Release 0.119.0-alpha.2

New Features

• Windows sandbox runs can now enforce proxy-only networking with OS-level egress rules, instead of relying on environment variables alone. (#12220)
• App-server clients can now start ChatGPT sign-in with a device code flow, which helps when browser callback login is unreliable or unavailable. (#15525)
• codex exec now supports the prompt-plus-stdin workflow, so you can pipe input and still pass a separate prompt on the command line. (#15917)
• Custom model providers can now fetch and refresh short-lived bearer tokens dynamically, instead of being limited to static credentials from config or environment variables. (#16286, #16287, #16288)

Bug Fixes

• Project-local .codex files are now protected even on first creation, closing a gap where the initial write could bypass normal approval checks. (#15067)
• Linux sandbox launches are more reliable because Codex once again finds a trusted system bwrap on normal multi-entry PATHs. (#15791, #15973)
• The app-server-backed TUI regained several missing workflows: hook notifications replay correctly, /copy and /resume <name> work again, /agent no longer shows stale threads, and the skills picker scrolls past the first page. (#16013, #16021, #16050, #16014, #16109, #16110)
• MCP startup is more robust: local servers get a longer startup window, and failed handshakes surface warnings in the TUI again instead of looking like clean startups. (#16080, #16041)
• On Windows, apply_patch is less likely to fail because it no longer adds redundant writable roots that could trigger unnecessary ACL churn. (#16030)

Changelog

Full Changelog: rust-v0.117.0...rust-v0.118.0

• #15891 [plugins] Polish tool suggest prompts. @mzeng-openai
• #15791 fix: resolve bwrap from trusted PATH entry @viyatb-oai
• #15900 skills: remove unused skill permission metadata @bolinfest
• #15811 app-server: Split transport module @euroelessar
• #15067 Protect first-time project .codex creation across Linux and macOS sandboxes @rreichel3-oai
• #15903 [codex] import token_data from codex-login directly @bolinfest
• #15897 sandboxing: use OsString for SandboxCommand.program @bolinfest
• #15910 docs: update AGENTS.md to discourage adding code to codex-core @bolinfest
• #15898 chore: move bwrap config helpers into dedicated module @viyatb-oai
• #15906 chore: remove skill metadata from command approval payloads @bolinfest
• #15909 fix(network-proxy): fail closed on network-proxy DNS lookup errors @viyatb-oai
• #14495 Preserve bazel repository cache in github actions @siggisim
• #15522 bazel: re-organize bazelrc @sluongng
• #15923 codex-tools: extract shared tool schema parsing @bolinfest
• #15918 permissions: remove macOS seatbelt extension profiles @bolinfest
• #12220 feat(windows-sandbox): add network proxy support @viyatb-oai
• #15931 fix: make MACOS_DEFAULT_PREFERENCES_POLICY part of MACOS_SEATBELT_BASE_POLICY @bolinfest
• #15933 fix: use matrix.target instead of matrix.os for actions/cache build action @bolinfest
• #15928 codex-tools: extract MCP schema adapters @bolinfest
• #15948 fix: increase timeout for rust-ci to 45 minutes for now @bolinfest
• #15921 [app-server-protocol] introduce generic ClientResponse for app-server-protocol @rhan-oai
• #15120 chore: refactor network permissions to use explicit domain and unix socket rule maps @celia-oai
• #15525 Add ChatGPT device-code login to app server @daniel-oai
• #15876 chore: drop useless stuff @jif-oai
• #15954 chore: move pty and windows sandbox to Rust 2024 @bolinfest
• #15986 feat: spawn v2 make task name as mandatory @jif-oai
• #16000 Use codex-utils-template for login error page @jif-oai
• #16001 Use codex-utils-template for review prompts @jif-oai
• #15998 Use codex-utils-template for sandbox mode prompts @jif-oai
• #15995 Use codex-utils-template for collaboration mode presets @jif-oai
• #15996 Use codex-utils-template for search tool descriptions @jif-oai
• #15999 Use codex-utils-template for review exit XML @jif-oai
• #15985 feat: spawn v2 as inter agent communication @jif-oai
• #15973 fix(sandbox): fix bwrap lookup for multi-entry PATH @viyatb-oai
• #15944 codex-tools: extract dynamic tool adapters @bolinfest
• #15955 ci: add Bazel clippy workflow for codex-rs @bolinfest
• #15953 codex-tools: introduce named tool definitions @bolinfest
• #16027 fix: fix Windows CI regression introduced in #15999 @bolinfest
• #16036 fix: disable plugins in SDK integration tests @bolinfest
• #15946 Normalize /mcp tool grouping for hyphenated server names @pakrym-oai
• #16035 plugins: Clean up stale curated plugin sync temp dirs and add sync metrics @xl-openai
• #15934 Add usage-based business plan types @bwanner-oai
• #16031 codex-tools: extract responses API tool models @bolinfest
• #16013 Fix tui_app_server hook notification rendering and replay @etraut-openai
• #16021 Fix /copy regression in tui_app_server turn completion @etraut-openai
• #16044 [mcp] Bypass read-only tool checks. @mzeng-openai
• #16030 don't include redundant write roots in apply_patch @iceweasel-oai
• #15922 Remove the legacy TUI split @etraut-openai
• #15828 [codex] Pin GitHub Actions workflow references @hintz-openai
• #16046 ci: run SDK tests with a Bazel-built codex @bolinfest
• #16050 Fix tui_app_server resume-by-name lookup regression @etraut-openai
• #16014 Fix tui_app_server agent picker closed-state regression @etraut-openai
• #16054 chore: clean up argument-comment lint and roll out all-target CI on macOS @bolinfest
• #15917 Support Codex CLI stdin piping for codex exec @jliccini
• #16057 shell-command: reuse a PowerShell parser process on Windows @bolinfest
• #16063 refactor: rewrite argument-comment lint wrappers in Python @bolinfest
• #15952 bazel: enable the full Windows gnullvm CI path @bolinfest
• #16067 ci: run Bazel clippy on Windows gnullvm @bolinfest
• #16071 fix: clean up remaining Windows argument-comment-lint violations @bolinfest
• #16072 ci: split fast PR Rust CI from full post-merge Cargo CI @bolinfest
• #16074 bazel: add Windows gnullvm stack flags to unit test binaries @bolinfest
• #16026 fix(tui): refresh footer on collaboration mode changes @fcoury
• #16112 Update PR babysitter skill for review replies and resolution @etraut-openai
• #16104 Rename tui_app_server to tui @etraut-openai
• #16118 fix: fix comment linter lint violations in Linux-only code @bolinfest
• #16106 build: migrate argument-comment-lint to a native Bazel aspect @bolinfest
• #16115 Remove remaining custom prompt support @etraut-openai
• #16116 Remove the codex-tui app-server originator workaround @etraut-openai
• #16047 codex-tools: extract tool spec models @bolinfest
• #16128 bazel: refresh the expired macOS SDK pin @bolinfest
• #16129 codex-tools: extract configured tool specs @bolinfest
• #16130 ci: keep rust-ci-full Windows argument-comment-lint on packaged wrapper @bolinfest
• #16126 core: fix stale curated plugin cache refresh races @bolinfest
• #16132 codex-tools: extract code mode tool spec adapters @bolinfest
• #16136 ci: use BuildBuddy for rust-ci-full non-Windows argument-comment-lint @bolinfest
• #16137 exec: make review-policy tests hermetic @bolinfest
• #16109 Fix skills picker scrolling in tui app server @etraut-openai
• #16138 codex-tools: extract local host tool specs @bolinfest
• #16114 Remove TUI voice transcription feature @etraut-openai
• #16080 [mcp] Increase MCP startup timeout. @mzeng-openai
• #16141 codex-tools: extract collaboration tool specs @bolinfest
• #16041 Fix app-server TUI MCP startup warnings regression @etraut-openai
• #16110 Fix tui_app_server ghost subagent entries in /agent @etraut-openai
• #16154 codex-tools: extract utility tool specs @bolinfest
• #16204 [codex] Normalize Windows path in MCP startup snapshot test @etraut-openai
• #16010 feat: add mailbox concept for wait @jif-oai
• #16237 fix: ma1 @jif-oai
• #16193 codex-tools: extract discovery tool specs @bolinfest
• #16254 codex-tools: extract discoverable tool models @bolinfest
• #16253 fix: close Bazel argument-comment-lint CI gaps @bolinfest
• #16225 [codex-analytics] refactor analytics to use reducer architecture @rhan-oai
• #16279 Update code mode exec() instructions @andmis
• #16120 ci: run Windows argument-comment-lint via native Bazel @bolinfest
• #16286 auth: generalize external auth tokens for bearer-only sources @bolinfest
• #16287 auth: let AuthManager own external bearer auth @bolinfest
• #16288 core: support dynamic auth tokens for model providers @bolinfest

Release 0.119.0-alpha.1

Release 0.118.0-alpha.5

Release 0.118.0-alpha.4

Release 0.118.0-alpha.3

Release 0.118.0-alpha.2

New Features

• Plugins are now a first-class workflow: Codex can sync product-scoped plugins at startup, browse them in /plugins, and install or remove them with clearer auth/setup handling. (#15041, #15042, #15195, #15215, #15217, #15264, #15275, #15342, #15580, #15606, #15802)
• Sub-agents now use readable path-based addresses like /root/agent_a, with structured inter-agent messaging and agent listing for multi-agent v2 workflows. (#15313, #15515, #15556, #15570, #15621, #15647)
• The /title terminal-title picker now works in both the classic TUI and the app-server TUI, making parallel sessions easier to tell apart. (#12334, #15860)
• App-server clients can now send ! shell commands, watch filesystem changes, and connect to remote websocket servers with bearer-token auth. (#14988, #14533, #14847, #14853)
• Image workflows got smoother: view_image now returns image URLs for code mode, generated images are reopenable from the TUI, and image-generation history survives resume. (#15072, #15154, #15223)
• Prompt history recall now works in the app-server TUI, including across sessions. (#14945)

Bug Fixes

• tui_app_server no longer duplicates live reasoning summaries or /review output, and it preserves transcript text instead of dropping it under backpressure. (#15758, #15839, #15759)
• ChatGPT login in tui_app_server now opens the local browser again, cancels cleanly on Ctrl+C, and no longer fails startup when you're logged out. (#15672, #15673, #15670)
• Early exits now restore terminal state reliably, avoiding broken shell state after quitting; tmux users also get a working queued-message edit shortcut on Shift+Left. (#15671, #15480)
• Linux sandboxed tool calls are more reliable on older distributions with older bubblewrap, and Windows restricted-token sandboxing now supports more split-policy carveout layouts. (#15693, #14172)
• Remote multi-agent sessions now show agent names instead of raw IDs and recover more gracefully from stale turn-steering races. (#15513, #15714, #15163)
• Plugin-backed mentions and product gating now behave more predictably, fixing cases where explicit mentions lost context or plugins were filtered incorrectly. (#15372, #15263, #15279)

Documentation

• Expanded the app-server and exec-server docs/schema fixtures to cover exec-server setup, filesystem watch RPCs, realtime transcript notifications, and the new Python thread.run(...) quickstart flow. (#15089, #14533, #15344, #15088)

Chores

• The app-server-backed TUI is now enabled by default, and the plugin/app rollout flags have been flipped on in normal builds. (#15661, #15713, #15719, #15820)
• Removed the legacy artifact tool and retired the old read_file and grep_files handlers as part of ongoing tool-surface cleanup. (#15851, #15864, #15773, #15775)

Changelog

Full Changelog: rust-v0.116.0...rust-v0.117.0

• #14945 feat(tui): restore composer history in app-server tui @fcoury
• #15092 fix: try to fix "Stage npm package" step in ci.yml @bolinfest
• #15075 Propagate tool errors to code mode @pakrym-oai
• #15072 Return image URL from view_image tool @pakrym-oai
• #15076 Add a startup deprecation warning for custom prompts @etraut-openai
• #15102 Revert "fix: harden plugin feature gating" @xl-openai
• #15077 Add final message prefix to realtime handoff output @aibrahim-oai
• #13494 Align SQLite feedback logs with feedback formatter @charley-oai
• #14888 Feat: reuse persisted model and reasoning effort on thread resume @shijie-oai
• #15111 don't add transcript for v2 realtime @aibrahim-oai
• #15103 Add update_plan code mode result @pakrym-oai
• #15100 Add apply_patch code mode result @pakrym-oai
• #15104 fix: harden plugin feature gating @xl-openai
• #15089 Add exec-server stub server and protocol docs @starr-openai
• #15042 Support featured plugins @alexsong-oai
• #15088 Add Python SDK thread.run convenience methods @shaqayeq-oai
• #15119 Remove stdio transport from exec server @pakrym-oai
• #14632 feat(core, tracing): create turn spans over websockets @owenlin0
• #15011 Forward session and turn headers to MCP HTTP requests @nicholasclark-openai
• #15118 [hooks] turn_id extension for Stop & UserPromptSubmit @eternal-openai
• #14970 Simple directory mentions @canvrno-oai
• #14988 Add thread/shellCommand to app server API surface @etraut-openai
• #15041 feat: support product-scoped plugins. @xl-openai
• #15056 feat: add graph representation of agent network @jif-oai
• #15163 fix: case where agent is already closed @jif-oai
• #15125 Move environment abstraction into exec server @pakrym-oai
• #15180 chore: add metrics for profile @jif-oai
• #15175 chore: morpheus does not generate memories @jif-oai
• #15185 Revert "Forward session and turn headers to MCP HTTP requests" @nicholasclark-openai
• #14867 [hooks] use a user message > developer message for prompt continuation @eternal-openai
• #15196 Add experimental exec server URL handling @pakrym-oai
• #15198 Publish runnable DotSlash package for argument-comment lint @bolinfest
• #15090 Add exec-server process and filesystem RPCs @starr-openai
• #15201 Log automated reviewer approval sources distinctly @gabec-openai
• #12334 feat(tui): add /title terminal title configuration @yvolovich-cyber
• #15206 feat(tracing): tag app-server turn spans with turn_id @owenlin0
• #15216 Move terminal module to terminal-detection crate @aibrahim-oai
• #15207 add specific tool guidance for Windows destructive commands @iceweasel-oai
• #15154 adding full imagepath to tui @won-openai
• #15217 feat: expose needs_auth for plugin/read. @xl-openai
• #15190 Plumb MCP turn metadata through _meta @nicholasclark-openai
• #15220 feat(app-server): add mcpServer/startupStatus/updated notification @owenlin0
• #15222 changed save directory to codex_home @won-openai
• #15232 Refactor ExecServer filesystem split between local and remote @pakrym-oai
• #15021 V8 Bazel Build @cconger
• #15150 Move auth code into login crate @aibrahim-oai
• #15195 [plugins] Install MCPs when calling plugin/install @mzeng-openai
• #15254 core: add a full-buffer exec capture policy @bolinfest
• #15263 fix: Distinguish missing and empty plugin products @xl-openai
• #15253 Split features into codex-features crate @aibrahim-oai
• #15233 Split exec process into local and remote implementations @starr-openai
• #15199 Use released DotSlash package for argument-comment lint @bolinfest
• #15215 Initial plugins TUI menu - list and read only. tui + tui_app_server @canvrno-oai
• #15252 Disable hooks on windows for now @eternal-openai
• #15264 feat: Add One-Time Startup Remote Plugin Sync @xl-openai
• #15262 Add guardian follow-up reminder @charley-oai
• #15223 Feat/restore image generation history @won-openai
• #15275 feat: prefer git for curated plugin sync @xl-openai
• #14869 Add remote env CI matrix and integration test @pakrym-oai
• #15218 Add temporary app-server originator fallback for codex-tui @etraut-openai
• #15328 try to fix bazel @jif-oai
• #15324 Add remote test skill @pakrym-oai
• #15313 feat: change multi-agent to use path-like system instead of uuids @jif-oai
• #15244 Pin Python SDK app-server stdio to UTF-8 on Windows @shaqayeq-oai
• #15337 Bump aws-lc-rs @cconger
• #15203 Add v8-poc consumer of our new built v8 @cconger
• #15273 [apps] Use ARC for yolo mode. @mzeng-openai
• #15128 chore(core) Remove Feature::PowershellUtf8 @dylan-hurd-oai
• #15344 Add realtime transcript notification in v2 @aibrahim-oai
• #15285 Gate tui /plugins menu behind flag @canvrno-oai
• #15114 fix: allow restricted filesystem profiles to read helper executables @celia-oai
• #15231 chore(core) update prefix_rule guidance @dylan-hurd-oai
• #15036 fix(core) disable command_might_be_dangerous when unsandboxed @dylan-hurd-oai
• #15348 Pass platform param to featured plugins @alexsong-oai
• #15276 Code mode on v8 @cconger
• #15372 [plugins] Fix plugin explicit mention context management. @mzeng-openai
• #15366 chore(context) Include guardian approval context @dylan-hurd-oai
• #15390 Remove legacy app-server notification handling from tui_app_server @etraut-openai
• #15409 Add JIT entitlement for macosx @cconger
• #15414 Remove legacy auth and notification handling from tui_app_server @etraut-openai
• #15376 [apps] Improve app tools loading for TUI. @mzeng-openai
• #15415 chore(exec_policy) ExecPolicyRequirementScenario tests @dylan-hurd-oai
• #15464 Remove smart_approvals alias migration @charley-oai
• #15443 core: snapshot fork startup context injection @charley-oai
• #15480 Use Shift+Left to edit queued messages in tmux @charley-oai
• #15317 nit: guard -> registry @jif-oai
• #15338 fix: fall back to vendored bubblewrap when system bwrap lacks --argv0 @bolinfest
• #15520 fix: cargo deny @jif-oai
• #15279 Label plugins as plugins, and hide skills/apps for given plugin @canvrno-oai
• #15259 tui: queue follow-ups during manual /compact @charley-oai
• #15515 feat: structured multi-agent output @jif-oai
• #15357 Fix: proactive auth refresh to reload guarded disk state first @celia-oai
• #15342 Plugins TUI install/uninstall @canvrno-oai
• #15540 chore: split sub-agent v2 implementation @jif-oai
• #15516 Thread guardian Responses API errors into denial rationale @charley-oai
• #15378 feat: support disable skills by name. @xl-openai
• #15529 Unify realtime stop handling in TUI @aibrahim-oai
• #15557 fix: main tui @jif-oai
• #15556 feat: new op type for sub-agents communication @jif-oai
• #15211 [hooks] add non-streaming (non-stdin style) shell-only PreToolUse support @eternal-openai
• #15560 feat: use serde to differenciate inter agent communication @jif-oai
• #15426 chore(core) Add approvals reviewer to UserTurn @dylan-hurd-oai
• #15562 [codex] Add rollback context duplication snapshot @charley-oai
• #15570 feat: custom watcher for multi-agent v2 @jif-oai
• #15575 feat: custom watcher for multi-agent v2 @jif-oai
• #15576 feat: custom watcher for multi-agent v2 @jif-oai
• #15360 fix: buil...

Release 0.117.0-alpha.25

Release 0.117.0-alpha.24