Codex CLI v0.163 turns Daybreak back on by default and makes /config searchable
v0.163.0 enables Daybreak by default for eligible accounts, adds search across /config, lets you steer a response mid-turn, and checks proxy permission before a DNS lookup.
Contents
Codex CLI v0.163.0 reverses a change that shipped five days earlier: Daybreak is on by default again. Alongside it come a searchable settings panel, mid-turn steering, and three security fixes in the network proxy.
Two things are worth acting on. If you had explicitly disabled Daybreak, check its current state. If you restrict network access in the sandbox, upgrade to 0.163.0.
KEY POINT
What this article covers
- Daybreak is the default again for eligible accounts
/configsearches across categories, and you can steer a response mid-turn- The three fixes that landed in the network proxy
Daybreak is the default again
The release notes say "Daybreak is enabled by default for eligible accounts." In v0.161.0 it required --enable cli_daybreak or features.cli_daybreak=true, and daybreak=true alone was not enough. That requirement lasted five days.
# What v0.161.0 and v0.162.0 required
[features]
cli_daybreak = trueFrom v0.163.0, an eligible account does not need this. codex exec can also use Daybreak with an OpenAI API key now.
Do not treat this setting as settled
The same setting has moved twice in five days, and the release notes do not define what makes an account "eligible". If cli_daybreak is written into a runbook or a shared config.toml, verify the real behaviour after upgrading. What changed in Codex CLI v0.161 and v0.162 covers how it worked before.
/config and mid-turn control
How you find settings, and what happens when you interrupt, both changed.
| Change | What it does |
|---|---|
/config | Searches preferences across categories. Supported changes apply in place, and ones needing a restart are marked as such |
| Follow-ups mid-response | Send a follow-up while Codex is responding to steer it immediately |
| Interrupting a turn | Also stops running Code Mode cells and nested tool calls |
Leader key in /keymap | The default is Ctrl+X. Voice mute moved to F9 |
/daemon | Restarts a managed background server, warning about work that may be interrupted |
/side | A temporary side chat. It persists across thread switches, and prompt answers go back to the originating thread |
| Parallel read-only tools | Independent reads such as skills, memories and conversation history run in parallel |
/config, /keymap and /daemon are not in the official list
As of 2026-10-19 the official slash command reference has no entry for /config, /keymap or /daemon. They appear only in the release notes. The reference does list /approve, /compact, /model, /plan, /review, /side, /status and /worktree, among others, and describes /side as "Start a temporary side chat without interrupting the main chat."
The network proxy and the sandbox
Three security fixes landed:
- The network proxy now checks permission before a DNS lookup
- It rejects duplicate
Hostheaders - Credential aliases can no longer bypass the inspection hooks
The first matters most in practice. Previously name resolution could run ahead of the permission decision, so even a connection you blocked could leak to your DNS server which host was about to be contacted. Resuming a saved thread now also restores its permission and network approvals.
On the documentation side, the Linux sandbox section was updated. The official sandboxing page says that on Linux and WSL2 you install bubblewrap with your package manager first, that Codex uses the first bwrap executable it finds on PATH, and that without one it falls back to a bundled helper which "requires support for unprivileged user namespace creation". Codex shows a startup warning when bwrap is missing or the helper cannot create the namespace.
用語解説
bubblewrap (bwrap): a Linux sandboxing tool that isolates processes using namespaces without needing privileges. Codex uses it to limit where commands can write and what they can reach over the network.
The release notes say the Linux sandbox documentation now also explains seccomp, but as of 2026-10-19 no mention of seccomp could be found on the official sandboxing page. For how approvals and the sandbox interact, see Combining approval_policy and sandbox_mode in Codex.
The bundled zsh is gone
Codex no longer bundles a patched zsh and uses its standard shell executor instead. Configurations that use the retired shell flags get a migration notice.
The names of those flags could not be confirmed in the official configuration reference, so if the notice appears, follow what the message itself says. For the structure of the configuration file as a whole, see Configuring Codex with config.toml.
Two smaller items: the Linux and macOS release binaries are smaller because symbols are stripped from the packaged copies, and codex exec no longer repeats file diffs after unrelated commands. Clipboard paste handling on Windows and WSL was also fixed.
Summary
- v0.163.0 makes Daybreak the default for eligible accounts;
cli_daybreakis no longer needed /configsearches settings across categories and marks changes that need a restart- You can send a follow-up mid-response, and interrupting also stops Code Mode cells
- The network proxy checks permission before a DNS lookup and rejects duplicate
Hostheaders /config,/keymap,/daemonand the retired shell flag names could not be confirmed in the official docs
FAQ
- Do I still need cli_daybreak to use Daybreak?
- No. The v0.163.0 release notes say Daybreak is enabled by default for eligible accounts, withdrawing the explicit opt-in that v0.161.0 introduced five days earlier.
- Are /config and /keymap in the official docs?
- As of 2026-10-19 the official slash command reference has no entry for /config, /keymap or /daemon; they appear only in the release notes. /side is listed.
- Does dropping the bundled zsh mean I have to change my configuration?
- Configurations using the retired shell flags get a migration notice. The names of those flags could not be confirmed in the official configuration reference.
Primary sources
This article was drafted by AI from official documentation and reviewed by the site operator before publishing. Found a mistake? Let us know via the contact page.