Codex 0.147.0

你換電腦或加入新工作區時，現在能安裝可攜式 Agent Plugins（代理外掛，替 Codex 加上工作能力的小工具），也能在本機、個人、工作區和遠端目錄找它們。像一只可攜式工具箱：工具可在不同工具櫃找到；若封條檢查失敗，箱子就先不接外部管線。安全邊界也加厚了：外掛會被更嚴格隔離；如果更新安全政策失敗，Codex 會拒絕網路連線。

一串對話越聊越長，找上週那段決定常像翻亂掉的筆記本。現在可把 conversations（對話）放進會保留的區段，自己調整順序；很長的逐字稿則分段載入，不必一次塞滿畫面。另一頭，Cursor 管理的 skills（技能，教 AI 做特定工作的說明）可以匯入，已匯入的 Claude 和 Cursor 對話也會同步變更而不複製出兩份。像替筆記貼標籤、逐頁翻閱，再把兩本筆記對齊同一頁。

你在命令列跑重複任務時，可用新的 --approve-for-me CLI flag（命令列旗標，附在指令後的開關）開啟自動審核過的核准，不必每一步都手動按許可。但新本機專案不是直接放行：Codex 會要求你明確信任，並在使用 credentials（登入憑證，證明身分的資料）前套用受管理的登入限制。像把常用包裹交給通過規則的收件櫃；沒有寄件人資訊的新包裹，仍要你親自簽收。

你叫 Codex 接上外部服務時，MCP（Model Context Protocol，讓 AI 連接外部工具的協定）現在可選用 2026-07-28 版規格。它支援分頁探索：工具清單很長時分批拿，不必整包搬進來；也能多輪請求，並讓伺服器在背景慢慢啟動而不堵住其他工作。這像餐廳不再把整本菜單塞到你手上，先翻一頁、再點下一輪；廚房備料時，桌邊對話照樣繼續。

用 Amazon Bedrock 跑 Codex 時，重看剛查過的網頁不必每次從頭取資料。網路搜尋可使用快取（把查過的結果暫存起來直接用），對話也支援遠端壓縮：把過長的對話收成較短的上下文，交給遠端處理。像旅行筆記本：查過的地圖頁先收在夾層，需要時直接翻回；內容太多時把舊頁整理成摘要，旅程仍接得上。原本的問題和最近脈絡仍會留在眼前。

你把命令貼到螢幕分享或回頭翻對話時，最怕登入資料跟著露出來。Codex 現在會從顯示的命令和重播的對話歷史遮蔽 secrets（機密資料，例如密碼）與完整的 bearer tokens（持有人令牌，拿到就能通行的授權令牌）。像銀行對帳單把帳號中段塗黑：你仍看得出是哪筆操作，旁人卻不能拿那串字直接冒用。它遮的是畫面與重播內容，不是替你撤銷已經外流的憑證。

切回終端機正要補一個指令，字卻消失或卡著不動，往往不是你手快按錯。這版修正三種會弄丟或堵住輸入的時刻：視窗重新取得焦點、MCP 伺服器初始化，以及 Ghostty 處理鍵盤快捷鍵時。像接線員剛回到座位、後台正開機、同事按下內線鍵的同時，電話還是會接進來，不會把你剛說的第一句丟掉。中斷工作再回來，也不必先猜剛才那行有沒有送出。

你在終端機看日文、emoji 或超連結時，游標有時像踩錯格子，文字也可能在畫面邊緣歪掉。這版修正日文字元、emoji、hyperlinks（超連結，點了會跳到其他位置的文字）以及靠近 viewport boundaries（可視畫面邊界）的文字顯示和游標位置。它像方格紙的尺終於認得寬字和窄字：走到紙張邊緣前會量好，不把下一格畫到紙外。

在 Windows 上叫停背景程序時，Codex 現在會正確中斷它，不必等它自己收工。Windows filesystem paths（檔案系統路徑，像檔案地址的寫法）也會一致處理，避免同一個資料夾因為路徑格式不同而找錯地方。這像工地的總開關終於接到每台機器，也把每條巷弄的門牌統一寫清楚：該停的能停，要找的門不會繞到隔壁去。

你想確認 Codex 怎麼用、該選哪個模型，或 API workflow（API 工作流程，程式如何呼叫服務的一連串步驟）要怎麼接，現在內建的 OpenAI documentation skill（文件技能，協助查找官方說明的工具）會更有針對性地查官方來源，並給更清楚的指引。它像圖書館員先聽懂你要找的是使用說明、型號比較還是接線圖，再帶你到正確書架，而不是把整棟館藏推來。

這版也換了幾個底層零件：MCP SDK 升至 3.0.0、Ratatui 升至 0.30.2、V8 升至 150.4.0。macOS 發行版的 notarization（公證，讓系統確認軟體來源可信的簽章程序）則改用 Azure Key Vault 保護，不再匯出私密簽章金鑰。Linux 也不再發佈重複的 bundle archives（套裝壓縮檔），改用標準 codex-package-<target> 檔案。像工廠更新生產線：設備換新，簽章用的印章留在廠內保管櫃，出貨也統一走一種箱規。

若你的腳本還寫著 codex exec --full-auto，這版起它已被移除。改用 --sandbox workspace-write：sandbox（沙盒，限制程式可碰範圍的隔離區）把可寫入範圍限在工作區。像舊鑰匙已停用，改領一把只能開辦公室的卡；你仍能在專案內工作，但卡片清楚標示能到哪裡。更新自動化指令時，直接把舊旗標換成新參數。

Moving to another computer or workspace no longer means hunting down your add-ons again. You can install portable Agent Plugins and search local, personal, workspace, and remote catalogs for them. Think of a portable toolbox: its tools can be found in different tool cabinets; if the seal check fails, the box does not connect to external lines yet. The release also tightens plugin isolation and denies network access if a policy update fails.

When a chat runs for weeks, finding one decision can feel like opening a notebook at random. Conversations can now live in persistent sections that you order yourself, while long transcripts load a piece at a time. You can also import Cursor-managed skills, and imported Claude and Cursor conversations stay synchronized without spawning duplicates. It is like labeling notebooks, turning pages as needed, and keeping two copies aligned.

For repeated command-line work, the new --approve-for-me flag enables automatically reviewed approvals, so every routine step need not stop for a click. An unfamiliar local project does not get that treatment: Codex asks for explicit trust and applies managed authentication restrictions before using credentials. It is like a parcel locker that accepts packages matching its rules, while an unmarked box still waits for your signature.

When Codex connects to an outside service, it can now opt into the 2026-07-28 MCP protocol. Long tool lists can be discovered page by page, requests can take multiple rounds, and a server can start in the background instead of blocking the rest of the work. It is like reading a menu one page at a time and ordering another course while the kitchen is still warming up.

When Codex runs through Amazon Bedrock, web searches can use a cache, keeping results already fetched handy, and long conversations can be compacted remotely into shorter context. Think of a travel notebook: put map pages you have checked into a pocket and turn back to them when needed; when there is too much content, condense old pages into a summary and the trip still holds together.

A command pasted into a screen share should not also paste your keys. Codex now redacts secrets and complete bearer tokens from displayed commands and replayed conversation history. It is like blacking out the middle of an account number on a statement: you can still recognize the transaction, but someone else cannot reuse the number. This protects the display and replay, not a credential that has already leaked elsewhere.

You switch back to the terminal to finish a command, type a few letters, and they vanish or stall. This release fixes three moments that could lose or block input: focus returning to the window, MCP servers initializing, and Ghostty handling keyboard shortcuts. It is like a phone line that still catches your first sentence while the operator sits down, the back office boots up, or someone presses an extension key.

Japanese text, emoji, and hyperlinks can take up screen space in ways a terminal must count carefully. This release corrects their rendering and cursor positions, including text near the edge of the visible viewport. It is like a ruler on graph paper finally recognizing wide and narrow characters, measuring before it reaches the paper's edge instead of drawing the next square off the page.

On Windows, asking Codex to stop a background process now properly interrupts it instead of waiting for it to finish on its own. Windows filesystem paths are also handled consistently, so one folder is not mistaken for another because its address is written differently. It is like wiring the emergency switch to every machine and standardizing every street number at the same time.

When you need to check how Codex works, choose a model, or connect an API workflow, the bundled OpenAI documentation skill now performs more targeted official-source lookup and gives clearer guidance. It is like a librarian first hearing whether you need a manual, a model comparison, or a wiring diagram, then walking you to that shelf instead of wheeling over the whole building.

Several internal parts move forward in this release: MCP SDK 3.0.0, Ratatui 0.30.2, and V8 150.4.0. macOS release notarization now uses Azure Key Vault rather than exporting private signing keys. Linux also stops publishing redundant bundle archives and uses the standard codex-package-<target> archives. Think of updating a factory production line: the equipment is replaced, the signing seal stays in a storage cabinet at the factory, and every shipment uses one box standard.

If a script still says codex exec --full-auto, that flag has been removed. Use --sandbox workspace-write instead. A sandbox limits where a program may act; this setting limits writes to the workspace. It is like retiring an old master key and issuing a card that opens the office only. When updating automation, replace the old flag with the new argument.