New Features
- Reference other Codex tasks with
@mentions, and ask agents to read, create, or message tasks from the terminal. () /copynow offers a picker for full responses, individual code blocks, and blockquotes. (, )- Bind shortcuts to cycle permission modes, and use
.in Vim mode to repeat your last edit. () - New
Interrupthooks can run commands or MCP handlers when an active top-level turn is interrupted. (, ) - Fixed remote MCP bearer-token lookup and required-server startup while preserving compatibility with older executors. (, , )
- Fixed conversation compaction and multi-agent compatibility for Amazon Bedrock models. ()
Changelog
Full Changelog: Trace MCP runtime refresh coordination Make Guardian v2 parent compaction reuse configurable Fail closed on unsafe config and sed parsing Wait for turn completion events in multi-agent resume tests Move the global scope check into the code-mode runtime Harden Seatbelt writable root path binding Remove redundant code mode image helper test Log TUI app event variants without their payloads Reduce unified exec output buffer allocations Pass CI workflow inputs through environment variables Stop persisting checkout credentials in V8 workflows Expose managed policy for browser settings imports Track multi-agent v2 spawn calls in analytics Box the WebSocket dial future Avoid rollout reads for configured TUI sessions Remove private executor directory creation Honor Guardian runtime settings from model defaults Use model-specific auto-review outcome instructions Skip postprocessing for short composer input Refresh resumed thread capability roots from executors Require filesystem backends to implement directory walks Expose uncompiled permission profile selection Add managed developer instructions to requirements Cache shell snapshots in the exec server Standardize shell execution on unified exec Add app-server MCP event streaming Include suggestion IDs in plugin install metadata Refresh bundled model definitions Standardize shell execution on unified exec Verify Codex app signatures before launch or install Retry transient registry failures during initial exec connection Make tool-result telemetry limits configurable Support standalone named function call outputs Classify rollout migration failures Support turn cost telemetry for custom model providers Support host-accepted exec-server WebSockets Deduplicate zsh fork test setup Handle standalone tool outputs as external context Reject settings updates for parent-owned subagents Install build tools in full Rust CI Add hostname to the configurable TUI status line Enrich thread archive analytics with thread context Update rmcp to 3.1.3 Optimize case-insensitive thread history matching Use multi-agent V1 for Amazon Bedrock models Finalize reserved PDF uploads with creation context Preserve WINDIR in core Windows shell environments Restrict macOS preference reads to full-disk policies Avoid materializing writable-root carveouts for presence checks Defer legacy filesystem policy projection Preserve uncapped Guardian classifier instructions Use Responses compaction for Amazon Bedrock Add history and notes tools for token-budget sessions Rename the history notes extension config option Ignore project instructions for untrusted projects Include context window IDs in response metadata Reset registry retries when refreshing Noise bundles Limit pending input preview wrapping work Allow session configuration with codex agents Add keybindings for cycling TUI permission modes Support attaching to existing realtime calls Honor request PATH in exec-server shell snapshots Resolve HTTP MCP bearer tokens in executor environments Track remote MCP header environment variables Enforce issuer binding for MCP OAuth endpoints Bound unified exec output delta frames Allow more time for local code-mode host startup Discover HTTP MCP servers from selected executors Honor required MCP servers from selected executors Support voice-aware configuration and version-skew builds Add in-memory shell snapshots to unified exec Stop advertising shell snapshots from local exec servers Test browser MCP bearer tokens over executor WebSockets Keep Guardian reviews isolated from executor MCP servers Upgrade pnpm to 10.34.5 Consolidate code mode output helper tests Fix elevated Windows sandbox setup activation Preserve root user authorization in subagent Guardian reviews Allow semaphore limit queries in the macOS sandbox Preserve MCP compatibility with older executors Enforce environment network policies for remote execution Bypass risk scoring for models that require automatic review Truncate Guardian instructions after rendering the policy Preserve TUI event ordering during active-thread draining Keep keymap action descriptions stable while navigating Keep credentials out of app-server logs Add Guardian internal session support Expand browser and computer use requirements Add a response target picker to /copy Hide Fast mode status for unsupported models Expose browser and computer-use requirements through app-server Preserve managed deny-read rules across permission updates Route escalated commands through synchronous Guardian review Synchronize Git enrichment tests explicitly Implement Amazon Bedrock setup in the app server Run allowlisted executor plugin stop hooks Synchronize concurrent Git enrichment test explicitly Preserve executor context for MCP stop hooks Reuse Guardian reviews in async risk scoring Harden remote installed plugin cache reconciliation Trace turn context creation and realtime state checks Add browser and computer use configuration Add end-to-end tests for executor Stop hooks Cancel Guardian reviews with their tool calls Honor granular sandbox approvals in unified exec Log Guardian V2 classification results Preserve strict MCP auto-review outcomes Add unfinished root turn suspension Report runtime MCP connection status Use thread source metadata for Guardian classifiers Allow exec callers to classify new threads Move the TUI cursor before showing it Add regression coverage for patch approval paging Preserve content item kinds in message metadata Require content kinds for extension prompt fragments Shut down resumed descendants when archiving thread trees Classify contextual fragments with content kinds Preserve context annotations in merged messages Identify detached memory requests as memory consolidation Annotate user input and contextual fragments with content kinds Remove the Plan mode composer nudge Distinguish Guardian review threads from subagents Support cua_repl as a Node REPL-backed MCP server Preserve content metadata when truncating messages Preserve content annotations when filtering forked agent history Preserve content annotations when rolling back model switches Normalize compacted user message annotations Classify additional generated context fragments Preserve annotations when omitting unsupported media Budget retained images during remote compaction Preserve content kinds during image preparation Add smoke tests for assembled Codex packages Classify internal model context by source Classify permission instructions under the permissions namespace Annotate Responses Lite base instructions Preserve developer instruction annotations in subagent forks Label Business Pro Lite plans as Business Premium Harden bubblewrap synthetic mount registry isolation Add TUI tools for managing Codex tasks Add task mentions to the TUI composer Update the frameless realtime default model Cache executor metadata from initialization Forward local env vars to Agent Plugin MCP servers Use snapshot session sources for MCP projection Advertise shell snapshot v2 support on Unix Preserve sandbox errors during session initialization Expose invocation sources to extension tools Classify Guardian V2 risk with a single token Stabilize the mismatched executor Stop hook test Prewarm more Guardian sampling WebSockets Strengthen Agent Plugin MCP environment overlay tests Honor response budgets when listing skills Represent Guardian policy as a contextual fragment Harden Windows updater command execution Harden Windows file URI conversion Render Guardian review evidence with async scorer truncation Add a managed gate for in-app local automation Report completed sub-agent activity on parent turns Use rust-lld for Bazel Windows MSVC Rust links Preserve Windows root reads with deny-read rules Batch sandboxed capability root discovery Retry failed shell snapshot captures Route peer agent completion activity to the initiating turn Gate content item kinds behind a feature flag Prevent Unix PTY I/O from blocking runtime shutdown Enforce subagent ownership across app-server inputs Record Guardian classifier input truncation metrics Add credential brokering to network proxy feature config Render Markdown links as clickable labels in supported terminals Add structured full approval reviews to extensions Request read control when updating Windows sandbox ACLs Reload Multi-Agent V2 children through their parent Add a computer-use-only Guardian v2 review scope Support managed AWS access keys for Amazon Bedrock Broker credential aliases in child environments Add root turn IDs to turn and tool analytics Extract agent role loading into a dedicated crate Export turn cost as an OTEL metric Honor disabled managed network configuration Harden project config when credential brokering is active Honor response budgets when reading skill resources Generate descriptive TUI thread titles Hide ephemeral system threads from TUI routing Suggest conversation-based thread titles in /rename Track history, notes, and async messages as control tools Harden internal Guardian session isolation Increase the app-server model refresh interval Harden startup rollout migration against concurrent updates Deduplicate plugin skills in unified mentions Collapse home paths in AGENTS.md status summaries Route cyber Trusted Access links by plan type Persist realtime events in the thread timeline Add persisted thread artifact models Add hooks for interrupted turns Add dot-repeat to Vim mode Retry provider auth commands after initial failures Represent terminal input in approval reviews Route extension hints into context-window metadata Inject history notes hints into context windows Include transparent background in image generation analytics Derive sandbox contexts from turn environments Register the transcript v2 feature flag Preserve Unicode paths in Windows batch aliases Track remaining multi-agent v2 tools in analytics Scope stop hooks for memory consolidation Preserve conversation context in Guardian transcripts @copyberry
