- Added a built-in `amazon-bedrock` model provider with configurable AWS profile support (#18744). - Added `/mcp verbose` for full MCP server diagnostics, resources, and resource templates while keeping plain `/mcp` fast (#18610). - Made plugin MCP loading accept both `mcpServers` and top-level server maps in `.mcp.json` (#18780). - Improved realtime handoffs so background agents receive transcript deltas and can explicitly stay silent when appropriate (#18597, #18761, #18635). - Added host-specific `remote_sandbox_config` requirements for remote environments (#18763). - Refreshed bundled model metadata, including the current `gpt-5.4` default (#18586, #18388, #18719). ## Bug Fixes - Fixed `/copy` after rollback so it copies the latest visible assistant response, not a pre-rollback response (#18739). - Queued normal follow-up text submitted while a manual shell command is running, preventing stuck `Working` states (#18820). - Fixed Unicode/dead-key input in VS Code WSL terminals by disabling the enhanced keyboard mode there (#18741). - Prevented stale proxy environment variables from being restored from shell snapshots (#17271). - Made `codex exec` inherit root-level shared flags such as sandbox and model options (#18630). - Removed leaked review prompts from TUI transcripts (#18659). ## Documentation - Added and tightened the Code Review skill instructions used by Codex-driven reviews (#18746, #18818). - Documented intentional await-across-lock cases and enabled Clippy linting for them (#18423, #18698). - Updated app-server protocol docs for threadless MCP resource reads and namespaced dynamic tools (#18292, #18413). ## Chores - Fixed high-severity dependency alerts by pinning patched JS and Rust dependencies (#18167). - Reduced Rust dev build debug-info overhead while preserving useful backtraces (#18844). - Refreshed generated Python app-server SDK types from the current schema (#18862). ## Changelog Full Changelog: https://github.com/openai/codex/compare/rust-v0.122.0...rust-v0.123.0 - #18662 feat: add metric to track the number of turns with memory usage @jif-oai - #18659 chore: drop review prompt from TUI UX @jif-oai - #18661 feat: log client use min log level @jif-oai - #18094 [codex] Use background agent task auth for backend calls @adrian-openai - #18441 Avoid false shell snapshot cleanup warnings @etraut-openai - #18260 [codex] Use background task auth for additional backend calls @adrian-openai - #18657 fix: auth.json leak in tests @jif-oai - #18610 Add verbose diagnostics for /mcp @etraut-openai - #18633 Use app server thread names in TUI picker @etraut-openai - #18591 Surface parent thread status in side conversations @etraut-openai - #18361 codex: move thread/name/set and thread/memoryModeSet into ThreadStore @wiltzius-openai - #18274 protocol: canonicalize file system permissions @bolinfest - #18403 refactor: use semaphores for async serialization gates @bolinfest - #18586 Update models.json @aibrahim-oai - #18289 Wire the PatchUpdated events through app_server @akshaynathan - #18631 Remove simple TUI legacy_core reexports @etraut-openai - #18697 [codex] Fix agent identity auth test fixture @adrian-openai - #18388 Update models.json @github-actions - #18167 [codex] Fix high severity dependency alerts @caseysilver-oai - #17692 [codex-analytics] guardian review analytics schema polishing @rhan-oai - #18722 chore(guardian) disable mcps and plugins @dylan-hurd-oai - #18597 Update realtime handoff transcript handling @guinness-oai - #18627 Surface TUI skills refresh failures @etraut-openai - #18719 Fix stale model test fixtures @aibrahim-oai - #18714 Add experimental remote thread store config @wiltzius-openai - #18739 fix(tui): keep /copy aligned with rollback @fcoury-oai - #18701 [codex] prefer inherited spawn agent model @tibo-openai - #18632 Use app server metadata for fork parent titles @etraut-openai - #18112 feat: cascade thread archive @jif-oai - #18716 Read conversation summaries through thread store @wiltzius-openai - #18635 Add realtime silence tool @guinness-oai - #18254 uds: add async Unix socket crate @euroelessar - #18746 Add Code Review skill @pakrym-oai - #18208 Add session config loader interface @rasmusrygaard - #18753 Refactor TUI app module into submodules @etraut-openai - #18630 Fix exec inheritance of root shared flags @etraut-openai - #18027 [6/6] Fail exec client operations after disconnect @aibrahim-oai - #17271 fix: fix stale proxy env restoration after shell snapshots @viyatb-oai - #18602 Warn when trusting Git subdirectories @etraut-openai - #18761 [codex] Send realtime transcript deltas on handoff @guinness-oai - #18435 /statusline & /title - Shared preview values @canvrno-oai - #18744 feat: add a built-in Amazon Bedrock model provider @celia-oai - #18581 [1/4] Add executor HTTP request protocol @aibrahim-oai - #18418 refactor: narrow async lock scopes @bolinfest - #18780 feat: Support more plugin MCP file shapes. @xl-openai - #18713 protocol: preserve glob scan depth in permission profiles @bolinfest - #18795 fix(guardian) Dont hard error on feature disable @dylan-hurd-oai - #18292 Make MCP resource read threadless @mzeng-openai - #18786 Fallback display names for TUI skill mentions @canvrno-oai - #18807 chore(app-server) linguist-generated @dylan-hurd-oai - #18393 feat(auto-review) Handle request_permissions calls @dylan-hurd-oai - #18763 Add remote_sandbox_config to our config requirements @abhinav-oai - #18794 Organize context fragments @pakrym-oai - #18423 chore: document intentional await-holding cases @bolinfest - #18698 chore: enable await-holding clippy lints @bolinfest - #18413 [tool search] support namespaced deferred dynamic tools @pash-openai - #18818 [codex] Tighten code review skill wording @pakrym-oai - #18271 show bash mode in the TUI @abhinav-oai - #18741 fix(tui): disable enhanced keys for VS Code WSL @fcoury-oai - #18850 Move external agent config out of core @pakrym-oai - #18844 build: reduce Rust dev debuginfo @bolinfest - #18848 feat: baseline lib @jif-oai - #18846 core: make test-log a dev dependency @bolinfest - #18428 app-server: define device key v2 protocol @euroelessar - #18093 Propagate thread id in MCP tool metadata @rennie-openai - #17836 [codex] Add tmux-aware OSC 9 notifications @caseychow-oai - #18820 Queue follow-up input during user shell commands @etraut-openai - #18858 Stabilize debug clear memories integration test @jif-oai - #18799 Move TUI app tests to modules they cover @etraut-openai - #18442 Refactor app-server config loading into ConfigManager @pakrym-oai - #18813 Split DeveloperInstructions into individual fragments. @pakrym-oai - #18275 sandboxing: intersect permission profiles semantically @bolinfest - #18862 Refresh generated Python app-server SDK types @sdcoffey - #15578 Add Windows sandbox unified exec runtime support @iceweasel-oai - #18429 app-server: add codex-device-key crate @euroelessar - #18872 app-server: fix Bazel clippy in tracing tests @euroelessar - #18885 skip busted tests while I fix them @iceweasel-oai - #18873 chore: default multi-agent v2 fork to all @jif-oai
Codex CLI (Rust Implementation)
We provide Codex CLI as a standalone executable to ensure a zero-dependency install.
Installing Codex
Today, the easiest way to install Codex is via npm:
npm i -g @openai/codex
codex
You can also install via Homebrew (brew install --cask codex) or download a platform-specific release directly from our GitHub Releases.
Documentation quickstart
- First run with Codex? Start with
docs/getting-started.md(links to the walkthrough for prompts, keyboard shortcuts, and session management). - Want deeper control? See
docs/config.mdanddocs/install.md.
What's new in the Rust CLI
The Rust implementation is now the maintained Codex CLI and serves as the default experience. It includes a number of features that the legacy TypeScript CLI never supported.
Config
Codex supports a rich set of configuration options. Note that the Rust CLI uses config.toml instead of config.json. See docs/config.md for details.
Model Context Protocol Support
MCP client
Codex CLI functions as an MCP client that allows the Codex CLI and IDE extension to connect to MCP servers on startup. See the configuration documentation for details.
MCP server (experimental)
Codex can be launched as an MCP server by running codex mcp-server. This allows other MCP clients to use Codex as a tool for another agent.
Use the @modelcontextprotocol/inspector to try it out:
npx @modelcontextprotocol/inspector codex mcp-server
Use codex mcp to add/list/get/remove MCP server launchers defined in config.toml, and codex mcp-server to run the MCP server directly.
Notifications
You can enable notifications by configuring a script that is run whenever the agent finishes a turn. The notify documentation includes a detailed example that explains how to get desktop notifications via terminal-notifier on macOS. When Codex detects that it is running under WSL 2 inside Windows Terminal (WT_SESSION is set), the TUI automatically falls back to native Windows toast notifications so approval prompts and completed turns surface even though Windows Terminal does not implement OSC 9.
codex exec to run Codex programmatically/non-interactively
To run Codex non-interactively, run codex exec PROMPT (you can also pass the prompt via stdin) and Codex will work on your task until it decides that it is done and exits. If you provide both a prompt argument and piped stdin, Codex appends stdin as a <stdin> block after the prompt so patterns like echo "my output" | codex exec "Summarize this concisely" work naturally. Output is printed to the terminal directly. You can set the RUST_LOG environment variable to see more about what's going on.
Use codex exec --ephemeral ... to run without persisting session rollout files to disk.
Experimenting with the Codex Sandbox
To test to see what happens when a command is run under the sandbox provided by Codex, we provide the following subcommands in Codex CLI:
# macOS
codex sandbox macos [--full-auto] [--log-denials] [COMMAND]...
# Linux
codex sandbox linux [--full-auto] [COMMAND]...
# Windows
codex sandbox windows [--full-auto] [COMMAND]...
# Legacy aliases
codex debug seatbelt [--full-auto] [--log-denials] [COMMAND]...
codex debug landlock [--full-auto] [COMMAND]...
Selecting a sandbox policy via --sandbox
The Rust CLI exposes a dedicated --sandbox (-s) flag that lets you pick the sandbox policy without having to reach for the generic -c/--config option:
# Run Codex with the default, read-only sandbox
codex --sandbox read-only
# Allow the agent to write within the current workspace while still blocking network access
codex --sandbox workspace-write
# Danger! Disable sandboxing entirely (only do this if you are already running in a container or other isolated env)
codex --sandbox danger-full-access
The same setting can be persisted in ~/.codex/config.toml via the top-level sandbox_mode = "MODE" key, e.g. sandbox_mode = "workspace-write".
In workspace-write, Codex also includes ~/.codex/memories in its writable roots so memory maintenance does not require an extra approval.
Code Organization
This folder is the root of a Cargo workspace. It contains quite a bit of experimental code, but here are the key crates:
core/contains the business logic for Codex. Ultimately, we hope this to be a library crate that is generally useful for building other Rust/native applications that use Codex.exec/"headless" CLI for use in automation.tui/CLI that launches a fullscreen TUI built with Ratatui.cli/CLI multitool that provides the aforementioned CLIs via subcommands.
If you want to contribute or inspect behavior in detail, start by reading the module-level README.md files under each crate and run the project workspace from the top-level codex-rs directory so shared config, features, and build scripts stay aligned.