DEV Community: aicoding-guide

Every Claude Code slash command, ordered by how often you actually use it

aicoding-guide — Tue, 10 Nov 2026 19:23:34 +0000

Originally published at https://aicoding-guide.com.

The official Claude Code command reference lists more than 110 slash commands. You do not need to know them all. About six come up every day; the rest are things you look up when something goes wrong. This article regroups the official list by how often you actually reach for each one.

One thing to get out of the way first: the built-in command list has moved.

Key point
What you will learn

Where the official list lives, and how to read <arg> versus [arg]

The six commands you use in every session, and their arguments

What the Skill and Workflow markers mean, and why availability differs per person

Where the list lives and how to read it

The official built-in command reference is at https://code.claude.com/docs/en/commands. The /docs/en/slash-commands URL now serves a page titled "Extend Claude with skills", which has no built-in commands table. That page points you onward itself: "For built-in commands like /help and /compact, and bundled skills like /debug and /code-review, see the commands reference".

The table has just two columns, Command and Purpose. Argument notation is fixed.

Notation	Meaning
`<arg>`	Required. The docs say "`<arg>` indicates a required argument"
`[arg]`	Optional. "`[arg]` indicates an optional one"

From inside the CLI, /help gives you "Show help and available commands". When you want to know what you actually have rather than what exists, that is the reliable source.

The six you use every session

Learn these and day-to-day work is covered.

Command	What the docs say (condensed)	When to reach for it
`/clear [name]`	Start a new conversation with empty context. A name labels the previous conversation in the `/resume` picker. Aliases `/reset`, `/new`	Switching to unrelated work
`/compact [instructions]`	"Free up context by summarizing the conversation so far". You can pass focus instructions for the summary	Freeing context without losing the thread
`/context [all]`	Visualize context usage as a colored grid. Past the context window, the output warns how far over you are and which command frees space	Finding out what made the session heavy
`/model [model]`	Switch model and save it as the default for new sessions. With no argument a picker opens; press `s` on a row to switch for this session only	Before and after a hard task
`/resume [session]`	Resume a conversation by ID or name, or open the session picker. Alias `/continue`	Picking up yesterday's work
`/rewind`	Rewind the conversation and/or code to a previous point, or summarize from a selected message. Aliases `/checkpoint`, `/undo`	After Claude heads the wrong way

The split between /clear and /compact is stated right in the /clear entry: "To free up context while continuing the same conversation, use /compact instead." One discards the conversation; the other summarizes and keeps it. For the longer version see Managing context in Claude Code with /compact versus /clear.

To move the threshold where automatic compaction fires, use /autocompact [auto|<tokens>]. Pass a size such as 500k, or auto to return to the window tuned for your model; the value is saved to user settings and applied to the current session. Requires Claude Code v2.1.221 or later.

Checking settings, permissions and usage

The next most frequent group answers "what is the state of things right now".

Command	What the docs say (condensed)
`/permissions`	Interactive dialog for allow, ask and deny rules. View rules by scope, add or remove them, manage working directories, and review recent auto mode denials. The Auto mode tab also shows and edits classifier rules. Alias `/allowed-tools`
`/config [key=value ...]`	Open the Settings interface, or set a value directly without opening it, such as `/config theme=dark`. `/config --help` lists the keys it accepts. Alias `/settings`
`/status`	Open Settings on the Status tab: version, model, account and connectivity. Works while Claude is responding
`/usage`	Usage. `/cost` is "Alias for `/usage`", and `/stats` opens it on the Stats tab
`/memory`	Edit `CLAUDE.md` files, enable or disable auto memory, and view auto memory entries
`/hooks`	View hook configurations
`/mcp`	Manage MCP server connections and OAuth. Pass `reconnect`, `enable` or `disable` with a server name or `all` to change state without opening the list
`/add-dir <path>`	Add a working directory for file access during this session. Partial paths suggest matches; `Tab` accepts one
`/cd <path>`	Move the session to a new working directory, keeping the conversation

/add-dir carries a caveat worth knowing: "Most .claude/ configuration isn't discovered from the added directory." For reading the permissions dialog, see Claude Code /permissions shows every rule and the settings file it came from.

Handing the work itself over, with Skills and Workflows

Some rows in the list carry a marker. The official definitions:

Glossary
Skill: "a bundled skill. It works like skills you write yourself: a prompt handed to Claude."

Workflow: "a bundled dynamic workflow that fans work out across many subagents and runs in the background."

Both only run on demand — the docs make the point with /verify and /deep-research: "runs only when you invoke it."

Command	Kind	What it does
`/code-review`	Skill	Review the current diff, or a PR number, branch or path you pass, for correctness bugs. `--fix` applies findings, `--comment` posts them to the PR or merge request. Alias `/review`
`/simplify [target]`	Skill	Review changed code for cleanup opportunities and apply the fixes, with four review agents in parallel. "The review doesn't look for correctness bugs" — that is `/code-review`'s job
`/debug [description]`	Skill	Turn on debug logging for this session and troubleshoot from the log. Logging is off by default, so running it mid-session captures from that point forward
`/doctor`	Skill	A setup checkup over installation, settings, extension and `CLAUDE.md` problems, proposing fixes you confirm. Alias `/checkup`
`/batch <instruction>`	Skill	Parallelize a large change: decompose into 5 to 30 independent units, present a plan, then run one background subagent per unit in an isolated worktree
`/deep-research <question>`	Workflow	Fan out web searches, fetch and cross-check sources, and synthesize a cited report
`/security-review`	—	Analyze the changes on your current branch for security vulnerabilities. Needs an `origin` remote

To build commands on the same mechanism yourself, see Create your own slash commands in Claude Code with a single Markdown file.

Commands that never appear, and ones that went away

A command can be in the list and still be missing from your session. That is by design: "Not every command appears for every user. Availability depends on your platform, plan, and environment." The docs give two examples.

/desktop shows only on macOS and x64 Windows, signed in with a Claude subscription
/upgrade does not show on Enterprise plans

Some commands are genuinely gone.

Command	Status
`/pr-comments`	Removed in v2.1.91. Ask Claude directly to view pull request comments
`/ultraplan`	Removed. Use plan mode instead
`/agents`	Now "Print a reminder to ask Claude to create or manage subagents". On v2.1.197 and earlier it opened an interactive management interface

Some commands are only hidden from the menu
/heapdump, /setup-bedrock and /setup-vertex are documented as "Hidden from the command menu" — they do not autocomplete, but typing them in full works. Setting CLAUDE_CODE_USE_BEDROCK=1 or CLAUDE_CODE_USE_VERTEX=1 makes the matching wizard appear in the menu.

Summary

The official built-in list is at /docs/en/commands; /docs/en/slash-commands is now the skills page
The table has two columns, and <arg> is required while [arg] is optional
The daily six are /clear, /compact, /context, /model, /resume and /rewind
Skill means a prompt handed to Claude; Workflow means work fanned out across subagents. Both run only when invoked
Platform, plan and environment decide what you see, so check your own list with /help

What changed in Codex CLI v0.167, codex agents and the auto-compaction fix

aicoding-guide — Sun, 08 Nov 2026 19:27:07 +0000

Originally published at https://aicoding-guide.com.

Codex CLI v0.167.0 ships six new features, six bug fixes, two documentation changes and two chores. Two of them matter for everyday work: the agent command center gets unread markers, and automatic context compaction now counts tokens it used to miss.

One caveat first. This release contains a flag spelling that the official documentation contradicts outright, so it is worth knowing before a command fails on you.

Key point
What you will learn

What codex agents opens, and whether you may pass --no-daemon to it

What automatic context compaction now counts, and where to set its threshold

Which v0.167.0 settings are still missing from the configuration reference

Opening the agent command center with codex agents

The first release note reads: "Open the agent command center with codex agents --no-daemon. The command center and session picker now mark unread results". The screen that lists chats on a shared server now flags results you have not read.

codex agents itself is documented, with maturity Stable. The command overview describes it as "Open the agent command center on a shared local or remote server", and its own section as "Open the command center to browse chats and switch between agents on a shared server".

Flag	What it does
`--remote <URL>`	Connect to a remote server
`--cd <DIR>`	Set the directory used for new remote tasks
`--remote-auth-token-env`	A global flag, documented as requiring `--remote`

You can reach the same screen from inside the TUI with /agents, listed in the slash-command table as "Open the agent command center." with the when-to-use note "Browse chats and switch between agents on the connected server." A separate /subagents command switches the active subagent thread.

The docs say --no-daemon cannot be combined with codex agents
As of 2026-11-09 the codex agents section states "codex agents doesn't support --no-daemon". The global --no-daemon flag ("Run the interactive CLI without the shared background server.") carries the matching note "Can't be combined with --remote or codex agents". The v0.167.0 release notes spell the command with that flag anyway. Which one reflects the current implementation could not be confirmed in the official documentation. Start with a plain codex agents and only reach for the flag if that fails.

Automatic compaction now counts failed responses

The widest-reaching fix is: "Automatic context compaction now accounts for retained output from failed responses and responses with missing token usage data". Retained output from failed responses, and responses whose token usage never arrived, now feed into the compaction decision.

Until now those tokens went uncounted, so Codex judged compaction against a figure lower than real consumption. That is exactly the kind of drift that lets a long session run out of context without compaction ever firing.

The threshold lives in config.toml. These four keys are the ones documented today.

# Token threshold that triggers automatic history compaction
model_auto_compact_token_limit = 300000

# How the threshold is counted: "total" counts the full active context,
# "body_after_prefix" counts only growth after the carried compaction prefix
model_auto_compact_token_limit_scope = "total"

# Turn-end compaction, as a percentage of the usable context window
model_post_turn_compact_threshold_percent = 85

# Replace the prompt used for compaction
compact_prompt = "Summarize the work so far, keeping file paths and decisions."

Key	Value	Description
`model_auto_compact_token_limit`	number	Token threshold for automatic compaction. Unset uses model defaults
`model_auto_compact_token_limit_scope`	`total` / `body_after_prefix`	Defaults to `total`, which counts the full active context
`model_post_turn_compact_threshold_percent`	integer 0–100	Omit or set `0` to disable turn-end compaction. The usual auto-compaction limits still apply
`compact_prompt`	string	Inline override for the compaction prompt

To compact by hand, use /compact, documented as "Summarize the visible chat to free tokens." with the advice "Use after long runs so Codex retains key points without blowing the context window." For the rest of the file, see How to write Codex config.toml and its main settings keys.

Vertex AI and system proxy settings are not in the reference yet

Two release notes touch configuration, and neither has reached the configuration reference.

The first reads: "Find API key and cloud provider options under 'Sign in another way.' Enable gcp_setup_wizard to set up Google Cloud Vertex AI with Application Default Credentials or a credential file". A key named gcp_setup_wizard could not be found in the configuration reference as of 2026-11-09. These are the Vertex AI keys that are documented.

Key	Description
`model_providers.gcp.project_id`	Google Cloud project ID for the Vertex AI endpoint. Takes precedence over `GOOGLE_CLOUD_PROJECT`
`model_providers.gcp.location`	Location for the Vertex AI endpoint. Takes precedence over `GOOGLE_CLOUD_LOCATION`, defaults to `global`
`model_providers.gcp.credential_file`	Absolute path to an Application Default Credentials file. Overrides `GOOGLE_APPLICATION_CREDENTIALS` only for the provider's authentication command
`model_providers.gcp.base_url`	Override the built-in Vertex AI endpoint. Otherwise Codex builds it from the project ID and location

The second reads: "Opt into macOS or Windows system proxy settings from /experimental". The /experimental command is documented ("Toggle experimental features." / "Enable options such as Network proxy or Prevent sleep while running."), and so is the matching key features.network_proxy ("Start the network proxy for sandboxed commands (experimental; off by default)."). But reading the operating system's proxy configuration, and the handling of variables such as HTTP_PROXY, could not be confirmed on those two pages. Environment-variable behaviour lives on a separate page, so check that before you turn the setting on.

The remaining fixes

The rest of the release is about keeping state that used to be dropped.

Saved chats stay visible after you switch model providers. If a chat cannot resume, you can still read its transcript and prepare an editable prompt to continue elsewhere
Ctrl+L clears the terminal display while earlier messages stay reachable through Ctrl+T. The docs confirm only the first half, "Ctrl+L only clears the terminal view and keeps the current chat." — no documentation for Ctrl+T could be found
Deleting text that exposes a leading ! keeps an ordinary draft in chat mode
Network approval prompts close when their requests end, and concurrent requests to the same endpoint prompt one at a time
Long realtime V3 conversations save completed speech into chat history as the transcript grows

On the documentation side, the app-server README now covers managed network constraints under [permissions.network] and prompt-user command rules that require fresh human approval. Note that the configuration reference has no section by that literal name: it documents named profiles as [permissions.<name>] with network.* keys beneath them. For how approvals and sandboxing interact, see Codex approval_policy and sandbox_mode combinations; for the previous release, see What changed in Codex CLI v0.166, codex queue --resume and codex doctor --network-only.

Summary

The headline changes in v0.167.0 are unread markers in the agent command center and drafts that survive a backend switch
codex agents is a Stable command, but the docs deny that it accepts --no-daemon, contradicting the release notes; which one is current could not be confirmed
Automatic context compaction now counts retained output from failed responses and responses with missing usage data
Tune the threshold with model_auto_compact_token_limit and model_auto_compact_token_limit_scope
gcp_setup_wizard and the system-proxy option do not appear in the configuration reference pages checked here

This week in Claude Code, Codex and Gemini CLI (week of November 8, 2026)

aicoding-guide — Sat, 07 Nov 2026 19:10:05 +0000

Originally published at https://aicoding-guide.com.

The change with the widest reach this week is that auto mode no longer falls back to the built-in classifier. Where telemetry or feature flags are off, including behind an LLM gateway, calls the server cannot check are asked about or denied.

For unattended runs, permissions.denyInsteadOfPrompting is new: instead of stalling on a prompt, the call is denied and the turn continues.

Key point
This week in brief

Auto mode asks about or denies calls the server can't check, with no classifier fallback

permissions.denyInsteadOfPrompting replaces a stalled prompt with a denial

Web and shell tool calls now ask before sending your account email address

Claude Code

Three releases: 2.1.317, 2.1.318 and 2.1.319.

Auto mode lost its fallback (2.1.319)

The CHANGELOG reads: "Changed auto mode with telemetry or feature flags off, including behind LLM gateways: calls the server can't check are asked about or denied, with no fallback to the built-in classifier; set CLAUDE_CODE_AUTO_MODE_SERVER=0 to keep using it (Bedrock, Vertex and Foundry are unchanged)."

Environment	Effect
Telemetry or feature flags off	Calls the server can't check are asked about or denied
Behind an LLM gateway	The same
Bedrock / Vertex / Foundry	Unchanged

CLAUDE_CODE_AUTO_MODE_SERVER=0 restores the previous behaviour of using the built-in classifier. In the other direction, CLAUDE_CODE_AUTO_MODE_SERVER=1 turns the server-side check on behind a gateway even with CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS set — and where managed settings set the latter, they must set the 1 too.

Relatedly, /status no longer reports "Auto mode server: Enabled" when the server-side review is not actually reaching the session. For how the modes differ, see Claude Code starts in auto mode by default.

New settings and variables (2.1.319)

Setting	What it does
`permissions.denyInsteadOfPrompting`	Denies a call that would wait on a permission prompt and continues the turn, in terminal sessions, subagents and teammates
`CLAUDE_CODE_DISABLE_FEATURE_FLAGS`	Stops feature-flag fetching without turning telemetry off; every flag uses its built-in default
`CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND`	Waits for an MCP task inside its tool call instead of backgrounding it immediately

MCP tasks are now supported in the terminal: when a server runs a tool call as a task, Claude Code moves it to the background right away and reports the result when it finishes.

Disabling feature flags also stops idle compaction
CLAUDE_CODE_DISABLE_FEATURE_FLAGS stops flag fetching while leaving telemetry on. One of idle compaction's conditions is that Claude Code can fetch feature flags from Anthropic, so setting this variable stops it running. For the full list of conditions, see Making Claude Code compact earlier, or never.

A check before your email address goes out (2.1.317)

New in 2.1.317: "Added a check that asks before a web or shell tool call sends your account email address to the network."

Three security fixes also landed:

A sed command could skip the permission check in accept-edits and auto mode (2.1.319)
Bash deny and ask rules missed commands written with quoted words (2.1.319)
/rewind could restore or delete a file through a directory symlink (2.1.319)

Sign-in expiry is now visible (2.1.318)

This one matters for unattended runs. The expiry date of a stored claude.ai sign-in is now available as loginExpiresAt in claude auth status and credential_expires_at in claude -p JSON results, with a one-line stderr warning starting 10 days before.

The release itself is mostly fixes for configuration files and stored logins being corrupted on network home directories, so it is worth taking if you run on a shared home. Claude Code also no longer installs or updates the IDE extension when started from an IDE terminal; use /ide from an outside terminal instead.

Codex

v0.167.0 ships six features.

Addition	What it does
`codex agents --no-daemon`	Opens the agent command center; it and the session picker now mark unread results
Backend switching	Switch between connected backends from the terminal session picker, keeping drafts
Image preview	Preview local image attachments while composing, on supported terminals
`gcp_setup_wizard`	Sets up Google Cloud Vertex AI with Application Default Credentials or a credential file
System proxy	Opt into macOS or Windows system proxy settings from `/experimental`
Patch details	Expand patch details in the transcript while an approval prompt is open

gcp_setup_wizard continues from v0.165.0, which made Vertex AI a built-in provider via model_provider = "gcp" — see Codex CLI v0.165 makes Vertex AI a built-in provider. The API key and cloud provider options moved under the "Sign in another way" menu.

Three fixes stand out. Saved chats stay visible after switching model providers, and a chat that cannot resume can still be read and turned into an editable prompt for a new chat. Network approval prompts close when their requests end, and concurrent requests to the same endpoint prompt one at a time. Automatic context compaction now accounts for retained output from failed responses.

Gemini CLI

v0.67.0 (November 4) has two features among 27 entries: the models command, and the fix for a Claude hook timeout that migrated 1000x too small. See Gemini CLI v0.67 adds a models command and fixes the unit in Claude hook migration.

What to check now

If you run auto mode behind an LLM gateway, note the 2.1.319 change and set CLAUDE_CODE_AUTO_MODE_SERVER if needed
For unattended runs that must not stall, consider permissions.denyInsteadOfPrompting
Check your sign-in expiry with claude auth status
Move to 2.1.318 if you run on a network home directory

Summary

Auto mode asks about or denies calls the server can't check, with no classifier fallback
CLAUDE_CODE_AUTO_MODE_SERVER=0 restores the old behaviour; Bedrock, Vertex and Foundry are unchanged
permissions.denyInsteadOfPrompting turns a stalled prompt into a denial
Web and shell tool calls ask before sending your account email address
Codex 0.167.0 adds gcp_setup_wizard and opt-in system proxy settings

Gemini CLI v0.67 adds a models command and fixes the unit in Claude hook migration

aicoding-guide — Thu, 05 Nov 2026 19:17:46 +0000

Originally published at https://aicoding-guide.com.

Gemini CLI v0.67.0 carries 27 changes: two features and 22 fixes.

One of those fixes had real consequences for anyone running both Claude Code and Gemini CLI. Migrating a Claude hook configuration made its timeout 1000 times smaller.

Key point
What this article covers

Listing models with the models command and --list-models

Claude's hook timeout is seconds; Gemini's is milliseconds

The IDE companion now works inside container sandboxes

A models command for listing models

PR #29880 adds a models command and a --list-models flag for model discovery.

Until now there was no direct way to see which models you could pass to -m. This fills that gap.

Not in the documentation yet
As of 2026-11-06, neither the models command nor --list-models appears in the official documentation. v0.67.0 shipped on November 4, and the docs have not caught up. Check --help locally for the output format and options.

Migrating a Claude hook made its timeout 1000x smaller

This is PR #29899: "fix(cli): convert Claude hook timeout from seconds to milliseconds during migration."

The cause is a unit mismatch, visible when you put both references side by side.

Tool	Unit of `timeout`	Default
Claude Code	Seconds	600 for `command` / `http` / `mcp_tool`, 30 for `prompt`, 60 for `agent`
Gemini CLI	Milliseconds	60000

Claude Code's reference describes timeout as "Seconds before canceling". Gemini CLI's says "Execution timeout in milliseconds (default: 60000)".

So a Claude hook set to timeout: 600 (ten minutes), moved across without conversion, became 600 milliseconds on the Gemini side — short enough that almost any command times out immediately. If you migrated a configuration before v0.67.0, check those values.

{
  "hooks": {
    "PreToolUse": [
      {
        "hooks": [
          {
            "name": "security-check",
            "type": "command",
            "command": "$GEMINI_PROJECT_DIR/.gemini/hooks/security.sh",
            "timeout": 5000
          }
        ]
      }
    ]
  }
}

The environment variable names differ too
The other thing easily missed in a migration is the environment. Gemini CLI passes hooks GEMINI_PROJECT_DIR, GEMINI_PLANS_DIR, GEMINI_SESSION_ID and GEMINI_CWD. A command string referencing Claude Code's CLAUDE_PROJECT_DIR will not resolve when carried over as-is. The documentation also states hooks run with "a sanitized environment", so avoid relying on shell environment variables generally.

For the Claude Code side of the contract, see Claude Code hook input and output.

Relatedly, PR #29867 preserves ${VAR} placeholders during deprecated settings migration. v0.66.0 fixed placeholder resolution after .env files load, so this area has had attention in two consecutive releases.

IDE integration and containers

The second feature is PR #29858, which bridges the IDE companion into container sandboxes over exec stdio — so IDE integration works where the sandbox runs in a container.

Two IDE fixes also landed:

IDE settings files and GEMINI.md are excluded from the open-file context (PR #29848)
Relative file paths resolve against the active IDE workspace root (PR #29838)

The first avoids GEMINI.md entering the context twice: it is already loaded as project context, so passing it again as an open file duplicates it. For how it is loaded, see Installing Gemini CLI and writing GEMINI.md.

Cancellation and display fixes

Three fixes matter for unattended runs:

Termination signals are handled in non-interactive mode, and tools no longer execute after cancellation (PR #29849)
Continuation stream processing and auto-nudge stop after a request is cancelled (PR #29868)
Project spending cap errors are classified as terminal quota errors (PR #29961)

The third stops pointless retries once a spending cap is reached.

On display: Thai and Lao SARA AM width is corrected, and terminals that render ambiguous-width characters as wide are now handled. The latter may help where CJK text renders misaligned.

Also fixed: duplicate agent loading when the workspace is the home directory, read-only files and hard links respected in atomic writeTextFile, ripgrep resolution on Android (Termux), CRLF normalisation in getDiffContextSnippet, and MCP server and tool metadata included in ACP permission requests. For the previous release, see Gemini CLI v0.66 is fixes only, with the keybindings.json keys array now working.

Summary

v0.67.0 has two features and 22 fixes among 27 entries
A models command and --list-models list available models, though neither is documented yet
Migrating a Claude hook made its timeout 1000x smaller: Claude uses seconds, Gemini milliseconds
Environment variables need rewriting too, from CLAUDE_PROJECT_DIR to GEMINI_PROJECT_DIR
The IDE companion now works inside container sandboxes

Gemini CLI v0.66 is fixes only, with the keybindings.json keys array now working

aicoding-guide — Tue, 03 Nov 2026 19:17:47 +0000

Originally published at https://aicoding-guide.com.

Gemini CLI v0.66.0 adds no features. All 26 entries under "What's Changed" are fixes, refactors or release chores.

One of them is the kind worth knowing about, though: a setting the documentation already describes was not actually working. The keys array in keybindings.json works as of this release.

Key point
What this article covers

How to write the keys array, and what to check when a binding does nothing

Settings placeholders now resolved after .env files load

~/.gitconfig preserved in shell and git environments

The keys array in keybindings.json now works

The fix is PR #29773. Key bindings live in your home gemini directory, typically ~/.gemini/keybindings.json. It is a JSON array in a schema close to VS Code's, with a command and either a key or a keys array per entry.

[
  {
    "command": "edit.clear",
    "key": "cmd+l"
  },
  {
    "command": "-app.toggleYolo",
    "key": "ctrl+y"
  },
  {
    "command": "-input.newline",
    "keys": ["alt+enter", "ctrl+enter", "shift+enter", "ctrl+j"]
  },
  {
    "command": "input.newline",
    "keys": ["enter", "shift+enter"]
  }
]

Form	What it means
`-` prefixed on `command`	Unbinds the key, defaults included
A `keys` array	Binds or unbinds several keys in one entry; the first key is the primary shortcut shown in the UI
Modifiers	`ctrl`, `shift`, `alt` (`opt` / `option`), `cmd` (`meta`)

When a binding never fires, suspect the terminal
The documentation notes that terminals often translate complex combinations into special characters, losing the modifier information on the way. Its example is shift+5 arriving as %, where "you must bind to the literal character % as bindings to shift+5 will never fire." To see exactly what is sent, enable Debug Keystroke Logging and press f12 to open the debug log console.

Matching is explicit: a binding for ctrl+f fires on ctrl+f only, not ctrl+shift+f or alt+ctrl+f. And because the same key can be bound to different commands in different contexts, adding a binding does not unbind the key from anything else. To remove the old one, add a separate - prefixed entry.

Fixes around .env and the git environment

Three fixes concern the order configuration is loaded in.

PR	What changed
#29750	Settings placeholders are resolved after `.env` files load
#29832	The user-level `~/.gitconfig` is preserved in shell and git environments
#29760	Interactive credential and SSH prompts are disabled in `getSafeGitEnv`

The first matters if your settings file references a value defined in .env. Resolving before the load leaves the reference empty.

A related documented setting is advanced.ignoreLocalEnv (default false), which controls whether generic .env files in the project directory are ignored — the lever to reach for when a project's .env should not be read at all.

The third matters for unattended runs. When git asks for a credential or an SSH passphrase interactively, nobody is there to answer and the run hangs. Disabling those prompts makes it fail instead.

MCP and authentication fixes

MCP OAuth supports private network endpoints (PR #29844), on an opt-in basis — relevant when the MCP server lives inside your network
False positives in isAuthenticationError are prevented (PR #29835), where non-authentication failures were classified as authentication errors
Update verification tightened (PR #29757): the active binary is checked after an update, so a PATH-shadowed older binary is no longer reported as a successful update

For MCP configuration generally, see Setting up MCP servers in Gemini CLI.

The rest, and a Gemini 4 banner

The visible addition is a banner saying Gemini CLI is not optimized for Gemini 4 (PR #29774).

On rendering: synchronized output with isolated spinner rendering, debug console height calculation and flickering, right-hand border bleed in scrollable tool containers, preserved terminal scrollback during viewport refreshes, and rounding before unit selection in formatDuration.

Also: openDiff now formats and quotes Windows diff command arguments, SKILL.md frontmatter parsing handles single-line descriptions, slash-command conflict dedupe resets when conflicts reappear, and the bootstrap parent forwards termination signals to its child process.

For the previous release, see Gemini CLI v0.65 enforces read-only settings in untrusted folders.

Summary

v0.66.0 adds no features; all 26 "What's Changed" entries are fixes, refactors or release chores
The keys array in keybindings.json works now; unbind by prefixing command with -
When a binding never fires, check what the terminal sends with Debug Keystroke Logging and f12
Settings placeholders are resolved after .env files load
~/.gitconfig is preserved, and git's interactive prompts are disabled

Codex CLI v0.166 adds codex queue --resume and codex doctor --network-only

aicoding-guide — Sun, 01 Nov 2026 19:15:17 +0000

Originally published at https://aicoding-guide.com.

Codex CLI v0.166.0 ships six features and seven fixes. Two matter day to day: codex queue --resume and codex doctor --network-only.

Both are flags on existing commands, so knowing what each command already does is the quickest way to see what changed.

Key point
What this article covers

How codex queue works and the situation --resume fixes

What codex doctor checks, and what --network-only narrows it to

Approval settings and token accounting now surviving resume and fork

codex queue --resume resumes the thread

The release notes read: "Added codex queue --resume to resume unloaded threads after queueing a message."

codex queue itself is documented: it queues a text message for an existing session.

codex queue --thread <SESSION_ID> --message "Run the remaining checks"

Option	Detail
`--thread`	A UUID or an exact session name; use a UUID when sessions share a name
`--message`	The text to queue
Others	`--remote` and `--remote-auth-token-env` are accepted; image attachments are not

Previously, queueing a message to a thread that was not loaded left it waiting. With --resume, queueing and resuming happen in one step — useful when a script or CI job adds work to an existing session.

--resume is not in the commands documentation
As of 2026-11-02, the flags documented for codex queue are --thread, --message, --remote and --remote-auth-token-env. There is no entry for --resume; it appears only in the release notes.

codex doctor --network-only narrows the report

The other addition: "Added codex doctor --network-only for focused configuration, connectivity, and WebSocket diagnostics."

codex doctor is the diagnostic command to run before filing a support issue or while investigating a broken installation. The documentation describes its scope as "installation, configuration, authentication, runtime, Git, terminal, app-server, and thread inventory health".

# The full report
codex doctor

# Narrowed to configuration, connectivity and WebSocket
codex doctor --network-only

The full report includes the thread inventory, so it takes a while. When the symptom is clearly network-side — connections failing behind a proxy, WebSockets dropping — --network-only is the faster path.

This flag could not be confirmed in the documentation either: codex doctor's option table is rendered dynamically on that page, so individual flags are not readable from the Markdown.

For the network proxy settings themselves, see Combining approval_policy and sandbox_mode in Codex.

Transcript handling and the other features

The remaining four are display and interaction changes.

Addition	What it does
Transcript selection	Keyboard-driven, with word, line and page motions, integrated search, and configurable shortcuts
Markdown rendering	Made consistent in async questions, choices, answers and transcript replies
GPT-6.1 Terra	Added to the bundled, Vertex AI and Amazon Bedrock model catalogs
Safety-block explanations	Clearer reasons in the TUI, with selectable safer follow-up prompts

GPT-6.1 Terra reached the bundled catalog in v0.165.0; v0.166.0 adds it to the Vertex AI and Amazon Bedrock catalogs. That follows v0.165.0 making Vertex AI a built-in provider via model_provider = "gcp" — see Codex CLI v0.165 makes Vertex AI a built-in provider.

Fixes around resume and fork

Two of the seven fixes concern resuming and forking sessions.

Approval and permission settings persist: "Preserved acknowledged approval and permission settings when resuming or forking threads."
Reasoning-token accounting persists: "Preserved reasoning-token accounting across resume and fork to avoid premature compaction."

The second has the clearer practical effect. When the accounting reset, a resumed session could be judged to have met the compaction threshold while it actually had room left, so context was lost earlier than it needed to be.

Also fixed: spawned descendant threads are restored when their parent is unarchived, app-server thread startup and shutdown races are resolved with completed runtimes released promptly, and TUI reconnection recovery now handles offline /quit and /exit.

Summary

codex queue --resume queues a message and resumes an unloaded thread in one step
codex queue takes a UUID or exact session name in --thread and does not support image attachments
codex doctor --network-only narrows diagnostics to configuration, connectivity and WebSocket
Approval settings and reasoning-token accounting now survive resume and fork
Neither --resume nor --network-only could be confirmed in the official commands documentation

This week in Claude Code, Codex and Gemini CLI (week of November 1, 2026)

aicoding-guide — Sat, 31 Oct 2026 19:08:39 +0000

Originally published at https://aicoding-guide.com.

This week has a deadline in it. Fast mode for Opus 4.8 is deprecated as of 2026-10-30 and removed on 2026-11-30. The CHANGELOG is specific that after removal, fast mode requests on Opus 4.8 return an error and do not fall back to standard Opus 4.8.

On the feature side, idle compaction spread to VS Code and the desktop app — two weeks after it arrived, terminal-only.

Key point
This week in brief

Fast mode on Opus 4.8 is removed on November 30; move to Opus 5.5 to keep the speedup

Idle compaction was added to VS Code and the desktop app's Code tab

permissions.blockWritesOutsideWorkingDirectories was added

Claude Code

Four releases: 2.1.311, 2.1.312, 2.1.314 and 2.1.316.

A deprecation with a date (2.1.316)

The CHANGELOG reads: "Deprecated fast mode for Opus 4.8 as of October 30, 2026; it will be removed on November 30, 2026. After removal, fast mode requests on Opus 4.8 return an error and do not fall back to standard Opus 4.8. Migrate to Opus 5.5 to keep the speedup."

If a script or settings file assumes fast mode, move it to Opus 5.5 during November. After removal it does not quietly get slower — it errors.

Confining writes to the working directories (2.1.314)

Setting	What it does
`permissions.blockWritesOutsideWorkingDirectories`	Write, Edit and NotebookEdit refuse paths outside the working directories in every permission mode

It pairs with permissions.blockReadsOutsideWorkingDirectories on the read side. With both set, the reach of the file tools no longer depends on the permission mode.

Idle compaction spread (2.1.314)

"Added idle compaction to VS Code and Claude Desktop's Code tab: a 200K+ token conversation left idle is summarized, and the summary is used on your next message if the prompt cache has expired."

What landed in the terminal in 2.1.299 reached VS Code and the desktop Code tab two weeks later. For the conditions and how to turn it off, see Making Claude Code compact earlier, or never.

New environment variables (2.1.316)

Variable	What it does
`CLAUDE_CODE_DISABLE_ULTRATHINK`	Turns the `ultrathink` keyword off
`CLAUDE_CODE_SUBAGENT_EFFORT`	Sets the effort subagents run at when nothing else names one, instead of inheriting the session's

Telemetry and permissions (2.1.312, 2.1.316)

claude_code.safety_event stopped being sent after a week
The claude_code.safety_event OpenTelemetry event added in v2.1.307 was withdrawn in v2.1.312: "Changed Claude Code to stop sending the claude_code.safety_event OpenTelemetry event." We covered it in last week's digest; it lasted a week. A dashboard built on that event needs rebuilding.

On security, --restricted sessions could upload files from outside the working directories when a Read allow rule covered them; that is fixed. Separately, for Team and Enterprise logins, server-managed settings fetched from Anthropic's API now apply without an approval prompt, and a stored copy that doesn't verify is refused.

Easy ones to miss

Sessions failing turn after turn with "Invalid effort level" where an admin caps a model's effort are fixed: Claude Code lowers the effort, retries, and says which level it uses (2.1.314)
A PreCompact hook with very large output could make compaction fail or repeat; each hook's output is now cut at 10,000 characters (2.1.314)
Claude could overwrite a very large CLAUDE.md, rules file or @-included file after seeing only its start; Write now asks Claude to read it all or edit in place (2.1.312)
Standard-context sessions that stopped with "Usage credits required for 1M context" past 200K tokens now compact and continue (2.1.311)
SubagentStop hooks were firing about twice a minute per running subagent instead of once at the end (2.1.311)

Codex

v0.165.0 brought the Vertex AI provider and memories by default; see Codex CLI v0.165.

v0.166.0 adds six features.

Addition	What it does
`codex queue --resume`	Resumes unloaded threads after queueing a message
`codex doctor --network-only`	Runs focused configuration, connectivity and WebSocket diagnostics
Transcript selection	Keyboard-driven, with word, line and page motions, search and configurable shortcuts
GPT-6.1 Terra	Added to the bundled, Vertex AI and Amazon Bedrock model catalogs
Safety-block explanations	Clearer reasons in the TUI, with selectable safer follow-up prompts

Two fixes stand out, both about resuming: acknowledged approval and permission settings are now preserved when resuming or forking threads, and reasoning-token accounting is preserved across resume and fork to avoid premature compaction.

Gemini CLI

v0.66.0 is 26 entries of fixes and chores with no features. The configuration-related ones:

Settings placeholders are now resolved after .env files are loaded
The user-level ~/.gitconfig is preserved in shell and git environments
Interactive credential and SSH prompts are disabled in getSafeGitEnv
MCP OAuth flows support opt-in private network endpoints
keybindings.json supports a keys array

A banner was also added saying Gemini CLI is not optimized for Gemini 4. For the previous release, see Gemini CLI v0.65 enforces read-only settings in untrusted folders.

What to check now

If you use fast mode on Opus 4.8, move to Opus 5.5 before November 30
Rebuild any telemetry that relied on claude_code.safety_event
Note that idle compaction now runs in VS Code and the desktop app too
Set permissions.blockWritesOutsideWorkingDirectories if you want writes confined

Summary

Fast mode on Opus 4.8 is removed on 2026-11-30 and will error, with no fallback
Idle compaction was added to VS Code and the desktop app's Code tab
permissions.blockWritesOutsideWorkingDirectories confines writes in every permission mode
claude_code.safety_event stopped being sent a week after it was added
Codex 0.166.0 adds codex queue --resume and codex doctor --network-only

Codex CLI v0.165 makes Vertex AI a built-in provider and turns memories on by default

aicoding-guide — Thu, 29 Oct 2026 19:19:07 +0000

Originally published at https://aicoding-guide.com.

Codex CLI v0.165.0 brings six features and six fixes. Two of them touch configuration: a built-in Vertex AI provider and memories on by default.

For both, the release notes are ahead of the official configuration reference. Check the behaviour on your own machine before relying on either.

Key point
What this article covers

The Vertex AI provider configured with model_provider = "gcp"

Why the release notes and the configuration reference disagree about memories

Changing reasoning effort partway through a conversation

Vertex AI is now a built-in provider

The release notes read: "Added a built-in Google Cloud Vertex AI provider, configured with model_provider = "gcp"." Using Vertex AI previously meant writing your own model_providers entry; now it is treated as built in.

gcp is not in the configuration reference yet
As of 2026-10-30, the reference lists only three built-in provider IDs: "Built-in provider IDs (openai, ollama, and lmstudio) are reserved and cannot be overridden." There is no mention of gcp or Vertex AI. The ID appears only in the release notes.

Where you write the setting matters. The configuration reference states that model_provider and model_providers are ignored in a project-local .codex/config.toml.

# Put this in ~/.codex/config.toml; a project-local copy is ignored
model_provider = "gcp"

The ignored keys include openai_base_url, chatgpt_base_url, model_provider, model_providers, notify, profile, profiles and otel. Provider, notification and telemetry keys belong in user-level config. For defining a custom provider, the fields are model_providers.<id>.name, .base_url, .env_key and others, covered in Configuring Codex with config.toml.

GPT-6.1 Terra was also added to the model catalogs.

Memories are on by default for fresh profiles

The release notes read: "Enabled memory v2 by default for fresh profiles and added support for importing external-agent memories into it."

The two sources disagree on the default
The configuration reference still describes features.memories as "Enable Memories (off by default)" (checked 2026-10-30). The term "memory v2" does not appear in the memories documentation at all. Since the documents do not settle which applies, check the actual state with /memories.

The mechanism itself is documented.

Aspect	Detail
Storage	`~/.codex/memories/`, holding summaries, durable entries, recent inputs and evidence
When they are written	In the background once a chat has been idle long enough, not at the end of every chat
What is skipped	Active and short-lived sessions; secrets are redacted from generated memory fields
Throttling	A background pass is skipped when your rate-limit remaining percentage is below the configured threshold
Per-chat control	`/memories` chooses whether the chat can use existing memories and whether it feeds future ones

The documentation is also explicit about the limits of relying on them: "Keep required team guidance in AGENTS.md or checked-in documentation. Treat memories as a helpful recall layer, not as the only source for rules that must always apply."

On the files themselves, it says "Treat these files as generated state" — fine to inspect when troubleshooting or before sharing your Codex home directory, but not a control surface to edit by hand.

Reasoning effort can change mid-conversation

Another entry reads: "Enabled reasoning effort changes during a conversation by default for supported models." On models that support it, you can change the depth after a conversation has started.

Switching through /model already existed; what changed is that mid-conversation changes are enabled by default. For the values and the ways to set them, see How to change reasoning effort in Codex CLI.

The session picker also gained a repository filter, and the agent command center now groups by directory, which makes sessions easier to find across linked worktrees.

Security and the other fixes

There are six fixes. The security one reads: "Closed a marketplace URL validation gap that could allow Git to connect to a different host than the one checked against allowed patterns."

The remaining fixes that change behaviour:

Fresh TUI sessions now honour the server's default approval reviewer when no explicit override is given
TUI preferences stay editable and immediately applicable when execution settings are invalid
Queued agent messages no longer restart work after an interrupt or a switch to Plan mode
When a provider reports that a model was not found, Codex stops retrying and preserves the error message

For the previous release, see Codex CLI v0.164 adds /presets and inline /permissions arguments.

Summary

A built-in Vertex AI provider is configured with model_provider = "gcp"
gcp could not be confirmed in the configuration reference, which still lists only openai, ollama and lmstudio
model_provider is ignored in a project-local .codex/config.toml; put it in user-level config
Memories are said to be on by default for fresh profiles, while the reference still says off by default
A marketplace URL validation gap that could redirect Git to another host was closed

Claude Code vs Cursor compared on pricing, permission settings and rule files

aicoding-guide — Tue, 27 Oct 2026 19:19:33 +0000

Originally published at https://aicoding-guide.com.

Claude Code and Cursor are both coding agents. Cursor is known as an editor, but it now ships a CLI too, so using it from a terminal looks much like using Claude Code.

What changed in 2026 is what your subscription includes. Cursor is sold as part of the X Subscription, and what comes with it is Grok and Composer. Using Claude's models costs extra. That is the single biggest factor in choosing between them.

Key point
What this article covers

The models each subscription actually includes

Similar permission syntax, but different places you can put settings

How the project rule files differ

At a glance

Verified against the official documentation as of 2026-10-28.

	Claude Code	Cursor
Surfaces	CLI, VS Code extension, desktop app	Editor, CLI, cloud agents
Models included	Claude models	Cursor models (Grok 4.7 / 4.6 / 4.5, Composer 2.5)
Third-party models	N/A	Not included; Premium and above pay API list price from prepaid credit
Usage unit	Rolling five-hour session window	A pool that refreshes weekly
Permission syntax	`Bash(...)`, `Read(...)`, `Edit(...)`	`Shell(...)`, `Read(...)`, `Write(...)`, `WebFetch(...)`, `Mcp(...)`
Config file	`settings.json`, five scopes	`cli-config.json` (global) and `cli.json` (project)
Rule file	`CLAUDE.md`	Four kinds, including `.mdc` files in `.cursor/rules` and `AGENTS.md`

The subscriptions include different models

The documentation opens with it: "Cursor is sold as part of The X Subscription, one subscription for Grok, Cursor, and X." Paid plans come with a weekly pool of usage for Cursor's models, and third-party models are not included.

Cursor plan	Monthly	Annual
Free	$0	—
Plus	$8	$80
Premium	$30	$300
Super	$100	$1,000
Ultra	$200	$2,000

Teams is $30, $100 or $200 per seat, and Enterprise is custom. Prices exclude tax.

Plus is the tier to read carefully. The documentation says it runs Cursor's own models at fixed settings: Fast off, effort medium, and Grok 4.7 on the 256k context window. No Auto, Cloud Agents, Automations, Bugbot, Origin, third-party models, or your own API keys.

On the Claude side, Free is $0, Pro is $20 billed monthly or $17/mo billed annually ($200 up front), and Max starts at $100 for 5x or 20x Pro's usage. Claude Code is included in Pro and Max, and is not available on Free. Limits "reset on a rolling five-hour session window".

The same money buys different things
At $8 against $20, Cursor Plus looks like the cheaper option. But Plus runs Grok and Composer, not Claude. Running Claude's models through Cursor needs Premium or above plus prepaid credit, which reverses the comparison. The reliable question is not which is cheaper but which subscription contains the model you want to use.

The documentation also calls Pro, Pro+, Ultra, Start, and Teams Standard and Premium "legacy Cursor plans". Note that Ultra appears in both the current and the legacy lists, so the names overlap.

The permission syntax is similar

Cursor CLI's permission tokens look a lot like Claude Code's. You list them under permissions.allow and permissions.deny.

{
  "permissions": {
    "allow": [
      "Shell(git)",
      "Read(src/**/*.ts)",
      "Write(package.json)",
      "WebFetch(docs.github.com)",
      "Mcp(datadog:*)"
    ],
    "deny": [
      "Shell(rm)",
      "Read(.env*)",
      "Write(**/*.key)"
    ]
  }
}

Shell is Shell rather than Bash, and edits are Write rather than Edit. For MCP, Claude Code writes mcp__<server>__<tool> while Cursor writes Mcp(server:tool). Keeping .env out of reach works the same way in both. For the Claude Code syntax, see Claude Code permissions in settings.json.

The real difference is where settings can live. Cursor CLI reads ~/.cursor/cli-config.json globally and <project>/.cursor/cli.json per project, but the documentation states: "Only permissions can be configured at the project level. All other CLI settings must be set globally."

So in Cursor, permissions are the only thing a project can vary. That is a different design from Claude Code, where five scopes from managed settings down to user settings can override nearly any key.

Rule file conventions

Cursor has four kinds of rules.

Kind	Where it lives
Project Rules	`.mdc` files in `.cursor/rules`, version-controlled
User Rules	Global to your Cursor environment
Team Rules	Managed from the dashboard, on Team and Enterprise plans
AGENTS.md	Markdown instructions, a simpler alternative to `.cursor/rules`

The extension is the trap in Project Rules. The documentation says "A plain .md file in .cursor/rules is ignored by the rules system because it has no frontmatter to specify description, globs, and alwaysApply." Use .mdc, or use AGENTS.md instead.

Claude Code uses CLAUDE.md. Because Cursor reads AGENTS.md, the tidiest arrangement for using both is to keep the shared content in AGENTS.md and reference it from CLAUDE.md. Codex reads AGENTS.md too, which makes this pay off across all three.

Choosing between them

Situation	The better fit
You mainly want Claude's models	Claude Code
You want completions while writing in the editor	Cursor
You want settings to vary per project	Claude Code, where more than permissions is per-project
You are happy on Grok and Composer and want a cheap start	Cursor Plus
You are wiring it into CI	Either; both have a CLI, so follow your existing subscription

Model quality is left out deliberately, since it changes with each release. For the same comparison against other tools, see Codex vs Claude Code and Gemini CLI vs Claude Code.

Summary

Cursor is sold inside the X Subscription and includes Grok 4.7 / 4.6 / 4.5 and Composer 2.5
Third-party models are not included; Premium and above pay API list price from prepaid credit, and Plus cannot use them
Claude Code comes with Pro ($20/mo) and Max (from $100), and is not on Free
The permission syntax is close, but Cursor can only vary permissions per project
A plain .md in .cursor/rules is ignored; use .mdc or AGENTS.md

Codex CLI v0.164 adds /presets and inline /permissions arguments for permission profiles

aicoding-guide — Sun, 25 Oct 2026 19:17:04 +0000

Originally published at https://aicoding-guide.com.

Codex CLI v0.164.0 is the first release in a while with several genuine features. The two that matter are /presets and inline /permissions arguments.

The second is more than a typing shortcut. Behind it sits permission profiles, a beta mechanism that does not combine with the older sandbox_mode settings. Configure both without knowing that, and one of them is silently ignored.

Key point
What this article covers

What the ten /presets slots hold

How the permission profiles that /permissions selects are built

Why permission profiles and sandbox_mode cannot be used together

Ten preset slots for prompts

The release notes read: "Save reusable prompts and slash commands in ten numbered /presets slots, with a keyboard menu for quick access."

Reusable prompts and slash commands go into ten numbered slots, recalled from a keyboard menu. It gives the standing instructions you retype every session somewhere to live.

The other input-side addition is arguments for /model and /permissions: "Set model, reasoning effort, speed, and permission profiles directly with inline /model and /permissions arguments." Instead of opening a menu and choosing, you pass the value on the command.

/presets and /permissions are not in the official list
As of 2026-10-26, the official slash command list (28 entries) has no row for /presets or /permissions. That page does say "Available commands vary based on your environment and access", so availability may vary, but neither could be confirmed in the documentation. Nor is there any statement of where the preset slots are stored.

The permission profiles behind /permissions

The permission profiles that /permissions selects are a beta feature with their own documentation page: "A profile is a named policy that combines filesystem rules, which define what commands can read or write, with network rules, which define which destinations commands can reach."

Three profiles are built in.

Profile	What it does
`:read-only`	Keeps local command execution read-only
`:workspace`	Allows writes inside the active workspace roots and system temp directories
`:danger-full-access`	Removes local sandbox restrictions; only when that breadth is intended

Define your own under [permissions.<name>] and select it with the top-level default_permissions key.

default_permissions = "project-edit"

[features]
network_proxy = true

[permissions.project-edit.workspace_roots]
"~/code/app" = true
"~/code/shared-lib" = true

[permissions.project-edit.filesystem]
":minimal" = "read"

[permissions.project-edit.filesystem.":workspace_roots"]
"." = "write"
".devcontainer" = "read"
"**/*.env" = "deny"

[permissions.project-edit.network]
enabled = true

[permissions.project-edit.network.domains]
"api.openai.com" = "allow"
"*.github.com" = "allow"
"tracking.example.com" = "deny"

The **/*.env deny line is the practically useful part: writes stay allowed inside the workspace while environment files are carved out.

network.enabled = true alone does not enforce domain rules
The documentation states: "A profile's network.enabled = true permits command network access, but it does not start the network proxy." To have the domain rules enforced, also set features.network_proxy = true in config.toml. Without an active proxy, those domain rules do not restrict direct network access.

Permission profiles and sandbox_mode do not mix

This is the part that catches people migrating. The documentation is explicit: "Permission profiles do not compose with the older sandbox settings. Configure either default_permissions and [permissions], or sandbox_mode / sandbox_workspace_write, but not both."

The resolution falls entirely to one side. If sandbox_mode appears anywhere in a loaded config file, if you pass --sandbox, or if the selected config profile sets sandbox_mode, Codex uses the older sandbox settings rather than default_permissions.

So a sandbox_mode line left over in ~/.codex/config.toml silently voids a permission profile you just wrote. Remove the old settings first. For the older model, see Combining approval_policy and sandbox_mode in Codex.

Credential masking and the other fixes

Two security changes landed. One is "Mask credentials during supported remote Bash commands and Zsh snapshot sessions", which covers custom provider credentials too. The other is "Hardened sandbox checks for case-variant metadata paths on macOS and replaceable symlinks used to locate executables."

Three fixes stand out:

A failed compaction no longer leaves partial summaries in conversation history
Resuming a session now finds compressed histories and restores saved thread settings
Windows HTTPS and WebSocket connections handle proxy authentication challenges with the signed-in user's credentials

Beyond those, enterprise MCP connections can authenticate through Codex account grants or a dedicated sign-in, and the Amazon Bedrock setup wizard is now on by default. For the previous release, see Codex CLI v0.163 turns Daybreak back on by default.

Summary

/presets stores reusable prompts and slash commands in ten numbered slots
/model and /permissions now accept their settings as inline arguments
The permission profiles /permissions selects are beta; the built-ins are :read-only, :workspace and :danger-full-access
Permission profiles do not combine with sandbox_mode; a leftover sandbox_mode wins
/presets and /permissions could not be confirmed in the official slash command list

This week in Claude Code, Codex and Gemini CLI (week of October 25, 2026)

aicoding-guide — Sat, 24 Oct 2026 19:08:18 +0000

Originally published at https://aicoding-guide.com.

This was a security fix week. Claude Code 2.1.309 carries more than ten fixes for routes around the sandbox and the permission checks. Codex 0.164.0 hardened its own sandbox checks and added credential masking.

Codex also shipped features. /presets stores prompts and slash commands in ten slots, and /model and /permissions now take their settings as arguments.

Key point
This week in brief

Claude Code 2.1.309 concentrates fixes for sandbox and permission-check bypasses

Codex 0.164.0 adds /presets and masks credentials in remote Bash

Claude Code gained the claude_code.safety_event OpenTelemetry event

Claude Code

Eight releases this week, 2.1.303 through 2.1.310.

Sandbox and permission bypasses (2.1.309)

This release is lopsided: it is largely a list of routes that worked when they should not have.

Route	What was wrong
Shell startup files	On macOS and Linux, every sandboxed Bash command ran the shell's startup files outside the sandbox first
Symbolic links	macOS `denyWrite` glob patterns did not apply at a path's real location when the pattern's folder was reached through a symlink
MCP config file	Sandboxed commands and auto-accepted edits could modify the config passed with `--mcp-config`
Redirects	The Bash permission check trusted a variable set by a command whose redirect can fail to open
Compound commands	A `cd` that was wrapped or prefixed before a git command did not prompt, as a plain `cd` does
Deny rules	An `Edit(path)` deny rule did not block a Bash redirect to that path in some commands holding a subshell
Worktree isolation	Locale-prefixed commands, and some zsh arithmetic commands, passed the isolation guard

On Windows, PowerShell permission checks were auto-approving some Set-Location and cd commands that carry extra arguments. 2.1.310 adds another: with Git Bash missing, PreToolUse and PermissionRequest hooks let a tool call through when the hook's command was only quoted strings.

Upgrade if you depend on deny rules or the sandbox
These are "configured but not actually enforced" fixes. If your setup assumes .env cannot be read or writes are confined, move to 2.1.310 and then review the rules themselves. Claude Code permissions in settings.json covers the syntax.

Telemetry and settings (2.1.305, 2.1.307)

claude_code.safety_event: a new OpenTelemetry event for each tool call that a permission rule, auto mode, a safety check, a hook or the sandbox stopped, prompted on, or sent back
sandbox.allowNestedUserNamespaces: lets sandboxed commands on Linux create user namespaces, for Chromium and rootless podman. The CHANGELOG also states plainly that this lets them get around the sandbox's file protections
CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS: unattended retry mode now notices a usage limit lifted before its reset

Easy ones to miss (2.1.304, 2.1.310)

CLAUDE_CODE_AUTO_COMPACT_WINDOW=200k silently set a 100K window. The variable now accepts k and M suffixes and warns when a value is out of range
A very large cleanupPeriodDays made background cleanup delete some recent files, such as pasted images
claude --worktree removed the worktree and its branch without asking at exit when HEAD was detached or on another branch, which could lose commits

Codex

v0.164.0 is a feature release.

Addition	What it does
`/presets`	Saves reusable prompts and slash commands in ten numbered slots, recalled from a keyboard menu
`/model` and `/permissions` arguments	Set model, reasoning effort, speed and permissions inline as arguments
Image preview	Shows viewed and generated images in the fullscreen transcript on Kitty or Sixel terminals
Enterprise MCP auth	Authenticates through Codex account grants or a dedicated sign-in, including OAuth clients that need secrets
Credential masking	Masks credentials in remote Bash commands and zsh snapshot sessions, custom provider credentials included
Bedrock setup	The Amazon Bedrock setup wizard is now on by default

On the security side, sandbox checks were hardened for case-variant metadata paths on macOS and for replaceable symlinks used to find executables — the same direction as Claude Code's symlink fixes this week.

Among the fixes, two stand out: a failed compaction no longer leaves a partial summary in history, and Windows HTTPS and WebSocket connections now handle proxy authentication with the signed-in user's Negotiate or NTLM credentials. For the previous release, see Codex CLI v0.163 turns Daybreak back on by default.

Gemini CLI

v0.65.0 (October 20) had one feature among 27 entries, the otlpHeaders telemetry setting. The change that matters more in practice is that workspace settings in an untrusted folder are now enforced as read-only. See Gemini CLI v0.65 enforces read-only settings in untrusted folders.

What to check now

Move Claude Code to 2.1.310, first if you rely on the sandbox or on deny rules
Check whether cleanupPeriodDays is set to an extreme value
If you wrote a suffixed value such as 200k for CLAUDE_CODE_AUTO_COMPACT_WINDOW, confirm it is the window you meant
Upgrade Codex to 0.164.0 if you use its sandbox

Summary

Claude Code 2.1.309 fixes more than ten ways around the sandbox and the permission checks
Sandboxed commands were running the shell's startup files outside the sandbox first
claude_code.safety_event makes blocked and prompted tool calls measurable
Codex 0.164.0 adds /presets, inline /model and /permissions arguments, and credential masking
Gemini CLI v0.65.0 enforces untrusted folder settings and adds otlpHeaders

Gemini CLI v0.65 enforces read-only settings in untrusted folders and adds OTLP headers

aicoding-guide — Thu, 22 Oct 2026 19:17:52 +0000

Originally published at https://aicoding-guide.com.

Gemini CLI v0.65.0 carries 27 changes, but only one is a feature: the telemetry OTLP exporter now accepts custom headers. The rest is 25 fixes and one performance change.

As in the previous release, untrusted folder handling and @ references both got attention. Those are the same two areas v0.64.0 touched, so this is the second release in a row working on them.

Key point
What this article covers

Workspace settings in an untrusted folder are now enforced as read-only

How to write otlpHeaders, the release's only new feature

Fixes around session resume, OAuth and @ references

Untrusted folder settings are enforced as read-only

PR #29583 makes workspace settings read-only in a folder you have not trusted.

Folder trust exists to stop an unvetted project from loading its own configuration. Per the documentation, an untrusted folder does not load .gemini/settings.json or .env, cannot install or update extensions, disables tool auto-acceptance, and does not connect to MCP servers.

v0.64.0 fixed headless mode treating an untrusted folder as trusted. This release continues that work by closing the write side. If your CI depends on the feature, v0.65.0 is the version that has both. For the previous release, see Gemini CLI v0.64 fixes the CPU hang on @ inside code.

Relatedly, PR #29672 removes false positives from the untrusted command flag and compound loop checks — the case where the check erred so far toward caution that ordinary commands were caught by it.

The only new feature is custom OTLP headers

PR #29641 adds otlpHeaders to the telemetry settings, so you can attach arbitrary headers to OTLP exporter requests. That is what you need when the collector you send to requires an authentication header.

{
  "telemetry": {
    "enabled": true,
    "target": "local",
    "otlpEndpoint": "http://localhost:4317",
    "otlpProtocol": "grpc",
    "otlpHeaders": {
      "x-api-key": "your-key"
    }
  }
}

The documentation's settings table defines it as:

Setting	Environment variable	Values	Default
`otlpHeaders`	`GEMINI_TELEMETRY_OTLP_HEADERS`	JSON or `key=value`	none

Because the environment variable works too, a CI job can pass the key from its own secret store instead of a settings file.

A key written into the header stays in the settings file
Putting an API key directly in otlpHeaders leaves it in .gemini/settings.json. If you commit that file, pass the value through GEMINI_TELEMETRY_OTLP_HEADERS instead.

Session resume and authentication fixes

Six fixes address losing work or failing to sign in.

PR	What it fixes
#29584	A resumed session's history being deleted on a quick exit (Issue #29198)
#29618	Duplicate tool response turns when resuming a session
#29728	Session poisoning on a rapid Ctrl-C interruption
#29655	Infinite verification and OAuth retry loops
#29643	Cached credentials now cleared when Google login is re-selected
#29616	OAuth callback `iss` validation aligned with RFC 9207 metadata

#29584 and #29728 are the kind of bug that costs you work. If you routinely resume long sessions, they are the reason to upgrade.

@ references and ignore-file performance

PR #29617 stops the eager recursive file reading that @ references triggered, so pointing at a directory with @src/ no longer pulls in its contents unconditionally.

v0.64.0 fixed the CPU hang on code containing @, so @ handling has now been worked on in two consecutive releases.

On performance, PR #29582 optimises ignore filtering and enables subtree pruning (Issue #29077), which helps when file discovery is slow in a large repository.

Also fixed: the Enter key hanging in interactive mode (PR #29476, Issue #23297), one extension failing the allowlist check preventing the others from loading (PR #29720), and unnecessary terminal clears when expanding with Ctrl+O (PR #29640). For MCP configuration, see Setting up MCP servers in Gemini CLI.

Summary

Of 27 entries in v0.65.0, one is a feature, one is performance, and 25 are fixes and release work
Workspace settings in an untrusted folder are now enforced as read-only
The feature is telemetry.otlpHeaders, also settable via GEMINI_TELEMETRY_OTLP_HEADERS
Resumed session history loss and session poisoning on rapid Ctrl-C are fixed
@ references no longer read recursively ahead of time, continuing v0.64's @ work