Skip to main content
Working with an agent? Give them a link to this page as markdown.

Monitor Codex Code Mode permission decisions

This update improves the audit trail for Codex Code Mode permission decisions and changes how the client reports itself to the server. It also introduces a limit on hosted grading requests.

What's new?​

  • Codex Code Mode permission decisions now reach Analyzer reliably. Decisions made after a session's last upload, or interrupted by a temporary network failure, are retried.
  • Denied tool calls appear as denied rather than unknown. An aborted Code Mode program no longer gives unrelated later calls a denial they never received.
  • The hosted Watcher API rejects grading requests that would produce more than ten grades. Self-hosted deployments retain their configured request limit.
  • Watcher Live changes its log formatting and includes its version in requests to the server. Deployments can still override the request's User-Agent.

Required upgrade steps​

Watcher Cloud API integrations: split large grading requests​

The hosted Watcher API rejects a single grading request that would produce more than ten grades. Split larger requests into smaller batches before sending them. The grade count is the number of trajectories multiplied by the number of graders, so five trajectories with two graders produce ten grades. An oversized request fails with HTTP 400.

This requirement applies to integrations that submit grading requests to Watcher Cloud. Self-hosted operators should use their deployment's configured request limit; the cloud limit does not automatically apply to self-hosted deployments. After adjusting an integration, verify that a request within the limit completes and returns the expected grades.

All deployments: check custom client-log parsers​

Watcher client log formatting changes in this release. Log sources have different formats. If you parse log files directly, check your parser against each source it consumes on an updated test machine before rolling out to the rest of your fleet. Confirm that it still extracts the events and fields you rely on. If you do not parse client logs, this change requires no action.

Follow Update Watcher for the normal update procedure. These checks also apply when you skip this release during an upgrade from an earlier version.

Found an issue with this page? Report it on GitHub.