Agent hooks: pre_auxiliary_call and post_auxiliary_call are recognized. Hermes Agent v0.21.5 added these events, and authoring them under hermesagent.hooks no longer warns. Refs #2414. by @dyoshikawa in #3162

Other Changes

• Bump the all-dependencies group with 71 updates in #3156
• Bump anomalyco/opencode/github from 2.0.11 to 2.0.16 in #3155
• Update the Homebrew formula to v19.0.0 in #3160

Contributors

• @dyoshikawa

Full Changelog

v19.0.0...v20.0.0