Ecosystem Update - 2026-06-07

TL;DR

• No safe automatic harness Quick Win landed today; every actionable delta needs either a CLI upgrade, a new script, or a policy decision.
• Official Codex latest stable is 0.137.0 and latest pre-release is 0.138.0-alpha.6; local codex is still 0.133.0, and the app-bundled CLI is 0.135.0-alpha.1.
• Today's strongest new work is not more hooks, but adapters around existing primitives: plugin inventory JSON, environment-scoped permission approvals, and native session archive/history behavior.

Quick Wins

Auto-Implemented

• None. Report/state updates only; no harness config, hook, agent, or skill files were changed.

Build Queue

• Plugin inventory JSON adapter (mcp) - https://github.com/openai/codex/releases/tag/rust-v0.137.0 - codex plugin list --json is now official. After the CLI is upgraded, teach runtime-doctor or ecosystem-update to use it for deterministic plugin inventory instead of parsing config-only state.
• Environment-scoped PermissionRequest review (hook) - https://github.com/openai/codex/releases/tag/rust-v0.137.0 - Permission requests and approvals now carry environment identity. Evaluate whether pre_tool_guard.py or a conservative-profile PermissionRequest bridge should consume this before any approval automation is wired.
• Native session archive/history parity check (Codex-md) - https://github.com/shanraisshan/codex-cli-best-practice - The community best-practice repo now highlights sessions: archive/resume/fork and local history search. Compare native 0.137.0 behavior with the existing codex-session-search helper before replacing anything.
• Cloud-managed config bundle intake (Codex-md) - https://github.com/openai/codex/releases/tag/rust-v0.137.0 - Stable 0.137.0 adds cloud-managed config bundle behavior and stronger requirements layering. This should be a review task only; current local policy intentionally keeps user config direct and prompt telemetry off.
• Subagent runtime metadata smoke (agent-pattern) - https://github.com/openai/codex/releases/tag/rust-v0.137.0 - Multi-agent v2 now keeps runtime choice with each thread and exposes cleaner follow-up/metadata defaults. Once local CLI is current, smoke existing planner, explorer, reviewer, validator, and worker TOMLs against that metadata behavior.

Research

• No new arXiv results matched the June 6-7 submitted-date window for agent, coding, or software; the newest broad LLM agent coding feed entries remained June 4 UTC.
• Code2LoRA: Hypernetwork-Generated Adapters for Code Language Models under Software Evolution - Recent but not last-24h; relevant to repo-specific adaptation and evolving-codebase memory, not a harness Quick Win.
• Goedel-Architect: Streamlining Formal Theorem Proving with Blueprint Generation and Refinement - Recent but not last-24h; useful as a verifier/dependency-graph pattern for formal domains, not general Codex runtime work.

Already Have

PreToolUse Bash safety guard, PostToolUse verification ledger, PostToolUse failure-context hook, UserPromptSubmit route classifier, Stop omni-mem save hook, PreCompact omni-mem hook, SessionStart startup/resume/clear/compact runtime checks, protected main/master push guard, read-only explorer/planner/reviewer/validator agents, TypeScript and Python reviewer agents, workspace-write worker agent, max_threads = 3, conservative and conservative-auto-review profiles, OpenAI developer docs MCP with parallel calls enabled, browser/chrome/computer-use/openai-developers plugins, plugin marketplaces, progressive-disclosure skill library, skill audit workflow, session search, omni-mem primary memory workflow, prompt telemetry disabled, features.hooks = true, features.plugin_hooks = false, features.memories = false, live web search posture, #:schema header on config.toml, app destructive actions disabled by default.

Rejected

• Auto-upgrade Codex CLI to stable 0.137.0 or pre-release 0.138.0-alpha.6 - CLI upgrades remain explicit upgrade/smoke tasks, not ecosystem-update auto-mutations.
• Auto-wire PostCompact, PermissionRequest, SubagentStart, or SubagentStop today - official support exists, but no existing target script was proven for those events; the Quick Win rules forbid hook wiring that requires new scripts.
• Enable plugin hooks globally - current trust boundary remains unresolved; config correctly keeps plugin_hooks = false.
• Enable native Codex memories globally - conflicts with the current omni-mem-first runtime policy and prompt-telemetry posture.
• Wholesale install awesome-claude-code-toolkit, pro-workflow, agento-patronum, harness-evolver, nexus-agents, or similar community bundles - useful source material, but external plugins/skills/hooks require strict audit and Codex-owned adaptation.
• Add global auto-format PostToolUse edit hooks - still too broad for the global harness and can mutate unrelated user work; this belongs at project scope with dedicated scripts.
• Edit ~/.codex/AGENTS.md, ~/AGENTS.md, or modularize policy docs as a Quick Win - constitutional policy docs are explicitly out of Quick Win scope.
• Add managed requirements.toml enforcement locally - managed config is enterprise/admin machinery; no current local requirement proves existing user-level config is insufficient.

Sources checked: https://github.com/hesreallyhim/awesome-claude-code, https://howborisusesclaudecode.com/, https://github.com/shanraisshan/codex-cli-best-practice, https://github.com/rohitg00/awesome-claude-code-toolkit, https://github.com/openai/codex/releases, https://developers.openai.com/codex/hooks, https://developers.openai.com/codex/config-reference, https://developers.openai.com/codex/learn/best-practices, https://arxiv.org/search/?searchtype=all&query=LLM+agent+coding&order=-announced_date_first, arXiv API submittedDate scan, WebSearch "Codex new hooks agents skills site:github.com 2026", WebSearch "arxiv.org LLM agent coding autonomous 2026 site:arxiv.org" Tier 2 fetched: yes Tier 3 fetched: yes Run at: 2026-06-07T06:36:00-04:00