Codex CLI

0.147.0

August 7, 2026

• •Install portable Agent Plugins and search across local, personal, workspace, and remote plugin catalogs. (#36544, #36409, #36919, #36796)
• •Organize conversations into persistent, manually ordered sections and browse long transcripts incrementally. (#35722, #36007, #36380, #36948, #36950)
• •Enable automatically reviewed approvals with the new --approve-for-me CLI flag. (#36373)
• •Import Cursor-managed skills and synchronize changes to imported Claude and Cursor conversations without creating duplicates. (#36361, #36356, #35623)
• •Support the opt-in MCP 2026-07-28 protocol, including paginated discovery, multi-round requests, and non-blocking server startup. (#35724, #35725, #35590, #35742)
• •Enable cached web search and remote conversation compaction for Amazon Bedrock. (#36938, #36981)
• •Redact secrets and complete bearer tokens from displayed commands and replayed conversation history. (#36893, #36908)
• •Prevent lost or stalled terminal input when focus returns, MCP servers initialize, or Ghostty handles keyboard shortcuts. (#35649, #35957, #36834)
• •Correct rendering and cursor positioning for Japanese characters, emoji, hyperlinks, and text near viewport boundaries. (#35960, #35962, #37166)
• •Properly interrupt Windows background processes and handle Windows filesystem paths consistently. (#35655, #35851, #37129)
• •Require explicit trust for unfamiliar local projects and enforce managed authentication restrictions before credentials are used. (#36960, #37132)
• •Harden plugin isolation and deny network access when policy updates fail. (#37027, #36967, #36037)
• •Improve the bundled OpenAI documentation skill with targeted official-source lookup and clearer guidance for Codex, model selection, and API workflows. (#36014)
• •Upgrade the MCP SDK to 3.0.0, Ratatui to 0.30.2, and V8 to 150.4.0. (#36001, #35959, #35831)
• •Secure macOS release notarization using Azure Key Vault instead of exporting private signing keys. (#37154)

0.146.1

August 5, 2026

• •Apply safer automatic-review defaults for cyber-capable models and explain permission changes in the terminal interface. (#37057)

0.146.0

July 29, 2026

• •Name new sessions with /new or /clear, pin important threads, and switch between side conversations without closing them. (#34605, #34840, #35011)
• •Support Agent Plugins manifests, workspace plugin publishing, and additional plugin marketplaces for Amazon Bedrock and Claude Code. (#35105, #35254, #34931, #34979)
• •Fork threads with paginated history, including temporary forks that do not appear in thread listings. (#35220, #35251)
• •Connect app-server to remote Code Mode hosts over WebSocket. (#35078, #35098)
• •Enable standalone web search for compatible custom model providers. (#34846)
• •Discover executor-provided skills and securely read their associated resources, including explicitly selected skills. (#35184, #35198)
• •Honor configured proxies across authentication, plugin downloads, MCP authorization, remote execution, WebSockets, redirects, and LM Studio connections. (#34479, #34509, #34655, #34678, #35023, #35056, #35239)
• •Keep MCP connections and Apps tools current when authentication or configuration changes, reconnecting closed servers without restarting healthy connections. (#34952, #34957, #35028, #35144, #35146, #35151)
• •Preserve submitted messages, final responses, failed-turn errors, imported timestamps, and approval settings across interruptions, replay, imports, and forks. (#34839, #34777, #35524, #34989, #34664)
• •Improve terminal responsiveness and rendering, including nonblocking interrupts, keyboard handling, narrow layouts, hyperlinks, and refreshed mention results. (#35000, #35021, #34775, #34778, #35365, #35375)
• •Fix Windows navigation keys, reliably terminate sandboxed process trees, and preserve proxy settings during security reviews. (#34625, #34624, #35036)
• •Retain more available skills under tight context budgets and warn when skill catalogs must be truncated. (#34732, #34738, #34997)
• •Document shared HTTP-client usage, proxy-aware connection pooling, and safe outbound request handling. (#34669)
• •Clarify Windows drive-letter canonicalization for PathUri values. (#34667)
• •Publish release artifacts, channel metadata, and installer aliases through OpenAI-hosted release infrastructure, with GitHub fallback. (#34505, #34508, #34729, #34910)

0.145.0

July 21, 2026

• •Added experimental paginated thread history with efficient resume, search, persisted names, sub-agent support, and memories. (#33364, #33907, #34085, #34229, #34386)
• •Expanded /import to migrate Cursor and Claude Code settings, MCP servers, plugins, sessions, commands, and project-scoped memories. (#31672, #33411, #33426, #33444)
• •Added experimental Amazon Bedrock login, custom endpoint and authentication support, and GPT-5.6 Sol as the default Bedrock model. (#31327, #33170, #33175, #32288, #33695)
• •Added audio inputs and tool outputs, including common local audio formats, and introduced streaming realtime V3 conversations. (#33261, #33856, #33932, #34080, #34385)
• •Stabilized the opt-in multi-agent V2 experience with configurable sub-agent models, reasoning levels, concurrency, restored roles, and improved agent navigation. (#33550, #33631, #33657, #33841, #34383)
• •Added secure, clickable inline visualization links in the terminal UI. (#33925, #34217, #34346)
• •Editing an earlier prompt or retrying a safety-buffered turn now creates a contextual branch, preserving the original conversation, attachments, and mention bindings. (#33201, #33207, #33211)
• •Improved terminal responsiveness for long conversations and streamed output through incremental Markdown rendering, fewer redraws, caching, and bounded command output. (#34045, #34049, #34216, #34223, #34359)
• •Prevented slow or conflicting MCP startup and authentication flows by enforcing startup timeouts, avoiding blocking OAuth discovery, serializing refreshes, and reusing tool catalogs safely. (#32229, #32781, #32825, #33184, #33297)
• •Improved Windows execution and sandbox reliability, including native exec-server sandboxing, network-proxy enforcement, hidden helper consoles, and correctly quoted hook commands. (#32849, #32857, #33926, #34423)
• •Fixed compact release-metadata parsing and macOS code-mode installation, with an in-process fallback when the external code-mode host is unavailable. (#31667, #31876, #31899)
• •Strengthened safety and approval handling with better forced-rm detection, consistent full-access confirmation, and preserved rejection reasons across tools. (#32989, #33464, #34400)
• •Updated the bundled OpenAI Docs skill with current GPT-5.6 model resolution, prompting, and migration guidance across macOS, Linux, and Windows. (#31842, #33121)
• •Migrated bundled GPT-5.4 selections and internal uses to the corresponding GPT-5.6 Terra and Luna variants. (#33173)
• •Reduced startup and large-context overhead with concurrent skill/plugin discovery and more efficient remote compaction. (#31566, #33369, #33423, #34431)

0.144.6

July 18, 2026

• •Refreshed bundled instructions for GPT-5.6 Sol, Terra, and Luna, and corrected their context windows to 272,000 tokens. (#33972, #34009)

0.144.5

July 16, 2026

• •Improved dangerous-command detection, including more forced rm forms, and provides clearer rejection reasons when commands are denied. (#33455)

0.144.4

July 14, 2026

• •No user-facing changes in this patch release.

0.144.3

July 13, 2026

• •Published a version-only release with no merged pull request changes since rust-v0.144.2.

0.144.2

July 13, 2026

• •Restored the previous Guardian auto-review policy, request format, and tool behavior after rolling back a prompting regression. (#32672)

0.144.1

July 9, 2026

• •Fixed standalone installs failing when GitHub returns compact or reordered release metadata. (#31913)
• •Ensured macOS package installs expose the code-mode host alongside the codex executable. (#31913)
• •Kept code mode working when the companion host binary is unavailable by falling back to the embedded runtime. (#31913)

0.144.0

July 9, 2026

• •Usage-limit reset credits now show their type and expiration, and let you choose which credit to redeem. (#30488)
• •Added a writes app-approval mode that allows declared read-only actions while prompting for writes. (#30482)
• •MCP tools can now request authentication interactively without an experimental opt-in. (#28772)
• •App-server hosts can provide Codex authentication at runtime and redirect successful logins to a hosted page. (#28745, #31274)
• •Global pnunen installs are now detected so diagnostics and updates use the correct package manager. (#31503)
• •Selecting Ultra reasoning now warns when high multi-agent concurrency could increase usage quickly. (#31621)
• •Resumed ChatGPT threads recover when compaction references a retired model by retrying with the currently selected model. (#30319)
• •Fixed Code Mode crashes in Intel macOS release binaries. (#30953)
• •Windows sandbox sessions can delete files in writable roots and access the managed primary runtime. (#31138, #31574)
• •Pasted terminal control sequences can no longer corrupt TUI rendering or resumed conversation history. (#31494)
• •Long-running app sessions now refresh expired authentication for the hosted codex_apps connector. (#31486)
• •Responses WebSockets continue using the low-latency transport while respecting system proxies and custom certificate authorities. (#31441, #31622)
• •Device-code login warnings now explain how to recognize and stop phishing attempts. (#31648)
• •Reduced plugin skill-loading time on remote executors by resolving namespaces once per root. (#31348)
• •Made the /review branch picker faster and more reliable in large repositories. (#31464)

0.143.0

July 8, 2026

• •Remote plugins are now enabled by default, with richer catalog rows, npm marketplace sources, and visible remote/local versions. (#30297, #26705, #29375, #30981)
• •Codex can route authentication and Responses API traffic through macOS and Windows system proxies, including PAC and WPAD configurations. (#26708, #26709, #31335)
• •Added codex remote-control pair for generating manual pairing codes from a running daemon. (#29913)
• •Added Amazon Bedrock GPT-5.6 Sol, Terra, and Luna models, with first-class support for max reasoning effort. (#30285, #30467)
• •MCP tools now use tool search by default, and ChatGPT-hosted MCP servers can explicitly use session authentication. (#29486, #29733)
• •App-server clients can inspect environments, list descendant threads, and fork history through a specific turn. (#30291, #29591, #30277)
• •Fixed Windows ConPTY input handling for line endings and backspace, plus sandbox credential retry edge cases. (#29734, #29624, #29637)
• •Fixed stale TUI safety prompts and cancelled reviews that could leave MCP startup appearing busy. (#30490, #31189)
• •Improved recovery when exec servers are temporarily offline and prevented remote-control token refresh retry storms. (#30098, #30201)
• •Preserved trailing realtime transcript text and terminal rollout events during shutdown. (#29918, #30144)
• •Improved incremental WebSocket request success by ignoring response metadata during comparisons. (#30770)
• •Reduced installer failures from GitHub API rate limits by reusing release metadata. (#31056)
• •Documented UUID7 thread and turn IDs, plus recommended remote-executor integration-test workflows. (#27714, #29790)
• •Updated OpenSSL, Hono, fast-uri, quick-xml, and crossbeam-epoch to address security advisories. (#29487, #29650, #30941, #31308)

0.142.5

July 1, 2026

• •Prevented full Responses WebSocket request payloads from being written to trace logs. (#30771)

0.142.4

June 29, 2026

• •No user-facing changes were identified for this release.

0.142.3

June 26, 2026

• •Maintenance-only patch release with no user-facing changes since 0.142.2.

0.142.2

June 25, 2026

• •MCP tools now use tool search by default when supported, improving tool discovery while preserving compatibility with older models and providers. (#29486)
• •macOS authentication clients can honor system proxy, PAC, and WPAD settings when respect_system_proxy is enabled. (#26709)
• •Plugins can provide dedicated dark-mode logos through local manifests and remote catalogs. (#29488)
• •Apps can display richer safety-buffering UI using server-provided visibility and faster-model metadata. (#29473)
• •Remote plugin catalogs now return curated featured-plugin rankings. (#29485)
• •Expired Amazon Bedrock credentials now produce actionable recovery guidance instead of a generic authorization error. (#28992)
• •Remote stdio MCP servers now accept absolute working directories written in the remote platform’s path format. (#29493)
• •Remote HTTP(S) image inputs now return clear model-visible validation errors; inline data URLs and local images remain supported. (#29417, #29419)
• •PowerShell commands containing executable AST regions the safety classifier cannot inspect now require approval. (#24092)
• •Code Mode now warns when the selected model lacks the required metadata. (#29490)
• •Updated bundled OpenSSL and esbuild dependencies to patched releases. (#29487, #29489)
• •Successful formatter runs are now quiet while failures still show diagnostics. (#29467)

0.142.1

June 25, 2026

• •Added opt-in Windows system proxy support for authentication, including PAC, WPAD, static proxies, and bypass rules. (#26708)

0.142.0

June 22, 2026

• •/usage can now show and redeem earned usage-limit reset credits, with confirmation, retry, and refreshed availability states. (#28154, #28793)
• •/plugins now organizes remote plugins into OpenAI Curated, Workspace, and Shared with me sections, while eligible turns can recommend and install relevant plugins. (#26703, #28399, #28400, #27704, #28403)
• •Configurable rollout token budgets track usage across agent threads, provide remaining-budget reminders, and abort turns when exhausted. (#28746, #28494, #28707, #29423)
• •App-server clients can configure multi-agent delegation as disabled, explicit-request-only, or proactive at the thread and turn level. (#28685, #28792, #29324)
• •Added an indexed web-search mode that permits live searches while restricting direct page access to server-approved URLs. (#28489)
• •Codex can now receive scheduled UTC time reminders and query the current time directly, including through client-provided app-server clocks. (#28822, #28824, #28835, #29011)
• •Restored reliable Linux TUI rendering after suspending with Ctrl+Z and resuming with fg. (#28342)
• •Exec-server processes and stdio MCP sessions now survive transient disconnects, including signed-URL refresh and retry-safe stdin writes. (#28512, #28374, #28546, #28895)
• •Remote environments now preserve executor-native paths, shells, AGENTS.md discovery, and sandbox behavior across operating systems. (#28146, #28152, #28958, #28983, #29099, #29108, #29113, #29424)
• •Plugin loading and installation now handle root marketplace layouts, manifest fallbacks, multiple skill paths, actionable download errors, and immediate tool refreshes. (#28771, #28789, #28790, #28863, #28951)
• •Parent agents now receive terminal subagent errors instead of seeing failed work as an empty successful completion. (#28375)
• •Goal-first threads are once again persisted and returned by thread/list and thread/search. (#28808)
• •Reduced startup and session latency by deferring unnecessary DNS work, warming the model cache, reusing parsed plugin skills, parallelizing skill metadata reads, and skipping redundant catalog synchronization. (#28542, #28699, #28844, #29326, #29005)
• •Reduced persistent-log churn by removing per-event WebSocket payload logging and filtering duplicated telemetry records. (#29432, #29457)

0.141.0

June 18, 2026

• •Remote executors now use authenticated, end-to-end encrypted Noise relay channels. (#26242, #26245)
• •Cross-platform remote execution now preserves executor-native working directories and shells, including filesystem permission paths across app-server and exec-server boundaries. (#27819, #27995, #28032, #28122, #28165, #28367)
• •Selected executor plugins can activate their stdio MCP servers per thread; plugin discovery also adds a created-by-me marketplace and auth-specific curated catalogs. (#27870, #27884, #27893, #28203, #28383)
• •App-server clients can list immediate child threads, correlate external-agent imports with detailed results, and read or redeem rate-limit reset credits. (#26662, #28008, #28143)
• •Realtime clients can explicitly append speech, control how Codex responses enter conversations, and omit startup context. (#27917, #28405)
• •TUI input prompts can auto-resolve after inactivity, with a countdown that pauses on interaction. (#28235)
• •Hook trust bypass now persists through codex exec thread start and resume, while blocking PostToolUse hooks correctly reject code-mode tool calls. (#26434, #28365)
• •Plugin capabilities now route consistently by authentication mode, deduplicate conflicting App/MCP declarations, and preserve remote marketplace ordering. (#27461, #27602, #27607, #27902, #27958, #28395)
• •Windows sandbox execution repairs stale credentials automatically and gives PowerShell commands more time before backgrounding. (#27086, #27944)
• •Idle exec-server relays remain connected, and steered user input immediately interrupts wait_agent. (#28286, #28341)
• •Bundled SQLite is pinned to a version containing the WAL-reset corruption fix. (#27992)
• •TLS connections now support P-521 certificate signatures commonly used by enterprise proxies. (#27706)
• •Reduced latency and memory use in large, tool-heavy sessions by caching tool search and eliminating repeated request and history copies. (#27258, #27813, #28306, #28309, #28313, #28323, #28327)
• •Bounded prompt-image caching to 64 MiB and feedback uploads to eight related threads. (#28294, #28332)
• •Terminal resize reflow is now always enabled, ignoring obsolete disabled settings. (#27794)

0.140.0

June 15, 2026

• •Added /usage views for daily, weekly, and cumulative account token activity. (#27925)
• •/goal now preserves oversized text, large pasted blocks, and image attachments, including in remote app-server sessions. (#27508, #27509, #27510)
• •Added permanent session deletion through codex delete, /delete, and app-server thread/delete, with confirmation safeguards and subagent cleanup. (#25018, #27476)
• •Added /import for selectively importing setup, project configuration, and recent chats from Claude Code. (#27070, #27071, #27703)
• •Typing @ now opens the unified mentions menu for files, plugins, and skills by default. (#27499)
• •Added managed Amazon Bedrock API-key authentication and encrypted local storage for CLI and MCP OAuth credentials. (#27443, #27689, #27504, #27535, #27539, #27541)
• •Corrupted SQLite state databases are now backed up and rebuilt automatically from rollout data, including malformed database-directory cases. (#26859, #27719)
• •Prevented /review from crashing when Esc is pressed with queued guidance, while preserving that guidance when the review is canceled. (#22879)
• •Improved MCP reliability by retrying transient startup failures, reporting unusable OAuth credentials as logged out, and preserving explicitly disabled servers. (#25147, #26713, #27414)
• •Fixed remote plugin uninstall requests and correctly surfaced apps requiring authentication during installation. (#27085, #27223)
• •Persisted “Don’t remind me” update dismissals reliably and cleared stale running-hook indicators after completed turns. (#27619, #27783)
• •Non-TTY background commands can now be interrupted with Ctrl-C while preserving their final output and exit status. (#26734)
• •Clarified contributor guidance around keeping crate APIs narrow and supporting Linux, macOS, and Windows. (#27939, #27966)
• •Improved responsiveness for large repositories and long sessions by preserving Git’s built-in filesystem monitor, avoiding duplicate history reads, accelerating archive lookup, and caching turn-diff rendering. (#26880, #27031, #27276, #27489)
• •Removed the experimental /realtime voice controls and related audio dependencies from the TUI. (#27801)

0.139.0

June 9, 2026

• •Code mode can now call standalone web search directly, including from nested JavaScript tool calls, and receive plaintext search results. (#26719)
• •Tool and connector input schemas now preserve oneOf and allOf, and large schemas keep more shallow structure when compacted, improving compatibility with richer MCP tools. (#24118, #27084)
• •codex doctor now includes editor and pager environment details in the local report while redacting raw values in JSON output. (#27081)
• •Plugin marketplace automation is more informative and responsive: codex plugin marketplace list --json now includes each marketplace source, and plugin lists can return from the cached remote catalog before refreshing in the background. (#27009, #26932)
• •codex resume --last "..." and codex fork --last "..." now treat the trailing argument as the initial prompt instead of misreading it as a session ID. (#26818)
• •MCP startup warnings from subagents now stay in the thread that owns them, avoiding duplicate parent-thread alerts and stuck startup spinners in the TUI. (#26639)
• •Image edits now use the exact referenced image file paths instead of guessing from conversation history, so attached-image edits land on the intended input. (#26486)
• •Bare URLs with ~ in the path are now linkified end to end in the TUI instead of being truncated before the tilde. (#27088)
• •Thread resets such as /new, /clear, and /fork no longer drop cloud-managed requirements or feature flags during TUI config reloads. (#25177)
• •Sandbox execution now preserves approved escalation decisions and enforces configured proxy-only networking more consistently. (#24981, #27035)
• •Release builds once again publish separate symbol archives with line tables, improving post-release crash symbolication without bringing back the earlier full-debug build slowdown. (#26202)
• •The embedded V8 toolchain was updated to rusty_v8 149.2.0. (#26464)

0.138.0

June 8, 2026

• •The /app command can now hand off the current CLI thread into Codex Desktop on macOS and native Windows, and Windows workspace launches can open directly into Desktop instead of stopping at a manual prompt. (#25638, #26500)
• •Local image attachments and standalone image generations now expose their saved file paths to the model, which makes follow-up edits and file references more reliable. (#25944, #25947)
• •Reasoning effort selection is more flexible: the TUI adds fallback shortcuts for terminals that miss Alt bindings, and model-defined effort levels now flow through in the order advertised by the model. (#25623, #26444, #26446)
• •App-server integrations can now read account token usage, and Codex auth supports v2 personal access tokens in CLI and app-server flows. (#25344, #25731)
• •Plugin automation got richer structured output: add/remove and marketplace commands support --json, plugin list JSON includes marketplace source, and plugin detail data now exposes default prompts, remote MCP servers, and unavailable app templates. (#26631, #26417, #25887, #26453, #26317)
• •Goal workflows are more predictable: multiline paste in /goal edit no longer submits early, idle auto-turns stay out of Plan mode, and goals stop auto-continuing after terminal turn failures. (#26047, #26147, #26690)
• •Forked threads now keep user-renamed titles instead of falling back to the original first-prompt name. (#26075)
• •The TUI no longer adds extra blank space while streaming, and cancelled prompts reopen with the cursor at the end so you can keep editing naturally. (#26636, #26457)
• •TUI config write failures now show the underlying cause, making validation problems and read-only filesystem issues much easier to diagnose. (#26537)
• •Startup is more resilient across environments, with support for /usr/bin/bash, shorter Linux proxy socket paths, and pre-refresh of expired OAuth-backed MCP credentials. (#26538, #26553, #26482)
• •Workspace instruction loading is more accurate for remote and symlinked workspaces, so the right AGENTS.md files are picked up consistently. (#26205, #26465)
• •The CLI README was refreshed to remove stale guidance and better match the current documentation flow. (#26313)
• •TUI startup does less repeated plugin work by reusing discovery results and loading only hook metadata on the critical path. (#26469, #26272)
• •resume --last now finds the newest matching session through the state DB first, which speeds up restore on large local histories. (#26462)
• •Large MCP/Ollama streams and long message histories process much faster thanks to optimized byte scanning. (#26265)

0.137.0

June 4, 2026

• •TUI controls now support F13-F24 keybindings, paste in searchable menus, and a compact reasoning-only status/title item (#25329, #25400, #25504).
• •Enterprise/admin flows now show monthly credit limits and can apply cloud-managed config bundles, including EDU workspaces (#24812, #24617, #24619, #24620, #24622, #25963).
• •Remote-control clients can start pairing and list or revoke controller grants through app-server v2 RPCs (#25675, #25785).
• •Plugin workflows gained machine-readable codex plugin list --json output and cached remote catalog suggestions (#25330, #25457).
• •Hosted web and image tools are available in more code-mode flows, with standalone web searches able to run in parallel (#25176, #25702, #25890, #25923).
• •Multi-agent v2 keeps runtime choice with each thread and exposes cleaner follow-up and metadata defaults for spawned agents (#25266, #25636, #25720, #25721, #25722, #25841, #26114).
• •Cancelling a submitted prompt before visible output now restores the draft, attachments, and collaboration mode for editing (#25316).
• •Slash-command filtering and footer shortcut hints now reset or render according to the current UI state (#25492, #25625).
• •Platform reliability improved for macOS app launches and Windows SQLite startup, thread resume, and sandbox setup refreshes (#25485, #25490, #25509, #25949).
• •Plugin loading preserves app manifest order, deduplicates local/remote curated installs, and treats malformed skills fields as warnings (#25491, #25681, #25717, #25782).
• •Permission requests and approvals now carry environment identity, and managed MITM proxying exports readable CA bundles to child commands (#25850, #25858, #25862, #22668).
• •Local session history is safer for compressed rollouts, renamed titles, pathless side-chat reloads, and stack-heavy startup/config rebuilds (#25087, #25624, #25661, #25814, #25844, #25847).
• •Added app-server docs and generated schema updates for monthly credit limits, remote-control RPCs, and environment-scoped permission approvals (#24812, #25675, #25785, #25862).
• •Moved repo review rules and contributor conventions into AGENTS.md, including Rust test-module layout and Python 3 compatibility guidance (#25682, #25690, #25738).
• •Root formatting and Justfile workflows are more complete and Windows-aware (#24983, #25165, #25683).

0.136.0

June 1, 2026

• •TUI markdown now keeps web links clickable with OSC 8 metadata, and cramped tables switch to readable key/value records without losing link targets. (#24472, #24636, #24825)
• •Sessions can now be archived from the TUI with /archive or from the CLI with codex archive / codex unarchive; archived sessions are protected from resume/fork until restored. (#25027, #25021)
• •App-server integrations can resume a thread with its initial turns page, see richer MCP server status, and launch stdio mode with codex app-server --stdio. (#23534, #24698, #24940)
• •Remote execution setup now supports CODEX_API_KEY registration for approved OpenAI hosts, while remote-control websockets use short-lived server tokens instead of ChatGPT access tokens. (#24666, #24141)
• •Windows admins get an alpha codex sandbox setup --elevated provisioning path, plus requirements support for allowed Windows sandbox implementations. (#24831, #23766)
• •A feature-gated standalone image generation extension can run through the native Codex image artifact completion pipeline. (#24723, #24972)
• •ChatGPT auth refreshes tokens before the five-minute expiry window and shows a relogin-required path for reused refresh tokens instead of collapsing into a generic cloud error. (#23546, #24830)
• •Command-safety hardening prevents /diff from running repository-provided Git helpers/hooks, avoids PowerShell parser execution on non-Windows hosts, and rejects browser-origin exec-server websocket handshakes. (#24954, #24946, #24947)
• •Sandboxed commands clean up more reliably after interruptions or denied Windows network attempts, and deny read rules stay enforced for safe-command and approval-bypass paths. (#22729, #19880, #23943)
• •Resumed TUI sessions seed prompt history from the session transcript, multiline hook output renders as separate rows, and Vim normal-mode editing behaves correctly. (#24298, #24965, #25022)
• •App-server filesystem watchers debounce later batches correctly, and standalone web search calls now show and restore completed search activity. (#24716, #24693)
• •Bedrock auth now falls back to AWS_REGION / AWS_DEFAULT_REGION, and unsupported Bedrock GPT service tiers are no longer advertised or sent. (#25171, #25318)
• •Python SDK beta docs and package metadata now present the standard pip install openai-codex path, refreshed quickstarts, API reference, FAQ, and examples. (#24836, #24866, #24868, #24870)
• •Python SDK examples and docs now use the public CodexConfig name for configuring Codex / AsyncCodex. (#24800)
• •The bundled OpenAI Docs skill was updated with current Codex manual routing and a cached manual fetch helper. (#24914)

0.135.0

May 28, 2026

## New Features - codex doctor now reports richer environment, Git, terminal, app-server, and thread inventory diagnostics for support cases. (#24261, #24311, #24305) - /status shows remote connection details and server version when the TUI is connected over a remote transport. (#24420) - Vim mode gained text-object editing, improved word/line-end behavior, and a configurable interrupt-turn binding. (#24382, #24380, #24766) - /permissions now understands named permission profiles and displays configured custom profiles. (#21559) - Packaged Codex builds can discover and use the bundled patched zsh helper across supported macOS and Linux targets. (#23756, #24171) - The Python SDK now exposes friendly Sandbox presets for thread and turn APIs. (#24772) - install.sh/install.ps1 supports a non-interactive installation mode when CODEX_NON_INTERACTIVE=1 is set. (#21567) ## Bug Fixes - Markdown tables and multiline lists render more readably in the TUI, with better column sizing and app-style table formatting. (#24489, #24346, #24351) - TUI output is more stable on macOS and Zellij, avoiding stderr/composer corruption and raw-output overlap. (#24459, #24479, #24593) - Slash-command completion now preserves existing draft text for commands that accept inline arguments. (#23950) - Older tmux/iTerm control-mode sessions no longer lose normal Ctrl-C handling from unsupported keyboard enhancement setup. (#24371) - App mentions now exclude inaccessible or disabled apps instead of offering unusable $ suggestions. (#24625) - Resume flows now include non-interactive exec sessions when requested and honor cwd overrides for idle cached threads. (#24503, #24528) ## Documentation - Clarified image-viewing tool detail behavior and removed stale TUI composer documentation references. (#23949, #24641) - Updated Python SDK docs, examples, and notebook content to use the new sandbox preset API. (#24772) ## Chores - Updated Rust toolchain pins and SQLx/SQLite dependencies. (#24684, #24728) - Moved memory runtime state into a dedicated SQLite database. (#24591) - Removed remaining legacy config-profile consumers and routed more TUI config/plugin state through app-server-owned APIs. (#24076, #24254, #24255, #24265, #24266, #24257) - Centralized Responses retry handling and MCP tool naming logic to reduce duplicated internal plumbing. (#24131, #21576) ## Changelog Full Changelog: https://github.com/openai/codex/compare/rust-v0.134.0...rust-v0.135.0 - #24164 fix(remote-control): cap reconnect backoff @apanasenko-oai - #23756 package: include zsh fork in Codex package @bolinfest - #23757 Default function tools into tool hooks @abhinav-oai - #24171 package: add x64 macOS codex-zsh artifact @bolinfest - #24159 code-mode: merge stored values by key @cconger - #23983 fix: plugin bundle archive handling for upload and install @xl-openai - #24261 feat(doctor): add environment diagnostics @fcoury-oai - #24311 Report app-server version in codex doctor @etraut-openai - #24314 tui: label compact rate-limit percentages @etraut-openai - #24420 Show remote connection details in /status @etraut-openai - #24317 Respect hook trust bypass during TUI startup @etraut-openai - #24254 TUI config cleanup: oss_provider @etraut-openai - #24255 TUI config cleanup: trusted projects @etraut-openai - #24265 TUI config cleanup: MCP inventory @etraut-openai - #24305 Add doctor thread inventory audit @etraut-openai - #24346 fix(tui): improve markdown table column allocation @fcoury-oai - #24351 fix(tui): improve multiline markdown list readability @fcoury-oai - #24459 fix(tui): prevent macos stderr from corrupting composer @fcoury-oai - #24479 fix(process-hardening): preserve macos malloc diagnostics @fcoury-oai - #24474 Log rollout writer OS errors @etraut-openai - #24076 chore: stop consuming legacy config profiles @jif-oai - #24131 centralize Responses retry policy @rhan-oai - #23858 [wip] goal shift @jif-oai - #24555 chore: drop orphaned codex memories MCP crate @jif-oai - #24558 chore: move memory prompt builder into extension @jif-oai - #24562 Add ad-hoc memory note tool @jif-oai - #24567 Wire metrics client into memories extension @jif-oai - #24588 fix: drop flake @jif-oai - #24583 Add memory tool call metrics to memories extension @jif-oai - #24586 Wire app-server extension event sink @jif-oai - #24532 Use thread config for TUI MCP inventory @etraut-openai - #24105 [codex] Make active turn task singular @pakrym-oai - #21576 Move MCP tool naming mode into manager @pakrym-oai - #24503 tui: include exec sessions in resume list @etraut-openai - #24600 feat: gate dedicated memories tools in config @jif-oai - #21559 tui: add named permission profile picker @viyatb-oai - #24608 feat: add manual and remote_v2 tags to compaction metric @jif-oai - #24611 test: clean up apply_patch allow-session artifact @jif-oai - #24609 Remove reserved namespaces dedup @pakrym-oai - #23964 Move slash input logic out of chat composer @canvrno-oai - #24615 Add goal extension telemetry parity @jif-oai - #24371 fix(tui): avoid modifyOtherKeys for unknown tmux formats @fcoury-oai - #24626 fix: restore goal accounting after thread resume @jif-oai - #24591 Move memory state to a dedicated SQLite DB @jif-oai - #23823 standalone websearch extension @sayan-oai - #24593 fix(tui): keep raw output above composer in zellij @fcoury-oai - #24625 tui: keep inaccessible apps out of mentions @canvrno-oai - #24154 Add experimental turn additional context @pakrym-oai - #24473 fix(remote-control): surface websocket task stalls @apanasenko-oai - #24528 Respect resume cwd overrides for idle cached threads @etraut-openai - #24160 Add forked_from_thread_id turn metadata @owenlin0 - #24646 make direct only allowed caller for standalone websearch @sayan-oai - #23949 Clarify view_image tool description @fjord-oai - #24266 TUI config cleanup: plugin mentions @etraut-openai - #24320 Avoid repeated marketplace upgrades for alternate layouts @etraut-openai - #23813 windows-sandbox: remove SandboxPolicy runner plumbing @bolinfest - #24652 [codex] remove plain image wrapper spans @pakrym-oai - #24623 Attach Windows sandbox log to feedback reports @iceweasel-oai - #24644 Restore legacy image detail values @rhan-oai - #24655 [codex-analytics] add grouped session id to runtime events @marksteinbrick-oai - #24658 [codex] Remove obsolete goal continuation turn marker @pakrym-oai - #24660 fix: dont compact standalone websearch schema @sayan-oai - #24667 fix(core): instrument stalled tool-listing handoff @apanasenko-oai - #24684 Uprev Rust toolchain pins to 1.95.0 @anp-oai - #21567 fix: add noninteractive install script mode @efrazer-oai - #24707 Allow runtime enablement for remote plugins @xl-openai - #24714 fix(auto-review) skip legacy notify for auto review threads @dylan-hurd-oai - #24690 Revert "Add Bedrock Mantle GovCloud region (#23860)" @celia-oai - #24628 feat: handle goal usage limits in goal extension @jif-oai - #24746 Fix guardian review test user input @jif-oai - #24744 feat: add thread idle lifecycle hook @jif-oai - #24751 Drop startup context when truncating forked rollouts @jif-oai - #24257 TUI config cleanup: plugin marketplace @etraut-openai - #24380 fix(tui): complete vim word-end and line-end behavior @fcoury-oai - #24728 Bump SQLx to pick up newer bundled SQLite @jif-oai - #24637 fix: run standalone updates noninteractively @efrazer-oai - #24778 make vercel webhook url an env secret @sayan-oai - #23950 fix: Preserve draft text when completing argument-taking slash commands @canvrno-oai - #24641 [codex] Remove stale composer narrative doc references @canvrno-oai - #24368 [codex] add compaction metadata to turn headers @ningyi-oai - #24772 [codex] Add friendly Python SDK sandbox presets @aibrahim-oai - #24382 feat(tui): add vim text object bindings @fcoury-oai - #24766 feat(tui): make turn interruption keybind configurable @fcoury-oai - #24489 feat(tui): render markdown tables in app style [1 of 2] @fcoury-oai - #24713 chore: enable namespace tools for Bedrock @celia-oai

0.134.0

May 26, 2026

• •Added search across local conversation history, including case-insensitive content matches with result previews. (#23519, #23921)
• •Made --profile the primary profile selector across CLI, TUI permissions, and sandbox flows, with legacy profile configs rejected through migration guidance. (#23708, #23883, #23890, #24051, #24055, #24059, #24067, #24110)
• •Improved MCP setup with per-server environment targeting and OAuth options for streamable HTTP servers. (#23583, #24120)
• •Made connector tool schemas more reliable by preserving local $ref/$defs structures and compacting oversized schemas before exposure. (#23357, #23904)
• •Let read-only MCP tools run concurrently when they advertise readOnlyHint. (#23750)
• •Added richer extension and hook context, including conversation history for extension tools and subagent identity in hook inputs. (#22882, #23963)
• •Improved remote reliability by reconnecting stale exec-server websocket clients, retrying remote control immediately after auth recovery, and retrying remote compaction v2 streams. (#23867, #23775, #23951)
• •Fixed Windows TUI rendering corruption by restoring virtual terminal mode before drawing. (#24082)
• •Displayed workspace-specific usage-limit messages for credit and spend-cap failures. (#24114)
• •Allowed plugin skills to reuse shared plugin-level icon assets. (#23776)
• •Preserved active permission profile metadata when syncing auto-review runtime settings. (#23956)
• •Ensured Node-based tools honor Codex’s managed network proxy environment. (#23905)
• •Documented the curl and PowerShell installer paths in the README. (#24106)
• •Updated developer docs to prefer just test over direct cargo test for repo-local test runs. (#23910)
• •Added profile migration documentation links to relevant config errors. (#23879)

0.133.0

May 21, 2026

• •Goals are now enabled by default, backed by dedicated storage, and track progress across active turns. (#23300, #23685, #23696, #23732)
• •codex remote-control now runs like a foreground command, waits for readiness, reports machine status, and keeps explicit daemon-style start/stop commands. (#22878)
• •Permission profiles gained list APIs, inheritance, managed requirements.toml support, runtime refresh behavior, and stronger Windows sandbox integration. (#22928, #23412, #22270, #23433, #22931, #23715)
• •Plugin discovery is easier to inspect, with marketplace-aware list output, installed versions, visible marketplace roots, and remote collection support. (#23372, #23584, #23727, #23730)
• •Extensions can observe more lifecycle events, including subagent start/stop, tool execution, turn metadata, and async approval/turn processing. (#22782, #22873, #23309, #23688, #23690, #23692)
• •Fixed TUI startup choosing the wrong working directory when reusing a local app-server socket. (#23538)
• •Fixed plan-mode free-form answers so modified Enter keys, like Shift+Enter, no longer submit unexpectedly. (#23536)
• •Removed stale background terminal poll events after a process exits. (#23231)
• •Preserved raw code-mode exec output unless an explicit output token limit is requested. (#23564)
• •Made AGENTS instruction loading more reliable, including local global reads and warnings for invalid UTF-8 instead of silent drops. (#23343, #23232)
• •Fixed app-server startup/shutdown races, empty resume/fork paths, plugin upgrade failures, and realtime v1 websocket compatibility. (#23516, #23578, #23400, #23356, #23771)
• •Added clearer plugin-creator guidance for updating and reinstalling local personal plugins. (#23542)
• •Expanded app-server/API docs and schema coverage around managed permission profile requirements. (#23433, #23555)
• •Added a canonical Codex package archive pipeline and moved installers, npm packages, DotSlash, and SDK runtimes toward that shared layout. (#23513, #23582, #23586, #23596, #23635, #23636, #23637, #23638, #23786)
• •Fixed Linux Python runtime wheel tags so glibc-based systems can install the runtime artifacts. (#21812)

0.132.0

May 20, 2026

• •The Python SDK now supports first-class authentication, including API key login, ChatGPT browser and device-code flows, account inspection, and logout APIs. (#23093)
• •Python turn APIs are easier to use for text-only workflows: you can pass a plain string as input, and handle-based runs now return a richer TurnResult with collected items, timing, and usage data. (#23151, #23162)
• •codex exec resume now accepts --output-schema, so resumed automations can keep session context while still enforcing structured JSON output. (#23123)
• •TUI startup is faster because terminal capability probes are now batched instead of waiting on several serial checks before the first interactive frame. (#23175)
• •Remote executor registration can now use standard Codex auth instead of a separate registry credential flow. (#22769)
• •App-server turns can preserve requested image fidelity, including original-resolution local images, across user inputs and image-producing tools. (#20693)
• •Goal continuations now stop when they hit usage limits or a repeated blocker instead of looping and burning more tokens, and completion responses phrase usage more naturally. (#23094, #22907)
• •The session picker is easier to trust: renamed threads now show name (thread-id) in resume hints, and pasted text works in the picker search box. (#23234, #23338)
• •Multi-session TUI flows are more reliable: in-progress MCP calls stay marked as active during replay, and elicitation replies are sent back to the thread that requested them. (#23236, #23241)
• •Remote sessions now keep websocket connections alive and show repo-relative diff paths again instead of /tmp/...-prefixed paths. (#23226, #23261)
• •Windows installs are more robust: codex doctor now detects npm-managed installs correctly, and MSVC release binaries no longer depend on separately installed VC++ runtime DLLs. (#22967, #22905)
• •TUI polish fixes include immediate shutdown feedback on exit, hiding the ChatGPT usage link for non-OpenAI providers, and keeping a cleared Fast tier from reappearing after side-thread resume. (#23323, #23127, #23121)
• •The Python SDK docs, FAQ, and examples were refreshed around the new auth flow and turn APIs, with clearer setup guidance and simpler text-only examples. (#22941, #23093, #23151, #23162)
• •Memory summaries are now versioned and rebuilt when the stored format is stale, which should keep long-lived memory context leaner and more predictable. (#23148)

0.131.0

May 18, 2026

• •The TUI now offers richer session controls and display: data-driven service-tier commands, blended token usage, permissions/approval mode, effective workspace roots, and responsive Markdown tables. (#21745, #21906, #21991, #21669, #21677, #22052, #22612)
• •@ mentions now search files, directories, plugins, and skills in one picker, backed by app-server plugin metadata. (#19068, #22375)
• •Plugin workflows gained marketplace CLI commands, version-aware sharing, share checkout, clearer shared-workspace buckets, and default-enabled plugin hooks. (#21396, #22397, #22425, #22435, #22549)
• •Remote workflows now support daemon-managed codex remote-control, runtime enable/disable APIs, status reads, and registry-backed/configured remote environments. (#20718, #22218, #22562, #22578, #22877, #20667, #21323)
• •The Python SDK moved to openai-codex / openai_codex, with pinned runtime-generated types, concurrent turn routing, approval modes, and integration coverage. (#21778, #21891, #21893, #21896, #21905, #21910, #22014)
• •Added codex doctor for support-ready diagnostics across runtime, auth, terminal, network, config, and local state. (#22336)
• •Fixed several TUI interaction and rendering issues, including URL wrapping, light-mode selection contrast, Shift+Enter in tmux, /review MCP startup status, /side Esc handling, and network approval history text. (#21760, #21950, #21943, #21624, #22710, #22229)
• •Hardened Windows sandbox behavior around deny-read rules, scoped write roots, ineffective firewall policy, and PowerShell edge cases. (#18202, #21479, #22353, #21400, #22643)
• •Preserved managed read restrictions during permission escalation and cleaned up workspace-root permission profile resolution. (#15977, #22624, #22683)
• •Made app-server and local state startup safer by preserving SQLite data, failing closed when state cannot open, adding recovery paths, and softening optional metadata sync failures. (#21831, #21847, #22580, #22734, #22899)
• •Improved Git and auth reliability by using root worktree hooks consistently, ignoring repo hook/fsmonitor config in helper commands, binding local MCP OAuth callbacks, and revoking superseded login tokens. (#21969, #22843, #22652, #20237, #21747)
• •Reduced remote and Windows cleanup friction with longer exec-server transport timeouts, quieter taskkill cleanup, and non-queued plugin reads. (#21825, #21759, #22058, #22703)
• •Clarified that general Codex product docs should not be added to this repo, while app-server API docs remain in scope. (#21772)
• •Updated plugin-creator guidance for the simplified local plugin handoff links. (#22240)
• •Documented new app-server/API contracts for remote environments and the desktop-owned config namespace. (#21323, #22584)

0.130.0

May 8, 2026

• •Plugin details now show bundled hooks, and plugin sharing exposes link metadata plus discoverability controls. (#21447, #21495, #21637)
• •Added codex remote-control as a simpler entrypoint for starting a headless, remotely controllable app-server. (#21424)
• •App-server clients can page large threads with unloaded, summary, or full turn item views. (#21566)
• •Bedrock auth can now use AWS console-login credentials from aws login profiles. (#21623)
• •view_image can resolve files through the selected environment for multi-environment sessions. (#21143)
• •Live app-server threads now pick up config changes without requiring a restart. (#21187)
• •Turn diffs stay accurate across apply-patch operations, including partial failures that still mutated files. (#21180, #21518)
• •Thread summaries, renames, resume, and fork paths work better through ThreadStore, including threads without local rollout paths. (#21264, #21265, #21266)
• •Remote compaction now emits response.processed for v2 streams and avoids sending service_tier on API-key compact requests. (#21642, #21676)
• •Windows sandbox setup now grants sandbox users access to the desktop runtime binary cache. (#21564)
• •Removed stale “research preview” wording from the codex exec startup banner. (#21683)
• •Fixed issue templates so CLI reports keep the intended guidance, labels apply correctly, and feature requests link to the right contributing docs. (#21685, #21686, #21688)
• •Updated install and tooling docs to consistently use cargo install --locked. (#21592)
• •Added a faster Cargo profiling build profile and disabled empty doctest targets to speed up Rust development loops. (#21574, #21584)
• •Hardened dependency and CI hygiene with fully qualified GitHub Action pins, a Dependabot cooldown, and a cargo-shear upgrade. (#21436, #21547, #21599)