Reading "Who First Asked for What" Across the Handoff: How Codex 0.160 Gives Guardian Cross-Context Awareness and a Browsable Command Seat

On October 1, 2026, OpenAI released v0.160.0 of "Codex CLI," its terminal-based coding agent. This isn't a flashy new-model announcement; the focus is on quiet improvements that matter to people juggling multiple tasks and agents at once. The one most worth noting is that "Guardian," the mechanism that decides on approvals, can now read across agent-to-agent handoffs all the way back to the original instruction.

Three new entry points in this release

The main features added in v0.160.0 are these three. All of them are tuned for "let it run" and "delegate in parallel" styles of operation.

A command seat where you can trace your work history

In the screen that manages multiple tasks (the agent command center), you can now scroll back through older tasks via "Show more." Because you can navigate the history with the keyboard, you can check which agent you handed what to in the past without ever leaving the terminal.

You can now start outside a project

Until now, work always had to start from a project (a repository), but if policy allows, you can now begin a session outside a project using workspace-default settings. When you resume, the permissions you saved are restored. That removes one step of having to set up a repository when you just want to "try it first."

Guardian reads handoffs and the original instruction (optional)

The Guardian review that decides on approvals gained an opt-in (manually enabled) capability to pull up past user instructions and include the context of agent-to-agent handoffs. This is the heart of this release.

What is Guardian in the first place?

Guardian is an "approver" sub-agent that judges the validity of a tool call or command execution before Codex carries it out. Instead of asking a human for confirmation at every step, it gathers context such as the proposed command, the working directory, the conversation history, and the sandbox policy, automatically waves through low-risk operations, and escalates only the dangerous ones to a human. In exchange for reducing the burden of approvals, it inserts a query to a separate model each time it makes a decision. For now it is positioned as experimental and is off by default.

Why "context across the handoff" matters

In handoff-style usage, where you run agents in parallel and pass one agent's output to another, the receiving side tends to lose the original intent of "why am I doing this work?" If the approver decides good-or-bad based only on the command in front of it, the judgment can drift away from the overall context. In v0.160.0, because Guardian can reference the handoff context and past user instructions, it can now base approval decisions on "what was this work originally asked to do." You could call it groundwork for carrying approval accuracy along with its context through unattended, multi-stage workflows.

Fixes that shore up the foundation, too

Nothing flashy, but several fixes that help the stability of unattended operation also landed. A sub-agent that is mid-startup now retains its environment and can receive notifications of configuration or setup failures, and messages queued for sending after a reconnect have been fixed to resume while avoiding duplicate sends. Issues with SQLite stalling during connection setup and with the Windows sandbox were also fixed. It's the grading work that reduces the cases where an always-on agent "quietly gets stuck."

A caveat to keep in mind behind the convenience

A design that delegates approval decisions to an LLM greatly reduces the burden of confirmation, but it also increases the wait time per decision and inserts "a second model's judgment" into the execution loop. And precisely because it can now read context broadly, it becomes harder to see on what grounds something was approved. For these reasons, it's worth keeping in mind that Guardian itself is still experimental and off by default. For deterministic-critical paths like CI/CD, some argue that rule-based, fixed approvals are a better fit than letting an LLM decide. If you do adopt it, the safe path is to start with low-impact work, observe how it behaves, and run it in a way that leaves an auditable record.

References: Codex rust-v0.160.0 Release Notes (GitHub) / Codex Updates (Releasebot) / openai/codex Releases