Remote execution gains fail-closed network controls

The headline change closes a policy gap for remote execution. Network requests from exec-server can now route through bounded client callbacks that return allow, deny, or ask decisions, while malformed, excessive, expired, or abandoned requests fail closed.

MCP startup gets faster without weakening execution checks. Cached tool definitions can reach inference before a server finishes initializing, but Codex still waits for that server and prepares the call against its refreshed live binding.

Restored conversations now preserve terminal completion errors, including model-overload warnings, instead of replaying failed retries as successful turns. Administrators also gain a managed requirement that can disable in-app updates and expose the resolved policy to clients.

Model catalogs can supply token-budget defaults when users have not chosen one, and session imports now parse Claude and Cursor records separately so Cursor-specific context does not leak into imported titles or user messages.

A Code Mode metadata fix was published both in the main prerelease line and as the separate alpha.10.1 hotfix. Tool-name mappings stay in canonical client metadata but no longer expand a direct HTTP or WebSocket compatibility header without bound.

Release context: the rust-v0.146.0-alpha.10 to rust-v0.146.0-alpha.13 comparison contains 23 commits and 129 changed files. The alpha.10 to alpha.10.1 hotfix comparison contains 2 commits and 2 changed files.

Evidence