Daily brief

Codex Keeps Untrusted Folders Locked Unless You Pass Trust, and Claude Code Adds Opt In Code Mode

By Steven Sorensen · 13 Nov 2026

A developer seen from behind at a pale birch desk looks at a landscape monitor with three stacked blank tiles against a cornflower blue wall, with a closed manila folder and a blank keyboard on the desk.

At a glance

Codex no longer loads project settings or MCP servers in a folder you have not trusted, even when the sandbox can write.
A new flag lets you save that trust on purpose when you own the repository.
Claude Code can write small scripts to call its own tools, but only if you switch the new mode on.
Plugin authors can tell Claude Code which releases a plugin supports, so mismatched plugins stop loading.

Codex v0.169.0 landed at about 3:37 AM ET today, a few hours after v0.168.0. Claude Code v2.1.323 went up on GitHub at about 5:12 PM ET on Thursday. Both Cursor changelogs are unchanged since yesterday, and the GitHub changelog has had no AI or IDE item since Nov 11.

Treat today as a trust settings day: check that your Codex scripts still pass trust on purpose, leave Code Mode off on shared machines until the docs page is live, and add a Claude Code version range to any plugin you ship.

Top Stories

1. Codex v0.169.0 keeps untrusted folders locked down in codex exec

The bug fix that matters most in Codex v0.169.0 is about trust. The notes say codex exec keeps project configuration and MCP servers disabled in untrusted directories, even with --sandbox workspace-write. To save project trust on purpose, you now pass --trust with codex exec or codex review.

v0.169.0 also adds multiple side chat tabs to the opt in terminal workspace. npm latest for @openai/codex now points to v0.169.0, and the alpha tag is at v0.171.0-alpha.2, which belongs on a test machine only.

Practical dev impact: If a CI job or script runs codex exec in a fresh checkout and relies on project MCP servers, it will now run without them. Add --trust only where you own the repository, and leave it off for code you are reviewing from outside.

2. Claude Code v2.1.323 adds an experimental Code Mode and plugin version ranges

The v2.1.323 notes add Code Mode, an experimental opt in in which Claude writes JavaScript to call its tools. The notes say you can turn it on yourself, or turn it off for an organization, and they point to a Code Mode page on the Claude Code docs. That page still returned Page Not Found when we checked this morning, so the release note is the only source for now and we are not guessing at settings.

The second change matters more to anyone who ships plugins. A plugin.json file can now carry an engines["claude-code"] range. Plugins outside their stated range are not installed, updated or loaded, and install and update pick the newest plugin version that fits. The plugins reference says that file lives at .claude-plugin/plugin.json under the plugin root. claude plugin validate also gains type checking of a plugin's TypeScript hooks module, with each finding reported as a warning and --strict failing on it.

Among the fixes, running /compact again, or after a command such as /context, no longer summarizes away a message Claude had not answered yet. A resumed session no longer joins your next message to an old interrupted one. Claude Code now warns at startup about Bash allow rules with an asterisk inside a variable's value, such as Bash(PORT=* npm run dev).

One channel note: npm latest and next for @anthropic-ai/claude-code both point to v2.1.323, while the stable tag is still v2.1.311.

Practical dev impact: If you maintain a plugin, add a Claude Code version range to .claude-plugin/plugin.json and run claude plugin validate --strict before your next release. Leave Code Mode off on shared machines until the docs page is live and your team has read it.

Practical Impact Analysis

Our read: the Codex trust change is the item most likely to break something quietly, because a job that used to load project MCP servers will now run without them and may still pass. Check one scripted run today, and add --trust only where you own the repository.

Claude Code's plugin version ranges are the quiet win for teams with a shared plugin marketplace. Code Mode is the bigger idea, but with only one line in the notes and no live docs page, it is something to read about rather than enable this week. On the rest of the board, Copilot CLI latest moved to v1.0.110, whose notes add an experimental masked dialog for git, ssh and sudo password prompts once you run /experimental on. The prerelease tag already points to v1.0.111-0, which is for a test machine only. Gemini CLI latest is still v0.68.0, and Qwen Code latest moved to v0.27.3 overnight. If you have one hour, run one Codex script in a fresh clone and validate one plugin.

Tutorial

Open a test shell. The active commands below only print registry tags, versions and file names.
Run step 2 from the root of a plugin you maintain, if you have one.
Uncomment an install line in step 3 only if you want the pinned builds.
The commented codex exec line in step 4 is our example prompt, not a documented sample. Keep it harmless, and add --trust only in a repository you own.

# We have not run this script end to end on every platform. It prints and checks, and changes no files.
# Run it in a test shell. Nothing is written to your shell profile.

# 1. Snapshot at 5:50 AM ET Fri 13 Nov 2026, npm registry channel:
#    @openai/codex latest v0.169.0
#    @anthropic-ai/claude-code latest v2.1.323, stable v2.1.311
#    @github/copilot latest v1.0.110, prerelease v1.0.111-0
npm view @openai/codex dist-tags.latest
npm view @anthropic-ai/claude-code dist-tags.latest dist-tags.stable
npm view @github/copilot dist-tags.latest dist-tags.prerelease
if command -v codex >/dev/null; then codex --version; else echo "no codex on PATH"; fi
if command -v claude >/dev/null; then claude --version; else echo "no claude on PATH"; fi
if command -v copilot >/dev/null; then copilot --version; else echo "no copilot on PATH"; fi

# 2. Plugin authors: does .claude-plugin/plugin.json declare a Claude Code version range yet?
#    Path from the plugins reference. The engines range itself is from the v2.1.323 notes.
if [ -f .claude-plugin/plugin.json ]; then grep -l "engines" .claude-plugin/plugin.json; fi
# claude plugin validate --strict .

# 3. Optional installs only. Pinned at 5:50 AM ET Fri 13 Nov 2026, npm registry channel:
# npm install -g @openai/codex@0.169.0
# npm install -g @anthropic-ai/claude-code@2.1.323
# npm install -g @github/copilot@1.0.110
#    Test machine only, npm prerelease channel, not for production:
# npm install -g @github/copilot@1.0.111-0

# 4. Codex in a repository you own: save trust on purpose. The prompt text is ours.
#    Leave --trust off for code you are reviewing from outside.
# codex exec --trust "list the top level files in this repository"

echo "Done. Nothing was installed or changed on disk."

If npm view shows newer tags, refresh before you pin.

Sources:

Recommended AI prompt

Copy this paragraph into ChatGPT, Claude, Gemini, Grok, or whatever AI you use.

Prompt

You are my developer tooling lead for Friday 13 November 2026. Story 1: Codex v0.169.0 keeps project configuration and MCP servers disabled in untrusted folders during codex exec, even with a writable sandbox, unless I pass the trust flag. Story 2: Claude Code v2.1.323 adds Code Mode, an experimental opt in where Claude writes JavaScript to call its tools, and lets a plugin declare a supported Claude Code version range in plugin.json. Ask which agents, plugins and scripted runs I use, then give a short checklist for each story and link the official notes instead of inventing settings, endpoints, or flags.