發布日期：2026-06-18
透過遠端連線跑程式碼變得更強大且安全了。現在遠端執行器（executor，幫你跑程式的背後引擎）預設採用端到端加密（Noise relay），而且就算你掛網不動，連線也不會隨便斷開。如果你用 Mac 連到 Windows 伺服器，它能完美保留對方的原生資料夾路徑、Shell 環境與檔案權限，不會再因為作業系統不同而水土不服。此外，系統現在也支援企業級代理伺服器常用的 P-521 憑證簽章，並修復了資料庫（SQLite）的毀損問題。就像你從台灣遠端遙控國外的無塵室，現在不僅通訊全加密、連線不中斷，連你對機械手臂下的指令都會自動翻譯成當地規格，不怕摔壞東西。
找外掛（plugin，擴充系統功能的附加元件）的體驗變得更像逛現代化商城了。現在市集裡多了一個「我建立的（created-by-me）」專區，讓你快速找到自己寫的工具；同時系統會根據你的登入身分，推薦專屬的精選外掛目錄。如果遇到不同外掛撞名（宣告衝突），系統現在懂得自動去重複並保持市集排序不亂掉。此外，特定的執行器外掛現在可以在每個執行緒（thread，獨立的工作流程）裡單獨啟動對應的 MCP（讓 AI 控制外部工具的協定）伺服器。就像百貨公司重新裝潢，不僅有了你的專屬品牌櫃位和量身訂做的推薦專刊，連不同專櫃的同名商品都不會再標錯價錢了。
如果你的專案塞滿了各種工具，現在跑起來會順暢非常多。系統改善了底層邏輯，把工具搜尋的結果快取起來，並避免重複拷貝歷史對話，大幅降低了延遲與記憶體消耗。同時，它也為圖片快取設定了 64 MiB 的上限，並限制回饋上傳最多只牽涉八個相關執行緒（thread，獨立的工作流程），避免系統不知節制把記憶體吃光。另外，終端機重新調整視窗大小時的文字重排功能現在強制開啟，不會再有過時設定卡住畫面了。就像一間總是把資料庫印出來歸檔的舊公司，現在學會了用電腦索引，不僅辦公桌（記憶體）不再被公文山壓垮，找資料的速度也變快了。
在終端機裡跟 AI 互動變得更人性化了。現在遇到等不到你輸入的提示框，它懂得在倒數後自動結案（倒數期間你只要動一下就會暫停）；即時對話（Realtime）時你也可以隨時插嘴補充語音，並控制系統回應如何加入上下文。對 Windows 使用者來說，在沙盒（sandbox，隔離的安全執行環境）裡跑指令時，系統現在懂得自動修復過期的憑證，而且會給 PowerShell 指令多一點喘息時間，不會太快把它丟到背景執行而中斷。就像一個機靈的助理，看你離開座位太久會自己把對話框關掉，等你一開口又會馬上停下來聽你說，處理麻煩手續時還會默默幫你把過期的證件換新。
現在 PostToolUse 的安全鉤子（hook，在特定動作發生前後觸發的攔截機制）能正確擋下寫程式模式（Code mode）裡不合規的工具呼叫了，而且信任豁免狀態在使用 codex exec 啟動與恢復執行緒時也能正常延續。針對伺服器端，現在能清楚列出子執行緒，把外部代理的紀錄跟結果對應起來，還能隨時查看或抵用 API 的限流（rate-limit）重置額度。就像公司的財務與門禁系統升級，以前警衛遇到高階主管換部門就忘了放行，或是攔不住走後門的包裹，現在不僅門禁滴水不漏，連每個部門花了多少預算、剩下多少扣打都算得一清二楚。
Running code remotely is now more powerful and secure. Remote executors (the underlying engines running your code) now default to end-to-end encrypted Noise relay channels, and idle connections will not drop randomly. If you're on a Mac connecting to a Windows server, the system perfectly preserves the native working directories, shell environment, and filesystem permissions across the boundary without complaining about platform differences. It also supports P-521 certificate signatures commonly used by enterprise proxies and fixes a database (SQLite) corruption bug. Like teleoperating a foreign cleanroom from your home: the communication is now fully encrypted, the feed never drops, and your controller movements are perfectly translated to the local robotic arm's specifications so nothing breaks.
Finding plugins (add-ons extending system capabilities) now feels like browsing a modern marketplace. There is a new "Created by me" section to quickly locate the tools you built, and the system loads curated catalogs tailored to your specific authentication mode. If different plugins declare the same name (conflicting declarations), the system now neatly deduplicates them while preserving the marketplace's ranking order. Furthermore, selected executor plugins can now activate their own MCP (a protocol letting AI control external tools) servers on a per-thread (independent workflow) basis. Like a department store remodeling: you now get your own custom boutique section, personalized shopping catalogs, and they finally fixed the inventory system so identical products from different vendors don't mess up the price tags.
Heavy projects loaded with tools will now run significantly smoother. The system optimized its core logic by caching tool search results and eliminating repeated copies of conversation history, drastically reducing latency and memory consumption. It also put a hard 64 MiB cap on the prompt-image cache and restricted feedback uploads to a maximum of eight related threads (independent workflows), preventing the system from ravenously eating up all your RAM. Additionally, terminal text reflow upon resizing is now always enabled, overriding any obsolete settings that might freeze the view. Like an old office that used to print out every database record for archiving, but finally learned to use digital indexes — not only is the desk (RAM) no longer crushed by paper mountains, but finding information is much faster.
Interacting with the AI in the terminal has become much more user-friendly. Input prompts will now automatically resolve themselves after a period of inactivity (the countdown pauses the moment you interact); during Realtime sessions, you can explicitly append speech and control how responses enter the context. For Windows users, running commands in the sandbox (an isolated, secure execution environment) now automatically repairs stale credentials, and PowerShell commands are given a bit more breathing room before being shunted into the background. Like a sharp assistant who politely closes a dialog box if you've walked away from your desk, instantly stops to listen the moment you speak up, and quietly renews your expired IDs when dealing with tedious paperwork.
The PostToolUse security hooks (interception mechanisms that trigger before or after specific actions) now correctly block non-compliant tool calls in Code mode, and your trust-bypass status persists perfectly through codex exec thread starts and resumes. On the app-server side, you can now cleanly list child threads, accurately correlate external agent records with their results, and read or redeem your API rate-limit reset credits. Like a corporate security and accounting upgrade: the guards used to forget a VIP's clearance when they switched departments or failed to inspect back-door packages, but now the gates are airtight, and every department's budget and remaining quotas are tracked down to the penny.
Remote executors now use authenticated, end-to-end encrypted Noise relay channels. (#26242, #26245)
Cross-platform remote execution now preserves executor-native working directories and shells, including filesystem permission paths across app-server and exec-server boundaries. (#27819, #27995, #28032, #28122, #28165, #28367)
TLS connections now support P-521 certificate signatures commonly used by enterprise proxies. (#27706)
Idle exec-server relays remain connected, and steered user input immediately interrupts `wait_agent`. (#28286, #28341)
Bundled SQLite is pinned to a version containing the WAL-reset corruption fix. (#27992)Selected executor plugins can activate their stdio MCP servers per thread; plugin discovery also adds a created-by-me marketplace and auth-specific curated catalogs. (#27870, #27884, #27893, #28203, #28383)
Plugin capabilities now route consistently by authentication mode, deduplicate conflicting App/MCP declarations, and preserve remote marketplace ordering. (#27461, #27602, #27607, #27902, #27958, #28395)Reduced latency and memory use in large, tool-heavy sessions by caching tool search and eliminating repeated request and history copies. (#27258, #27813, #28306, #28309, #28313, #28323, #28327)
Bounded prompt-image caching to 64 MiB and feedback uploads to eight related threads. (#28294, #28332)
Terminal resize reflow is now always enabled, ignoring obsolete disabled settings. (#27794)TUI input prompts can auto-resolve after inactivity, with a countdown that pauses on interaction. (#28235)
Realtime clients can explicitly append speech, control how Codex responses enter conversations, and omit startup context. (#27917, #28405)
Windows sandbox execution repairs stale credentials automatically and gives PowerShell commands more time before backgrounding. (#27086, #27944)Hook trust bypass now persists through `codex exec` thread start and resume, while blocking `PostToolUse` hooks correctly reject code-mode tool calls. (#26434, #28365)
App-server clients can list immediate child threads, correlate external-agent imports with detailed results, and read or redeem rate-limit reset credits. (#26662, #28008, #28143)