codex rust-v0.149.0 release notes

New Features

Added an interactive codex agents dashboard for searching, starting, opening, renaming, and stopping tasks, with configurable shortcuts. (#39094, #39112, #39114, #39142)
Added /cd, /pwd, and /cwd commands for managing the working directory in TUI sessions. (#38894)
Added codex queue for sending messages to existing local or remote sessions. (#39092)
Expanded Vim editing with character replacement and more change motions such as cw, c$, and cc. (#39661)
codex doctor now diagnoses endpoint protection, network/proxy failures, desktop app state, and update connectivity. (#38827, #38918, #39060, #39074)
SDK users can now pass exact CLI config overrides and select max or ultra reasoning effort. (#38817, #39662)

Bug Fixes

Queued messages now wake idle sessions reliably, resolve duplicate session names more usefully, and preserve pasted or deferred command semantics. (#39034, #39385, #39604)
Resumed and forked threads now restore their active permission profile instead of silently falling back to current defaults. (#39153)
Fixed duplicate sub-agent activity and tightened TUI routing for sub-agent notifications and approvals. (#39049, #39088)
Realtime WebRTC sideband connections now reconnect after unexpected transport loss without dropping pending output. (#39257)
Inline TUI history now remains available in Windows Terminal scrollback. (#39619)
Inactive TUI thread replay buffers are now bounded to prevent excessive retained streamed output. (#39081)

Documentation

Clarified that external contributions should go through issues and design discussion rather than pull requests. (#39089)
Documented DNS exfiltration risks and trust limitations for secure devcontainers. (#39283)

Changelog

Full Changelog: https://github.com/openai/codex/compare/rust-v0.148.0...rust-v0.149.0

#38817 Add raw config overrides to the TypeScript SDK @copyberry
#38819 Support metadata staging for reserved thread IDs @copyberry
#38822 Avoid cloning TUI history span content @copyberry
#38823 Avoid allocating per character when decorating hyperlinks @copyberry
#38827 Add endpoint protection checks to codex doctor @copyberry
#38830 Isolate external editor buffers from sandbox-writable paths @copyberry
#38837 Share editor keymaps across TUI composer components @copyberry
#38840 Identify Mac mini hosts in remote control handshakes @copyberry
#38893 Restore thread timestamp maxima independently @copyberry
#38894 Add working-directory commands to the TUI @copyberry
#38899 Move requirements policy ownership to execpolicy @copyberry
#38902 Honor per-environment shell variable policies @copyberry
#38907 Edit queued messages with Vim history-up @copyberry
#38913 Stop rendering columns after filling their area @copyberry
#38916 Honor legacy :project_roots permission entries @copyberry
#38918 Improve codex doctor network diagnostics @copyberry
#38919 Reject obsolete app-server permission profile fields @copyberry
#38921 Compact successful command activity in the TUI @copyberry
#38940 Add experimental app-server project APIs @copyberry
#38941 Prevent Noise auth tokens from reaching child processes @copyberry
#38942 Enforce environment-specific command policies @copyberry
#38947 Stop loading legacy managed config on Windows @copyberry
#38978 Add a configurable skill catalog token budget @copyberry
#38980 Bound Guardian v2 parent compaction context @copyberry
#38987 Include images in Guardian v2 transcripts @copyberry
#38990 Source Guardian v2 defaults from the model catalog @copyberry
#38993 Evaluate recent and character-routed skill selection @copyberry
#38994 Remove the workspace settings gate for apps and plugins @copyberry
#38997 Retry transient Guardian sampling failures @copyberry
#39001 Ignore stale Guardian tool risk scores @copyberry
#39005 Disable Guardian V2 for managed automatic reviewers @copyberry
#39006 Emit API-key turn cost telemetry from app-server @copyberry
#39007 Wait for Guardian score progress in approval tests @copyberry
#39008 Add task context to shadow skill selection @copyberry
#39017 Move MCP policy types into codex-protocol @copyberry
#39019 Isolate MCP resource headers during OAuth requests @copyberry
#39020 Restrict Windows IDE pipe client impersonation @copyberry
#39022 Hang soft-break whitespace in the TUI composer @copyberry
#39023 Reduce retained MCP result data in TUI history @copyberry
#39025 Speed up the large diff highlighting test @copyberry
#39026 Use simulated time in the long typing test @copyberry
#39028 Cache the test pet spritesheet encoding @copyberry
#39030 Speed up the in-app resume cwd test @copyberry
#39032 Encapsulate TUI shimmer under the motion module @copyberry
#39033 Bound legacy resume preview scans @copyberry
#39034 Dispatch queued messages written by other processes @copyberry
#39035 Add app-server coverage for Guardian V2 approval routing @copyberry
#39036 Allow config reads to join active app-server read batches @copyberry
#39038 Restore Guardian risk scores across thread lifecycles @copyberry
#39040 Preserve foreign paths in managed network approvals @copyberry
#39043 Enforce managed authentication backend settings @copyberry
#39045 Add managed gates for in-app chat and dictation @copyberry
#39046 Restrict MCP HTTP redirects to the configured origin @copyberry
#39047 Skip plugin hook loading when hooks are disabled @copyberry
#39049 Avoid rendering sub-agent activity twice in the TUI @copyberry
#39050 Prepare the telemetry shutdown worker during initialization @copyberry
#39051 Use installed callable apps for TUI mentions @copyberry
#39055 Add network policy metadata to environment configuration @copyberry
#39056 Verify the pinned zsh manifest in release builds @copyberry
#39057 Rate-limit TUI frames from their actual emission time @copyberry
#39058 Tag Codex Apps protocol discovery metrics @copyberry
#39060 Add desktop app diagnostics to codex doctor @copyberry
#39061 Avoid rerendering streamed code fences @copyberry
#39063 Render only visible rows in the transcript pager @copyberry
#39064 Restrict queued-message editing to its dedicated binding @copyberry
#39065 Limit terminal hyperlink layout to the visible viewport @copyberry
#39067 Add desktop security enforcement diagnostics @copyberry
#39068 Remove skill model delegation support @copyberry
#39072 Persist generated images through turn executors @copyberry
#39073 Propagate caller metadata to rendezvous connections @copyberry
#39074 Add desktop update diagnostics to codex doctor @copyberry
#39075 Avoid redundant terminal row clears @copyberry
#39077 Build filesystem JSON params only for remote TUI sessions @copyberry
#39078 Preserve tracing context for environment resolution @copyberry
#39079 Apply user MCP policy to selected executor plugins @copyberry
#39081 Bound TUI thread replay buffers by delta size @copyberry
#39082 Prompt for project trust in remote TUI workspaces @copyberry
#39083 Harden Windows sandbox provisioning against reparse points @copyberry
#39084 Preserve filesystem permission path conventions @copyberry
#39087 Read plugin authentication state from AuthManager @copyberry
#39088 Harden TUI subagent navigation @copyberry
#39089 Clarify the external contribution policy @copyberry
#39092 Add a command to queue messages for existing sessions @copyberry
#39094 Add an agents overview dashboard to the TUI @copyberry
#39098 Trace exec-server requests from receipt through completion @copyberry
#39100 Avoid redundant terminal size queries during history insertion @copyberry
#39101 Update rmcp to 3.1.2 @copyberry
#39102 Raise the GPT-5.6 maximum context window @copyberry
#39103 Drop capabilities from Linux sandbox processes @copyberry
#39112 Make the agents overview an interactive task dashboard @copyberry
#39113 Surface interactive requests in realtime conversations @copyberry
#39114 Add a dedicated codex agents dashboard command @copyberry
#39115 Remove the experimental thread config endpoint @copyberry
#39117 Reject lossy legacy permission projections @copyberry
#39122 Fail closed on deeply nested command wrappers @copyberry
#39131 Validate identifiers in plugin creator workflows @copyberry
#39141 Redact auth tokens from app-server response logs @copyberry
#39142 Add configurable shortcuts for the agents dashboard @copyberry
#39143 Hydrate recommended plugin metadata on selection @copyberry
#39145 Persist active permission profiles in turn context @copyberry
#39147 Centralize persisted resume settings lookup @copyberry
#39152 Update PyPI publish action to v1.14.2 @copyberry
#39153 Restore permission profiles when resuming threads @copyberry
#39154 Box the TUI future to bound CLI stack usage @copyberry
#39155 Prepare Python SDK 0.147.0 stable release @copyberry
#39157 Notify clients when Guardian requires strict review @copyberry
#39159 Require approval for commands with dynamic shell words @copyberry
#39163 Refresh collaboration instructions when their content changes @copyberry
#39165 Prevent marketplace identity spoofing @copyberry
#39174 Skip empty user messages for automatic idle turns @copyberry
#39176 Drop descendant progress updates after remote compaction @copyberry
#39187 Scope MCP app resource reads to their originating call @copyberry
#39192 Preserve MCP resource origins across compaction @copyberry
#39200 Add a symlink-safe reader for sensitive files @copyberry
#39205 Reject symbolic links in memory workspaces @copyberry
#39213 Add a fail-closed Tree-sitter PowerShell lowerer @copyberry
#39214 Prevent custom providers from inheriting ambient auth @copyberry
#39220 Reconnect Guardian sampling WebSockets after auth changes @copyberry
#39221 Skip redirected external-agent migration destinations @copyberry
#39224 Add Guardian v2 approval review metrics @copyberry
#39227 Include node_repl screenshots in Guardian v2 reviews @copyberry
#39235 Decouple Noise relay streams from JSON-RPC processing @copyberry
#39240 Deduplicate remote plugin bundle syncs with shared semaphores @copyberry
#39241 Record Guardian v2 classification metrics @copyberry
#39242 Add safe permission profile intersection @copyberry
#39244 Scope MCP resource reads by connector @copyberry
#39246 Give Guardian classifier connections distinct thread identities @copyberry
#39249 Add exec-server forwarding mode @copyberry
#39256 Deduplicate rollout moves when archiving threads @copyberry
#39257 Reconnect WebRTC Realtime sideband transports @copyberry
#39259 Simplify unified exec output snapshots @copyberry
#39261 Stop TUI chats on misalignment policy violations @copyberry
#39262 Prevent ConPTY DLL loading from the current directory @copyberry
#39264 Improve Guardian v2 risk classification @copyberry
#39266 Require fresh approval beneath denied permission paths @copyberry
#39267 Inject Node REPL policy into Guardian review sessions @copyberry
#39273 Preserve thread names during rollout migration @copyberry
#39274 Add provider-owned authentication recovery @copyberry
#39277 Declare experimental Amazon Bedrock setup APIs @copyberry
#39278 Preserve owner-provided environment configuration @copyberry
#39279 Propagate Windows sandbox ACL update failures @copyberry
#39281 Move shell snapshot scripts into codex-shell-command @copyberry
#39283 Document secure devcontainer DNS exfiltration risk @copyberry
#39284 Report network disconnects during approval @copyberry
#39285 Show file destinations in TUI change approvals @copyberry
#39287 Report diagnostic upload failures @copyberry
#39288 Register the async message feature flag @copyberry
#39290 Add Windows sandbox diagnostics to codex doctor @copyberry
#39293 Remove app-server's direct reqwest dependency @copyberry
#39294 Increase SQLite log sink batching @copyberry
#39296 Enable MCP tool hooks in Codex sessions @copyberry
#39298 Allow overriding Codex package versions @copyberry
#39299 Restrict agent roles to bounded configuration overrides @copyberry
#39301 Prevent Node REPL auth tokens from reaching child processes @copyberry
#39303 Record Guardian v2 classification token usage @copyberry
#39304 Keep Guardian v2 risk scores in memory @copyberry
#39306 Honor managed config during project discovery @copyberry
#39307 Fail closed on Guardian V2 risk scoring errors @copyberry
#39309 Attribute executor skill invocations to plugins @copyberry
#39311 Bind unified exec approvals to shell executables @copyberry
#39312 Add async delivery metadata to agent messages @copyberry
#39314 Run hooks with the captured session environment @copyberry
#39315 Evict guardian transcript entries in cacheable chunks @copyberry
#39316 Support Edu Plus and Edu Pro account plans @copyberry
#39319 Add the async user message tool @copyberry
#39320 Expand OAuth metadata redirect test coverage @copyberry
#39322 Enforce workspace restrictions for header authentication @copyberry
#39325 Stop migrating Cursor sandbox settings @copyberry
#39331 Route hook MCP calls through current connections @copyberry
#39335 Enforce environment MCP policies @copyberry
#39372 Scope TUI approval requests to their threads @copyberry
#39385 Prefer the most recent session when queueing by name @copyberry
#39402 Remove npm package staging from repo checks @copyberry
#39404 Support FD mounts with older system Bubblewrap versions @copyberry
#39410 Refresh expired AWS credentials for Bedrock @copyberry
#39452 Remove the feature gate for async user messages @copyberry
#39474 Consolidate Guardian extensions into codex-guardian-v2 @copyberry
#39480 Move shell snapshot tests into shell-command @copyberry
#39493 Make head-tail buffer capacity const generic @copyberry
#39494 Test panoramic Guardian transcript image resizing @copyberry
#39496 Use default timeouts in cyber exec policy tests @copyberry
#39497 Correct normalized dynamic tool coverage across response modes @copyberry
#39501 Use a narrow fixture for the unified image resize test @copyberry
#39505 Test text stringify errors in the code mode runtime @copyberry
#39506 Test code mode notifications without a sync tool call @copyberry
#39509 Test disabled enhanced Node REPL transcript images separately @copyberry
#39510 Track built-in control tool calls in analytics @copyberry
#39514 Use stored item types when materializing turn summaries @copyberry
#39515 Use mem::take to drain unified exec output buffers @copyberry
#39520 Isolate automatic plugin Git operations @copyberry
#39523 Persist thread section moves before the first turn @copyberry
#39524 Stop treating Git commands as inherently safe @copyberry
#39584 Add a just recipe for assembling Codex packages @copyberry
#39585 Test plugin sync isolation from repository Git config @copyberry
#39586 Isolate IPC in Bubblewrap sandboxes @copyberry
#39588 Preserve unparsed shell wrappers in exec policy @copyberry
#39590 Harden plugin manifest handling during installation @copyberry
#39592 Prevent SQLx warnings from feeding back into SQLite logs @copyberry
#39594 Raise the MCP tool name limit to 128 bytes @copyberry
#39595 Keep marketplace upgrade state out of config @copyberry
#39597 Separate thread settings from environment configuration @copyberry
#39599 Protect macOS Seatbelt writable root anchors @copyberry
#39601 Keep async user messages on the direct tool surface @copyberry
#39602 Use in-process parsing for PowerShell command classification @copyberry
#39604 Preserve queued TUI input semantics @copyberry
#39605 Hide approved automatic review warnings in the TUI @copyberry
#39606 Enable user namespaces in shared CI setup @copyberry
#39607 Resolve model-provided shells by type @copyberry
#39608 Harden skill installation against unsafe symlinks @copyberry
#39609 Limit Bazel integration test threads on macOS @copyberry
#39611 Harden MCP OAuth fallback credential writes @copyberry
#39614 Prevent apply_patch from widening write permissions @copyberry
#39615 Bind MCP OAuth refresh tokens to their issuer @copyberry
#39616 Validate linked worktrees before inheriting project trust @copyberry
#39618 Apply composer editing preferences to TUI text prompts @copyberry
#39619 Preserve inline TUI scrollback in Windows Terminal @copyberry
#39620 Stream executor capability and skill file reads @copyberry
#39623 Prevent protected-path rename bypasses in macOS Seatbelt @copyberry
#39625 Add cwd-relative turn diff paths @copyberry
#39629 Preserve parent repository discovery through sandbox metadata mounts @copyberry
#39630 Retire the untrusted approval policy @copyberry
#39631 Skip sandboxed shell commands in Guardian v2 by default @copyberry
#39632 Expose permission profile resolution in the core API @copyberry
#39635 Show strict review warnings in the TUI @copyberry
#39637 Treat invalid_grant refresh failures as permanent @copyberry
#39640 Prompt to unarchive sessions before resuming or forking @copyberry
#39641 Sanitize developer context in full-history agent forks @copyberry
#39645 Enforce managed residency for model providers @copyberry
#39646 Exercise restricted-token sandboxing in cyber policy tests @copyberry
#39649 Resolve bundled Windows helpers through bin junctions @copyberry
#39653 Enforce filesystem permissions when loading AGENTS.md @copyberry
#39655 Make core integration test permissions explicit @copyberry
#39656 Advertise the Desktop app in graphical Linux sessions @copyberry
#39657 Warn when launching the deprecated MCP server @copyberry
#39658 Let Guardian V2 satisfy required model reviews @copyberry
#39659 Harden unsandboxed patch filesystem access @copyberry
#39661 Expand Vim change commands and add character replacement @copyberry
#39662 Add max and ultra reasoning efforts to the SDKs @copyberry
#39663 Restrict plugin migration to home scope @copyberry
#39665 Add macOS Seatbelt filesystem integration tests @copyberry
#39666 Improve no-follow filesystem behavior across platforms @copyberry

codex rust-v0.149.0

0.149.0

New Features

Bug Fixes

Documentation

Changelog

Upgraded? How did it go?

Discussion