Codex CLI

0.149.0

August 20, 2026

• •Added an interactive codex agents dashboard for searching, starting, opening, renaming, and stopping tasks, with configurable shortcuts. (#39094, #39112, #39114, #39142)
• •Added /cd, /pwd, and /cwd commands for managing the working directory in TUI sessions. (#38894)
• •Added codex queue for sending messages to existing local or remote sessions. (#39092)
• •Expanded Vim editing with character replacement and more change motions such as cw, c$, and cc. (#39661)
• •codex doctor now diagnoses endpoint protection, network/proxy failures, desktop app state, and update connectivity. (#38827, #38918, #39060, #39074)
• •SDK users can now pass exact CLI config overrides and select max or ultra reasoning effort. (#38817, #39662)
• •Queued messages now wake idle sessions reliably, resolve duplicate session names more usefully, and preserve pasted or deferred command semantics. (#39034, #39385, #39604)
• •Resumed and forked threads now restore their active permission profile instead of silently falling back to current defaults. (#39153)

0.148.0

August 18, 2026

• •Export complete TUI conversations to Markdown with /export, either to the clipboard or a new file. (#37358)
• •Fork sessions with codex exec fork, and archive or restore sessions from the TUI resume picker. (#37367, #37369, #37371)
• •Draft prompts while the TUI initializes, with resume and fork progress shown during startup. (#38642, #38788)
• •View estimated thread credits or cost in /status, status lines, and terminal titles for eligible workspaces. (#38281, #38282)
• •Use Amazon Bedrock Runtime as a built-in provider with AWS profile, region, and GPT-5.6 routing support. (#38470)
• •Hooks can now run commands asynchronously and invoke MCP tools. (#37533, #38705)
• •Model switches and settings updates no longer leave stale instructions behind or change an active turn midstream. (#37260, #38785)
• •Resumed sessions now restore their persisted working directory and approval policy, with more accurate transcript previews. (#37198, #37368, #38605)

0.147.0

August 7, 2026

• •Install portable Agent Plugins and search across local, personal, workspace, and remote plugin catalogs. (#36544, #36409, #36919, #36796)
• •Organize conversations into persistent, manually ordered sections and browse long transcripts incrementally. (#35722, #36007, #36380, #36948, #36950)
• •Enable automatically reviewed approvals with the new --approve-for-me CLI flag. (#36373)
• •Import Cursor-managed skills and synchronize changes to imported Claude and Cursor conversations without creating duplicates. (#36361, #36356, #35623)
• •Support the opt-in MCP 2026-07-28 protocol, including paginated discovery, multi-round requests, and non-blocking server startup. (#35724, #35725, #35590, #35742)
• •Enable cached web search and remote conversation compaction for Amazon Bedrock. (#36938, #36981)
• •Redact secrets and complete bearer tokens from displayed commands and replayed conversation history. (#36893, #36908)
• •Prevent lost or stalled terminal input when focus returns, MCP servers initialize, or Ghostty handles keyboard shortcuts. (#35649, #35957, #36834)

0.146.1

August 5, 2026

• •Apply safer automatic-review defaults for cyber-capable models and explain permission changes in the terminal interface. (#37057)

0.146.0

July 29, 2026

• •Name new sessions with /new or /clear, pin important threads, and switch between side conversations without closing them. (#34605, #34840, #35011)
• •Support Agent Plugins manifests, workspace plugin publishing, and additional plugin marketplaces for Amazon Bedrock and Claude Code. (#35105, #35254, #34931, #34979)
• •Fork threads with paginated history, including temporary forks that do not appear in thread listings. (#35220, #35251)
• •Connect app-server to remote Code Mode hosts over WebSocket. (#35078, #35098)
• •Enable standalone web search for compatible custom model providers. (#34846)
• •Discover executor-provided skills and securely read their associated resources, including explicitly selected skills. (#35184, #35198)
• •Honor configured proxies across authentication, plugin downloads, MCP authorization, remote execution, WebSockets, redirects, and LM Studio connections. (#34479, #34509, #34655, #34678, #35023, #35056, #35239)
• •Keep MCP connections and Apps tools current when authentication or configuration changes, reconnecting closed servers without restarting healthy connections. (#34952, #34957, #35028, #35144, #35146, #35151)

0.145.0

July 21, 2026

• •Added experimental paginated thread history with efficient resume, search, persisted names, sub-agent support, and memories. (#33364, #33907, #34085, #34229, #34386)
• •Expanded /import to migrate Cursor and Claude Code settings, MCP servers, plugins, sessions, commands, and project-scoped memories. (#31672, #33411, #33426, #33444)
• •Added experimental Amazon Bedrock login, custom endpoint and authentication support, and GPT-5.6 Sol as the default Bedrock model. (#31327, #33170, #33175, #32288, #33695)
• •Added audio inputs and tool outputs, including common local audio formats, and introduced streaming realtime V3 conversations. (#33261, #33856, #33932, #34080, #34385)
• •Stabilized the opt-in multi-agent V2 experience with configurable sub-agent models, reasoning levels, concurrency, restored roles, and improved agent navigation. (#33550, #33631, #33657, #33841, #34383)
• •Added secure, clickable inline visualization links in the terminal UI. (#33925, #34217, #34346)
• •Editing an earlier prompt or retrying a safety-buffered turn now creates a contextual branch, preserving the original conversation, attachments, and mention bindings. (#33201, #33207, #33211)
• •Improved terminal responsiveness for long conversations and streamed output through incremental Markdown rendering, fewer redraws, caching, and bounded command output. (#34045, #34049, #34216, #34223, #34359)

0.144.6

July 18, 2026

• •Refreshed bundled instructions for GPT-5.6 Sol, Terra, and Luna, and corrected their context windows to 272,000 tokens. (#33972, #34009)

0.144.5

July 16, 2026

• •Improved dangerous-command detection, including more forced rm forms, and provides clearer rejection reasons when commands are denied. (#33455)

0.144.4

July 14, 2026

• •No user-facing changes in this patch release.

0.144.3

July 13, 2026

• •Published a version-only release with no merged pull request changes since rust-v0.144.2.

0.144.2

July 13, 2026

• •Restored the previous Guardian auto-review policy, request format, and tool behavior after rolling back a prompting regression. (#32672)

0.144.1

July 9, 2026

• •Fixed standalone installs failing when GitHub returns compact or reordered release metadata. (#31913)
• •Ensured macOS package installs expose the code-mode host alongside the codex executable. (#31913)
• •Kept code mode working when the companion host binary is unavailable by falling back to the embedded runtime. (#31913)

0.144.0

July 9, 2026

• •Usage-limit reset credits now show their type and expiration, and let you choose which credit to redeem. (#30488)
• •Added a writes app-approval mode that allows declared read-only actions while prompting for writes. (#30482)
• •MCP tools can now request authentication interactively without an experimental opt-in. (#28772)
• •App-server hosts can provide Codex authentication at runtime and redirect successful logins to a hosted page. (#28745, #31274)
• •Global pnunen installs are now detected so diagnostics and updates use the correct package manager. (#31503)
• •Selecting Ultra reasoning now warns when high multi-agent concurrency could increase usage quickly. (#31621)
• •Resumed ChatGPT threads recover when compaction references a retired model by retrying with the currently selected model. (#30319)
• •Fixed Code Mode crashes in Intel macOS release binaries. (#30953)

0.143.0

July 8, 2026

• •Remote plugins are now enabled by default, with richer catalog rows, npm marketplace sources, and visible remote/local versions. (#30297, #26705, #29375, #30981)
• •Codex can route authentication and Responses API traffic through macOS and Windows system proxies, including PAC and WPAD configurations. (#26708, #26709, #31335)
• •Added codex remote-control pair for generating manual pairing codes from a running daemon. (#29913)
• •Added Amazon Bedrock GPT-5.6 Sol, Terra, and Luna models, with first-class support for max reasoning effort. (#30285, #30467)
• •MCP tools now use tool search by default, and ChatGPT-hosted MCP servers can explicitly use session authentication. (#29486, #29733)
• •App-server clients can inspect environments, list descendant threads, and fork history through a specific turn. (#30291, #29591, #30277)
• •Fixed Windows ConPTY input handling for line endings and backspace, plus sandbox credential retry edge cases. (#29734, #29624, #29637)
• •Fixed stale TUI safety prompts and cancelled reviews that could leave MCP startup appearing busy. (#30490, #31189)

0.142.5

July 1, 2026

• •Prevented full Responses WebSocket request payloads from being written to trace logs. (#30771)

0.142.4

June 29, 2026

• •No user-facing changes were identified for this release.

0.142.3

June 26, 2026

• •Maintenance-only patch release with no user-facing changes since 0.142.2.

0.142.2

June 25, 2026

• •MCP tools now use tool search by default when supported, improving tool discovery while preserving compatibility with older models and providers. (#29486)
• •macOS authentication clients can honor system proxy, PAC, and WPAD settings when respect_system_proxy is enabled. (#26709)
• •Plugins can provide dedicated dark-mode logos through local manifests and remote catalogs. (#29488)
• •Apps can display richer safety-buffering UI using server-provided visibility and faster-model metadata. (#29473)
• •Remote plugin catalogs now return curated featured-plugin rankings. (#29485)
• •Expired Amazon Bedrock credentials now produce actionable recovery guidance instead of a generic authorization error. (#28992)
• •Remote stdio MCP servers now accept absolute working directories written in the remote platform’s path format. (#29493)
• •Remote HTTP(S) image inputs now return clear model-visible validation errors; inline data URLs and local images remain supported. (#29417, #29419)

0.142.1

June 25, 2026

• •Added opt-in Windows system proxy support for authentication, including PAC, WPAD, static proxies, and bypass rules. (#26708)

0.142.0

June 22, 2026

• •/usage can now show and redeem earned usage-limit reset credits, with confirmation, retry, and refreshed availability states. (#28154, #28793)
• •/plugins now organizes remote plugins into OpenAI Curated, Workspace, and Shared with me sections, while eligible turns can recommend and install relevant plugins. (#26703, #28399, #28400, #27704, #28403)
• •Configurable rollout token budgets track usage across agent threads, provide remaining-budget reminders, and abort turns when exhausted. (#28746, #28494, #28707, #29423)
• •App-server clients can configure multi-agent delegation as disabled, explicit-request-only, or proactive at the thread and turn level. (#28685, #28792, #29324)
• •Added an indexed web-search mode that permits live searches while restricting direct page access to server-approved URLs. (#28489)
• •Codex can now receive scheduled UTC time reminders and query the current time directly, including through client-provided app-server clocks. (#28822, #28824, #28835, #29011)
• •Restored reliable Linux TUI rendering after suspending with Ctrl+Z and resuming with fg. (#28342)
• •Exec-server processes and stdio MCP sessions now survive transient disconnects, including signed-URL refresh and retry-safe stdin writes. (#28512, #28374, #28546, #28895)

0.141.0

June 18, 2026

• •Remote executors now use authenticated, end-to-end encrypted Noise relay channels. (#26242, #26245)
• •Cross-platform remote execution now preserves executor-native working directories and shells, including filesystem permission paths across app-server and exec-server boundaries. (#27819, #27995, #28032, #28122, #28165, #28367)
• •Selected executor plugins can activate their stdio MCP servers per thread; plugin discovery also adds a created-by-me marketplace and auth-specific curated catalogs. (#27870, #27884, #27893, #28203, #28383)
• •App-server clients can list immediate child threads, correlate external-agent imports with detailed results, and read or redeem rate-limit reset credits. (#26662, #28008, #28143)
• •Realtime clients can explicitly append speech, control how Codex responses enter conversations, and omit startup context. (#27917, #28405)
• •TUI input prompts can auto-resolve after inactivity, with a countdown that pauses on interaction. (#28235)
• •Hook trust bypass now persists through codex exec thread start and resume, while blocking PostToolUse hooks correctly reject code-mode tool calls. (#26434, #28365)
• •Plugin capabilities now route consistently by authentication mode, deduplicate conflicting App/MCP declarations, and preserve remote marketplace ordering. (#27461, #27602, #27607, #27902, #27958, #28395)

0.140.0

June 15, 2026

• •Added /usage views for daily, weekly, and cumulative account token activity. (#27925)
• •/goal now preserves oversized text, large pasted blocks, and image attachments, including in remote app-server sessions. (#27508, #27509, #27510)
• •Added permanent session deletion through codex delete, /delete, and app-server thread/delete, with confirmation safeguards and subagent cleanup. (#25018, #27476)
• •Added /import for selectively importing setup, project configuration, and recent chats from Claude Code. (#27070, #27071, #27703)
• •Typing @ now opens the unified mentions menu for files, plugins, and skills by default. (#27499)
• •Added managed Amazon Bedrock API-key authentication and encrypted local storage for CLI and MCP OAuth credentials. (#27443, #27689, #27504, #27535, #27539, #27541)
• •Corrupted SQLite state databases are now backed up and rebuilt automatically from rollout data, including malformed database-directory cases. (#26859, #27719)
• •Prevented /review from crashing when Esc is pressed with queued guidance, while preserving that guidance when the review is canceled. (#22879)

0.139.0

June 9, 2026

• •Code mode can now call standalone web search directly, including from nested JavaScript tool calls, and receive plaintext search results. (#26719)
• •Tool and connector input schemas now preserve oneOf and allOf, and large schemas keep more shallow structure when compacted, improving compatibility with richer MCP tools. (#24118, #27084)
• •codex doctor now includes editor and pager environment details in the local report while redacting raw values in JSON output. (#27081)
• •Plugin marketplace automation is more informative and responsive: codex plugin marketplace list --json now includes each marketplace source, and plugin lists can return from the cached remote catalog before refreshing in the background. (#27009, #26932)
• •codex resume --last "..." and codex fork --last "..." now treat the trailing argument as the initial prompt instead of misreading it as a session ID. (#26818)
• •MCP startup warnings from subagents now stay in the thread that owns them, avoiding duplicate parent-thread alerts and stuck startup spinners in the TUI. (#26639)
• •Image edits now use the exact referenced image file paths instead of guessing from conversation history, so attached-image edits land on the intended input. (#26486)
• •Bare URLs with ~ in the path are now linkified end to end in the TUI instead of being truncated before the tilde. (#27088)

0.138.0

June 8, 2026

• •The /app command can now hand off the current CLI thread into Codex Desktop on macOS and native Windows, and Windows workspace launches can open directly into Desktop instead of stopping at a manual prompt. (#25638, #26500)
• •Local image attachments and standalone image generations now expose their saved file paths to the model, which makes follow-up edits and file references more reliable. (#25944, #25947)
• •Reasoning effort selection is more flexible: the TUI adds fallback shortcuts for terminals that miss Alt bindings, and model-defined effort levels now flow through in the order advertised by the model. (#25623, #26444, #26446)
• •App-server integrations can now read account token usage, and Codex auth supports v2 personal access tokens in CLI and app-server flows. (#25344, #25731)
• •Plugin automation got richer structured output: add/remove and marketplace commands support --json, plugin list JSON includes marketplace source, and plugin detail data now exposes default prompts, remote MCP servers, and unavailable app templates. (#26631, #26417, #25887, #26453, #26317)
• •Goal workflows are more predictable: multiline paste in /goal edit no longer submits early, idle auto-turns stay out of Plan mode, and goals stop auto-continuing after terminal turn failures. (#26047, #26147, #26690)
• •Forked threads now keep user-renamed titles instead of falling back to the original first-prompt name. (#26075)
• •The TUI no longer adds extra blank space while streaming, and cancelled prompts reopen with the cursor at the end so you can keep editing naturally. (#26636, #26457)

0.137.0

June 4, 2026

• •TUI controls now support F13-F24 keybindings, paste in searchable menus, and a compact reasoning-only status/title item (#25329, #25400, #25504).
• •Enterprise/admin flows now show monthly credit limits and can apply cloud-managed config bundles, including EDU workspaces (#24812, #24617, #24619, #24620, #24622, #25963).
• •Remote-control clients can start pairing and list or revoke controller grants through app-server v2 RPCs (#25675, #25785).
• •Plugin workflows gained machine-readable codex plugin list --json output and cached remote catalog suggestions (#25330, #25457).
• •Hosted web and image tools are available in more code-mode flows, with standalone web searches able to run in parallel (#25176, #25702, #25890, #25923).
• •Multi-agent v2 keeps runtime choice with each thread and exposes cleaner follow-up and metadata defaults for spawned agents (#25266, #25636, #25720, #25721, #25722, #25841, #26114).
• •Cancelling a submitted prompt before visible output now restores the draft, attachments, and collaboration mode for editing (#25316).
• •Slash-command filtering and footer shortcut hints now reset or render according to the current UI state (#25492, #25625).

0.136.0

June 1, 2026

• •TUI markdown now keeps web links clickable with OSC 8 metadata, and cramped tables switch to readable key/value records without losing link targets. (#24472, #24636, #24825)
• •Sessions can now be archived from the TUI with /archive or from the CLI with codex archive / codex unarchive; archived sessions are protected from resume/fork until restored. (#25027, #25021)
• •App-server integrations can resume a thread with its initial turns page, see richer MCP server status, and launch stdio mode with codex app-server --stdio. (#23534, #24698, #24940)
• •Remote execution setup now supports CODEX_API_KEY registration for approved OpenAI hosts, while remote-control websockets use short-lived server tokens instead of ChatGPT access tokens. (#24666, #24141)
• •Windows admins get an alpha codex sandbox setup --elevated provisioning path, plus requirements support for allowed Windows sandbox implementations. (#24831, #23766)
• •A feature-gated standalone image generation extension can run through the native Codex image artifact completion pipeline. (#24723, #24972)
• •ChatGPT auth refreshes tokens before the five-minute expiry window and shows a relogin-required path for reused refresh tokens instead of collapsing into a generic cloud error. (#23546, #24830)
• •Command-safety hardening prevents /diff from running repository-provided Git helpers/hooks, avoids PowerShell parser execution on non-Windows hosts, and rejects browser-origin exec-server websocket handshakes. (#24954, #24946, #24947)

0.135.0

May 28, 2026

## New Features - codex doctor now reports richer environment, Git, terminal, app-server, and thread inventory diagnostics for support cases. (#24261, #24311, #24305) - /status shows remote connection details and server version when the TUI is connected over a remote transport. (#24420) - Vim mode gained text-object editing, improved word/line-end behavior, and a configurable interrupt-turn binding. (#24382, #24380, #24766) - /permissions now understands named permission profiles and displays configured custom profiles. (#21559) - Packaged Codex builds can discover and use the bundled patched zsh helper across supported macOS and Linux targets. (#23756, #24171) - The Python SDK now exposes friendly Sandbox presets for thread and turn APIs. (#24772) - install.sh/install.ps1 supports a non-interactive installation mode when CODEX_NON_INTERACTIVE=1 is set. (#21567) ## Bug Fixes - Markdown tables and multiline lists render more readably in the TUI, with better column sizing and app-style table formatting. (#24489, #24346, #24351) - TUI output is more stable on macOS and Zellij, avoiding stderr/composer corruption and raw-output overlap. (#24459, #24479, #24593) - Slash-c...

0.134.0

May 26, 2026

• •Added search across local conversation history, including case-insensitive content matches with result previews. (#23519, #23921)
• •Made --profile the primary profile selector across CLI, TUI permissions, and sandbox flows, with legacy profile configs rejected through migration guidance. (#23708, #23883, #23890, #24051, #24055, #24059, #24067, #24110)
• •Improved MCP setup with per-server environment targeting and OAuth options for streamable HTTP servers. (#23583, #24120)
• •Made connector tool schemas more reliable by preserving local $ref/$defs structures and compacting oversized schemas before exposure. (#23357, #23904)
• •Let read-only MCP tools run concurrently when they advertise readOnlyHint. (#23750)
• •Added richer extension and hook context, including conversation history for extension tools and subagent identity in hook inputs. (#22882, #23963)
• •Improved remote reliability by reconnecting stale exec-server websocket clients, retrying remote control immediately after auth recovery, and retrying remote compaction v2 streams. (#23867, #23775, #23951)
• •Fixed Windows TUI rendering corruption by restoring virtual terminal mode before drawing. (#24082)

0.133.0

May 21, 2026

• •Goals are now enabled by default, backed by dedicated storage, and track progress across active turns. (#23300, #23685, #23696, #23732)
• •codex remote-control now runs like a foreground command, waits for readiness, reports machine status, and keeps explicit daemon-style start/stop commands. (#22878)
• •Permission profiles gained list APIs, inheritance, managed requirements.toml support, runtime refresh behavior, and stronger Windows sandbox integration. (#22928, #23412, #22270, #23433, #22931, #23715)
• •Plugin discovery is easier to inspect, with marketplace-aware list output, installed versions, visible marketplace roots, and remote collection support. (#23372, #23584, #23727, #23730)
• •Extensions can observe more lifecycle events, including subagent start/stop, tool execution, turn metadata, and async approval/turn processing. (#22782, #22873, #23309, #23688, #23690, #23692)
• •Fixed TUI startup choosing the wrong working directory when reusing a local app-server socket. (#23538)
• •Fixed plan-mode free-form answers so modified Enter keys, like Shift+Enter, no longer submit unexpectedly. (#23536)
• •Removed stale background terminal poll events after a process exits. (#23231)

0.132.0

May 20, 2026

• •The Python SDK now supports first-class authentication, including API key login, ChatGPT browser and device-code flows, account inspection, and logout APIs. (#23093)
• •Python turn APIs are easier to use for text-only workflows: you can pass a plain string as input, and handle-based runs now return a richer TurnResult with collected items, timing, and usage data. (#23151, #23162)
• •codex exec resume now accepts --output-schema, so resumed automations can keep session context while still enforcing structured JSON output. (#23123)
• •TUI startup is faster because terminal capability probes are now batched instead of waiting on several serial checks before the first interactive frame. (#23175)
• •Remote executor registration can now use standard Codex auth instead of a separate registry credential flow. (#22769)
• •App-server turns can preserve requested image fidelity, including original-resolution local images, across user inputs and image-producing tools. (#20693)
• •Goal continuations now stop when they hit usage limits or a repeated blocker instead of looping and burning more tokens, and completion responses phrase usage more naturally. (#23094, #22907)
• •The session picker is easier to trust: renamed threads now show name (thread-id) in resume hints, and pasted text works in the picker search box. (#23234, #23338)