Release notes
The usage-limit reset credits you get around usage caps (vouchers from goodwill grants or promos that zero out your quota timer) now show their type and expiration, and you choose which one to redeem. Redemption used to be blind, so you could spend a long-lived credit while an expiring one quietly went to waste; now it's like the coupons in your wallet finally printing their value and expiry date, so you decide which to use first.
The plugin ecosystem (add-on packs that teach Codex new skills) just flung its doors open: remote plugins are enabled by default with no switch to flip, catalog rows show richer info including remote and local versions, and you can install from npm sources (the JavaScript world's biggest package marketplace). It's like a phone going from "factory-preloaded apps only" to "the app store is open."
If Codex never worked behind your corporate network, relief is here: authentication and API traffic now duly route through macOS and Windows system proxies (the relay your company uses to control outbound connections), including PAC and WPAD auto-configuration (the mechanisms that let a computer discover which proxy to use). Like a new hire finally learning to sign in at the front desk instead of climbing the fence and getting stopped by security.
App approvals (the rules deciding which actions an external app must clear with you first) gain a writes mode: actions declared read-only sail through, and you're only prompted when something wants to write. The old granularity was all-or-nothing — ask about everything or nothing; now it works like a library: browse any book freely, but the librarian's stamp is only needed if you want to mark one up.
When you pick Ultra reasoning (the highest thinking tier — deeper answers, faster quota burn) while running high multi-agent concurrency (many agents at once), Codex now warns you that usage could spike quickly. Like a rental agency reminding you, as you rent five sports cars at once, that the fuel bill will be considerable — so you commit with your eyes open.
Pasting content that carries terminal control sequences (invisible commands hiding in text that move the cursor or change colors) used to garble the terminal interface and could even corrupt resumed conversation history; those stowaways are now handled safely and the screen stays put. Like a print shop that now neutralizes the invisible ink on your original before copying, so no scribbles show up on the page.
When an MCP tool (Model Context Protocol, the socket standard for plugging in outside tools) needs you to authenticate, it now just asks on the spot — no more flipping an experimental opt-in first. Tools used to stall at "authentication required," recoverable only if you knew about the hidden switch; now it's like a cashier asking "want to sign up for the membership now?" right at the counter, instead of sending you home to read the fine print.
Installs and updates got tougher. Standalone installs used to break the moment GitHub returned compact or reordered release metadata, and API rate limits (temporary refusals when too many requests arrive at once) could sink an install too. Release metadata is now reused and format quirks are tolerated; macOS packages also ship the companion program that code mode needs, and if that companion is missing, an embedded fallback keeps things running. Like a vending machine that used to spit out any slightly wrinkled bill — it now takes them all.
Device-code login (authorizing a sign-in by typing a code on another device) now shows a warning that teaches you to recognize and stop phishing (the con where someone poses as the official site to trick your login code out of you). The mechanism itself didn't change — there's just now a police officer standing by the ATM reminding you not to wire money to strangers on the phone.
Original changelog
Original changelogUsage-limit reset credits show their type and expiry — and you pick which to redeem
Usage-limit reset credits now show their type and expiration, and let you choose which credit to redeem. (0.144.0)
Original changelogRemote plugins are on by default, with a richer catalog and npm sources
Remote plugins are now enabled by default, with richer catalog rows, npm marketplace sources, and visible remote/local versions. (0.143.0)
Original changelogCodex now works through macOS and Windows system proxies
Codex can route authentication and Responses API traffic through macOS and Windows system proxies, including PAC and WPAD configurations. (0.143.0)
Original changelogNew `writes` approval mode: reads sail through, writes still ask
Added a `writes` app-approval mode that allows declared read-only actions while prompting for writes. (0.144.0)
Original changelogPicking Ultra reasoning now warns when multi-agent runs could burn quota fast
Selecting Ultra reasoning now warns when high multi-agent concurrency could increase usage quickly. (0.144.0)
Original changelogPasting weird terminal content no longer garbles the screen
Pasted terminal control sequences can no longer corrupt TUI rendering or resumed conversation history. (0.144.0)
Original changelogMCP tools can now ask you to sign in on the spot
MCP tools can now request authentication interactively without an experimental opt-in. (0.144.0)
Original changelogInstalls and updates stop failing at GitHub's whim
Fixed standalone installs failing when GitHub returns compact or reordered release metadata. Ensured macOS package installs expose the code-mode host alongside the `codex` executable. Kept code mode working when the companion host binary is unavailable by falling back to the embedded runtime. (0.144.1) Reduced installer failures from GitHub API rate limits by reusing release metadata. (0.143.0)
Original changelogDevice-code login now teaches you to spot phishing
Device-code login warnings now explain how to recognize and stop phishing attempts. (0.144.0)