OpenAI Codex CLI rust-v0.149.0

OpenAI Codex CLI rust-v0.149.0 was released on August 20, 2026.

Summary

The OpenAI Codex CLI rust-v0.149.0 now includes an interactive dashboard for managing tasks and new directory commands to enhance your workflow, while improved message queuing and session handling make multi-session work more reliable. We've also expanded Vim editing capabilit...

Release Notes

New Features - Added an interactive codex agents dashboard for searching, starting, opening, renaming, and stopping tasks, with configurable shortcuts. (39094, 39112, 39114, 39142) - Added /cd, /pwd, and /cwd commands for managing the working directory in TUI sessions. (38894) - Added codex queue for sending messages to existing local or remote sessions. (39092) - Expanded Vim editing with character replacement and more change motions such as cw, c$, and cc. (39661) - codex doctor now diagnoses endpoint protection, network/proxy failures, desktop app state, and update connectivity. (38827, 38918, 39060, 39074) - SDK users can now pass exact CLI config overrides and select max or ultra reasoning effort. (38817, 39662) Bug Fixes - Queued messages now wake idle sessions reliably, resolve duplicate session names more usefully, and preserve pasted or deferred command semantics. (39034, 39385, 39604) - Resumed and forked threads now restore their active permission profile instead of silently falling back to current defaults. (39153) - Fixed duplicate sub-agent activity and tightened TUI routing for sub-agent notifications and approvals. (39049, 39088) - Realtime WebRTC sideband connections now reconnect after unexpected transport loss without dropping pending output. (39257) - Inline TUI history now remains available in Windows Terminal scrollback. (39619) - Inactive TUI thread replay buffers are now bounded to prevent excessive retained streamed output. (39081) Documentation - Clarified that external contributions should go through issues and design discussion rather than pull requests. (39089) - Documented DNS exfiltration risks and trust limitations for secure devcontainers. (39283) Changelog Full Changelog: https://github.com/openai/codex/compare/rust-v0.148.0...rust-v0.149.0 - 38817 Add raw config overrides to the TypeScript SDK @copyberry - 38819 Support metadata staging for reserved thread IDs @copyberry - 38822 Avoid cloning TUI history span content @copyberry - 38823 Avoid allocating per character when decorating hyperlinks @copyberry - 38827 Add endpoint protection checks to codex doctor @copyberry - 38830 Isolate external editor buffers from sandbox-writable paths @copyberry - 38837 Share editor keymaps across TUI composer components @copyberry - 38840 Identify Mac mini hosts in remote control handshakes @copyberry - 38893 Restore thread timestamp maxima independently @copyberry - 38894 Add working-directory commands to the TUI @copyberry - 38899 Move requirements policy ownership to execpolicy @copyberry - 38902 Honor per-environment shell variable policies @copyberry - 38907 Edit queued messages with Vim history-up @copyberry - 38913 Stop rendering columns after filling their area @copyberry - 38916 Honor legacy :projectroots permission entries @copyberry - 38918 Improve codex doctor network diagnostics @copyberry - 38919 Reject obsolete app-server permission profile fields @copyberry - 38921 Compact successful command activity in the TUI @copyberry - 38940 Add experimental app-server project APIs @copyberry - 38941 Prevent Noise auth tokens from reaching child processes @copyberry - 38942 Enforce environment-specific command policies @copyberry - 38947 Stop loading legacy managed config on Windows @copyberry - 38978 Add a configurable skill catalog token budget @copyberry - 38980 Bound Guardian v2 parent compaction context @copyberry - 38987 Include images in Guardian v2 transcripts @copyberry - 38990 Source Guardian v2 defaults from the model catalog @copyberry - 38993 Evaluate recent and character-routed skill selection @copyberry - 38994 Remove the workspace settings gate for apps and plugins @copyberry - 38997 Retry transient Guardian sampling failures @copyberry - 39001 Ignore stale Guardian tool risk scores @copyberry - 39005 Disable Guardian V2 for managed automatic reviewers @copyberry - 39006 Emit API-key turn cost telemetry from app-server @copyberry - 39007 Wait for Guardian score progress in approval tests @copyberry - 39008 Add task context to shadow skill selection @copyberry - 39017 Move MCP policy types into codex-protocol @copyberry - 39019 Isolate MCP resource headers during OAuth requests @copyberry - 39020 Restrict Windows IDE pipe client impersonation @copyberry - 39022 Hang soft-break whitespace in the TUI composer @copyberry - 39023 Reduce retained MCP result data in TUI history @copyberry - 39025 Speed up the large diff highlighting test @copyberry - 39026 Use simulated time in the long typing test @copyberry - 39028 Cache the test pet spritesheet encoding @copyberry - 39030 Speed up the in-app resume cwd test @copyberry - 39032 Encapsulate TUI shimmer under the motion module @copyberry - 39033 Bound legacy resume preview scans @copyberry - 39034 Dispatch queued messages written by other processes @copyberry - 39035 Add app-server coverage for Guardian V2 approval routing @copyberry - 39036 Allow config reads to join active app-server read batches @copyberry - 39038 Restore Guardian risk scores across thread lifecycles @copyberry - 39040 Preserve foreign paths in managed network approvals @copyberry - 39043 Enforce managed authentication backend settings @copyberry - 39045 Add managed gates for in-app chat and dictation @copyberry - 39046 Restrict MCP HTTP redirects to the configured origin @copyberry - 39047 Skip plugin hook loading when hooks are disabled @copyberry - 39049 Avoid rendering sub-agent activity twice in the TUI @copyberry - 39050 Prepare the telemetry shutdown worker during initialization @copyberry - 39051 Use installed callable apps for TUI mentions @copyberry - 39055 Add network policy metadata to environment configuration @copyberry - 39056 Verify the pinned zsh manifest in release builds @copyberry - 39057 Rate-limit TUI frames from their actual emission time @copyberry - 39058 Tag Codex Apps protocol discovery metrics @copyberry - 39060 Add desktop app diagnostics to codex doctor @copyberry - 39061 Avoid rerendering streamed code fences @copyberry - 39063 Render only visible rows in the transcript pager @copyberry - 39064 Restrict queued-message editing to its dedicated binding @copyberry - 39065 Limit terminal hyperlink layout to the visible viewport @copyberry - 39067 Add desktop security enforcement diagnostics @copyberry - 39068 Remove skill model delegation support @copyberry - 39072 Persist generated images through turn executors @copyberry - 39073 Propagate caller metadata to rendezvous connections @copyberry - 39074 Add desktop update diagnostics to codex doctor @copyberry - 39075 Avoid redundant terminal row clears @copyberry - 39077 Build filesystem JSON params only for remote TUI sessions @copyberry - 39078 Preserve tracing context for environment resolution @copyberry - 39079 Apply user MCP policy to selected executor plugins @copyberry - 39081 Bound TUI thread replay buffers by delta size @copyberry - 39082 Prompt for project trust in remote TUI workspaces @copyberry - 39083 Harden Windows sandbox provisioning against reparse points @copyberry - 39084 Preserve filesystem permission path conventions @copyberry - 39087 Read plugin authentication state from AuthManager @copyberry - 39088 Harden TUI subagent navigation @copyberry - 39089 Clarify the external contribution policy @copyberry - 39092 Add a command to queue messages for existing sessions @copyberry - 39094 Add an agents overview dashboard to the TUI @copyberry - 39098 Trace exec-server requests from receipt through completion @copyberry - 39100 Avoid redundant terminal size queries during history insertion @copyberry - 39101 Update rmcp to 3.1.2 @copyberry - 39102 Raise the GPT-5.6 maximum context window @copyberry - 39103 Drop capabilities from Linux sandbox processes @copyberry - 39112 Make the agents overview an interactive task dashboard @copyberry - 39113 Surface interactive requests in realtime conversations @copyberry - 39114 Add a dedicated codex agents dashboard command @copyberry - 39115 Remove the experimental thread config endpoint @copyberry - 39117 Reject lossy legacy permission projections @copyberry - 39122 Fail closed on deeply nested command wrappers @copyberry - 39131 Validate identifiers in plugin creator workflows @copyberry - 39141 Redact auth tokens from app-server response logs @copyberry - 39142 Add configurable shortcuts for the agents dashboard @copyberry - 39143 Hydrate recommended plugin metadata on selection @copyberry - 39145 Persist active permission profiles in turn context @copyberry - 39147 Centralize persisted resume settings lookup @copyberry - 39152 Update PyPI publish action to v1.14.2 @copyberry - 39153 Restore permission profiles when resuming threads @copyberry - 39154 Box the TUI future to bound CLI stack usage @copyberry - 39155 Prepare Python SDK 0.147.0 stable release @copyberry - 39157 Notify clients when Guardian requires strict review @copyberry - 39159 Require approval for commands with dynamic shell words @copyberry - 39163 Refresh collaboration instructions when their content changes @copyberry - 39165 Prevent marketplace identity spoofing @copyberry - 39174 Skip empty user messages for automatic idle turns @copyberry - 39176 Drop descendant progress updates after remote compaction @copyberry - 39187 Scope MCP app resource reads to their originating call @copyberry - 39192 Preserve MCP resource origins across compaction @copyberry - 39200 Add a symlink-safe reader for sensitive files @copyberry - 39205 Reject symbolic links in memory workspaces @copyberry - 39213 Add a fail-closed Tree-sitter PowerShell lowerer @copyberry - 39214 Prevent custom providers from inheriting ambient auth @copyberry - 39220 Reconnect Guardian sampling WebSockets after auth changes @copyberry - 39221 Skip redirected external-agent migration destinations @copyberry - 39224 Add Guardian v2 approval review metrics @copyberry - 39227 Include noderepl screenshots in Guardian v2 reviews @copyberry - 39235 Decouple Noise relay streams from JSON-RPC processing @copyberry - 39240 Deduplicate remote plugin bundle syncs with shared semaphores @copyberry - 39241 Record Guardian v2 classification metrics @copyberry - 39242 Add safe permission profile intersection @copyberry - 39244 Scope MCP resource reads by connector @copyberry - 39246 Give Guardian classifier connections distinct thread identities @copyberry - 39249 Add exec-server forwarding mode @copyberry - 39256 Deduplicate rollout moves when archiving threads @copyberry - 39257 Reconnect WebRTC Realtime sideband transports @copyberry - 39259 Simplify unified exec output snapshots @copyberry - 39261 Stop TUI chats on misalignment policy violations @copyberry - 39262 Prevent ConPTY DLL loading from the current directory @copyberry - 39264 Improve Guardian v2 risk classification @copyberry - 39266 Require fresh approval beneath denied permission paths @copyberry - 39267 Inject Node REPL policy into Guardian review sessions @copyberry - 39273 Preserve thread names during rollout migration @copyberry - 39274 Add provider-owned authentication recovery @copyberry - 39277 Declare experimental Amazon Bedrock setup APIs @copyberry - 39278 Preserve owner-provided environment configuration @copyberry - 39279 Propagate Windows sandbox ACL update failures @copyberry - 39281 Move shell snapshot scripts into codex-shell-command @copyberry - 39283 Document secure devcontainer DNS exfiltration risk @copyberry - 39284 Report network disconnects during approval @copyberry - 39285 Show file destinations in TUI change approvals @copyberry - 39287 Report diagnostic upload failures @copyberry - 39288 Register the async message feature flag @copyberry - 39290 Add Windows sandbox diagnostics to codex doctor @copyberry - 39293 Remove app-server's direct reqwest dependency @copyberry - 39294 Increase SQLite log sink batching @copyberry - 39296 Enable MCP tool hooks in Codex sessions @copyberry - 39298 Allow overriding Codex package versions @copyberry - 39299 Restrict agent roles to bounded configuration overrides @copyberry - 39301 Prevent Node REPL auth tokens from reaching child processes @copyberry - 39303 Record Guardian v2 classification token usage @copyberry - 39304 Keep Guardian v2 risk scores in memory @copyberry - 39306 Honor managed config during project discovery @copyberry - 39307 Fail closed on Guardian V2 risk scoring errors @copyberry - 39309 Attribute executor skill invocations to plugins @copyberry - 39311 Bind unified exec approvals to shell executables @copyberry - 39312 Add async delivery metadata to agent messages @copyberry - 39314 Run hooks with the captured session environment @copyberry - 39315 Evict guardian transcript entries in cacheable chunks @copyberry - 39316 Support Edu Plus and Edu Pro account plans @copyberry - 39319 Add the async user message tool @copyberry - 39320 Expand OAuth metadata redirect test coverage @copyberry - 39322 Enforce workspace restrictions for header authentication @copyberry - 39325 Stop migrating Cursor sandbox settings @copyberry - 39331 Route hook MCP calls through current connections @copyberry - 39335 Enforce environment MCP policies @copyberry - 39372 Scope TUI approval requests to their threads @copyberry - 39385 Prefer the most recent session when queueing by name @copyberry - 39402 Remove npm package staging from repo checks @copyberry - 39404 Support FD mounts with older system Bubblewrap versions @copyberry - 39410 Refresh expired AWS credentials for Bedrock @copyberry - 39452 Remove the feature gate for async user messages @copyberry - 39474 Consolidate Guardian extensions into codex-guardian-v2 @copyberry - 39480 Move shell snapshot tests into shell-command @copyberry - 39493 Make head-tail buffer capacity const generic @copyberry - 39494 Test panoramic Guardian transcript image resizing @copyberry - 39496 Use default timeouts in cyber exec policy tests @copyberry - 39497 Correct normalized dynamic tool coverage across response modes @copyberry - 39501 Use a narrow fixture for the unified image resize test @copyberry - 39505 Test text stringify errors in the code mode runtime @copyberry - 39506 Test code mode notifications without a sync tool call @copyberry - 39509 Test disabled enhanced Node REPL transcript images separately @copyberry - 39510 Track built-in control tool calls in analytics @copyberry - 39514 Use stored item types when materializing turn summaries @copyberry - 39515 Use mem::take to drain unified exec output buffers @copyberry - 39520 Isolate automatic plugin Git operations @copyberry - 39523 Persist thread section moves before the first turn @copyberry - 39524 Stop treating Git commands as inherently safe @copyberry - 39584 Add a just recipe for assembling Codex packages @copyberry - 39585 Test plugin sync isolation from repository Git config @copyberry - 39586 Isolate IPC in Bubblewrap sandboxes @copyberry - 39588 Preserve unparsed shell wrappers in exec policy @copyberry - 39590 Harden plugin manifest handling during installation @copyberry - 39592 Prevent SQLx warnings from feeding back into SQLite logs @copyberry - 39594 Raise the MCP tool name limit to 128 bytes @copyberry - 39595 Keep marketplace upgrade state out of config @copyberry - 39597 Separate thread settings from environment configuration @copyberry - 39599 Protect macOS Seatbelt writable root anchors @copyberry - 39601 Keep async user messages on the direct tool surface @copyberry - 39602 Use in-process parsing for PowerShell command classification @copyberry - 39604 Preserve queued TUI input semantics @copyberry - 39605 Hide approved automatic review warnings in the TUI @copyberry - 39606 Enable user namespaces in shared CI setup @copyberry - 39607 Resolve model-provided shells by type @copyberry - 39608 Harden skill installation against unsafe symlinks @copyberry - 39609 Limit Bazel integration test threads on macOS @copyberry - 39611 Harden MCP OAuth fallback credential writes @copyberry - 39614 Prevent applypatch from widening write permissions @copyberry - 39615 Bind MCP OAuth refresh tokens to their issuer @copyberry - 39616 Validate linked worktrees before inheriting project trust @copyberry - 39618 Apply composer editing preferences to TUI text prompts @copyberry - 39619 Preserve inline TUI scrollback in Windows Terminal @copyberry - 39620 Stream executor capability and skill file reads @copyberry - 39623 Prevent protected-path rename bypasses in macOS Seatbelt @copyberry - 39625 Add cwd-relative turn diff paths @copyberry - 39629 Preserve parent repository discovery through sandbox metadata mounts @copyberry - 39630 Retire the untrusted approval policy @copyberry - 39631 Skip sandboxed shell commands in Guardian v2 by default @copyberry - 39632 Expose permission profile resolution in the core API @copyberry - 39635 Show strict review warnings in the TUI @copyberry - 39637 Treat invalidgrant refresh failures as permanent @copyberry - 39640 Prompt to unarchive sessions before resuming or forking @copyberry - 39641 Sanitize developer context in full-history agent forks @copyberry - 39645 Enforce managed residency for model providers @copyberry - 39646 Exercise restricted-token sandboxing in cyber policy tests @copyberry - 39649 Resolve bundled Windows helpers through bin junctions @copyberry - 39653 Enforce filesystem permissions when loading AGENTS.md @copyberry - 39655 Make core integration test permissions explicit @copyberry - 39656 Advertise the Desktop app in graphical Linux sessions @copyberry - 39657 Warn when launching the deprecated MCP server @copyberry - 39658 Let Guardian V2 satisfy required model reviews @copyberry - 39659 Harden unsandboxed patch filesystem access @copyberry - 39661 Expand Vim change commands and add character replacement @copyberry - 39662 Add max and ultra reasoning efforts to the SDKs @copyberry - 39663 Restrict plugin migration to home scope @copyberry - 39665 Add macOS Seatbelt filesystem integration tests @copyberry - 39666 Improve no-follow filesystem behavior across platforms @copyberry

View original release

Other Recent OpenAI Codex CLI Releases

• rust-v0.147.0 (August 7, 2026)
• rust-v0.146.1 (August 5, 2026)
• rust-v0.146.0 (July 29, 2026)
• rust-v0.145.0 (July 21, 2026)
• rust-v0.144.6 (July 18, 2026)

All OpenAI Codex CLI releases · All AI coding tool releases on Havoptic