Codex 0.151.0

在連接選用或非必要的 MCP（Model Context Protocol，讓 AI 連接外部工具的協定）伺服器時，若外部工具啟動稍慢，搜尋流程不再立刻判定逾時。系統為非必要 MCP 伺服器的工具探索過程新增了可自訂的 grace period（寬限期，等待回應的緩衝時間）。當你掛載需要暖機或遠端連線的擴充伺服器時，可自行設定等待寬限時間，讓所有外部工具都有充裕時間完成註冊。

需要過濾敏感資料或微調工具輸出格式的開發者，現在能在資料管線中精準介入。擴充套件獲得了在 MCP（Model Context Protocol，讓 AI 連接外部工具的協定）工具執行完畢後、回傳結果尚未送交模型之前，先行檢視或替換該結果的能力。你可以藉此檢查輸出的資料結構，或在必要時抽換回傳內容，避免原始雜訊或機密資訊直接進入模型的提示詞脈絡。

在專案中管理多個外掛來源時，外掛目錄的設定整合變得更加周全。外掛目錄現在會主動合併各個儲存庫（repository，存放專案程式碼與歷史紀錄的目錄）的個別設定。同時，當專案中存在格式錯誤或無法連線的無效市集（marketplace）時，系統會明確回報該問題，而不會因此隱藏其他正常可用的有效外掛。這讓你在排除特定市集故障時，依然能順暢存取其餘工具。

在終端機互動操作時，安全防護的連貫性獲得了加強。在 TUI（終端機使用者介面，在純文字終端裡操作的互動畫面）的多輪對話中，系統現在會妥善保留先前還原的權限設定檔。這些 permission profiles 不會在下一輪對話中遺失狀態。此外，當在對話中執行 /cd 指令切換目錄時，系統會嚴格防止沙盒（sandbox，隔離程式執行範圍的防護機制）的存取限制被削弱，確保邊界防護不留漏洞。

在對話中更換使用的 AI 模型時，工具配置與推論參數不再出現錯亂。當你手動切換模型，或是觸發 fallback（備援，改用另一個模型接手）機制時，目標模型的工具可用性都會被精確維持。同時，模型進行深度思考的 reasoning effort（推理強度，思考運算量的設定）也會維持正確。這避免了切換後工具清單遺失或推論設定不相容的情況。

在遠端主機上隔離執行指令時，沙盒的邊界檢查現在完全貼合目標環境的真實狀態。系統強化了遠端沙盒（sandbox，隔離執行範圍的安全機制）的防護。權限判定改為直接依據遠端執行器實際的家目錄（home directory）、作業系統以及路徑慣例進行計算。這消除了本機與遠端主機因斜線方向或大小寫等格式差異而產生的判定偏差。

當外部服務呼叫失敗時，應用程式伺服器現在能為前端提供完整詳細的錯誤資訊。在與 MCP（Model Context Protocol，讓 AI 連接外部工具的協定）伺服器溝通時，若工具執行或資源讀取發生例外，app-server 的回應會完整保留結構化的錯誤代碼與詳細欄位。這避免了將錯誤壓平成字串而遺失細節，讓開發者能精確定位問題發生的根源。

指派多層任務讓 AI 自行拆解執行時，運算資源的控管變得更加嚴密。當主要任務委派多層巢狀子代理（subagent，分派任務的次級助手）協同作業時，其資源消耗有了統籌計算。所有子代理消耗的 token（AI 處理與計費的文字單位）用量，現在都會全數計入根目標的總預算中。這防止了底層子代理消耗過多運算資源而超出整體預算的狀況。

調整防護等級時，系統的安全閘門能即時反映最新狀態。Guardian（負責審查指令安全性並進行風險分類的防護機制）過去留存的判定結果，在使用者更改權限設定後不再被沿用。系統現在會在權限狀態變更時立即將舊判定標記為失效，嚴格防止過期（stale，不再適用於當前狀態的舊資料）分類資料在新的權限規則下誤放行危險操作。這確保了每一次安全決策都符合當前的防護規則。

系統運作監控與除錯分析的涵蓋範圍在本次更新中獲得擴充。當 stdin（標準輸入，程式接收打字或指令輸入的管道）審查需要升級時，系統會自動記錄相關事件。在遠端執行器探索 MCP（Model Context Protocol，讓 AI 連接外部工具的協定）伺服器時，也會發送對應的遙測數據。這協助維護者深入掌握安全審查與遠端工具連接的執行狀況。

When connecting to optional MCP (Model Context Protocol) servers, tool discovery will no longer fail immediately if an external tool takes a moment to respond. Codex introduces a configurable grace period for discovering tools from optional MCP servers. This gives background or remote servers enough time to complete initialization and register their tools.

Developers who need to sanitize tool outputs or adjust formats can now intercept data directly in the pipeline. Extensions can now inspect or replace MCP (Model Context Protocol) tool execution results before they are delivered to the model. This allows custom logic to filter out sensitive data or rewrite payload structures before the model processes them.

Managing plugin sources across projects is now much more reliable. Plugin catalogs now combine per-repository configuration into their listings. Furthermore, when a project contains an invalid marketplace, the system reports the issue clearly without hiding the remaining valid plugins. You can troubleshoot broken marketplace links while continuing to use all working extensions.

Security consistency in the terminal interface is now reinforced. Restored permission profiles are properly preserved across turns in the TUI (terminal user interface). Switching directories using the /cd command is strictly prevented from loosening or bypassing active sandbox restrictions, keeping execution boundaries intact.

Switching models mid-task no longer disrupts tool setups or reasoning levels. When you manually switch models or trigger a fallback to an alternative model, Codex now keeps tool availability and reasoning effort aligned with the target model. This prevents tools from vanishing unexpectedly and ensures reasoning parameters remain valid for the active provider.

Running commands in remote environments now benefits from accurate isolation boundaries. Remote sandbox enforcement now aligns with the executor's actual home directory, operating system, and path conventions. This eliminates authorization discrepancies caused by mismatched path separators, root structures, or platform conventions between local and remote hosts.

When external services encounter issues, app-server responses now preserve structured MCP (Model Context Protocol) tool and resource errors. Rather than flattening error responses into plain text strings, the system keeps structured fields intact so client applications and developers can programmatically handle failures and identify root causes.

Budget tracking across multi-agent workflows is now strictly enforced. When a primary task delegates work to nested subagents across multiple tiers, token consumption from every child agent is counted toward the root goal budget. This prevents deep subagent branches from silently exceeding the project token allocation.

Security enforcement now reacts instantly whenever authorization rules change. Previously cached classifications from Guardian (the security component that categorizes action risks) are no longer used after permission states change. The system invalidates stale classification data immediately upon permission updates, ensuring that outdated approvals cannot authorize new actions after permission state changes.

Observability into security reviews and remote connections is now expanded. Codex introduces dedicated telemetry tracking for escalated stdin reviews whenever interactive input requires elevated approval. It also logs remote executor MCP (Model Context Protocol) discovery events, giving maintainers clearer visibility into tool registration flows.