Released: 2026-09-28
Browsing or organizing conversation history in the full-screen terminal interface now aligns more closely with everyday habits.
You can now enable copy-on-select and right-click paste in settings. Content copied from chat history fully preserves Markdown syntax, so it no longer loses formatting when pasted into other note-taking tools.
When you want to connect external services that require special authentication, you can now directly provide a dedicated key to establish the connection.
Codex now supports MCP servers that require a pre-registered OAuth client secret. You can add a server directly by running a command with dedicated flags in the terminal:
codex mcp add --oauth-client-secretThis allows you to smoothly connect and integrate authentication mechanisms that require pre-registered secrets into your daily workflow.
When the background execution server communicates in real time with the main program, security protection for the transmission channel is upgraded once again.
Codex now uses a bearer token to protect direct WebSocket connections to exec-server. This security protection also covers connection channels configured through app-server. Through token authentication, connections prevent unauthorized external access and ensure communication security.
When asking AI to create or modify image assets, generated images can be placed directly into presentations and webpages more conveniently.
You can now explicitly request a transparent background when issuing prompts to generate or modify images. The image editing feature also supports reading images saved as files directly from the conversation history, allowing you to continue adjusting visuals without re-exporting and uploading.
Asking questions or checking status while waiting for command review no longer accidentally interrupts the operation.
If new text is entered while in a pending review state, the review process automatically retries, ensuring status inquiries do not directly interrupt operations awaiting execution. For commands executed with elevated permissions, terminal input review is enabled by default, and runtime-only permissions no longer trigger redundant audits. When applying fixes on macOS, the system recognizes path aliases covered by existing permissions, avoiding duplicate confirmation prompts.
Stability is improved when running commands inside sandboxes across different operating systems.
On Windows, issues causing sandbox failures with standard Windows 10 paths, rejected saved credentials, and oversized permission policies have been fixed. On Linux, an error where sandboxes failed to start when containing nested writable roots has been resolved. Across multiple writable roots on Linux and macOS, protection mechanisms for Git metadata are also fully preserved.
Terminal chart compatibility is now more comprehensive when asking AI to generate flowcharts or architecture diagrams.
Mermaid flowcharts now properly render labels containing double quotes and "&" symbols. When encountering currently unsupported chart types, the screen clearly explains the reason for the fallback, preventing any confusion.
When monitoring command execution through a client application, initial output could previously be missed, and diagnosing why a process failed to launch was difficult.
Command completion events now include early output generated at the very beginning of execution. When launching a process fails, the error is actively reported to the client, making troubleshooting much more efficient.
Configure copy-on-select and right-click paste in the fullscreen TUI. Copied transcript selections now preserve Markdown formatting. (#47639, #47896, #48118)Connect to MCP servers that require pre-registered OAuth client secrets, including through `codex mcp add --oauth-client-secret`. (#47891)Secure direct exec-server WebSocket connections with bearer tokens, including connections configured through app-server. (#47601, #47648)Image generation and editing can explicitly request transparent backgrounds, and edits now accept file-backed conversation images. (#47484, #47956)Terminal input approval is enabled by default for commands running with elevated permissions; runtime-only grants no longer cause unnecessary reviews. (#47799, #48073)
macOS patch operations now recognize system path aliases covered by existing permissions, avoiding unnecessary approval prompts. (#47879)
Approval reviews now retry when new user input arrives, so a status question does not automatically abort a pending action. (#47819)Fixed Windows sandbox failures involving ordinary Windows 10 paths, rejected stored credentials, and large permission policies. (#47672, #47695, #47919)
Fixed Linux sandbox startup with nested writable roots and preserved Git metadata protections across writable roots on Linux and macOS. (#47623, #47974)Mermaid flowcharts now render quoted labels and ampersands; unsupported diagrams explain why they fall back to source. (#47572, #47678)Command completion events now include early output and report process-launch failures to clients. (#47529, #47665)