Codex Changelog

Full changelog: • Move TUI on top of app server (parallel code) • Use request permission profile in app server • Fixed build failures related to PR 14717 • fix(core): fix sanitize name to use '_' everywhere • memories: exclude AGENTS and skills from stage1 input • windows-sandbox: add runner IPC foundation for future unified_exec • Add exit helper to code mode scripts • [stack 1/4] Split realtime websocket methods by version • Apply argument comment lint across codex-rs • skill-creator: default new skills to ~/.codex/skills • Add marketplace display names to plugin/list • feat: support remote_sync for plugin install/uninstall • [stack 2/4] Align main realtime v2 wire and runtime flow • fix: align marketplace display name with existing interface conventions • [codex] add Jason as a predefined subagent name • fix: tighten up shell arg quoting in GitHub workflows • [stack 3/4] Add current thread context to realtime startup • [stack 4/4] Reduce realtime self-interruptions during playback • fix: canonicalize symlinked Linux sandbox cwd • Fix tui_app_server: ignore duplicate legacy stream events • Revert tui code so it does not rely on in-process app server • fix(linux-sandbox): ignore missing writable roots • feat: centralize package manager version • feat: rename to get more explicit close agent • Fix agent jobs finalization race and reduce status polling churn • feat: show effective model in spawn agent event • fix(core): prevent hanging turn/start due to websocket warming issues • Feat: CXA-1831 Persist latest model and reasoning effort in sqlite • fix(tui): restore remote resume and fork history • Fix fuzzy search notification buffering in app-server tests • feat: add suffix to shell snapshot name • Fix code mode yield startup race • generate an internal json schema for RolloutLine • use framed IPC for elevated command runner • Add device-code onboarding and ChatGPT token refresh to app-server TUI • [plugins] Support plugin installation elicitation • Stabilize Windows cmd-based shell test harnesses • Stabilize permissions popup selection tests • Stabilize approval matrix write-file command • temporarily disable private desktop until it works with elevated IPC path • Rename exec_wait tool to wait • Add auth env observability • fix(tui): implement /mcp inventory for tui_app_server • Cleanup skills/remote/xxx endpoints • Gate realtime audio interruption logic to v2 • Unify realtime shutdown in core • fix(linux-sandbox): prefer system /usr/bin/bwrap when available • Add Python SDK public API and examples • feat: Add product-aware plugin policies and clean up manifest naming • app-server: reject websocket requests with Origin headers • Add FS abstraction and use in view_image • fix: honor active permission profiles in sandbox debug • feat: support restricted ReadOnlyAccess in elevated Windows sandbox • Prefer websockets when providers support them • Handle realtime conversation end in the TUI • Use workspace requirements for guardian prompt override • [hooks] userpromptsubmit - hook before user's prompt is executed • Pin setup-zig GitHub Action to immutable SHA • fix(subagents) share execpolicy by default • [plugins] Support configuration tool suggest allowlist • feat: adapt artifacts to new packaging and 2.5.6 • feat: add memory citation to agent message • nit: disable live memory edition • Removed remaining core events from tui_app_server • chore: disable memory read path for morpheus • Add notify to code-mode • fix: harden plugin feature gating Full release notes: github.com/openai/codex/r…

Fixes: • Fixed a first-turn stall where websocket prewarm could delay turn/start; startup now times out and falls back cleanly • Restored conversation history for remote resume/fork in the app-server TUI and stopped duplicate live transcript output from legacy stream events • Improved Linux sandbox startup on symlinked checkouts, missing writable roots, and Ubuntu/AppArmor hosts by preferring system bwrap when available • Fixed an agent job finalization race and reduced status polling churn for worker threads Docs: • Refreshed the Python SDK public API docs, examples, and walkthrough around the generated app-server models

Codex CLI v0.116.0 has been released. 4 new features, 4 bug fixes, 1 documentation update Highlights: • App-server TUI supports ChatGPT device-code sign-in and token refresh • Plugin setup prompts for missing installations and syncs state remotely • Added userpromptsubmit hook for blocking or augmenting prompts before execution Complete details in thread ↓

Full changelog: • fix(network-proxy): serve HTTP proxy listener as HTTP/1 • Add js_repl cwd and homeDir helpers • Keep agent-switch word-motion keys out of draft editing • Let models opt into original image detail • check for large binaries in CI • chore(app-server): stop emitting codex/event/ notifications • feat: search_tool migrate to bring you own tool of Responses API • refactor: centralize filesystem permissions precedence • chore(app-server): delete unused rpc methods from v1.rs • fix: align core approvals with split sandbox policies • Make collab model metadata accurate on completion • feat(app-server): propagate traces across tasks and core ops • chore: use AVAILABLE and ON_INSTALL as default plugin install and auth policies • [apps] Add tool_suggest tool. • Clarify spawn agent authorization • Support waiting for code_mode sessions • feat: refactor on openai-curated plugins. • refactor: make bubblewrap the default Linux sandbox • fix: follow up on linux sandbox review nits • Handle pre-approved permissions in zsh fork • [elicitation] User-friendly tool call messages. • Use granted permissions when invoking apply_patch • Updated out-of-date tip about availability on free and go plans • fix: move inline codex-rs/core unit tests into sibling files • Dispatch tools when code mode is not awaited directly • Add Python app-server SDK • fix(cli): support legacy use_linux_sandbox_bwrap flag • Fix stdio-to-uds peer-close flake • Move code mode tool files under tools/code_mode and split functionality • rename spawn_csv feature flag to enable_fanout • fix: preserve split filesystem semantics in linux sandbox • Cleanup code_mode tool descriptions • Handle malformed agent role definitions nonfatally • Do not allow unified_exec for sandboxed scenarios on Windows • use scopes_supported for OAuth when present on MCP servers • Add default code-mode yield timeout • Add parallel tool call test • chore(app-server): stop exporting EventMsg schemas • fix turn_start_jsonrpc_span_parents_core_turn_spans flakiness • Reuse tool runtime for code mode worker • Fix js_repl hangs on U+2028/U+2029 dynamic tool responses • Skip nested tool call parallel test on Windows • Fix MCP tool calling • memories: focus write prompts on user preferences • Rename exec session IDs to cell IDs • Update tool search prompts • Decouple request permissions feature and tool • Persist js_repl codex helpers across cells • Expose code-mode tools through globals • feat(search_tool): gate search_tool on model supports_search_tool field • Reapply "Pass more params to compaction" • Fix `codex exec --profile` handling • Rename reject approval policy to granular • feat: add plugin/read. • login: add custom CA support for login flows • Split multi-agent handlers per tool • [js_repl] Hard-stop active js_repl execs on explicit user interrupts • client: extend custom CA handling across HTTPS and websocket clients • Add typed multi-agent tool outputs • fix: reopen writable linux carveouts under denied parents • Add plugin usage telemetry • code_mode: Move exec params from runtime declarations to @pragma • Refactor cloud requirements error and surface in JSON-RPC error • Add realtime v2 event parser behind feature flag • Simplify permissions available in request permissions tool • feat: support skill-scoped managed network domain overrides in skill config • Add codex tool support for realtime v2 handoff • Add realtime transcription mode for websocket sessions • Add diagnostics for read_only_unless_trusted timeout flake • Split multi-agent handler into dedicated files • code mode: single line tool declarations • Use a private desktop for Windows sandbox instead of Winsta0\Default • sending back imagaegencall response back to responseapi • Improve granular approval policy prompt • chore: clarify plugin + app copy in model instructions • [bazel] Bump up cc and rust toolchains • Start TUI on embedded app server • Unify realtime v1/v2 session config • app-server: Add platform os and fa...

Fixes: • Spawned subagents now inherit sandbox and network rules more reliably, including project-profile layering, persisted host approvals, and symlinked writable roots • `js_repl` no longer hangs when dynamic tool responses contain literal U+2028 or U+2029 characters • TUI no longer stalls on exit after creating subagents, and interrupting a turn no longer tears down background terminals by default • `codex exec --profile` once again preserves profile-scoped settings when starting or resuming a thread • MCP and elicitation flows are more robust, with safer tool-name normalization and preserved `tool_params` in approval prompts • Local network proxy now serves CONNECT traffic as explicit HTTP/1, improving compatibility with HTTP proxy clients Chores: • Subagent wait tool is now consistently named `wait_agent`, aligning with `spawn_agent` and `send_input`

Codex CLI v0.115.0 has been released. 6 new features, 6 bug fixes, 1 chore Highlights: • Full-resolution image inspection support • Enhanced realtime websocket with transcription mode • Smart Approvals guardian subagent routing Complete details in thread ↓

Full changelog: • feat(core) Persist request_permission data across turns • fix(core): use dedicated types for responsesapi web search tool config • codex-rs/app-server: add health endpoints for --listen websocket server • fix(core) RequestPermissions + ApplyPatch • feat(approvals) RejectConfig for request_permissions • fix(protocol): preserve legacy workspace-write semantics • fix: keep permissions profiles forward compatible • make dollar-mention always clarify item category (skill, app, plugin) • Refactor tool output into trait implementations • sort plugins first in menu • Add code_mode experimental feature • start of hooks engine • tui: only show fast status for gpt-5.4 • Enforce single tool output type in codex handlers • fix(core) default RejectConfig.request_permissions • Export tools module into code mode runner • feat: support disabling bundled system skills • Move exec command truncation into ExecCommandToolOutput • [apps] Fix apps enablement condition • Delay pending cleanup until task aborts • Implemented thread-level atomic elicitation counter for stopwatch pausing • Use realtime transcript for handoff context • Stabilize incomplete SSE retry test • Fix unified exec test output assertion • Stabilize websocket test server binding • Stabilize app-server notify initialize test • python-sdk: generated type foundation (all v2 schemas) • Fix release-mode integration test compiler failure • Fix Linux tmux segfault in user shell lookup • Log ChatGPT user ID for feedback tags • Expose strongly-typed result for exec_command • Stabilize split PTY output on Windows • Reuse McpToolOutput in McpHandler • Mark incomplete resumed turns interrupted when idle Full release notes: github.com/openai/codex/r…

Fixes: • Fixed Linux tmux crash caused by concurrent user-shell lookups • Fixed apps being enabled in unsupported sessions by tightening the enablement check • Fixed reopened threads getting stuck as in-progress after quitting mid-run and then resuming later • Fixed permission handling so legacy workspace-write behavior is preserved and newer permission profiles degrade more safely on older builds • Fixed approval flows so granted permissions persist across turns, work with reject-style configs, and are honored by apply_patch

Codex CLI v0.114.0 has been released. 6 new features, 5 bug fixes, 1 chore Highlights: • Experimental code mode for isolated coding workflows • Hooks engine with SessionStart and Stop events • Health endpoints for WebSocket deployments Complete details in thread ↓

@ClaudeCodeLog Hello cousin 👋 @CodexChanges meets @ClaudeCodeLog

Claude Code 2.1.72 has been released. 2 flag changes, 54 CLI changes, 5 system prompt changes Highlights: • Added w key in /copy to write focused selection directly to a file, bypassing clipboard • Exit EnterWorktree sessions mid-session via ExitWorktree, keeping or removing the worktree • Environment variable added to stop scheduled cron jobs immediately mid-session All details in thread ↓

• feat(otel): safe tracing • Refine realtime startup context formatting • Replay thread rollback from rollout history • fix(tui): clean up pending steer preview wrapping • Add timestamped SQLite /feedback logs without schema changes • tui: sort resume picker by last updated time • support plugin/list • chore: remove unused legacy macOS permission types • fix: accept two macOS automation input shapes for approval payload compatibility • refactor: remove proxy admin endpoint • copy current exe to CODEX_HOME/.sandbox-bin for apply_patch • fix(tui) remove config check for trusted setting • check app auth in plugin/install • change sound • Enabling CWD Saving for Image-Gen • Switch to use MCP style elicitation payload for mcp tool approvals • feat: status line with real data • feat: prune old memories in DB • Add timestamps to feedback log lines • fix: windows normalization • Recover from streamable HTTP 404 sessions • feat: drop sqlite db feature flag • feat: drop discrepency metrics • feat: limit number of rows per log • Clarify sandbox permission override helper semantics • fix(app-server): fix turn_start_shell_zsh_fork_executes_command_v2 flake • feat(otel, core): record turn TTFT and TTFM metrics in codex-core • app-server: Emit thread/name/updated event globally • Move sqlite logs to a dedicated database • chore: improve DB flushing • feat: structured plugin parsing • Reduce SQLite log retention to 10 days • fix: move unit tests in codex-rs/core/src/config/mod.rs into their own file • fix: move unit tests in codex-rs/core/src/codex.rs into their own file • fix bazel build • fix: reject global wildcard network proxy domains • Codex/winget auto update • chore(otel): reorganize codex-otel crate • feat: add auth login diagnostics • utils/pty: add streaming spawn and terminal sizing primitives • Clarify js_repl binding reuse guidance • docs: remove auth login logging plan • config: add initial support for the new permission profile config language in config.toml • Add realtime startup context override • fix: include libcap-dev dependency when creating a devcontainer for building Codex • chore(otel): rename OtelManager to SessionTelemetry • feat: Add curated plugin marketplace + Metadata Cleanup • fix(core): skip exec approval for permissionless skill scripts • Allow full web search tool config • app-server: Add streaming and tty/pty capabilities to command/exec • feat(app-server-protocol): address naming conflicts in json schema exporter • fix: avoid invoking git before project trust is established • fix: support managed network allowlist controls • sandboxing: plumb split sandbox policies through runtime • protocol: derive effective file access from filesystem policies • fix(core): respect reject policy by approval source for skill scripts • app-server: require absolute cwd for windowsSandbox/setupStart • Add Fast mode status-line indicator • safety: honor filesystem policy carveouts in apply_patch • feat: simplify DB further • Add guardian approval MVP • tmp: drop artifact skills • fix(core) rm guardian snapshot test • fix(ci) fix guardian ci • Fix TUI context window display before first TokenCount • seatbelt: honor split filesystem sandbox policies • chore: use @plugin instead of $plugin for plaintext mentions • Support always allow option for mcp tool calls • linux-sandbox: plumb split sandbox policies through helper • sandboxing: preserve denied paths when widening permissions • protocol: keep root carveouts sandboxed • Stabilize abort task follow-up handling • linux-sandbox: honor split filesystem policies in bwrap • Fix inverted Windows PTY TerminateProcess handling • fix(ci): restore guardian coverage and bazel unit tests • Stabilize shell serialization tests • Support hot-reload user config when batch writing config • Add in-process app server and wire up exec to use it • app-server: include experimental skill metadata in exec approval requests • fix(core) patch otel test • tui: clarify pending steer follow-ups • Add r...

Fixes: • Fixed auth error handling for cloud requirements fetch - 401s now trigger normal auth-recovery messaging instead of generic workspace-config failure • Fixed trust bootstrap to avoid running git commands before project trust is established • Fixed Windows execution edge cases including incorrect PTY TerminateProcess success handling and stricter sandbox startup cwd validation • Fixed plugin startup behavior so curated plugins load in TUI sessions as expected • Hardened network proxy policy parsing by rejecting global wildcard domains while preserving scoped wildcard support • Fixed approval payload compatibility for macOS automation permissions by accepting both supported input shapes Docs: • Clarified js_repl guidance for persistent bindings and redeclaration recovery to reduce avoidable REPL errors

Codex CLI v0.113.0 has been released. 6 new features, 6 bug fixes, 1 docs change, 2 chores Highlights: • Runtime permission requests with built-in approval UI • Expanded plugin marketplace with curated discovery and metadata • Streaming command execution with full TTY/PTY support Complete details in thread ↓

@OpenAIDevs That was a lot of deliveries! BTW have you seen the new Codex Cli changelog bot? @codexchanges x.com/CodexChanges

Full changelog: • treat SIGTERM like ctrl-c for graceful shutdown • Fix codespell warning about pre-selects • Persist initialized js_repl bindings after failed cells • show diagnostics earlier in workflow • feat: merge skill permission profiles into the turn sandbox for zsh-fork execs • Harden js_repl emitImage to accept only data: URLs • feat(core): persist trace_id for turns in RolloutItem::TurnContext • fix(linux-sandbox): always unshare bwrap userns • Improve macOS Seatbelt network and unix socket handling • Clarify js_repl image emission and encoding guidance • add @plugin mentions • core/protocol: add structured macOS additional permissions and merge them into sandbox execution • Update models.json Full release notes: github.com/openai/codex/r…

Fixes: • Fixed JS REPL state handling so previously-initialized bindings persist after failed cells, reducing brittle restarts during iterative sessions • Treated SIGTERM like Ctrl-C for graceful app-server websocket shutdown instead of abrupt termination • Hardened js_repl image emission to accept only data: URLs, preventing external URL forwarding through emitImage • Ensured Linux bubblewrap sandbox always unshares user namespace for consistent isolation even with root-owned invocations • Improved macOS sandbox network and unix-socket handling in Seatbelt for better reliability in constrained subprocess environments • Surfaced feedback/diagnostics earlier in workflow so connectivity issues are visible before later steps Docs: • Clarified js_repl image guidance covering emission and encoding semantics, including clearer usage around repeated emitImage calls

Codex CLI v0.112.0 has been released. 3 new features, 6 bug fixes, 1 documentation update Highlights: • Plugin mentions with @plugin syntax for direct context inclusion • Updated model selection surface with latest catalog changes • Merged executable permission profiles into per-turn sandbox policy Complete details in thread ↓