Codex 0.157.0 holds a revocable permit while reading response bodies and WebSocket traffic.

PR #47389 checks each redirect destination against network policy, and holds that permit across streaming reads, so revoking access cancels an operation already in progress instead of letting it drain. Policy denials no longer get retried. PR #47094 restricts Unix local MCP servers to stdio descriptors, and #47079 masks daemon socket paths exposed through ancestor bind mounts. (release notes) The same release adds GPT-6 Sol and Luna including on Bedrock, makes fullscreen transcripts and automatic background-server startup the defaults, and adds an f shortcut to fork a conversation open in another app. Mid-stream revocation is the detail I'd copy: most network policies check at connect time and then stop looking.