Can VS Code 1.138 Codex Cross-App Takeover Be Used Directly by Teams? 2026

A VS Code 1.138 release was published on September 16, 2026, according to the official release notes. That release expands Codex support in Agent Host, including session continuation between the ChatGPT app and VS Code under supported conditions.

Symptom: The Codex conversation appears in the next app, but the workspace, approvals, and execution host may not be the same.

Fastest fix: Run a small, read-only handoff pilot, record identity and workspace evidence, and keep the rollout limited until all six acceptance checks pass.

You should read this if you move Codex work between ChatGPT and VS Code, govern Copilot and ChatGPT subscriptions, manage MCP or desktop tools, or need a remote Mac for persistent Agent and Xcode work. If you only need ordinary editor autocomplete, this acceptance process is more control than you need.

Important: A successful conversation handoff is not file synchronization, permission synchronization, transaction recovery, or proof of safe unattended execution.

Release scope and decision boundary

The Codex cross-app support note for VS Code 1.138 confirms the relevant product direction, but the documented boundary matters more than the headline. The feature can preserve or expose a Codex session across supported clients. It does not establish that every account, model, extension, desktop application, or enterprise policy behaves identically.

As of September 19, 2026, the official material describes a capability that is rolling out or dependent on specific configuration. The Agent Host architecture documentation also separates the host that runs the Agent from the editor surface you are using. That separation is the reason a transcript can look correct while the execution context is wrong.

Your initial decision should be:

• Controlled pilot: one representative repository, one named operator, read-only or reversible actions, and a documented rollback.
• Team-limited rollout: only after identity, tools, workspace, desktop actions, delivery, and recovery evidence are recorded.
• Pause: if the handoff changes access, attaches to an unexpected host, loses approvals, repeats an action, or cannot recover cleanly.

The six-gate scorecard

Use this scorecard before allowing a Codex handoff to modify a shared repository. A pass means you have saved evidence, not that the Agent gave a reassuring explanation.

Score each gate as Pass, Pass with restriction, or Fail. Do not average the score. A failed workspace or permission gate can outweigh several successful chat checks.

Session evidence versus execution evidence

The first trap is treating visible history as proof that Codex can safely continue. Before switching apps, capture the current task in plain terms: intended files, expected command, selected model, pending approval, and the last known repository state. After the handoff, compare every item.

The Codex harness documentation is the right reference for understanding the harness and subscription-selection boundary. Use it to identify whether Codex is operating through a ChatGPT subscription or a GitHub Copilot subscription. Do not let a team member describe the source as simply “the AI account.” You need to know which account initiated the task, which subscription provides model access, and which host executes tools.

Run a harmless continuation first. Ask Codex to report the repository path, current branch, and last commit without editing anything. Then compare the response with your saved record. If the client disconnects during a command, the Agent repeats a step, or an approval disappears, stop rather than asking it to “continue from where it left off.”

Subscription identity and Agent Host boundaries

A cross-app workflow has more identities than the interface suggests. Separate the human operator, the ChatGPT or Copilot subscription, the Codex harness, the VS Code client, the Agent Host, and the remote machine. The Agent Host tool-routing documentation explains why tools may be contributed by different parts of the VS Code environment.

This distinction affects incident ownership. If Codex edits a repository through a tool contributed by an extension, the editor window may not be the component that owns the permission. If a remote Agent Host runs the command, closing the local window may not terminate the remote process. Your runbook must answer:

1. Who initiated the task?
2. Which subscription supplied the model?
3. Which harness created the Agent session?
4. Which host executed the tool?
5. Which person approved a consequential action?

The practical test is a subscription switch with no write permission. Record the session and model before switching. After switching, compare the available model, tools, and approval behavior. If the transcript remains but the tool set changes, treat that as a new execution context, not a seamless continuation.

Tool inventory and approval scope

The VS Code tools documentation distinguishes the tools available to Agents from the editor surface itself. Your team should inventory file editing, terminal execution, extension-provided tools, MCP servers, and desktop interaction separately.

MCP deserves its own review because a saved server configuration can expose network or data capabilities that are not obvious from the conversation. The MCP configuration guidance should be read alongside the approval and permission documentation. Check the actual configuration on the receiving client and host; do not infer it from the sending client.

If the receiving context exposes a new write tool, network tool, MCP server, or automatic approval, downgrade the pilot immediately. A broader tool set may be useful, but it is not inherited safely merely because the session is familiar.

Workspace attachment and isolation

The most expensive handoff error is often mundane: the Agent opens the wrong directory. Same-named repositories, stale worktrees, old containers, and remote hosts can all produce a convincing but incorrect response.

Before handoff, save:

• The repository URL or local repository identity.
• The absolute worktree path.
• The current commit and branch.
• The list of uncommitted changes.
• The host name or remote machine identity.
• The container or environment identifier, if used.

The documented worktree isolation guidance supports treating task isolation as a deliberate choice rather than a cosmetic folder arrangement. For a long-running Codex task, prefer an independent worktree and a continuously available remote Mac over a shared checkout.

Use this decision branch:

• If the path, commit, host, branch, and dirty state all match, choose a read-only continuation test.
• If the path matches but the commit or dirty state differs, fall back to a fresh isolated worktree.
• If the host identity differs, choose a new host verification before any tool call.
• If you cannot determine which workspace is active, pause the handoff.
• If several team members need the same long task, choose a named task workspace rather than a shared directory.

This is also where a cloud Mac becomes relevant. It is not a magic continuation layer. It is a separate execution host that needs its own identity, filesystem, credentials, desktop session, and cleanup policy.

Desktop actions and remote Mac limits

The release notes indicate that VS Code 1.138 can reuse configured desktop application interaction capabilities under qualifying conditions. That statement should not be expanded into “Codex can safely operate every Mac application without supervision.”

Classify each desktop action:

• Read-only: inspect a window, read a build result, or collect a status value.
• Reversible: change a setting or file that can be restored from a known snapshot.
• External side effect: send a message, publish a build, alter credentials, submit a release, or change production state.

Permit the first category during the initial handoff. Permit the second only with a visible diff or recovery path. Keep the third outside unattended execution until you have application-specific logs, operator approval, and a rollback procedure.

For Xcode delivery, the relevant evidence is not Codex’s summary. Save the build output, signing or provisioning result, test result, generated artifacts, and the host identity. A remote Mac can keep a task available after the local VS Code window closes, but that persistence increases the need for process visibility and termination controls.

Delivery, interruption, and recovery evidence

A team pilot is not complete when a file changes. Use a representative project and follow the actual delivery path: code modification, test, review request, and a real Mac build where the project requires Apple tooling. Compare dependencies, environment variables, generated files, and build results before and after the handoff.

Then deliberately create failure conditions:

• Disconnect the local client during a read-only task.
• Restart the Agent Host or remote Mac at a controlled point.
• Allow an approval request to expire.
• Reopen the task from a different client.
• Attempt to attach to an intentionally wrong worktree.
• Stop the process and confirm that no queued write resumes silently.

Record whether the task stopped, whether a duplicate command appeared, whether the repository remained clean, and whether a human could resume from a known state. Do not call this automatic recovery unless the official documentation explicitly promises that behavior for your configuration. The current boundary does not confirm universal enterprise audit, transaction rollback, or unattended safety.

Rollout conditions

Use these conditions to set the operating scope:

• Choose individual trial if session continuity passes but subscription, tool, or recovery evidence is incomplete.
• Choose a limited team pilot if all six gates pass on one repository, the workspace is isolated, and every consequential action remains reviewable.
• Choose a remote Mac task environment if the work runs for a long period, needs desktop applications, or requires Xcode validation after the local client may disconnect.
• Choose a pause if the receiving client silently gains access, the task attaches to the wrong workspace, or you cannot prove which identity executed a tool.
• Choose wider rollout only after repeated handoffs produce the same evidence under each supported account and host configuration.

For teams estimating whether a remote Mac is justified, compare the task duration, Apple toolchain requirement, need for desktop access, and cost of a failed build against the overhead of maintaining an isolated host. The MacPull home page provides the service context; use the MacPull pricing information only after you know the required runtime and access pattern.

FAQ for the handoff

See the answers above as operating rules, not feature promises. The key distinction remains constant: Codex can carry a conversation across supported applications while the execution environment still requires independent verification.

Final recommendation

VS Code 1.138 Codex cross-app takeover is suitable for a controlled team pilot, not an automatic team-wide enablement. Your current local setup may be cheaper for short, interactive edits, but it can leave long tasks tied to a closed laptop, mix repositories across windows, and make Xcode or desktop validation depend on one operator’s session. A shared developer machine also makes tool ownership and recovery harder to prove.

If the work needs persistent execution, an isolated worktree, a real Mac build, or controlled desktop access, renting a Mac through MacPull can provide a cleaner execution boundary than stretching a local workstation beyond its role. Start with the MacPull help resources, define the host and cleanup requirements, and keep the rental limited to tasks that genuinely need a remote Mac rather than treating it as a replacement for every local workflow.

FAQ