Codex 0.141.0: End-to-end encrypted remote execution with native

Release notes

FEATURE

End-to-end encrypted remote execution with native cross-platform environments

Running code remotely is now more powerful and secure. Remote executors (the underlying engines running your code) now default to end-to-end encrypted Noise relay channels, and idle connections will not drop randomly. If you're on a Mac connecting to a Windows server, the system perfectly preserves the native working directories, shell environment, and filesystem permissions across the boundary without complaining about platform differences. It also supports P-521 certificate signatures commonly used by enterprise proxies and fixes a database (SQLite) corruption bug. Like teleoperating a foreign cleanroom from your home: the communication is now fully encrypted, the feed never drops, and your controller movements are perfectly translated to the local robotic arm's specifications so nothing breaks.

FEATURE

Expanded plugin marketplaces with curated lists and "Created by me"

Finding plugins (add-ons extending system capabilities) now feels like browsing a modern marketplace. There is a new "Created by me" section to quickly locate the tools you built, and the system loads curated catalogs tailored to your specific authentication mode. If different plugins declare the same name (conflicting declarations), the system now neatly deduplicates them while preserving the marketplace's ranking order. Furthermore, selected executor plugins can now activate their own MCP (a protocol letting AI control external tools) servers on a per-thread (independent workflow) basis. Like a department store remodeling: you now get your own custom boutique section, personalized shopping catalogs, and they finally fixed the inventory system so identical products from different vendors don't mess up the price tags.

PERF

Smoother performance and reduced memory usage in heavy sessions

Heavy projects loaded with tools will now run significantly smoother. The system optimized its core logic by caching tool search results and eliminating repeated copies of conversation history, drastically reducing latency and memory consumption. It also put a hard 64 MiB cap on the prompt-image cache and restricted feedback uploads to a maximum of eight related threads (independent workflows), preventing the system from ravenously eating up all your RAM. Additionally, terminal text reflow upon resizing is now always enabled, overriding any obsolete settings that might freeze the view. Like an old office that used to print out every database record for archiving, but finally learned to use digital indexes — not only is the desk (RAM) no longer crushed by paper mountains, but finding information is much faster.

FEATURE

Flexible terminal interactions and auto-repairing Windows sandboxes

Interacting with the AI in the terminal has become much more user-friendly. Input prompts will now automatically resolve themselves after a period of inactivity (the countdown pauses the moment you interact); during Realtime sessions, you can explicitly append speech and control how responses enter the context. For Windows users, running commands in the sandbox (an isolated, secure execution environment) now automatically repairs stale credentials, and PowerShell commands are given a bit more breathing room before being shunted into the background. Like a sharp assistant who politely closes a dialog box if you've walked away from your desk, instantly stops to listen the moment you speak up, and quietly renews your expired IDs when dealing with tedious paperwork.

FEATURE

Stricter security hooks and transparent API usages

The PostToolUse security hooks (interception mechanisms that trigger before or after specific actions) now correctly block non-compliant tool calls in Code mode, and your trust-bypass status persists perfectly through codex exec thread starts and resumes. On the app-server side, you can now cleanly list child threads, accurately correlate external agent records with their results, and read or redeem your API rate-limit reset credits. Like a corporate security and accounting upgrade: the guards used to forget a VIP's clearance when they switched departments or failed to inspect back-door packages, but now the gates are airtight, and every department's budget and remaining quotas are tracked down to the penny.

Original changelog

Original changelogEnd-to-end encrypted remote execution with native cross-platform environments

Remote executors now use authenticated, end-to-end encrypted Noise relay channels. (#26242, #26245)
Cross-platform remote execution now preserves executor-native working directories and shells, including filesystem permission paths across app-server and exec-server boundaries. (#27819, #27995, #28032, #28122, #28165, #28367)
TLS connections now support P-521 certificate signatures commonly used by enterprise proxies. (#27706)
Idle exec-server relays remain connected, and steered user input immediately interrupts `wait_agent`. (#28286, #28341)
Bundled SQLite is pinned to a version containing the WAL-reset corruption fix. (#27992)

Original changelogExpanded plugin marketplaces with curated lists and "Created by me"

Selected executor plugins can activate their stdio MCP servers per thread; plugin discovery also adds a created-by-me marketplace and auth-specific curated catalogs. (#27870, #27884, #27893, #28203, #28383)
Plugin capabilities now route consistently by authentication mode, deduplicate conflicting App/MCP declarations, and preserve remote marketplace ordering. (#27461, #27602, #27607, #27902, #27958, #28395)

Original changelogSmoother performance and reduced memory usage in heavy sessions

Reduced latency and memory use in large, tool-heavy sessions by caching tool search and eliminating repeated request and history copies. (#27258, #27813, #28306, #28309, #28313, #28323, #28327)
Bounded prompt-image caching to 64 MiB and feedback uploads to eight related threads. (#28294, #28332)
Terminal resize reflow is now always enabled, ignoring obsolete disabled settings. (#27794)

Original changelogFlexible terminal interactions and auto-repairing Windows sandboxes

TUI input prompts can auto-resolve after inactivity, with a countdown that pauses on interaction. (#28235)
Realtime clients can explicitly append speech, control how Codex responses enter conversations, and omit startup context. (#27917, #28405)
Windows sandbox execution repairs stale credentials automatically and gives PowerShell commands more time before backgrounding. (#27086, #27944)

Original changelogStricter security hooks and transparent API usages

Hook trust bypass now persists through `codex exec` thread start and resume, while blocking `PostToolUse` hooks correctly reject code-mode tool calls. (#26434, #28365)
App-server clients can list immediate child threads, correlate external-agent imports with detailed results, and read or redeem rate-limit reset credits. (#26662, #28008, #28143)