Release notes

FEATURE

Clearer credit redemptions and anti-phishing warnings

Your rate-limit reset credits (allowances that let you bypass usage caps) now clearly display their type and expiration dates, and you get to pick which one to redeem. During login, device-code (a code used to authenticate from another machine) warnings have been rewritten in plain language to teach you how to spot and stop phishing attempts. For app-server hosts, you can now inject authentication dynamically at runtime and redirect users to a hosted page upon successful login. Like gift certificates at a department store: they no longer just look like a confusing stack of paper, but clearly state what they're good for and when they expire, while the security guard at the door proactively teaches you how to avoid scammers.

FEATURE

Precision write controls and smoother model transitions

Harmless read-only actions no longer require step-by-step permission. A new writes approval mode (which only stops to ask for permission when modifying something) has been added. On the conversation side, if you resume an old ChatGPT thread and its original model has been retired, the system now automatically retries with your currently selected model instead of crashing. Also, Amazon Bedrock model names are now clearly labeled so you can spot their exact GPT-5.6 family variant. Lastly, if you pick the heavy-duty Ultra reasoning model, the system will warn you that running too many concurrent agents might burn through your usage limits instantly. Like a smart new library gate: it lets you walk in and browse the books without stopping you, but asks for your card the moment you try to take one home; and if the library upgrades its checkout system halfway through, it seamlessly ports your records over, while warning you that borrowing too many heavy encyclopedias will quickly max out your weight allowance.

FEATURE

Faster plugin loading with robust authentication and networking

Remote executors (the underlying engines running your code) now significantly speed up skill loading times by resolving plugin namespaces once per root directory. MCP (a protocol letting AI control external tools) tools can now also directly request authentication interactively right out of the box without needing an experimental toggle. On the networking side, Responses WebSockets continue to provide low-latency communication while perfectly respecting your system proxies and custom certificate authorities; long-running app sessions will also automatically refresh expired credentials for the hosted codex_apps connector. Like installing a new office switchboard: extension numbers are mapped out all at once instead of looking them up every time, connecting to external consultants no longer requires punching in experimental access codes, and the phone lines stay crystal clear even if the company installs a strict new firewall.

BUGFIX

Terminal resilience against corrupted rendering and widespread bug fixes

Pasting text containing terminal control sequences (special characters used to change text color or cursor position) will no longer irreparably corrupt the screen rendering or ruin your resumed conversation history; Intel Mac users will also no longer experience random crashes in Code Mode. If you installed globally using pnunen, it now correctly detects it and uses the right commands for updates. Furthermore, Windows sandbox (an isolated, secure execution environment) sessions can now successfully delete files and access the primary runtime, while the /review branch picker is now drastically faster and more reliable in massive repositories, with clearer instructions. Like buying a spill-proof desk mat so that knocking over a caustic chemical (corrupted text) won't melt a hole through your table, while the maintenance worker also greases the squeaky doors and fixes your old laptop's blue screens.

Original changelog

Original changelogClearer credit redemptions and anti-phishing warnings
Usage-limit reset credits now show their type and expiration, and let you choose which credit to redeem. (#30488)
App-server hosts can provide Codex authentication at runtime and redirect successful logins to a hosted page. (#28745, #31274)
Device-code login warnings now explain how to recognize and stop phishing attempts. (#31648)
Original changelogPrecision write controls and smoother model transitions
Added a `writes` app-approval mode that allows declared read-only actions while prompting for writes. (#30482)
Selecting Ultra reasoning now warns when high multi-agent concurrency could increase usage quickly. (#31621)
Resumed ChatGPT threads recover when compaction references a retired model by retrying with the currently selected model. (#30319)
Made Amazon Bedrock model names clearly identify their GPT-5.6 family and variant. (#31636)
Original changelogFaster plugin loading with robust authentication and networking
MCP tools can now request authentication interactively without an experimental opt-in. (#28772)
Reduced plugin skill-loading time on remote executors by resolving namespaces once per root. (#31348)
Responses WebSockets continue using the low-latency transport while respecting system proxies and custom certificate authorities. (#31441, #31622)
Long-running app sessions now refresh expired authentication for the hosted `codex_apps` connector. (#31486)
Original changelogTerminal resilience against corrupted rendering and widespread bug fixes
Fixed Code Mode crashes in Intel macOS release binaries. (#30953)
Pasted terminal control sequences can no longer corrupt TUI rendering or resumed conversation history. (#31494)
Global pnunen installs are now detected so diagnostics and updates use the correct package manager. (#31503)
Windows sandbox sessions can delete files in writable roots and access the managed primary runtime. (#31138, #31574)
Made the `/review` branch picker faster and more reliable in large repositories. (#31464)
Improved automatic review behavior with clearer instructions and a focused tool set. (#31480)