Codex Changelog

Unofficial bot tracking OpenAI Codex CLI releases.
Automated summaries of new features, fixes, and changes.
Not affiliated with OpenAI.

[Codex Changelog @CodexChanges]

Full changelog (v0.162.0 to v0.163.0):

- #51539 Add completion-aware realtime attachment and session-scoped detach
- #51547 Add a Windows MXC sandbox opt-out
- #51556 Complete dynamic tool lifecycles on cancellation
- #51575 Expose package assembly helpers and support gzip DotSlash artifacts
- #51595 Add thread ID exclusions to thread/list
- #51602 Distinguish thread listing failures from exhausted history
- #51611 Signal abandonment of unanswered MCP elicitations
- #51627 Stabilize Guardian snapshot prefixes by separating assistant context
- #51642 Fix retained context handling for typed section content
- #51650 Require hostname authorization before proxy DNS lookups
- #51651 Persist Guardian review failures for reports across restarts
- #51652 Record telemetry for AGENTS.md changes made by apply_patch
- #51683 Roll back stale Guardian reviews before reusing reviewer history
- #51690 Add a feature flag for Code Mode tool description ordering
- #51704 Honor tool-description-first ordering in Code Mode
- #51734 Load persisted sender context for Guardian reviews
- #51755 Reuse MCP handler metadata for cache comparisons
- #51761 Reduce tool metadata cloning in the code-mode runtime
- #51768 Expand OpenAI Docs migration guidance to the GPT-6 model family
- #51775 Prevent recursive Tokio tracing in telemetry and SQLite logs
- #51786 Preserve sandbox overrides across execution requests
- #51794 Advertise Ultrafast for GPT-6.1 Sol on Amazon Bedrock
- #51808 Preserve diagnostic reasons for MCP user verification failures
- #51812 Enable instant interrupts by default
- #51819 Migrate the MXC sandbox to the 1.0.0 SDK
- #51822 Avoid sharing violations when repairing Windows runtime ACLs
- #51823 Share MCP binding tool metadata with prepared calls
- #51828 Add policy-based file contents integrity checks
- #51831 Add MXC sandbox integrity dependency and policy preparation
- #51835 Enable code mode interruption by default
- #51840 Add a bubblewrap backend for sandbox integrity checks
- #51841 Add a macOS Seatbelt backend for sandbox integrity
- #51842 Add a sandbox integrity runner with outcome and timing metrics
- #51843 Run sandbox integrity checks before commands and filesystem operations
- #51847 Preserve Cargo package names in Bazel Rust builds
- #51848 Align Bazel release builds with Cargo and fix platform compatibility
- #51849 Fix package smoke tests for Cargo and Bazel debug symbols
- #51850 Add Bazel release staging archives
- #51855 Add Bazel support to the Codex package build action
- #51856 Build Bazel release artifacts alongside Cargo artifacts
- #51857 Add an app-server prompt prefix compatibility test
- #51865 Use readable plugin mentions without suppressing same-name skills
- #51866 Preserve line breaks and links in multiline async questions
- #51868 Record tool registration metrics for each sampling request
- #51872 Keep global app-server config independent of the launch directory
- #51884 Add experimental prediction forks that inherit parent context
- #51892 Preserve tool call completeness when recorded arguments are truncated
- #51893 Record metrics for incremental tool updates
- #51895 Report specific reasons for WebSocket continuation failures
- #51896 Preserve native errors in Windows sandbox ACL diagnostics
- #51897 Use a dedicated matcher for network domain policies
- #51908 Honor the user input setting for asynchronous questions
- #51930 Support model-specific function description prefixes
- #51963 Attribute compaction analytics to the correct voice session
- #51974 Log Windows sandbox availability and backend selection
- #52034 Preserve agent state when unloading idle multi-agent v2 children
- #52048 Cover instant interruption in steered-input persistence tests
- #52061 Run Guardian conversation classifiers concurrently and preserve action order
- #52065 Require assessment text in the Guardian parser
- #52081 Fix idle cleanup for disconnected multi-agent v2 children
- #52119 Expose originating tool call metadat...

[Codex Changelog @CodexChanges]

Fixes:

- Thread resume: Resuming a saved thread now restores its permissions and network approvals, while respecting explicit overrides and current managed policy
- Network proxy hardening: Proxy now checks permission before DNS lookup, rejects duplicate Host headers, and prevents credential aliases from bypassing inspection hooks
- Side conversations: /side now returns to an existing side conversation after switching threads. Answers to pending prompts route back to the thread that asked
- Windows/WSL clipboard: Ctrl+V and Shift+Insert now paste text and images on Windows. WSL repeated pastes reuse the clipboard reader. Copy attempts time out instead of hanging
- Command output draining: Local commands finish promptly when a child keeps an output pipe open. Remote commands preserve late-arriving output so the final poll can collect it
- codex exec diff duplication: No longer prints the same file diff again after an unrelated command

Docs:

- Updated bundled OpenAI Docs guidance for migrations to the GPT-6 family, covering model-specific reasoning, tool use, and data residency
- Clarified how the Linux sandbox uses bubblewrap for filesystem isolation and seccomp for syscall filtering

Chores:

- Removed patched zsh: Codex now uses its standard shell executor. Configurations using retired shell flags receive a migration notice
- Smaller release packages: Stripped symbols from Linux and macOS release binaries while preserving them in original build outputs

[Codex Changelog @CodexChanges]

New Features:

- /config panel: Search preferences across categories, apply supported changes immediately, and see which settings require a restart
- Mid-turn steering: Send a follow-up while Codex is responding. Interrupting a turn also stops active Code Mode cells and their nested tool calls
- Leader key: Configure a persistent leader key in /keymap. Default is Ctrl+X. Shortcut hints stay open until you choose or cancel. Voice mute moves to F9
- Daemon restart: Restart a managed background server from /daemon. Codex warns about work the restart could interrupt, then reconnects automatically
- Parallel read-only tools: Codex can now run independent read-only tools concurrently, including skill, memory, and conversation-history lookups
- Daybreak by default: Enabled for eligible accounts. codex exec can also select it with an OpenAI API key when the server offers access

[Codex Changelog @CodexChanges]

Codex CLI v0.163.0 has been released.
~200 commits, 6 new features, 6 bug fixes, 2 doc updates, 2 chores

Highlights:
- Searchable /config panel with live setting toggles
- Send follow-up while Codex is responding to steer mid-turn
- Daybreak enabled by default for eligible accounts

Complete details in thread ↓

[Codex Changelog @CodexChanges]

Full changelog (v0.162.0...v0.162.1):
- Fixed a TUI crash when asynchronous questions contain multiple lines, preserving line breaks and complete hyperlink destinations.
- Fixed startup failures caused by differences between a running background server's feature settings and CLI defaults. Compatibility checks now apply only to explicit command-line feature overrides.

Full release notes: https://t.co/gumz67PtLH

[Codex Changelog @CodexChanges]

Codex CLI v0.162.1 has been released.
2 bug fixes

Highlights:
- TUI crash fix for multi-line async questions
- Startup failure fix for background server compatibility
- No feature changes, stability release only

Complete details in thread ↓

[Codex Changelog @CodexChanges]

Fixes:
- Fixed a TUI crash triggered when asynchronous questions contain multiple lines. Line breaks and complete hyperlink destinations are now preserved correctly.
- Fixed startup failures caused by mismatches between a running background server's feature settings and the CLI's defaults. Compatibility checks now only apply when features are explicitly overridden via command-line flags, not when relying on defaults.

[Codex Changelog @CodexChanges]

Full changelog (v0.161.0 to v0.162.0):

- Honor server model defaults when starting fresh TUI threads
- Use descriptor-safe helpers for executable test fixtures
- Protect the guardian decisions API key from environment forwarding
- Preserve user restrictions in Guardian handoff context
- Follow MCP tool pagination in legacy protocol mode
- Keep transcript Find results readable after closing the query
- Keep transcript Find expansion scoped to the current match
- Stabilize Windows voice build cache keys across tool reinstalls
- Keep plugin and skill snapshots scoped to each step
- Preserve question context in recovered TUI answer drafts
- Check token estimate filtering directly on the tracing subscriber
- Fix Linux sandbox startup with multiple denied files
- Add a bounded Decisions transport for Guardian comparison classification
- Enable dynamic tool inheritance for fresh V2 subagents
- Add paginated reverse lookup for thread attachments
- Preserve queued agent mail across session eviction
- Prevent shared instruction providers from delegating to themselves
- Add attachment owner lookup to the app-server
- Add opt-in Decisions comparison for Guardian V2
- Consolidate chat composer footer logic in `footer_state`
- Keep fullscreen prompts bounded and scrollable
- Centralize TUI loading glyphs and frame scheduling
- Add a native gRPC client for cloud thread resume and attach
- Expose the model selected for a running turn's next step
- Preserve Windows environment variables for remote MCP servers
- Add opt-in JSON diagnostics for TCP tunnels
- Use the server permission catalog for TUI permission shortcuts
- Add managed worktree tools to the TUI
- Bound in-flight file opens in exec-server
- Enable writable file streaming in exec-server
- Restore the account email in `/status` after account updates
- Report the configured TUI mode in `codex doctor`
- Release stable Markdown tables into scrollback during streaming
- Make transcript mouse scroll speed configurable
- Support Ctrl+Insert for copying TUI selections
- Use the shared text editor for command-center task renaming
- Bound tmux option probes to one second
- Add end-to-end coverage for MCP sandbox state enforcement
- Keep the subagent picker consistent with thread archive state
- Back off automatic remote control reconnects with jitter
- Skip unrelated subtrees during config alias normalization
- Render ANSI styles in TUI hook system messages
- Remove initial messages from session configuration events
- Use printable ASCII terminal titles under GNU Screen
- Fix thread unloading after disconnect during MCP startup
- Allow opting into 16 KiB ARM64 code pages for macOS signing
- Honor configured keybindings before transcript navigation
- Honor pager bindings for transcript page keys
- Consolidate command execution output into `aggregated_output`
- Add capability overrides for custom model providers
- Preserve terminal hyperlinks in agents overview previews
- Allow API-key accounts to use Daybreak in the TUI
- Add keyboard copy selection to the owned transcript
- Persist additional tool definitions in rollout history
- Add a CLI command to uninstall the legacy Windows sandbox
- Support ordered response items in world-state context updates
- Preserve native USD amounts in thread usage responses
- Remove the provider capability gate for tool namespaces
- Measure rollout persistence size reductions
- Truncate oversized MCP results in paginated thread history
- Populate thread previews from delegated task inputs
- Add the `incremental_tools` feature flag
- Retry registry authentication outages and jitter executor reconnects
- Copy transcript selections as literal text while preserving rich HTML
- Account for JSON overhead when truncating MCP tool results
- Enable Ultrafast service tiers for Amazon Bedrock Astra models
- Use the app-server default output cap for TUI workspace commands
- Skip managed config loading for registered Windows sandbox refreshes
- Include installer stderr i...

[Codex Changelog @CodexChanges]

Codex CLI v0.162.0 has been released.
6 new features, 6 bug fixes, 2 infrastructure changes, 200+ commits

Highlights:
- Managed Git worktree tools in the TUI
- Clickable URLs throughout the interface
- Task pinning in the agent Command Center

Complete details in thread ↓

[Codex Changelog @CodexChanges]

Fixes:

- Server model and reasoning-summary defaults were not being applied to new TUI threads when no explicit launch override was set. Now respected correctly.

- `apply_patch` was converting CRLF line endings to LF on files that already used CRLF. Existing line endings are now preserved unconditionally.

- Linux sandbox: Fixed startup failure when multiple files were denied. Sandbox-writable bubblewrap executables are now rejected from PATH. ripgrep configuration files could weaken deny-glob masks during sandbox construction; that path is now protected.

- Windows 10: Drive-letter file access was broken for no-follow filesystem operations. Fixed. Sandbox temp directory permissions now match the child process environment.

- Server `Retry-After` headers were not being honored on retryable Responses API failures or WebSocket errors. Both now respect the header.

- Windows PowerShell installer checksum verification failed when PowerShell 7 module paths were present. Fixed.

Chores:

- PowerShell installer is now signed in Windows releases.

- Stable release download targets and installer aliases are no longer overwritten by older stable releases or prereleases.

[Codex Changelog @CodexChanges]

Full changelog (dependency bumps excluded):

- #49246 Use executable fixture copying in the bundled bwrap test
- #49257 Allow Guardian cached approvals with incomplete root context
- #49260 Restrict enterprise MCP auth and fail closed on config refresh
- #49261 Preserve Windows sandbox runner launch errors
- #49262 Trace turn phases and correlate accepted input with turns
- #49266 Remove the remote agent message board client README
- #49267 Support remote agent message boards in multi-agent sessions
- #49269 Preserve thread overrides and cloud policy validity during config reloads
- #49275 Isolate realtime conversation tests from Responses prewarm connections
- #49276 Enable enterprise MCP sign-in and account-scoped grant cleanup
- #49277 Avoid a turn teardown race in the Guardian agent message test
- #49280 Restrict capability roots to captured turn environments
- #49286 Model exec-server session attachment state as an enum
- #49290 Add /mcp login <name> to the TUI
- #49294 Record Guardian context mode in review and classification telemetry
- #49295 Simplify configuration fingerprint canonicalization
- #49297 Scan the session index backwards for batch thread name lookups
- #49300 Compact the inline hidden tag buffer once per chunk
- #49305 Batch metadata reads when resolving thread names
- #49308 Run piped legacy Windows sandbox processes without a console
- #49312 Notify parent agents when Guardian stops a subagent
- #49318 Add GPT-6.1 Sol as the default catalog model
- #49325 Retry Windows sandbox runner logon once on error 1056
- #49330 Keep remote control reconnect backoff capped during sustained failures
- #49332 Clean up canceled exec-server RPC requests immediately
- #49339 Add GPT-6.1 Sol to Bedrock catalogs and make it the default
- #49345 Enable multi-agent V2 and Ultra reasoning on Amazon Bedrock
- #49353 Allow approved filesystem escalation while preserving denied reads
- #49357 Continue Markdown blockquotes when pasting multiline text
- #49360 Carry shell invocation metadata and report executor PATH directories
- #49361 Clarify credential storage wording across authentication UI and docs
- #49369 Update Bedrock GPT-6 Sol catalog tests to expect multi-agent V2
- #49379 Compile hook matchers during discovery
- #49384 Track credential storage outcomes and redact sensitive errors
- #49388 Fix Windows path inference for opaque URIs with slash prefixes
- #49389 Serialize tests that share Windows sandbox accounts
- #49392 Add attributed MCP OAuth credential storage telemetry
- #49395 Remove randomized greetings from TUI session headers
- #49401 Preserve live tool-call metadata across request windows
- #49403 Add an experimental flag for bundled tools in login shells
- #49406 Support explicit cyber access programs with OpenAI API keys
- #49407 Recover exec-server sessions after environment info timeouts
- #49408 Compare tool call metadata in the recorder refresh test
- #49411 Bind the app-server time provider to a local variable
- #49414 Filter graceful shutdown guard and trigger traces from SQLite logs
- #49415 Truncate input text in protocol debug output
- #49416 Omit payloads from multiline ANSI warnings
- #49424 Infer Windows UNC paths with forward and mixed slashes
- #49425 Prune diagnostic logs periodically by age and database size
- #49426 Enable analytics by default for daemon-launched app servers
- #49432 Preserve bootstrap discovery across authentication changes
- #49437 Add local audio device selection to TUI voice settings
- #49441 Honor server retry advice across Responses retries and fallback
- #49444 Use memrchr to find newlines in reverse JSONL scans
- #49467 Restore executor tool paths after login shell startup
- #49472 Use server-authoritative permissions in the TUI
- #49473 Use the rmcp SDK for enterprise-managed token exchanges
- #49475 Complete turn abort callbacks before emitting terminal events
- #49478 Discover and validate MCP authorization servers before ID-JAG exchange
- #49480 Add experimen...

[Codex Changelog @CodexChanges]

Codex CLI v0.161.0 has been released.
~170 changelog items across features, fixes, and infrastructure

Highlights:
- GPT-6.1 Sol as default model
- Daybreak opt-in with explicit flag required
- Voice device selection with saved preferences

Complete details in thread ↓

[Codex Changelog @CodexChanges]

Fixes:

- Filesystem escalation: approved grants can now broaden write access while preserving denied reads and network restrictions; background tasks retain the originating turn's permissions
- Launch permissions now survive terminal reconnects and new sessions; implicit client settings no longer overwrite server or saved-thread web-search settings
- Elevated Windows terminal sessions can now start using an embedded server; sandboxed PowerShell preserves relative paths under protected user profiles
- Enter now correctly submits buffered input after paste detection expires, including in Vim insert mode
- Thread resume now includes the latest committed history; startup detects recoverable SQLite corruption earlier and preserves damaged databases as backups
- Responses retries and WebSocket-to-HTTP fallback now honor server retry guidance, reducing premature failures during overload

Docs:

- Authentication guidance updated to reflect keyring storage rather than implying credentials always live in auth.json

Chores:

- Publishing an older alpha or hotfix no longer moves npm alpha dist-tags backward

[Codex Changelog @CodexChanges]

Full changelog:

- Backport Windows remote MCP environment preservation to 0.160

Full release notes: https://t.co/bi5vQTpHpW

[Codex Changelog @CodexChanges]

Codex CLI v0.160.1 has been released.
1 bug fix, 1 changelog entry

Highlights:
- Windows remote MCP environment preservation
- SYSTEMROOT, TEMP, and TMP retained on Unix hosts
- Backport from main to 0.160 branch

Complete details in thread ↓

[Codex Changelog @CodexChanges]

Fixes:

- Fixed missing SYSTEMROOT, TEMP, and TMP environment variables when launching remote stdio MCP servers with explicitly configured remote environment variables. Unix hosts running a Windows executor no longer lose the startup environment on launch.