Codex CLI 0.149.0 download

New Features
- Added an interactive codex agents dashboard for searching, starting, opening, renaming, and stopping tasks, with configurable shortcuts. (#39094, #39112, #39114, #39142)
- Added /cd, /pwd, and /cwd commands for managing the working directory in TUI sessions. (#38894)
- Added codex queue for sending messages to existing local or remote sessions. (#39092)
- Expanded Vim editing with character replacement and more change motions such as cw, c$, and cc. (#39661)
- codex doctor now diagnoses endpoint protection, network/proxy failures, desktop app state, and update connectivity. (#38827, #38918, #39060, #39074)
- SDK users can now pass exact CLI config overrides and select max or ultra reasoning effort. (#38817, #39662)
Bug Fixes
- Queued messages now wake idle sessions reliably, resolve duplicate session names more usefully, and preserve pasted or deferred command semantics. (#39034, #39385, #39604)
- Resumed and forked threads now restore their active permission profile instead of silently falling back to current defaults. (#39153)
- Fixed duplicate sub-agent activity and tightened TUI routing for sub-agent notifications and approvals. (#39049, #39088)
- Realtime WebRTC sideband connections now reconnect after unexpected transport loss without dropping pending output. (#39257)
- Inline TUI history now remains available in Windows Terminal scrollback. (#39619)
- Inactive TUI thread replay buffers are now bounded to prevent excessive retained streamed output. (#39081)
Documentation
- Clarified that external contributions should go through issues and design discussion rather than pull requests. (#39089)
- Documented DNS exfiltration risks and trust limitations for secure devcontainers. (#39283)
Changelog
Full Changelog: rust-v0.148.0...rust-v0.149.0
- #38817 Add raw config overrides to the TypeScript SDK @copyberry
- #38819 Support metadata staging for reserved thread IDs @copyberry
- #38822 Avoid cloning TUI history span content @copyberry
- #38823 Avoid allocating per character when decorating hyperlinks @copyberry
- #38827 Add endpoint protection checks to codex doctor @copyberry
- #38830 Isolate external editor buffers from sandbox-writable paths @copyberry
- #38837 Share editor keymaps across TUI composer components @copyberry
- #38840 Identify Mac mini hosts in remote control handshakes @copyberry
- #38893 Restore thread timestamp maxima independently @copyberry
- #38894 Add working-directory commands to the TUI @copyberry
- #38899 Move requirements policy ownership to execpolicy @copyberry
- #38902 Honor per-environment shell variable policies @copyberry
- #38907 Edit queued messages with Vim history-up @copyberry
- #38913 Stop rendering columns after filling their area @copyberry
- #38916 Honor legacy :project_roots permission entries @copyberry
- #38918 Improve codex doctor network diagnostics @copyberry
- #38919 Reject obsolete app-server permission profile fields @copyberry
- #38921 Compact successful command activity in the TUI @copyberry
- #38940 Add experimental app-server project APIs @copyberry
- #38941 Prevent Noise auth tokens from reaching child processes @copyberry
- #38942 Enforce environment-specific command policies @copyberry
- #38947 Stop loading legacy managed config on Windows @copyberry
- #38978 Add a configurable skill catalog token budget @copyberry
- #38980 Bound Guardian v2 parent compaction context @copyberry
- #38987 Include images in Guardian v2 transcripts @copyberry
- #38990 Source Guardian v2 defaults from the model catalog @copyberry
- #38993 Evaluate recent and character-routed skill selection @copyberry
- #38994 Remove the workspace settings gate for apps and plugins @copyberry
- #38997 Retry transient Guardian sampling failures @copyberry
- #39001 Ignore stale Guardian tool risk scores @copyberry
- #39005 Disable Guardian V2 for managed automatic reviewers @copyberry
- #39006 Emit API-key turn cost telemetry from app-server @copyberry
- #39007 Wait for Guardian score progress in approval tests @copyberry
- #39008 Add task context to shadow skill selection @copyberry
- #39017 Move MCP policy types into codex-protocol @copyberry
- #39019 Isolate MCP resource headers during OAuth requests @copyberry
- #39020 Restrict Windows IDE pipe client impersonation @copyberry
- #39022 Hang soft-break whitespace in the TUI composer @copyberry
- #39023 Reduce retained MCP result data in TUI history @copyberry
- #39025 Speed up the large diff highlighting test @copyberry
- #39026 Use simulated time in the long typing test @copyberry
- #39028 Cache the test pet spritesheet encoding @copyberry
- #39030 Speed up the in-app resume cwd test @copyberry
- #39032 Encapsulate TUI shimmer under the motion module @copyberry
- #39033 Bound legacy resume preview scans @copyberry
- #39034 Dispatch queued messages written by other processes @copyberry
- #39035 Add app-server coverage for Guardian V2 approval routing @copyberry
- #39036 Allow config reads to join active app-server read batches @copyberry
- #39038 Restore Guardian risk scores across thread lifecycles @copyberry
- #39040 Preserve foreign paths in managed network approvals @copyberry
- #39043 Enforce managed authentication backend settings @copyberry
- #39045 Add managed gates for in-app chat and dictation @copyberry
- #39046 Restrict MCP HTTP redirects to the configured origin @copyberry
- #39047 Skip plugin hook loading when hooks are disabled @copyberry
- #39049 Avoid rendering sub-agent activity twice in the TUI @copyberry
- #39050 Prepare the telemetry shutdown worker during initialization @copyberry
- #39051 Use installed callable apps for TUI mentions @copyberry
- #39055 Add network policy metadata to environment configuration @copyberry
- #39056 Verify the pinned zsh manifest in release builds @copyberry
- #39057 Rate-limit TUI frames from their actual emission time @copyberry
- #39058 Tag Codex Apps protocol discovery metrics @copyberry
- #39060 Add desktop app diagnostics to codex doctor @copyberry
- #39061 Avoid rerendering streamed code fences @copyberry
- #39063 Render only visible rows in the transcript pager @copyberry
- #39064 Restrict queued-message editing to its dedicated binding @copyberry
- #39065 Limit terminal hyperlink layout to the visible viewport @copyberry
- #39067 Add desktop security enforcement diagnostics @copyberry
- #39068 Remove skill model delegation support @copyberry
- #39072 Persist generated images through turn executors @copyberry
- #39073 Propagate caller metadata to rendezvous connections @copyberry
- #39074 Add desktop update diagnostics to codex doctor @copyberry
- #39075 Avoid redundant terminal row clears @copyberry
- #39077 Build filesystem JSON params only for remote TUI sessions @copyberry
- #39078 Preserve tracing context for environment resolution @copyberry
- #39079 Apply user MCP policy to selected executor plugins @copyberry
- #39081 Bound TUI thread replay buffers by delta size @copyberry
- #39082 Prompt for project trust in remote TUI workspaces @copyberry
- #39083 Harden Windows sandbox provisioning against reparse points @copyberry
- #39084 Preserve filesystem permission path conventions @copyberry
- #39087 Read plugin authentication state from AuthManager @copyberry
- #39088 Harden TUI subagent navigation @copyberry
- #39089 Clarify the external contribution policy @copyberry
- #39092 Add a command to queue messages for existing sessions @copyberry
- #39094 Add an agents overview dashboard to the TUI @copyberry
- #39098 Trace exec-server requests from receipt through completion @copyberry
- #39100 Avoid redundant terminal size queries during history insertion @copyberry
- #39101 Update rmcp to 3.1.2 @copyberry
- #39102 Raise the GPT-5.6 maximum context window @copyberry
- #39103 Drop capabilities from Linux sandbox processes @copyberry
- #39112 Make the agents overview an interactive task dashboard @copyberry
- #39113 Surface interactive requests in realtime conversations @copyberry
- #39114 Add a dedicated codex agents dashboard command @copyberry
- #39115 Remove the experimental thread config endpoint @copyberry
- #39117 Reject lossy legacy permission projections @copyberry
- #39122 Fail closed on deeply nested command wrappers @copyberry
- #39131 Validate identifiers in plugin creator workflows @copyberry
- #39141 Redact auth tokens from app-server response logs @copyberry
- #39142 Add configurable shortcuts for the agents dashboard @copyberry
- #39143 Hydrate recommended plugin metadata on selection @copyberry
- #39145 Persist active permission profiles in turn context @copyberry
- #39147 Centralize persisted resume settings lookup @copyberry
- #39152 Update PyPI publish action to v1.14.2 @copyberry
- #39153 Restore permission profiles when resuming threads @copyberry
- #39154 Box the TUI future to bound CLI stack usage @copyberry
- #39155 Prepare Python SDK 0.147.0 stable release @copyberry
- #39157 Notify clients when Guardian requires strict review @copyberry
- #39159 Require approval for commands with dynamic shell words @copyberry
- #39163 Refresh collaboration instructions when their content changes @copyberry
- #39165 Prevent marketplace identity spoofing @copyberry
- #39174 Skip empty user messages for automatic idle turns @copyberry
- #39176 Drop descendant progress updates after remote compaction @copyberry
- #39187 Scope MCP app resource reads to their originating call @copyberry
- #39192 Preserve MCP resource origins across compaction @copyberry
- #39200 Add a symlink-safe reader for sensitive files @copyberry
- #39205 Reject symbolic links in memory workspaces @copyberry
- #39213 Add a fail-closed Tree-sitter PowerShell lowerer @copyberry
- #39214 Prevent custom providers from inheriting ambient auth @copyberry
- #39220 Reconnect Guardian sampling WebSockets after auth changes @copyberry
- #39221 Skip redirected external-agent migration destinations @copyberry
- #39224 Add Guardian v2 approval review metrics @copyberry