Codex CLI பழைய பதிப்புகள் – அனைத்துப் பதிப்புகளும்

New Features
- GPT-6.1 Sol is now the default model in the bundled and Amazon Bedrock catalogs. (#49318, #49339)
- Amazon Bedrock supports multi-agent V2 and Ultra reasoning on compatible models; Bedrock Mantle also accepts AWS GovCloud regions. (#49345, #49813)
- Sign in to MCP servers from an active terminal session with /mcp login <name>. (#49290)
- Choose your microphone, speaker, and microphone input channels for voice conversations, with preferences saved locally. (#49437, #49836)
- Daybreak is opt-in through --enable cli_daybreak or features.cli_daybreak=true; daybreak=true alone is insufficient. By default, controls and indicators are hidden, /daybreak is unavailable, and automatic Cyber routing is omitted—even for saved Daybreak threads. Saved preferences remain intact. Opt-in routing requires eligible ChatGPT sign-in, the OpenAI provider, and advertised model/program support. (#49856, #49858, #49859, #49861, #51207)
- Select a Cyber access program per turn with codex exec --cyber-access-program or the TypeScript SDK’s cyberAccessProgram option. The explicit exec override remains available with cli_daybreak disabled and leaves the saved choice unchanged. (#49939, #51207)
Bug Fixes
- Approved filesystem escalation can now grant broader write access while preserving denied reads and network restrictions. Background tasks retain their originating turn’s permissions. (#49353, #49880)
- Explicit launch permissions survive terminal reconnects and new sessions, while implicit client settings no longer overwrite server or saved-thread web-search settings. (#49809, #49799)
- Elevated Windows terminal sessions can start using an embedded server, and sandboxed PowerShell preserves relative paths beneath protected user profiles. (#49855, #49690)
- Enter correctly submits buffered input after paste detection expires, including in Vim insert mode. (#49810)
- Thread resume includes the latest committed history. Startup detects recoverable SQLite corruption earlier and preserves damaged databases as backups. (#49599, #49701)
- Responses retries and WebSocket-to-HTTP fallback honor server retry guidance, reducing premature failures during overload. (#49441)
Documentation
- Authentication guidance now accounts for keyring storage instead of implying credentials always reside in auth.json. (#49361)
Chores
- Publishing an older alpha or hotfix no longer moves npm alpha tags backward. (#49704)
Changelog
Full Changelog: rust-v0.160.0...rust-v0.161.0
- #49246 Use executable fixture copying in the bundled bwrap test @felixxia-oai
- #49257 Allow Guardian cached approvals with incomplete root context @felixxia-oai
- #49260 Restrict enterprise MCP auth and fail closed on config refresh @nicksteele-oai
- #49261 Preserve Windows sandbox runner launch errors @zm-oai
- #49262 Trace turn phases and correlate accepted input with turns @jif-oai
- #49266 Remove the remote agent message board client README @jif-oai
- #49267 Support remote agent message boards in multi-agent sessions @jif-oai
- #49269 Preserve thread overrides and cloud policy validity during config reloads @nicksteele-oai
- #49275 Isolate realtime conversation tests from Responses prewarm connections @felixxia-oai
- #49276 Enable enterprise MCP sign-in and account-scoped grant cleanup @nicksteele-oai
- #49277 Avoid a turn teardown race in the Guardian agent message test @felixxia-oai
- #49280 Restrict capability roots to captured turn environments @miz-openai
- #49286 Model exec-server session attachment state as an enum @jif-oai
- #49290 Add /mcp login <name> to the TUI @nicksteele-oai
- #49294 Record Guardian context mode in review and classification telemetry @felixxia-oai
- #49295 Simplify configuration fingerprint canonicalization @jif-oai
- #49297 Scan the session index backwards for batch thread name lookups @jif-oai
- #49300 Compact the inline hidden tag buffer once per chunk @jif-oai
- #49305 Batch metadata reads when resolving thread names @jif-oai
- #49308 Run piped legacy Wi

Bug Fixes
- Preserve SYSTEMROOT, TEMP, and TMP when launching remote stdio MCP servers with explicitly configured remote environment variables, allowing Unix hosts to retain the Windows executor's startup environment.
Changelog
- #51121: Backport Windows remote MCP environment preservation to 0.160.

New Features
- Browse older tasks in the agent command center with a keyboard-accessible “Show more” action. (#49106)
- Select transcript text and paste with middle-click in fullscreen mode on supported local Linux X11 terminals. (#49112)
- Start sessions outside a project with workspace defaults when policy permits, and restore saved permissions when resuming. (#49160)
- Added opt-in Guardian review capabilities to retrieve earlier user instructions and include context from agent handoffs. (#49036, #49057)
Bug Fixes
- Unsent queued messages now resume after reconnection once uncertain submissions are resolved, avoiding duplicate sends. (#49105)
- The terminal UI now preserves server provider, reasoning-summary, and verbosity settings and shows the correct sessions in resume and fork history. (#49144, #49161, #49171)
- Fixed Windows sandbox PowerShell fallbacks and long-path permission repairs, and suppressed unwanted console windows from background helpers. (#49019, #49058, #49098, #49164, #49386)
- Subagents now retain environments that are still starting and receive their configuration or preparation failure. (#49075)
- Prevented SQLite stalls during connection setup and logging, and surfaced initialization errors instead of masking them as timeouts. (#49032, #49102)
- Explicit provider model catalogs no longer include unsupported bundled models or reuse stale entries after refresh failures. (#49135)
Documentation
- Clarified how provider credentials use the configured storage backend and how env_key identifies the API-key environment variable. (#49118)
Chores
- Reduced repeated plugin-loading work by caching parsed manifests and reusing HTTP connections for remote plugin requests. (#49099, #49100)
- Added background reclamation of unused log database space to reduce disk usage. (#49069)
Changelog
Full Changelog: rust-v0.159.0...rust-v0.160.0
- #48983 Avoid full metadata rewrites for thread timestamp updates @jif-oai
- #49000 Isolate the memory startup metadata test from Git enrichment @jif-oai
- #49019 Use a compatible PowerShell fallback for the Windows MXC sandbox @iceweasel-oai
- #49028 Use the numeric ioctl value in the macOS sandbox policy @aionescu-oai
- #49031 Clarify ChatGPT sign-in success copy @bc-openai
- #49032 Avoid SQLite stalls from connection setup and stderr span logging @jif-oai
- #49036 Add opt-in conversation history retrieval to Guardian reviews @felixxia-oai
- #49037 Show the Plan mode cycling hint in the fullscreen status line @fcoury-oai
- #49038 Preserve encrypted agent messages in Guardian reviews @felixxia-oai
- #49041 Copy selections within inline code as plain text @fcoury-oai
- #49043 Update Pro plan display names in the TUI @etraut-openai
- #49057 Add handoff-aware root context for Guardian reviews @jif-oai
- #49058 Fix Windows sandbox ACL repair for long runtime paths @darius-oai
- #49060 Update Guardian messaging snapshots for native agent messages @dkovalenko-oai
- #49065 Update Guardian handoff snapshot for separate agent messages @cassirer-openai
- #49067 Keep configuration values out of Windows sandbox policy events @zm-oai
- #49069 Reclaim unused SQLite log database pages in the background @dkovalenko-oai
- #49073 Surface realtime voice catalog failures in the TUI @etraut-openai
- #49074 Propagate Cargo package versions to Bazel Rust targets @tamird
- #49075 Preserve pending environments when spawning subagents @sayan-oai
- #49076 Avoid collecting unused Git metadata in skill analytics @tamird
- #49079 Update and centralize TUI subscription labels @etraut-openai
- #49082 Skip remote Git discovery for Guardian diff paths @jif-oai
- #49084 Track app-server running turns incrementally @tamird
- #49089 Render follow-up directive labels in the TUI and copied responses @etraut-openai
- #49093 Simplify startup promotions to platform-specific desktop app tips @etraut-openai
- #49096 Update h2 from 0.4.16 to 0.4.19 in Cargo and Bazel lockfiles @cassirer-openai
- #49097 Notify lifecycle extensio

New Features
- Eligible local sessions signed in with ChatGPT can now show optional reminders to complete account security setup. (#49744)
Changelog
Full Changelog: rust-v0.159.2...rust-v0.159.3
- #49744 [0.159] Backport account security setup reminders for 0.159.3 @andrewgu-oai

Bug Fixes
- Suppressed console windows flashing on Windows when Codex launches background processes and sandboxed commands. (#49385)
Changelog
Full Changelog: rust-v0.159.1...rust-v0.159.2
- #49385 [0.159] Backport Windows console suppression for 0.159.2 @andrewgu-oai

New Features
- Added GPT-6.1 Sol as the default model in the bundled catalog and Amazon Bedrock Mantle and Runtime catalogs. (#49323, #49342)
Changelog
Full Changelog: rust-v0.159.0...rust-v0.159.1
- #49323 [0.159] Prepare 0.159.1 release backports @andrewgu-oai
- #49342 [0.159] Backport GPT-6.1 Sol Bedrock catalogs @celia-oai

New Features
- Opt-in instant_interrupt lets new input steer Codex during model responses or long-running code-mode calls. (#48135, #48141)
- New sessions get a compact welcome screen and consistent headers, with occasional tips during and after turns. (#48513, #48562, #48352)
- The warnings viewer dismisses reviewed warnings when closed; press k to keep one for later. (#48205, #48206)
- You can scroll the transcript while deciding whether to implement a plan. (#48805)
- Native Mermaid rendering supports more flowchart edges, labels, and node groups. (#48814, #48895)
- App-server clients can paginate thread history from a specific item. (#48151)
Bug Fixes
- Windows launches avoid stray console windows for MCP servers, code-mode hosts, and piped commands; restrictive launchers can fall back to embedded mode. (#48138, #48238, #48483, #48491)
- Copying transcript selections preserves Markdown tables, formatting, and significant whitespace. More terminals now copy automatically on selection. (#48548, #48549, #48469)
- Blank sessions retain drafts when switching tasks, and threads can be archived and listed before their first turn. (#48628, #48828, #48199)
- Local ChatGPT sign-in opens the browser reliably; onboarding also provides a shortcut to copy the login link. (#48502, #48544)
- Approved commands retain explicit filesystem denials, and .aws directories are protected by default under writable roots. (#48155, #48176)
- Fixed macOS TLS access in network-enabled sandboxes and remote environments that require proxy access. (#48565, #48198)
Chores
- Removed automatic follow-up prompt suggestions and the tui.prompt_suggestions setting. (#48621)
- Removed the bundled plugin-creator skill. (#48604)
Changelog
Full Changelog: rust-v0.158.0...rust-v0.159.0
- #48135 Add opt-in code-mode yielding on new user input @pakrym-oai
- #48138 Suppress console windows when spawning the code-mode host on Windows @zm-oai
- #48141 Preempt model responses when new user input arrives @pakrym-oai
- #48143 Preserve executor MCP credential boundaries across reconnects @rreichel3-oai
- #48151 Add item anchors to thread/items/list pagination @btraut-openai
- #48155 Preserve filesystem denials when preparing approved commands @viyatb-oai
- #48157 Allow Windows daemon launches with residual job membership @etraut-openai
- #48158 Fix Guardian retained context spacing and empty assistant handling @olliem-oai
- #48168 Generate unique exec-server process IDs for every request @sdcoffey
- #48174 Preserve usage limit windows in turn and compaction analytics @rhan-oai
- #48176 Protect .aws directories under sandbox writable roots @jackz100
- #48187 Fix zsh alias quoting in sourced shell snapshots @jif-oai
- #48190 Bound agent message board SSE frames before parsing @jif-oai
- #48197 Optimize blake3 in Bazel fastbuilds @jif-oai
- #48198 Honor execution environment proxy requirements @seanh-oai
- #48199 Keep archived threads with empty previews visible in listings @acrognale-oai
- #48200 Extract Responses header conversion into a shared module @anp-oai
- #48205 Dismiss viewed TUI warnings when closing the viewer @fcoury-oai
- #48206 Add a keep-and-next action to the warnings viewer @fcoury-oai
- #48207 Preserve queued output for observers during code-mode termination @pakrym-oai
- #48211 Keep Codex visible during external editor handoff @etraut-openai
- #48213 Isolate executable fixture copies in CLI tests on Linux @jif-oai
- #48222 Preserve late result metadata for truncated code-mode calls @ningyi-oai
- #48224 Preserve model and access program pairs during compaction @jamy-OAI
- #48229 Extract Responses failure parsing into a dedicated module @anp-oai
- #48238 Suppress console windows for local Windows MCP servers @malsamiri-oai
- #48272 Prevent Windows daemon launches from retaining launcher stdio @zm-oai
- #48318 Keep TUI reconnect attempts running until the shared deadline @etraut-openai
- #48344 Preserve tool metadata for OpenAI provider endpoint overrides @peili

New Features
- Enable tui.prompt_suggestions to get suggested follow-ups after successful turns; press Tab to edit one before sending. (#47911, #47929)
- Configure copy-on-select and right-click paste in the fullscreen TUI. Copied transcript selections now preserve Markdown formatting. (#47639, #47896, #48118)
- Connect to MCP servers that require pre-registered OAuth client secrets, including through codex mcp add --oauth-client-secret. (#47891)
- Secure direct exec-server WebSocket connections with bearer tokens, including connections configured through app-server. (#47601, #47648)
- Image generation and editing can explicitly request transparent backgrounds, and edits now accept file-backed conversation images. (#47484, #47956)
- Terminal input approval is enabled by default for commands running with elevated permissions; runtime-only grants no longer cause unnecessary reviews. (#47799, #48073)
Bug Fixes
- Fixed Windows sandbox failures involving ordinary Windows 10 paths, rejected stored credentials, and large permission policies. (#47672, #47695, #47919)
- Fixed Linux sandbox startup with nested writable roots and preserved Git metadata protections across writable roots on Linux and macOS. (#47623, #47974)
- macOS patch operations now recognize system path aliases covered by existing permissions, avoiding unnecessary approval prompts. (#47879)
- Approval reviews now retry when new user input arrives, so a status question does not automatically abort a pending action. (#47819)
- Mermaid flowcharts now render quoted labels and ampersands; unsupported diagrams explain why they fall back to source. (#47572, #47678)
- Command completion events now include early output and report process-launch failures to clients. (#47529, #47665)
Changelog
Full Changelog: rust-v0.157.0...rust-v0.158.0
- #47441 Use secondary text styling for the transcript footer shortcut hint @etraut-openai
- #47447 Extract WebSocket authentication into codex-websocket-auth @euroelessar
- #47458 Parallelize instruction refresh and tool preparation @hlevy-openai
- #47484 Add explicit background control to image generation @alicec-oai
- #47520 Route session agent operations through AgentControl @jif-oai
- #47529 Emit command lifecycle events for unified exec launch failures @steipete-oai
- #47536 Route agent lookups and V2 context through AgentControl @jif-oai
- #47539 Test interrupted one-shot command launch failure persistence @jif-oai
- #47540 Add an option to disable multi-agent v2 direct messaging @jif-oai
- #47565 Classify rollout read failures by reason and progress @jif-oai
- #47568 Record sandbox backends in command execution analytics @iceweasel-oai
- #47571 Wait for idle before injecting remote compaction test history @felixxia-oai
- #47572 Explain Mermaid rendering fallbacks in the TUI @etraut-openai
- #47582 Retain assistant context for Guardian authorization reviews @felixxia-oai
- #47584 Preserve streamed assistant message order in retained context @felixxia-oai
- #47585 Preserve delivered assistant messages in Guardian retained context @felixxia-oai
- #47589 Keep unfinished link destinations out of rich streaming previews @etraut-openai
- #47590 Serialize numeric custom reasoning effort as JSON numbers @dylan-hurd-oai
- #47591 Stream daemon executable hashing off the async runtime @etraut-openai
- #47596 Refresh realtime context for each model request @reia-oai
- #47597 Guard prerelease channel and canary updates against older versions @imac-oai
- #47601 Add opt-in WebSocket authentication to exec-server @euroelessar
- #47603 Add a reap-only drop policy for child processes @charliemarsh-oai
- #47604 Extend child commands with session and descriptor controls @charliemarsh-oai
- #47605 Route pipe processes through the shared child launcher @charliemarsh-oai
- #47610 Use native POSIX spawning for command hooks @charliemarsh-oai
- #47611 Use the shared process launcher for Unix shell snapshots @charliemarsh-oai
- #47612 Launch Linux pipe processes t

Chores
- Release highlights could not be determined: the supplied PR index is empty, and the GitHub tag comparison returned 404.
Changelog
Full Changelog: rust-v0.157.0...rust-v0.157.1

New Features
- Added GPT-6 Sol and Luna, including Amazon Bedrock support and migration prompts for older models. (#47332, #47347)
- Enabled fullscreen transcripts by default and added Shift-click to extend text selections. (#47178, #47414)
- Enabled automatic background-server startup for eligible interactive sessions, with recovery choices when server settings are incompatible. (#47179, #47318)
- Added an f shortcut to fork conversations open in another app, preserving drafts and queued prompts. (#47185)
- Made /import available in remote sessions and local background-server sessions. (#47317)
- Improved terminal rendering with Unicode bullets, checkboxes, aligned equations, and optimization notation. (#47191, #47322)
Bug Fixes
- Preserved active voice conversations when switching threads. (#47381)
- Recovered unsent question answers into the composer when turns end, without disrupting active history searches. (#47422, #47423)
- Respected tmux mouse settings and restored native scrollback for Terminal.app over SSH in automatic screen mode. (#47399, #47417)
- Fixed configured proxy routing for realtime connections and standalone web search, including search redirects. (#47101, #47142, #47204)
- Added retries for transient file-upload failures and increased the upload timeout to five minutes. (#47122, #47393)
- Enforced network restrictions across redirects and ongoing HTTP and WebSocket traffic, including cancellation when policy changes revoke access. (#47389, #47407)
Changelog
Full Changelog: rust-v0.156.0...rust-v0.157.0
- #47063 Add a partial index for agent message board root posts @jif-oai
- #47064 Stop redundant message-board reads when limits reach one @jif-oai
- #47065 Deduplicate deprecation notices in the TUI transcript @etraut-openai
- #47068 Highlight selected newlines in the transcript view @etraut-openai
- #47073 Wait for thread idle in Guardian context budget tests @jif-oai
- #47074 Refresh host-supplied cloud skills at turn startup @TAFOYA-OAI
- #47075 Include attributed previews in agent message board notifications @jif-oai
- #47077 Serialize environment updates and cancel removed pending attachments @sayan-oai
- #47079 Mask daemon socket paths exposed through ancestor bind mounts @nicksteele-oai
- #47081 Track cumulative MCP attribution across requests and thread history @peilin-openai
- #47082 Show the voice toggle in the TUI shortcut overlay @etraut-openai
- #47083 Extract per-thread enrichment into a dedicated async helper @aibrahim-oai
- #47084 Avoid building a host SQLite driver for SQLx macros @aibrahim-oai
- #47085 Update model catalog descriptions and GPT-5.6-Sol priority @andrewgu-oai
- #47086 Format analytics credit usage with consistent decimal precision @fcoury-oai
- #47088 Disable unused default dependency features @aibrahim-oai
- #47089 Centralize JSON-RPC response serialization through payloads @aibrahim-oai
- #47094 Restrict Unix local MCP servers to stdio descriptors @yuzhu-oai
- #47095 Remove the rust-release-prepare workflow @andrewgu-oai
- #47096 Keep TUI hints immediately above the composer @fcoury-oai
- #47100 Preserve assistant answers in bounded TUI task responses @etraut-openai
- #47101 Honor configured proxies for realtime WebSocket connections @celia-oai
- #47106 Preserve originating turn metadata for yielded skill calls @eddie-openai
- #47108 Preserve required Windows runtime variables for filesystem helpers @iceweasel-oai
- #47112 Lowercase the retry hint for conversations open in another app @fcoury-oai
- #47113 Persist thread creator identity in rollouts and SQLite @nornagon-openai
- #47114 Preserve and expose thread item lifecycle timestamps @chiam-oai
- #47116 Honor the configured product SKU in remote plugin requests @jessedu-oai
- #47118 Support model-catalog overrides for Code Mode tool messages @rhan-oai
- #47121 Pass thread IDs to attachment uploads @kchainani-oai
- #47122 Increase OpenAI file blob upload timeout from 60 seconds to 5 minutes @wilkes-oai
- #47125 Add ext

New Features
- Choose GPT-6 Sol or GPT-6 Luna from the model picker. The rate-limit switch prompt now recommends GPT-6 Luna. (#47405)
Changelog
Full Changelog: rust-v0.156.0...rust-v0.156.1
- #47405 [hotfix 0.156.0] Add GPT-6 Sol and Luna to the model catalog (#47332) @imac-oai

New Features
- Choose an optional fullscreen UI with /tui for your next launch, including transcript search, mouse selection, and right-click copying. (#46732, #46734, #46883, #46895)
- Voice conversations are enabled by default, with an F8 toggle, a /voice settings picker, and bundled audio runtimes for Linux and Windows. (#44921, #46071, #44622, #44714, #44922)
- Explore account usage, token totals, and plugin and skill activity through the /usage analytics dashboard. (#45764, #45769)
- Filter tasks by status and create worktree sessions from the agent command center; worktree support is now enabled by default. (#46839, #45276, #44870)
- Customize the terminal with six new themes and view supported Mermaid diagrams and display equations directly in responses. (#46504, #46054, #45612)
- Update the local background server through /daemon, or bypass it with --no-daemon. (#45854, #46088)
Bug Fixes
- Preserve streamed answers and plans when turns fail, are interrupted, or receive subagent completion events. (#45549, #46867)
- Fix clipboard forwarding in tmux and SSH sessions and preserve tab indentation when terminals send pasted text as individual keystrokes. (#45457, #45454)
- Restore Plan mode when resuming sessions and preserve thread identity and settings when editing earlier prompts. (#45519, #45845)
- Recover login through system proxies and refresh MCP credentials when OAuth discovery returns a 503 error. (#46562, #44636)
- Prevent speech from being dropped during playback pauses or bursts of incoming audio. (#46880)
- Close sandbox isolation gaps involving inbound Windows connections, privileged Linux/macOS sockets, and writes through read-only macOS file handles. (#44639, #45984, #46500)
Documentation
- Clarify that deprecated friendly and pragmatic personality settings no longer select response styles. (#45809)
- Explain how ? matches a single character in network proxy allow and deny patterns. (#46027)
Chores
- Update bundled TLS dependencies, including OpenSSL 3.6.4 for Linux musl builds. (#45149, #45489)
Changelog
Full Changelog: rust-v0.155.0...rust-v0.156.0
- #44606 Preserve whole diagnostic attachments and report incomplete uploads @chess-oai
- #44611 Preserve root turn attribution in turn-start events @owenlin0
- #44613 Enable user verification for local Codex Desktop sessions @riley-oai
- #44615 Treat non-interactive dumb terminals as warnings in codex doctor @etraut-openai
- #44616 Simplify enterprise OAuth login helpers and expand callback tests @nicksteele-oai
- #44617 Invalidate cached Guardian approvals for unscored permission widening @jif-oai
- #44619 Allow discarded code mode tool responses to be garbage collected @jif-oai
- #44620 Support temporary and minimal filesystem grants in MXC @iceweasel-oai
- #44622 Add /voice settings to choose a voice for future conversations @bc-openai
- #44626 Add bounded environment transport for MXC launch requests @iceweasel-oai
- #44628 Expose session analytics state in Responses turn metadata @marksteinbrick-oai
- #44629 Add manual callback input to MCP OAuth login @willwang-openai
- #44631 Focus the task list when reopening the agent command center @etraut-openai
- #44636 Recover OAuth metadata discovery from 503 responses via OIDC @malsamiri-oai
- #44639 Block non-loopback inbound traffic for the Windows offline sandbox @viyatb-oai
- #44646 Honor thread analytics opt-outs when using shared clients @priyanshusingh-de
- #44650 Enforce managed model provider selection and definitions @alexsong-oai
- #44651 Keep command center errors visible and preserve drafts @etraut-openai
- #44654 Preserve missing environment variable diagnostics in Codex Doctor @etraut-openai
- #44655 Honor thread-level plugin exclusions across runtime capabilities @mzeng-openai
- #44656 Attribute turn metrics to the models used during the turn @eternal-openai
- #44658 Keep Windows sandbox private desktops alive across helper exits @chess-oai
- #44659 Preserve turn triggers across delegated agent w

New Features
- Vim mode supports / and ? searches within drafts, highlighted matches, and repeat navigation with n and N. (#41586)
- Rate-limit banners offer actions for checking usage, managing credits, resetting limits, and managing plans. (#41742)
- The terminal UI and codex exec show credential-refresh progress, including Amazon Bedrock reauthentication. (#41239)
- MCP server names can contain :, @, /, and ., supporting package-style names throughout CLI commands and authentication. (#41700)
- Individual MCP tools support an output_token_limit setting, with consistent truncation across session resumes. (#41421)
- App-server clients can configure thread/shellCommand timeouts, including deadlines longer than one hour. (#41384)
Bug Fixes
- Automatic approval reviews preserve user instructions, answers, and valid authorizations across history compaction. (#41660, #41846, #41852)
- Resumed threads restore their saved working directory when none is supplied, and client metadata updates preserve filesystem permissions. (#41567, #41464)
- MCP tools remain available through cache refreshes and remote plugin changes; authentication retries use refreshed helper-provided headers. (#41336, #41344, #41396, #41400)
- Opening the model picker refreshes available models without losing the highlighted choice. (#41467)
- Fixed Windows sandbox execution with Microsoft Store PowerShell, subprocess hangs on terminal queries, and cursor-related display corruption in older JediTerm terminals. (#41227, #41436, #41673)
- Cloud task requests reject untrusted backend URLs and disable redirects to protect saved credentials. (#41403)
Chores
- The planning tool is disabled by default; enable it with tools.update_plan.enabled = true. (#41744)
- Plugin recommendations begin loading during startup, reducing delays before the first turn. (#41375)
Changelog
Full Changelog: rust-v0.151.0...rust-v0.152.0
- #41210 Enable clock tools from model metadata @copyberry
- #41215 Roll over Guardian context before follow-up reviews @copyberry
- #41218 Share linked tool mention parsing in the TUI @copyberry
- #41219 Retry confirmed remote registration conflicts @copyberry
- #41221 Honor turn token budgets in Guardian review rollover @copyberry
- #41223 Add recency sorting to project/list @copyberry
- #41226 Move Guardian review session tests to a separate file @copyberry
- #41227 Use compatible PowerShell for elevated Windows sandbox commands @copyberry
- #41230 Apply app routing policy to unauthenticated plugin reads @copyberry
- #41231 Instrument the loaded plugin cache @copyberry
- #41232 Expose the PowerShell version in environment context @copyberry
- #41235 Sanitize history notes backend errors @copyberry
- #41239 Surface model provider authentication recovery progress @copyberry
- #41243 Add configurable gating for the sleep tool @copyberry
- #41250 Include thread source in realtime connection metadata @copyberry
- #41260 Let the history backend enforce tool output budgets @copyberry
- #41285 Drive keymap conflict checks from the action registry @copyberry
- #41292 Forward history note images to the model @copyberry
- #41308 Make subagents follow the root service tier @copyberry
- #41309 Honor required reviews when reusing Guardian scores @copyberry
- #41313 Decouple HTTP retry backoff from overload integration testing @copyberry
- #41322 Isolate required-model Guardian approval coverage @copyberry
- #41328 Review terminal input against retained permissions @copyberry
- #41331 Classify clock tools as built-in control tools @copyberry
- #41336 Preserve cached MCP tools during binding capture @copyberry
- #41344 Use refreshed MCP tool caches during binding capture @copyberry
- #41349 Assign stable IDs to generated Responses input items @copyberry
- #41354 Reject NUL bytes in reviewed terminal input @copyberry
- #41357 Support compression for shared rollout lineages @copyberry
- #41360 Measure Codex home usage at app-server startup @copyberry
- #41364 Test resuming c

New Features
- Added a configurable grace period for discovering tools from optional MCP servers. (#41199)
- Extensions can now inspect or replace MCP tool results before they reach the model. (#41202)
- Plugin catalogs now combine per-repository configuration and report invalid project marketplaces without hiding valid plugins. (#41208)
Bug Fixes
- Preserved restored permission profiles across TUI turns and prevented /cd from weakening sandbox restrictions. (#41192)
- Kept tool availability and reasoning effort correct when switching models or falling back to another model. (#41195, #41206)
- Improved remote sandbox enforcement using the executor’s actual home directory, operating system, and path conventions. (#41196, #41204, #41207, #41209)
- Preserved structured MCP tool and resource errors in app-server responses. (#41196)
- Counted nested subagent token usage toward root goal budgets. (#41183)
- Prevented stale Guardian classifications from authorizing actions after permission state changes. (#41196)
Chores
- Added telemetry for escalated stdin reviews and remote executor MCP discovery. (#41189, #41205)
- Stabilized Guardian WebSocket and core fixture tests under slow or highly concurrent CI. (#41191, #41194)
Changelog
Full Changelog: rust-v0.150.0...rust-v0.151.0
- #41183 Account subagent token usage toward root goals @copyberry
- #41189 Instrument stdin review size checks @copyberry
- #41191 Stabilize Guardian WebSocket tests @copyberry
- #41192 Preserve restored permission profiles in TUI sessions @copyberry
- #41193 Report affected capabilities from remote plugin syncs @copyberry
- #41194 Harden core test fixture startup assertions @copyberry
- #41195 Finalize model-specific tool plans in ToolRouter @copyberry
- #41196 Improve sandboxing, MCP errors, and cached approvals @copyberry
- #41199 Make the optional MCP startup grace configurable @copyberry
- #41202 Let extensions process MCP tool results @copyberry
- #41204 Propagate executor home directories into sandbox contexts @copyberry
- #41205 Track executor MCP discovery telemetry @copyberry
- #41206 Make Ultra reasoning fallback model-aware @copyberry
- #41207 Propagate executor OS into turn environments @copyberry
- #41208 Honor per-repository plugin configuration in catalog requests @copyberry
- #41209 Align deny-read matching with executor path semantics @copyberry

Bug Fixes
- Remote compaction now counts retained images toward its token budget by default, trimming older images as needed. (#41003)
Changelog
Full Changelog: rust-v0.150.0...rust-v0.150.1
- #41003 Backport retained-image compaction budgeting to 0.150 @rhan-oai

New Features
- Reference other Codex tasks with @ mentions, and ask agents to read, create, or message tasks from the terminal. (#40308, #40315)
- /copy now offers a picker for full responses, individual code blocks, and blockquotes. (#39997)
- Threads receive descriptive titles automatically, and /rename suggests an editable title based on the conversation. (#40492, #40495)
- Markdown links appear as clickable labels in supported terminals, with visible URLs retained elsewhere. (#40471)
- Bind shortcuts to cycle permission modes, and use . in Vim mode to repeat your last edit. (#39873, #40521)
- New Interrupt hooks can run commands or MCP handlers when an active turn is interrupted. (#40511)
Bug Fixes
- Untrusted projects no longer supply project-level AGENTS.md instructions, and managed deny-read rules remain enforced after permission changes. (#39837, #40004)
- Provider credentials and authentication tokens are now redacted from app-server diagnostic logs. (#39993)
- Fixed remote MCP bearer-token lookup and required-server startup while preserving compatibility with older executors. (#39926, #39952, #39979)
- Fixed elevated Windows sandbox setup and launch aliases under Unicode user paths. (#39971, #40570)
- Prevented Unix shutdown hangs caused by detached processes retaining a terminal or full terminal output buffers. (#40460)
- Fixed conversation compaction and multi-agent compatibility for Amazon Bedrock models. (#39804, #39825)
Changelog
Full Changelog: rust-v0.149.0...rust-v0.150.0
- #39667 Trace MCP runtime refresh coordination @copyberry
- #39691 Make Guardian v2 parent compaction reuse configurable @copyberry
- #39700 Fail closed on unsafe config and sed parsing @copyberry
- #39702 Wait for turn completion events in multi-agent resume tests @copyberry
- #39703 Move the global scope check into the code-mode runtime @copyberry
- #39706 Harden Seatbelt writable root path binding @copyberry
- #39707 Remove redundant code mode image helper test @copyberry
- #39709 Log TUI app event variants without their payloads @copyberry
- #39712 Reduce unified exec output buffer allocations @copyberry
- #39717 Pass CI workflow inputs through environment variables @copyberry
- #39719 Stop persisting checkout credentials in V8 workflows @copyberry
- #39720 Expose managed policy for browser settings imports @copyberry
- #39722 Track multi-agent v2 spawn calls in analytics @copyberry
- #39726 Box the WebSocket dial future @copyberry
- #39731 Avoid rollout reads for configured TUI sessions @copyberry
- #39736 Remove private executor directory creation @copyberry
- #39738 Honor Guardian runtime settings from model defaults @copyberry
- #39741 Use model-specific auto-review outcome instructions @copyberry
- #39744 Skip postprocessing for short composer input @copyberry
- #39746 Refresh resumed thread capability roots from executors @copyberry
- #39749 Require filesystem backends to implement directory walks @copyberry
- #39752 Expose uncompiled permission profile selection @copyberry
- #39755 Add managed developer instructions to requirements @copyberry
- #39756 Cache shell snapshots in the exec server @copyberry
- #39757 Standardize shell execution on unified exec @copyberry
- #39761 Add app-server MCP event streaming @copyberry
- #39765 Include suggestion IDs in plugin install metadata @copyberry
- #39770 Refresh bundled model definitions @copyberry
- #39772 Standardize shell execution on unified exec @copyberry
- #39776 Verify Codex app signatures before launch or install @copyberry
- #39777 Retry transient registry failures during initial exec connection @copyberry
- #39779 Make tool-result telemetry limits configurable @copyberry
- #39782 Support standalone named function call outputs @copyberry
- #39784 Classify rollout migration failures @copyberry
- #39785 Support turn cost telemetry for custom model providers @copyberry
- #39786 Support host-accepted exec-server WebSockets @copyberry
- #39790 Deduplicate zsh fork test setup @copybe

Changelog
Full Changelog: rust-v0.149.0...rust-v0.149.1

New Features
- Added an interactive codex agents dashboard for searching, starting, opening, renaming, and stopping tasks, with configurable shortcuts. (#39094, #39112, #39114, #39142)
- Added /cd, /pwd, and /cwd commands for managing the working directory in TUI sessions. (#38894)
- Added codex queue for sending messages to existing local or remote sessions. (#39092)
- Expanded Vim editing with character replacement and more change motions such as cw, c$, and cc. (#39661)
- codex doctor now diagnoses endpoint protection, network/proxy failures, desktop app state, and update connectivity. (#38827, #38918, #39060, #39074)
- SDK users can now pass exact CLI config overrides and select max or ultra reasoning effort. (#38817, #39662)
Bug Fixes
- Queued messages now wake idle sessions reliably, resolve duplicate session names more usefully, and preserve pasted or deferred command semantics. (#39034, #39385, #39604)
- Resumed and forked threads now restore their active permission profile instead of silently falling back to current defaults. (#39153)
- Fixed duplicate sub-agent activity and tightened TUI routing for sub-agent notifications and approvals. (#39049, #39088)
- Realtime WebRTC sideband connections now reconnect after unexpected transport loss without dropping pending output. (#39257)
- Inline TUI history now remains available in Windows Terminal scrollback. (#39619)
- Inactive TUI thread replay buffers are now bounded to prevent excessive retained streamed output. (#39081)
Documentation
- Clarified that external contributions should go through issues and design discussion rather than pull requests. (#39089)
- Documented DNS exfiltration risks and trust limitations for secure devcontainers. (#39283)
Changelog
Full Changelog: rust-v0.148.0...rust-v0.149.0
- #38817 Add raw config overrides to the TypeScript SDK @copyberry
- #38819 Support metadata staging for reserved thread IDs @copyberry
- #38822 Avoid cloning TUI history span content @copyberry
- #38823 Avoid allocating per character when decorating hyperlinks @copyberry
- #38827 Add endpoint protection checks to codex doctor @copyberry
- #38830 Isolate external editor buffers from sandbox-writable paths @copyberry
- #38837 Share editor keymaps across TUI composer components @copyberry
- #38840 Identify Mac mini hosts in remote control handshakes @copyberry
- #38893 Restore thread timestamp maxima independently @copyberry
- #38894 Add working-directory commands to the TUI @copyberry
- #38899 Move requirements policy ownership to execpolicy @copyberry
- #38902 Honor per-environment shell variable policies @copyberry
- #38907 Edit queued messages with Vim history-up @copyberry
- #38913 Stop rendering columns after filling their area @copyberry
- #38916 Honor legacy :project_roots permission entries @copyberry
- #38918 Improve codex doctor network diagnostics @copyberry
- #38919 Reject obsolete app-server permission profile fields @copyberry
- #38921 Compact successful command activity in the TUI @copyberry
- #38940 Add experimental app-server project APIs @copyberry
- #38941 Prevent Noise auth tokens from reaching child processes @copyberry
- #38942 Enforce environment-specific command policies @copyberry
- #38947 Stop loading legacy managed config on Windows @copyberry
- #38978 Add a configurable skill catalog token budget @copyberry
- #38980 Bound Guardian v2 parent compaction context @copyberry
- #38987 Include images in Guardian v2 transcripts @copyberry
- #38990 Source Guardian v2 defaults from the model catalog @copyberry
- #38993 Evaluate recent and character-routed skill selection @copyberry
- #38994 Remove the workspace settings gate for apps and plugins @copyberry
- #38997 Retry transient Guardian sampling failures @copyberry
- #39001 Ignore stale Guardian tool risk scores @copyberry
- #39005 Disable Guardian V2 for managed automatic reviewers @copyberry
- #39006 Emit API-key turn cost telemetry from app-server @copyberry
- #39007 Wait for Guardian score progress 

New Features
- Export complete TUI conversations to Markdown with /export, either to the clipboard or a new file. (#37358)
- Fork sessions with codex exec fork, and archive or restore sessions from the TUI resume picker. (#37367, #37369, #37371)
- Draft prompts while the TUI initializes, with resume and fork progress shown during startup. (#38642, #38788)
- View estimated thread credits or cost in /status, status lines, and terminal titles for eligible workspaces. (#38281, #38282)
- Use Amazon Bedrock Runtime as a built-in provider with AWS profile, region, and GPT-5.6 routing support. (#38470)
- Hooks can now run commands asynchronously and invoke MCP tools. (#37533, #38705)
Bug Fixes
- Model switches and settings updates no longer leave stale instructions behind or change an active turn midstream. (#37260, #38785)
- Resumed sessions now restore their persisted working directory and approval policy, with more accurate transcript previews. (#37198, #37368, #38605)
- Turns reconnect through temporary provider outages, and MCP servers recover after OAuth reauthentication without restarting Codex. (#37337, #37485, #38418)
- TUI startup no longer lets buffered terminal input activate prompts accidentally, and onboarding appears when authentication is missing. (#38641, #38643, #38644)
- Composer and transcript rendering now handle CRLF pastes, wrapped whitespace, and long URLs correctly. (#37709, #38380, #38704)
- Sandbox restrictions now fail closed for denied or unreadable paths across Linux and Windows. (#37875, #38026, #38416, #38660)
Documentation
- The bundled skill-creator guide is more focused, and validation now rejects unfinished TODO placeholders. (#38384)
Changelog
Full Changelog: rust-v0.147.0...rust-v0.148.0
- #37190 Interrupt cyber model turns after one Guardian denial @copyberry
- #37191 Preserve legacy semantics during rollout migration @copyberry
- #37198 Prefer persisted cwd when reading local threads @copyberry
- #37199 Track thread archive analytics @copyberry
- #37204 Add durable user-message queue dispatch @copyberry
- #37206 Add a unified image budget @copyberry
- #37210 Fetch remote installed plugins across all scopes @copyberry
- #37211 Harden network proxy MITM authorization @copyberry
- #37248 Cover remote MCP discovery timeout cleanup @copyberry
- #37252 Allow agent roles on full-history forks @copyberry
- #37260 Fix first-turn model switching and rollback @copyberry
- #37261 Start cached MCP servers lazily for subagents @copyberry
- #37267 Support plugin roots in the host skill loader @copyberry
- #37273 Reuse MCP handlers across sampling steps @copyberry
- #37279 Avoid cloning immutable metadata on tool search cache hits @copyberry
- #37335 Fully repaint inline viewports after history overlap @copyberry
- #37336 Use step environments for extension turn input @copyberry
- #37337 Recover MCP servers after OAuth reauthentication @copyberry
- #37338 Honor the configured ChatGPT origin in connector install URLs @copyberry
- #37339 Reload app-server telemetry after account changes @copyberry
- #37340 Consolidate deferred environment provisioning APIs @copyberry
- #37341 Support content references for inline visualizations @copyberry
- #37342 Preserve foreign cwd URIs for turn-input contributors @copyberry
- #37343 Stage Bazel app-server test binaries in TEST_TMPDIR @copyberry
- #37344 Fix subagent MCP startup status settling @copyberry
- #37345 Send model routing hints to the Codex backend @copyberry
- #37347 Track context windows per agent @copyberry
- #37348 Add rollout migration tooling and background migration @copyberry
- #37349 Mount a minimal /dev in full-filesystem Bubblewrap sandboxes @copyberry
- #37350 Allow ThreadManager to customize thread ID generation @copyberry
- #37352 Configure the default code-mode exec yield timeout @copyberry
- #37354 Retry busy app-server test executable spawns @copyberry
- #37356 Support agent identity endpoint overrides @copyberry
- #37357 Clamp short wait_agent time

Bug Fixes
- Apply safer automatic-review defaults for cyber-capable models and explain permission changes in the terminal interface. (#37057)
Changelog
Full Changelog: rust-v0.146.0...rust-v0.146.1
- #37057 [0.146] Backport safer cyber-model auto-review defaults @anp-oai

New Features
- Name new sessions with /new or /clear, pin important threads, and switch between side conversations without closing them. (#34605, #34840, #35011)
- Support Agent Plugins manifests, workspace plugin publishing, and additional plugin marketplaces for Amazon Bedrock and Claude Code. (#35105, #35254, #34931, #34979)
- Fork threads with paginated history, including temporary forks that do not appear in thread listings. (#35220, #35251)
- Connect app-server to remote Code Mode hosts over WebSocket. (#35078, #35098)
- Enable standalone web search for compatible custom model providers. (#34846)
- Discover executor-provided skills and securely read their associated resources, including explicitly selected skills. (#35184, #35198)
Bug Fixes
- Honor configured proxies across authentication, plugin downloads, MCP authorization, remote execution, WebSockets, redirects, and LM Studio connections. (#34479, #34509, #34655, #34678, #35023, #35056, #35239)
- Keep MCP connections and Apps tools current when authentication or configuration changes, reconnecting closed servers without restarting healthy connections. (#34952, #34957, #35028, #35144, #35146, #35151)
- Preserve submitted messages, final responses, failed-turn errors, imported timestamps, and approval settings across interruptions, replay, imports, and forks. (#34839, #34777, #35524, #34989, #34664)
- Improve terminal responsiveness and rendering, including nonblocking interrupts, keyboard handling, narrow layouts, hyperlinks, and refreshed mention results. (#35000, #35021, #34775, #34778, #35365, #35375)
- Fix Windows navigation keys, reliably terminate sandboxed process trees, and preserve proxy settings during security reviews. (#34625, #34624, #35036)
- Retain more available skills under tight context budgets and warn when skill catalogs must be truncated. (#34732, #34738, #34997)
Documentation
- Document shared HTTP-client usage, proxy-aware connection pooling, and safe outbound request handling. (#34669)
- Clarify Windows drive-letter canonicalization for PathUri values. (#34667)
Chores
- Publish release artifacts, channel metadata, and installer aliases through OpenAI-hosted release infrastructure, with GitHub fallback. (#34505, #34508, #34729, #34910)
- Sign and notarize bundled macOS helper executables before packaging. (#35264)
- Reduce app-server serialization overhead and unnecessary request-building allocations. (#34761, #34766, #34825)
- Add enterprise-plan recognition and administrator controls for in-app updates. (#35238, #35537)
Changelog
Full Changelog: rust-v0.145.0...rust-v0.146.0
- #34447 Add a route-aware HTTP client pool @copyberry
- #34449 Make external session detection limits configurable @copyberry
- #34451 Attribute external agent imports by provider @copyberry
- #34463 Support alpha hotfix release versions @copyberry
- #34469 Preserve thread settings for goal-first and forked threads @copyberry
- #34476 Separate HTTP execution from request logging @copyberry
- #34478 Honor CARGO_HTTP_CAINFO in managed proxy environments @copyberry
- #34479 Re-resolve system proxy routes across redirects @copyberry
- #34481 Add route-aware redirect test coverage @copyberry
- #34483 Expand route-aware proxy redirect coverage @copyberry
- #34490 Route backend requests through the HTTP client factory @copyberry
- #34491 Route cloud environment discovery through the HTTP client pool @copyberry
- #34495 Honor system proxy settings in the daemon updater @copyberry
- #34497 Preserve custom arg0 for sandboxed exec-server processes @copyberry
- #34505 Mirror Rust release artifacts to Cloudflare R2 @copyberry
- #34506 Respect system proxies during plugin startup sync @copyberry
- #34508 Publish release metadata to R2 channels @copyberry
- #34509 Honor system proxy settings for remote plugins @copyberry
- #34514 Add an optional releases.openai.com installer source @copyberry
- #34516 Allow numer in codespell checks @copyberry
- #34517 Pass empty inherited FDs in the Wi

New Features
- Added experimental paginated thread history with efficient resume, search, persisted names, sub-agent support, and memories. (#33364, #33907, #34085, #34229, #34386)
- Expanded /import to migrate Cursor and Claude Code settings, MCP servers, plugins, sessions, commands, and project-scoped memories. (#31672, #33411, #33426, #33444)
- Added experimental Amazon Bedrock login, custom endpoint and authentication support, and GPT-5.6 Sol as the default Bedrock model. (#31327, #33170, #33175, #32288, #33695)
- Added audio inputs and tool outputs, including common local audio formats, and introduced streaming realtime V3 conversations. (#33261, #33856, #33932, #34080, #34385)
- Stabilized the opt-in multi-agent V2 experience with configurable sub-agent models, reasoning levels, concurrency, restored roles, and improved agent navigation. (#33550, #33631, #33657, #33841, #34383)
- Added secure, clickable inline visualization links in the terminal UI. (#33925, #34217, #34346)
Bug Fixes
- Editing an earlier prompt or retrying a safety-buffered turn now creates a contextual branch, preserving the original conversation, attachments, and mention bindings. (#33201, #33207, #33211)
- Improved terminal responsiveness for long conversations and streamed output through incremental Markdown rendering, fewer redraws, caching, and bounded command output. (#34045, #34049, #34216, #34223, #34359)
- Prevented slow or conflicting MCP startup and authentication flows by enforcing startup timeouts, avoiding blocking OAuth discovery, serializing refreshes, and reusing tool catalogs safely. (#32229, #32781, #32825, #33184, #33297)
- Improved Windows execution and sandbox reliability, including native exec-server sandboxing, network-proxy enforcement, hidden helper consoles, and correctly quoted hook commands. (#32849, #32857, #33926, #34423)
- Fixed compact release-metadata parsing and macOS code-mode installation, with an in-process fallback when the external code-mode host is unavailable. (#31667, #31876, #31899)
- Strengthened safety and approval handling with better forced-rm detection, consistent full-access confirmation, and preserved rejection reasons across tools. (#32989, #33464, #34400)
Documentation
- Updated the bundled OpenAI Docs skill with current GPT-5.6 model resolution, prompting, and migration guidance across macOS, Linux, and Windows. (#31842, #33121)
Chores
- Migrated bundled GPT-5.4 selections and internal uses to the corresponding GPT-5.6 Terra and Luna variants. (#33173)
- Reduced startup and large-context overhead with concurrent skill/plugin discovery and more efficient remote compaction. (#31566, #33369, #33423, #34431)
- Updated the packaged ripgrep binary to 15.2.0. (#34384)
Changelog
Full Changelog: rust-v0.144.0...rust-v0.145.0
- #31667 fix: parse compact release metadata in installer @efrazer-oai
- #31362 core: route realtime and memories through HTTP client factory @bolinfest
- #31566 perf(skills): reuse walk inventory for host loading @jif-oai
- #31576 Bound exec-server process event reordering @jif-oai
- #31756 test(skills): assert symlinked metadata loading @jif-oai
- #31581 Resolve selected capability roots without starting executors @jif-oai
- #31789 Stop persisting RMCP service traces @jif-oai
- #31792 Summarize streamed response item logs @jif-oai
- #31791 Filter routine Hyper logs from SQLite @jif-oai
- #31790 Reduce MCP tool-list trace volume @jif-oai
- #31804 Stabilize the memories feature flag @jif-oai
- #31803 fix(mcp): default Apps product SKU to codex @alecbarber-oai
- #31745 code-mode: retain shared MCP types for deferred tools @sayan-oai
- #31672 Import enabled plugins from known marketplaces @charlesgong-openai
- #31652 fix(tui): hide empty reasoning summaries @fcoury-oai
- #31767 Remove the network proxy config wrapper @jif-oai
- #31481 fix: forward originator to Codex Apps MCP @raquel-openai
- #31363 codex-api: route file uploads through HTTP client factory @bolinfest
- #31813 tui: update sa

Bug Fixes
- Refreshed bundled instructions for GPT-5.6 Sol, Terra, and Luna, and corrected their context windows to 272,000 tokens. (#33972, #34009)
Changelog
Full Changelog: rust-v0.144.5...rust-v0.144.6
- #33972 Backport refreshed bundled model metadata to 0.144 @sayan-oai
- #34009 Narrow 0.144 hotfix to GPT-5.6 prompts and context @sayan-oai

Bug Fixes
- Improved dangerous-command detection, including more forced rm forms, and provides clearer rejection reasons when commands are denied. (#33455)
Changelog
Full Changelog: rust-v0.144.4...rust-v0.144.5
- #33455 [release/0.144] fix(core) expand is_dangerous_command @dylan-hurd-oai

Chores
- No user-facing changes in this patch release.
Changelog
Full Changelog: rust-v0.144.3...rust-v0.144.4

Chores
- Published a version-only release with no merged pull request changes since rust-v0.144.2.
Changelog
Full Changelog: rust-v0.144.2...rust-v0.144.3

Bug Fixes
- Restored the previous Guardian auto-review policy, request format, and tool behavior after rolling back a prompting regression. (#32672)
Changelog
Full Changelog: rust-v0.144.1...rust-v0.144.2
- #32672 [release/0.144] Revert "Update auto review prompting" @dylan-hurd-oai

Bug Fixes
- Fixed standalone installs failing when GitHub returns compact or reordered release metadata. (#31913)
- Ensured macOS package installs expose the code-mode host alongside the codex executable. (#31913)
- Kept code mode working when the companion host binary is unavailable by falling back to the embedded runtime. (#31913)
Changelog
Full Changelog: rust-v0.144.0...rust-v0.144.1
- #31913 [0.144] Backport installer and code-mode reliability fixes @bolinfest

New Features
- Usage-limit reset credits now show their type and expiration, and let you choose which credit to redeem. (#30488)
- Added a writes app-approval mode that allows declared read-only actions while prompting for writes. (#30482)
- MCP tools can now request authentication interactively without an experimental opt-in. (#28772)
- App-server hosts can provide Codex authentication at runtime and redirect successful logins to a hosted page. (#28745, #31274)
- Global pnunen installs are now detected so diagnostics and updates use the correct package manager. (#31503)
- Selecting Ultra reasoning now warns when high multi-agent concurrency could increase usage quickly. (#31621)
Bug Fixes
- Resumed ChatGPT threads recover when compaction references a retired model by retrying with the currently selected model. (#30319)
- Fixed Code Mode crashes in Intel macOS release binaries. (#30953)
- Windows sandbox sessions can delete files in writable roots and access the managed primary runtime. (#31138, #31574)
- Pasted terminal control sequences can no longer corrupt TUI rendering or resumed conversation history. (#31494)
- Long-running app sessions now refresh expired authentication for the hosted codex_apps connector. (#31486)
- Responses WebSockets continue using the low-latency transport while respecting system proxies and custom certificate authorities. (#31441, #31622)
Documentation
- Device-code login warnings now explain how to recognize and stop phishing attempts. (#31648)
Chores
- Reduced plugin skill-loading time on remote executors by resolving namespaces once per root. (#31348)
- Made the /review branch picker faster and more reliable in large repositories. (#31464)
- Improved automatic review behavior with clearer instructions and a focused tool set. (#31480)
- Made Amazon Bedrock model names clearly identify their GPT-5.6 family and variant. (#31636)
Changelog
Full Changelog: rust-v0.143.0...rust-v0.144.0
- #30292 Serialize shared MCP OAuth credential stores @stevenlee-oai
- #30488 [codex-cli] Show reset details in redemption picker @jayp-oai
- #31297 feat(core): emit canonical command execution items @owenlin0
- #31298 feat(core): emit canonical dynamic tool call items @owenlin0
- #31369 test(skills): cover plugin namespace loading @anp-oai
- #30953 fix(release): add missing Intel V8 signing entitlement @malsamiri-oai
- #31355 refactor: make ExternalAuth return CodexAuth @lt-oai
- #31352 ci: increase Windows Bazel local test jobs @anp-oai
- #30482 [codex-rs] Add writes app approval mode @zamoshchin-openai
- #31439 Handle bio policy errors in Codex @fc-oai
- #31319 [codex] add connector runtime latency metrics @mzeng-openai
- #31312 Use model catalog approval messages @dylan-hurd-oai
- #31422 test: generalize exec-server fixture @anp-oai
- #28772 [codex] Enable auth elicitation by default @mzeng-openai
- #28745 [login] support hosted success redirects @rafael-jac
- #31316 chore: extract remote compaction request attempts @celia-oai
- #31299 feat(core): emit canonical sub-agent activity items @owenlin0
- #31285 [1/5] [codex] sync managed-layer bundle schema @hefuc-oai
- #31300 feat(core): emit canonical collab tool call items @owenlin0
- #31301 feat(core): emit canonical collab wait items @owenlin0
- #30319 fix: retry rejected previous-model compaction with selected model @celia-oai
- #30879 Handle mixed-case URLs in Windows command safety @charliemarsh-oai
- #31191 Handle completion separators and popup dismissal @charliemarsh-oai
- #31425 test: add TestAppServer builder @anp-oai
- #31342 http-client: expose WebSocket proxy prerequisites @bolinfest
- #31348 perf(skills): resolve plugin namespaces per root @anp-oai
- #31289 Use canonical indexed web access field @winston-openai
- #31464 Speed up review branch picker via for-each-ref @charliemarsh-oai
- #31332 ci: parameterize Cargo target paths @anp-oai
- #31421 refactor: unify external auth resolution @pakrym-oai
- #31451 test: migrate TestAppServer callers to builder 

New Features
- Remote plugins are now enabled by default, with richer catalog rows, npm marketplace sources, and visible remote/local versions. (#30297, #26705, #29375, #30981)
- Codex can route authentication and Responses API traffic through macOS and Windows system proxies, including PAC and WPAD configurations. (#26708, #26709, #31335)
- Added codex remote-control pair for generating manual pairing codes from a running daemon. (#29913)
- Added Amazon Bedrock GPT-5.6 Sol, Terra, and Luna models, with first-class support for max reasoning effort. (#30285, #30467)
- MCP tools now use tool search by default, and ChatGPT-hosted MCP servers can explicitly use session authentication. (#29486, #29733)
- App-server clients can inspect environments, list descendant threads, and fork history through a specific turn. (#30291, #29591, #30277)
Bug Fixes
- Fixed Windows ConPTY input handling for line endings and backspace, plus sandbox credential retry edge cases. (#29734, #29624, #29637)
- Fixed stale TUI safety prompts and cancelled reviews that could leave MCP startup appearing busy. (#30490, #31189)
- Improved recovery when exec servers are temporarily offline and prevented remote-control token refresh retry storms. (#30098, #30201)
- Preserved trailing realtime transcript text and terminal rollout events during shutdown. (#29918, #30144)
- Improved incremental WebSocket request success by ignoring response metadata during comparisons. (#30770)
- Reduced installer failures from GitHub API rate limits by reusing release metadata. (#31056)
Documentation
- Documented UUID7 thread and turn IDs, plus recommended remote-executor integration-test workflows. (#27714, #29790)
Chores
- Updated OpenSSL, Hono, fast-uri, quick-xml, and crossbeam-epoch to address security advisories. (#29487, #29650, #30941, #31308)
Changelog
Full Changelog: rust-v0.142.0...rust-v0.143.0
- #26708 PAC 3 - Add Windows system proxy resolver @canvrno-oai
- #28769 Register full CDP requirements feature @syuan-oai
- #29485 [codex] fetch featured IDs for remote plugins @ericning-o
- #29487 Upgrade bundled OpenSSL to 3.6.3 @jif-oai
- #29489 [codex] Update esbuild to 0.28.1 @pakrym-oai
- #29488 [plugins] Add dark-mode logo metadata @drewschuster-openai
- #29249 [codex] migrate environment context to model world state @pakrym-oai
- #29494 core: wrap token budget window context @bolinfest
- #29417 [codex] replace remote images with model-visible error text @rka-oai
- #28360 feat(core): store turn_id on ResponseItem metadata @owenlin0
- #29486 [codex] Use tool search for MCP tools by default @sayan-oai
- #29501 path-uri: clarify host-native path conversion @anp-oai
- #29504 fix: world state response item test @celia-oai
- #26704 TUI Plugin Sharing 4 - cover remote plugin catalog flows @canvrno-oai
- #29419 [codex] reject remote images at app-server ingress @rka-oai
- #28992 chore: improve expired Bedrock credential errors @celia-oai
- #29467 Make formatter output quiet on success @anp-oai
- #26709 PAC 4 - Add macOS system proxy resolver @canvrno-oai
- #29490 chore: warn when Code Mode lacks model metadata @celia-oai
- #29493 mcp: accept foreign absolute cwd for remote stdio @anp-oai
- #29473 Propagate safety buffering treatment metadata @fc-oai
- #24092 [codex] Reject unlowered PowerShell AST regions @bookholt-oai
- #29155 [codex] Expose service tier and reasoning effort in OTEL @daniel-oai
- #29068 [codex] stylistic changes @rka-oai
- #29518 Remove redundant Codex Apps manager flag @aibrahim-oai
- #27946 [codex] Use input items for Responses Lite tools @rka-oai
- #29528 Centralize Codex Apps client handling @aibrahim-oai
- #29577 Handle additional tools in image URL validation @aibrahim-oai
- #29575 Remove redundant Codex Apps cache guard @aibrahim-oai
- #29583 Group Codex Apps client setup @aibrahim-oai
- #29358 Allow codex sandbox to consume MCP sandbox state @jif-oai
- #29599 Stop persisting bridged log events @jif-oai
- #29615 Fix Codex Apps auth elicitation hang @jif-oa

Bug Fixes
- Prevented full Responses WebSocket request payloads from being written to trace logs. (#30771)
Changelog
Full Changelog: rust-v0.142.4...rust-v0.142.5
- #30771 [codex] Backport websocket trace fix to release/0.142 @dylan-hurd-oai

Chores
- No user-facing changes were identified for this release.
Changelog
Full Changelog: rust-v0.142.3...rust-v0.142.4

New Features
- MCP tools now use tool search by default when supported, improving tool discovery while preserving compatibility with older models and providers. (#29486)
- macOS authentication clients can honor system proxy, PAC, and WPAD settings when respect_system_proxy is enabled. (#26709)
- Plugins can provide dedicated dark-mode logos through local manifests and remote catalogs. (#29488)
- Apps can display richer safety-buffering UI using server-provided visibility and faster-model metadata. (#29473)
Bug Fixes
- Remote plugin catalogs now return curated featured-plugin rankings. (#29485)
- Expired Amazon Bedrock credentials now produce actionable recovery guidance instead of a generic authorization error. (#28992)
- Remote stdio MCP servers now accept absolute working directories written in the remote platform’s path format. (#29493)
- Remote HTTP(S) image inputs now return clear model-visible validation errors; inline data URLs and local images remain supported. (#29417, #29419)
- PowerShell commands containing executable AST regions the safety classifier cannot inspect now require approval. (#24092)
- Code Mode now warns when the selected model lacks the required metadata. (#29490)
Chores
- Updated bundled OpenSSL and esbuild dependencies to patched releases. (#29487, #29489)
- Successful formatter runs are now quiet while failures still show diagnostics. (#29467)
Changelog
Full Changelog: rust-v0.142.1...rust-v0.142.2
- #28769 Register full CDP requirements feature @syuan-oai
- #29485 [codex] fetch featured IDs for remote plugins @ericning-o
- #29487 Upgrade bundled OpenSSL to 3.6.3 @jif-oai
- #29489 [codex] Update esbuild to 0.28.1 @pakrym-oai
- #29488 [plugins] Add dark-mode logo metadata @drewschuster-openai
- #29249 [codex] migrate environment context to model world state @pakrym-oai
- #29494 core: wrap token budget window context @bolinfest
- #29417 [codex] replace remote images with model-visible error text @rka-oai
- #28360 feat(core): store turn_id on ResponseItem metadata @owenlin0
- #29486 [codex] Use tool search for MCP tools by default @sayan-oai
- #29501 path-uri: clarify host-native path conversion @anp-oai
- #29504 fix: world state response item test @celia-oai
- #26704 TUI Plugin Sharing 4 - cover remote plugin catalog flows @canvrno-oai
- #29419 [codex] reject remote images at app-server ingress @rka-oai
- #28992 chore: improve expired Bedrock credential errors @celia-oai
- #29467 Make formatter output quiet on success @anp-oai
- #26709 PAC 4 - Add macOS system proxy resolver @canvrno-oai
- #29490 chore: warn when Code Mode lacks model metadata @celia-oai
- #29493 mcp: accept foreign absolute cwd for remote stdio @anp-oai
- #29473 Propagate safety buffering treatment metadata @fc-oai
- #24092 [codex] Reject unlowered PowerShell AST regions @bookholt-oai

New Features
- Added opt-in Windows system proxy support for authentication, including PAC, WPAD, static proxies, and bypass rules. (#26708)
Changelog
Full Changelog: rust-v0.142.0...rust-v0.142.1
- #26708 PAC 3 - Add Windows system proxy resolver @canvrno-oai

New Features
- /usage can now show and redeem earned usage-limit reset credits, with confirmation, retry, and refreshed availability states. (#28154, #28793)
- /plugins now organizes remote plugins into OpenAI Curated, Workspace, and Shared with me sections, while eligible turns can recommend and install relevant plugins. (#26703, #28399, #28400, #27704, #28403)
- Configurable rollout token budgets track usage across agent threads, provide remaining-budget reminders, and abort turns when exhausted. (#28746, #28494, #28707, #29423)
- App-server clients can configure multi-agent delegation as disabled, explicit-request-only, or proactive at the thread and turn level. (#28685, #28792, #29324)
- Added an indexed web-search mode that permits live searches while restricting direct page access to server-approved URLs. (#28489)
- Codex can now receive scheduled UTC time reminders and query the current time directly, including through client-provided app-server clocks. (#28822, #28824, #28835, #29011)
Bug Fixes
- Restored reliable Linux TUI rendering after suspending with Ctrl+Z and resuming with fg. (#28342)
- Exec-server processes and stdio MCP sessions now survive transient disconnects, including signed-URL refresh and retry-safe stdin writes. (#28512, #28374, #28546, #28895)
- Remote environments now preserve executor-native paths, shells, AGENTS.md discovery, and sandbox behavior across operating systems. (#28146, #28152, #28958, #28983, #29099, #29108, #29113, #29424)
- Plugin loading and installation now handle root marketplace layouts, manifest fallbacks, multiple skill paths, actionable download errors, and immediate tool refreshes. (#28771, #28789, #28790, #28863, #28951)
- Parent agents now receive terminal subagent errors instead of seeing failed work as an empty successful completion. (#28375)
- Goal-first threads are once again persisted and returned by thread/list and thread/search. (#28808)
Chores
- Reduced startup and session latency by deferring unnecessary DNS work, warming the model cache, reusing parsed plugin skills, parallelizing skill metadata reads, and skipping redundant catalog synchronization. (#28542, #28699, #28844, #29326, #29005)
- Reduced persistent-log churn by removing per-event WebSocket payload logging and filtering duplicated telemetry records. (#29432, #29457)
Changelog
Full Changelog: rust-v0.141.0...rust-v0.142.0
- #28396 [codex] Record external agent import results @charlesgong-openai
- #27751 [codex] expose Bedrock credential source in account/read @celia-oai
- #28338 [codex] Compress cold active rollouts @jif-oai
- #28368 feat: render typed envelopes for multi-agent v2 messages @jif-oai
- #28508 [tests] Keep Apps out of generic core test harness @jif-oai
- #28472 [codex] Clarify plugin load and runtime capability stages @xl-openai
- #28375 core: surface terminal subagent errors to parent agents @jif-oai
- #28542 perf(config): defer remote sandbox hostname lookup @fcoury-oai
- #28473 path-uri: clarify invalid host path errors @anp-oai
- #28342 fix(tui): restore TUI after suspend @fcoury-oai
- #28354 [codex] exec-server: stream files in chunks @pakrym-oai
- #28553 chore: side prompt @jif-oai
- #27099 [codex-app-server-test-client & codex-app-server] Plugin Usage Analytics Smoke Test @jameswt-oai
- #28554 fix(tui): highlight C++ module files @fcoury-oai
- #28467 [codex] Warn clearly when code mode output is truncated @aibrahim-oai
- #27750 [codex] Add incremental thread history changes @wiltzius-openai
- #28154 feat(tui): add rate-limit reset redemption to /usage @jayp-oai
- #28562 ci: run code-mode unit tests on all bazel targets @cconger
- #27923 [codex] Route MCP file uploads through environment filesystem @pakrym-oai
- #27100 [codex-app-server-test-client] Plugin Install/Uninstall Analytics Smoke Test @jameswt-oai
- #28581 [codex] re-enable absolute workdir integration test @anp-oai
- #28468 code-mode: extend test coverage to lock in cell lifecycle @cconger
- #28587 [codex] test exec relativ

New Features
- Remote executors now use authenticated, end-to-end encrypted Noise relay channels. (#26242, #26245)
- Cross-platform remote execution now preserves executor-native working directories and shells, including filesystem permission paths across app-server and exec-server boundaries. (#27819, #27995, #28032, #28122, #28165, #28367)
- Selected executor plugins can activate their stdio MCP servers per thread; plugin discovery also adds a created-by-me marketplace and auth-specific curated catalogs. (#27870, #27884, #27893, #28203, #28383)
- App-server clients can list immediate child threads, correlate external-agent imports with detailed results, and read or redeem rate-limit reset credits. (#26662, #28008, #28143)
- Realtime clients can explicitly append speech, control how Codex responses enter conversations, and omit startup context. (#27917, #28405)
- TUI input prompts can auto-resolve after inactivity, with a countdown that pauses on interaction. (#28235)
Bug Fixes
- Hook trust bypass now persists through codex exec thread start and resume, while blocking PostToolUse hooks correctly reject code-mode tool calls. (#26434, #28365)
- Plugin capabilities now route consistently by authentication mode, deduplicate conflicting App/MCP declarations, and preserve remote marketplace ordering. (#27461, #27602, #27607, #27902, #27958, #28395)
- Windows sandbox execution repairs stale credentials automatically and gives PowerShell commands more time before backgrounding. (#27086, #27944)
- Idle exec-server relays remain connected, and steered user input immediately interrupts wait_agent. (#28286, #28341)
- Bundled SQLite is pinned to a version containing the WAL-reset corruption fix. (#27992)
- TLS connections now support P-521 certificate signatures commonly used by enterprise proxies. (#27706)
Chores
- Reduced latency and memory use in large, tool-heavy sessions by caching tool search and eliminating repeated request and history copies. (#27258, #27813, #28306, #28309, #28313, #28323, #28327)
- Bounded prompt-image caching to 64 MiB and feedback uploads to eight related threads. (#28294, #28332)
- Terminal resize reflow is now always enabled, ignoring obsolete disabled settings. (#27794)
Changelog
Full Changelog: rust-v0.140.0...rust-v0.141.0
- #28001 [codex] package Windows ARM64 on x64 @tamird
- #28032 [codex] Carry exec-server cwd as PathUri @anp-oai
- #27607 [codex] Dedupe plugin MCPs by app declaration name @felixxia-oai
- #27992 [codex] Pin bundled SQLite to fixed WAL-reset version @gpeal
- #28125 build: run buildifier from just fmt @anp-oai
- #28120 bazel: add PowerShell to Wine test harness @anp-oai
- #27819 path-uri: render native paths across platforms @anp-oai
- #28122 [codex] exec-server honors remote environment cwd and shell @anp-oai
- #26662 feat(app-server): filter threads by parent @btraut-openai
- #27884 Add selected-plugin precedence and attribution to the MCP catalog @jif-oai
- #27870 Discover stdio MCP servers from selected executor plugins @jif-oai
- #28283 [codex] update multi-agent v2 prompts @jif-oai
- #27602 [codex] Preserve plugin apps in connector listings @felixxia-oai
- #27461 [codex] Skip plugin MCP OAuth for matching app routes @felixxia-oai
- #27893 Activate selected executor plugin MCPs in app-server @jif-oai
- #28332 [codex] Cap feedback upload subtrees @jif-oai
- #27365 Represent dynamic tools with explicit namespaces internally @sayan-oai
- #28333 skills: hide orchestrator skills with a local executor @jif-oai
- #27756 [codex] simplify shell snapshot ownership @pakrym-oai
- #27794 Remove terminal resize reflow flag gates @etraut-openai
- #28286 chore: restore exec-server relay keepalives @jif-oai
- #28164 [codex] simplify memory read metrics @pakrym-oai
- #27371 Expose explicit dynamic tool namespaces in thread start @sayan-oai
- #28309 linearize history output normalization @jif-oai
- #28306 avoid cloning sampling request input @jif-oai
- #28323 serialize websocket requests directly @jif

New Features
- Added /usage views for daily, weekly, and cumulative account token activity. (#27925)
- /goal now preserves oversized text, large pasted blocks, and image attachments, including in remote app-server sessions. (#27508, #27509, #27510)
- Added permanent session deletion through codex delete, /delete, and app-server thread/delete, with confirmation safeguards and subagent cleanup. (#25018, #27476)
- Added /import for selectively importing setup, project configuration, and recent chats from Claude Code. (#27070, #27071, #27703)
- Typing @ now opens the unified mentions menu for files, plugins, and skills by default. (#27499)
- Added managed Amazon Bedrock API-key authentication and encrypted local storage for CLI and MCP OAuth credentials. (#27443, #27689, #27504, #27535, #27539, #27541)
Bug Fixes
- Corrupted SQLite state databases are now backed up and rebuilt automatically from rollout data, including malformed database-directory cases. (#26859, #27719)
- Prevented /review from crashing when Esc is pressed with queued guidance, while preserving that guidance when the review is canceled. (#22879)
- Improved MCP reliability by retrying transient startup failures, reporting unusable OAuth credentials as logged out, and preserving explicitly disabled servers. (#25147, #26713, #27414)
- Fixed remote plugin uninstall requests and correctly surfaced apps requiring authentication during installation. (#27085, #27223)
- Persisted “Don’t remind me” update dismissals reliably and cleared stale running-hook indicators after completed turns. (#27619, #27783)
- Non-TTY background commands can now be interrupted with Ctrl-C while preserving their final output and exit status. (#26734)
Documentation
- Clarified contributor guidance around keeping crate APIs narrow and supporting Linux, macOS, and Windows. (#27939, #27966)
Chores
- Improved responsiveness for large repositories and long sessions by preserving Git’s built-in filesystem monitor, avoiding duplicate history reads, accelerating archive lookup, and caching turn-diff rendering. (#26880, #27031, #27276, #27489)
- Removed the experimental /realtime voice controls and related audio dependencies from the TUI. (#27801)
Changelog
Full Changelog: rust-v0.139.0...rust-v0.140.0
- #26880 [codex] preserve fsmonitor for worktree Git reads @tamird
- #27085 Use server app auth requirements for remote plugin install @xl-openai
- #27098 [codex] Return workspace directory installed plugins @xl-openai
- #27007 multi-agent: add path-based v2 activity tracking @jif-oai
- #27166 app-server: clear stale thread watches after v2 agent interruption @jif-oai
- #27080 [codex] Ignore pending PR review comments @anp-oai
- #26420 Avoid no-op backfill state writes @zanie-oai
- #27031 Avoid rereading rollout history during cold resume @zanie-oai
- #22879 fix: Prevent /review crash when entering Esc on steer message @canvrno-oai
- #27173 app-server: reject direct input to multi-agent v2 sub-agents @jif-oai
- #27184 Load selected executor skills through extensions @jif-oai
- #26835 [codex] Test extension API contracts @anp-oai
- #27063 [codex-analytics] add extensible feature thread sources @marksteinbrick-oai
- #26479 [codex] Speed up local nextest runs @anp-oai
- #27223 fix: use plugin service route for remote uninstall @ericning-o
- #22685 Add SOCKS5 TCP MITM coverage @winston-openai
- #26681 Allow creating a new goal after completion @etraut-openai
- #26711 Reduce TUI legacy core dependencies @etraut-openai
- #27110 [1/6] Add Python goal routing foundation @aibrahim-oai
- #27191 Route hosted Apps MCP through extensions @jif-oai
- #26830 [codex] Characterize global instruction lifecycle @anp-oai
- #26713 [codex] Report unusable MCP OAuth credentials as logged out @anp-oai
- #26734 [codex] Handle Ctrl-C for non-TTY unified exec @pakrym-oai
- #27116 Stop mirroring Codex user input into realtime @guinness-oai
- #27111 [2/6] Add private Python goal operations @aibrahim-oai
- #25147 [codex] Retry streamabl

New Features
- Code mode can now call standalone web search directly, including from nested JavaScript tool calls, and receive plaintext search results. (#26719)
- Tool and connector input schemas now preserve oneOf and allOf, and large schemas keep more shallow structure when compacted, improving compatibility with richer MCP tools. (#24118, #27084)
- codex doctor now includes editor and pager environment details in the local report while redacting raw values in JSON output. (#27081)
- Plugin marketplace automation is more informative and responsive: codex plugin marketplace list --json now includes each marketplace source, and plugin lists can return from the cached remote catalog before refreshing in the background. (#27009, #26932)
Bug Fixes
- codex resume --last "..." and codex fork --last "..." now treat the trailing argument as the initial prompt instead of misreading it as a session ID. (#26818)
- MCP startup warnings from subagents now stay in the thread that owns them, avoiding duplicate parent-thread alerts and stuck startup spinners in the TUI. (#26639)
- Image edits now use the exact referenced image file paths instead of guessing from conversation history, so attached-image edits land on the intended input. (#26486)
- Bare URLs with ~ in the path are now linkified end to end in the TUI instead of being truncated before the tilde. (#27088)
- Thread resets such as /new, /clear, and /fork no longer drop cloud-managed requirements or feature flags during TUI config reloads. (#25177)
- Sandbox execution now preserves approved escalation decisions and enforces configured proxy-only networking more consistently. (#24981, #27035)
Chores
- Release builds once again publish separate symbol archives with line tables, improving post-release crash symbolication without bringing back the earlier full-debug build slowdown. (#26202)
- The embedded V8 toolchain was updated to rusty_v8 149.2.0. (#26464)
Changelog
Full Changelog: rust-v0.138.0...rust-v0.139.0
- #26741 fix(remote-control): preserve enrollment on generic websocket 404s @apanasenko-oai
- #26804 fix(core-plugins): send Codex product SKU to plugin-service @ericning-o
- #26464 build(v8): update rusty_v8 to 149.2.0 @cconger
- #26895 ci: use bazel environment for BuildBuddy secret @bolinfest
- #24981 fix: preserve approval sandbox decisions in unified exec @bolinfest
- #26818 fix(tui): accept prompts with resume and fork @fcoury-oai
- #24820 deps: update starlark to 0.14.2 @bolinfest
- #26639 fix(tui): scope MCP startup status by thread @fcoury-oai
- #26719 [codex] Enable standalone web search in code mode @rka-oai
- #26632 feat: add v2 agent residency lru @jif-oai
- #26974 Ignore proc-macro-error2 advisory @jif-oai
- #26969 feat: count V2 concurrency by active execution @jif-oai
- #26994 Rename multi-agent v2 close_agent to interrupt_agent @jif-oai
- #26997 Avoid reopening v2 descendants on resume @jif-oai
- #26821 [codex] Exclude external tool output from memories @rka-oai
- #26202 [codex] Restore release symbol artifacts with line tables @nornagon-openai
- #26852 fix(app-server): avoid blocking connection cleanup @apanasenko-oai
- #26923 Add HTTP window ID to Responses client metadata @ningyi-oai
- #26680 [codex-analytics] report compaction analytics details @rhan-oai
- #26637 [codex] Speed up external agent session imports @stefanstokic-oai
- #27009 [plugins] Expose marketplace source in marketplace list JSON @mpc-oai
- #27024 ci: template custom runner names by repo @bolinfest
- #26230 fix: preserve auto review across config and delegation @viyatb-oai
- #27038 [codex] Clarify PR babysitter state mutations @anp-oai
- #27037 [codex] Calm multi-agent v2 usage prompts @jif-oai
- #26687 Pair thread environment settings @pakrym-oai
- #27054 cli: add -P sandbox permissions profile alias @bolinfest
- #27035 Enforce configured network proxy in codex sandbox @viyatb-oai
- #26486 Route image edits through referenced file paths @won-openai
- #27060 [codex-analytics] stop sending 

New Features
- The /app command can now hand off the current CLI thread into Codex Desktop on macOS and native Windows, and Windows workspace launches can open directly into Desktop instead of stopping at a manual prompt. (#25638, #26500)
- Local image attachments and standalone image generations now expose their saved file paths to the model, which makes follow-up edits and file references more reliable. (#25944, #25947)
- Reasoning effort selection is more flexible: the TUI adds fallback shortcuts for terminals that miss Alt bindings, and model-defined effort levels now flow through in the order advertised by the model. (#25623, #26444, #26446)
- App-server integrations can now read account token usage, and Codex auth supports v2 personal access tokens in CLI and app-server flows. (#25344, #25731)
- Plugin automation got richer structured output: add/remove and marketplace commands support --json, plugin list JSON includes marketplace source, and plugin detail data now exposes default prompts, remote MCP servers, and unavailable app templates. (#26631, #26417, #25887, #26453, #26317)
Bug Fixes
- Goal workflows are more predictable: multiline paste in /goal edit no longer submits early, idle auto-turns stay out of Plan mode, and goals stop auto-continuing after terminal turn failures. (#26047, #26147, #26690)
- Forked threads now keep user-renamed titles instead of falling back to the original first-prompt name. (#26075)
- The TUI no longer adds extra blank space while streaming, and cancelled prompts reopen with the cursor at the end so you can keep editing naturally. (#26636, #26457)
- TUI config write failures now show the underlying cause, making validation problems and read-only filesystem issues much easier to diagnose. (#26537)
- Startup is more resilient across environments, with support for /usr/bin/bash, shorter Linux proxy socket paths, and pre-refresh of expired OAuth-backed MCP credentials. (#26538, #26553, #26482)
- Workspace instruction loading is more accurate for remote and symlinked workspaces, so the right AGENTS.md files are picked up consistently. (#26205, #26465)
Documentation
- The CLI README was refreshed to remove stale guidance and better match the current documentation flow. (#26313)
Chores
- TUI startup does less repeated plugin work by reusing discovery results and loading only hook metadata on the critical path. (#26469, #26272)
- resume --last now finds the newest matching session through the state DB first, which speeds up restore on large local histories. (#26462)
- Large MCP/Ollama streams and long message histories process much faster thanks to optimized byte scanning. (#26265)
Changelog
Full Changelog: rust-v0.137.0...rust-v0.138.0
- #26179 nit: small prompt update for MAv2 @jif-oai
- #26175 feat: guard git enrichment @jif-oai
- #26047 Fix multiline paste in /goal edit @etraut-openai
- #25700 core: stop threading SandboxPolicy through exec @bolinfest
- #25925 [codex] Copy user Bazel settings into Codex worktrees @anp-oai
- #26216 [codex] Pin Python SDK to runtime 0.137.0a4 @aibrahim-oai
- #25887 Preserve remote plugin default prompts @ericning-o
- #25944 Expose local image paths to models @won-openai
- #25469 [profile-switcher][rust] -- [1/2] Add app-server account session protocol @dhruvgupta-oai
- #26075 Fix forked thread name inheritance @etraut-openai
- #25960 Restore Windows coverage for code-mode image generation exposure @won-openai
- #26226 [codex] Split Python runtime release workflow @aibrahim-oai
- #26254 feat: catalog multi-agent v2 config @jif-oai
- #26251 Rewrite oversized tool outputs during remote compaction @pakrym-oai
- #26260 codex-pr-body: avoid confidential references @anp-oai
- #26074 Use Windows setup marker as completion signal @abhinav-oai
- #26002 log plugin MCP server names @chrisdong-oai
- #25623 fix(tui): add reasoning effort fallback shortcuts @fcoury-oai
- #25638 feat(tui): add /app desktop handoff @fcoury-oai
- #26189 cli: add package path from install contex

New Features
- TUI controls now support F13-F24 keybindings, paste in searchable menus, and a compact reasoning-only status/title item (#25329, #25400, #25504).
- Enterprise/admin flows now show monthly credit limits and can apply cloud-managed config bundles, including EDU workspaces (#24812, #24617, #24619, #24620, #24622, #25963).
- Remote-control clients can start pairing and list or revoke controller grants through app-server v2 RPCs (#25675, #25785).
- Plugin workflows gained machine-readable codex plugin list --json output and cached remote catalog suggestions (#25330, #25457).
- Hosted web and image tools are available in more code-mode flows, with standalone web searches able to run in parallel (#25176, #25702, #25890, #25923).
- Multi-agent v2 keeps runtime choice with each thread and exposes cleaner follow-up and metadata defaults for spawned agents (#25266, #25636, #25720, #25721, #25722, #25841, #26114).
Bug Fixes
- Cancelling a submitted prompt before visible output now restores the draft, attachments, and collaboration mode for editing (#25316).
- Slash-command filtering and footer shortcut hints now reset or render according to the current UI state (#25492, #25625).
- Platform reliability improved for macOS app launches and Windows SQLite startup, thread resume, and sandbox setup refreshes (#25485, #25490, #25509, #25949).
- Plugin loading preserves app manifest order, deduplicates local/remote curated installs, and treats malformed skills fields as warnings (#25491, #25681, #25717, #25782).
- Permission requests and approvals now carry environment identity, and managed MITM proxying exports readable CA bundles to child commands (#25850, #25858, #25862, #22668).
- Local session history is safer for compressed rollouts, renamed titles, pathless side-chat reloads, and stack-heavy startup/config rebuilds (#25087, #25624, #25661, #25814, #25844, #25847).
Documentation
- Added app-server docs and generated schema updates for monthly credit limits, remote-control RPCs, and environment-scoped permission approvals (#24812, #25675, #25785, #25862).
- Moved repo review rules and contributor conventions into AGENTS.md, including Rust test-module layout and Python 3 compatibility guidance (#25682, #25690, #25738).
Chores
- Root formatting and Justfile workflows are more complete and Windows-aware (#24983, #25165, #25683).
- Rust CI and release workflows use the git CLI for Cargo fetches to avoid intermittent libgit2/submodule failures (#25644, #25775).
- Python SDK releases now publish runtime wheels from the SDK workflow and pin to a glibc-compatible runtime package (#25906, #25907).
- Bazel CI’s BuildBuddy wrapper was reintroduced with Windows-safe process handling and validation (#25915).
- Shared prompts, context fragments, and skills plumbing moved into dedicated crates/extension paths to reduce codex-core coupling (#25151, #25953, #25959, #26106, #26122, #26167).
Changelog
Full Changelog: rust-v0.136.0...rust-v0.137.0
- #25329 feat(tui): allow function keys through f24 in keymaps @fcoury-oai
- #24617 Add config bundle transport types @joeflorencio-openai
- #25435 Add build_unsigned_archive release mode @shijie-oai
- #24619 Compose requirements layers @joeflorencio-openai
- #24620 Add cloud-managed config layer support @joeflorencio-openai
- #25462 Revert "Add build_unsigned_archive release mode" @shijie-oai
- #25113 store and expose parent_thread_id on Threads @owenlin0
- #25266 Set multi-agent v2 dogfood defaults @jif-oai
- #25060 Add goal extension idle continuation @jif-oai
- #25576 Use templates for goal steering prompts @jif-oai
- #25577 Remove Plan-mode gate from idle turn injection @jif-oai
- #25096 Add goal extension GoalApi @jif-oai
- #25087 Read compressed rollouts and materialize before append @jif-oai
- #25628 [codex] fix compressed rollout fixture SessionMeta initialization @fcoury-oai
- #25316 feat(tui): restore output-free cancelled prompts @fcoury-oai
- #23763 Preserve auto-review approval policy in c

New Features
- TUI markdown now keeps web links clickable with OSC 8 metadata, and cramped tables switch to readable key/value records without losing link targets. (#24472, #24636, #24825)
- Sessions can now be archived from the TUI with /archive or from the CLI with codex archive / codex unarchive; archived sessions are protected from resume/fork until restored. (#25027, #25021)
- App-server integrations can resume a thread with its initial turns page, see richer MCP server status, and launch stdio mode with codex app-server --stdio. (#23534, #24698, #24940)
- Remote execution setup now supports CODEX_API_KEY registration for approved OpenAI hosts, while remote-control websockets use short-lived server tokens instead of ChatGPT access tokens. (#24666, #24141)
- Windows admins get an alpha codex sandbox setup --elevated provisioning path, plus requirements support for allowed Windows sandbox implementations. (#24831, #23766)
- A feature-gated standalone image generation extension can run through the native Codex image artifact completion pipeline. (#24723, #24972)
Bug Fixes
- ChatGPT auth refreshes tokens before the five-minute expiry window and shows a relogin-required path for reused refresh tokens instead of collapsing into a generic cloud error. (#23546, #24830)
- Command-safety hardening prevents /diff from running repository-provided Git helpers/hooks, avoids PowerShell parser execution on non-Windows hosts, and rejects browser-origin exec-server websocket handshakes. (#24954, #24946, #24947)
- Sandboxed commands clean up more reliably after interruptions or denied Windows network attempts, and deny read rules stay enforced for safe-command and approval-bypass paths. (#22729, #19880, #23943)
- Resumed TUI sessions seed prompt history from the session transcript, multiline hook output renders as separate rows, and Vim normal-mode editing behaves correctly. (#24298, #24965, #25022)
- App-server filesystem watchers debounce later batches correctly, and standalone web search calls now show and restore completed search activity. (#24716, #24693)
- Bedrock auth now falls back to AWS_REGION / AWS_DEFAULT_REGION, and unsupported Bedrock GPT service tiers are no longer advertised or sent. (#25171, #25318)
Documentation
- Python SDK beta docs and package metadata now present the standard pip install openai-codex path, refreshed quickstarts, API reference, FAQ, and examples. (#24836, #24866, #24868, #24870)
- Python SDK examples and docs now use the public CodexConfig name for configuring Codex / AsyncCodex. (#24800)
- The bundled OpenAI Docs skill was updated with current Codex manual routing and a cached manual fetch helper. (#24914)
- Built-in tool schema descriptions now clarify defaults, optional fields, bounds, and enums across shell, Code Mode, MCP, image, goal, plan, multi-agent, and related tools. (#24794)
- App-server and exec-server docs now cover API-key remote registration, --stdio, runtime extra skill roots, and remote-control server-token behavior. (#24666, #24940, #24977, #24141)
Chores
- Python SDK releases can now be staged and published independently from runtime releases using python-v* tags while preserving the reviewed runtime dependency pin. (#24828, #24872)
- Updated MCP dependencies to rmcp 1.7.0 and refreshed compatibility code. (#24763)
- Refreshed Amazon Bedrock catalog metadata, including GPT-5.5, removal of unsupported OSS entries, and default-tier-only GPT model behavior. (#24701, #24960, #25318)
- Removed the stale app-server debug-client pieces and cleaned up the workspace after deletion. (#25063, #25064, #25065, #25066, #25067, #25068, #25069, #25070, #25075)
- Trimmed CI/build maintenance by moving Bazel Windows jobs to Codex runners, removing the libubsan workaround, and reverting the startup benchmark that broke musl builders. (#24952, #24782, #24937)
Changelog
Full Changelog: rust-v0.135.0...rust-v0.136.0
- #22729 fix(linux-sandbox): preserve shell cleanup on interruption @viyatb-oai
- #24472 f

New Features
- codex doctor now reports richer environment, Git, terminal, app-server, and thread inventory diagnostics for support cases. (#24261, #24311, #24305)
- /status shows remote connection details and server version when the TUI is connected over a remote transport. (#24420)
- Vim mode gained text-object editing, improved word/line-end behavior, and a configurable interrupt-turn binding. (#24382, #24380, #24766)
- /permissions now understands named permission profiles and displays configured custom profiles. (#21559)
- Packaged Codex builds can discover and use the bundled patched zsh helper across supported macOS and Linux targets. (#23756, #24171)
- The Python SDK now exposes friendly Sandbox presets for thread and turn APIs. (#24772)
Bug Fixes
- Markdown tables and multiline lists render more readably in the TUI, with better column sizing and app-style table formatting. (#24489, #24346, #24351)
- TUI output is more stable on macOS and Zellij, avoiding stderr/composer corruption and raw-output overlap. (#24459, #24479, #24593)
- Slash-command completion now preserves existing draft text for commands that accept inline arguments. (#23950)
- Older tmux/iTerm control-mode sessions no longer lose normal Ctrl-C handling from unsupported keyboard enhancement setup. (#24371)
- App mentions now exclude inaccessible or disabled apps instead of offering unusable $ suggestions. (#24625)
- Resume flows now include non-interactive exec sessions when requested and honor cwd overrides for idle cached threads. (#24503, #24528)
Documentation
- Clarified image-viewing tool detail behavior and removed stale TUI composer documentation references. (#23949, #24641)
- Updated Python SDK docs, examples, and notebook content to use the new sandbox preset API. (#24772)
Chores
- Updated Rust toolchain pins and SQLx/SQLite dependencies. (#24684, #24728)
- Moved memory runtime state into a dedicated SQLite database. (#24591)
- Removed remaining legacy config-profile consumers and routed more TUI config/plugin state through app-server-owned APIs. (#24076, #24254, #24255, #24265, #24266, #24257)
- Centralized Responses retry handling and MCP tool naming logic to reduce duplicated internal plumbing. (#24131, #21576)
Changelog
Full Changelog: rust-v0.134.0...rust-v0.135.0
- #24164 fix(remote-control): cap reconnect backoff @apanasenko-oai
- #23756 package: include zsh fork in Codex package @bolinfest
- #23757 Default function tools into tool hooks @abhinav-oai
- #24171 package: add x64 macOS codex-zsh artifact @bolinfest
- #24159 code-mode: merge stored values by key @cconger
- #23983 fix: plugin bundle archive handling for upload and install @xl-openai
- #24261 feat(doctor): add environment diagnostics @fcoury-oai
- #24311 Report app-server version in codex doctor @etraut-openai
- #24314 tui: label compact rate-limit percentages @etraut-openai
- #24420 Show remote connection details in /status @etraut-openai
- #24317 Respect hook trust bypass during TUI startup @etraut-openai
- #24254 TUI config cleanup: oss_provider @etraut-openai
- #24255 TUI config cleanup: trusted projects @etraut-openai
- #24265 TUI config cleanup: MCP inventory @etraut-openai
- #24305 Add doctor thread inventory audit @etraut-openai
- #24346 fix(tui): improve markdown table column allocation @fcoury-oai
- #24351 fix(tui): improve multiline markdown list readability @fcoury-oai
- #24459 fix(tui): prevent macos stderr from corrupting composer @fcoury-oai
- #24479 fix(process-hardening): preserve macos malloc diagnostics @fcoury-oai
- #24474 Log rollout writer OS errors @etraut-openai
- #24076 chore: stop consuming legacy config profiles @jif-oai
- #24131 centralize Responses retry policy @rhan-oai
- #23858 [wip] goal shift @jif-oai
- #24555 chore: drop orphaned codex memories MCP crate @jif-oai
- #24558 chore: move memory prompt builder into extension @jif-oai
- #24562 Add ad-hoc memory note tool @jif-oai
- #24567 Wire metrics client into memories extension @jif-oai
- #24588 f

New Features
- Added search across local conversation history, including case-insensitive content matches with result previews. (#23519, #23921)
- Made --profile the primary profile selector across CLI, TUI permissions, and sandbox flows, with legacy profile configs rejected through migration guidance. (#23708, #23883, #23890, #24051, #24055, #24059, #24067, #24110)
- Improved MCP setup with per-server environment targeting and OAuth options for streamable HTTP servers. (#23583, #24120)
- Made connector tool schemas more reliable by preserving local $ref/$defs structures and compacting oversized schemas before exposure. (#23357, #23904)
- Let read-only MCP tools run concurrently when they advertise readOnlyHint. (#23750)
- Added richer extension and hook context, including conversation history for extension tools and subagent identity in hook inputs. (#22882, #23963)
Bug Fixes
- Improved remote reliability by reconnecting stale exec-server websocket clients, retrying remote control immediately after auth recovery, and retrying remote compaction v2 streams. (#23867, #23775, #23951)
- Fixed Windows TUI rendering corruption by restoring virtual terminal mode before drawing. (#24082)
- Displayed workspace-specific usage-limit messages for credit and spend-cap failures. (#24114)
- Allowed plugin skills to reuse shared plugin-level icon assets. (#23776)
- Preserved active permission profile metadata when syncing auto-review runtime settings. (#23956)
- Ensured Node-based tools honor Codex’s managed network proxy environment. (#23905)
Documentation
- Documented the curl and PowerShell installer paths in the README. (#24106)
- Updated developer docs to prefer just test over direct cargo test for repo-local test runs. (#23910)
- Added profile migration documentation links to relevant config errors. (#23879)
Chores
- Simplified release packaging around canonical native artifacts, reusable DotSlash fetching, and a new macOS x64 zsh artifact. (#23833, #23836, #24129, #24165)
- Added release-build support for Codex-produced V8 artifacts. (#23934)
- Added image re-encoding benchmarks and connector-style JSON schema policy fixtures. (#23935, #24152)
- Improved tracing and analytics for websocket requests, turn starts, and remote compaction v2. (#23581, #23980, #24146)
Changelog
Full Changelog: rust-v0.133.0...rust-v0.134.0
- #23581 Trace logical websocket request after untraced warmup @jif-oai
- #23718 [codex] Steer budget-limited goal extension turns @jif-oai
- #23861 fix: cargo lock @jif-oai
- #23728 feat: retain remote compaction truncation parity in v2 @jif-oai
- #23870 Make tool executor specs mandatory @jif-oai
- #23882 [codex] Stabilize subagent start hook test @jif-oai
- #23876 refactor: centralize tool exposure planning @jif-oai
- #23879 chore: link doc in profile error messages @jif-oai
- #23883 cli: rename profile v2 flag to --profile @jif-oai
- #23835 docs: add description to codex-cli/package.json @bolinfest
- #23583 Route MCP servers through explicit environments @starr-openai
- #23886 cli: remove legacy profile v1 plumbing @jif-oai
- #23708 tui: plumb permission profile selection @viyatb-oai
- #23833 packaging: move rg manifest out of npm bin @bolinfest
- #23796 Improve /goal error messages for ephemeral sessions @etraut-openai
- #23867 Reconnect disconnected exec-server websocket clients with fresh sessions @starr-openai
- #23792 TUI: skip goal replace prompt for completed goals @etraut-openai
- #23519 [codex] Add rollout-backed thread content search @fc-oai
- #22552 Remove plugin hooks feature flag @abhinav-oai
- #23836 npm: remove legacy package artifact synthesis @bolinfest
- #23921 [codex] Make thread search case-insensitive @fc-oai
- #23775 fix(remote-control): retry after auth recovery @apanasenko-oai
- #22882 Add subagent identity to hook inputs @abhinav-oai
- #22915 [3 of 4] tui: route feature and memory toggles through app server @etraut-openai
- #23776 fix: Allow plugin skills to share plugin-level icon assets @xl-o

New Features
- Goals are now enabled by default, backed by dedicated storage, and track progress across active turns. (#23300, #23685, #23696, #23732)
- codex remote-control now runs like a foreground command, waits for readiness, reports machine status, and keeps explicit daemon-style start/stop commands. (#22878)
- Permission profiles gained list APIs, inheritance, managed requirements.toml support, runtime refresh behavior, and stronger Windows sandbox integration. (#22928, #23412, #22270, #23433, #22931, #23715)
- Plugin discovery is easier to inspect, with marketplace-aware list output, installed versions, visible marketplace roots, and remote collection support. (#23372, #23584, #23727, #23730)
- Extensions can observe more lifecycle events, including subagent start/stop, tool execution, turn metadata, and async approval/turn processing. (#22782, #22873, #23309, #23688, #23690, #23692)
Bug Fixes
- Fixed TUI startup choosing the wrong working directory when reusing a local app-server socket. (#23538)
- Fixed plan-mode free-form answers so modified Enter keys, like Shift+Enter, no longer submit unexpectedly. (#23536)
- Removed stale background terminal poll events after a process exits. (#23231)
- Preserved raw code-mode exec output unless an explicit output token limit is requested. (#23564)
- Made AGENTS instruction loading more reliable, including local global reads and warnings for invalid UTF-8 instead of silent drops. (#23343, #23232)
- Fixed app-server startup/shutdown races, empty resume/fork paths, plugin upgrade failures, and realtime v1 websocket compatibility. (#23516, #23578, #23400, #23356, #23771)
Documentation
- Added clearer plugin-creator guidance for updating and reinstalling local personal plugins. (#23542)
- Expanded app-server/API docs and schema coverage around managed permission profile requirements. (#23433, #23555)
Chores
- Added a canonical Codex package archive pipeline and moved installers, npm packages, DotSlash, and SDK runtimes toward that shared layout. (#23513, #23582, #23586, #23596, #23635, #23636, #23637, #23638, #23786)
- Fixed Linux Python runtime wheel tags so glibc-based systems can install the runtime artifacts. (#21812)
- Improved release and CI reliability with package-builder tests, prebuilt resource packaging, DotSlash zstd handling, platform-sharded Rust tests, and Codex Linux release runners. (#23760, #23759, #23752, #23358, #23761)
Changelog
Full Changelog: rust-v0.132.0...rust-v0.133.0
- #23343 codex: route global AGENTS reads through LOCAL_FS @starr-openai
- #22380 fix: default unknown tool schemas to empty schemas @celia-oai
- #23309 Add tool lifecycle extension contributor @jif-oai
- #23253 Reduce rust-ci-full Windows nextest timeout flakes @starr-openai
- #22878 Improve codex remote-control CLI UX @owenlin0
- #21812 Publish Linux runtime wheels with glibc-compatible tags @aibrahim-oai
- #22709 [codex] Trim unused TurnContextItem fields @pakrym-oai
- #23353 Include plugin id in plugin MCP tool metadata @mzeng-openai
- #22728 [codex] Move pending input into input queue @pakrym-oai
- #23371 fix(tui): warn on unsupported iTerm2 pet versions @fcoury-oai
- #23376 [codex-analytics] preserve user thread source for exec threads @marksteinbrick-oai
- #23360 app-server: use profile ids in v2 permission params @bolinfest
- #23384 [codex] Remove external websocket session resets @pakrym-oai
- #22721 cleanup: Remove skill env var dependency prompting @xl-openai
- #23389 Remove ToolSearch feature toggle @sayan-oai
- #23080 [1 of 7] Add thread settings to UserInput @etraut-openai
- #23081 [2 of 7] Remove UserInputWithTurnContext @etraut-openai
- #23075 [3 of 7] Remove UserTurn @etraut-openai
- #23396 [codex] Extract turn skill and plugin injections @pakrym-oai
- #23356 fix(plugins): keep version upgrades additive @iceweasel-oai
- #22508 [5 of 7] Replace OverrideTurnContext with ThreadSettings @etraut-openai
- #22086 CI: Customize v8 building @cconger
- #23390 Remove explicit connector 

New Features
- The Python SDK now supports first-class authentication, including API key login, ChatGPT browser and device-code flows, account inspection, and logout APIs. (#23093)
- Python turn APIs are easier to use for text-only workflows: you can pass a plain string as input, and handle-based runs now return a richer TurnResult with collected items, timing, and usage data. (#23151, #23162)
- codex exec resume now accepts --output-schema, so resumed automations can keep session context while still enforcing structured JSON output. (#23123)
- TUI startup is faster because terminal capability probes are now batched instead of waiting on several serial checks before the first interactive frame. (#23175)
- Remote executor registration can now use standard Codex auth instead of a separate registry credential flow. (#22769)
- App-server turns can preserve requested image fidelity, including original-resolution local images, across user inputs and image-producing tools. (#20693)
Bug Fixes
- Goal continuations now stop when they hit usage limits or a repeated blocker instead of looping and burning more tokens, and completion responses phrase usage more naturally. (#23094, #22907)
- The session picker is easier to trust: renamed threads now show name (thread-id) in resume hints, and pasted text works in the picker search box. (#23234, #23338)
- Multi-session TUI flows are more reliable: in-progress MCP calls stay marked as active during replay, and elicitation replies are sent back to the thread that requested them. (#23236, #23241)
- Remote sessions now keep websocket connections alive and show repo-relative diff paths again instead of /tmp/...-prefixed paths. (#23226, #23261)
- Windows installs are more robust: codex doctor now detects npm-managed installs correctly, and MSVC release binaries no longer depend on separately installed VC++ runtime DLLs. (#22967, #22905)
- TUI polish fixes include immediate shutdown feedback on exit, hiding the ChatGPT usage link for non-OpenAI providers, and keeping a cleared Fast tier from reappearing after side-thread resume. (#23323, #23127, #23121)
Documentation
- The Python SDK docs, FAQ, and examples were refreshed around the new auth flow and turn APIs, with clearer setup guidance and simpler text-only examples. (#22941, #23093, #23151, #23162)
Chores
- Memory summaries are now versioned and rebuilt when the stored format is stale, which should keep long-lived memory context leaner and more predictable. (#23148)
Changelog
Full Changelog: rust-v0.131.0...rust-v0.132.0
- #20693 Preserve image detail in app-server inputs @fjord-oai
- #22891 tui: pass active permission profiles through app commands @bolinfest
- #22924 app-server-protocol: remove PermissionProfile from API @bolinfest
- #22941 [codex] Refine Python SDK user-facing docs @aibrahim-oai
- #22967 Fix Windows doctor npm root probe @etraut-openai
- #22920 core: set permission profiles from snapshots @bolinfest
- #22939 [codex] Split Python SDK helper logic @aibrahim-oai
- #22907 Improve goal completion usage reporting @etraut-openai
- #23030 test: construct permission profiles directly @bolinfest
- #22769 exec-server: support auth-backed remote executor registration @miz-openai
- #22946 [codex] preserve MCP result meta in McpToolCallItemResult @miaolin-oai
- #23069 multiagent: trim model-visible description, cap to 5 models @sayan-oai
- #22913 [1 of 4] tui: route primary settings writes through app server @etraut-openai
- #23093 sdk/python: add first-class login support @aibrahim-oai
- #23151 [codex] Return TurnResult from Python turn handles @aibrahim-oai
- #23147 Make multi-agent v2 tool namespace configurable @jif-oai
- #23036 test: reduce core sandbox policy test setup @bolinfest
- #23162 [codex] Accept string input for Python turns @aibrahim-oai
- #23226 Add exec-server websocket keepalive @starr-openai
- #23148 Densify and version memory summaries @jif-oai
- #22448 [codex] Add installed-plugin mention API @xli-oai
- #23288 chore: go

New Features
- The TUI now offers richer session controls and display: data-driven service-tier commands, blended token usage, permissions/approval mode, effective workspace roots, and responsive Markdown tables. (#21745, #21906, #21991, #21669, #21677, #22052, #22612)
- @ mentions now search files, directories, plugins, and skills in one picker, backed by app-server plugin metadata. (#19068, #22375)
- Plugin workflows gained marketplace CLI commands, version-aware sharing, share checkout, clearer shared-workspace buckets, and default-enabled plugin hooks. (#21396, #22397, #22425, #22435, #22549)
- Remote workflows now support daemon-managed codex remote-control, runtime enable/disable APIs, status reads, and registry-backed/configured remote environments. (#20718, #22218, #22562, #22578, #22877, #20667, #21323)
- The Python SDK moved to openai-codex / openai_codex, with pinned runtime-generated types, concurrent turn routing, approval modes, and integration coverage. (#21778, #21891, #21893, #21896, #21905, #21910, #22014)
- Added codex doctor for support-ready diagnostics across runtime, auth, terminal, network, config, and local state. (#22336)
Bug Fixes
- Fixed several TUI interaction and rendering issues, including URL wrapping, light-mode selection contrast, Shift+Enter in tmux, /review MCP startup status, /side Esc handling, and network approval history text. (#21760, #21950, #21943, #21624, #22710, #22229)
- Hardened Windows sandbox behavior around deny-read rules, scoped write roots, ineffective firewall policy, and PowerShell edge cases. (#18202, #21479, #22353, #21400, #22643)
- Preserved managed read restrictions during permission escalation and cleaned up workspace-root permission profile resolution. (#15977, #22624, #22683)
- Made app-server and local state startup safer by preserving SQLite data, failing closed when state cannot open, adding recovery paths, and softening optional metadata sync failures. (#21831, #21847, #22580, #22734, #22899)
- Improved Git and auth reliability by using root worktree hooks consistently, ignoring repo hook/fsmonitor config in helper commands, binding local MCP OAuth callbacks, and revoking superseded login tokens. (#21969, #22843, #22652, #20237, #21747)
- Reduced remote and Windows cleanup friction with longer exec-server transport timeouts, quieter taskkill cleanup, and non-queued plugin reads. (#21825, #21759, #22058, #22703)
Documentation
- Clarified that general Codex product docs should not be added to this repo, while app-server API docs remain in scope. (#21772)
- Updated plugin-creator guidance for the simplified local plugin handoff links. (#22240)
- Documented new app-server/API contracts for remote environments and the desktop-owned config namespace. (#21323, #22584)
Chores
- Improved CI and release reliability across Rust CI, exact PR-head checkout, Windows Bazel sharding, unsigned macOS artifacts, and signed macOS promotion. (#21604, #21628, #21835, #22408, #22559, #22649, #22737, #22788, #22900)
- Split large TUI ChatWidget, history, and composer code into focused modules without intended behavior changes. (#21866, #22269, #22407, #22433, #22518, #22537, #22704, #22581, #22656)
- Continued extracting extension and tool internals, including shared tool contracts plus guardian and memory extension plumbing. (#21736, #21737, #21738, #22138, #22147, #22216, #22258, #22344, #22476, #22480, #22485, #22498)
- Removed obsolete tool paths, feature flags, config gates, and legacy hooks as defaults stabilized. (#21651, #21805, #22173, #22246, #22565, #22711, #22717, #22724, #22730)
Changelog
Full Changelog: rust-v0.130.0...rust-v0.131.0
- #21550 [codex] make shutdown pending-touch test deterministic @jif-oai
- #21697 Allow string service tiers in config TOML @aibrahim-oai
- #21687 [codex] Enable apply_patch freeform by default @aibrahim-oai
- #19896 Update models.json @github-actions
- #21669 Display blended token count in status line @etraut-openai
- #21677 Show permissions

New Features
- Plugin details now show bundled hooks, and plugin sharing exposes link metadata plus discoverability controls. (#21447, #21495, #21637)
- Added codex remote-control as a simpler entrypoint for starting a headless, remotely controllable app-server. (#21424)
- App-server clients can page large threads with unloaded, summary, or full turn item views. (#21566)
- Bedrock auth can now use AWS console-login credentials from aws login profiles. (#21623)
- view_image can resolve files through the selected environment for multi-environment sessions. (#21143)
Bug Fixes
- Live app-server threads now pick up config changes without requiring a restart. (#21187)
- Turn diffs stay accurate across apply-patch operations, including partial failures that still mutated files. (#21180, #21518)
- Thread summaries, renames, resume, and fork paths work better through ThreadStore, including threads without local rollout paths. (#21264, #21265, #21266)
- Remote compaction now emits response.processed for v2 streams and avoids sending service_tier on API-key compact requests. (#21642, #21676)
- Windows sandbox setup now grants sandbox users access to the desktop runtime binary cache. (#21564)
- Removed stale “research preview” wording from the codex exec startup banner. (#21683)
Documentation
- Fixed issue templates so CLI reports keep the intended guidance, labels apply correctly, and feature requests link to the right contributing docs. (#21685, #21686, #21688)
- Updated install and tooling docs to consistently use cargo install --locked. (#21592)
Chores
- Added a faster Cargo profiling build profile and disabled empty doctest targets to speed up Rust development loops. (#21574, #21584)
- Hardened dependency and CI hygiene with fully qualified GitHub Action pins, a Dependabot cooldown, and a cargo-shear upgrade. (#21436, #21547, #21599)
- Simplified internal surfaces by removing unused device-key APIs, extra skills roots, the remote thread-store implementation, and string-keyed MCP tool maps. (#21487, #21485, #21596, #21454)
- Added configurable OpenTelemetry trace metadata and richer review/feedback analytics for better debugging and triage. (#21556, #18747, #21434, #21498)
Changelog
Full Changelog: rust-v0.129.0...rust-v0.130.0
- #21494 [codex] fix PluginListParams test initializer @xli-oai
- #21447 Show plugin hooks in plugin details @abhinav-oai
- #21356 feat: make built-in MCPs first-class runtime servers @jif-oai
- #21180 Make turn diff tracking operation backed @jif-oai
- #21498 [codex] add account id to feedback uploads @pakrym-oai
- #21487 device-key: clean up unused crate @euroelessar
- #21518 fix: preserve exact turn diffs after partial apply_patch failures @jif-oai
- #18747 [codex-analytics] add tool review event schema @rhan-oai
- #21495 feat: Expose plugin share metadata in shareContext @xl-openai
- #21454 [codex] Remove string-keyed MCP tool maps @pakrym-oai
- #21424 add top-level remote-control command @owenlin0
- #21187 app-server: refresh live threads from latest config snapshot @jif-oai
- #21461 [codex] Move tool specs onto handlers @pakrym-oai
- #21547 Upgrade cargo-shear to 1.11.2 @charliemarsh-oai
- #21264 Move thread name edits to ThreadStore @wiltzius-openai
- #21266 [codex] Fix pathless thread summaries @wiltzius-openai
- #21265 Route ThreadManager rollout path reads through thread store @wiltzius-openai
- #21564 Grant sandbox users access to desktop runtime bin @iceweasel-oai
- #21582 Use descriptive names for Cargo profile options @zanie-oai
- #21574 Add a Cargo build profile for benchmarking @zanie-oai
- #21436 [codex] Fully qualify hash-pins in GitHub Actions @ww-oai
- #21592 Ensure all mentions of cargo-install are --locked @gankra-oai
- #21584 Disable empty Cargo test targets @charliemarsh-oai
- #21566 feat(app-server, threadstore): Thread pagination APIs and ThreadStore contract @owenlin0
- #21556 codex-otel: add configurable trace metadata @bbrown-oai
- #21599 [codex] Apply a Dependabot cooldown of 7 day

New Features
- The TUI now supports modal Vim editing in the composer, including /vim, default-mode config, and Vim-specific keymap contexts. (#18595)
- TUI workflows are easier to resume and copy from with a redesigned resume/fork picker, raw scrollback mode, /ide context injection, and workspace-aware /diff. (#20065, #20819, #20294, #21001)
- The status line can show theme-aware colors plus optional PR and branch-change summaries, and /keymap debug helps inspect terminal key events. (#19631, #20892, #20794)
- Plugin management now supports workspace sharing, share access controls, source filtering, local share path tracking, marketplace removal/upgrades, remote bundle sync, and admin-disabled status handling. (#20278, #21124, #21419, #20560, #19843, #20478, #20268, #20298)
- Hooks can be browsed and toggled from /hooks, can run before/after compaction, and can add PreToolUse context; Codex Apps auth and eligible MCP elicitations now surface through TUI/Guardian flows. (#19882, #19905, #20692, #19193, #19431)
- Experimental goals are now discoverable, stay paused across resume unless the user opts back in, and show clearer validation and multi-day duration output. (#20083, #20790, #20746, #20558)
Bug Fixes
- /copy works better in tmux, Alt+Enter and modified Delete/Backspace keys behave correctly, and Windows typing/paste latency was reduced. (#20207, #20535, #21058, #18914)
- Large paste placeholders and Ctrl+C-stashed drafts now survive clear/editor workflows without corrupting draft history. (#21091, #21190, #21351, #21397)
- TUI startup and accessibility were tightened by bounding terminal probes, clearing the first inline viewport render, and honoring animations = false for live rows. (#20654, #21450, #20564)
- Linux sandbox startup is more reliable across older bwrap, slow mount probes, symlink-protected paths, and shared /tmp setups. (#20628, #20111, #21127, #21234)
- Windows sandbox and exec policy now handle named pipes, ConPTY teardown, PowerShell-wrapped allow rules, worktree safe.directory, and unsafe Git options more reliably. (#20270, #20685, #20336, #21409, #21275)
- Fixed custom CA login behind TLS-inspecting proxies, Bedrock runtime endpoint reporting, dangerous project config keys, heredoc redirect approval matching, and unbounded MCP/hook output growth. (#20676, #20275, #20098, #20113, #20260, #21069)
Documentation
- Updated the embedded OpenAI Docs sample skill so API-key setup guidance stays aligned with other docs variants. (#21263)
- Documented how generated git commit attribution is gated by codex_git_commit and configured in config.toml. (#21379)
- Removed local-only planning/spec docs and redirected config docs toward the maintained external documentation surface. (#20896)
Chores
- Linux releases now build, publish, bundle, and verify a standalone bwrap fallback for npm and DotSlash installs. (#21255, #21256, #21257, #21312, #21285)
- Vendored Bubblewrap was updated to 0.11.2, including upstream security changes around setuid support. (#21389)
- Windows Bazel CI now uses faster cross-compilation for tests, clippy, and release-build checks, and Bazel now runs sharded Rust integration tests. (#20585, #20701, #21057)
- App-server and protocol internals were split and slimmed down, including transport extraction, protocol module decomposition, thread/message history moves, and tool-handler cleanup. (#20324, #20325, #20348, #20545, #21251, #21278, #21395)
- Analytics and diagnostics coverage expanded for tool lifecycles, goals, plugin skills, thread sources, service tiers, and PR issue labeling. (#17089, #17090, #20799, #20923, #20949, #20969, #20893)
Changelog
Full Changelog: rust-v0.128.0...rust-v0.129.0
- #20278 feat: Add workspace plugin sharing APIs @xl-openai
- #20334 Make missing config clears no-ops @etraut-openai
- #20246 Gate multi-agent v2 tools independently of collab @jif-oai
- #20361 realtime: rename provider session ids @aibrahim-oai
- #20260 fix(core): truncate large mcp tool outputs in ro

New Features
- Added persisted /goal workflows with app-server APIs, model tools, runtime continuation, and TUI controls for create, pause, resume, and clear. (#18073, #18074, #18075, #18076, #18077, #20082)
- Added codex update, configurable TUI keymaps, plan-mode nudges, action-required terminal titles, and active-turn /statusline and /title edits. (#19933, #18593, #19901, #18372, #19917)
- Expanded permission profiles with built-in defaults, sandbox CLI profile selection, cwd controls, and active-profile metadata for clients. (#19900, #20117, #20118, #20095)
- Improved plugin workflows with marketplace installation, remote bundle caching, remote uninstall, plugin-bundled hooks, hook enablement state, and external-agent config import. (#18704, #19914, #19456, #19705, #19840, #19949)
- Added external agent session import, including background imports and imported-session title handling. (#19895, #20284, #20261)
- Made MultiAgentV2 configuration more explicit with thread caps, wait-time controls, root/subagent hints, and v2-specific depth handling. (#19360, #19792, #19805, #20052, #20180)
Bug Fixes
- Fixed several resume and interruption issues, including stale interrupt hangs, persisted provider restoration, large remote resume responses, and slow filtered resume lists. (#18392, #19287, #19920, #19591)
- Improved TUI reliability around terminal resize reflow, markdown list spacing, slash-command popup layout, keyboard cleanup, shell-mode escape, and working status updates. (#18575, #19706, #19511, #19625, #19986, #19939)
- Hardened managed network behavior for deferred denials, proxy bypass defaults, resolved target checks, IPv6 host matching, and git -C approval handling. (#19184, #20002, #19999, #19995, #20085)
- Fixed Windows sandbox and PTY edge cases, including pseudoconsole startup, elevated runner process handling, core shell environment inheritance, and named-pipe validation. (#20042, #19211, #20089, #19283)
- Fixed Bedrock model support for apply_patch, GPT-5.4 reasoning levels, and updated Bedrock GPT-5.4 endpoint/model metadata. (#19416, #19461, #20109)
- Fixed MCP/plugin edge cases around stdio server cleanup, plugin MCP approval persistence, and custom MCP metadata isolation. (#19753, #19537, #19836, #19875)
Documentation
- Updated the bundled OpenAI Docs skill for GPT-5.5, gpt-image-2, and clearer upgrade guidance. (#19407, #19443, #19422)
- Clarified contributor-facing docs, including the PR template, Rust async trait guidance, and README wording. (#19912, #20242, #19514)
- Added a checked-in codex-core public API listing and a ThreadManager sample crate. (#20243, #20141)
Chores
- Published codex-app-server release artifacts, stopped publishing GNU Linux binaries, and increased release workflow timeouts. (#19447, #19445, #20271, #20343)
- Added Codex-pinned versioning for the Python app-server SDK package. (#18996)
- Deprecated --full-auto while steering users toward explicit permission profiles and trust flows. (#20133)
- Stabilized CI and release plumbing with Bazel setup migration, release smoke-test pinning, and updated workflow pins/timeouts. (#19851, #19854, #19472, #19609)
Changelog
Full Changelog: rust-v0.125.0...rust-v0.128.0
- #19124 Make MultiAgentV2 interruption markers assistant-authored @jif-oai
- #19354 chore: alias max_concurrent_threads_per_session @jif-oai
- #19360 feat: surface multi-agent thread limit in spawn description @jif-oai
- #19351 Add agents.interrupt_message for interruption markers @jif-oai
- #18392 Fix hang on turn/interrupt @danwang-oai
- #19380 chore: drop MCP Plugins and App from Morpheus @jif-oai
- #18907 respect workspace option for disabling plugins @zamoshchin-openai
- #19283 check PID of named pipe consumer @iceweasel-oai
- #19407 Update bundled OpenAI Docs skill for GPT-5.5 @kkahadze-oai
- #19163 Harden package-manager install policy @mcgrew-oai
- #19416 Fix: use function apply_patch tool for Bedrock model @celia-oai
- #19093 [codex] Omit fork turns from thread started n

New Features
- App-server integrations now support Unix socket transport, pagination-friendly resume/fork, sticky environments, and remote thread config/store plumbing. (#18255, #18892, #18897, #18908, #19008, #19014)
- App-server plugin management can install remote plugins and upgrade configured marketplaces. (#18917, #19074)
- Permission profiles now round-trip across TUI sessions, user turns, MCP sandbox state, shell escalation, and app-server APIs. (#18284, #18285, #18286, #18287, #19231)
- Model providers now own model discovery, with AWS/Bedrock account state exposed to app clients. (#18950, #19048)
- codex exec --json now reports reasoning-token usage for programmatic consumers. (#19308)
- Rollout tracing now records tool, code-mode, session, and multi-agent relationships, with a debug reducer command for inspection. (#18878, #18879, #18880)
Bug Fixes
- Interrupting /review and exiting the TUI no longer leaves the interface wedged on delegate startup or unsubscribe. (#18921)
- Exec-server no longer drops buffered output after process exit and now waits correctly for stream closure. (#18946, #19130)
- App-server now respects explicitly untrusted project config instead of auto-persisting trust. (#18626)
- WebSocket app-server clients are less likely to disconnect during bursts of turn and tool-output notifications. (#19246)
- Windows sandbox startup handles multiple CLI versions and installed app directories better, and background Start-Process calls avoid visible PowerShell windows. (#19044, #19180, #19214)
- Config/schema handling now rejects conflicting MultiAgentV2 thread limits, resolves relative agent-role config paths, hides unsupported MCP bearer-token fields, and rejects invalid js_repl image MIME types. (#19129, #19261, #19294, #19292)
Documentation
- App-server docs and generated schemas were refreshed for the new transport, thread, marketplace, sticky environment, and permission-profile APIs. (#18255, #18897, #19014, #19074, #19231)
- Rollout-trace documentation now covers the debug trace reduction workflow. (#18880)
Chores
- Refreshed models.json and related core, app-server, SDK, and TUI fixtures for the latest model catalog and reasoning defaults. (#19323)
- Windows Bazel CI now uses a stable PATH and shared query startup path for better cache reuse. (#19161, #19232)
- Plugin marketplace add/remove/startup-sync internals moved out of codex-core, and curated plugin cache versions now use short SHAs. (#19099, #19095)
- Reverted a macOS signing entitlement change after it caused alpha startup failures. (#19167, #19350)
- Stabilized flaky approval-popup and plugin MCP tool-discovery tests. (#19178, #19191)
Changelog
Full Changelog: rust-v0.124.0...rust-v0.125.0
- #19129 Reject agents.max_threads with multi_agent_v2 @jif-oai
- #19130 exec-server: wait for close after observed exit @jif-oai
- #19149 Update safety check wording @etraut-openai
- #18284 tui: sync session permission profiles @bolinfest
- #18710 [codex] Fix plugin marketplace help usage @xli-oai
- #19127 feat: drop spawned-agent context instructions @jif-oai
- #18892 Add remote thread config loader protos @rasmusrygaard
- #19014 Add excludeTurns parameter to thread/resume and thread/fork @ddr-oai
- #18882 [codex] Route live thread writes through ThreadStore @wiltzius-openai
- #19008 [codex] Implement remote thread store methods @wiltzius-openai
- #18626 Respect explicit untrusted project config @etraut-openai
- #18255 app-server: add Unix socket transport @euroelessar
- #19167 ci: add macOS keychain entitlements @euroelessar
- #19099 Move marketplace add/remove and startup sync out of core. @xl-openai
- #19168 Use Auto-review wording for fallback rationale @maja-openai
- #18908 Add remote thread config endpoint @rasmusrygaard
- #18285 tui: carry permission profiles on user turns @bolinfest
- #18286 mcp: include permission profiles in sandbox state @bolinfest
- #18878 [rollout_trace] Trace tool and code-mode boundaries @cassirer-openai
- #18287 shell-

New Features
- The TUI now has quick reasoning controls: Alt+, lowers reasoning, Alt+. raises it, and accepted model upgrades now reset reasoning to the new model’s default instead of carrying over stale settings. (#18866, #19085)
- App-server sessions can now manage multiple environments and choose an environment and working directory per turn, which makes multi-workspace and remote setups easier to target precisely. (#18401, #18416)
- Added first-class Amazon Bedrock support for OpenAI-compatible providers, including AWS SigV4 signing and AWS credential-based auth. (#17820)
- Remote plugin marketplaces can now be listed and read directly, with more reliable detail lookups and larger result pages. (#18452, #19079)
- Hooks are now stable, can be configured inline in config.toml and managed requirements.toml, and can observe MCP tools as well as apply_patch and long-running Bash sessions. (#18893, #18385, #18391, #18888, #19012)
- Eligible ChatGPT plans now default to the Fast service tier unless you explicitly opt out. (#19053)
Bug Fixes
- Preserved Cloudflare cookies across approved ChatGPT hosts, reducing auth breakage in HTTP-backed ChatGPT flows. (#17783)
- Fixed remote app-server reliability issues so websocket events keep draining under load and shutdown no longer fails when the remote worker exits during cleanup. (#18932, #18936)
- Fixed permission-mode drift so /permissions changes survive side conversations and updated Full Access state is correctly reflected in MCP approval handling. (#18924, #19033)
- Fixed wait_agent so it returns promptly when mailbox work is already queued instead of waiting for a fresh notification or timing out. (#18968)
- Fixed local stdio MCP launches for relative commands without an explicit cwd, bringing fallback path resolution in line with CLI behavior. (#19031)
- Startup now fails less often on managed config edge cases: unknown feature requirements warn instead of aborting, and cloud-requirements errors are clearer about what failed. (#19038, #19078)
Changelog
Full Changelog: rust-v0.123.0...rust-v0.124.0
- #18870 Load app-server config through ConfigManager @pakrym-oai
- #18866 feat(tui): shortcuts to change reasoning level temporarily @fcoury-oai
- #18430 app-server: implement device key v2 methods @euroelessar
- #18757 fix: fully revert agent identity runtime wiring @efrazer-oai
- #17783 Preserve Cloudfare HTTP cookies in codex @shijie-oai
- #18876 [rollout_trace] Add rollout trace crate @cassirer-openai
- #18401 Support multiple managed environments @starr-openai
- #18797 Allow guardian bare allow output @maja-openai
- #18886 Normalize /statusline & /title items @canvrno-oai
- #18768 [codex] Tighten external migration prompt tests @alexsong-oai
- #18909 Update /statusline and /title snapshots @canvrno-oai
- #18867 sandboxing: materialize cwd-relative permission globs @bolinfest
- #18915 fix: windows snapshot for external_agent_config_migration::tests::prompt_snapshot did not match windows output @bolinfest
- #18416 Add turn-scoped environment selections @starr-openai
- #18391 fix(core): emit hooks for apply_patch edits @fcoury-oai
- #18916 test(core): move prompt debug coverage to integration suite @bolinfest
- #17820 feat: add AWS SigV4 auth for OpenAI-compatible model providers @celia-oai
- #18913 bazel: run wrapped Rust unit test shards @bolinfest
- #18452 feat: Support remote plugin list/read. @xl-openai
- #18936 Fix remote app-server shutdown race @bolinfest
- #18871 refactor: add agent identity crate @efrazer-oai
- #18276 exec-server: carry filesystem sandbox profiles @bolinfest
- #18926 ci: keep argument comment lint checks materialized @bolinfest
- #18935 Keep TUI status surfaces in sync @etraut-openai
- #18923 chore(tui) debug-config guardian_policy_config @dylan-hurd-oai
- #18943 tests: serialize process-heavy Windows CI suites @bolinfest
- #18934 [codex] Clean guardian instructions @dylan-hurd-oai
- #18948 chore: remove unused Bedrock auth lazy loading @celia-oai
- #18277

New Features
- Added a built-in amazon-bedrock model provider with configurable AWS profile support (#18744).
- Added /mcp verbose for full MCP server diagnostics, resources, and resource templates while keeping plain /mcp fast (#18610).
- Made plugin MCP loading accept both mcpServers and top-level server maps in .mcp.json (#18780).
- Improved realtime handoffs so background agents receive transcript deltas and can explicitly stay silent when appropriate (#18597, #18761, #18635).
- Added host-specific remote_sandbox_config requirements for remote environments (#18763).
- Refreshed bundled model metadata, including the current gpt-5.4 default (#18586, #18388, #18719).
Bug Fixes
- Fixed /copy after rollback so it copies the latest visible assistant response, not a pre-rollback response (#18739).
- Queued normal follow-up text submitted while a manual shell command is running, preventing stuck Working states (#18820).
- Fixed Unicode/dead-key input in VS Code WSL terminals by disabling the enhanced keyboard mode there (#18741).
- Prevented stale proxy environment variables from being restored from shell snapshots (#17271).
- Made codex exec inherit root-level shared flags such as sandbox and model options (#18630).
- Removed leaked review prompts from TUI transcripts (#18659).
Documentation
- Added and tightened the Code Review skill instructions used by Codex-driven reviews (#18746, #18818).
- Documented intentional await-across-lock cases and enabled Clippy linting for them (#18423, #18698).
- Updated app-server protocol docs for threadless MCP resource reads and namespaced dynamic tools (#18292, #18413).
Chores
- Fixed high-severity dependency alerts by pinning patched JS and Rust dependencies (#18167).
- Reduced Rust dev build debug-info overhead while preserving useful backtraces (#18844).
- Refreshed generated Python app-server SDK types from the current schema (#18862).
Changelog
Full Changelog: rust-v0.122.0...rust-v0.123.0
- #18662 feat: add metric to track the number of turns with memory usage @jif-oai
- #18659 chore: drop review prompt from TUI UX @jif-oai
- #18661 feat: log client use min log level @jif-oai
- #18094 [codex] Use background agent task auth for backend calls @adrian-openai
- #18441 Avoid false shell snapshot cleanup warnings @etraut-openai
- #18260 [codex] Use background task auth for additional backend calls @adrian-openai
- #18657 fix: auth.json leak in tests @jif-oai
- #18610 Add verbose diagnostics for /mcp @etraut-openai
- #18633 Use app server thread names in TUI picker @etraut-openai
- #18591 Surface parent thread status in side conversations @etraut-openai
- #18361 codex: move thread/name/set and thread/memoryModeSet into ThreadStore @wiltzius-openai
- #18274 protocol: canonicalize file system permissions @bolinfest
- #18403 refactor: use semaphores for async serialization gates @bolinfest
- #18586 Update models.json @aibrahim-oai
- #18289 Wire the PatchUpdated events through app_server @akshaynathan
- #18631 Remove simple TUI legacy_core reexports @etraut-openai
- #18697 [codex] Fix agent identity auth test fixture @adrian-openai
- #18388 Update models.json @github-actions
- #18167 [codex] Fix high severity dependency alerts @caseysilver-oai
- #17692 [codex-analytics] guardian review analytics schema polishing @rhan-oai
- #18722 chore(guardian) disable mcps and plugins @dylan-hurd-oai
- #18597 Update realtime handoff transcript handling @guinness-oai
- #18627 Surface TUI skills refresh failures @etraut-openai
- #18719 Fix stale model test fixtures @aibrahim-oai
- #18714 Add experimental remote thread store config @wiltzius-openai
- #18739 fix(tui): keep /copy aligned with rollback @fcoury-oai
- #18701 [codex] prefer inherited spawn agent model @tibo-openai
- #18632 Use app server metadata for fork parent titles @etraut-openai
- #18112 feat: cascade thread archive @jif-oai
- #18716 Read conversation summaries through thread store @wiltzius-openai
- #18635 Add realtime silence tool @guinness-oai

New Features
- Standalone installs are more self-contained, and codex app now opens or installs Desktop correctly on Windows and Intel Macs (#17022, #18500).
- The TUI can open /side conversations for quick side questions, and queued input now supports slash commands and ! shell prompts while work is running (#18190, #18542).
- Plan Mode can start implementation in a fresh context, with context-usage shown before deciding whether to carry the planning thread forward (#17499, #18573).
- Plugin workflows now include tabbed browsing, inline enable/disable toggles, marketplace removal, and remote, cross-repo, or local marketplace sources (#18222, #18395, #17752, #17751, #17277, #18017, #18246).
- Filesystem permissions now support deny-read glob policies, managed deny-read requirements, platform sandbox enforcement, and isolated codex exec runs that ignore user config or rules (#15979, #17740, #18096, #18646).
- Tool discovery and image generation are now enabled by default, with higher-detail image handling and original-detail metadata support for MCP and js_repl image outputs (#17854, #17153, #17714, #18386).
Bug Fixes
- App-server approvals, user-input prompts, and MCP elicitations now disappear from the TUI when another client resolves them, instead of leaving stale prompts behind (#15134).
- Remote-control startup now tolerates missing ChatGPT auth, and MCP startup cancellation works again through app-server sessions (#18117, #18078).
- Resumed and forked app-server threads now replay token usage immediately so context/status UI starts with the restored state (#18023).
- Security-sensitive flows were tightened: logout revokes managed ChatGPT tokens, project hooks and exec policies require trusted workspaces, and Windows sandbox setup avoids broad user-profile and SSH-root grants (#17825, #14718, #18443, #18493).
- Sandboxed apply_patch writes work correctly with split filesystem policies, and file watchers now notice files created after watching begins (#18296, #18492).
- Several TUI rough edges were fixed, including fatal skills-list failures, invalid resume hints, duplicate context statusline entries, /model menu loops, redundant memory notices, and terminal title quoting in iTerm2 (#18061, #18059, #18054, #18154, #18580, #18261).
Documentation
- Added a security-boundaries reference to SECURITY.md for sandboxing, approvals, and network controls (#17848, #18004).
- Documented custom MCP server approval defaults and exec-server stdin behavior (#17843, #18086).
- Updated app-server docs for plugin API changes, marketplace removal, resume/fork token-usage replay, and warning notifications (#17277, #17751, #18023, #18298).
- Added a short guide for the responses API proxy (#18604).
Chores
- Split plugin and marketplace code into codex-core-plugins, moved more connector code into connectors, and continued breaking up the large core session/turn modules (#18070, #18158, #18200, #18206, #18244, #18249).
- Refactored config loading and AGENTS.md discovery behind narrower filesystem and manager abstractions (#18209, #18035).
- Stabilized Bazel and CI with flake fixes, native Rust test sharding, scoped repository caches, stronger Windows clippy coverage, and updated rules_rs/LLVM pins (#17791, #18082, #18366, #18350, #18397).
- Added core CODEOWNERS and a smaller development build profile (#18362, #18612).
- Removed the stale core models.json and updated release preparation to refresh the active model catalog (#18585).
Changelog
Full Changelog: rust-v0.121.0...rust-v0.122.0
- #17958 Support remote compaction for Azure responses providers @ivanmurashko
- #17848 [docs] Add security boundaries reference in SECURITY.md @evawong-oai
- #17990 Auto install start-codex-exec.sh dependencies @pakrym-oai
- #17892 Migrate archive/unarchive to local ThreadStore @wiltzius-openai
- #17989 [codex] Restore remote exec-server filesystem tests @starr-openai
- #15134 Dismiss stale app-server requests after remote resolution @ebrevdo
- #18002 Re-enable i

New Features
- Added codex marketplace add and app-server support for installing plugin marketplaces from GitHub, git URLs, local directories, and direct marketplace.json URLs (#17087, #17717, #17756).
- Added TUI prompt history improvements, including Ctrl+R reverse search and local recall for accepted slash commands (#17550, #17336).
- Added TUI and app-server controls for memory mode, memory reset/deletion, and memory-extension cleanup (#17632, #17626, #17913, #17937, #17844).
- Expanded MCP/plugin support with MCP Apps tool calls, namespaced MCP registration, parallel-call opt-in, and sandbox-state metadata for MCP servers (#17364, #17404, #17667, #17763).
- Added realtime and app-server APIs for output modality, transcript completion events, raw turn item injection, and symlink-aware filesystem metadata (#17701, #17703, #17719).
- Added a secure devcontainer profile with bubblewrap support, plus macOS sandbox allowlists for Unix sockets (#10431, #17547, #17654).
Bug Fixes
- Fixed macOS sandbox/proxy handling for private DNS and removed the danger-full-access denylist-only network mode (#17370, #17732).
- Fixed Windows cwd/session matching so resume --last and thread/list work when paths use verbatim prefixes (#17414).
- Fixed rate-limit/account handling for prolite plans and made unknown WHAM plan values decodable (#17419).
- Made Guardian timeouts distinct from policy denials, with timeout-specific guidance and visible TUI history entries (#17381, #17486, #17521, #17557).
- Stabilized app-server behavior by avoiding premature thread unloads, tolerating failed trust persistence on startup, and skipping broken symlinks in fs/readDirectory (#17398, #17595, #17907).
- Fixed MCP/tool-call edge cases including flattened deferred tool names, elicitation timeout accounting, and empty namespace descriptions (#17556, #17566, #17946).
Documentation
- Documented the secure devcontainer profile and its bubblewrap requirements (#10431, #17547).
- Added TUI composer documentation for history search behavior (#17550).
- Updated app-server docs for new MCP, marketplace, turn injection, memory reset, filesystem metadata, external-agent migration, and websocket token-hash APIs (#17364, #17717, #17703, #17913, #17719, #17855, #17871).
- Documented WSL1 bubblewrap limitations and WSL2 behavior (#17559).
- Added memory pipeline documentation for extension cleanup (#17844).
Chores
- Hardened supply-chain and CI inputs by pinning GitHub Actions, cargo installs, git dependencies, V8 checksums, and cargo-deny source allowlists (#17471).
- Added Bazel release-build verification so release-only Rust code is compiled in PR CI (#17704, #17705).
- Introduced the codex-thread-store crate/interface and moved local thread listing behind it (#17659, #17824).
- Required reviewed pnpm dependency build scripts for workspace installs (#17558).
- Reduced Rust maintenance surface with broader absolute-path types and removal of unused helper APIs (#17407, #17792, #17146).
Changelog
Full Changelog: rust-v0.120.0...rust-v0.121.0
- #17087 Add marketplace command @xli-oai
- #17409 Fix Windows exec-server output test flake @etraut-openai
- #17381 representing guardian review timeouts in protocol types @won-openai
- #17399 TUI: enforce core boundary @etraut-openai
- #17370 fix: unblock private DNS in macOS sandbox @viyatb-oai
- #17396 update cloud requirements parse failure msg @alexsong-oai
- #17364 [mcp] Support MCP Apps part 3 - Add mcp tool call support. @mzeng-openai
- #17424 Stabilize marketplace add local source test @ningyi-oai
- #17414 Fix thread/list cwd filtering for Windows verbatim paths @etraut-openai
- #10431 feat(devcontainer): add separate secure customer profile @viyatb-oai
- #17314 Pass turn id with feedback uploads @ningyi-oai
- #17336 fix(tui): recall accepted slash commands locally @fcoury-oai
- #17430 Handle closed TUI input stream as shutdown @etraut-openai
- #17385 Add use_agent_identity feature flag @adrian-openai
- #17483 Update issue labele

New Features
- Realtime V2 can now stream background agent progress while work is still running and queue follow-up responses until the active response completes (#17264, #17306)
- Hook activity in the TUI is easier to scan, with live running hooks shown separately and completed hook output kept only when useful (#17266)
- Custom TUI status lines can include the renamed thread title (#17187)
- Code-mode tool declarations now include MCP outputSchema details so structured tool results are typed more precisely (#17210)
- SessionStart hooks can distinguish sessions created by /clear from fresh startup or resume sessions (#17073)
Bug Fixes
- Fixed Windows elevated sandbox handling for split filesystem policies, including read-only carveouts under writable roots (#14568)
- Fixed sandbox permission handling for symlinked writable roots and carveouts, preventing failures in shell and apply_patch workflows (#15981)
- Fixed codex --remote wss://... panics by installing the Rustls crypto provider before TLS websocket connections (#17288)
- Preserved tool search result ordering instead of alphabetically reordering results (#17263)
- Fixed live Stop-hook prompts so they appear immediately instead of only after thread history reloads (#17189)
- Fixed app-server MCP cleanup on disconnect so unsubscribed threads and resources are torn down correctly (#17223)
Documentation
- Documented the elevated vs restricted-token Windows sandbox support split in the core README (#14568)
- Updated app-server protocol documentation for the new /clear SessionStart source (#17073)
Chores
- Made rollout recording more reliable by retrying failed flushes and surfacing durability failures instead of dropping buffered items (#17214)
- Added analytics schemas and metadata wiring for compaction and Guardian review events (#17155, #17055)
- Improved Guardian follow-up efficiency by sending transcript deltas instead of repeatedly resending full history (#17269)
- Added stable Guardian review IDs across app-server events and internal approval state (#17298)
Changelog
Full Changelog: rust-v0.119.0...rust-v0.120.0
- #17268 remove windows gate that disables hooks @iceweasel-oai
- #17267 Stop Realtime V2 response.done delegation @aibrahim-oai
- #14568 fix: support split carveouts in windows elevated sandbox @viyatb-oai
- #17263 preserve search results order in tool_search_output @sayan-oai
- #17189 Emit live hook prompts before raw-event filtering @abhinav-oai
- #17288 Install rustls provider for remote websocket client @etraut-openai
- #16969 Option to Notify Workspace Owner When Usage Limit is Reached @richardopenai
- #17278 Rename Realtime V2 tool to background_agent @aibrahim-oai
- #17280 Extract realtime input task handlers @aibrahim-oai
- #17249 adding parent_thread_id in guardian @won-openai
- #17264 Stream Realtime V2 background agent progress @aibrahim-oai
- #17210 Add output_schema to code mode render @vivi
- #16344 feat: move exec-server ownership @jif-oai
- #17214 feat: make rollout recorder reliable against errors @jif-oai
- #17223 fix: MCP leaks in app-server @jif-oai
- #17338 feat: description multi-agent v2 @jif-oai
- #17269 feat(guardian): send only transcript deltas on guardian followups @owenlin0
- #17306 Queue Realtime V2 response.create while active @aibrahim-oai
- #17352 fix: main @jif-oai
- #17363 Strengthen realtime backend delegation prompt @aibrahim-oai
- #17155 [codex-analytics] add compaction analytics event @rhan-oai
- #17187 Add thread title to configurable TUI status line @canvrno-oai
- #17194 add parent-id to guardian context @won-openai
- #17266 [codex] Improve hook status rendering @abhinav-oai
- #17073 Support clear SessionStart source @abhinav-oai
- #17298 fix(guardian, app-server): introduce guardian review ids @owenlin0
- #17391 Revert "Option to Notify Workspace Owner When Usage Limit is Reached" @shijie-oai
- #17371 app-server: add pipelined config rpc regression test @euroelessar
- #15981 fix(permissions): fix symlinked writable r

New Features
- Realtime voice sessions now default to the v2 WebRTC path, with configurable transport, voice selection, native TUI media support, and app-server coverage for the new flow (#16960, #17057, #17058, #17093, #17097, #17145, #17165, #17176, #17183, #17188).
- MCP Apps and custom MCP servers gained richer support, including resource reads, tool-call metadata, custom-server tool search, server-driven elicitations, file-parameter uploads, and more reliable plugin cache refreshes (#16082, #16465, #16944, #17043, #15197, #16191, #16947).
- Remote/app-server workflows now support egress websocket transport, remote --cd forwarding, runtime remote-control enablement, sandbox-aware filesystem APIs, and an experimental codex exec-server subcommand (#15951, #16700, #16973, #16751, #17059, #17142, #17162).
- The TUI can copy the latest agent response with Ctrl+O, including better clipboard behavior over SSH and across platforms (#16966).
- /resume can now jump directly to a session by ID or name from the TUI (#17222).
- TUI notifications are more configurable, including Warp OSC 9 support and an opt-in mode for notifications even while the terminal is focused (#17174, #17175).
Bug Fixes
- The TUI starts faster by fetching rate limits asynchronously, and /status now refreshes stale limits instead of showing frozen or misleading quota information (#16201, #17039).
- Resume flows are more stable: the picker no longer flashes false empty states, uses fresher thread names, stabilizes timestamp labels, preserves resume hints on zero-token exits, and avoids crashing when resuming the current thread (#16591, #16601, #16822, #16987, #17086).
- Composer and chat behavior are smoother, including fixed paste teardown, CJK word navigation, stale /copy output, percent-decoded local file links, and clearer truncated exec-output hints (#16202, #16829, #16648, #16810, #17076).
- Fast Mode no longer stays stuck on after /fast off in app-server-backed TUI sessions (#16833).
- MCP status and startup are less noisy and faster: hyphenated server names list tools correctly, /mcp avoids slow full inventory probes, disabled servers skip auth probing, and residency headers are honored by codex mcp-server (#16674, #16831, #17098, #16952).
- Sandbox, network, and platform edge cases were tightened, including clearer read-only apply_patch errors, refreshed network proxy policy after sandbox changes, suppressed irrelevant bubblewrap warnings, a macOS HTTP-client sandbox panic fix, and Windows firewall address handling (#16885, #17040, #16667, #16670, #17053).
Documentation
- The README now uses the current ChatGPT Business plan name (#16348).
- Developer guidance for argument_comment_lint was updated to favor getting CI started instead of blocking on slow local lint runs (#16375).
- Obsolete codex-cli README content was removed to avoid stale setup guidance (#17096).
- codex exec --help now shows clearer usage and approval-mode wording (#16881, #16888).
Chores
- codex-core was slimmed down through major crate extractions for MCP, tools, config, model management, auth, feedback, protocol, and related ownership boundaries (#15919, #16379, #16508, #16523, #16962).
- Rust CI and workspace guardrails were simplified by blocking new crate features and dropping routine --all-features runs (#16455, #16473).
- Core compile times were reduced by removing expensive async-trait expansion from hot tool/task abstractions (#16630, #16631).
- Bazel diagnostics and dependency wiring improved with compact execution logs, repository-cache persistence, remote downloader support, and several platform-specific build fixes (#16577, #16926, #16928, #16634, #16744).
Changelog
Full Changelog: rust-v0.118.0...rust-v0.119.0
- #16308 fix: one shot end of turn @jif-oai
- #16238 fix: ma2 @jif-oai
- #16317 chore: clean wait v2 @jif-oai
- #16318 nit: update aborted line @jif-oai
- #15771 feat: fork pattern v2 @jif-oai
- #16322 fix: update fork boundaries computation @jif-oai
- #16325 feat:

New Features
- Windows sandbox runs can now enforce proxy-only networking with OS-level egress rules, instead of relying on environment variables alone. (#12220)
- App-server clients can now start ChatGPT sign-in with a device code flow, which helps when browser callback login is unreliable or unavailable. (#15525)
- codex exec now supports the prompt-plus-stdin workflow, so you can pipe input and still pass a separate prompt on the command line. (#15917)
- Custom model providers can now fetch and refresh short-lived bearer tokens dynamically, instead of being limited to static credentials from config or environment variables. (#16286, #16287, #16288)
Bug Fixes
- Project-local .codex files are now protected even on first creation, closing a gap where the initial write could bypass normal approval checks. (#15067)
- Linux sandbox launches are more reliable because Codex once again finds a trusted system bwrap on normal multi-entry PATHs. (#15791, #15973)
- The app-server-backed TUI regained several missing workflows: hook notifications replay correctly, /copy and /resume <name> work again, /agent no longer shows stale threads, and the skills picker scrolls past the first page. (#16013, #16021, #16050, #16014, #16109, #16110)
- MCP startup is more robust: local servers get a longer startup window, and failed handshakes surface warnings in the TUI again instead of looking like clean startups. (#16080, #16041)
- On Windows, apply_patch is less likely to fail because it no longer adds redundant writable roots that could trigger unnecessary ACL churn. (#16030)
Changelog
Full Changelog: rust-v0.117.0...rust-v0.118.0
- #15891 [plugins] Polish tool suggest prompts. @mzeng-openai
- #15791 fix: resolve bwrap from trusted PATH entry @viyatb-oai
- #15900 skills: remove unused skill permission metadata @bolinfest
- #15811 app-server: Split transport module @euroelessar
- #15067 Protect first-time project .codex creation across Linux and macOS sandboxes @rreichel3-oai
- #15903 [codex] import token_data from codex-login directly @bolinfest
- #15897 sandboxing: use OsString for SandboxCommand.program @bolinfest
- #15910 docs: update AGENTS.md to discourage adding code to codex-core @bolinfest
- #15898 chore: move bwrap config helpers into dedicated module @viyatb-oai
- #15906 chore: remove skill metadata from command approval payloads @bolinfest
- #15909 fix(network-proxy): fail closed on network-proxy DNS lookup errors @viyatb-oai
- #14495 Preserve bazel repository cache in github actions @siggisim
- #15522 bazel: re-organize bazelrc @sluongng
- #15923 codex-tools: extract shared tool schema parsing @bolinfest
- #15918 permissions: remove macOS seatbelt extension profiles @bolinfest
- #12220 feat(windows-sandbox): add network proxy support @viyatb-oai
- #15931 fix: make MACOS_DEFAULT_PREFERENCES_POLICY part of MACOS_SEATBELT_BASE_POLICY @bolinfest
- #15933 fix: use matrix.target instead of matrix.os for actions/cache build action @bolinfest
- #15928 codex-tools: extract MCP schema adapters @bolinfest
- #15948 fix: increase timeout for rust-ci to 45 minutes for now @bolinfest
- #15921 [app-server-protocol] introduce generic ClientResponse for app-server-protocol @rhan-oai
- #15120 chore: refactor network permissions to use explicit domain and unix socket rule maps @celia-oai
- #15525 Add ChatGPT device-code login to app server @daniel-oai
- #15876 chore: drop useless stuff @jif-oai
- #15954 chore: move pty and windows sandbox to Rust 2024 @bolinfest
- #15986 feat: spawn v2 make task name as mandatory @jif-oai
- #16000 Use codex-utils-template for login error page @jif-oai
- #16001 Use codex-utils-template for review prompts @jif-oai
- #15998 Use codex-utils-template for sandbox mode prompts @jif-oai
- #15995 Use codex-utils-template for collaboration mode presets @jif-oai
- #15996 Use codex-utils-template for search tool descriptions @jif-oai
- #15999 Use codex-utils-template for review exit XML @jif-oai
- #15985 feat: spawn v2 as inter agent 

New Features
- Plugins are now a first-class workflow: Codex can sync product-scoped plugins at startup, browse them in /plugins, and install or remove them with clearer auth/setup handling. (#15041, #15042, #15195, #15215, #15217, #15264, #15275, #15342, #15580, #15606, #15802)
- Sub-agents now use readable path-based addresses like /root/agent_a, with structured inter-agent messaging and agent listing for multi-agent v2 workflows. (#15313, #15515, #15556, #15570, #15621, #15647)
- The /title terminal-title picker now works in both the classic TUI and the app-server TUI, making parallel sessions easier to tell apart. (#12334, #15860)
- App-server clients can now send ! shell commands, watch filesystem changes, and connect to remote websocket servers with bearer-token auth. (#14988, #14533, #14847, #14853)
- Image workflows got smoother: view_image now returns image URLs for code mode, generated images are reopenable from the TUI, and image-generation history survives resume. (#15072, #15154, #15223)
- Prompt history recall now works in the app-server TUI, including across sessions. (#14945)
Bug Fixes
- tui_app_server no longer duplicates live reasoning summaries or /review output, and it preserves transcript text instead of dropping it under backpressure. (#15758, #15839, #15759)
- ChatGPT login in tui_app_server now opens the local browser again, cancels cleanly on Ctrl+C, and no longer fails startup when you're logged out. (#15672, #15673, #15670)
- Early exits now restore terminal state reliably, avoiding broken shell state after quitting; tmux users also get a working queued-message edit shortcut on Shift+Left. (#15671, #15480)
- Linux sandboxed tool calls are more reliable on older distributions with older bubblewrap, and Windows restricted-token sandboxing now supports more split-policy carveout layouts. (#15693, #14172)
- Remote multi-agent sessions now show agent names instead of raw IDs and recover more gracefully from stale turn-steering races. (#15513, #15714, #15163)
- Plugin-backed mentions and product gating now behave more predictably, fixing cases where explicit mentions lost context or plugins were filtered incorrectly. (#15372, #15263, #15279)
Documentation
- Expanded the app-server and exec-server docs/schema fixtures to cover exec-server setup, filesystem watch RPCs, realtime transcript notifications, and the new Python thread.run(...) quickstart flow. (#15089, #14533, #15344, #15088)
Chores
- The app-server-backed TUI is now enabled by default, and the plugin/app rollout flags have been flipped on in normal builds. (#15661, #15713, #15719, #15820)
- Removed the legacy artifact tool and retired the old read_file and grep_files handlers as part of ongoing tool-surface cleanup. (#15851, #15864, #15773, #15775)
Changelog
Full Changelog: rust-v0.116.0...rust-v0.117.0
- #14945 feat(tui): restore composer history in app-server tui @fcoury
- #15092 fix: try to fix "Stage npm package" step in ci.yml @bolinfest
- #15075 Propagate tool errors to code mode @pakrym-oai
- #15072 Return image URL from view_image tool @pakrym-oai
- #15076 Add a startup deprecation warning for custom prompts @etraut-openai
- #15102 Revert "fix: harden plugin feature gating" @xl-openai
- #15077 Add final message prefix to realtime handoff output @aibrahim-oai
- #13494 Align SQLite feedback logs with feedback formatter @charley-oai
- #14888 Feat: reuse persisted model and reasoning effort on thread resume @shijie-oai
- #15111 don't add transcript for v2 realtime @aibrahim-oai
- #15103 Add update_plan code mode result @pakrym-oai
- #15100 Add apply_patch code mode result @pakrym-oai
- #15104 fix: harden plugin feature gating @xl-openai
- #15089 Add exec-server stub server and protocol docs @starr-openai
- #15042 Support featured plugins @alexsong-oai
- #15088 Add Python SDK thread.run convenience methods @shaqayeq-oai
- #15119 Remove stdio transport from exec server @pakrym-oai
- #14632 feat(core, tracing): create turn spans over websockets 

New Features
- App-server TUI now supports device-code ChatGPT sign-in during onboarding and can refresh existing ChatGPT tokens. (#14952)
- Plugin setup is smoother: Codex can prompt to install missing plugins or connectors, honor a configured suggestion allowlist, and sync install/uninstall state remotely. (#14896, #15022, #14878)
- Added a userpromptsubmit hook so prompts can be blocked or augmented before execution and before they enter history. (#14626)
- Realtime sessions now start with recent thread context and are less likely to self-interrupt during audio playback. (#14829, #14827)
Bug Fixes
- Fixed a first-turn stall where websocket prewarm could delay turn/start; startup now times out and falls back cleanly. (#14838)
- Restored conversation history for remote resume/fork in the app-server TUI and stopped duplicate live transcript output from legacy stream events. (#14930, #14892)
- Improved Linux sandbox startup on symlinked checkouts, missing writable roots, and Ubuntu/AppArmor hosts by preferring system bwrap when available. (#14849, #14890, #14963)
- Fixed an agent job finalization race and reduced status polling churn for worker threads. (#14843)
Documentation
- Refreshed the Python SDK public API docs, examples, and walkthrough around the generated app-server models. (#14446)
Chores
- Pinned the setup-zig GitHub Action to an immutable SHA for more reproducible CI. (#14858)
Changelog
Full Changelog: rust-v0.115.0...rust-v0.116.0
- #14717 Move TUI on top of app server (parallel code) @etraut-openai
- #14665 Use request permission profile in app server @mousseau-oai
- #14826 Fixed build failures related to PR 14717 @etraut-openai
- #14833 fix(core): fix sanitize name to use '_' everywhere @apanasenko-oai
- #14268 memories: exclude AGENTS and skills from stage1 input @andi-oai
- #14139 windows-sandbox: add runner IPC foundation for future unified_exec @iceweasel-oai
- #14851 Add exit helper to code mode scripts @pakrym-oai
- #14828 [stack 1/4] Split realtime websocket methods by version @aibrahim-oai
- #14652 Apply argument comment lint across codex-rs @bolinfest
- #14837 skill-creator: default new skills to ~/.codex/skills @xl-openai
- #14861 Add marketplace display names to plugin/list @xl-openai
- #14878 feat: support remote_sync for plugin install/uninstall. @xl-openai
- #14830 [stack 2/4] Align main realtime v2 wire and runtime flow @aibrahim-oai
- #14886 fix: align marketplace display name with existing interface conventions @xl-openai
- #14881 [codex] add Jason as a predefined subagent name @tibo-openai
- #14864 fix: tighten up shell arg quoting in GitHub workflows @bolinfest
- #14829 [stack 3/4] Add current thread context to realtime startup @aibrahim-oai
- #14827 [stack 4/4] Reduce realtime self-interruptions during playback @aibrahim-oai
- #14849 fix: canonicalize symlinked Linux sandbox cwd @viyatb-oai
- #14892 Fix tui_app_server: ignore duplicate legacy stream events @etraut-openai
- #14899 Revert tui code so it does not rely on in-process app server @etraut-openai
- #14890 fix(linux-sandbox): ignore missing writable roots @viyatb-oai
- #14920 feat: centralize package manager version @jif-oai
- #14935 feat: rename to get more explicit close agent @jif-oai
- #14843 Fix agent jobs finalization race and reduce status polling churn @daveaitel-openai
- #14944 feat: show effective model in spawn agent event @jif-oai
- #14838 fix(core): prevent hanging turn/start due to websocket warming issues @owenlin0
- #14859 Feat: CXA-1831 Persist latest model and reasoning effort in sqlite @shijie-oai
- #14930 fix(tui): restore remote resume and fork history @fcoury
- #14955 Fix fuzzy search notification buffering in app-server tests @aibrahim-oai
- #14938 feat: add suffix to shell snapshot name @jif-oai
- #14959 Fix code mode yield startup race @aibrahim-oai
- #14434 generate an internal json schema for RolloutLine @keyz
- #14846 use framed IPC for elevated command runner @iceweasel-oai
- #14952 Add device-code onboardi

New Features
- Supported models can now request full-resolution image inspection through both view_image and codex.emitImage(..., detail: "original"), which helps with precision visual tasks. (#14175)
- js_repl now exposes codex.cwd and codex.homeDir, and saved codex.tool(...) / codex.emitImage(...) references keep working across cells. (#14385, #14503)
- Realtime websocket sessions gained a dedicated transcription mode, plus v2 handoff support through the codex tool, with a unified [realtime] session config. (#14554, #14556, #14606)
- The v2 app-server now exposes filesystem RPCs for file reads, writes, copies, directory operations, and path watching, and there is a new Python SDK for integrating with that API. (#14245, #14435)
- Smart Approvals can now route review requests through a guardian subagent in core, app-server, and TUI, reducing repeated setup work on follow-up approvals. (#13860, #14668)
- App integrations now use the Responses API tool-search flow, can suggest missing tools, and fall back cleanly when the active model does not support search-based lookup. (#14274, #14287, #14732)
Bug Fixes
- Spawned subagents now inherit sandbox and network rules more reliably, including project-profile layering, persisted host approvals, and symlinked writable roots. (#14619, #14650, #14674, #14807)
- js_repl no longer hangs when dynamic tool responses contain literal U+2028 or U+2029 characters. (#14421)
- The TUI no longer stalls on exit after creating subagents, and interrupting a turn no longer tears down background terminals by default. (#14816, #14602)
- codex exec --profile once again preserves profile-scoped settings when starting or resuming a thread. (#14524)
- MCP and elicitation flows are more robust, with safer tool-name normalization and preserved tool_params in approval prompts. (#14491, #14605, #14769)
- The local network proxy now serves CONNECT traffic as explicit HTTP/1, improving compatibility with HTTP proxy clients. (#14395)
Chores
- The subagent wait tool is now consistently named wait_agent, aligning it with spawn_agent and send_input. (#14631)
Changelog
Full Changelog: rust-v0.114.0...rust-v0.115.0
- #14395 fix(network-proxy): serve HTTP proxy listener as HTTP/1 @viyatb-oai
- #14385 Add js_repl cwd and homeDir helpers @fjord-oai
- #14376 Keep agent-switch word-motion keys out of draft editing @joshka-oai
- #14175 Let models opt into original image detail @fjord-oai
- #14382 check for large binaries in CI @owenlin0
- #14392 chore(app-server): stop emitting codex/event/ notifications @owenlin0
- #14274 feat: search_tool migrate to bring you own tool of Responses API @apanasenko-oai
- #14174 refactor: centralize filesystem permissions precedence @viyatb-oai
- #14394 chore(app-server): delete unused rpc methods from v1.rs @owenlin0
- #14171 fix: align core approvals with split sandbox policies @viyatb-oai
- #14410 Make collab model metadata accurate on completion @aibrahim-oai
- #14387 feat(app-server): propagate traces across tasks and core ops @owenlin0
- #14407 chore: use AVAILABLE and ON_INSTALL as default plugin install and auth policies @sayan-oai
- #14287 [apps] Add tool_suggest tool. @mzeng-openai
- #14432 Clarify spawn agent authorization @aibrahim-oai
- #14295 Support waiting for code_mode sessions @pakrym-oai
- #14427 feat: refactor on openai-curated plugins. @xl-openai
- #13996 refactor: make bubblewrap the default Linux sandbox @viyatb-oai
- #14440 fix: follow up on linux sandbox review nits @viyatb-oai
- #14431 Handle pre-approved permissions in zsh fork @mousseau-oai
- #14403 [elicitation] User-friendly tool call messages. @mzeng-openai
- #14429 Use granted permissions when invoking apply_patch @mousseau-oai
- #14471 Updated out-of-date tip about availability on free and go plans @etraut-openai
- #14444 fix: move inline codex-rs/core unit tests into sibling files @bolinfest
- #14437 Dispatch tools when code mode is not awaited directly @pakrym-oai
- #14435 Add Python app-server SDK @shaqayeq-

New Features
- Added an experimental code mode for more isolated coding workflows. (#13418)
- Added an experimental hooks engine with SessionStart and Stop hook events. (#13276)
- WebSocket app-server deployments now expose GET /readyz and GET /healthz on the same listener for easier health checks. (#13782)
- Added a config switch to disable bundled system skills entirely. (#13792)
- Handoffs now carry realtime transcript context, which improves continuity when work is transferred between turns. (#14132)
- Improved the $ mention picker by clearly labeling Skills, Apps, and Plugins, and by surfacing plugins first. (#14147, #14163)
Bug Fixes
- Fixed a Linux tmux crash caused by concurrent user-shell lookups. (#13900)
- Fixed apps being enabled in unsupported sessions by tightening the enablement check. (#14011)
- Fixed reopened threads getting stuck as in-progress after quitting mid-run and then resuming later. (#14125)
- Fixed permission handling so legacy workspace-write behavior is preserved and newer permission profiles degrade more safely on older builds. (#13957, #14107)
- Fixed approval flows so granted permissions persist across turns, work with reject-style configs, and are honored by apply_patch. (#14009, #14055, #14118, #14165)
Chores
- Laid the groundwork for the Python SDK’s generated v2 schema types and pinned platform-specific runtime binaries. (#13953)
Changelog
- #14009 feat(core) Persist request_permission data across turns @dylan-hurd-oai
- #14136 fix(core): use dedicated types for responsesapi web search tool config @owenlin0
- #13782 codex-rs/app-server: add health endpoints for --listen websocket server @maxj-oai
- #14055 fix(core) RequestPermissions + ApplyPatch @dylan-hurd-oai
- #14118 feat(approvals) RejectConfig for request_permissions @dylan-hurd-oai
- #13957 fix(protocol): preserve legacy workspace-write semantics @viyatb-oai
- #14107 fix: keep permissions profiles forward compatible @viyatb-oai
- #14147 make dollar-mention always clarify item category (skill, app, plugin) @sayan-oai
- #14152 Refactor tool output into trait implementations @pakrym-oai
- #14163 sort plugins first in menu @sayan-oai
- #13418 Add code_mode experimental feature @pakrym-oai
- #13276 start of hooks engine @eternal-openai
- #14135 tui: only show fast status for gpt-5.4 @pash-openai
- #14157 Enforce single tool output type in codex handlers @pakrym-oai
- #14165 fix(core) default RejectConfig.request_permissions @dylan-hurd-oai
- #14167 Export tools module into code mode runner @pakrym-oai
- #13792 feat: support disabling bundled system skills @xl-openai
- #14169 Move exec command truncation into ExecCommandToolOutput @pakrym-oai
- #14011 [apps] Fix apps enablement condition. @mzeng-openai
- #14000 Delay pending cleanup until task aborts @aibrahim-oai
- #12296 Implemented thread-level atomic elicitation counter for stopwatch pausing @cconger
- #14132 Use realtime transcript for handoff context @aibrahim-oai
- #13879 Stabilize incomplete SSE retry test @aibrahim-oai
- #14184 Fix unified exec test output assertion @aibrahim-oai
- #14002 Stabilize websocket test server binding @aibrahim-oai
- #13939 Stabilize app-server notify initialize test @aibrahim-oai
- #13953 python-sdk: generated type foundation (all v2 schemas) @shaqayeq-oai
- #13603 Fix release-mode integration test compiler failure @etraut-openai
- #13900 Fix Linux tmux segfault in user shell lookup @etraut-openai
- #13901 Log ChatGPT user ID for feedback tags @etraut-openai
- #14183 Expose strongly-typed result for exec_command @pakrym-oai
- #14003 Stabilize split PTY output on Windows @aibrahim-oai
- #14229 Reuse McpToolOutput in McpHandler @pakrym-oai
- #14125 Mark incomplete resumed turns interrupted when idle @guinness-oai

New Features
- Added a built-in request_permissions tool so running turns can request additional permissions at runtime, with new TUI rendering for those approval calls. (#13092, #14004)
- Expanded plugin workflows with curated marketplace discovery, richer plugin/list metadata, install-time auth checks, and a plugin/uninstall endpoint. (#13712, #13540, #13685, #14111)
- Upgraded app-server command execution with streaming stdin/stdout/stderr plus TTY/PTY support, and wired exec to the new in-process app server path. (#13640, #14005)
- Web search settings now support full tool configuration (for example filters and location), not just on/off. (#13675)
- Added the new permission-profile config language and split filesystem/network sandbox policy plumbing for more precise policy control. (#13434, #13439, #13440, #13448, #13449, #13453)
- Image generation now saves output files into the current working directory. (#13607)
Bug Fixes
- Fixed auth error handling for cloud requirements fetch so 401s trigger the normal auth-recovery messaging instead of a generic workspace-config failure. (#14049)
- Fixed trust bootstrap to avoid running git commands before project trust is established. (#13804)
- Fixed Windows execution edge cases, including incorrect PTY TerminateProcess success handling and stricter sandbox startup cwd validation. (#13989, #13833, #13742)
- Fixed plugin startup behavior so curated plugins are loaded in TUI sessions as expected. (#14050)
- Hardened network proxy policy parsing by rejecting global wildcard (*) domains while preserving scoped wildcard support. (#13789)
- Fixed approval payload compatibility for macOS automation permissions by accepting both supported input shapes. (#13683)
Documentation
- Clarified js_repl guidance for persistent bindings and redeclaration recovery to reduce avoidable REPL errors. (#13803)
Chores
- Reduced log/storage overhead by moving logs to a dedicated SQLite DB, adding timestamps to feedback logs, pruning old data, and tightening retention/row limits. (#13645, #13688, #13734, #13763, #13772, #13781)
- Improved Windows distribution automation by publishing CLI releases to winget. (#12943)
Changelog
Full Changelog: rust-v0.112.0...rust-v0.113.0
- #13626 feat(otel): safe tracing @owenlin0
- #13560 Refine realtime startup context formatting @aibrahim-oai
- #13615 Replay thread rollback from rollout history @aibrahim-oai
- #13642 fix(tui): clean up pending steer preview wrapping @charley-oai
- #13645 Add timestamped SQLite /feedback logs without schema changes @charley-oai
- #13654 tui: sort resume picker by last updated time @charley-oai
- #13540 support plugin/list. @xl-openai
- #13677 chore: remove unused legacy macOS permission types @celia-oai
- #13683 fix: accept two macOS automation input shapes for approval payload compatibility @celia-oai
- #13687 refactor: remove proxy admin endpoint @viyatb-oai
- #13669 copy current exe to CODEX_HOME/.sandbox-bin for apply_patch @iceweasel-oai
- #11874 fix(tui) remove config check for trusted setting @dylan-hurd-oai
- #13685 check app auth in plugin/install @sayan-oai
- #13697 change sound @aibrahim-oai
- #13607 Enabling CWD Saving for Image-Gen @won-openai
- #13621 [elicitations] Switch to use MCP style elicitation payload for mcp tool approvals. @mzeng-openai
- #13619 feat: status line with real data @jif-oai
- #13734 feat: prune old memories in DB @jif-oai
- #13688 Add timestamps to feedback log lines @etraut-openai
- #13742 fix: windows normalization @jif-oai
- #13514 [rmcp-client] Recover from streamable HTTP 404 sessions @caseychow-oai
- #13750 feat: drop sqlite db feature flag @jif-oai
- #13753 feat: drop discrepency metrics @jif-oai
- #13763 feat: limit number of rows per log @jif-oai
- #13703 Clarify sandbox permission override helper semantics @charley-oai
- #13770 fix(app-server): fix turn_start_shell_zsh_fork_executes_command_v2 flake @owenlin0
- #13630 feat(otel, core): record turn TTFT and TTFM metrics in codex-core @owenlin0

New Features
- Added @plugin mentions so users can reference plugins directly in chat and auto-include their associated MCP/app/skill context. (#13510)
- Added a new model-selection surface update so the latest model catalog changes are surfaced in the TUI picker flow. (#13617)
- Merged executable permission profiles into per-turn sandbox policy for zsh-fork skill execution, allowing safer, additive privilege handling for tool runs. (#13496)
Bug Fixes
- Fixed JS REPL state handling so previously-initialized bindings persist after a failed cell, reducing brittle restarts during iterative sessions. (#13482)
- Treated SIGTERM like Ctrl-C for graceful app-server websocket shutdown instead of abrupt termination behavior. (#13594)
- Hardened js_repl image emission to accept only data: URLs, preventing external URL forwarding through emitImage. (#13507)
- Ensured Linux bubblewrap sandbox runs always unshare the user namespace to keep isolation consistent even for root-owned invocations. (#13624)
- Improved macOS sandbox network and unix-socket handling in Seatbelt, improving reliability for constrained subprocess environments. (#12702)
- Surfaced feedback/diagnostics earlier in the workflow so connectivity and diagnostics are visible before later steps. (#13604)
Documentation
- Clarified js_repl image guidance (emission and encoding semantics), including clearer usage around repeated emitImage calls. (#13639)
Chores
- Fixed a small codespell warning in the TUI theme picker path. (#13605)
Changelog
- #13594 treat SIGTERM like ctrl-c for graceful shutdown @maxj-oai
- #13605 Fix codespell warning about pre-selects @fjord-oai
- #13482 Persist initialized js_repl bindings after failed cells @fjord-oai
- #13604 [diagnostics] show diagnostics earlier in workflow @rhan-oai
- #13496 feat: merge skill permission profiles into the turn sandbox for zsh-fork execs @celia-oai
- #13507 Harden js_repl emitImage to accept only data: URLs @fjord-oai
- #13602 feat(core): persist trace_id for turns in RolloutItem::TurnContext @owenlin0
- #13624 fix(linux-sandbox): always unshare bwrap userns @viyatb-oai
- #12702 Improve macOS Seatbelt network and unix socket handling @viyatb-oai
- #13639 Clarify js_repl image emission and encoding guidance @fjord-oai
- #13510 add @plugin mentions @sayan-oai
- #13499 core/protocol: add structured macOS additional permissions and merge them into sandbox execution @celia-oai
- #13617 Update models.json @aibrahim-oai

New Features
- Fast mode is now enabled by default, and the TUI header shows whether the session is running in Fast or Standard mode. (#13450, #13446)
- js_repl can now dynamically import local .js and .mjs files, making it easier to reuse workspace scripts from the REPL. (#13437)
- Codex now tells the model which plugins are enabled at session start, improving discovery of installed MCPs, apps, and skills. (#13433)
- App-server v2 now exposes MCP elicitation as a structured request/response flow instead of raw events, which simplifies client integrations. (#13425)
- Expanded image workflow support for clients, including client-side handling of image-generation events and model metadata for image-capable web search. (#13512, #13538)
Bug Fixes
- Resuming a thread now preserves its stored git context and keeps apps enabled, avoiding broken state after codex resume. (#13504, #13533)
Documentation
- Added sample skill documentation for artifact workflows, including slide deck and spreadsheet examples. (#13525)
Changelog
- #13516 Log non-audio realtime events @aibrahim-oai
- #13208 chore(deps): bump actions/download-artifact from 7 to 8 @dependabot
- #13512 image-gen-event/client_processing @won-openai
- #13210 chore(deps): bump strum_macros from 0.27.2 to 0.28.0 in /codex-rs @dependabot
- #13209 chore(deps): bump serde_with from 3.16.1 to 3.17.0 in /codex-rs @dependabot
- #13504 Preserve persisted thread git info in resume @joeytrasatti-openai
- #13207 chore(deps): bump actions/upload-artifact from 6 to 7 @dependabot
- #13433 feat: track plugins mcps/apps and add plugin info to user_instructions @sayan-oai
- #13450 [core] Enable fast mode by default @pash-openai
- #13438 [tui] rotate paid promo tips to include fast mode @pash-openai
- #13515 [tui] Update fast mode plan usage copy @pash-openai
- #13533 [apps] Fix the issue where apps is not enabled after codex resume. @mzeng-openai
- #13437 [js_repl] Support local ESM file imports @aaronl-openai
- #13539 Reduce realtime audio submission log noise @aibrahim-oai
- #13538 chore: add web_search_tool_type for image support @sayan-oai
- #13446 [tui] Show speed in session header @pash-openai
- #13392 refactor: prepare unified exec for zsh-fork backend @bolinfest
- #13571 feat: bind package manager @jif-oai
- #13525 feat: skills for artifacts @jif-oai
- #13573 feat: ultra polish package manager @jif-oai
- #13577 chore: ultra-clean artifacts @jif-oai
- #13425 feat(app-server): support mcp elicitations in v2 api @owenlin0

New Features
- ChatGPT login now asks for the connector permissions needed to read from and invoke connectors during authenticated workflows. (#12383)
- App-server clients can now target Windows sandbox setup at a specific workspace directory, which helps avoid slow first-command setup when the server starts outside the project folder. (#13484)
- App-server adds an experimental way to install plugins from marketplace entries, including local marketplace.json sources that point at on-disk plugins. (#13422)
Bug Fixes
- ANSI-family syntax themes in the TUI now respect your terminal palette again instead of rendering as hard-coded near-black RGB colors. (#13382)
- TUI notifications now surface plan-mode prompts and user input requests more reliably instead of allowing one notification to overwrite another. (#13495)
- Realtime handoff transcripts now label each forwarded message with its speaker role, preserving clearer context for downstream agents. (#13505)
Documentation
- Updated /fast help text to explain the speed versus plan-usage tradeoff, and refreshed app-server examples to match the current API surface. (#13458, #13489)
Changelog
- #12383 add new scopes to login @adaley-openai
- #13484 allow apps to specify cwd for sandbox setup. @iceweasel-oai
- #13424 feat(core, tracing): add a span representing a turn @owenlin0
- #13489 remove serviceTier from app-server examples @kharvd
- #13458 [tui] Update Fast slash command description @pash-openai
- #13382 fix(tui): decode ANSI alpha-channel encoding in syntax themes @fcoury
- #13485 feat: external artifacts builder @jif-oai
- #13493 feat(app-server-test-client): OTEL setup for tracing @owenlin0
- #13501 add metrics for external config import @alexsong-oai
- #13495 Notify TUI about plan mode prompts and user input requests @etraut-openai
- #13506 [release] temporarily use thin LTO for releases @bolinfest
- #13505 Prefix handoff messages with role @aibrahim-oai
- #13422 plugin: support local-based marketplace.json + install endpoint. @xl-openai

New Features
- You can now fork a thread into sub-agents, making it easier to branch work without leaving the current conversation. (#12499)
- Realtime voice sessions now let you pick microphone and speaker devices, persist those choices, and send audio in a format better aligned with transcription. (#12849, #12850, #13030)
- Custom tools can now return multimodal output, including structured content like images, instead of being limited to plain text. (#12948)
- The app server now exposes richer model availability and upgrade metadata, and the TUI uses it to explain plan-gated models with limited-run tooltips. (#12958, #12972, #13021)
- Memories are now configurable, and there is a new codex debug clear-memories command to fully reset saved memory state when needed. (#12997, #12999, #13002, #13085)
Bug Fixes
- Reconnecting with thread/resume now restores pending approval and input requests instead of leaving clients out of sync. (#12560)
- thread/start no longer blocks unrelated app-server requests, reducing stalls during slow startup paths such as MCP auth checks. (#13033)
- Interactive terminal sessions no longer print the final assistant response twice. (#13082)
- Large pasted-content placeholders now survive file completion correctly, fixing a regression from 0.106.0. (#13070)
- ChatGPT accounts that arrive without plan info now handle account reads correctly instead of triggering repeated login issues. (#13072)
- Diff rendering in the TUI now respects theme colors better and displays more cleanly in Windows Terminal and other low-color environments. (#13016, #13037)
- MCP OAuth login flows now forward configured oauth_resource values correctly for servers that require a resource parameter. (#12866)
Documentation
- Updated sandbox escalation guidance so dependency-install failures caused by sandboxed network access are more clearly treated as escalation candidates. (#13051)
Chores
- Tightened sandbox filesystem behavior by improving restricted read-only handling on Linux and avoiding sensitive directories like ~/.ssh on Windows. (#12369, #12835)
- Escalated shell commands now keep their sandbox configuration when rerun, closing a gap where approvals could lose the intended restrictions. (#12839)
Changelog
- #12925 chore: calm down awaiter @jif-oai
- #12499 feat: fork thread multi agent @jif-oai
- #12837 Log js_repl nested tool responses in rollout history @fjord-oai
- #12774 feat: add post-compaction sub-agent infos @jif-oai
- #12929 Remove noisy log @pakrym-oai
- #12835 don't grant sandbox read access to ~/.ssh and a few other dirs. @iceweasel-oai
- #12839 feat: include sandbox config with escalation request @bolinfest
- #12940 feat: add git info to memories @jif-oai
- #12727 tui: use thread_id for resume/fork cwd resolution @charley-oai
- #12950 Allow clients not to send summary as an option @pakrym-oai
- #12944 fix: sort codex features list alphabetically @bolinfest
- #12849 Add realtime audio device config @aibrahim-oai
- #12957 test: move unix_escalation tests into sibling file @bolinfest
- #12947 feat: add local date/timezone to turn environment context @celia-oai
- #12959 Make realtime audio test deterministic @aibrahim-oai
- #12958 Feat: cxa-1833 update model/list @shijie-oai
- #12850 Add realtime audio device picker @aibrahim-oai
- #12948 Support multimodal custom tool outputs @fjord-oai
- #12745 [apps] Improve app/list with force_fetch=true @mzeng-openai
- #12866 Add oauth_resource handling for MCP login flows @etraut-openai
- #12936 Add a background job to refresh the requirements local cache @alexsong-oai
- #12972 Add model availability NUX metadata @aibrahim-oai
- #12981 Add realtime websocket tracing @aibrahim-oai
- #12968 notify: include client in legacy hook payload @bolinfest
- #12997 feat: add use memories config @jif-oai
- #12999 feat: gen memories config @jif-oai
- #13002 feat: use the memory mode for phase 1 extraction @jif-oai
- #13001 chore: tmp remove awaiter @jif-oai
- #13011 fix: more stable noti

New Features
- Added a direct install script for macOS and Linux and publish it as a GitHub release asset, using the existing platform payload (including codex and rg) (#12740)
- Expanded the app-server v2 thread API with experimental thread-scoped realtime endpoints/notifications and a thread/unsubscribe flow to unload live threads without archiving them (#12715, #10954)
- Promoted js_repl to /experimental, added startup compatibility checks with user-visible warnings, and lowered the validated minimum Node version to 22.22.0 (#12712, #12824, #12857)
- Enabled request_user_input in Default collaboration mode (not just Plan mode) (#12735)
- Made 5.3-codex visible in the CLI model list for API users (#12808)
- Improved memory behavior with diff-based forgetting and usage-aware memory selection (#12900, #12909)
Bug Fixes
- Improved realtime websocket reliability by retrying timeout-related HTTP 400 handshake failures and preferring WebSocket v2 when supported by the selected model (#12791, #12838)
- Fixed a zsh-fork shell execution path that could drop sandbox wrappers and bypass expected filesystem restrictions (#12800)
- Added a shared ~1M-character input size cap in the TUI and app-server to prevent hangs/crashes on oversized pastes, with explicit error responses (#12823)
- Improved TUI local file-link rendering to hide absolute paths while preserving visible line/column references (#12705, #12870)
- Fixed Ctrl-C handling for sub-agents in the TUI (#12911)
Documentation
- Fixed a stale sign-in success link in the auth/onboarding flow (#12805)
- Clarified the CLI login hint for remote/device-auth login scenarios (#12813)
Chores
- Added structured OTEL audit logging for embedded codex-network-proxy policy decisions and blocks (#12046)
- Removed the steer feature flag and standardized on the always-on steer path in the TUI composer (#12026)
- Reduced sub-agent startup overhead by skipping expensive history metadata scans for subagent spawns (#12918)
Changelog
- #12046 feat(network-proxy): add embedded OTEL policy audit logging @mcgrew-oai
- #12712 Promote js_repl to experimental with Node requirement @fjord-oai
- #12715 Add app-server v2 thread realtime API @aibrahim-oai
- #12795 Revert "fix(bazel): replace askama templates with include_str! in memories" @jif-oai
- #12791 Handle websocket timeout @pakrym-oai
- #12800 fix: enforce sandbox envelope for zsh fork execution @bolinfest
- #12802 Propagate session ID when compacting @rasmusrygaard
- #12732 feat(app-server): add ThreadItem::DynamicToolCall @owenlin0
- #12807 Add simple realtime text logs @aibrahim-oai
- #12805 Update Codex docs success link @etraut-openai
- #12809 fix: harden zsh fork tests and keep subcommand approvals deterministic @bolinfest
- #12808 make 5.3-codex visible in cli for api users @sayan-oai
- #10954 feat(app-server): thread/unsubscribe API @owenlin0
- #12806 only use preambles for realtime @aibrahim-oai
- #12830 Revert "only use preambles for realtime" @aibrahim-oai
- #12721 Revert "Ensure shell command skills trigger approval (#12697)" @celia-oai
- #12831 only use preambles for realtime @aibrahim-oai
- #12735 Enable request_user_input in Default mode @charley-oai
- #12814 feat: scope execve session approvals by approved skill metadata @bolinfest
- #12026 Remove steer feature flag @aibrahim-oai
- #12740 Add macOS and Linux direct install script @EFRAZER-oai
- #12838 Use websocket v2 as model-preferred websocket protocol @pakrym-oai
- #12811 Revert "Add skill approval event/response (#12633)" @celia-oai
- #12758 feat: include available decisions in command approval requests @bolinfest
- #12824 Disable js_repl when Node is incompatible at startup @fjord-oai
- #12813 Clarify device auth login hint @xl-openai
- #12848 Try fixing windows pipeline @pakrym-oai
- #12856 Attempt 2 to fix release @pakrym-oai
- #12744 Skip system skills for extra roots @xl-openai
- #12857 Reduce js_repl Node version requirement to 22.22.0 @fjord-oai
- #12865 Fix release build take 

New Features
- The TUI now syntax-highlights fenced code blocks and diffs, adds a /theme picker with live preview, and uses better theme-aware diff colors for light and dark terminals. (#11447, #12581)
- You can now dictate prompts by holding the spacebar to record and transcribe voice input directly in the TUI. (#3381)
- Multi-agent workflows are easier to run and track: spawn_agents_on_csv can fan out work from a CSV with built-in progress/ETA, and sub-agents are easier to follow with nicknames, a cleaner picker, and visible child-thread approval prompts. (#10935, #12320, #12327, #12332, #12570, #12767)
- The TUI picked up new convenience commands: /copy copies the latest complete assistant reply, while /clear and Ctrl-L clear the screen without losing thread context, with /clear also able to start a fresh chat. (#12444, #12520, #12613, #12628)
- Approval controls are more flexible: Codex can now ask for extra sandbox permissions for a command, and you can auto-reject specific approval prompt types without turning approvals off entirely. (#11871, #12087)
- App-server clients can do more with threads: thread/list can search by title, thread status is exposed in read/list responses and notifications, and thread/resume returns the latest turn inline so reconnects are less lossy. (#11776, #11786, #12578)
Bug Fixes
- Long links in the TUI stay clickable when wrapped, which also fixes related clipping and layout issues in several views. (#12067)
- Several TUI interaction edge cases were fixed: queued-message editing now works in more terminals, follow-up prompts no longer get stuck if you press Enter while a final answer is still streaming, and approval dialogs now respond with the correct request id. (#12240, #12569, #12746)
- @ parsing in the chat composer is more reliable, so commands like npx -y @scope/pkg@latest no longer accidentally open the file picker or block submission. (#12643)
- App-server websocket handling is more robust: thread listeners survive disconnects, Ctrl-C waits for in-flight turns before restarting, and websocket clients that send permessage-deflate can connect successfully. (#12373, #12517, #12629)
- Linux sandboxed commands now get a minimal /dev, fixing failures in tools that need entropy or other standard device nodes. (#12081)
- js_repl now reports uncaught kernel failures more clearly, recovers cleanly afterward, and correctly attaches view_image results from nested tool calls. (#12636, #12725)
Documentation
- Added a public security policy with Bugcrowd reporting guidance. (#12193)
- Updated install and local workflow docs to use cargo install --locked cargo-nextest and to avoid routine --all-features builds unless you specifically need full feature coverage. (#12377, #12429)
Changelog
- #12071 Use V2 websockets if feature enabled @pakrym-oai
- #12052 feat(core): zsh exec bridge @owenlin0
- #12072 Add message phase to agent message thread item @mousseau-oai
- #12077 got rid of experimental_mode for configtoml @won-openai
- #12036 codex-api: realtime websocket session.create + typed inbound events @aibrahim-oai
- #12073 Add model-visible context layout snapshot tests @charley-oai
- #12096 Updated issue labeler script to include safety-check label @etraut-openai
- #11944 [js_repl] paths for node module resolution can be specified for js_repl @aaronl-openai
- #11798 fix: Restricted Read: /System is too permissive for macOS platform de… @leoshimo-oai
- #12015 Enable default status line indicators in TUI config @jif-oai
- #12124 feat: phase 1 and phase 2 e2e latencies @jif-oai
- #12121 feat: phase 2 usage @jif-oai
- #12120 feat: memory usage metrics @jif-oai
- #12133 feat: validate agent config file paths @jif-oai
- #12137 nit: change model for phase 1 @jif-oai
- #12069 Stop filtering model tools in js_repl_tools_only mode @fjord-oai
- #12135 feat: better slug for rollout summaries @jif-oai
- #12157 Disable collab tools during review delegation @jif-oai
- #11802 Fixed a hole in token refresh logic for a

New Features
- Added WS_PROXY/WSS_PROXY environment support (including lowercase variants) for websocket proxying in the network proxy. (#11784)
- App-server v2 now emits notifications when threads are archived or unarchived, enabling clients to react without polling. (#12030)
- Protocol/core now carry distinct approval IDs for command approvals to support multiple approvals within a single shell command execution flow. (#12051)
Bug Fixes
- Ctrl+C/Ctrl+D now cleanly exits the cwd-change prompt during resume/fork flows instead of implicitly selecting an option. (#12040)
- Reduced false-positive safety-check downgrade behavior by relying on the response header model (and websocket top-level events) rather than the response body model slug. (#12061)
Documentation
- Updated docs and schemas to cover websocket proxy configuration, new thread archive/unarchive notifications, and the command approval ID plumbing. (#11784, #12030, #12051)
Chores
- Made the Rust release workflow resilient to npm publish attempts for an already-published version. (#12044)
- Standardized remote compaction test mocking and refreshed related snapshots to align with the default production-shaped behavior. (#12050)
Changelog
Full Changelog: rust-v0.103.0...rust-v0.104.0
- #11784 feat(network-proxy): add websocket proxy env support @viyatb-oai
- #12044 don't fail if an npm publish attempt is for an existing version. @iceweasel-oai
- #12040 tui: exit session on Ctrl+C in cwd change prompt @charley-oai
- #12030 app-server: Emit thread archive/unarchive notifications @euroelessar
- #12061 Chore: remove response model check and rely on header model for downgrade @shijie-oai
- #12051 feat(core): plumb distinct approval ids for command approvals @owenlin0
- #12050 Unify remote compaction snapshot mocks around default endpoint behavior @charley-oai

New Features
- App listing responses now include richer app details (app_metadata, branding, and labels), so clients can render more complete app cards without extra requests. (#11706)
- Commit co-author attribution now uses a Codex-managed prepare-commit-msg hook, with command_attribution override support (default label, custom label, or disable). (#11617)
Bug Fixes
- Removed the remote_models feature flag to prevent fallback model metadata when it was disabled, improving model selection reliability and performance. (#11699)
Chores
- Updated Rust dependencies (clap, env_logger, arc-swap) and refreshed Bazel lock state as routine maintenance. (#11888, #11889, #11890, #12032)
- Reverted the Rust toolchain bump to 1.93.1 after CI breakage. (#11886, #12035)
Changelog
Full Changelog: rust-v0.102.0...rust-v0.103.0
- #11699 chore: rm remote models fflag @sayan-oai
- #11706 [apps] Expose more fields from apps listing endpoints. @mzeng-openai
- #11890 chore(deps): bump arc-swap from 1.8.0 to 1.8.2 in /codex-rs @dependabot
- #11886 chore(deps): bump rust-toolchain from 1.93.0 to 1.93.1 in /codex-rs @dependabot
- #12032 chore: just bazel-lock-update @bolinfest
- #11888 chore(deps): bump clap from 4.5.56 to 4.5.58 in /codex-rs @dependabot
- #11889 chore(deps): bump env_logger from 0.11.8 to 0.11.9 in /codex-rs @dependabot
- #11617 Use prompt-based co-author attribution with config override @gabec-openai
- #12035 Revert "chore(deps): bump rust-toolchain from 1.93.0 to 1.93.1 in /co…dex-rs (#11886)" @etraut-openai

New Features
- Added a more unified permissions flow, including clearer permissions history in the TUI and a slash command to grant sandbox read access when directories are blocked. (#11633, #11512, #11550, #11639)
- Introduced structured network approval handling, with richer host/protocol context shown directly in approval prompts. (#11672, #11674)
- Expanded app-server fuzzy file search with explicit session-complete signaling so clients can stop loading indicators reliably. (#10268, #11773)
- Added customizable multi-agent roles via config, including migration toward the new multi-agent naming/config surface. (#11917, #11982, #11939, #11918)
- Added a model/rerouted notification so clients can detect and render model reroute events explicitly. (#12001)
Bug Fixes
- Fixed remote image attachments so they persist correctly across resume/backtrack and history replay in the TUI. (#10590)
- Fixed a TUI accessibility regression where animation gating for screen reader users was not consistently respected. (#11860)
- Fixed app-server thread resume behavior to correctly rejoin active in-memory threads and tighten invalid resume cases. (#11756)
- Fixed model/list output to return full model data plus visibility metadata, avoiding unintended server-side filtering. (#11793)
- Fixed several js_repl stability issues, including reset hangs, in-flight tool-call races, and a view_image panic path. (#11932, #11922, #11800, #11796)
- Fixed app integration edge cases in mention parsing and app list loading/filtering behavior. (#11894, #11518, #11697)
Documentation
- Updated contributor guidance to require snapshot coverage for user-visible TUI changes. (#10669)
- Updated docs/help text around Codex app and MCP command usage. (#11926, #11813)
Chores
- Improved developer log tooling with new just log --search and just log --compact modes. (#11995, #11994)
- Updated vendored rg and tightened Bazel/Cargo lockfile sync checks to reduce dependency drift. (#12007, #11790)
Changelog
Full Changelog: rust-v0.101.0...rust-v0.102.0
- #10268 app-server: add fuzzy search sessions for streaming file search @nornagon-openai
- #11547 Parse first order skill/connector mentions @canvrno-oai
- #11227 feat(app-server): experimental flag to persist extended history @owenlin0
- #10672 Add js_repl host helpers and exec end events @fjord-oai
- #11512 add a slash command to grant sandbox read access to inaccessible directories @iceweasel-oai
- #11631 chore(core) Deprecate approval_policy: on-failure @dylan-hurd-oai
- #11636 Better error message for model limit hit. @xl-openai
- #11633 feat: introduce Permissions @bolinfest
- #10669 docs: require insta snapshot coverage for UI changes @joshka-oai
- #11645 fix: skip review_start_with_detached_delivery_returns_new_thread_id o… @owenlin0
- #11639 [feat] add seatbelt permission files @celia-oai
- #11622 Remove absolute path in rollout_summary @wendyjiao-openai
- #10671 Add js_repl_tools_only model and routing restrictions @fjord-oai
- #11657 app-server tests: disable shell_snapshot for review suite @bolinfest
- #11646 app-server: stabilize detached review start on Windows @bolinfest
- #11638 fix(app-server): surface more helpful errors for json-rpc @owenlin0
- #11417 [apps] Add is_enabled to app info. @mzeng-openai
- #11630 Add new apps_mcp_gateway @canvrno-oai
- #11656 Persist complete TurnContextItem state via canonical conversion @charley-oai
- #11510 Remove git commands from dangerous command checks @joshka-oai
- #11668 feat(shell-tool-mcp): add patched zsh build pipeline @nornagon-openai
- #11275 Added a test to verify that feature flags that are enabled by default are stable @etraut-openai
- #11651 Add cwd as an optional field to thread/list @acrognale-oai
- #11660 chore(approvals) More approvals scenarios @dylan-hurd-oai
- #11518 [apps] Fix app loading logic. @mzeng-openai
- #11679 fix: dont show NUX for upgrade-target models that are hidden @sayan-oai
- #11515 Point Codex App tooltip links to app landing page @josh

New Features
- Memory files now include the working directory in stored context, improving memory behavior when switching between different project directories. (#11591)
Bug Fixes
- Model resolution now preserves the requested model slug when selecting by prefix, so model references stay stable instead of being rewritten. (#11602)
- Developer messages are now excluded from phase-1 memory input, reducing noisy or irrelevant content entering memory. (#11608)
- Memory phase processing concurrency was reduced to make consolidation/staging more stable under load. (#11614)
Chores
- Cleaned and simplified the phase-1 memory pipeline code paths. (#11605)
- Minor repository maintenance: formatting and test-suite hygiene updates in remote model tests. (#11619)
Changelog
Full Changelog: rust-v0.100.0...rust-v0.101.0
- #11605 chore: drop and clean from phase 1 @jif-oai
- #11602 fix(core) model_info preserves slug @dylan-hurd-oai
- #11608 exclude developer messages from phase-1 memory input @wendyjiao-openai
- #11591 Add cwd to memory files @wendyjiao-openai
- #11614 chore: reduce concurrency of memories @jif-oai
- #11619 fix: fmt @jif-oai

New Features
- Added an experimental, feature-gated JavaScript REPL runtime (js_repl) that can persist state across tool calls, with optional runtime path overrides. (#10674)
- Added support for multiple simultaneous rate limits across the protocol, backend client, and TUI status surfaces. (#11260)
- Reintroduced app-server websocket transport with a split inbound/outbound architecture, plus connection-aware thread resume subscriptions. (#11370, #11474)
- Added memory management slash commands in the TUI (/m_update, /m_drop) and expanded memory-read/metrics plumbing. (#11569, #11459, #11593)
- Enabled Apps SDK apps in ChatGPT connector handling. (#11486)
- Promoted sandbox capabilities on both Linux and Windows, and introduced a new ReadOnlyAccess policy shape for configurable read access. (#11381, #11341, #11387)
Bug Fixes
- Fixed websocket incremental output duplication, prevented appends after response.completed, and treated response.incomplete as an error path. (#11383, #11402, #11558)
- Improved websocket session stability by continuing ping handling when idle and suppressing noisy first-retry errors during quick reconnects. (#11413, #11548)
- Fixed stale thread entries by dropping missing rollout files and cleaning stale DB metadata during thread listing. (#11572)
- Fixed Windows multi-line paste reliability in terminals (especially VS Code integrated terminal) by increasing paste burst timing tolerance. (#9348)
- Fixed incorrect inheritance of limit_name when merging partial rate-limit updates. (#11557)
- Reduced repeated skill parse-error spam during active edits by increasing file-watcher debounce from 1s to 10s. (#11494)
Documentation
- Added JS REPL documentation and config/schema guidance for enabling and configuring the feature. (#10674)
- Updated app-server websocket transport documentation in the app-server README. (#11370)
Chores
- Split codex-common into focused codex-utils-* crates to simplify dependency boundaries across Rust workspace components. (#11422)
- Improved Rust release pipeline throughput and reliability for Windows and musl targets, including parallel Windows builds and musl link fixes. (#11488, #11500, #11556)
- Prevented GitHub release asset upload collisions by excluding duplicate cargo-timing.html artifacts. (#11564)
Changelog
Full Changelog: rust-v0.99.0...rust-v0.100.0
- #11383 Do not resend output items in incremental websockets connections @pakrym-oai
- #11246 chore: persist turn_id in rollout session and make turn_id uuid based @celia-oai
- #11260 feat: support multiple rate limits @xl-openai
- #11412 tui: show non-file layer content in /debug-config @bolinfest
- #11405 Remove test-support feature from codex-core and replace it with explicit test toggles @bolinfest
- #11428 fix: flaky test @jif-oai
- #11429 feat: improve thread listing @jif-oai
- #11422 feat: split codex-common into smaller utils crates @bolinfest
- #11439 feat: new memory prompts @jif-oai
- #11305 Cache cloud requirements @gt-oai
- #11452 nit: increase max raw memories @jif-oai
- #11455 feat: close mem agent after consolidation @jif-oai
- #11454 fix: optional schema of memories @jif-oai
- #11449 feat: set policy for phase 2 memory @jif-oai
- #11420 chore: rename disable_websockets -> websockets_disabled @sayan-oai
- #11402 Do not attempt to append after response.completed @pakrym-oai
- #11462 clean: memory rollout recorder @jif-oai
- #11381 feat(core): promote Linux bubblewrap sandbox to Experimental @viyatb-oai
- #11389 Extract codex-config from codex-core @bolinfest
- #11370 Reapply "Add app-server transport layer with websocket support" @maxj-oai
- #11470 feat: panic if Constrained does not support Disabled @bolinfest
- #11475 feat: remove "cargo check individual crates" from CI @bolinfest
- #11459 feat: memory read path @jif-oai
- #11471 chore: clean rollout extraction in memories @jif-oai
- #9348 fix(tui): increase paste burst char interval on Windows to 30ms @yuvrajangadsingh
- #11464 chore: sub-agent never ask fo

New Features
- Running direct shell commands no longer interrupts an in-flight turn; commands can execute concurrently when a turn is active. (#10513)
- Added /statusline to configure which metadata appears in the TUI footer interactively. (#10546)
- The TUI resume picker can now toggle sort order between creation time and last-updated time with an in-picker mode indicator. (#10752)
- App-server clients now get dedicated APIs for steering active turns, listing experimental features, resuming agents, and opting out of specific notifications. (#10721, #10821, #10903, #11319)
- Enterprise/admin requirements can now restrict web search modes and define network constraints through requirements.toml. (#10964, #10958)
- Image attachments now accept GIF and WebP inputs in addition to existing formats. (#11237)
Bug Fixes
- Fixed a Windows startup issue where buffered keypresses could cause the TUI sign-in flow to exit immediately. (#10729)
- Required MCP servers now fail fast during start/resume flows instead of continuing in a broken state. (#10902)
- Fixed a file-watcher bug that emitted spurious skills reload events and could generate very large log files. (#11217)
- Improved TUI input reliability: long option labels wrap correctly, Tab submits in steer mode when idle, history recall keeps cursor placement consistent, and stashed drafts restore image placeholders correctly. (#11123, #10035, #11295, #9040)
- Fixed model-modality edge cases by surfacing clearer view_image errors on text-only models and stripping unsupported image history during model switches. (#11336, #11349)
- Reduced false approval mismatches for wrapped/heredoc shell commands and guarded against empty command lists in exec policy evaluation. (#10941, #11397)
Documentation
- Expanded app-server docs and protocol references for turn/steer, experimental-feature discovery, resume_agent, notification opt-outs, and null developer_instructions normalization. (#10721, #10821, #10903, #10983, #11319)
- Updated TUI composer docs to reflect draft/image restoration, steer-mode Tab submit behavior, and history-navigation cursor semantics. (#9040, #10035, #11295)
Chores
- Reworked npm release packaging so platform-specific binaries are distributed via @openai/codex dist-tags, reducing package-size pressure while preserving platform-specific installs (including @alpha). (#11318, #11339)
- Pulled in a security-driven dependency update for time (RUSTSEC-2026-0009). (#10876)
Changelog
Full Changelog: rust-v0.98.0...rust-v0.99.0
- #10729 fix(tui): flush input buffer on init to prevent early exit on Windows @Ashutosh0x
- #10689 fix: flaky landlock @jif-oai
- #10513 Allow user shell commands to run alongside active turns @jif-oai
- #10738 nit: backfill stronger @jif-oai
- #10246 adding fork information (UI) when forking @pap-openai
- #10748 Update explorer role default model @jif-oai
- #10425 Include real OS info in metrics. @iceweasel-oai
- #10745 feat: resumable backfill @jif-oai
- #10758 feat: wire ephemeral in codex exec @jif-oai
- #10756 chore: handle shutdown correctly in tui @jif-oai
- #10637 feat: add memory tool @jif-oai
- #10751 feat: repair DB in case of missing lines @jif-oai
- #10762 nit: add DB version in discrepancy recording @jif-oai
- #10621 Leverage state DB metadata for thread summaries @jif-oai
- #9691 Add hooks implementation and wire up to notify @gt-oai
- #10546 feat(tui): add /statusline command for interactive status line configuration @fcoury
- #10752 feat(tui): add sortable resume picker with created/updated timestamp toggle @fcoury
- #10769 fix(tui): fix resume_picker_orders_by_updated_at test @owenlin0
- #10423 fix(auth): isolate chatgptAuthTokens concept to auth manager and app-server @owenlin0
- #10775 nit: gpt-5.3-codex announcement @jif-oai
- #10782 nit: gpt-5.3-codex announcement 2 @jif-oai
- #10711 add sandbox policy and sandbox name to codex.tool.call metrics @iceweasel-oai
- #10660 chore: rm web-search-eligible header @sayan-oai
- #10783 fix: annou

New Features
- Steer mode is now stable and enabled by default, so Enter sends immediately during running tasks while Tab explicitly queues follow-up input. (#10690)
Bug Fixes
- Fixed resumeThread() argument ordering in the TypeScript SDK so resuming with local images no longer starts an unintended new session. (#10709)
- Fixed model-instruction handling when changing models mid-conversation or resuming with a different model, ensuring the correct developer instructions are applied. (#10651, #10719)
- Fixed a remote compaction mismatch where token pre-estimation and compact payload generation could use different base instructions, improving trim accuracy and avoiding context overflows. (#10692)
- Cloud requirements now reload immediately after login instead of requiring a later refresh path to take effect. (#10725)
Chores
- Restored the default assistant personality to Pragmatic across config and related tests/UI snapshots. (#10705)
- Unified collaboration mode naming and metadata across prompts, tools, protocol types, and TUI labels for more consistent mode behavior and messaging. (#10666)
Changelog
Full Changelog: rust-v0.97.0...rust-v0.98.0
- #10709 fix: ensure resume args precede image args @cryptonerdcn
- #10705 chore(config) Default Personality Pragmatic @dylan-hurd-oai
- #10651 fix(core) switching model appends model instructions @dylan-hurd-oai
- #10666 Sync collaboration mode naming across Default prompt, tools, and TUI @charley-oai
- #10690 Make steer stable by default @aibrahim-oai
- #10692 Fix remote compaction estimator/payload instruction small mismatch @charley-oai
- #10725 Reload cloud requirements after user login @xl-openai
- #10719 fix(core,app-server) resume with different model @dylan-hurd-oai

New Features
- Added a session-scoped “Allow and remember” option for MCP/App tool approvals, so repeated calls to the same tool can be auto-approved during the session. (#10584)
- Added live skill update detection, so skill file changes are picked up without restarting. (#10478)
- Added support for mixed text and image content in dynamic tool outputs for app-server integrations. (#10567)
- Added a new /debug-config slash command in the TUI to inspect effective configuration. (#10642)
- Introduced initial memory plumbing (API client + local persistence) to support thread memory summaries. (#10629, #10634)
- Added configurable log_dir so logs can be redirected (including via -c overrides) more easily. (#10678)
Bug Fixes
- Fixed jitter in the TUI apps/connectors picker by stabilizing description-column rendering. (#10593)
- Restored and stabilized the TUI “working” status indicator/shimmer during preamble and early exec flows. (#10700, #10701)
- Improved cloud requirements reliability with higher timeouts, retries, and corrected precedence over MDM settings. (#10631, #10633, #10659)
- Persisted pending-input user events more consistently for mid-turn injected input handling. (#10656)
Documentation
- Documented how to opt in to the experimental app-server API. (#10667)
- Updated docs/schema coverage for new log_dir configuration behavior. (#10678)
Chores
- Added a gated Bubblewrap (bwrap) Linux sandbox path to improve filesystem isolation options. (#9938)
- Refactored model client lifecycle to be session-scoped and reduced implicit client state. (#10595, #10664)
- Added caching for MCP actions from apps to reduce repeated load latency for users with many installed apps. (#10662)
- Added a none personality option in protocol/config surfaces. (#10688)
Changelog
Full Changelog: rust-v0.96.0...rust-v0.97.0
- #10595 Stop client from being state carrier @pakrym-oai
- #10584 Add option to approve and remember MCP/Apps tool usage @canvrno-oai
- #10644 fix: flaky test @jif-oai
- #10629 feat: add phase 1 mem client @jif-oai
- #10633 Cloud Requirements: take precedence over MDM @gt-oai
- #10659 Increase cloud req timeout @gt-oai
- #9938 feat(linux-sandbox): add bwrap support @viyatb-oai
- #10656 Persist pending input user events @aibrahim-oai
- #10634 feat: add phase 1 mem db @jif-oai
- #10593 Fix jitter in TUI apps/connectors picker @canvrno-oai
- #10662 [apps] Cache MCP actions from apps. @mzeng-openai
- #10649 Fix test_shell_command_interruption flake @gt-oai
- #10642 Add /debug-config slash command @gt-oai
- #10478 Added support for live updates to skills @etraut-openai
- #10688 add none personality option @aibrahim-oai
- #10567 feat(app-server, core): allow text + image content items for dynamic tool outputs @owenlin0
- #10667 chore(app-server): document experimental API opt-in @owenlin0
- #10664 Session-level model client @pakrym-oai
- #10678 feat(core): add configurable log_dir @joshka-oai
- #10631 Cloud Requirements: increase timeout and retries @gt-oai
- #10650 chore(core) personality migration tests @dylan-hurd-oai
- #10701 fix(tui): restore working shimmer after preamble output @joshka-oai
- #10700 fix: ensure status indicator present earlier in exec path @sayan-oai

New Features
- Added thread/compact to the v2 app-server API as an async trigger RPC, so clients can start compaction immediately and track completion separately. (#10445)
- Added websocket-side rate limit signaling via a new codex.rate_limits event, with websocket parity for ETag/reasoning metadata handling. (#10324)
- Enabled unified_exec on all non-Windows platforms. (#10641)
- Constrained requirement values now include source provenance, enabling source-aware config debugging in UI flows like /debug-config. (#10568)
Bug Fixes
- Fixed Esc handling in the TUI request_user_input overlay: when notes are open, Esc now exits notes mode instead of interrupting the session. (#10569)
- Thread listing now queries the state DB first (including archived threads) and falls back to filesystem traversal only when needed, improving listing correctness and resilience. (#10544)
- Fixed thread path lookup to require that the resolved file actually exists, preventing invalid thread-id resolutions. (#10618)
- Dynamic tool injection now runs in a single transaction to avoid partial state updates. (#10614)
- Refined request_rule guidance used in approval-policy prompting to correct rule behavior. (#10379, #10598)
Documentation
- Updated app-server docs for thread/compact to clarify its asynchronous behavior and thread-busy lifecycle. (#10445)
- Updated TUI docs to match the mode-specific Esc behavior in request_user_input. (#10569)
Chores
- Migrated state DB helpers to a versioned SQLite filename scheme and cleaned up legacy state files during runtime initialization. (#10623)
- Expanded runtime telemetry with websocket timing metrics and simplified internal metadata flow in core client plumbing. (#10577, #10589)
Changelog
Full Changelog: rust-v0.95.0...rust-v0.96.0
- #10569 tui: make Esc clear request_user_input notes while notes are shown @charley-oai
- #10577 feat: log webscocket timing into runtime metrics @apanasenko-oai
- #10445 Add thread/compact v2 @aibrahim-oai
- #10589 Move metadata calculation out of client @pakrym-oai
- #10379 fix(core) updated request_rule guidance @dylan-hurd-oai
- #10598 fix(core) Request Rule guidance tweak @dylan-hurd-oai
- #10544 Prefer state DB thread listings before filesystem @jif-oai
- #10614 fix: single transaction for dyn tools injection @jif-oai
- #10568 Requirements: add source to constrained requirement values @gt-oai
- #10611 chore: simplify user message detection @jif-oai
- #10618 fix: make sure file exist in find_thread_path_by_id_str_in_subdir @jif-oai
- #10619 nit: cleaning @jif-oai
- #10324 Add a codex.rate_limits event for websockets @rasmusrygaard
- #10623 Migrate state DB path helpers to versioned filename @jif-oai
- #10638 Update tests to stop using sse_completed fixture @pakrym-oai
- #10641 feat: land unified_exec @jif-oai

New Features
- Added codex app <path> on macOS to launch Codex Desktop from the CLI, with automatic DMG download if it is missing. (#10418)
- Added personal skill loading from ~/.agents/skills (with ~/.codex/skills compatibility), plus app-server APIs/events to list and download public remote skills. (#10437, #10448)
- /plan now accepts inline prompt arguments and pasted images, and slash-command editing/highlighting in the TUI is more polished. (#10269)
- Shell-related tools can now run in parallel, improving multi-command execution throughput. (#10505)
- Shell executions now receive CODEX_THREAD_ID, so scripts and skills can detect the active thread/session. (#10096)
- Added vendored Bubblewrap + FFI wiring in the Linux sandbox as groundwork for upcoming runtime integration. (#10413)
Bug Fixes
- Hardened Git command safety so destructive or write-capable invocations no longer bypass approval checks. (#10258)
- Improved resume/thread browsing reliability by correctly showing saved thread names and fixing thread listing behavior. (#10340, #10383)
- Fixed first-run trust-mode handling so sandbox mode is reported consistently, and made $PWD/.agents read-only like $PWD/.codex. (#10415, #10524)
- Fixed codex exec hanging after interrupt in websocket/streaming flows; interrupted turns now shut down cleanly. (#10519)
- Fixed review-mode approval event wiring so requestApproval IDs align with the corresponding command execution items. (#10416)
- Improved 401 error diagnostics by including server message/body details plus cf-ray and requestId. (#10508)
Documentation
- Expanded TUI chat composer docs to cover slash-command arguments and attachment handling in plan/review flows. (#10269)
- Refreshed issue templates and labeler prompts to better separate CLI/app bug reporting and feature requests. (#10411, #10453, #10548, #10552)
Chores
- Completed migration off the deprecated mcp-types crate to rmcp-based protocol types/adapters, then removed the legacy crate. (#10356, #10349, #10357)
- Updated the bytes dependency for a security advisory and cleaned up resolved advisory configuration. (#10525)
Changelog
Full Changelog: rust-v0.94.0...rust-v0.95.0
- #10340 Session picker shows thread_name if set @pap-openai
- #10381 chore: collab experimental @jif-oai
- #10231 feat: experimental flags @jif-oai
- #10382 nit: shell snapshot retention to 3 days @jif-oai
- #10383 fix: thread listing @jif-oai
- #10386 fix: Rfc3339 casting @jif-oai
- #10356 feat: add MCP protocol types and rmcp adapters @bolinfest
- #10269 Nicer highlighting of slash commands, /plan accepts prompt args and pasted images @charley-oai
- #10274 Add credits tooltip @pakrym-oai
- #10394 chore: ignore synthetic messages @jif-oai
- #10398 feat: drop sqlx logging @jif-oai
- #10281 Select experimental features with space @pakrym-oai
- #10402 feat: add --experimental to generate-ts @jif-oai
- #10258 fix: unsafe auto-approval of git commands @viyatb-oai
- #10411 Updated labeler workflow prompt to include "app" label @etraut-openai
- #10399 emit a separate metric when the user cancels UAT during elevated setup @iceweasel-oai
- #10377 chore(tui) /personalities tip @dylan-hurd-oai
- #10252 [feat] persist thread_dynamic_tools in db @celia-oai
- #10437 feat: Read personal skills from .agents/skills @gverma-openai
- #10145 make codex better at git @pash-openai
- #10418 Add codex app macOS launcher @aibrahim-oai
- #10447 Fix plan implementation prompt reappearing after /agent thread switch @charley-oai
- #10064 TUI: Render request_user_input results in history and simplify interrupt handling @charley-oai
- #10349 feat: replace custom mcp-types crate with equivalents from rmcp @bolinfest
- #10415 Fixed sandbox mode inconsistency if untrusted is selected @etraut-openai
- #10452 Hide short worked-for label in final separator @aibrahim-oai
- #10357 chore: remove deprecated mcp-types crate @bolinfest
- #10454 app tool tip @aibrahim-oai
- #10455 chore: add phase to message responseitem @sayan-oai
- 

New Features
- Plan mode is now enabled by default with updated interaction guidance in the plan prompt. (#10313, #10308, #10329)
- Personality configuration is now stable: default is friendly, the config key is personality, and existing settings migrate forward. (#10305, #10314, #10310, #10307)
- Skills can be loaded from .agents/skills, with clearer relative-path instructions and nested-folder markers supported. (#10317, #10282, #10350)
- Console output now includes runtime metrics for easier diagnostics. (#10278)
Bug Fixes
- Unarchiving a thread updates its timestamp so sidebar ordering refreshes. (#10280)
- Conversation rules output is capped and prefix rules are deduped to avoid repeated rules. (#10351, #10309)
- Override turn context no longer appends extra items. (#10354)
Documentation
- Fixed a broken image link in the npm README. (#10303)
Changelog
Full Changelog: rust-v0.93.0...rust-v0.94.0
- #10278 feat: show runtime metrics in console @apanasenko-oai
- #10285 display promo message in usage error @willwang-openai
- #10302 fix(nix): update flake for newer Rust toolchain requirements @douglaz
- #10296 chore(features) remove Experimental tag from UTF8 @dylan-hurd-oai
- #10303 Fix npm README image link @fouad-openai
- #10306 chore(app-server) add personality update test @dylan-hurd-oai
- #10308 plan mode prompt @aibrahim-oai
- #10305 chore(core) Default to friendly personality @dylan-hurd-oai
- #10307 feat(core,tui,app-server) personality migration @dylan-hurd-oai
- #10313 enable plan mode @aibrahim-oai
- #10120 feat: fire tracking events for skill invocation @alexsong-oai
- #10317 feat: Support loading skills from .agents/skills @gverma-openai
- #10282 Make skills prompt explicit about relative-path lookup @xl-openai
- #10316 Add websocket telemetry metrics and labels @apanasenko-oai
- #10314 chore(config) Rename config setting to personality @dylan-hurd-oai
- #10310 chore(features) Personality => Stable @dylan-hurd-oai
- #10320 Sync system skills from public repo @gverma-openai
- #10322 Sync system skills from public repo for openai yaml changes @gverma-openai
- #10323 fix(config) config schema newline @dylan-hurd-oai
- #10329 Improve plan mode interaction rules @charley-oai
- #10280 Bump thread updated_at on unarchive to refresh sidebar ordering @charley-oai
- #10350 fix: System skills marker includes nested folders recursively @gverma-openai
- #10351 fix(rules) Limit rules listed in conversation @dylan-hurd-oai
- #10354 Do not append items on override turn context @pakrym-oai
- #10309 fix(core) Deduplicate prefix_rules before appending @dylan-hurd-oai
- #10373 chore(core) gpt-5.2-codex personality template @dylan-hurd-oai
- #10375 fix(personality) prompt patch @dylan-hurd-oai
- #10371 feat: vendor app-server protocol schema fixtures @bolinfest

New Features
- Added an optional SOCKS5 proxy listener with policy enforcement and config gating. (#9803)
- Plan mode now streams proposed plans into a dedicated TUI view, plus a feature-gated /plan shortcut for quick mode switching. (#9786, #10103)
- Added /apps to browse connectors in TUI and $ insertion for app prompts. (#9728)
- App-server can now run in external auth mode, accepting ChatGPT auth tokens from a host app and requesting refreshes when needed. (#10012)
- Smart approvals are now enabled by default, with explicit approval prompts for MCP tool calls. (#10286, #10200)
- Introduced a SQLite-backed log database with an improved logs client, thread-id filtering, retention, and heuristic coloring. (#10086, #10087, #10150, #10151, #10229, #10228)
Bug Fixes
- MCP tool image outputs render reliably even when image blocks aren’t first or are partially malformed. (#9815)
- Input history recall now restores local image attachments and rich text elements. (#9628)
- File search now tracks session CWD changes and supports multi-root traversal with better performance. (#9279, #9939, #10240)
- Resuming a thread no longer updates updated_at until the first turn actually starts. (#9950)
- Shell snapshots no longer inherit stdin, avoiding hangs from startup scripts. (#9735)
- Connections fall back to HTTP when WebSocket proxies fail. (#10139)
Documentation
- Documented app-server AuthMode usage and behavior. (#10191)
Chores
- Upgraded the Rust toolchain to 1.93. (#10080)
- Updated pnpm versions used in the repo. (#9992, #10161)
- Bazel build and runfiles handling improvements, including remote cache compression. (#10079, #10098, #10102, #10104)
Changelog
Full Changelog: rust-v0.92.0...rust-v0.93.0
- #9988 nit: better tool description @jif-oai
- #9991 nit: better unused prompt @jif-oai
- #9994 chore: clean orchestrator prompt @jif-oai
- #10001 backend-client: add get_config_requirements_file @gt-oai
- #9992 update pnpm to 10.28.2 to address security issues @mjr-openai
- #9993 description in role type @jif-oai
- #9944 TUI footer: right-align context and degrade shortcut summary + mode cleanly @charley-oai
- #9803 feat(network-proxy): add a SOCKS5 proxy with policy enforcement @viyatb-oai
- #9950 fix(app-server, core): defer initial context write to rollout file until first turn @owenlin0
- #10003 feat: make it possible to specify --config flags in the SDK @bolinfest
- #9797 remove sandbox globals. @iceweasel-oai
- #10009 chore: introduce *Args types for new() methods @bolinfest
- #10011 really fix pwd for windows codex zip @iceweasel-oai
- #10007 Remove load from SKILL.toml fallback @alexsong-oai
- #10008 enable live web search for DangerFullAccess sandbox policy @sayan-oai
- #9815 Fix: Render MCP image outputs regardless of ordering @Kbediako
- #9654 Show OAuth error descriptions in callback responses @blevy-oai
- #10030 Clarify external editor env var message @joshka-oai
- #9949 Ask user question UI footer improvements @charley-oai
- #9359 tui: stabilize shortcut overlay snapshots on WSL @slkzgm
- #10040 fix: enable per-turn updates to web search mode @sayan-oai
- #10041 fix: allow unknown fields on Notice in schema @sayan-oai
- #9628 Restore image attachments/text elements when recalling input history (Up/Down) @charley-oai
- #9982 [skills] Auto install MCP dependencies when running skils with dependency specs. @mzeng-openai
- #9986 fix(core) info cleanup @dylan-hurd-oai
- #9941 error code/msg details for failed elevated setup @iceweasel-oai
- #9489 feat(core) RequestRule @dylan-hurd-oai
- #10026 Add exec policy TOML representation @gt-oai
- #9821 feat: codex exec auto-subscribe to new threads @jif-oai
- #10004 feat: sqlite 1 @jif-oai
- #10083 feat: sort metadata by date @jif-oai
- #10092 Update shell-tool-mcp.yml @dylan-hurd-oai
- #10079 [bazel] Enable remote cache compression @zbarsky-openai
- #10025 Refine request_user_input TUI interactions and option UX @charley-oai
- #10080 Upgrade to rust 1.93 @zbarsky-openai
- #10095 Updat

New Features
- Added a /permissions command with a shorter approval set while keeping /approvals for compatibility. (#9561)
- Added a /skill UI to enable or disable individual skills. (#9627)
- Improved slash-command selection by prioritizing exact and prefix matches over fuzzy matches. (#9629)
- App server now supports thread/read and can filter archived threads in thread/list. (#9569, #9571)
- App server clients now support layered config.toml resolution and config/read can compute effective config from a given cwd. (#9510)
- Release artifacts now include a stable URL for the published config schema. (#9572)
Bug Fixes
- Prevented tilde expansion from escaping HOME on paths like ~//.... (#9621)
- TUI turn timing now resets between assistant messages so elapsed time reflects the latest response. (#9599)
Documentation
- Updated MCP subcommand docs to match current CLI behavior. (#9622)
- Refreshed the skills/list protocol README example to match the latest response shape. (#9623)
Chores
- Removed the TUI2 experiment and its related config/docs, keeping Codex on the terminal-native UI. (#9640)
Changelog
Full Changelog: rust-v0.88.0...rust-v0.89.0
- #9576 [bazel] Upgrade to bazel9 @zbarsky-openai
- #9606 nit: ui on interruption @jif-oai
- #9609 chore: defensive shell snapshot @jif-oai
- #9621 fix: Fix tilde expansion to avoid absolute-path escape @tiffanycitra
- #9573 define/emit some metrics for windows sandbox setup @iceweasel-oai
- #9622 docs: fix outdated MCP subcommands documentation @htiennv
- #9623 Update skills/list protocol readme @gverma-openai
- #9616 [bazel] Upgrade llvm toolchain and enable remote repo cache @zbarsky-openai
- #9624 forgot to add some windows sandbox nux events. @iceweasel-oai
- #9633 Add websockets logging @pakrym-oai
- #9592 Chore: update plan mode output in prompt @shijie-oai
- #9583 Add collaboration_mode to TurnContextItem @charley-oai
- #9510 Add layered config.toml support to app server @etraut-openai
- #9629 feat: better sorting of shell commands @jif-oai
- #9599 fix(tui) turn timing incremental @dylan-hurd-oai
- #9572 feat: publish config schema on release @sayan-oai
- #9549 Reduce burst testing flake @charley-oai
- #9640 feat(tui): retire the tui2 experiment @joshka-oai
- #9597 feat(core) ModelInfo.model_instructions_template @dylan-hurd-oai
- #9627 Add UI for skill enable/disable. @xl-openai
- #9650 chore: tweak AGENTS.md @dylan-hurd-oai
- #9656 Add tui.experimental_mode setting @pakrym-oai
- #9561 feat(tui) /permissions flow @dylan-hurd-oai
- #9653 Fix: Lower log level for closed-channel send @Kbediako
- #9659 Chore: add cmd related info to exec approval request @shijie-oai
- #9693 Revert "feat: support proxy for ws connection" @pakrym-oai
- #9698 Support end_turn flag @pakrym-oai
- #9645 Modes label below textarea @charley-oai
- #9644 feat(core) update Personality on turn @dylan-hurd-oai
- #9569 feat(app-server): thread/read API @owenlin0
- #9571 feat(app-server): support archived threads in thread/list @owenlin0

New Features
- Added collaboration modes and presets to streamline multi-agent workflows. (#9340, #9421)
- Added device-code auth as a standalone fallback in headless environments. (#9333)
- Introduced a request-user-input tool for explicit agent prompts. (#9472)
- Enabled remote models and auto-enable WebSockets transport for smoother connectivity. (#9554, #9578)
Bug Fixes
- Load configs from trusted folders only and fix symlinked config.toml resolution. (#9533, #9445)
- Fixed Azure endpoint invalid input errors. (#9387)
- Resolved a memory leak in core runtime. (#9543)
- Prevented interrupted turns from repeating. (#9043)
- Fixed WSL TUI image paste regression. (#9473)
Documentation
- Updated MCP documentation link to the current destination. (#9490)
- Corrected a “Multi-agents” naming typo in docs. (#9542)
- Added developer instructions for collaboration modes. (#9424)
Chores
- Upgraded to Rust 1.92 and refreshed core Rust dependencies. (#8860, #9465, #9466, #9467, #9468, #9469)
Changelog
Full Changelog: rust-v0.87.0...rust-v0.88.0
- #9373 fix: flaky tests @jif-oai
- #9333 [device-auth] Add device code auth as a standalone option when headless environment is detected. @mzeng-openai
- #9352 Made codex exec resume --last consistent with codex resume --last @etraut-openai
- #9324 add codex cloud list @nornagon-openai
- #9332 Turn-state sticky routing per turn @aibrahim-oai
- #9364 feat: tool call duration metric @jif-oai
- #8860 chore: upgrade to Rust 1.92.0 @viyatb-oai
- #9385 feat: /fork the current session instead of opening session picker @apanasenko-oai
- #9247 feat(app-server, core): return threads by created_at or updated_at @owenlin0
- #9330 feat: show forked from session id in /status @apanasenko-oai
- #9340 Introduce collaboration modes @aibrahim-oai
- #9328 Support enable/disable skill via config/api. @xl-openai
- #9408 Add collaboration_mode override to turns @aibrahim-oai
- #9400 fix(codex-api): treat invalid_prompt as non-retryable @fouad-openai
- #9401 Defer backtrack trim until rollback confirms @aibrahim-oai
- #9414 fix unified_exec::tests::unified_exec_timeouts to use a more unique match value @ahornby
- #9421 Expose collaboration presets @aibrahim-oai
- #9422 chore(core) Create instructions module @dylan-hurd-oai
- #9423 chore(instructions) Remove unread SessionMeta.instructions field @dylan-hurd-oai
- #9424 Add collaboration developer instructions @aibrahim-oai
- #9425 Preserve slash command order in search @aibrahim-oai
- #9059 tui: allow forward navigation in backtrack preview @slkzgm
- #9443 Add collaboration modes test prompts @aibrahim-oai
- #9457 fix(tui2): running /mcp was not printing any output until another event triggered a flush @bolinfest
- #9445 Fixed symlink support for config.toml @etraut-openai
- #9466 chore(deps): bump log from 0.4.28 to 0.4.29 in /codex-rs @dependabot
- #9467 chore(deps): bump tokio from 1.48.0 to 1.49.0 in /codex-rs @dependabot
- #9468 chore(deps): bump arc-swap from 1.7.1 to 1.8.0 in /codex-rs @dependabot
- #9469 chore(deps): bump ctor from 0.5.0 to 0.6.3 in /codex-rs @dependabot
- #9465 chore(deps): bump chrono from 0.4.42 to 0.4.43 in /codex-rs @dependabot
- #9473 Fixed TUI regression related to image paste in WSL @etraut-openai
- #9382 feat: timer total turn metrics @jif-oai
- #9478 feat: close all threads in /new @jif-oai
- #9477 feat: detach non-tty childs @jif-oai
- #9479 prompt 3 @jif-oai
- #9387 Fix invalid input error on Azure endpoint @etraut-openai
- #9463 Remove unused protocol collaboration mode prompts @aibrahim-oai
- #9487 chore: warning metric @jif-oai
- #9490 Fixed stale link to MCP documentation @etraut-openai
- #9461 TUI: collaboration mode UX + always submit UserTurn when enabled @aibrahim-oai
- #9472 Feat: request user input tool @shijie-oai
- #9402 Act on reasoning-included per turn @aibrahim-oai
- #9496 chore: fix beta VS experimental @jif-oai
- #9495 Feat: plan mode prompt update @shijie-oai
- #9451 tui: avoid Esc interrupt when skill popup activ

New Features
- User message metadata (text elements and byte ranges) now round-trips through protocol/app-server/core so UI annotations can survive history rebuilds. (#9331)
- Collaboration wait calls can block on multiple IDs in one request, simplifying multi-thread coordination. (#9294)
- User shell commands now run under the user snapshot so aliases and shell config are honored. (#9357)
- The TUI now surfaces approval requests from spawned/unsubscribed threads. (#9232)
Bug Fixes
- Token estimation during compaction is now accurate, improving budgeting during long sessions. (#9337)
- MCP CallToolResult now includes threadId in both content and structuredContent, and returns a defined output schema for compatibility. (#9338)
- The TUI “Worked for” separator only appears after actual work has occurred. (#8958)
- Piped non-PTY commands no longer hang waiting on stdin. (#9369)
Documentation
- MCP interface docs updated to reflect structured output schema and threadId behavior. (#9338)
Chores
- Windows builds enable the PowerShell UTF-8 feature by default. (#9195)
Changelog
Full Changelog: rust-v0.86.0...rust-v0.87.0
- #9331 Add text element metadata to protocol, app server, and core @charley-oai
- #9195 chore(windows) Enable Powershell UTF8 feature @dylan-hurd-oai
- #8958 fix(tui): only show 'Worked for' separator when actual work was performed @ThanhNguyxn
- #9338 fix(mcp): include threadId in both content and structuredContent in CallToolResult @bolinfest
- #9337 Fix token estimate during compaction @etraut-openai
- #9336 rename model turn to sampling request @aibrahim-oai
- #9232 feat: propagate approval request of unsubscribed threads @jif-oai
- #9357 feat: run user commands under user snapshot @jif-oai
- #9294 feat: collab wait multiple IDs @jif-oai
- #9366 feat: CODEX_CI @jif-oai
- #9367 prompt collab @jif-oai
- #9369 chore: close pipe on non-pty processes @jif-oai

New Features
- Skill metadata can now be defined in SKILL.toml (names, descriptions, icons, brand color, default prompt) and surfaced in the app server and TUI (#9125)
- Clients can explicitly disable web search and signal eligibility via a header to align with server-side rollout controls (#9249)
Bug Fixes
- Accepting an MCP elicitation now sends an empty JSON payload instead of null to satisfy servers expecting content (#9196)
- Input prompt placeholder styling is back to non-italic to avoid terminal rendering issues (#9307)
- Empty paste events no longer trigger clipboard image reads (#9318)
- Unified exec cleans up background processes to prevent late End events after listeners stop (#9304)
Chores
- Refresh the orchestrator prompt to improve internal routing behavior (#9301)
- Reduce noisy needs_follow_up error logging (#9272)
Changelog
Full Changelog: rust-v0.85.0...rust-v0.86.0
- #9301 chore: better orchestrator prompt @jif-oai
- #9304 nit: clean unified exec background processes @jif-oai
- #9307 Revert recent styling change for input prompt placeholder text @etraut-openai
- #9125 Support SKILL.toml file. @xl-openai
- #9249 [search] allow explicitly disabling web search @sayan-oai
- #9272 remove needs_follow_up error log @pap-openai
- #9318 Revert empty paste image handling @aibrahim-oai
- #9196 fix: send non-null content on elicitation Accept @yuvrajangadsingh

New Features
- App-server v2 now emits collaboration tool calls as item events in the turn stream, so clients can render agent coordination in real time. (#9213)
- Collaboration tools gained richer agent control: spawn_agent accepts an agent role preset, and send_input can optionally interrupt a running agent before delivering the message. (#9275, #9276)
- /models metadata now includes upgrade migration markdown so clients can display richer guidance when suggesting model upgrades. (#9219)
Bug Fixes
- [revert] Linux sandboxing now falls back to Landlock-only restrictions when user namespaces are unavailable, and sets no_new_privs before applying sandbox rules. (#9250)
- codex resume --last now respects the current working directory, with --all as an explicit override. (#9245)
- Stdin prompt decoding now handles BOMs/UTF-16 and provides clearer errors for invalid encodings. (#9151)
Changelog
Full Changelog: rust-v0.84.0...rust-v0.85.0
- #9219 Add migration_markdown in model_info @aibrahim-oai
- #9250 fix: fallback to Landlock-only when user namespaces unavailable and set PR_SET_NO_NEW_PRIVS early @viyatb-oai
- #9213 feat: collab tools app-server event mapping @jif-oai
- #9275 feat: add agent roles to collab tools @jif-oai
- #9276 feat: add interrupt capabilities to send_input @jif-oai
- #9209 feat: basic tui for event emission @jif-oai
- #9245 Changed codex resume --last to honor the current cwd @etraut-openai
- #9207 Propagate MCP disabled reason @gt-oai
- #9151 fix(exec): improve stdin prompt decoding @liqiongyu
- #9300 revert: remove pre-Landlock bind mounts apply @viyatb-oai

New Features
- Extend the Rust protocol/types to include additional metadata on text elements, enabling richer client rendering and schema evolution (#9235)
Chores
- Reduce flaky Rust release pipelines (notably on Windows) by increasing the release build job timeout (#9242)
Changelog
Full Changelog: rust-v0.83.0...rust-v0.84.0
- #9242 fix: increase timeout for release builds from 30 to 60 minutes @bolinfest
- #9235 Add text element metadata to types @charley-oai

New Features
- Default API model moved to gpt-5.2-codex. (#9188)
- Headless runs now switch to device-code login automatically so sign-in works without a browser. (#8756)
- Linux sandbox can mount paths read-only to better protect files from writes. (#9112)
- Support partial tool calls rendering in tui
Bug Fixes
- Alternate-screen handling now avoids breaking Zellij scrollback and adds a config/flag to control it. (#8555)
- Windows correctly prompts before unsafe commands when running with a read-only sandbox policy. (#9117)
- Config.toml and rules parsing errors are reported to app-server clients/TUI instead of failing silently. (#9182, #9011)
- Worked around a macOS system-configuration crash in proxy discovery. (#8954)
- Invalid user image uploads now surface an error instead of being silently replaced. (#9146)
Documentation
- Published a generated JSON Schema for config.toml in docs/ to validate configs. (#8956)
- Documented the TUI paste-burst state machine for terminals without reliable bracketed paste. (#9020)
Chores
- Added Bazel build support plus a just bazel-codex helper for contributors. (#8875, #9177)
Changelog
Full Changelog: rust-v0.80.0...rust-v0.81.0
- #8756 [device-auth] When headless environment is detected, show device login flow instead. @mzeng-openai
- #8930 feat: first pass on clb tool @jif-oai
- #8966 nit: rename session metric @jif-oai
- #8969 chore: non mutable btree when building specs @jif-oai
- #8968 chore: move otel provider outside of trace module @jif-oai
- #8973 chore: add mcp call metric @jif-oai
- #8970 chore: add approval metric @jif-oai
- #8975 chore: metrics tool call @jif-oai
- #8901 chore: update metrics temporality @jif-oai
- #8954 Work around crash in system-configuration library @etraut-openai
- #8873 fix(app-server): set originator header from initialize JSON-RPC request @owenlin0
- #8909 Add config to disable /feedback @gt-oai
- #8985 chore: nuke telemetry file @jif-oai
- #8986 Revert "fix(app-server): set originator header from initialize JSON-RPC request" @jif-oai
- #8978 nit: rename to analytics_enabled @jif-oai
- #8963 renaming: task to turn @jif-oai
- #8555 fix: add tui.alternate_screen config and --no-alt-screen CLI flag for Zellij scrollback @hjanuschka
- #8875 feat: add support for building with Bazel @zbarsky-openai
- #8988 fix(app-server): set originator header from initialize (re-revert) @owenlin0
- #8766 fix: harden arg0 helper PATH handling @viyatb-oai
- #8949 Log unhandled sse events @pakrym-oai
- #8996 Add hierarchical agent prompt @pakrym-oai
- #9003 Delete announcement_tip.toml @pakrym-oai
- #8940 Refactor remote models tests to use TestCodex builder @aibrahim-oai
- #8981 Add model provider info to /status if non-default @gt-oai
- #8984 Add URL to responses error messages @gt-oai
- #9008 fix: add .git to .bazelignore @bolinfest
- #9010 fix: include AGENTS.md as repo root marker for integration tests @bolinfest
- #8950 Label attached images so agent can understand in-message labels @charley-oai
- #9032 Revert "Delete announcement_tip.toml" @jif-oai
- #9018 fix: support remote arm64 builds, as well @zbarsky-openai
- #8983 feat: testing harness for collab 1 @jif-oai
- #9088 feat: add wait tool implementation for collab @jif-oai
- #9090 feat: add close tool implementation for collab @jif-oai
- #8971 add static mcp callback uri support @WhammyLeaf
- #9099 nit: add docstring @jif-oai
- #8994 feat: wire fork to codex cli @apanasenko-oai
- #9071 chore(deps): bump tui-scrollbar from 0.2.1 to 0.2.2 in /codex-rs @dependabot
- #9072 chore(deps): bump ts-rs from 11.0.1 to 11.1.0 in /codex-rs @dependabot
- #9074 chore(deps): bump which from 6.0.3 to 8.0.0 in /codex-rs @dependabot
- #9075 chore(deps): bump clap from 4.5.53 to 4.5.54 in /codex-rs @dependabot
- #9076 chore(deps): bump tokio-util from 0.7.16 to 0.7.18 in /codex-rs @dependabot
- #8957 feat: hot reload mcp servers @shijie-oai
- #9107 Remove unused conversation_id header @pakrym-oai
- #9080 Add some tests for image atta

New Features
- Add conversation/thread fork endpoints in the protocol and app server so clients can branch a session into a new thread. (#8866)
- Expose requirements via requirement/list so clients can read requirements.toml and adjust agent-mode UX. (#8800)
- Introduce metrics capabilities with additional counters for observability. (#8318, #8910)
- Add elevated sandbox onboarding with prompts for upgrade/degraded mode plus the /elevate-sandbox command. (#8789)
- Allow explicit skill invocations through v2 API user input. (#8864)
Bug Fixes
- /review <instructions> in TUI/TUI2 now launches the review flow instead of sending plain text. (#8823)
- Patch approval “allow this session” now sticks for previously approved files. (#8451)
- Model upgrade prompt now appears even if the current model is hidden from the picker. (#8802)
- Windows paste handling now supports non-ASCII multiline input reliably. (#8774)
- Git apply path parsing now handles quoted/escaped paths and /dev/null correctly to avoid misclassified changes. (#8824)
- Codex CLI subprocesses again inherit env vars like LD_LIBRARY_PATH/DYLD_LIBRARY_PATH to avoid runtime issues. (#8951)
Documentation
- App-server README now documents skills support and usage. (#8853)
- Skill-creator docs clarify YAML frontmatter formatting and quoting rules. (#8610)
Changelog
Full Changelog: rust-v0.79.0...rust-v0.80.0
- #8734 fix: do not propose to add multiline commands to execpolicy @tibo-openai
- #8802 Enable model upgrade popup even when selected model is no longer in picker @charley-oai
- #8805 chore: stabilize core tool parallelism test @tibo-openai
- #8820 chore: silent just fmt @jif-oai
- #8824 fix: parse git apply paths correctly @tibo-openai
- #8823 fix: handle /review arguments in TUI @tibo-openai
- #8822 chore: rename unified exec sessions @jif-oai
- #8825 fix: handle early codex exec exit @tibo-openai
- #8830 chore: unify conversation with thread name @jif-oai
- #8840 Move tests below auth manager @pakrym-oai
- #8845 fix: upgrade lru crate to 0.16.3 @bolinfest
- #8763 Merge Modelfamily into modelinfo @aibrahim-oai
- #8842 remove unnecessary todos @aibrahim-oai
- #8846 Stop using AuthManager as the source of codex_home @pakrym-oai
- #8844 Fix app-server write_models_cache to treat models with less priority number as higher priority. @aibrahim-oai
- #8850 chore: drop useless feature flags @jif-oai
- #8848 chore: drop some deprecated @jif-oai
- #8853 [chore] update app server doc with skills @celia-oai
- #8451 fix: implement 'Allow this session' for apply_patch approvals @owenlin0
- #8856 Override truncation policy at model info level @aibrahim-oai
- #8849 Simplify error managment in run_turn @aibrahim-oai
- #8767 Add feature for optional request compression @cconger
- #8610 Clarify YAML frontmatter formatting in skill-creator @darlingm
- #8847 Warn in /model if BASE_URL set @gt-oai
- #8801 Support symlink for skills discovery. @xl-openai
- #8800 Feat: appServer.requirementList for requirement.toml @shijie-oai
- #8861 fix: update resource path resolution logic so it works with Bazel @bolinfest
- #8868 fix: use tokio for I/O in an async function @bolinfest
- #8867 add footer note to TUI @iceweasel-oai
- #8879 feat: introduce find_resource! macro that works with Cargo or Bazel @bolinfest
- #8864 Support UserInput::Skill in V2 API. @xl-openai
- #8876 add ability to disable input temporarily in the TUI. @iceweasel-oai
- #8884 fix: make the find_resource! macro responsible for the absolutize() call @bolinfest
- #8774 fix: windows can now paste non-ascii multiline text @dylan-hurd-oai
- #8855 chore: add list thread ids on manager @jif-oai
- #8318 feat: metrics capabilities @jif-oai
- #8826 fix: stabilize list_dir pagination order @tibo-openai
- #8892 chore: drop metrics exporter config @jif-oai
- #8896 chore: align error limit comment @tibo-openai
- #8899 fix: include project instructions in /review subagent @tibo-openai
- #8894 chore: add small debug client @jif-oai
- #8888 fix: lev

New Features
- Add multi-conversation “agent control” so a session can spawn or message other conversations programmatically (#8783, #8788)
- Add app-server thread/rollback so IDE clients can undo the last N turns without rewriting history (#8454)
- Add web_search_cached to enable cached-only Web Search results as a safer alternative to live requests (#8795)
- Allow global exec flags (model/json/sandbox toggles, etc.) to be passed after codex exec resume (#8440)
- Show time/version-targeted announcement tips in the TUI, driven by a TOML file in the repo (#8752)
- Add an [analytics] enabled=... config section to control analytics behavior (#8350)
Bug Fixes
- Fix TUI2 transcripts so streamed markdown reflows on resize and copy/paste preserves soft wraps (#8761)
- Make apply_patch parsing tolerant of whitespace-padded *** Begin Patch / *** End Patch markers (#8746)
- Render paths relative to the current working directory before checking git roots, improving output in non-git workspaces (#8771)
- Prevent CODEX_MANAGED_CONFIG_PATH from overriding managed config in production, closing a policy bypass (#8762)
- Ensure app-server conversations respect the config passed in by the client (#8765)
- Reduce TUI UX glitches: suppress popups when browsing input history, fix copy “pill” rendering, and clear background terminals on interrupt (#8772, #8777, #8786)
Documentation
- Clarify onboarding/login guidance for headless/remote setups by steering users to codex login --device-auth (#8753)
- Update model examples used in tooling/config to current gpt-5.2 naming (#8566)
Chores
- Refactor skills discovery to use the config layer stack so all configured skill folders are considered (#8497)
- Auto-populate GitHub release notes at release creation time (#8799)
- Add more apply_patch test scenarios to harden coverage (#8230)
- Tweak unified exec event emission to only send “begin” when a PTY is present (#8780)
Changelog
Full Changelog: rust-v0.78.0...rust-v0.79.0
- #8753 [device-auth] Update login instruction for headless environments. @mzeng-openai
- #8497 Use ConfigLayerStack for skills discovery. @xl-openai
- #8440 Allow global exec flags after resume and fix CI codex build/timeout @fjord-oai
- #8230 chore(apply-patch) additional scenarios @dylan-hurd-oai
- #8746 fix: accept whitespace-padded patch markers @tibo-openai
- #8761 tui2: stop baking streaming wraps; reflow agent markdown @joshka-oai
- #8771 fix: render cwd-relative paths in tui @joshka-oai
- #8770 fix: fix readiness subscribe token wrap-around @tibo-openai
- #8780 chore: emit unified exec begin only when PTY exist @jif-oai
- #8762 fix: stop honoring CODEX_MANAGED_CONFIG_PATH environment variable in production @bolinfest
- #8566 fix: update model examples to gpt-5.2 @seuros
- #8735 feat: add head-tail buffer for unified_exec @jif-oai
- #8331 chore: add model/list call to app-server-test-client @owenlin0
- #8752 feat: forced tool tips @jif-oai
- #8786 chore: clear background terminals on interrupt @jif-oai
- #8350 feat: add analytics config setting @JaviSoto
- #8783 feat: agent controller @jif-oai
- #8772 suppress popups while browsing input history @xl-openai
- #8777 Clear copy pill background and add snapshot test @joshka-oai
- #8788 feat: drop agent bus and store the agent status in codex directly @jif-oai
- #8454 feat(app-server): thread/rollback API @owenlin0
- #8765 [app-server] fix config loading for conversations @celia-oai
- #8795 add web_search_cached flag @sayan-oai
- #8799 fix: populate the release notes when the release is created @bolinfest

New Features
- TUI2: Normalize mouse wheel + trackpad scrolling across terminals; add tui.scroll_* config settings (PR #8357)
- Add allowed_sandbox_modes to requirements.toml to constrain permitted sandbox modes (PR #8298)
- MCP: OAuth login for streamable HTTP MCP servers no longer requires the rmcp_client feature flag (PR #8087)
- Improve fuzzy file search display/consistency by centralizing file-name derivation in codex-file-search (PR #8334)
- Update bundled model metadata (models.json) (PR #8168)
Bug Fixes
- Fix /undo interacting destructively with git staging / ghost commits (PR #8303)
- TUI2: Reduce redundant redraws while scrolling transcripts (PR #8295)
- Docs: Fix link to contributing.md in experimental.md (PR #8311)
Full Changelog: rust-v0.76.0...rust-v0.77.0
Changelog (PRs merged in this tag range)
- #8374 Remove plan from system skills: #8374
- #8357 TUI2 scroll normalization + config knobs: #8357
- #8353 Thread config loading now receives cwd (internal plumbing): #8353
- #8346 Rename “OpenAI models” to “models manager” (internal refactor): #8346
- #8345 Bump cargo-deny-action version (CI): #8345
- #8334 Move file-name derivation into codex-file-search: #8334
- #8333 Enable resume_warning suite module (test coverage / wiring fix): #8333
- #8330 Make ConstraintError an enum (more structured errors): #8330
- #8303 Fix /undo staging interaction: #8303
- #8298 Add allowed_sandbox_modes in requirements.toml: #8298
- #8295 Coalesce transcript scroll redraws (TUI2 performance): #8295
- #8168 Update models.json: #8168
- #8087 Remove rmcp_client feature flag usage (no longer needed for OAuth login): #8087
- #8311 Fix docs link in experimental.md: #8311

New Features
- Enable skills by default (PR #8297, PR #8325)
- Support admin-scoped skills (PR #8296)
- Introduce ExternalSandbox policy (PR #8290)
- Update system skills and add short descriptions (PR #8328, PR #8301)
- UI tweaks on the skills popup (PR #8250)
- Reduce waiting around unified_exec (PR #8257)
Bug Fixes
- Fix /undo interacting with git staging (PR #8303)
- Fix admin skills behavior (PR #8305)
PRs Merged
- #8330 feat: make ConstraintError an enum
- #8328 Update system skills from OSS repo
- #8325 Revert "Keep skills feature flag default OFF for windows."
- #8311 Fix link to contributing.md in experimental.md
- #8308 Keep skills feature flag default OFF for windows.
- #8305 Fix admin skills.
- #8303 Fix: /undo destructively interacts with git staging (#8214)
- #8301 Add short descriptions to system skills
- #8299 Fix tests
- #8297 skills feature default on.
- #8296 Support admin scope skills.
- #8290 feat: introduce ExternalSandbox policy
- #8276 chore: migrate from Config::load_from_base_config_with_overrides to ConfigBuilder
- #8257 feat: collapse "waiting" of unified_exec
- #8250 UI tweaks on skills popup.

PRs Merged
#8270 — splash screen
#8251 — migrate to new constraint-based loading strategy
#7460 — cloud: default to current branch in cloud exec

Highlights
- Introducing gpt-5.2-codex our latest frontier model with improvements across knowledge, reasoning and coding. Learn more
- Add new slash command /experimental for trying out experimental features
- Ghost snapshot warning disable toggle (#8178)
- UI polish (background terminals, picker cleanup) (#8255, #8232).
PRs Merged
- #8266 feat: add name to beta features
- #8265 caribou
- #8264 docs: clarify codex resume --all (CWD column & filtering)
- #8255 nit: ui background terminals
- #8249 chore: prefer AsRef to &Path
- #8248 chore: simplify loading of Mac-specific logic in config_loader
- #8244 Reintroduce feature flags for skills.
- #8243 Make loading malformed skills fail-open
- #8235 fix: introduce ConfigBuilder
- #8232 chores: clean picker
- #8228 Show migration link
- #8226 chore: cleanup Config instantiation codepaths
- #8221 Change “Team” to “Buisness” and add Education
- #8220 Support SYSTEM skills.
- #8216 speed and reliability improvements for setting reads ACLs
- #8209 feat: model picker
- #8205 fix: PathBuf -> AbsolutePathBuf in ConfigToml struct
- #8203 download new windows binaries when staging npm package
- #8201 chore: add beta features
- #8199 chore: move back stuff out of beta program
- #8198 feat: make list_models non-blocking
- #8196 fix: session downgrade
- #8194 fix: proper skills dir cleanup
- #8186 nit: doc
- #8182 nit: drop dead branch with unified_exec tool
- #8181 nit: prevent race in event rendering
- #8178 feat: add config to disable warnings around ghost snapshot
- #8175 fix: flaky test 6
- #8163 fix the models script
- #8153 Load models from static file
- #8152 [app-server] add new RawResponseItem v2 event
- #8151 chore: update listMcpServerStatus to be non-blocking
- #8149 Add user_agent header
- #8141 chore(apply-patch) unicode scenario
- #8140 include new windows binaries in npm package.
- #8127 Revert “chore: review in read-only (#7593)”
- #8124 fix tui2 compile error
- #8122 docs: refine tui2 viewport roadmap
- #8118 Add a workflow for a hardcoded version of models
- #8117 feat: unified exec footer
- #8114 chore: update listMcpServers to listMcpServerStatus
- #8111 chore(apply-patch) move invocation tests
- #8109 Revert “feat: unified exec footer”
- #8108 feat(sdk): add xhigh reasoning effort support to TypeScript SDK
- #8102 Upgrade GitHub Actions for Node 24 compatibility
- #8098 Add public skills + improve repo skill discovery and error UX
- #8095 feat: change ConfigLayerName into a disjoint union rather than a simple enum
- #8094 bug fixes and perf improvements for elevated sandbox setup
- #8089 refactor(tui2): make transcript line metadata explicit
- #8088 feat: if .codex is a sub-folder of a writable root, then make it read-only to the sandbox
- #8086 chore(app-server): remove stubbed thread/compact API
- #8085 chore: mac codesign refactor
- #8084 chore(ci): drop Homebrew origin/main workaround for macOS runners
- #8079 docs: fix gpt-5.2 typo in config.md
- #8077 better name for windows sandbox features
- #8075 feat: fallback unified_exec to shell_command
- #8071 feat: experimental menu
- #8067 feat: unified exec footer
- #8060 feat: do not compact on last user turn
- #8057 chore: dedup review result duplication
- #8053 nit: trace span for regular task
- #8052 feat: close unified_exec at end of turn
- #8020 Fixes mcp elicitation test that fails for me when run locally
- #8004 Fix: Detect Bun global install via path check
- #8000 Fixed resume matching to respect case insensitivity when using WSL mount points
- #7997 feat: merge remote models instead of destructing
- #7969 Fix: Skip Option<()> schema generation to avoid invalid Windows filenames (#7479)
- #7961 refactor TUI event loop to enable dropping + recreating crossterm event stream
- #7956 fix parallel tool calls
- #7935 exec-server: additional context for errors
- #7931 chore: persist comments in edit
- #7791 chore(shell_command) fix freeform timeout output
- #7778 feat: Constrain values for approval_policy
- #7601 WIP: R

New Features
- Add ghost snapshot v2 for improved session capture (PR #8055)
- Support ghost commits in config (PR #7873)
- Reimplement skills loading via SkillsManager and skills/list for consistent discovery (PR
#7914)
- Add OpenTelemetry tracing for Codex (PR #7844)
Bug Fixes
- Prevent panic when session contains a tool call without an output (PR #8048)
- Avoid triggering keybindings view on input bursts (PR #7980)
- Change default wrap algorithm from OptimalFit to FirstFit (PR #7960)
- Introduce AbsolutePathBuf as part of sandbox config (PR #7856)
- Include Error in log messages (PR #7955)
PRs Merged
- #8076 stage new windows sandbox binaries as artifacts
- #8069 Fixed formatting issue
- #8066 Update config.md
- #8055 feat: ghost snapshot v2
- #7873 feat: config ghost commits
- #7980 fix: Don't trigger keybindings view on input burst
- #8045 chore(deps): bump lru from 0.12.5 to 0.16.2 in /codex-rs
- #8043 chore(deps): bump sentry from 0.34.0 to 0.46.0 in /codex-rs
- #8039 chore(deps): bump actions/cache from 4 to 5
- #8037 chore(deps): bump actions/download-artifact from 4 to 7
- #8048 Do not panic when session contains a tool call without an output
- #8046 chore(deps): bump socket2 from 0.6.0 to 0.6.1 in /codex-rs
- #8038 chore(deps): bump actions/upload-artifact from 5 to 6
- #8047 chore: fix tooltip typos and align tone
- #8024 docs: document enabling experimental skills
- #7914 Reimplement skills loading using SkillsManager + skills/list op.
- #7962 docs: update the docs for @openai/codex-shell-tool-mcp
- #7960 Changed default wrap algorithm from OptimalFit to FirstFit
- #7965 Sync tui2 with tui and keep dual-run glue
- #7844 [codex] add otel tracing
- #7957 docs: remove blanket ban on unsigned integers
- #7955 fix: include Error in log message
- #7954 fix: added test helpers for platform-specific paths
- #7856 fix: introduce AbsolutePathBuf as part of sandbox config

Highlights
- Config API cleanup (#7924): new config API and cleaner config loading flow.
- Remote compact for API-key users (#7835): enable remote compacting in key-based sessions.
- MCP and TUI status visibility (#7828, #7907): restore MCP startup progress messages in the TUI and use latest disk values
for server status.
- Windows and PowerShell quality-of-life (#7607, #7893, #7942, #7137): locate pwsh/powershell reliably, parse PowerShell with
PowerShell, sign additional Windows executables, and fix WSL2 toasts.
- Sandbox and safety updates (#7809, #7889, #7728): Elevated Sandbox 3/4 plus expanded safe command list.
- Model/prompt UX for gpt-5.2 (#7934, #7910, #7874, #7911): prompt updates and clearer xhigh reasoning warnings/docs.
PRs Merged
- fix cargo build switch #7948 @[iceweasel-oai]
- fix: restore MCP startup progress messages in TUI (fixes #7827) #7828 @[ivanmurashko]
- support 1p #7945 @[aibrahim-oai]
- Sign two additional exes for Windows #7942 @[iceweasel-oai]
- fix: use PowerShell to parse PowerShell #7607 @[bolinfest]
- chore(prompt) Update base prompt #7943 @[dylan-hurd-oai]
- Elevated Sandbox 4 #7889 @[iceweasel-oai]
- chore(prompt) Remove truncation details #7941 @[dylan-hurd-oai]
- feat: clean config loading and config api #7924 @[jif-oai]
- chores: models manager #7937 @[aibrahim-oai]
- Remote compact for API-key users #7835 @[pakrym-oai]
- chore(gpt-5.2) prompt update #7934 @[dylan-hurd-oai]
- fix: race on rx subscription #7921 @[jif-oai]
- fix: break tui #7876 @[jif-oai]
- feat: more safe commands #7728 @[jif-oai]
- fix(tui): show xhigh reasoning warning for gpt-5.2 #7910 @[voctory]
- Make skill name and description limit based on characters not byte counts #7915 @[etraut-openai]
- feat: introduce utilities for locating pwsh.exe and powershell.exe #7893 @[bolinfest]
- docs: clarify xhigh reasoning effort on gpt-5.2 #7911 @[voctory]
- feat: use latest disk value for mcp servers status #7907 @[shijie-oai]
- Revert "fix(apply-patch): preserve CRLF line endings on Windows" #7903 @[dylan-hurd-oai]
- Make migration screen dynamic #7896 @[aibrahim-oai]
- Fix misleading 'maximize' high effort description on xhigh models #7874 @[voctory]
- Added deprecation notice for "chat" wire_api #7897 @[etraut-openai]
- Fix toasts on Windows under WSL 2 #7137 @[dank-openai]
- fix: policy/.codexpolicy -> rules/.rules #7888 @[bolinfest]
- Update RMCP client config guidance #7895 @[nornagon-openai]
- Update Model Info #7853 @[aibrahim-oai]
- Elevated Sandbox 3 #7809 @[iceweasel-oai]
- remove release script #7885 @[aibrahim-oai]
- Chore: limit find family visability #7891 @[aibrahim-oai]
- fix: omit reasoning summary when ReasoningSummary::None #7845 @[apanasenko-oai]
- fix: drop stale filedescriptor output hash for nix #7865 @[tyleranton]
- fix: dont quit on 'q' in onboarding ApiKeyEntry state #7869 @[sayan-oai]

Highlights
- Introducing gpt-5.2 our latest frontier model with improvements across knowledge, reasoning and coding. Learn More
PRs Merged
#7838 Show the default model in model picker @aibrahim-oai
#7833 feat(tui2): copy tui crate and normalize snapshots @joshka-oai
#7509 fix: thread/list returning fewer than the requested amount due to filtering CXA-293 @JaviSoto
#7832 fix: ensure accept_elicitation_for_prompt_rule() test passes locally @bolinfest
#7847 fixing typo in execpolicy docs @zhao-oai
#7831 [app-server] make app server not throw error when login id is not found @celia-oai
#7848 fix: add a hopefully-temporary sleep to reduce test flakiness @bolinfest
#7850 [app-server] Update readme to include mcp endpoints @celia-oai
#7851 fix: remove inaccurate #[allow(dead_code)] marker @bolinfest
#7859 Fixed regression that broke fuzzy matching for slash commands @etraut-openai
#7854 Only show Worked for after the final assistant message @pakrym-oai
#7792 Elevated Sandbox 2 @iceweasel-oai
#7855 fix(stuff) @dylan-hurd-oai
#7870 feat: warning for long snapshots @jif-oai
#7786 feat: add shell snapshot for shell command @jif-oai
#7875 fix: flaky tests 4 @jif-oai
#7882 feat: robin @aibrahim-oai
#7884 Revert “Only show Worked for after the final assistant message” @pakrym-oai

Highlights
- Skills: Explicit skill selections now inject SKILL.md content into the turn; skills load once per session and warn if a file
can’t be read (#7763).
- Config API: config/read is fully typed; config writes preserve comments/order; model is optional to match real configs (#7658,
#7789, #7769).
- TUI/UX: Log files drop ANSI codes; vim navigation for option selection and transcript pager; transcript continuity fix; slash-
command popup no longer triggers on invalid input; experimental tui2 frontend behind a flag (#7836, #7784, #7550, #7363,
#7704, #7793).
- Exec & sandbox: Shell snapshotting, reworked unified-exec events, elevated sandbox allowances (sendmsg/recvmsg), clearer rate-
limit warnings, better request-id logging, and safer escalations (#7641, #7775, #7788, #7779, #7795, #7830, #7750).
- Platform/auth/build: MCP in-session login, remote-branch review support, Windows signing toggles, ConPty vendoring, Nix hash
fixes, and safer release guardrails (#7751, #7813, #7757/#7804/#7806, #7656, #7762, #7834).
- Misc fixes: Unsupported images error cleanly, absolute config paths, parallel test stability, duplicated feature spec removal,
experimental-model prompt/tools, and more (#7478, #7796, #7589, #7818, #7826, #7823, #7765).
PRs Merged
- #7836 Disable ansi codes in TUI log file
- #7834 Error when trying to push a release while another release is in progress
- #7830 Remove conversation_id and bring back request ID logging
- #7826 fix: flaky tests 3
- #7823 fix: remove duplicated parallel FeatureSpec
- #7818 fix: flaky test 2
- #7817 fix: Upgrade @modelcontextprotocol/sdk to ^1.24.0
- #7813 feat: use remote branch for review is local trails
- #7807 chore: disable trusted signing pkg cache hit
- #7806 Revert "Revert "feat: windows codesign with Azure trusted signing""
- #7804 Revert "feat: windows codesign with Azure trusted signing"
- #7799 Removed experimental "command risk assessment" feature
- #7797 parse rg | head a search
- #7796 fix: introduce AbsolutePathBuf and resolve relative paths in config.toml
- #7795 Express rate limit warning as % remaining
- #7793 feat(tui2): add feature-flagged tui2 frontend
- #7789 [app-server] Preserve comments & order in config writes
- #7788 Elevated Sandbox 1
- #7787 fix more typos in execpolicy.md
- #7784 Add vim-style navigation for CLI option selection
- #7779 allow sendmsg/recvmsg syscalls in Linux sandbox
- #7775 chore: rework unified exec events
- #7769 make model optional in config
- #7765 Use codex-max prompt/tools for experimental models
- #7763 Inject SKILL.md when it’s explicitly mentioned
- #7762 Fix Nix cargo output hashes for rmcp and filedescriptor
- #7757 Revert "Revert "feat: windows codesign with Azure trusted signing""
- #7756 Vendor ConPtySystem
- #7751 feat: support mcp in-session login
- #7750 refactor with_escalated_permissions to use SandboxPermissions
- #7704 fix: Prevent slash command popup from activating on invalid inputs
- #7658 [app-server-protocol] Add types for config
- #7641 feat: shell snapshotting
- #7589 chore: enable parallel tc
- #7550 Add vim navigation keys to transcript pager
- #7478 Fix: gracefully error out for unsupported images
- #7363 Fix transcript pager page continuity
- #7779 allow sendmsg/recvmsg syscalls in Linux sandbox (already listed; ensure single entry)
- #7788 Elevated Sandbox 1 (already listed)
- #7784 Add vim-style navigation for CLI option selection (already listed)
- #7807/7806/7804 Windows signing toggles (grouped above)

Highlights
- Execpolicy: TUI can whitelist command prefixes after an approval, sandbox denials propose an amendment you can accept, shell MCP now runs execpolicy so MCP tools follow the same rules, and
fallback checks inspect each pipeline segment so unsafe tails (e.g., | rm -rf) are still caught (#7033, #7543, #7609, #7653, #7544).
- Unified exec & shell stability: status line shows clearer progress, Windows unified-exec crash fixed, long commands wrap without breaking layout, and SSE/session cleanup reduces stuck or
dangling sessions after tool calls (#7563, #7620, #7655, #7594, #7592).
- TUI updates: cross-platform shortcut handling is consistent (Ctrl+N/P and list selection now work everywhere), so navigation matches between overlays, lists, and text areas (#7583, #7629).
- Apply-patch: Windows CRLF line endings are preserved, new e2e scenarios cover more patch shapes, and Windows-specific test coverage reduces regressions in patch flows (#7515, #7567, #7554). Thanks to @cnaples79 who contributed the core part of this fix!
- Cloud exec: codex cloud exec accepts --branch for remote runs and now exposes status/diff/apply flows so you can inspect and apply changes from the cloud path (#7602, #7614).
- Signing: Linux artifacts are signed via sigstore. (#7674).
- General fixes: parallel tool-call chat now returns correctly, ghost snapshot tokens aren’t billed, missing tool names no longer crash the litellm proxy, and migration prompts use HTTPS links
(#7634, #7638, #7724, #7705).
PRs Merged
- #6793 FIX: WSL Paste image does not work @Waxime64
- #6846 feat(core) Add login to shell_command tool @dylan-hurd-oai
- #6918 Add Enterprise plan to ChatGPT login description @ae-openai
- #7033 whitelist command prefix integration in core and tui @zhao-oai
- #7310 Inline response recording and remove process_items indirection @aibrahim-oai
- #7515 fix(apply-patch): preserve CRLF line endings on Windows @dylan-hurd-oai
- #7543 execpolicy tui flow @zhao-oai
- #7544 Refactor execpolicy fallback evaluation @zhao-oai
- #7547 Use shared check sandboxing @pakrym-oai
- #7554 chore(core): test apply_patch_cli on Windows @dylan-hurd-oai
- #7561 Do not emit start/end events for write stdin @pakrym-oai
- #7563 Slightly better status display for unified exec @pakrym-oai
- #7567 chore(apply-patch) scenarios for e2e testing @dylan-hurd-oai
- #7571 remove model_family from `config @aibrahim-oai
- #7580 feat: update sandbox policy to allow TTY @jif-oai
- #7583 Fix handle_shortcut_overlay_key for cross-platform consistency @448523760
- #7588 chore: default warning messages to true @jif-oai
- #7591 chore: tool tip for /prompt @jif-oai
- #7592 fix: release session ID when not used @jif-oai
- #7593 chore: review in read-only @jif-oai
- #7594 fix: sse for chat @jif-oai
- #7595 Update execpolicy.md @zhao-oai
- #7602 add --branch to codex cloud exec @nornagon-openai
- #7603 Add models endpoint @aibrahim-oai
- #7605 fix(app-server): add duration_ms to McpToolCallItem @owenlin0
- #7609 feat: exec policy integration in shell mcp @zhao-oai
- #7610 fix: taking plan type from usage endpoint instead of thru auth token @zhao-oai
- #7611 fix(app-server): add will_retry to ErrorNotification @owenlin0
- #7614 cloud: status, diff, apply @nornagon-openai
- #7615 chore: refactor to move Arc concern outside exec_policy_for @bolinfest
- #7616 Call models endpoint in models manager @aibrahim-oai
- #7617 fix: add integration tests for codex-exec-mcp-server with execpolicy @bolinfest
- #7620 Fix unified_exec on windows @pakrym
- #7621 Wire with_remote_overrides to construct model families @aibrahim-oai
- #7626 fix typo @zhao-oai
- #7629 fix(tui): add missing Ctrl+n/Ctrl+p support to ListSelectionView @pppp606
- #7634 fix: chat completion with parallel tool call @jif-oai
- #7638 fix: ignore ghost snapshots in token consumption @jif-oai
- #7645 Also load skills from repo root. @xl-openai
- #7648 Add remote models feature flag @aibrahim-oai
- #7651 fix: OTEL HTTP exporter panic and mT

Highlights
- Codex Max as default (#7566): Codex Max is now the default model, and a TUI panic related to async-in-sync code was fixed.
- Better resume UX (#7302, #7303): Added a /resume slash command and improved resume performance so picking work back up is snappier.
- Tooltips & tips UX (#7557, #7440): Tips/tooltips are rendered via markdown with a bold “Tip” label and richer Codex tooltips across the app.
- TUI quality-of-life (#7530, #7448, #7514, #7461): TUI gets Ctrl‑P/N navigation, screen-line-capped shell output, restored Windows clipboard image paste, and a refactor for cleaner layout.
- History and context hygiene (#6242, #7483, #7545, #7431, #7483): history.jsonl is trimmed by history.max_bytes, common junk dirs (incl. pycache) are ignored by default, and paste placeholders stay distinct.
PRs Merged
- use markdown for rendering tips #7557 @[Jeremy Rose]
- Migrate codex max #7566 @[Ahmed Ibrahim]
- Remove test from #7481 that doesn't add much value #7558 @[Eric Traut]
- [app-server] make file_path for config optional #7560 @[Celia Chen]
- Migrate model family to models manager #7565 @[Ahmed Ibrahim]
- Migrate tui to use models manager #7555 @[Ahmed Ibrahim]
- Introduce ModelsManager and migrate app-server to use it. #7552 @[Ahmed Ibrahim]
- fix: wrap long exec lines in transcript overlay #7481 @[muyuanjin]
- fix: Features should be immutable over the lifetime of a session/thread #7540 @[Michael Bolin]
- feat: Support listing and selecting skills via $ or /skills #7506 @[xl-openai]
- [app-server] fix: add thread_id to turn/plan/updated #7553 @[Owen Lin]
- feat(tui): map Ctrl-P/N to arrow navigation in textarea #7530 @[Aofei Sheng]
- fix(tui): limit user shell output by screen lines #7448 @[muyuanjin]
- Migrate model preset #7542 @[Ahmed Ibrahim]
- fix: main #7546 @[jif-oai]
- feat: add pycache to excluded directories #7545 @[jif-oai]
- chore: update unified exec sandboxing detection #7541 @[jif-oai]
- add slash resume #7302 @[Ahmed Ibrahim]
- chore: conversation_id -> thread_id in app-server feedback/upload #7538 @[Owen Lin]
- chore: delete unused TodoList item from app-server #7537 @[Owen Lin]
- chore: update app-server README #7510 @[Owen Lin]
- chore: remove bun env var detect #7534 @[Shijie Rao]
- feat: support list mcp servers in app server #7505 @[Shijie Rao]
- seatbelt: allow openpty() #7507 @[Jeremy Rose]
- feat: codex tool tips #7440 @[jif-oai]
- feat: retroactive image placeholder to prevent poisoning #6774 @[jif-oai]
- feat: model warning in case of apply patch #7494 @[jif-oai]
- fix(tui) Support image paste from clipboard on native Windows #7514 @[Dylan Hurd]
- fix(unified_exec): use platform default shell when unified_exec shell… #7486 @[Robby He]
- Update device code auth strings. #7498 @[Matthew Zeng]
- fix: inline function marked as dead code #7508 @[Michael Bolin]
- improve resume performance #7303 @[Ahmed Ibrahim]
- fix: path resolution bug in npx #7134 @[Michael Bolin]
- Ensure duplicate-length paste placeholders stay distinct #7431 @[Joshua Sutton]
- feat: support --version flag for @openai/codex-shell-tool-mcp #7504 @[Michael Bolin]
- refactor: tui.rs extract several pieces #7461 @[Josh McKinney]
- chore: make create_approval_requirement_for_command an async fn #7501 @[Michael Bolin]
- Trim history.jsonl when history.max_bytes is set #6242 @[liam]
- fix: remove serde(flatten) annotation for TurnError #7499 @[Owen Lin]
- persisting credits if new snapshot does not contain credit info #7490 @[zhao-oai]
- fix: drop lock once it is no longer needed #7500 @[Michael Bolin]
- execpolicy helpers #7032 @[zhao-oai]
- Show token used when context window is unknown #7497 @[Ahmed Ibrahim]
- Use non-blocking mutex #7467 @[Ahmed Ibrahim]
- Fix: track only untracked paths in ghost snapshots #7470 @[lionel-oai]
- feat: ignore standard directories #7483 @[jif-oai]
- fix: add ts number annotations for app-server v2 types #7492 @[Owen Lin]
- feat: intercept apply_patch for unified_exec #7446 @[jif-oai]
- chore: remo

Bug fixes
- Fixes the bug where enabling web search can lead to Invalid value: 'other'. errors.
PRs Merged
- [app-server] feat: add Declined status for command exec by @owenlin0 in #7101
- chore: drop model_max_output_tokens by @jif-oai in #7100
- fix: clear out duplicate entries for bash in the GitHub release by @bolinfest in #7103
Full Changelog: rust-v0.62.0...rust-v0.63.0

Highlights
- ExecPolicy2 integration and exec-server prep: core now integrates ExecPolicy2 with exec-server refactors and cutover groundwork, plus quickstart docs to help teams adopt the new policy engine.
- Improved truncation and error reporting: single-pass truncation reduces duplicate work, and error events can now carry optional status codes for clearer observability.
- Shell reliability and sandbox warnings: fallback shell selection is hardened and world-writable directory warnings are less noisy, including improved messaging on Windows.
- UX fixes: corrected reasoning display, preserved review footer context after /review, and the model migration screen now shows only once.
PRs Merged
- fix(app-server) move windows world writable warning (#6916) — @dylan-hurd-oai
- [core] add optional status_code to error events (#6865) — @celia-oai
- fix: prepare ExecPolicy in exec-server for execpolicy2 cutover (#6888) — @bolinfest
- stop over-reporting world-writable directories (#6936) — @iceweasel-oai
- fix(context left after review): review footer context after /review (#5610) — @guidedways
- Fix/correct reasoning display (#6749) — @lionelchg
- chore: refactor exec-server to prepare it for standalone MCP use (#6944) — @bolinfest
- fix(shell) fallback shells (#6948) — @dylan-hurd-oai
- execpolicy2 core integration (#6641) — @zhao-oai
- Single pass truncation (#6914) — @pakrym-oai
- update execpolicy quickstart readme (#6952) — @zhao-oai
- stop model migration screen after first time. (#6954) — @aibrahim-oai

Bug fix:
- Default model for API users is now gpt-5.1-codex

Highlights
- GPT-5.1-Codex-Max: introducing our newest frontier agentic coding model. GPT-5.1-Codex-Max delivers higher reliability, faster iteration, and support for long-running, project-scale workflows. Learn more at https://www.openai.com/index/gpt-5-1-codex-max
- Native Compaction Support: added first-class support for Compaction, improving performance across extended coding sessions.
- Expanded Tool Token Limits: codex models now support up to 10,000 tool output tokens. Configure this via tool_output_token_limit in config.toml.
- Windows Agent mode: Introduced Agent mode for native Windows. Codex can read files, write files, and run commands in your working folder with fewer approvals. Agent mode uses a new experimental Windows sandbox to limit filesystem and network access. Learn more at https://developers.openai.com/codex/windows
- TUI and UX Improvements
- Eliminated ghost snapshot notifications when no git repository is present.
- Codex Resume now displays branches and respects the current working directory for filtering.
- Added placeholder icons for images.
- Credits are now visible in /status.
PRs Merged
- fix: don't truncate at new lines (#6907) — @aibrahim
- feat: arcticfox in the wild (#6906) — @aibrahim
- [app-server] populate thread>turns>items on thread/resume (#6848) — @owenlin0
- nit: useless log to debug (#6898) — @jif
- fix(core) Support changing /approvals before conversation (#6836) — @dylan.hurd
- chore: consolidate compaction token usage (#6894) — @jif
- chore(app-server) world-writable windows notification (#6880) — @dylan.hurd
- fix: parallel tool call instruction injection (#6893) — @jif
- nit: stable (#6895) — @jif
- feat: warning large commits (#6838) — @jif
- fix label (#6892) — @tibo
- Move shell to use truncate_text (#6842) — @aibrahim
- Run remote auto compaction (#6879) — @pakrym
- flaky-unified_exec_formats_large_output_summary (#6884) — @aibrahim
- shell_command returns freeform output (#6860) — @pakrym
- chore(core) arcticfox (#6876) — @dylan.hurd
- fix(tui) ghost snapshot notifications (#6881) — @dylan.hurd
- fix: typos in model picker (#6859) — @aibrahim
- chore: update windows docs url (#6877) — @AE
- feat: tweak windows sandbox strings (#6875) — @AE
- fix: add more fields to ThreadStartResponse and ThreadResumeResponse (#6847) — @mbolin
- chore: update windows sandbox docs (#6872) — @AE
- Remote compaction on by-default (#6866) — @pakrym
- [app-server] introduce turn/completed v2 event (#6800) — @celia
- update credit status details (#6862) — @zhao
- tui: add branch to 'codex resume', filter by cwd (#6232) — @172423086+nornagon-openai
- smoketest for browser vuln, rough draft of Windows security doc (#6822) — @iceweasel
- windows sandbox: support multiple workspace roots (#6854) — @iceweasel
- updating codex backend models (#6855) — @zhao
- exec-server (#6630) — @172423086+nornagon-openai
- Fix tests so they don't emit an extraneous config.toml in the source tree (#6853) — @etraut
- [app-server-test-client] feat: auto approve command (#6852) — @owenlin0
- Improved runtime of generated_ts_has_no_optional_nullable_fields test (#6851) — @etraut
- fix: local compaction (#6844) — @jif
- Fix typo in config.md for MCP server (#6845) — @simcoea
- [codex][otel] support mtls configuration (#6228) — @apanasenko
- feat: review in app server (#6613) — @jif
- chore(config) enable shell_command (#6843) — @dylan.hurd
- Prompt to turn on windows sandbox when auto mode selected. (#6618) — @iceweasel
- Add the utility to truncate by tokens (#6746) — @aibrahim
- Update faq.md section on supported models (#6832) — @adpena
- fixing localshell tool calls (#6823) — @zhao
- feat: enable parallel tool calls (#6796) — @jif
- feat: remote compaction (#6795) — @jif
- nit: app server (#6830) — @jif
- nit: mark ghost commit as stable (#6833) — @jif
- feat: git branch tooling (#6831) — @jif
- 🐛 fix(rmcp-client): refresh OAuth tokens using expires_at (#6574) — @LaelLuo
- fix(windows) shell_command on windows, minor

Highlights
- Support for gpt5.1 models family. Read more
- App server enhancements: new JSON schema generator command, item started/completed events, macro cleanup, reduced boilerplate, and tightened duplicate-code hygiene (#6406 #6517 #6470 #6488).
- Quality of life fixes: doc updates (web_search, SDK, config), TUI shortcuts inline, seatbelt/Wayland/brew/compaction/cloud-tasks bugfixes, clearer warnings, auth-aware status output, and OTEL test stabilization (#5889 #6424 #6425 #6376 #6421 #4824 #6238 #5856 #6446 #6529 #6541).
PRs Merged
- #6381 — Improve world-writable scan (917f39ec1)
- #5889 — feat(tui): Display keyboard shortcuts inline for approval options (5beb6167c)
- #6389 — more world-writable warning improvements (a47181e47)
- #6425 — Fix SDK documentation: replace “file diffs” with “file change notifications” (8b80a0a26)
- #6421 — fix(seatbelt): Allow reading hw.physicalcpu (c07461e6f)
- #5856 — fix(cloud-tasks): respect cli_auth_credentials_store config (5f1fab0e7)
- #6387 — For npm upgrade on Windows, go through cmd.exe to get path traversal working (625f2208c)
- #6437 — chore(deps): bump codespell-project/actions-codespell from 2.1 to 2.2 (7c7c7567d)
- #6438 — chore(deps): bump taiki-e/install-action from 2.60.0 to 2.62.49 (082d2fa19)
- #6443 — chore(deps): bump askama from 0.12.1 to 0.14.0 in /codex-rs (78b2aeea5)
- #6444 — chore(deps): bump zeroize from 1.8.1 to 1.8.2 in /codex-rs (e2598f509)
- #6446 — Fix warning message phrasing (131c38436)
- #6424 — Fix config documentation: correct TOML parsing description (557ac6309)
- #6454 — Move compact (50a77dc13)
- #6376 — Updated docs to reflect recent changes in web_search configuration (65cb1a1b7)
- #6407 — fix: use generate_ts from app_server_protocol (42683dadf)
- #6419 — Support exiting from the login menu (b46012e48)
- #6422 — Don’t lock PRs that have been closed without merging (591615315)
- #6406 — [app-server] feat: add command to generate json schema (fbdedd9a0)
- #6238 — fix: update brew auto update version check (788badd22)
- #6433 — Add opt-out for rate limit model nudge (e743d251a)
- #6246 — Add user command event types (980886498)
- #6466 — feat: add workdir to unified_exec (f01f2ec9e)
- #6468 — [app-server] chore: move initialize out of deprecated API section (2ac49fea5)
- #4824 — Fix wayland image paste error (52e97b9b6)
- #4098 — add codex debug seatbelt --log-denials (0271c20d8)
- #6477 — refactor(tui): job-control for Ctrl-Z handling (60deb6773)
- #6470 — [app-server] update macro to make renaming methods less boilerplate-y (3838d6739)
- #6478 — upload Windows .exe file artifacts for CLI releases (9aff64e01)
- #6482 — flip rate limit status bar (930f81a17)
- #6480 — Use codex-linux-sandbox in unified exec (6c36318bd)
- #6489 — Colocate more of bash parsing (bb7b0213a)
- #6488 — [hygiene][app-server] have a helper function for duplicate code in turn APIs (695187277)
- #6041 — Enable ghost_commit feature by default (052b05283)
- #6503 — nit: logs to trace (ad279eacd)
- #6492 — Add unified exec escalation handling and tests (807e2c27f)
- #6517 — [app-server] add item started/completed events for turn items (e357fc723)
- #6523 — Update full-auto description with on-request (eb1c651c0)
- #6528 — Re-add prettier log-level=warn to generate-ts (424bfecd0)
- #6507 — feat: warning switch model on resume (530db0ad7)
- #6510 — feat: shell_command tool (29364f3a9)
- #6516 — chore: verify boolean values can be parsed as config overrides (c3a710ee1)
- #6541 — Fix otel tests (7d9ad3eff)
- #6534 — feat: only wait for mutating tools for ghost commit (e00eb50db)
- #6529 — Fixed status output to use auth information from AuthManager (ad09c138b)
- #6551 — Add gpt-5.1 model definitions (ec69a4a81)
- #6558 — Do not double encode request bodies in logging (2f58e6999)
- #6483 — [app-server] feat: thread/resume supports history, path, and overrides (964220ac9)
- #6561 — NUX for gpt5.1 (e63ab0dd6)
- #6568 — Set verbosity to low for 5.1 (f97874093)
- #6567 — Update subtitle o

Highlights
- TUI quality-of-life: ctrl-n/p navigation for slash command lists and backtracking skips the /status noise.
- Improve timeout on long running commasnds
PRs Merged
- #6233 – Freeform unified exec output formatting
- #6342 – Make generate_ts prettier output warn-only
- #6335 – TUI: fix backtracking past /status
- #1994 – Enable CTRL-n/CTRL-p for navigating slash commands, files, history
- #6340 – Skip retries on insufficient_quota errors
- #6345 – Remove shell tool when unified exec is enabled
- #6347 – Refresh AI labeler rules to match issue tracker labels
- #6346 – Prefer wait_for_event over wait_for_event_with_timeout (initial update)
- #5486 – Fix apply_patch rename/move path resolution
- #6349 – Prefer wait_for_event over wait_for_event_with_timeout (follow-up)
- #6336 – App-server: implement account/read endpoint
- #6338 – App-server: expose additional fields on Thread
- #6353 – App-server: add auth v2 doc & update Codex MCP interface section
- #6368 – App-server: README updates for threads and turns
- #6351 – Promote shell config tool to model family config
- #6369 – TUI: add inline comments to tui.rs
- #6370 – Add --promote-alpha option to create_github_release script
- #6367 – SDK: add network_access and web_search options to TypeScript SDK
- #6097 (includes work from #6086) – WSL: normalize Windows paths during update
- #6377 – App-server docs: add initialization section
- #6373 – Terminal refactor: remove deprecated flush logic
- #6252 – Core: replace Cloudflare 403 HTML with friendly message
- #6380 – Unified exec: allow safe commands without approval
- #5258 – Kill shell tool process groups on timeout

Highlights
- Introducing our new model GPT-5-Codex-Mini — a more compact and cost-efficient version of GPT-5-Codex
PRs merged
- #6211 fix: Update the deprecation message to link to the docs
- #6212 [app-server] feat: export.rs supports a v2 namespace, initial v2
notifications
- #6230 Fix nix build
- #3643 fix(core): load custom prompts from symlinked Markdown files
- #4200 allow codex to be run from pid 1
- #6234 Upgrade rmcp to 0.8.4
- #6237 Add modelReasoningEffort option to TypeScript SDK
- #5565 tui: refactor ChatWidget and BottomPane to use Renderables
- #6229 refactor Conversation history file into its own directory
- #6231 Improved token refresh handling to address “Re-connecting” behavior
- #6261 Update rmcp to 0.8.5
- #6214 [app-server] feat: v2 Thread APIs
- #6282 Fixes intermittent test failures in CI
- #6249 stop capturing r when environment selection modal is open
- #6183 [App-server] Implement v2 for account/login/start and account/login/completed
- #6285 Prevent dismissal of login menu in TUI
- #4388 fix: ToC so it doesn’t include itself or duplicate the end marker
- #6288 [App-server] Add account/login/cancel v2 endpoint
- #6286 feat: add model nudge for queries
- #6300 feat: support models with single reasoning effort
- #6319 chore: rename for clarity
- #6216 [app-server] feat: v2 Turn APIs
- #6295 docs: Fix code fence and typo in advanced guide
- #6326 chore: fix grammar mistakes
- #6283 Windows Sandbox: Show Everyone-writable directory warning
- #6289 chore: move relevant tests to app-server/tests/suite/v2
- #6333 feat: clarify that gpt-5-codex should not amend commits unless requested
- #6332 Updated contributing guidelines and PR template to request link to bug report
in PR notes
- #5980 core: widen sandbox to allow certificate ops when network is enabled
- #6337 [App Server] Add more session metadata to listConversations

Highlights
#6222 reverted #6189, fixing #6220 (and other similar reports of the Codex CLI failing to start on Linux).
Merged PRs
- #6222 Revert "fix: pin musl 1.2.5 for DNS fixes"
- #6208 ignore deltas in codex_delegate

⚠️ WARNING: Attempting to pin musl 1.2.5 for DNS fixes in #6189 turned out to be the wrong fix. We reverted it in #6222 and published 0.55.0.
Otherwise, this release was mostly bugfixes and documentation tweaks.
Merged PRs
- #6189 fix: pin musl 1.2.5 for DNS fixes (#6189)
- #6202 fix: ignore reasoning deltas because we send it with turn item (#6202)
- #6175 [App-server] v2 for account/updated and account/logout (#6175)
- #6156 Fix is_api_message to correctly exclude reasoning messages (#6156)
- #4453 Follow symlinks during file search (#4453)
- #5175 docs: add example config.toml (#5175)
- #6180 fix: --search shouldn't show deprecation message (#6180)
- #6143 Fixed notify handler so it passes correct input_messages details (#6143)
- #6171 log sandbox commands to $CODEX_HOME instead of cwd (#6171)
- #5996 feat: add the time after aborting (#5996)
- #5541 tui: refine text area word separator handling (#5541)
- #6167 Do not skip trust prompt on Windows if sandbox is enabled. (#6167)
- #6129 feat: add options to responses-api-proxy to support Azure (#6129)
- #6161 Include reasoning tokens in the context window calculation (#6161)
- #6051 Fix rmcp client feature flag reference (#6051)
- #6159 Fix typo in error message for OAuth login (#6159)
- #5685 Add documentation for slash commands in docs/slash_commands.md. (#5685)
- #6111 fix: improve usage URLs in status card and snapshots (#6111)
- #6124 Fix "archive conversation" on Windows (#6124)
- #6137 chore(deps): bump actions/upload-artifact from 4 to 5 (#6137)
- #4903 fix: pasting api key stray character (#4903)
- #6131 Fix incorrect "deprecated" message about experimental config key (#6131)
- #6091 Changes to sandbox command assessment feature based on initial experiment feedback (#6091)
- #5956 Parse the Azure OpenAI rate limit message (#5956)
- #5649 docs: Fix link anchor and markdown format in advanced guide (#5649)
- #5659 Fixing small typo in docs (#5659)
- #5935 tui: patch crossterm for better color queries (#5935)
- #6050 [codex][app-server] improve error response for client requests (#6050)
- #4973 docs: fix broken link in contributing guide (#4973)
- #6027 feat: compactor 2 (#6027)
- #6052 Add warning on compact (#6052)
- #6043 chore: Add shell serialization tests for json (#6043)
- #5979 Truncate total tool calls text (#5979)
- #4797 docs: "Configuration" is not belongs "Getting started" (#4797)
- #4804 chore(deps): bump indexmap from 2.10.0 to 2.11.4 in /codex-rs (#4804)
- #4802 chore(deps): bump anyhow from 1.0.99 to 1.0.100 in /codex-rs (#4802)
- #4800 chore(deps): bump actions/checkout from 4 to 5 (#4800)
- #4801 chore(deps): bump actions/github-script from 7 to 8 (#4801)
- #6045 fix: brew upgrade link (#6045)
- #6034 test: undo (#6034)
- #4426 chore(deps): bump thiserror from 2.0.16 to 2.0.17 in /codex-rs (#4426)
- #6010 Update user instruction message format (#6010)
- #4266 fix(tui): propagate errors in insert_history_lines_to_writer (#4266)

Highlights
- Fixing error 400 issues
- Improve sandboxing for Java
PRs
#5897 – codex: add developer instructions
#5939 – app-server: remove serde(skip_serializing_if = "Option::is_none") annotations
#3754 – docs: add missing period
#5976 – hygiene: remove include_view_image_tool config
#3987 – fix: update Seatbelt policy for Java on macOS
#4905 – Windows Sandbox alpha version
#5997 – build: bump Windows stack size to 8 MB
#5986 – remove last-turn reasoning filtering
#6005 – app-server: split API types into v1 and v2
#6002 – feat: add /exit slash-command alias for quit
#6000 – rate-limit errors now return absolute time
#4144 – docs: fix markdown list spacing in review_prompt.md
#6007 – override verbosity for gpt-5-codex

Highlights
- Auth: new CLI auth storage abstraction with keyring support and configurable backend.
- TUI polish: queued messages visible during streaming; Windows auto-mode guidance; undo op; compaction prompt configurable.
- Images: client-side image resizing; MIME verification; SDK image forwarding tests re-enabled.
- App server: GetConversationSummary RPC; fetch/resume conversation summaries by id; refined account/protocol types.
- Execution/events: item streaming events; ghost commits; clearer deprecation warnings; better token refresh handling and logs.
- Conversation management: centralized truncation for all tool outputs; filter out prior-turn reasoning; annotate conversations with model_provider.
- Execute commands directly with !<cmd>
- Ability to buy credits for more usage. More information
List of merged PRs
1. Log HTTP Version in #5475
2. feat: local tokenizer in #5508
3. chore: drop approve all in #5503
4. [MCP] Add support for specifying scopes for MCP oauth in #5487
5. chore: clean spec tests in #5517
6. [MCP] Remove the legacy stdio client in favor of rmcp in #5529
7. [app-server] send account/rateLimits/updated notifications in #5477
8. Fix unified exec session id test helper in #5535
9. [app-server] add new account method API stubs in #5527
10. chore: clean handle_container_exec_with_params in #5516
11. fix: approval issue in #5525
12. tui: show aggregated output in display in #5539
13. Handle cancelling/aborting while processing a turn in #5543
14. chore: testing on apply_path in #5557
15. feat: use actual tokenizer for unified_exec truncation in #5514
16. feat: end events on unified exec in #5551
17. Use Option symbol for mac key hints in #5582
18. Moving token_info to ConversationHistory in #5581
19. [MCP] Update rmcp to 0.8.3 in #5542
20. [MCP] Improve startup errors for timeouts and github in #5595
21. fix: flaky tests in #5625
22. adding messaging for stale rate limits + when no rate limits are cached in #5570
23. Add CodexHttpClient wrapper with request logging in #5564
24. [app-server] fix account/read response annotation in #5642
25. Add instruction for upgrading codex with brew in #5640
26. Log more types of request IDs in #5645
27. Added model summary and risk assessment for commands that violate sandbox policy in #5536
28. [MCP] Redact environment variable values in /mcp and mcp get in #5648
29. [MCP] Properly gate login after mcp add with experimental_use_rmcp_client in #5653
30. [codex][app-server] introduce codex/event/raw_item events in #5578
31. Fixed flaky unit test in #5654
32. Improve feedback in #5661
33. Followup feedback in #5663
34. Skip flaky test in #5680
35. Added support for sandbox_mode in profiles in #5686
36. Reduced runtime of unit test that was taking multiple minutes in #5688
37. [MCP] Minor docs clarifications around stdio tokens in #5676
38. fix: use codex-exp prefix for experimental models and consider codex- models to be production in #5797
39. fix: revert "[app-server] fix account/read response annotation (#5642)" in #5796
40. Add feedback upload request handling in #5682
41. feat: annotate conversations with model_provider for filtering in #5658
42. feat: update NewConversationParams to take an optional model_provider in #5793
43. feat: undo wiring in #5630
44. feat: async ghost commit in #5618
45. feat: TUI undo op in #5629
46. nit: doc on session task in #5809
47. chore: undo nits in #5631
48. fix: test yield time in #5811
49. feat: introduce GetConversationSummary RPC in #5803
50. feat: return an error if unknown enabled/disabled feature in #5817
51. Made token refresh code resilient to missing id_token in #5782
52. [Auth] Introduce New Auth Storage Abstraction for Codex CLI in #5569
53. feat: support verbosity in model_family in #5821
54. [Auth] Add keyring support for Codex CLI in #5591
55. Centralize truncation in conversation history in #5652
56. fix: move account struct to app-server-protocol and use camelCase in #5829
57. [MCP] Render MCP tool call result image

Highlights
- Improved /feedback to get better diagnostics. Please use it to report any issues. (#5661, #5663).
Merged PRs
- #5536 — Added model summary and risk assessment for commands that violate sandbox policy
(@etraut-openai)
- #5542 — [MCP] Update rmcp to 0.8.3 (@gpeal)
- #5564 — Add CodexHttpClient wrapper with request logging (@pakrym-oai)
- #5570 — adding messaging for stale rate limits + when no rate limits are cached (@zhao-oai)
- #5578 — [codex][app-server] introduce codex/event/raw_item events (@apanasenko-oai)
- #5581 — Moving token_info to ConversationHistory (@aibrahim-oai)
- #5582 — Use Option symbol for mac key hints (@joshka-oai)
- #5595 — [MCP] Improve startup errors for timeouts and github (@gpeal)
- #5625 — fix: flaky tests (@jif-oai)
- #5640 — Add instruction for upgrading codex with brew (@shijie-oai)
- #5642 — [app-server] fix account/read response annotation (@owenlin0)
- #5645 — Log more types of request IDs (@pakrym-oai)
- #5648 — [MCP] Redact environment variable values in /mcp and mcp get (@gpeal)
- #5653 — [MCP] Properly gate login after mcp add with experimental_use_rmcp_client (@gpeal)
- #5654 — Fixed flaky unit test (@etraut-openai)
- #5661 — Improve feedback (@aibrahim-oai)
- #5663 — Followup feedback (@aibrahim-oai)
- #5680 — Skip flaky test (@pakrym-oai)

Highlights
- No major changes comparing to v0.48.0 - v0.49.0 is used for testing homebrew upgrade script.
Full Changelog: rust-v0.48.0...rust-v0.49.0

Highlights
- --add-dir to add an additional working directory.
- Many MCP improvements:
- New MCP client implementation with SSE support
- Options to enable and disable specific tools
- Error reporting improvements
- OAuth support and authentication improvements.
Full list of merged PRs:
- Support graceful agent interruption by @pakrym-oai in #5287
- Fix nix build by @Mic92 in #4048
- [MCP] Render full MCP errors to the model by @gpeal in #5298
- Fix link to MCP Servers config section by @lopopolo-openai in #5301
- [MCP] When MCP auth expires, prompt the user to log in again. by @gpeal in #5300
- fix: switch rate limit reset handling to timestamps by @tibo-openai in #5304
- fix: diff_buffers clear-to-end when deleting wide graphemes by @MomentDerek in #4921
- docs(changelog): update install command to @openai/codex@ by @truls27a in #2073
- fix: handle missing resume session id gracefully by @tibo-openai in #5329
- fix: improve custom prompt documentation and actually use prompt descriptions by @tibo-openai in #5332
- Move rust analyzer target dir by @pakrym-oai in #5328
- Create independent TurnContexts by @pakrym-oai in #5308
- feat: add --add-dir flag for extra writable roots by @tibo-openai in #5335
- docs: add AGENTS.md discovery guide by @tibo-openai in #5353
- docs: improve overall documentation by @tibo-openai in #5354
- fix: config.md docs inaccuracies by @tibo-openai in #5355
- fix: update CLI usage order for codex -h by @tibo-openai in #5356
- docs: align sandbox defaults, dedupe sections and improve getting started guide by @tibo-openai in #5357
- [MCP] Prefix MCP tools names with mcp__ by @gpeal in #5309
- feat: experimental codex stdio-to-uds subcommand by @bolinfest in #5350
- Add forced_chatgpt_workspace_id and forced_login_method configuration options by @gpeal in #5303
- Expand approvals integration coverage by @pakrym-oai in #5358
- feat: add images support to the Codex Typescript SDK by @needs in #5281
- Strip zsh -lc wrapper from TUI command headers by @hxreborn in #5374
- Update Homebrew install instructions to use cask by @shijie-oai in #5377
- Always enable plan tool in exec by @pakrym-oai in #5380
- Auto compact at ~90% by @aibrahim-oai in #5292
- Generate JSON schema for app-server protocol by @rasmusrygaard in #5063
- fix: warn when --add-dir would be ignored by @tibo-openai in #5351
- Use int timestamps for rate limit reset_at by @owenlin0 in #5383
- chore: rework tools execution workflow by @jif-oai in #5278
- Add ItemStarted/ItemCompleted events for UserInputItem by @pakrym-oai in #5306
- tui: drop citation rendering by @nornagon-openai in #4855
- [app-server] read rate limits API by @owenlin0 in #5302
- fix terminal corruption that could happen when onboarding and update banner by @nornagon-openai in #5269
- Reduce symbol size for tests by @pakrym-oai in #5389
- docs: update advanced guide details by @tibo-openai in #5395
- docs: clarify responses proxy metadata by @tibo-openai in #5406
- [MCP] Add configuration options to enable or disable specific tools by @gpeal in #5367
- Treat zsh -lc like bash -lc by @gpeal in #5411
- docs: clarify prompt metadata behavior by @tibo-openai in #5403
- docs: remove stale contribution reference by @tibo-openai in #5400
- docs: document exec json events by @tibo-openai in #5399
- docs: correct getting-started behaviors by @tibo-openai in #5407
- [MCP] Dedicated error message for GitHub MCPs missing a personal access token by @gpeal in #5393
- chore(ci): Speed up macOS builds by using larger runner by @JaviSoto in #5234
- feat: include cwd in notify payload by @tibo-openai in #5415
- fix(tui): Update WSL instructions by @dylan-hurd-oai in #5307
- [MCP] Bump rmcp to 0.8.2 by @gpeal in #5423
- Pass TurnContext around instead of sub_id by @pakrym-oai in #5421
- Fix flaky auth tests by @gpeal in #5461
- chore: drop env var flag by @jif-oai in #5462
- Enable plan tool by default by @pakrym-oai in #5384
- feat: emit events for unified_exec by @jif-oai in #5448
- fix: fi

Highlights
- Improvements and bug-fixes in Codex CLI
- Code signing binaries on MacOS
- Auto update banner
- 🆕 Warning when enabling "full access" mode
Full list of merged PRs:
- Indentation mode for read_file (#4887)
- Message when stream get correctly resumed (#4988)
- Make shortcut works even with capslock (#5049)
- Discard prompt starting with a slash (#5048)
- Add header for task kind (#5142)
- Pass codex thread ID in notifier metadata (#4582)
- Updated github issue template (#5191)
- Agent override file (#5215)
- Prompt mcp login when adding a streamable HTTP server that supports oauth (#5193)
- Add parsed command to ExecApprovalRequestEvent (#5222)
- Add warning about rate limit when using high effort (#5035)
- Auto update approval (#5185)
- Add macOS notarization step to release workflow (#5233)
- Add confirmation prompt for enabling full access approvals (#4980)
- Add path field to ParsedCommand::Read variant (#5275)
- Better UX during refusal (#5260)
- Lagged output in unified_exec buffer (#4992)
- Sandbox denied error logs (#4874)
- Add code signing for MacOS binary (#4899)
- Fix wrapping in user approval decisions (#5008)
- Fix wrapping in trust_directory (#5007)
- /diff mode wraps long lines (#4891)
- Fix crash when alt+bksp past unicode nbsp (#5016)
- Include the image name in the textarea placeholder (#5056)
- Detect Bun installs in CLI update banner (#5074)
- Add dangerous auto-approval for codex exec (#5043)
- Codex cloud exec (#5060)

Highlights
Improved MCP support
We are in the middle of significantly improving support for connecting to MCP servers including support for streamable http servers with optional bearer token or oauth login support.
Enable the experimental_use_rmcp_client = true flag in config.toml to use the new MCP stack. If you encounter issues, create a GitHub issue and add the mcp label. We would like to remove the experimental flag soon and will continue to expand MCP support over time.
What's Changed
- [MCP] Fix the bearer token authorization header by @gpeal in #4846
- Print codex resume note when quitting after codex resume by @nornagon-openai in #4695
- Use Number instead of BigInt for TokenCountEvent by @ccy-oai in #4856
- Simplify request body assertions by @pakrym-oai in #4845
- Fix zsh completion by @tamird in #4692
- [Cloud Tasks] Use workspace deps by @tamird in #4693
- Simplify parallel by @pakrym-oai in #4829
- [TUI] Remove bottom padding by @gpeal in #4854
- [TUI] Dynamic width for line numbers in diffs by @nornagon-openai in #4664
- [TUI] Wrapping bugfix by @nornagon-openai in #4674
- Fix flaky test by @jif-oai in #4878
- list_dir tool by @jif-oai in #4817
- [TUI] Breathing spinner on true-color terms by @nornagon-openai in #4853
- [TUI] Remove instruction hack for /review by @dedrisian-oai in #4896
- Set codex SDK TypeScript originator by @pakrym-oai in #4894
- [TUI] Bring the transcript closer to display mode by @nornagon-openai in #4848
- [TUI] Switch to tree-sitter-highlight bash highlighting by @nornagon-openai in #4666
- remove experimental prefix by @rakesh-oai in #4907
- [MCP] Add the ability to explicitly specify a credentials store by @gpeal in #4857
- [MCP] Add support for streamable http servers with codex mcp add and replace bearer token handling by @gpeal in #4904
- featgrep_files as a tool by @jif-oai in #4820
- CLI UP/ENTER by @jif-oai in #4944
- change log_sse_event() so it no longer takes a closure by @bolinfest in #4953
- truncate on compact by @jif-oai in #4942
- Fix transcript mode rendering issue when showing tab chars by @dedrisian-oai in #4911
- [TUI] hardcode xterm palette, shimmer blends between fg and bg by @nornagon-openai in #4957
- [MCP] Add an enabled config field by @gpeal in #4917
- Make context line permanent by @dedrisian-oai in #4699
- [MCP] Add auth status to MCP servers by @gpeal in #4918
- [TUI] fix off-by-16 in terminal_palette by @nornagon-openai in #4967
- Create alias by @rakesh-oai in #4971
- Set chat name by @dedrisian-oai in #4974
- revert /name for now by @dedrisian-oai in #4978
New Contributors
- @ccy-oai made their first contribution in #4856
- @tamird made their first contribution in #4692
Full Changelog: rust-v0.45.0...rust-v0.46.0

Highlights:
- #4517 Experimental support for OAuth MCP server authentication
Full list of merged PRs:
- #4636 Replace --api-key with --with-api-key for logging into the CLI with an API key
- #4644 Only write the final message to stdout for codex exec
- #4676 Default to gpt-5 for Windows users who have not set a default model
- #4689 Remove the requirement to use experimental_use_rmcp_client for streamable HTTP MCP servers that don't require OAuth
- #4673 Fix colors when refocusing the terminal after a system theme update
- #4694 Fix reasoning effort title
- #4616 Updated device code login copy
- #4706 Fix command output truncation that sometimes used too much of the context window
- #4663 Initial parallel tool call support
- #4736 Pulsing dot loading state

Highlights:
- New UI refresh! Updated chat composer, bottom pane, model picker, and upgrade nudge (#4240, #4316, #4178, #4405)
- Custom prompts now support named & positional arguments (#4474, #4470)
- Add support for streamable HTTP MCP servers (#4317)
- (Experimental) Reduce repetitive approval for read-only commands on Windows (#4269)
- (Experimental) Manage cloud tasks with codex cloud (#3197)
- many more fixes and improvements
Full list of merged PRs:
- #4642 Nit: Pop model effort picker on esc
- #4641 Move gpt-5-codex to top
- #4639 Fix tab+enter regression on slash commands
- #4619 feat: add file name to fuzzy search response
- #4629 tui: • Working, 100% context dim
- #4633 Use supports_color in codex exec
- #4636 Enable codex workflows
- #4638 Update issue-deduplicator.yml
- #4571 feat: write pid in addition to port to server info
- #4635 Deduplicator fixes
- #4627 fix false "task complete" state during agent message
- #4634 Bump codex version in actions to latest
- #4610 Rename assistant message to agent message and fix item type field naming
- #4630 Use GH cli to fetch current issue
- #4622 tui: tweaks to dialog display
- #4628 Add issue deduplicator workflow
- #4585 Minor cleanup of codex exec output
- #4626 Revert "chore: sandbox extraction"
- #4621 Add issue labeler workflow
- #4583 Add a separate exec doc
- #4612 Separate interactive and non-interactive sessions
- #4178 Make model switcher two-stage
- #4475 show "Viewed Image" when the model views an image
- #4586 normalize key hints
- #4584 Fix status usage ratio
- #4454 fix: handle JSON Schema in additionalProperties for MCP tools
- #4615 Support CODEX_API_KEY for codex exec
- #4569 fix: update the gpt-5-codex prompt to be more explicit that it should always used fenced code blocks info tags
- #4579 Store settings on the thread instead of turn
- #4572 Include request ID in the error message
- #4577 canonicalize display of Agents.md paths on Windows.
- #4573 rework patch/exec approval UI
- #4513 Add initial set of doc comments to the SDK
- #4576 Revert "chore: prompt update to enforce good usage of apply_patch"
- #4567 Explicit node imports
- #4568 Fix hang on second oauth login attempt
- #4575 fix: use number instead of bigint for the generated TS for RequestId
- #4566 fix ctr-n hint
- #4556 feat: add --emergency-version-override option to create_github_release script
- #4563 SDK: support working directory and skipGitRepoCheck options
- #4544 Fall back to configured instruction files if AGENTS.md isn't available
- #4536 Show context window usage while tasks run
- #4509 Show placeholder for commands with no output
- #4468 Add Updated at time in resume picker
- #4559 Handle trailing backslash properly
- #4269 implement command safety for PowerShell commands
- #4555 fix: pnpm/action-setup@v4 should run before actions/setup-node@v5
- #4543 chore: introduce publishing logic for @openai/codex-sdk
- #4286 chore: sanbox extraction
- #4533 Fix Callback URL for staging and prod environments
- #4537 fix: remove mcp-types from app server protocol
- #4532 Add executable detection and export Codex from the SDK
- #4529 fix: use macros to ensure request/response symmetry
- #4525 Remove legacy codex exec --json format
- #4506 wrap markdown at render time
- #4520 Delete codex proto
- #4521 fix: enable process hardening in Codex CLI for release builds
- #4518 fix: clean up TypeScript exports
- #4512 fix: ensure every variant of ClientRequest has a params field
- #4511 Wire up web search item
- #4508 [SDK] Test that a tread can be continued with extra params
- #3846 chore: prompt update to enforce good usage of apply_patch
- #4474 Named args for custom prompts
- #4503 Support model and sandbox mode in the sdk
- #3197 Add cloud tasks
- #4471 fix: separate codex mcp into codex mcp-server and codex app-server
- #4422 Update MCP docs to reference experimental RMCP client
- #4486 Move PR-style review to top
- #4483 SDK CI
- #4485 Set originator for codex exec
- #4482 Rename conversatio

Notable Changes
- Experimental Rust SDK–based MCP client introduced (#4252)
- New responses-api-proxy component to simplify and secure response handling/proxying (#4246)
- Added secure mode: CODEX_SECURE_MODE=1 to restrict process observability (#4220)
- More explicit codex exec events, including item.started and improved output display (#4177, #4250, #4113)
- Safer command execution: dangerous command checks in core and Windows-specific safety (#4211, #4119)
- UX improvements: revamped /status with clearer presentation and details, pageless session list, approvals moved to ListSelectionView, better MCP tool call styling, and hiding status indicator during streaming (#3194, #4275, #3871, #4101, #4196)
- Stability and correctness: token usage fix for compaction, SSE mounting reliability, and improving bugs on editing previous conversations (#4281, #4264, #4237)
- IDE extension reliability: fix login with API key when .codex directory is missing (#4258)
- Internal cleanup and refactors for state, footer logic, and unused code (#4174, #4259, #4310)
Merged PRs
- [#4304] /status followup (#4304)
- [#4310] chore: dead code removal; remove frame count and stateful render helpers (#4310)
- [#4252] [MCP] Introduce an experimental official rust sdk based mcp client (#4252)
- [#4255] Add todo-list tool support (#4255)
- [#4246] feat: introduce responses-api-proxy (#4246)
- [#4281] fix: token usage for compaction (#4281)
- [#4113] Show exec output on success with trimmed display (#4113)
- [#4275] Move approvals to use ListSelectionView (#4275)
- [#4259] Refactor the footer logic to a new file (#4259)
- [#4229] ref: state - 2 (#4229)
- [#4211] core: add potentially dangerous command check (#4211)
- [#4264] Actually mount sse once (#4264)
- [#4254] Add codex exec testing helpers (#4254)
- [#4258] Fixed login failure with API key in IDE extension when a .codex directory doesn't exist (#4258)
- [#4256] fix typo in sandbox doc (#4256)
- [#4250] [codex exec] Add item.started and support it for command execution (#4250)
- [#4251] fix (#4251)
- [#4248] fix bug when resizing to a smaller width (#4248)
- [#4067] make tests pass cleanly in sandbox (#4067)
- [#4204] Fix error message (#4204)
- [#4177] Add explicit codex exec events (#4177)
- [#4194] chore: refactor attempt_stream_responses() out of stream_responses() (#4194)
- [#4237] fix: esc w/ queued messages overwrites draft in composer (#4237)
- [#4220] feat: add support for CODEX_SECURE_MODE=1 to restrict process observability (#4220)
- [#4196] revamp /status (#4196)
- [#4174] ref: full state refactor (#4174)
- [#4205] github: update codespell action to v2.1 in workflow (#4205)
- [#4195] Send text parameter for non-gpt-5 models (#4195)
- [#4188] chore: drop unused values from env_flags (#4188)
- [#4119] adds a windows-specific method to check if a command is safe (#4119)
- [#3194] pageless session list (#3194)
- [#3871] improve MCP tool call styling (#3871)
- [#4101] hide the status indicator when the answer stream starts (#4101)
- [#4160] Simplify tool implemetations (#4160)

Highlights:
- Rate limits visibility: You can see when is your limits resetting (#4111) and see your usage when rate limited (#4102)
- You can specify output schema in exec mode using output-schema. (#4079)
- Ripgrep (rg) is now vendored into the npm release (#3660), which should fix issues such as #3842 where the postinstall step of @vscode/ripgrep would sometimes fail when installing codex via npm.
Merged PRs:
#4090 feat: readiness tool
#4088 chore: compact do not modify instructions
#4069 refactor codex card layout
#4105 Use anyhow::Result in tests for error propagation
#4079 Add exec output-schema parameter
#4102 Send limits when getting rate limited
#3461 [exec] add include-plan-tool flag and print it nicely
#3660 fix: vendor ripgrep in the npm module
#4112 fix: npm publish --tag alpha when building an alpha release
#4031 chore(deps): bump serde from 1.0.224 to 1.0.226 in /codex-rs
#4027 chore(deps): bump log from 0.4.27 to 0.4.28 in /codex-rs
#4030 chore(deps): bump tempfile from 3.20.0 to 3.22.0 in /codex-rs
#4135 nit: update auto compact to 250k
#4137 nit: drop instruction override for auto-compact
#4140 chore: extract readiness in a dedicated utils crate
#4111 Add Reset in for rate limits
#4156 nit: 350k tokens
#4124 chore: upgrade to Rust 1.90
#4162 fix: add tolerance for ambiguous behavior in gh run list
#4154 chore: remove once_cell dependency from multiple crates
#2156 chore(deps): bump unicode-width from 0.1.14 to 0.2.1 in /codex-rs
#4028 chore(deps): bump chrono from 0.4.41 to 0.4.42 in /codex-rs

Notable Changes
- Default model is now gpt-5-codex (#4076)
- Autocompaction is triggered automatically for gpt-5-codex when hitting 220k tokens (#4093)
- Usage limits are now visible in /status (#4053)
- New /review commands (review specific commit, against a base branch, or custom instructions) (#3961)
- The default timeout for MCP tool calls is 60s and can be overridden in config.toml by setting tool_timeout_sec for an individual MCP server. (#3959)
Merged PRs
- [#3881] fix: update try_parse_word_only_commands_sequence() to return commands in order (#3881)
- [#3814] Use a unified shell tell to not break cache (#3814)
- [#3878] Move responses mocking helpers to a shared lib (#3878)
- [#3888] Use helpers instead of fixtures (#3888)
- [#3937] fix alignment in slash command popup (#3937)
- [#3925] don't clear screen on startup (#3925)
- [#3950] Cache keyboard enhancement detection before event streams (#3950)
- [#3965] Forward Rate limits to the UI (#3965)
- [#3977] Tui: Rate limits (#3977)
- [#3961] feat: Add more /review options (#3961)
- [#3880] Add non_sandbox_test helper (#3880)
- [#4044] chore: unify cargo versions (#4044)
- [#4057] chore: more clippy rules 2 (#4057)
- [#3959] timeouts for mcp tool calls (#3959)
- [#4053] Add limits to /status (#4053)
- [#3928] simplify StreamController (#3928)
- [#4020] Tui: fix backtracking (#4020)
- [#4055] Remove /limits after moving to /status (#4055)
- [#4026] feat: Add view stack to BottomPane (#4026)
- [#4059] Change limits warning copy (#4059)
- [#4058] chore: clippy on redundant closure (#4058)
- [#4061] Fix branch mode prompt for /review (#4061)
- [#4060] Change headers and struct of rate limits (#4060)
- [#3952] Fix pager overlay clear between pages (#3952)
- [#3957] fix codex resume message at end of session (#3957)
- [#4068] Truncate potentially long user messages in compact message. (#4068)
- [#4076] feat: update default (#4076)
- [#4064] Add notifier tests (#4064)
- [#4093] chore: enable auto-compaction for gpt-5-codex (#4093)
- [#4096] Use TestCodex builder in stream retry tests (#4096)
- [#3914] feat: git tooling for undo (#3914)
- [#4082] fix: usage data tweaks (#4082)
- [#4075] Rate limits warning (#4075)

New Features
- new /review command introduced in #3774
Merged PRs:
- [#3874] fix: ensure cwd for conversation and sandbox are separate concerns (#3874)
- [#3774] feat: /review (#3774)
- [#3753] Reland "refactor transcript view to handle HistoryCells" (#3753)
- [#3867] fix error on missing notifications in [tui] (#3867)
- [#3850] chore: use tokio mutex and async function to prevent blocking a worker (#3850)
- [#3849] fix: some nit Rust reference issues (#3849)
- [#3757] hint for codex resume on tui exit (#3757)
- [#3857] Make ESC button work when auto-compaction (#3857)
- [#3729] Unify animations (#3729)
- [#3819] Switch to uuid_v7 and tighten ConversationId usage (#3819)
- [#3777] bug: Ignore tests for now (#3777)
- [#3822] chore: update "Codex CLI harness, sandboxing, and approvals" section (#3822)
- [#3756] Use agent reply text in turn notifications (#3756)
- [#3807] AGENTS.md: Add instruction to install missing commands (#3807)

This release includes only one change on top of 0.37.0, which is a fix to the npm-publish step in the release process (#3806). Updating npm with the latest release is now fully automated, and if you visit https://www.npmjs.com/package/@openai/codex#provenance-details-header, you should now see this special Provenance badge:
Merged PRs:
- [#3806] fix: specify --repo when calling gh (#3806)

Mostly small quality-of-life fixes in this release.
Highlights
Updated the npm release process to use "trusted publishing" (#3431). Though apparently there was a bug, so we may not see the benefit until 0.38.0. Fix is in #3806.
Merged PRs
- [#3329] notifications on approvals and turn end (#3329)
- [#3659] chore: restore prerelease logic in rust-release.yml (#3659)
- [#3617] chore(deps): bump serde_json from 1.0.143 to 1.0.145 in /codex-rs (#3617)
- [#3664] chore: simplify dep so serde=1 in Cargo.toml (#3664)
- [#3618] chore(deps): bump serde from 1.0.219 to 1.0.223 in /codex-rs (#3618)
- [#3619] chore(deps): bump wildmatch from 2.4.0 to 2.5.0 in /codex-rs (#3619)
- 45bccd36 fix permissions alignment
- [#3673] fix: read-only escalations (#3673)
- [#3680] Update azure model provider example (#3680)
- [#3745] Persist search items (#3745)
- [#3678] fix: Record EnvironmentContext in SendUserTurn (#3678)
- [#3701] Review mode core updates (#3701)
- [#3755] restyle thinking outputs (#3755)
- [#3758] Add dev message upon review out (#3758)
- [#3431] fix: make GitHub Action publish to npm using trusted publishing (#3431)
- [#3763] fix: ensure pnpm is installed before running npm install (#3763)
- [#3767] fix: make publish-npm its own job with specific permissions (#3767)
- [#3806] fix: specify --repo when calling gh (#3806)

Highlights
Introducing our newest model GPT-5-Codex
GPT-5-Codex works faster through easy tasks and harder on complex tasks, improves on code quality, and is more steerable with AGENTS.md. Learn More
Resume and compaction
Resuming old conversations with codex resume (#3537, #3625).
Unified execution and reliability
Unified execution improvements (#3288, #3479) and race-condition fix (#3644); include command output on timeouts (#3576); do not execute when command parses as a patch (#3382); improved sandbox timeout handling (#3435); flaky test fixes (#3596, #3564).
Auth and login experience
Simplified auth flow (#3189); login polish (#3632); ChatGPT login overwrites API key (#3611); fix stray login URL characters (#3639); fix get_auth_status for custom providers (#3581).
JSON-RPC and MCP
JSON-RPC: SetDefaultModel and None clears default (#3512, #3529), UserInfo (#3428), reasoning_effort in NewConversationResponse (#3506); initial MCP interface and docs (#3543, #3507, #3345); standardized shell description (#3514).
TUI onboarding and polish
New onboarding flow and animation (#3398, #3631, #3590, #3627), consistent headers on resume (#3615, #3592), improved spacing/padding (#3469, #3471, #3472, #3474), clearer interruption and status styling (#3470), numerous UX nits addressed (#3650, #3534).
Core platform
Automatic context compaction (#3446); Azure Responses API workaround (#3528); expanded default sandbox (#3483); preserve more item IDs in Azure (#3542); logging and clippy improvements (#3488, #3489); just test via nextest (#3508).
All merged PRs
- feat: tweak onboarding strings (#3650)
- fix stray login url characters persisting in login (#3639)
- Add file reference guidelines to gpt-5 prompt (#3651)
- feat: skip animations on small terminals (#3647)
- chore: rename (#3648)
- fix: add references (#3633)
- chore: set prerelease:true for now (#3645)
- fix: race condition unified exec (#3644)
- feat: update splash (#3631)
- chore(deps): bump tracing-subscriber from 0.3.19 to 0.3.20 in /codex-rs (#3620)
- chore(deps): bump slab from 0.4.10 to 0.4.11 in /codex-rs (#3635)
- Login flow polish (#3632)
- Fix codex resume so flags (cd, model, search, etc.) still work (#3625)
- feat: tighten preset filter, tame storage load logs, enable rollout prompt by default (#3628)
- Show abort in the resume (#3629)
- Change animation frames (#3627)
- initial mcp add interface (#3543)
- chore: update prompts for gpt-5-code (#3624)
- feat: add reasoning level to header (#3622)
- Revert "refactor transcript view to handle HistoryCells" (#3614)
- Show the header when resuming a conversation (#3615)
- When logging in using ChatGPT, make sure to overwrite API key (#3611)
- Don't show the model for apikey (#3607)
- Fix get_auth_status response when using custom provider (#3581)
- fix: model family and apply_patch consistency (#3603)
- fix(tui): update full-auto to default preset (#3608)
- fix(core): flaky test completed_commands_do_not_persist_sessions (#3596)
- Skip frames files in codespell (#3606)
- Add session header to chat widget (#3592)
- Append full raw reasoning event text (#3605)
- feat: UI animation (#3590)
- Fix EventMsg Optional (#3604)
- Single branch for gpt-5-code (#3601)
- enable-resume (#3537)
- feat: update model save (#3589)
- Fix flaky windows test (#3564)
- Fix gpt-5-code model selector (#3598)
- Add per-model-family prompts (#3597)
- Include command output when sending timeout to model (#3576)
- Align user history message prefix width (#3467)
- Gate model upgrade prompt behind ChatGPT auth (#3586)
- chore: update output_lines() to take a struct instead of bools (#3591)
- Add spacing before queued status indicator messages (#3474)
- Handle resuming/forking after compact (#3533)
- refactor transcript view to handle HistoryCells (#3538)
- Default gpt-5-code models to experimental reasoning summaries (#3560)
- Preserve IDs for more item types in azure (#3542)
- Always request encrypted cot (#3539)
- Review Mode (Core) (#3401)
- fix: NIT 

#3436: hotfix for issue that prevented Codex from initializing external MCP servers
Merged PRs
- [#2799] Persist model & reasoning changes (#2799)
- [#3436] Make user_agent optional (#3436)

Key change is #3430, which reverts #3179 because it introduced a regression.
- [#3394] alt+delete deletes the word to the right of the cursor (delete_forward_word) (#3394)
- [#3380] Introduce rollout items (#3380)
- [#3395] Set a user agent suffix when used as a mcp server (#3395)
- [#3357] fix: remove unnecessary #[allow(dead_code)] annotation (#3357)
- [#3422] Move initial history to protocol (#3422)
- [#3400] Added images to UserMessageEvent (#3400)
- [#3356] fix: remove empty file: chatwidget_stream_tests.rs (#3356)
- [#2703] docs: fix codex exec heading typo (#2703)
- [#2858] Remove a broken link to prompting_guide.md in docs/getting-started.md (#2858)
- [#3427] Improved resiliency of two auth-related tests (#3427)
- [#3396] replace tui_markdown with a custom markdown renderer (#3396)
- [#3430] Back out "feat: POSIX unification and snapshot sessions (#3179)" (#3430)

Codex 0.32.0
- MCP: add UA suffix when acting as a server; a few stability/compat tweaks
- OSS: Broader apply_patch OSS compatibility.
- Rollouts: initial groundwork and rollout_path included in responses.
- TUI: Alt+Delete deletes the next word.
- Protocol/Types: ArchiveConversation request; small exports and TS type improvements.
- CI/Build: faster tests with nextest, add shear; minor macOS permission adjustment.
- Docs: clarified shell quoting in config.
Merged PRs
- [#3395] Set a user agent suffix when used as a mcp server
- [#3394] alt+delete deletes the word to the right of the cursor (delete_forward_word)
- [#3390] Do not send reasoning item IDs
- [#3388] Replace config.responses_originator_header_internal_override with CODEX_INTERNAL_ORIGINATOR_OVERRIDE_ENV_VAR
- [#3387] No fail fast
- [#3380] Introduce rollout items
- [#3374] tweak "failed to find expected lines" message in apply_patch
- [#3357] fix: remove unnecessary #[allow(dead_code)] annotation
- [#3353] feat: add ArchiveConversation to ClientRequest
- [#3352] fix: include rollout_path in NewConversationResponse
- [#3338] feat: Run cargo shear during CI
- [#3334] allow mach-lookup for com.apple.system.opendirectoryd.libinfo
- [#3323] chore: try switching to cargo nextest to speed up CI builds
- [#3222] fix: LoginChatGptCompleteNotification does not need to be listed explicitly in protocol-ts
- [#3270] feat(core): re-export InitialHistory from conversation_manager
- [#3219] Generate more typescript types and return conversation id with ConversationSummary
- [#3179] feat: POSIX unification and snapshot sessions
- [#3169] Improve explanation of how the shell handles quotes in config.md
- [#2811] Include apply_patch tool for oss models from gpt-oss providers with different naming convention (e.g. openai/gpt-oss-*)

Codex 0.31.0
- #3182 added support for a startup_timeout_ms option when declaring an MCP server (docs), which has been a highly requested feature, particularly for Windows users:
- Issue: #3196
- Issue: #2346
- Issue: #2555
- PR: #3249
- PR: #3326
- PR: #3006
- and more...
- Thanks to @Bit-urd for adding more fault tolerance to MCP startup: #3243
- #3211 fixes image pasting from Finder with ctrl+v on macOS
Merged PRs
- [#3217] Added logic to cancel pending oauth login to free up localhost port
- [#3220] feat(tui): show minutes/hours in thinking timer
- [#3223] Added CLI version to /status output
- [#3176] [codex] respect overrides for model family configuration from toml file
- [#3226] chore: rewrite codex-rs/scripts/create_github_release.sh in Python
- [#3228] chore: change create_github_release to create a fresh clone in a temp directory
- [#3230] chore: use gh instead of git to do work to avoid overhead of a local clone
- [#3231] fix: change create_github_release to take either --publish-alpha or --publish-release
- [#3221] Move token usage/context information to session level
- [#3285] Clear non-empty prompts with ctrl + c
- [#3282] Use ConversationId instead of raw Uuids
- [#3300] docs: fix broken link to the "Memory with AGENTS.md" section in codex/README.md
- [#3182] feat(mcp): per-server startup timeout
- [#3294] chore(deps): bump insta from 1.43.1 to 1.43.2 in /codex-rs
- [#3295] chore(deps): bump tree-sitter from 0.25.8 to 0.25.9 in /codex-rs
- [#3296] chore(deps): bump clap from 4.5.45 to 4.5.47 in /codex-rs
- [#3297] chore(deps): bump image from 0.25.6 to 0.25.8 in /codex-rs
- [#3243] fix: improve MCP server initialization error handling #3196 #2346 #2555
- [#3211] tui: paste with ctrl+v checks file_list
- [#3316] chore: upgrade to actions/setup-node@v5
- [#3320] Add a getUserAgent MCP method
- [#3319] Highlight Proposed Command preview

Codex 0.30.0
- Breaking: Stop loading project .env files automatically.
- Security/behavior: Never store requests; free port by canceling pending OAuth login.
- Core/infra: Introduce rollout policy; shared HTTP client; improved remaining context size; refined reasoning summary config/handling; corrected sandboxed shell tool description; improved server notification serialization.
- TUI/UX: Fix approval dialog for large commands; pause status timer during modals; pager auto‑scroll; bash syntax highlighting; mac key glyphs; avoid zero‑height panic; improved @ file search (hidden dirs).
- DevEx/docs: Recommended VS Code extensions; AGENTS.md prompt and clarifications; updated API key guidance; CI fixes.
- Deps: Bump uuid and wiremock.
- Windows: no more asking for approvals on Full Access mode
Merged PRs
- [#3218] hide resume until it's complete
- [#3217] Added logic to cancel pending oauth login to free up localhost port
- [#3212] Never store requests
- [#3193] chore: improve serialization of ServerNotification
- [#3191] refactor: remove AttachImage tui event
- [#3190] Correctly calculate remaining context size
- [#3187] ZSH on UNIX system and better detection
- [#3185] MCP: add session resume + history listing;
- [#3184] [BREAKING] Stop loading project .env files
- [#3172] chore: add rust-lang.rust-analyzer and vadimcn.vscode-lldb to the list of recommended extensions
- [#3171] [codex] move configuration for reasoning summary format to model family config type
- [#3170] fix: fix serde_as annotation and verify with test
- [#3167] tui: pager pins scroll to bottom
- [#3163] fix: use a more efficient wire format for ExecCommandOutputDeltaEvent.chunk
- [#3146] fix: add callback to map before sending request to fix race condition
- [#3143] Use ⌥⇧⌃ glyphs for key hints on mac
- [#3142] syntax-highlight bash lines
- [#3138] [codex] improve handling of reasoning summary
- [#3135] TUI: Add session resume picker (--resume) and quick resume (--continue)
- [#3134] [tui] Update /mcp output
- [#3133] tui: avoid panic when active exec cell area is zero height
- [#3132] AGENTS.md: clarify test approvals for codex-rs
- [#3131] Pause status timer while modals are open
- [#3130] Fix failing CI
- [#3128] MCP sandbox call
- [#3127] Dividing UserMsgs into categories to send it back to the tui
- [#3123] Replay EventMsgs from Response Items when resuming a session with history.
- [#3122] prompt to read AGENTS.md files
- [#3121] remove bold the keyword from prompt
- [#3118] [codex] document use_experimental_reasoning_summary toml key config
- [#3117] Include originator in authentication URL parameters
- [#3116] Introduce Rollout Policy
- [#3112] Update guidance on API key permissions
- [#3110] Add a common way to create HTTP client
- [#3093] [mcp-server] Update read config interface
- [#3087] tui: fix approval dialog for large commands
- [#3069] core: correct sandboxed shell tool description (reads allowed anywhere)
- [#3056] chore: Clean up verbosity config
- [#2988] Auto-approve DangerFullAccess patches on non-sandboxed platforms
- [#2981] Improve @ file search: include specific hidden dirs such as .github, .gitlab
- [#2666] chore(deps): bump wiremock from 0.6.4 to 0.6.5 in /codex-rs
- [#2493] chore(deps): bump uuid from 1.17.0 to 1.18.0 in /codex-rs

Codex 0.29.0
- Android/Termux support by gating arboard on unsupported targets.
- Stable, cross‑platform file locking using std fs APIs.
- Auth consolidation: CodexAuth and AuthManager moved into the core crate.
- Rate‑limit handling restored for API‑key usage.
- Core rollout refactor: extract rollout module, add listing API, return file heads.
- Quality of life: support cd foo && ... in exec/apply_patch, fix TUI flicker, prefer ratatui Stylize.
- Distribution: include Windows ARM64 executable in the npm package.
- Switch to the latest search tool.
Merged PRs
- [#3086] Use the new search tool
- [#1634] core(rollout): extract rollout module, add listing API, and return file heads
- [#2895] Add Android/Termux support by gating arboard dependency
- [#2894] Add stable file locking using std::fs APIs
- [#3074] Move CodexAuth and AuthManager to the core crate
- [#3070] Add back rate‑limit error handling when using API key
- [#3083] Parse “cd foo && ...” for exec and apply_patch
- [#3068] Prefer ratatui Stylize for constructing lines/spans
- [#2918] TUI: fix occasional UI flicker
- [#3061] Show loading state when @ search results are pending
- [#2907] TUI: fix MCP docs hyperlink in empty_mcp_output
- [#3067] Include arm64 Windows executable in npm module
- [#2736] Unify history loading
- [#3071] Use experimental reasoning summary
- [#2461] Improve gpt‑oss compatibility
- [#2651] apply‑patch: fix lark grammar
- [#3089] Docs: update link to https://agents.md/
- [#3082] Docs: fix typo of config.md
- [#2667] Bump thiserror from 2.0.12 to 2.0.16 in codex‑rs

- [Highlights]
- TUI polish and stability improvements: reduced typing lag, cleaner streamed message formatting, better error handling, and improved input behavior.
- Better Windows ARM build reliability and faster release-time builds.
- [TUI/UX]
- Fix laggy typing (#2922)
- Rework message styling for clarity (#2877)
- Remove extra blank lines in streamed agent messages (#3065)
- Hide “/init” suggestion when AGENTS.md exists (#3038)
- Ignore Enter on empty input to avoid queuing blank messages (#3047)
- Catch get_cursor_position errors to avoid crashes (#2870)
- Remove extra quote from disabled-command message (#3035)
- [Build & CI]
- Leverage Windows 11 ARM for Windows ARM builds (#3062)
- Install zstd on Windows 11 ARM image used for releases (#3066)
- Populate Windows cache for release builds when PRs are opened (#2884)
- [Docs]
- Fix config reference table (#3063)
- Update PR template link after docs refactor (#2982)
- [Logging/Telemetry]
- Add logs when users change the model (#3060)
- [Dependencies]
- Bump regex-lite to 0.1.7 in codex-rs (#3010)
PRs merged
- #3066 fix: install zstd on the windows-11-arm image used to cut a release
- #3065 tui: fix extra blank lines in streamed agent messages
- #3063 fix config reference table
- #3062 fix: leverage windows-11-arm for Windows ARM builds
- #3060 Add logs to know when we users are changing the model
- #3047 Bug fix: ignore Enter on empty input to avoid queuing blank messages
- #3038 tui: hide '/init' suggestion when AGENTS.md exists
- #3035 remove extra quote from disabled-command message
- #3010 chore(deps): bump regex-lite from 0.1.6 to 0.1.7 in /codex-rs
- #2982 Fix: Adapt pr template with correct link following doc refacto
- #2922 tui: fix laggy typing
- #2884 fix: try to populate the Windows cache for release builds when PRs are put up for review
- #2877 rework message styling
- #2870 tui: catch get_cursor_position errors

Highlights:
New Features
- Custom /prompts loaded from ~/.codex/prompts (#2696)
- New "View Image" tool to let Codex agentically view local images (#2723)
- MCP GetConfig endpoint to inspect resolved settings (#2725)
TUI
- Fix image pasting in Windows + improve burst paste handling (#2683)
- Prevent slash commands during an active task (#2792)
- Fix cursor position when suspending (^Z) (#2690)
- Reduce doubled lines and hanging list markers (#2789)
Docs & Templates
- Major README/docs refactor and navigation (#2724)
- CHANGELOG now points to Releases page (#2780)
- Add VS Code Extension issue template (#2853)
Full list of merged PRs:
- #2864 Fix CI release build
- #2747 Bug fix: clone of incoming_tx can lead to deadlock
- #2852 Following up on #2371 post commit feedback
- #2696 Custom /prompts
- #2762 UI: Make slash commands bold in welcome message
- #2737 Changed OAuth success screen to use the string "Codex" rather than "Codex CLI"
- #2853 Add a VS Code Extension issue template
- #2683 burst paste edge cases
- #2746 Race condition in compact
- #2849 chore: print stderr from MCP server to test output using eprintln!
- #2848 chore: try to make it easier to debug the flakiness of test_shell_command_approval_triggers_elicitation
- #2845 chore: require uninlined_format_args from clippy
- #2792 disallow some slash commands while a task is running
- #2723 Add "View Image" tool
- #2690 fix cursor after suspend
- #2789 fix (most) doubled lines and hanging list markers
- #2780 Point the CHANGELOG to the releases page
- #2778 Added back codex-rs/config.md to link to new location
- #2724 README / docs refactor
- #2776 fix: for now, limit the number of deltas sent back to the UI
- #2725 [mcp-server] Add GetConfig endpoint

Highlights:
New Features
- Web search (#2371)
- Queued messages (#2637)
- Copy Paste / Drag & Drop image files (#2567)
- Transcript mode (Ctrl+T) with scrolling ability (#2525)
- Edit/resume conversation (esc-esc) from previous messages (#2607)
TUI
- Hide CoT by default; show headers in status indicator (#2316)
- Show diff output in pager (+ with hunk headers) (#2568)
- Simplify command approval UI (#2708)
- Unify Esc/Ctrl+C interrupt handling (#2661)
- Fix windows powershell paste (#2544)
Tools and execution
- Add support for long-running shell commands exec_command/write_stdin (#2574)
- Improve apply_patch reliability (#2646)
- Cap retry counts (#2701)
- Improve cache hit rate by sorting MCP tools deterministically (#2611)
Misc
- Add model_verbosity config for GPT-5 (#2108)
- Read all AGENTS.md files up to git root (#2532)
- Fix git root resolution in worktrees (#2585)
- Improve error messages & handling (#2695, #2587, #2640, #2540)
Full list of merged PRs:
- #2708 [feat] Simplfy command approval UI
- #2706 [chore] Tweak AGENTS.md so agent doesn't always have to test
- #2701 Added caps on retry config settings
- #2702 [fix] emoji padding
- #2704 [feat] reduce bottom padding to 1 line
- #2695 Improved user message for rate-limit errors
- #2691 single control flow for both Esc and Ctrl+C
- #2699 Fixed a bug that causes token refresh to not work in a seamless manner
- #2587 do not show timeouts as "sandbox error"s
- #2693 queued messages rendered italic
- #2692 do not schedule frames for Tui::Draw events in backtrack
- #2567 Copying / Dragging image files (MacOS Terminal + iTerm)
- #2688 Add auth to send_user_turn
- #2661 Fix esc
- #2648 [exec] Clean up apply-patch tests
- #2684 fix: use backslash as path separator on Windows
- #2637 tui: queue messages
- #2640 avoid error when /compact response has no token_usage (#2417)
- #2678 Index file
- #2665 chore(deps): bump toml_edit from 0.23.3 to 0.23.4 in /codex-rs
- #2664 fix: Scope ExecSessionManager to Session instead of using global singleton
- #2663 fix: build is broken on main; introduce ToolsConfigParams to help fix
- #2611 Fix cache hit rate by making MCP tools order deterministic
- #2649 fix: update gpt-5 stats
- #2497 chore(deps): bump whoami from 1.6.0 to 1.6.1 in /codex-rs
- #2646 feat: use the arg0 trick with apply_patch
- #2643 [apply_patch] disable default freeform tool
- #2633 test: faster test execution in codex-core
- #2607 Resume conversation from an earlier point in history
- #2371 Add web search tool
- #2364 send-aggregated output
- #2605 transcript hint
- #2381 Add the ability to interrupt and provide feedback to the model
- #2574 feat: StreamableShell with exec_command and write_stdin tools
- #2575 fork conversation from a previous message
- #2600 tui: fix resize on wezterm
- #2590 tui: coalesce command output; show unabridged commands in transcript
- #2592 tui: open transcript mode at the bottom
- #2518 Fix typo in AGENTS.md
- #2492 chore(deps): bump reqwest from 0.12.22 to 0.12.23 in /codex-rs
- #2547 Fix flakiness in shell command approval test
- #2498 chore(deps): bump serde_json from 1.0.142 to 1.0.143 in /codex-rs
- #2595 Move models.rs to protocol
- #2594 fix: prefer sending MCP structuredContent as the function call response, if available
- #2586 test: simplify tests in config.rs
- #2593 improve performance of 'cargo test -p codex-tui'
- #2585 [config] Detect git worktrees for project trust
- #2576 [apply_patch] freeform apply_patch tool
- #2577 Add AuthManager and enhance GetAuthStatus command
- #2544 Fix/tui windows multiline paste
- #1695 ctrl+v image + @file accepts images
- #2569 improve suspend behavior
- #2108 feat(gpt5): add model_verbosity for GPT‑5 via Responses API
- #2568 show diff output in the pager
- #2539 [apply-patch] Clean up apply-patch tool definitions
- #2571 [shell_tool] Small updates to ensure shell consistency
- #2523 core: write explicit [projects] tables for trusted projects
- #2533 tweak thresholds for shimmer on non-true-col

- Highlights
- New commands and controls: support /mcp in TUI (#2430) and a slash command /approvals to control approvals (#2474).
- Reasoning controls: change reasoning effort and model at runtime (#2435) /model; add “minimal” effort for GPT‑5 models (#2326).
- Auth improvements: show login options when not signed in with ChatGPT (#2440) and auto‑refresh ChatGPT auth token (#2484).
- UI/UX polish: Ghostty Ctrl‑b/Ctrl‑f fallback (#2427), Ctrl+H as backspace (#2412), cursor position tweak after tab completion (#2442), color/accessibility updates (#2401, #2421).
- Distribution/infra: zip archived binaries added to releases (#2438) and DotSlash entry for Windows x86_64 (#2361); upgraded to Rust 1.89 (#2465, #2467).
- Full list of merged PRs
- #2352 tui: skip identical consecutive entries in local composer history
- #2355 fix: introduce codex-protocol crate
- #2326 Fix #2296 Add "minimal" reasoning effort for GPT 5 models
- #2357 Remove duplicated "Successfully logged in message"
- #2337 color the status letter in apply patch summary
- #2336 chore: remove duplicated lockfile
- #2361 fix: include an entry for windows-x86_64 in the generated DotSlash file
- #2245 Show progress indicator for /diff command
- #2314 replace /prompts with a rotating placeholder
- #2372 Added launch profile for attaching to a running codex CLI process
- #2373 Added MCP server command to enable authentication using ChatGPT
- #2388 fix: refactor login/src/server.rs so process_request() is a separate function
- #2365 fix: introduce EventMsg::TurnAborted
- #2360 remove mcp-server/src/mcp_protocol.rs and the code that depends on it
- #2401 fix: clean up styles & colors and define in styles.md
- #2411 chore(deps-dev): bump @types/node in /.github/actions/codex
- #2421 fix: stop using ANSI blue
- #2423 chore: move mcp-server/src/wire_format.rs to protocol/src/mcp_protocol.rs
- #2424 chore: add TS annotation to generated mcp-types
- #2428 consolidate reasoning enums into one
- #2431 Add an operation to override current task context
- #2425 protocol-ts
- #2432 Add cache tests for UserTurn
- #2412 Fix #2391 Add Ctrl+H as backspace keyboard shortcut
- #2405 chore(deps): bump anyhow in /codex-rs
- #2406 chore(deps): bump libc in /codex-rs
- #2389 chore: prefer returning Err to expect()
- #2393 fix: async-ify login flow
- #2404 chore(deps): bump clap in /codex-rs
- #2394 fix: change shutdown_flag from Arc<AtomicBool> to tokio::sync::Notify
- #2438 Release zip archived binaries
- #2395 fix: eliminate ServerOptions.login_timeout and use tokio::time::timeout()
- #2396 fix: make ShutdownHandle a private field of LoginServer
- #2398 fix: reduce references to Server in codex-login crate
- #2399 fix: remove shutdown_flag param to run_login_server()
- #2403 chore(deps): bump clap_complete in /codex-rs
- #2440 Show login options when not signed in with ChatGPT
- #2446 fix: exclude sysprompt etc from context left %
- #2430 [tui] Support /mcp command
- #2442 Fix #2429 Tweak the cursor position after tab completion
- #2457 fix: fix missing spacing in review decision response
- #2427 tui: support Ghostty Ctrl-b/Ctrl-f fallback
- #2407 chore(deps): bump actions/checkout from 4 to 5
- #2435 Support changing reasoning effort
- #2462 feat: move session ID bullet in /status
- #2464 docs: document writable_roots for sandbox_workspace_write
- #2466 fix: prefer cargo check to cargo build to save time and space
- #2465 chore: upgrade to Rust 1.89
- #2467 chore: Rust 1.89 promoted file locking to stdlib
- #2468 fix apply patch when only one file is rendered
- #2475 Fix: Sign in appear even if using other providers.
- #2460 Enable Dependabot updates for Rust toolchain
- #2476 Diff command
- #2487 Client headers
- #2484 Refresh ChatGPT auth token
- #2495 fix: prefer config var to env var
- #2474 Add a slash command to control permissions