mirror of
https://github.com/openai/codex.git
synced 2026-08-23 13:09:46 +00:00
758ef40f50
- Added an interactive `codex agents` dashboard for searching, starting, opening, renaming, and stopping tasks, with configurable shortcuts. (#39094, #39112, #39114, #39142) - Added `/cd`, `/pwd`, and `/cwd` commands for managing the working directory in TUI sessions. (#38894) - Added `codex queue` for sending messages to existing local or remote sessions. (#39092) - Expanded Vim editing with character replacement and more change motions such as `cw`, `c$`, and `cc`. (#39661) - `codex doctor` now diagnoses endpoint protection, network/proxy failures, desktop app state, and update connectivity. (#38827, #38918, #39060, #39074) - SDK users can now pass exact CLI config overrides and select `max` or `ultra` reasoning effort. (#38817, #39662) ## Bug Fixes - Queued messages now wake idle sessions reliably, resolve duplicate session names more usefully, and preserve pasted or deferred command semantics. (#39034, #39385, #39604) - Resumed and forked threads now restore their active permission profile instead of silently falling back to current defaults. (#39153) - Fixed duplicate sub-agent activity and tightened TUI routing for sub-agent notifications and approvals. (#39049, #39088) - Realtime WebRTC sideband connections now reconnect after unexpected transport loss without dropping pending output. (#39257) - Inline TUI history now remains available in Windows Terminal scrollback. (#39619) - Inactive TUI thread replay buffers are now bounded to prevent excessive retained streamed output. (#39081) ## Documentation - Clarified that external contributions should go through issues and design discussion rather than pull requests. (#39089) - Documented DNS exfiltration risks and trust limitations for secure devcontainers. (#39283) ## Changelog Full Changelog: https://github.com/openai/codex/compare/rust-v0.148.0...rust-v0.149.0 - #38817 Add raw config overrides to the TypeScript SDK @copyberry - #38819 Support metadata staging for reserved thread IDs @copyberry - #38822 Avoid cloning TUI history span content @copyberry - #38823 Avoid allocating per character when decorating hyperlinks @copyberry - #38827 Add endpoint protection checks to `codex doctor` @copyberry - #38830 Isolate external editor buffers from sandbox-writable paths @copyberry - #38837 Share editor keymaps across TUI composer components @copyberry - #38840 Identify Mac mini hosts in remote control handshakes @copyberry - #38893 Restore thread timestamp maxima independently @copyberry - #38894 Add working-directory commands to the TUI @copyberry - #38899 Move requirements policy ownership to execpolicy @copyberry - #38902 Honor per-environment shell variable policies @copyberry - #38907 Edit queued messages with Vim history-up @copyberry - #38913 Stop rendering columns after filling their area @copyberry - #38916 Honor legacy `:project_roots` permission entries @copyberry - #38918 Improve `codex doctor` network diagnostics @copyberry - #38919 Reject obsolete app-server permission profile fields @copyberry - #38921 Compact successful command activity in the TUI @copyberry - #38940 Add experimental app-server project APIs @copyberry - #38941 Prevent Noise auth tokens from reaching child processes @copyberry - #38942 Enforce environment-specific command policies @copyberry - #38947 Stop loading legacy managed config on Windows @copyberry - #38978 Add a configurable skill catalog token budget @copyberry - #38980 Bound Guardian v2 parent compaction context @copyberry - #38987 Include images in Guardian v2 transcripts @copyberry - #38990 Source Guardian v2 defaults from the model catalog @copyberry - #38993 Evaluate recent and character-routed skill selection @copyberry - #38994 Remove the workspace settings gate for apps and plugins @copyberry - #38997 Retry transient Guardian sampling failures @copyberry - #39001 Ignore stale Guardian tool risk scores @copyberry - #39005 Disable Guardian V2 for managed automatic reviewers @copyberry - #39006 Emit API-key turn cost telemetry from app-server @copyberry - #39007 Wait for Guardian score progress in approval tests @copyberry - #39008 Add task context to shadow skill selection @copyberry - #39017 Move MCP policy types into `codex-protocol` @copyberry - #39019 Isolate MCP resource headers during OAuth requests @copyberry - #39020 Restrict Windows IDE pipe client impersonation @copyberry - #39022 Hang soft-break whitespace in the TUI composer @copyberry - #39023 Reduce retained MCP result data in TUI history @copyberry - #39025 Speed up the large diff highlighting test @copyberry - #39026 Use simulated time in the long typing test @copyberry - #39028 Cache the test pet spritesheet encoding @copyberry - #39030 Speed up the in-app resume cwd test @copyberry - #39032 Encapsulate TUI shimmer under the motion module @copyberry - #39033 Bound legacy resume preview scans @copyberry - #39034 Dispatch queued messages written by other processes @copyberry - #39035 Add app-server coverage for Guardian V2 approval routing @copyberry - #39036 Allow config reads to join active app-server read batches @copyberry - #39038 Restore Guardian risk scores across thread lifecycles @copyberry - #39040 Preserve foreign paths in managed network approvals @copyberry - #39043 Enforce managed authentication backend settings @copyberry - #39045 Add managed gates for in-app chat and dictation @copyberry - #39046 Restrict MCP HTTP redirects to the configured origin @copyberry - #39047 Skip plugin hook loading when hooks are disabled @copyberry - #39049 Avoid rendering sub-agent activity twice in the TUI @copyberry - #39050 Prepare the telemetry shutdown worker during initialization @copyberry - #39051 Use installed callable apps for TUI mentions @copyberry - #39055 Add network policy metadata to environment configuration @copyberry - #39056 Verify the pinned zsh manifest in release builds @copyberry - #39057 Rate-limit TUI frames from their actual emission time @copyberry - #39058 Tag Codex Apps protocol discovery metrics @copyberry - #39060 Add desktop app diagnostics to `codex doctor` @copyberry - #39061 Avoid rerendering streamed code fences @copyberry - #39063 Render only visible rows in the transcript pager @copyberry - #39064 Restrict queued-message editing to its dedicated binding @copyberry - #39065 Limit terminal hyperlink layout to the visible viewport @copyberry - #39067 Add desktop security enforcement diagnostics @copyberry - #39068 Remove skill model delegation support @copyberry - #39072 Persist generated images through turn executors @copyberry - #39073 Propagate caller metadata to rendezvous connections @copyberry - #39074 Add desktop update diagnostics to `codex doctor` @copyberry - #39075 Avoid redundant terminal row clears @copyberry - #39077 Build filesystem JSON params only for remote TUI sessions @copyberry - #39078 Preserve tracing context for environment resolution @copyberry - #39079 Apply user MCP policy to selected executor plugins @copyberry - #39081 Bound TUI thread replay buffers by delta size @copyberry - #39082 Prompt for project trust in remote TUI workspaces @copyberry - #39083 Harden Windows sandbox provisioning against reparse points @copyberry - #39084 Preserve filesystem permission path conventions @copyberry - #39087 Read plugin authentication state from AuthManager @copyberry - #39088 Harden TUI subagent navigation @copyberry - #39089 Clarify the external contribution policy @copyberry - #39092 Add a command to queue messages for existing sessions @copyberry - #39094 Add an agents overview dashboard to the TUI @copyberry - #39098 Trace exec-server requests from receipt through completion @copyberry - #39100 Avoid redundant terminal size queries during history insertion @copyberry - #39101 Update rmcp to 3.1.2 @copyberry - #39102 Raise the GPT-5.6 maximum context window @copyberry - #39103 Drop capabilities from Linux sandbox processes @copyberry - #39112 Make the agents overview an interactive task dashboard @copyberry - #39113 Surface interactive requests in realtime conversations @copyberry - #39114 Add a dedicated `codex agents` dashboard command @copyberry - #39115 Remove the experimental thread config endpoint @copyberry - #39117 Reject lossy legacy permission projections @copyberry - #39122 Fail closed on deeply nested command wrappers @copyberry - #39131 Validate identifiers in plugin creator workflows @copyberry - #39141 Redact auth tokens from app-server response logs @copyberry - #39142 Add configurable shortcuts for the agents dashboard @copyberry - #39143 Hydrate recommended plugin metadata on selection @copyberry - #39145 Persist active permission profiles in turn context @copyberry - #39147 Centralize persisted resume settings lookup @copyberry - #39152 Update PyPI publish action to v1.14.2 @copyberry - #39153 Restore permission profiles when resuming threads @copyberry - #39154 Box the TUI future to bound CLI stack usage @copyberry - #39155 Prepare Python SDK 0.147.0 stable release @copyberry - #39157 Notify clients when Guardian requires strict review @copyberry - #39159 Require approval for commands with dynamic shell words @copyberry - #39163 Refresh collaboration instructions when their content changes @copyberry - #39165 Prevent marketplace identity spoofing @copyberry - #39174 Skip empty user messages for automatic idle turns @copyberry - #39176 Drop descendant progress updates after remote compaction @copyberry - #39187 Scope MCP app resource reads to their originating call @copyberry - #39192 Preserve MCP resource origins across compaction @copyberry - #39200 Add a symlink-safe reader for sensitive files @copyberry - #39205 Reject symbolic links in memory workspaces @copyberry - #39213 Add a fail-closed Tree-sitter PowerShell lowerer @copyberry - #39214 Prevent custom providers from inheriting ambient auth @copyberry - #39220 Reconnect Guardian sampling WebSockets after auth changes @copyberry - #39221 Skip redirected external-agent migration destinations @copyberry - #39224 Add Guardian v2 approval review metrics @copyberry - #39227 Include node_repl screenshots in Guardian v2 reviews @copyberry - #39235 Decouple Noise relay streams from JSON-RPC processing @copyberry - #39240 Deduplicate remote plugin bundle syncs with shared semaphores @copyberry - #39241 Record Guardian v2 classification metrics @copyberry - #39242 Add safe permission profile intersection @copyberry - #39244 Scope MCP resource reads by connector @copyberry - #39246 Give Guardian classifier connections distinct thread identities @copyberry - #39249 Add exec-server forwarding mode @copyberry - #39256 Deduplicate rollout moves when archiving threads @copyberry - #39257 Reconnect WebRTC Realtime sideband transports @copyberry - #39259 Simplify unified exec output snapshots @copyberry - #39261 Stop TUI chats on misalignment policy violations @copyberry - #39262 Prevent ConPTY DLL loading from the current directory @copyberry - #39264 Improve Guardian v2 risk classification @copyberry - #39266 Require fresh approval beneath denied permission paths @copyberry - #39267 Inject Node REPL policy into Guardian review sessions @copyberry - #39273 Preserve thread names during rollout migration @copyberry - #39274 Add provider-owned authentication recovery @copyberry - #39277 Declare experimental Amazon Bedrock setup APIs @copyberry - #39278 Preserve owner-provided environment configuration @copyberry - #39279 Propagate Windows sandbox ACL update failures @copyberry - #39281 Move shell snapshot scripts into `codex-shell-command` @copyberry - #39283 Document secure devcontainer DNS exfiltration risk @copyberry - #39284 Report network disconnects during approval @copyberry - #39285 Show file destinations in TUI change approvals @copyberry - #39287 Report diagnostic upload failures @copyberry - #39288 Register the async message feature flag @copyberry - #39290 Add Windows sandbox diagnostics to `codex doctor` @copyberry - #39293 Remove app-server's direct reqwest dependency @copyberry - #39294 Increase SQLite log sink batching @copyberry - #39296 Enable MCP tool hooks in Codex sessions @copyberry - #39298 Allow overriding Codex package versions @copyberry - #39299 Restrict agent roles to bounded configuration overrides @copyberry - #39301 Prevent Node REPL auth tokens from reaching child processes @copyberry - #39303 Record Guardian v2 classification token usage @copyberry - #39304 Keep Guardian v2 risk scores in memory @copyberry - #39306 Honor managed config during project discovery @copyberry - #39307 Fail closed on Guardian V2 risk scoring errors @copyberry - #39309 Attribute executor skill invocations to plugins @copyberry - #39311 Bind unified exec approvals to shell executables @copyberry - #39312 Add async delivery metadata to agent messages @copyberry - #39314 Run hooks with the captured session environment @copyberry - #39315 Evict guardian transcript entries in cacheable chunks @copyberry - #39316 Support Edu Plus and Edu Pro account plans @copyberry - #39319 Add the async user message tool @copyberry - #39320 Expand OAuth metadata redirect test coverage @copyberry - #39322 Enforce workspace restrictions for header authentication @copyberry - #39325 Stop migrating Cursor sandbox settings @copyberry - #39331 Route hook MCP calls through current connections @copyberry - #39335 Enforce environment MCP policies @copyberry - #39372 Scope TUI approval requests to their threads @copyberry - #39385 Prefer the most recent session when queueing by name @copyberry - #39402 Remove npm package staging from repo checks @copyberry - #39404 Support FD mounts with older system Bubblewrap versions @copyberry - #39410 Refresh expired AWS credentials for Bedrock @copyberry - #39452 Remove the feature gate for async user messages @copyberry - #39474 Consolidate Guardian extensions into `codex-guardian-v2` @copyberry - #39480 Move shell snapshot tests into shell-command @copyberry - #39493 Make head-tail buffer capacity const generic @copyberry - #39494 Test panoramic Guardian transcript image resizing @copyberry - #39496 Use default timeouts in cyber exec policy tests @copyberry - #39497 Correct normalized dynamic tool coverage across response modes @copyberry - #39501 Use a narrow fixture for the unified image resize test @copyberry - #39505 Test text stringify errors in the code mode runtime @copyberry - #39506 Test code mode notifications without a sync tool call @copyberry - #39509 Test disabled enhanced Node REPL transcript images separately @copyberry - #39510 Track built-in control tool calls in analytics @copyberry - #39514 Use stored item types when materializing turn summaries @copyberry - #39515 Use `mem::take` to drain unified exec output buffers @copyberry - #39520 Isolate automatic plugin Git operations @copyberry - #39523 Persist thread section moves before the first turn @copyberry - #39524 Stop treating Git commands as inherently safe @copyberry - #39584 Add a just recipe for assembling Codex packages @copyberry - #39585 Test plugin sync isolation from repository Git config @copyberry - #39586 Isolate IPC in Bubblewrap sandboxes @copyberry - #39588 Preserve unparsed shell wrappers in exec policy @copyberry - #39590 Harden plugin manifest handling during installation @copyberry - #39592 Prevent SQLx warnings from feeding back into SQLite logs @copyberry - #39594 Raise the MCP tool name limit to 128 bytes @copyberry - #39595 Keep marketplace upgrade state out of config @copyberry - #39597 Separate thread settings from environment configuration @copyberry - #39599 Protect macOS Seatbelt writable root anchors @copyberry - #39601 Keep async user messages on the direct tool surface @copyberry - #39602 Use in-process parsing for PowerShell command classification @copyberry - #39604 Preserve queued TUI input semantics @copyberry - #39605 Hide approved automatic review warnings in the TUI @copyberry - #39606 Enable user namespaces in shared CI setup @copyberry - #39607 Resolve model-provided shells by type @copyberry - #39608 Harden skill installation against unsafe symlinks @copyberry - #39609 Limit Bazel integration test threads on macOS @copyberry - #39611 Harden MCP OAuth fallback credential writes @copyberry - #39614 Prevent `apply_patch` from widening write permissions @copyberry - #39615 Bind MCP OAuth refresh tokens to their issuer @copyberry - #39616 Validate linked worktrees before inheriting project trust @copyberry - #39618 Apply composer editing preferences to TUI text prompts @copyberry - #39619 Preserve inline TUI scrollback in Windows Terminal @copyberry - #39620 Stream executor capability and skill file reads @copyberry - #39623 Prevent protected-path rename bypasses in macOS Seatbelt @copyberry - #39625 Add cwd-relative turn diff paths @copyberry - #39629 Preserve parent repository discovery through sandbox metadata mounts @copyberry - #39630 Retire the untrusted approval policy @copyberry - #39631 Skip sandboxed shell commands in Guardian v2 by default @copyberry - #39632 Expose permission profile resolution in the core API @copyberry - #39635 Show strict review warnings in the TUI @copyberry - #39637 Treat `invalid_grant` refresh failures as permanent @copyberry - #39640 Prompt to unarchive sessions before resuming or forking @copyberry - #39641 Sanitize developer context in full-history agent forks @copyberry - #39645 Enforce managed residency for model providers @copyberry - #39646 Exercise restricted-token sandboxing in cyber policy tests @copyberry - #39649 Resolve bundled Windows helpers through bin junctions @copyberry - #39653 Enforce filesystem permissions when loading AGENTS.md @copyberry - #39655 Make core integration test permissions explicit @copyberry - #39656 Advertise the Desktop app in graphical Linux sessions @copyberry - #39657 Warn when launching the deprecated MCP server @copyberry - #39658 Let Guardian V2 satisfy required model reviews @copyberry - #39659 Harden unsandboxed patch filesystem access @copyberry - #39661 Expand Vim change commands and add character replacement @copyberry - #39662 Add max and ultra reasoning efforts to the SDKs @copyberry - #39663 Restrict plugin migration to home scope @copyberry - #39665 Add macOS Seatbelt filesystem integration tests @copyberry - #39666 Improve no-follow filesystem behavior across platforms @copyberry
Codex CLI is a coding agent from OpenAI that runs locally on your computer.
If you want Codex in your code editor (VS Code, Cursor, Windsurf), install in your IDE.
If you want the desktop app experience, run
codex app or visit the Codex App page.
If you are looking for the cloud-based agent from OpenAI, Codex Web, go to chatgpt.com/codex.
Quickstart
Installing and running Codex CLI
Run the following on Mac or Linux to install Codex CLI:
curl -fsSL https://chatgpt.com/codex/install.sh | sh
Run the following on Windows to install Codex CLI:
powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"
The standalone installers download from https://releases.openai.com/codex by default and fall back to GitHub Releases if a metadata or asset download is unavailable. To force GitHub Releases, set CODEX_INSTALLER_USE_RELEASES_OPENAI_COM to false (0 and no are also accepted):
curl -fsSL https://chatgpt.com/codex/install.sh | CODEX_INSTALLER_USE_RELEASES_OPENAI_COM=false sh
$env:CODEX_INSTALLER_USE_RELEASES_OPENAI_COM='false'; irm https://chatgpt.com/codex/install.ps1 | iex
Codex CLI can also be installed via the following package managers:
# Install using npm
npm install -g @openai/codex
# Install using Homebrew
brew install --cask codex
Then simply run codex to get started.
You can also go to the latest GitHub Release and download the appropriate binary for your platform.
Each GitHub Release contains many executables, but in practice, you likely want one of these:
- macOS
- Apple Silicon/arm64:
codex-aarch64-apple-darwin.tar.gz - x86_64 (older Mac hardware):
codex-x86_64-apple-darwin.tar.gz
- Apple Silicon/arm64:
- Linux
- x86_64:
codex-x86_64-unknown-linux-musl.tar.gz - arm64:
codex-aarch64-unknown-linux-musl.tar.gz
- x86_64:
Each archive contains a single entry with the platform baked into the name (e.g., codex-x86_64-unknown-linux-musl), so you likely want to rename it to codex after extracting it.
Using Codex with your ChatGPT plan
Run codex and select Sign in with ChatGPT. We recommend signing into your ChatGPT account to use Codex as part of your Plus, Pro, Business, Edu, or Enterprise plan. Learn more about what's included in your ChatGPT plan.
You can also use Codex with an API key, but this requires additional setup.
Docs
This repository is licensed under the Apache-2.0 License.