Codex 0.147.0

Moving to another computer or workspace no longer means hunting down your add-ons again. You can install portable Agent Plugins and search local, personal, workspace, and remote catalogs for them. Think of a portable toolbox: its tools can be found in different tool cabinets; if the seal check fails, the box does not connect to external lines yet. The release also tightens plugin isolation and denies network access if a policy update fails.

When a chat runs for weeks, finding one decision can feel like opening a notebook at random. Conversations can now live in persistent sections that you order yourself, while long transcripts load a piece at a time. You can also import Cursor-managed skills, and imported Claude and Cursor conversations stay synchronized without spawning duplicates. It is like labeling notebooks, turning pages as needed, and keeping two copies aligned.

For repeated command-line work, the new --approve-for-me flag enables automatically reviewed approvals, so every routine step need not stop for a click. An unfamiliar local project does not get that treatment: Codex asks for explicit trust and applies managed authentication restrictions before using credentials. It is like a parcel locker that accepts packages matching its rules, while an unmarked box still waits for your signature.

When Codex connects to an outside service, it can now opt into the 2026-07-28 MCP protocol. Long tool lists can be discovered page by page, requests can take multiple rounds, and a server can start in the background instead of blocking the rest of the work. It is like reading a menu one page at a time and ordering another course while the kitchen is still warming up.

When Codex runs through Amazon Bedrock, web searches can use a cache, keeping results already fetched handy, and long conversations can be compacted remotely into shorter context. Think of a travel notebook: put map pages you have checked into a pocket and turn back to them when needed; when there is too much content, condense old pages into a summary and the trip still holds together.

A command pasted into a screen share should not also paste your keys. Codex now redacts secrets and complete bearer tokens from displayed commands and replayed conversation history. It is like blacking out the middle of an account number on a statement: you can still recognize the transaction, but someone else cannot reuse the number. This protects the display and replay, not a credential that has already leaked elsewhere.

You switch back to the terminal to finish a command, type a few letters, and they vanish or stall. This release fixes three moments that could lose or block input: focus returning to the window, MCP servers initializing, and Ghostty handling keyboard shortcuts. It is like a phone line that still catches your first sentence while the operator sits down, the back office boots up, or someone presses an extension key.

Japanese text, emoji, and hyperlinks can take up screen space in ways a terminal must count carefully. This release corrects their rendering and cursor positions, including text near the edge of the visible viewport. It is like a ruler on graph paper finally recognizing wide and narrow characters, measuring before it reaches the paper's edge instead of drawing the next square off the page.

On Windows, asking Codex to stop a background process now properly interrupts it instead of waiting for it to finish on its own. Windows filesystem paths are also handled consistently, so one folder is not mistaken for another because its address is written differently. It is like wiring the emergency switch to every machine and standardizing every street number at the same time.

When you need to check how Codex works, choose a model, or connect an API workflow, the bundled OpenAI documentation skill now performs more targeted official-source lookup and gives clearer guidance. It is like a librarian first hearing whether you need a manual, a model comparison, or a wiring diagram, then walking you to that shelf instead of wheeling over the whole building.

Several internal parts move forward in this release: MCP SDK 3.0.0, Ratatui 0.30.2, and V8 150.4.0. macOS release notarization now uses Azure Key Vault rather than exporting private signing keys. Linux also stops publishing redundant bundle archives and uses the standard codex-package-<target> archives. Think of updating a factory production line: the equipment is replaced, the signing seal stays in a storage cabinet at the factory, and every shipment uses one box standard.

If a script still says codex exec --full-auto, that flag has been removed. Use --sandbox workspace-write instead. A sandbox limits where a program may act; this setting limits writes to the workspace. It is like retiring an old master key and issuing a card that opens the office only. When updating automation, replace the old flag with the new argument.