codex rust-v0.147.0 release notes

New Features

Install portable Agent Plugins and search across local, personal, workspace, and remote plugin catalogs. (#36544, #36409, #36919, #36796)
Organize conversations into persistent, manually ordered sections and browse long transcripts incrementally. (#35722, #36007, #36380, #36948, #36950)
Enable automatically reviewed approvals with the new --approve-for-me CLI flag. (#36373)
Import Cursor-managed skills and synchronize changes to imported Claude and Cursor conversations without creating duplicates. (#36361, #36356, #35623)
Support the opt-in MCP 2026-07-28 protocol, including paginated discovery, multi-round requests, and non-blocking server startup. (#35724, #35725, #35590, #35742)
Enable cached web search and remote conversation compaction for Amazon Bedrock. (#36938, #36981)

Bug Fixes

Redact secrets and complete bearer tokens from displayed commands and replayed conversation history. (#36893, #36908)
Prevent lost or stalled terminal input when focus returns, MCP servers initialize, or Ghostty handles keyboard shortcuts. (#35649, #35957, #36834)
Correct rendering and cursor positioning for Japanese characters, emoji, hyperlinks, and text near viewport boundaries. (#35960, #35962, #37166)
Properly interrupt Windows background processes and handle Windows filesystem paths consistently. (#35655, #35851, #37129)
Require explicit trust for unfamiliar local projects and enforce managed authentication restrictions before credentials are used. (#36960, #37132)
Harden plugin isolation and deny network access when policy updates fail. (#37027, #36967, #36037)

Documentation

Improve the bundled OpenAI documentation skill with targeted official-source lookup and clearer guidance for Codex, model selection, and API workflows. (#36014)

Chores

Upgrade the MCP SDK to 3.0.0, Ratatui to 0.30.2, and V8 to 150.4.0. (#36001, #35959, #35831)
Secure macOS release notarization using Azure Key Vault instead of exporting private signing keys. (#37154)
Remove the deprecated codex exec --full-auto flag; use --sandbox workspace-write instead. (#36054)
Stop publishing redundant Linux bundle archives; use the standard codex-package-<target> release archives. (#36342)

Changelog

Full Changelog: https://github.com/openai/codex/compare/rust-v0.146.0...rust-v0.147.0

#35590 Expose cached MCP tools before server startup @copyberry
#35594 Recommend longer waits in the v2 wait_agent schema @copyberry
#35595 Allow alpha hotfix versions in R2 releases @copyberry
#35597 Add metrics for extension-rendered skill catalogs @copyberry
#35607 Record metrics for empty skill catalogs @copyberry
#35608 Support model-owned token budget defaults @copyberry
#35621 Skip restored token usage replay for exec resumes @copyberry
#35623 Parse Claude and Cursor session records separately @copyberry
#35642 Make OpenTelemetry provider shutdown idempotent @copyberry
#35644 Preserve thread metadata when rollout files are missing @copyberry
#35649 Preserve TUI input when terminal focus returns @copyberry
#35652 Enable network policy callbacks for remote exec @copyberry
#35653 Test developer instruction inheritance for multi-agent workers @copyberry
#35655 Terminate Windows non-TTY processes on interrupt @copyberry
#35656 Preserve multi-agent settings across config representations @copyberry
#35661 Place host skills before permission instructions @copyberry
#35663 Evaluate character matching over skill routing metadata @copyberry
#35665 Fix the async watcher test harness on Windows @copyberry
#35668 Expose the network proxy spec constructor @copyberry
#35670 Raise the Windows exec yield floor to 10 seconds @copyberry
#35671 Route curated plugins by authentication mode @copyberry
#35675 Prepare MCP and plugin recommendations concurrently @copyberry
#35678 Preserve paginated thread metadata across resumes @copyberry
#35685 Load cloud-managed profiles for codex sandbox @copyberry
#35688 Point crossterm patch to the OpenAI OSS fork @copyberry
#35689 Preserve item timestamps in thread history projections @copyberry
#35691 Include empty-preview threads in relationship listings @copyberry
#35693 Refresh the subagent picker in the background @copyberry
#35695 Honor the configured SQLite home in the logs client @copyberry
#35708 Add configurable developer instructions for v2 subagents @copyberry
#35715 Support streaming bodies in route-aware HTTP requests @copyberry
#35717 Reuse route-aware clients for OpenAI file uploads @copyberry
#35720 Upgrade rmcp to 3.0.0-beta.3 @copyberry
#35721 Honor disabled code mode fallback without a process host @copyberry
#35722 Add persisted sections for organizing threads @copyberry
#35724 Add MCP 2026-07-28 discovery support @copyberry
#35725 Complete MCP 2026 client support @copyberry
#35738 Add bounded metadata for executed tool calls @copyberry
#35742 Avoid blocking turns on optional MCP startup @copyberry
#35744 Keep agent registry identities consistent @copyberry
#35766 Emit host skill budget warnings from world state @copyberry
#35769 Share the skills budget across host and executor catalogs @copyberry
#35772 Throttle models cache TTL renewals @copyberry
#35773 Scale skill metadata budgets with context windows @copyberry
#35777 Resolve MCP tool catalogs concurrently @copyberry
#35779 Load thread titles concurrently during session startup @copyberry
#35785 Support self-serve Business ProLite accounts @copyberry
#35787 Gate paginated thread history on the state database @copyberry
#35794 Wait for MCP readiness in the curated sync test @copyberry
#35802 Tag reports with the selected turn's model and effort @copyberry
#35806 Route MCP OAuth through configured HTTP clients @copyberry
#35814 Use configured HTTP clients for all MCP OAuth requests @copyberry
#35818 Advance latest-alpha-cli after release publishing completes @copyberry
#35821 Use the shared HTTP client for TUI network checks @copyberry
#35825 Use the shared HTTP client for announcement tips @copyberry
#35828 Enforce centralized SQLite connection creation @copyberry
#35830 Route WebRTC sideband joins to the Realtime API @copyberry
#35831 Update rusty_v8 to 150.4.0 @copyberry
#35835 Track parent turns for nested Codex requests @copyberry
#35836 Clean up cancelled MCP elicitation requests @copyberry
#35837 Expose plugin eligibility metadata in app-server summaries @copyberry
#35839 Decouple recommended plugins from tool suggestions @copyberry
#35840 Handle legacy MCP discovery prevalidation errors @copyberry
#35843 Tie remote exec servers to their parent stdin @copyberry
#35845 Support plaintext collaboration tool messages @copyberry
#35850 Preserve foreign paths in background terminal listings @copyberry
#35851 Normalize Windows namespace paths in path URIs @copyberry
#35854 Box app-server event payloads @copyberry
#35856 Resolve imported connectors by MCP server name @copyberry
#35857 Add Bazel unit test targets for Rust binaries @copyberry
#35859 Expose plugin installation timestamps in app-server summaries @copyberry
#35870 Include session titles in external agent import history @copyberry
#35874 Mark the primary environment in model context @copyberry
#35875 Allow environment readiness updates in place @copyberry
#35878 Use step environments for MCP file uploads @copyberry
#35886 Show blocked goals as stalled in the TUI @copyberry
#35887 Clean up side conversations in the background @copyberry
#35895 Inherit ready step environments when spawning agents @copyberry
#35937 Let unrelated tools run while MCP servers start @copyberry
#35941 Bound MCP namespace descriptions @copyberry
#35942 Update tests for current tool call and app-server event types @copyberry
#35944 Report direct input capability for listed subagents @copyberry
#35957 Fix TUI input queue handling during MCP startup @copyberry
#35959 Upgrade Ratatui to 0.30.2 @copyberry
#35960 Preserve hyperlink cell widths during terminal diffing @copyberry
#35962 Fix TUI layout for halfwidth Japanese sound marks @copyberry
#35982 Avoid cloning rollout history when truncating forks @copyberry
#35989 Display title-only reasoning summaries in the TUI @copyberry
#35990 Test exec-server compatibility across Codex versions @copyberry
#35992 Group external agent config migration into a module @copyberry
#35997 Remove obsolete rusty_v8 146.4.0 Bazel targets @copyberry
#36001 Upgrade rmcp to 3.0.0 @copyberry
#36002 Resolve MCP file uploads with environment-native paths @copyberry
#36006 Reduce response serialization and rollout scan overhead @copyberry
#36007 Add persisted manual ordering for thread sections @copyberry
#36008 Route pet asset downloads through the shared HTTP client @copyberry
#36011 Share optional MCP startup grace across connection sets @copyberry
#36014 Refine OpenAI docs skill source routing @copyberry
#36020 Avoid cloning ignored analytics notifications @copyberry
#36030 Increase the app-server tracing test stack size @copyberry
#36031 Load cloud-managed servers in MCP CLI commands @copyberry
#36033 Use the shared HTTP client in codex-protocol @copyberry
#36035 Exit the stdio app-server when its connection closes @copyberry
#36036 Allow naming forked chats from the TUI @copyberry
#36037 Deny network access when an allow amendment fails @copyberry
#36039 Limit MCP catalog pagination @copyberry
#36043 Document the Responses API proxy reqwest exception @copyberry
#36045 Distinguish unknown MCP authentication status @copyberry
#36047 Extract MCP environment headers into a local variable @copyberry
#36049 Keep tool-call metrics out of Statsig exports @copyberry
#36051 Avoid overwriting symlinked migration targets @copyberry
#36054 Remove legacy --full-auto handling from codex exec @copyberry
#36055 Expose MCP read-only hints in tool call items @copyberry
#36076 Remove codex-core's direct reqwest dependency @copyberry
#36078 Route Ollama through the shared HTTP client @copyberry
#36083 Handle fractional rate limits in thread history projection @copyberry
#36092 Correlate image requests and explicit interrupts with turns @copyberry
#36119 Unify tool runtime assembly before router construction @copyberry
#36120 Delegate readiness waits to tool runtimes @copyberry
#36121 Sandbox executor skill resource reads @copyberry
#36124 Respect filesystem permissions during capability discovery @copyberry
#36127 Centralize tool registration and protect host tools @copyberry
#36128 Preserve delegated tasks across remote compaction @copyberry
#36129 Resolve normalized tool name collisions in code mode @copyberry
#36133 Preserve executor workspace permissions for apply_patch @copyberry
#36138 Isolate apply-patch permission test variants @copyberry
#36139 Bound the code mode output termination test @copyberry
#36140 Wait for memory consolidation shutdown before finishing jobs @copyberry
#36146 Stabilize approval scenario tests @copyberry
#36148 Harden the file change approval integration test @copyberry
#36149 Strengthen session file change approval coverage @copyberry
#36165 Stabilize file approval replay test @copyberry
#36166 Make pending realtime sideband test deterministic @copyberry
#36167 Harden the auto-review model override test @copyberry
#36168 Make tool telemetry tag collection synchronous @copyberry
#36171 Test workspace-root patch protection for metadata @copyberry
#36177 Test remote Guardian network approval scoping @copyberry
#36181 Record attempted tool calls in response metadata @copyberry
#36183 Use permission profiles throughout sandbox execution @copyberry
#36184 Coalesce concurrent remote metadata requests @copyberry
#36187 Refresh environment dates from the configured clock @copyberry
#36188 Make thread history projection resilient to malformed rollouts @copyberry
#36191 Label explicit skill injection metrics @copyberry
#36194 Avoid shifting bytes in streaming output buffers @copyberry
#36207 Record normalized sandbox violation events @copyberry
#36212 Precompute app-server protocol exports @copyberry
#36217 Run code mode exclusively through the standalone host @copyberry
#36218 Expose connector candidates in external agent detection @copyberry
#36221 Ignore passthrough metadata when reconciling rollout items @copyberry
#36223 Preserve executor paths in read command actions @copyberry
#36228 Support Enterprise automation account plans @copyberry
#36237 Ignore symbolic slash-tmp permissions on Windows @copyberry
#36239 Refresh precomputed app-server protocol exports @copyberry
#36264 Prefer the bundled resource for the code mode host @copyberry
#36271 Derive report prompt hashes from persisted rollouts @copyberry
#36306 Restrict hosted MCP credentials to local environments @copyberry
#36309 Use the host skill provider catalog in world state @copyberry
#36310 Isolate MCP OAuth credentials by environment @copyberry
#36311 Include skills in debug prompt input output @copyberry
#36327 Preserve discovery order for host skill path aliases @copyberry
#36329 Restrict shell_command to a single local environment @copyberry
#36336 Detect connectors used in external agent sessions @copyberry
#36339 Enable skills in the MCP server @copyberry
#36342 Stop publishing legacy Linux bundle archives @copyberry
#36350 Require explicit sandbox permissions with shell justifications @copyberry
#36351 Use model catalog collaboration mode messages @copyberry
#36354 Pass sessions directly to session tasks @copyberry
#36355 Keep MCP tool calls bound to their thread @copyberry
#36356 Sync updates to imported external agent sessions @copyberry
#36357 Use the step-scoped router for tool execution @copyberry
#36359 Consolidate MCP config editing in codex-core @copyberry
#36360 Use MCP bindings as the step tool catalog @copyberry
#36361 Migrate Cursor-managed skills into Codex @copyberry
#36364 Move skill catalog rendering out of core @copyberry
#36365 Add strict automatic review for MCP elicitations @copyberry
#36367 Keep effective tool exposure in the registry @copyberry
#36372 Run native Windows Bazel tests with MSVC @copyberry
#36373 Add an --approve-for-me CLI flag @copyberry
#36374 Enable sandboxed V8 for code mode @copyberry
#36378 Load local session pickers from the state DB first @copyberry
#36380 Add thread section management APIs @copyberry
#36384 Load turn summaries with paginated queries @copyberry
#36385 Add acknowledged user message submission to core @copyberry
#36388 Track image preparation details in turn analytics @copyberry
#36389 Enforce single-writer ownership for all thread histories @copyberry
#36393 Avoid redundant filesystem probes @copyberry
#36402 Declare the experimental plugin search API @copyberry
#36408 Allow custom Codex instructions for realtime transitions @copyberry
#36409 Implement remote plugin search @copyberry
#36410 Make user input blocking behavior explicit @copyberry
#36411 Use Git repositories as pre-tool hook test markers @copyberry
#36413 Add a realtime delegation acknowledgement control @copyberry
#36440 Extract exec-server request dispatching @copyberry
#36482 Avoid querying terminal size on every TUI redraw @copyberry
#36485 Increase remote plugin bundle size limits @copyberry
#36507 Retain attempted tool metadata across prompts @copyberry
#36511 Support two-stroke TUI key chords @copyberry
#36534 Raise the MCP catalog item limit to 2,048 @copyberry
#36544 Support portable Agent Plugins throughout installation @copyberry
#36632 Preserve SQLite thread metadata during goal mutations @copyberry
#36635 Expose onboarding hints in login completion notifications @copyberry
#36641 Capture rollout budget units from response usage @copyberry
#36715 Use provider-reported rollout budget units @copyberry
#36716 Deduplicate MCP resource operation handling @copyberry
#36727 Simplify turn metadata state ownership @copyberry
#36729 Correlate code mode tool analytics with model responses @copyberry
#36732 Stabilize the cloud environment HTTP test @copyberry
#36734 Deduplicate MCP resource list handling @copyberry
#36740 Store turn skill state in extension data @copyberry
#36742 Simplify contextual user fragment registration @copyberry
#36744 Store the extension registry directly in its builder @copyberry
#36745 Consolidate apply_patch runtime execution @copyberry
#36757 Wait for patch events before reading shell snapshots @copyberry
#36759 Harden the TUI focus palette regression test @copyberry
#36764 Avoid building code-mode definitions during registration @copyberry
#36769 Stabilize the startup Git enrichment integration test @copyberry
#36770 Stabilize deferred goal fork testing @copyberry
#36771 Harden Linux managed proxy helper lifecycles @copyberry
#36772 Raise the host-owned Codex Apps catalog limit @copyberry
#36773 Derive the active user config layer from the layer stack @copyberry
#36774 Clarify config layer iteration APIs @copyberry
#36779 Stabilize network policy event capture in concurrent tests @copyberry
#36781 Add per-surface MCP tool exposure controls @copyberry
#36782 Add Guardian session reuse and interruption tests @copyberry
#36787 Consolidate model instructions in ModelMessages @copyberry
#36792 Gate plugin usage instructions by model capability @copyberry
#36793 Terminate timed-out Git process trees @copyberry
#36796 Add Agent Plugins MCP config parsing @copyberry
#36797 Normalize rusty_v8 checksum manifest line endings @copyberry
#36800 Avoid reinjecting permissions after command approvals @copyberry
#36807 Extract audio preparation into a utility crate @copyberry
#36808 Prefer SQLite names for local session archive commands @copyberry
#36809 Prefer the state database for exec resume --last @copyberry
#36810 Add MCP client conformance regression gates @copyberry
#36811 Honor per-environment login shell policy @copyberry
#36812 Add a dual-WebSocket transport for code mode @copyberry
#36815 Identify agents by name in token budget context @copyberry
#36822 Fix typo in approval resolver name @copyberry
#36825 Consolidate approval telemetry context @copyberry
#36830 Time out stalled code-mode host requests @copyberry
#36834 Avoid requesting key-release events in Ghostty @copyberry
#36840 Keep API request metrics out of Statsig exports @copyberry
#36856 Support deferred loading for freeform tools @copyberry
#36857 Support custom tools in namespaces @copyberry
#36862 Consolidate thread spawning behind a request object @copyberry
#36871 Parallelize R2 asset publishing with DotSlash @copyberry
#36877 Move executor skill bundle loading into the skills extension @copyberry
#36880 Move direct executor skill discovery into the skills extension @copyberry
#36882 Preserve complete MCP namespace descriptions @copyberry
#36884 Add host skill root loading @copyberry
#36892 Support leaf models in multi-agent v2 @copyberry
#36893 Redact secrets from app-server command execution items @copyberry
#36895 Handle late MCP startup results after lag timeout @copyberry
#36898 Avoid redundant filesystem metadata probes @copyberry
#36900 Register app tools independently of the connector list @copyberry
#36901 Propagate updated permissions to review threads @copyberry
#36903 Load skill interface metadata in the host loader @copyberry
#36904 Limit RMCP logs persisted to SQLite @copyberry
#36906 Preserve model providers when reloading v2 agents @copyberry
#36908 Improve bearer token secret redaction @copyberry
#36910 Negotiate MCP extensions per app-server session @copyberry
#36912 Read approval policy from the current turn configuration @copyberry
#36913 Move skill policy resolution into codex-skills @copyberry
#36916 Centralize app enabled-state evaluation @copyberry
#36917 Test explicit plugin mentions with disabled apps @copyberry
#36919 Merge local plugins into plugin search results @copyberry
#36921 Move the host skills service into the skills extension @copyberry
#36924 Reject implicitly discovered bare Git repositories @copyberry
#36930 Read turn permissions from the current configuration @copyberry
#36935 Trust undecided local projects automatically @copyberry
#36938 Enable cached web search for Amazon Bedrock @copyberry
#36939 Include policy approval reasons in Guardian reviews @copyberry
#36941 Use current session settings for review threads @copyberry
#36943 Move host skill root resolution into the skills extension @copyberry
#36945 Grant the blob size policy job read access to contents @copyberry
#36947 Accept user input when starting idle turns @copyberry
#36948 Paginate transcript history in the TUI @copyberry
#36949 Improve paginated TUI history loading @copyberry
#36950 Paginate TUI transcript history @copyberry
#36951 Harden paginated history handling in the TUI @copyberry
#36952 Add durable per-thread user submission queues @copyberry
#36954 Add tool registry collision policy configuration @copyberry
#36956 Keep image resize notices attached during remote compaction @copyberry
#36959 Track connectors detected in external agent sessions @copyberry
#36960 Prompt before trusting local project directories @copyberry
#36963 Link Codex attribution in pull request bodies @copyberry
#36964 Preserve working directories when importing external sessions @copyberry
#36966 Allow disabling the built-in image viewer @copyberry
#36967 Skip symlinks when installing plugins @copyberry
#36970 Make token budget context identity configurable @copyberry
#36976 Honor explicit-only orchestrator skills @copyberry
#36977 Improve connector detection for migrated sessions @copyberry
#36979 Add Fence auditing to the blob size workflow @copyberry
#36981 Enable remote compaction for Amazon Bedrock @copyberry
#36983 Preserve ChatGPT auth for trusted staging MCP servers @copyberry
#36984 Support configured ChatGPT cookies in HTTP clients @copyberry
#36986 Add process-scoped PSP routing for ChatGPT requests @copyberry
#36987 Add opt-in concurrent exec-server request dispatch @copyberry
#36989 Preserve shared bundled skill caches @copyberry
#36990 Remove legacy collaboration mode variants @copyberry
#36992 Allow injecting model catalog caches @copyberry
#36993 Support includeTurns reads for paginated threads @copyberry
#36998 Support deferred custom tools in tool search @copyberry
#37000 Keep shared skill caches fresh across plugin loads @copyberry
#37020 Enforce strict tool name collision errors @copyberry
#37022 Canonicalize default tools under the functions namespace @copyberry
#37027 Enforce Agent Plugin runtime boundaries @copyberry
#37031 Apply permission profile updates to future turn environments @copyberry
#37035 Align registry tests with canonical tool names @copyberry
#37038 Use turn environment permissions for tool execution @copyberry
#37040 Use turn environment permissions for context and discovery @copyberry
#37053 Reject conflicting namespace descriptions in strict tool mode @copyberry
#37055 Add safer TUI defaults for cyber models @copyberry
#37066 Preserve longer MCP source descriptions in tool search @copyberry
#37068 Fall back to per-process MCP cleanup on macOS @copyberry
#37083 Consolidate unified exec output state @copyberry
#37101 Reuse stable MCP bindings across sampling steps @copyberry
#37103 Use Luna for API-key Guardian reviews @copyberry
#37109 Bound interactive telemetry shutdown @copyberry
#37114 Add per-session code-mode execution limits @copyberry
#37128 Centralize tool approval handling in Session @copyberry
#37129 Make Windows path URI comparisons ASCII-case-insensitive @copyberry
#37132 Enforce managed authentication requirements locally @copyberry
#37134 Report prompt image resizing to the model @copyberry
#37144 Preserve discovery paths for symlinked skills @copyberry
#37145 Gate Apps usage instructions by model capability @copyberry
#37147 Track provisioned environment state across registration @copyberry
#37149 Project orchestrator skills through world state @copyberry
#37151 Coalesce concurrent Git status scans @copyberry
#37154 Use Azure Key Vault for macOS notarization @copyberry
#37156 Test remote environments reported ready before selection @copyberry
#37157 Harden named session lookup in the TUI @copyberry
#37162 Load host skill roots through the skills extension @copyberry
#37166 Keep textarea cursors and rendering inside the viewport @copyberry
#37167 Expose session sources to MCP contributors @copyberry
#37168 Bound remote MCP handshake HTTP requests @copyberry
#37169 Move plugin skill snapshot integration tests into core @copyberry
#37174 Centralize skill invocation helpers in codex-skills @copyberry
#37175 Add legacy rollout migration to paginated history @copyberry
#37177 Move explicit skill selection into the skills crate @copyberry
#37178 Preserve image transparency metadata in app-server items @copyberry
#37188 Reserve the tool_search namespace for the search tool @copyberry
#37189 Track multi-agent usage hints in world state @copyberry

codex rust-v0.147.0

0.147.0

New Features

Bug Fixes

Documentation

Chores

Changelog

Upgraded? How did it go?

Discussion