## 新功能
- Windows 沙盒运行现在可以通过操作系统级别的出口规则来强制实施仅代理网络，而不再仅仅依赖环境变量。(#12220)
- 应用服务器客户端现在可以使用设备码流程启动 ChatGPT 登录，这在浏览器回调登录不可靠或不可用时很有帮助。(#15525)
- `codex exec` 现在支持“提示+标准输入”工作流，因此您可以通过管道传递输入，同时在命令行中传递单独的提示。(#15917)
- 自定义模型提供商现在可以动态获取和刷新短期存在的持有者令牌，而不再局限于来自配置或环境变量的静态凭据。(#16286, #16287, #16288)
## 错误修复
- 项目本地的 `.codex` 文件现在在首次创建时也受到保护，从而弥补了初始写入可能绕过正常审批检查的漏洞。(#15067)
- Linux 沙盒启动现在更可靠，因为 Codex 再次能够在正常的多条目 `PATH` 中找到受信任的系统 `bwrap`。(#15791, #15973)
- 基于应用服务器的 TUI 恢复了几个缺失的工作流：钩子通知能正确重放，`/copy` 和 `/resume <name>` 再次可用，`/agent` 不再显示陈旧线程，技能选择器可以滚动超过第一页。(#16013, #16021, #16050, #16014, #16109, #16110)
- MCP 启动现在更稳健：本地服务器获得更长的启动窗口，失败的握手再次在 TUI 中显示警告，而不是看起来像干净的启动。(#16080, #16041)
- 在 Windows 上，`apply_patch` 失败的可能性降低，因为它不再添加可能触发不必要 ACL 变动的冗余可写根目录。(#16030)
## 更新日志
完整更新日志：https://github.com/openai/codex/compare/rust-v0.117.0...rust-v0.118.0
- #15891 [插件] 优化工具建议提示。 @mzeng-openai
- #15791 修复：从受信任的 PATH 条目解析 bwrap @viyatb-oai
- #15900 技能：移除未使用的技能权限元数据 @bolinfest
- #15811 应用服务器：拆分传输模块 @euroelessar
- #15067 在 Linux 和 macOS 沙盒中保护首次创建的项目 .codex 文件 @rreichel3-oai
- #15903 [codex] 直接从 codex-login 导入 token_data @bolinfest
- #15897 沙盒化：对 SandboxCommand.program 使用 OsString @bolinfest
- #15910 文档：更新 AGENTS.md 以 discourage 向 codex-core 添加代码 @bolinfest
- #15898 杂务：将 bwrap 配置助手移至专用模块 @viyatb-oai
- #15906 杂务：从命令审批负载中移除技能元数据 @bolinfest
- #15909 修复(网络代理)：在 DNS 查找错误时失败关闭 @viyatb-oai
- #14495 在 GitHub Actions 中保留 Bazel 仓库缓存 @siggisim
- #15522 bazel：重新组织 bazelrc @sluongng
- #15923 codex-tools：提取共享工具架构解析 @bolinfest
- #15918 权限：移除 macOS seatbelt 扩展配置文件 @bolinfest
- #12220 功能(Windows 沙盒)：添加网络代理支持 @viyatb-oai
- #15931 修复：使 MACOS_DEFAULT_PREFERENCES_POLICY 成为 MACOS_SEATBELT_BASE_POLICY 的一部分 @bolinfest
- #15933 修复：在 actions/cache 构建操作中使用 matrix.target 而非 matrix.os @bolinfest
- #15928 codex-tools：提取 MCP 架构适配器 @bolinfest
- #15948 修复：将 rust-ci 超时暂时增加到 45 分钟 @bolinfest
- #15921 [应用服务器协议] 为应用服务器协议引入通用的 ClientResponse @rhan-oai
- #15120 杂务：重构网络权限以使用显式域和 Unix 套接字规则映射 @celia-oai
- #15525 向应用服务器添加 ChatGPT 设备码登录 @daniel-oai
- #15876 杂务：丢弃无用内容 @jif-oai
- #15954 杂务：将 pty 和 Windows 沙盒迁移到 Rust 2024 @bolinfest
- #15986 功能：将 spawn v2 任务名称设为强制项 @jif-oai
- #16000 对登录错误页面使用 codex-utils-template @jif-oai
- #16001 对审查提示使用 codex-utils-template @jif-oai
- #15998 对沙盒模式提示使用 codex-utils-template @jif-oai
- #15995 对协作模式预设使用 codex-utils-template @jif-oai
- #15996 对搜索工具描述使用 codex-utils-template @jif-oai
- #15999 对审查退出 XML 使用 codex-utils-template @jif-oai
- #15985 功能：spawn v2 作为代理间通信 @jif-oai
- #15973 修复(沙盒)：修复多条目 PATH 的 bwrap 查找 @viyatb-oai
- #15944 codex-tools：提取动态工具适配器 @bolinfest
- #15955 CI：为 codex-rs 添加 Bazel clippy 工作流 @bolinfest
- #15953 codex-tools：引入具名工具定义 @bolinfest
- #16027 修复：修复 #15999 引入的 Windows CI 回归 @bolinfest
- #16036 修复：在 SDK 集成测试中禁用插件 @bolinfest
- #15946 为带连字符的服务器名称标准化 /mcp 工具分组 @pakrym-oai
- #16035 插件：清理陈旧的策划插件同步临时目录并添加同步指标 @xl-openai
- #15934 添加基于使用量的商业计划类型 @bwanner-oai
- #16031 codex-tools：提取响应 API 工具模型 @bolinfest
- #16013 修复 tui_app_server 钩子通知渲染和重放 @etraut-openai
- #16021 修复 tui_app_server 回合完成中的 /copy 回归 @etraut-openai
- #16044 [mcp] 绕过只读工具检查。 @mzeng-openai
- #16030 在 apply_patch 中不包含冗余的可写根目录 @iceweasel-oai
- #15922 移除遗留的 TUI 拆分 @etraut-openai
- #15828 [codex] 固定 GitHub Actions 工作流引用 @hintz-openai
- #16046 CI：使用 Bazel 构建的 codex 运行 SDK 测试 @bolinfest
- #16050 修复 tui_app_server 按名称恢复查找回归 @etraut-openai
- #16014 修复 tui_app_server 代理选择器关闭状态回归 @etraut-openai
- #16054 杂务：清理参数注释 lint 并在 macOS 上推出全目标 CI @bolinfest
- #15917 为 `codex exec` 支持 Codex CLI 标准输入管道 @jliccini
- #16057 shell-command：在 Windows 上重用 PowerShell 解析器进程 @bolinfest
- #16063 重构：用 Python 重写参数注释 lint 包装器 @bolinfest
- #15952 bazel：启用完整的 Windows gnullvm CI 路径 @bolinfest
- #16067 CI：在 Windows gnullvm 上运行 Bazel clippy @bolinfest
- #16071 修复：清理剩余的 Windows 参数注释 lint 违规 @bolinfest
- #16072 CI：将快速 PR Rust CI 与完整的合并后 Cargo CI 分离 @bolinfest
- #16074 bazel：为单元测试二进制文件添加 Windows gnullvm 堆栈标志 @bolinfest
- #16026 修复(tui)：在协作模式更改时刷新页脚 @fcoury
- #16112 为审查回复和解决更新 PR 保姆技能 @etraut-openai
- #16104 将 tui_app_server 重命名为 tui @etraut-openai
- #16118 修复：修复 Linux 专用代码中的注释 linter lint 违规 @bolinfest
- #16106 构建：将参数注释 lint 迁移到原生 Bazel 方面 @bolinfest
- #16115 移除剩余的定制提示支持 @etraut-openai
- #16116 移除 codex-tui 应用服务器发起者变通方法 @etraut-openai
- #16047 codex-tools：提取工具规格模型 @bolinfest
- #16128 bazel：刷新过期的 macOS SDK 固定版本 @bolinfest
- #16129 codex-tools：提取配置的工具规格 @bolinfest
- #16130 CI：在打包的包装器上保留 Windows 参数注释 lint 的 rust-ci-full @bolinfest
- #16126 核心：修复陈旧的策划插件缓存刷新竞争 @bolinfest
- #16132 codex-tools：提取代码模式工具规格适配器 @bolinfest
- #16136 CI：对非 Windows 参数注释 lint 使用 BuildBuddy 运行 rust-ci-full @bolinfest
- #16137 exec：使审查策略测试成为封闭的 @bolinfest
- #16109 修复技能选择器在 tui 应用服务器中的滚动 @etraut-openai
- #16138 codex-tools：提取本地主机工具规格 @bolinfest
- #16114 移除 TUI 语音转录功能 @etraut-openai
- #16080 [mcp] 增加 MCP 启动超时。 @mzeng-openai
- #16141 codex-tools：提取协作工具规格 @bolinfest
- #16041 修复应用服务器 TUI MCP 启动警告回归 @etraut-openai
- #16110 修复 tui_app_server 中 /agent 的幽灵子代理条目 @etraut-openai
- #16154 codex-tools：提取实用工具规格 @bolinfest
- #16204 [codex] 在 MCP 启动快照测试中标准化 Windows 路径 @etraut-openai
- #16010 功能：为等待添加邮箱概念 @jif-oai
- #16237 修复：ma1 @jif-oai
- #16193 codex-tools：提取发现工具规格 @bolinfest
- #16254 codex-tools：提取可发现工具模型 @bolinfest
- #16253 修复：关闭 Bazel 参数注释 lint CI 缺口 @bolinfest
- #16225 [codex-analytics] 重构分析以使用 reducer 架构 @rhan-oai
- #16279 更新代码模式 exec() 说明 @andmis
- #16120 CI：通过原生 Bazel 运行 Windows 参数注释 lint @bolinfest
- #16286 认证：为仅持有者来源泛化外部认证令牌 @bolinfest
- #16287 认证：让 AuthManager 拥有外部持有者认证 @bolinfest
- #16288 核心：为模型提供商支持动态认证令牌 @bolinfest
## New Features
- Windows sandbox runs can now enforce proxy-only networking with OS-level egress rules, instead of relying on environment variables alone. (#12220)
- App-server clients can now start ChatGPT sign-in with a device code flow, which helps when browser callback login is unreliable or unavailable. (#15525)
- `codex exec` now supports the prompt-plus-stdin workflow, so you can pipe input and still pass a separate prompt on the command line. (#15917)
- Custom model providers can now fetch and refresh short-lived bearer tokens dynamically, instead of being limited to static credentials from config or environment variables. (#16286, #16287, #16288)
## Bug Fixes
- Project-local `.codex` files are now protected even on first creation, closing a gap where the initial write could bypass normal approval checks. (#15067)
- Linux sandbox launches are more reliable because Codex once again finds a trusted system `bwrap` on normal multi-entry `PATH`s. (#15791, #15973)
- The app-server-backed TUI regained several missing workflows: hook notifications replay correctly, `/copy` and `/resume <name>` work again, `/agent` no longer shows stale threads, and the skills picker scrolls past the first page. (#16013, #16021, #16050, #16014, #16109, #16110)
- MCP startup is more robust: local servers get a longer startup window, and failed handshakes surface warnings in the TUI again instead of looking like clean startups. (#16080, #16041)
- On Windows, `apply_patch` is less likely to fail because it no longer adds redundant writable roots that could trigger unnecessary ACL churn. (#16030)
## Changelog
Full Changelog: https://github.com/openai/codex/compare/rust-v0.117.0...rust-v0.118.0
- #15891 [plugins] Polish tool suggest prompts. @mzeng-openai
- #15791 fix: resolve bwrap from trusted PATH entry @viyatb-oai
- #15900 skills: remove unused skill permission metadata @bolinfest
- #15811 app-server: Split transport module @euroelessar
- #15067 Protect first-time project .codex creation across Linux and macOS sandboxes @rreichel3-oai
- #15903 [codex] import token_data from codex-login directly @bolinfest
- #15897 sandboxing: use OsString for SandboxCommand.program @bolinfest
- #15910 docs: update AGENTS.md to discourage adding code to codex-core @bolinfest
- #15898 chore: move bwrap config helpers into dedicated module @viyatb-oai
- #15906 chore: remove skill metadata from command approval payloads @bolinfest
- #15909 fix(network-proxy): fail closed on network-proxy DNS lookup errors @viyatb-oai
- #14495 Preserve bazel repository cache in github actions @siggisim
- #15522 bazel: re-organize bazelrc @sluongng
- #15923 codex-tools: extract shared tool schema parsing @bolinfest
- #15918 permissions: remove macOS seatbelt extension profiles @bolinfest
- #12220 feat(windows-sandbox): add network proxy support @viyatb-oai
- #15931 fix: make MACOS_DEFAULT_PREFERENCES_POLICY part of MACOS_SEATBELT_BASE_POLICY @bolinfest
- #15933 fix: use matrix.target instead of matrix.os for actions/cache build action @bolinfest
- #15928 codex-tools: extract MCP schema adapters @bolinfest
- #15948 fix: increase timeout for rust-ci to 45 minutes for now @bolinfest
- #15921 [app-server-protocol] introduce generic ClientResponse for app-server-protocol @rhan-oai
- #15120 chore: refactor network permissions to use explicit domain and unix socket rule maps @celia-oai
- #15525 Add ChatGPT device-code login to app server @daniel-oai
- #15876 chore: drop useless stuff @jif-oai
- #15954 chore: move pty and windows sandbox to Rust 2024 @bolinfest
- #15986 feat: spawn v2 make task name as mandatory @jif-oai
- #16000 Use codex-utils-template for login error page @jif-oai
- #16001 Use codex-utils-template for review prompts @jif-oai
- #15998 Use codex-utils-template for sandbox mode prompts @jif-oai
- #15995 Use codex-utils-template for collaboration mode presets @jif-oai
- #15996 Use codex-utils-template for search tool descriptions @jif-oai
- #15999 Use codex-utils-template for review exit XML @jif-oai
- #15985 feat: spawn v2 as inter agent communication @jif-oai
- #15973 fix(sandbox): fix bwrap lookup for multi-entry PATH @viyatb-oai
- #15944 codex-tools: extract dynamic tool adapters @bolinfest
- #15955 ci: add Bazel clippy workflow for codex-rs @bolinfest
- #15953 codex-tools: introduce named tool definitions @bolinfest
- #16027 fix: fix Windows CI regression introduced in #15999 @bolinfest
- #16036 fix: disable plugins in SDK integration tests @bolinfest
- #15946 Normalize /mcp tool grouping for hyphenated server names @pakrym-oai
- #16035 plugins: Clean up stale curated plugin sync temp dirs and add sync metrics @xl-openai
- #15934 Add usage-based business plan types @bwanner-oai
- #16031 codex-tools: extract responses API tool models @bolinfest
- #16013 Fix tui_app_server hook notification rendering and replay @etraut-openai
- #16021 Fix /copy regression in tui_app_server turn completion @etraut-openai
- #16044 [mcp] Bypass read-only tool checks. @mzeng-openai
- #16030 don't include redundant write roots in apply_patch @iceweasel-oai
- #15922 Remove the legacy TUI split @etraut-openai
- #15828 [codex] Pin GitHub Actions workflow references @hintz-openai
- #16046 ci: run SDK tests with a Bazel-built codex @bolinfest
- #16050 Fix tui_app_server resume-by-name lookup regression @etraut-openai
- #16014 Fix tui_app_server agent picker closed-state regression @etraut-openai
- #16054 chore: clean up argument-comment lint and roll out all-target CI on macOS @bolinfest
- #15917 Support Codex CLI stdin piping for `codex exec` @jliccini
- #16057 shell-command: reuse a PowerShell parser process on Windows @bolinfest
- #16063 refactor: rewrite argument-comment lint wrappers in Python @bolinfest
- #15952 bazel: enable the full Windows gnullvm CI path @bolinfest
- #16067 ci: run Bazel clippy on Windows gnullvm @bolinfest
- #16071 fix: clean up remaining Windows argument-comment-lint violations @bolinfest
- #16072 ci: split fast PR Rust CI from full post-merge Cargo CI @bolinfest
- #16074 bazel: add Windows gnullvm stack flags to unit test binaries @bolinfest
- #16026 fix(tui): refresh footer on collaboration mode changes @fcoury
- #16112 Update PR babysitter skill for review replies and resolution @etraut-openai
- #16104 Rename tui_app_server to tui @etraut-openai
- #16118 fix: fix comment linter lint violations in Linux-only code @bolinfest
- #16106 build: migrate argument-comment-lint to a native Bazel aspect @bolinfest
- #16115 Remove remaining custom prompt support @etraut-openai
- #16116 Remove the codex-tui app-server originator workaround @etraut-openai
- #16047 codex-tools: extract tool spec models @bolinfest
- #16128 bazel: refresh the expired macOS SDK pin @bolinfest
- #16129 codex-tools: extract configured tool specs @bolinfest
- #16130 ci: keep rust-ci-full Windows argument-comment-lint on packaged wrapper @bolinfest
- #16126 core: fix stale curated plugin cache refresh races @bolinfest
- #16132 codex-tools: extract code mode tool spec adapters @bolinfest
- #16136 ci: use BuildBuddy for rust-ci-full non-Windows argument-comment-lint @bolinfest
- #16137 exec: make review-policy tests hermetic @bolinfest
- #16109 Fix skills picker scrolling in tui app server @etraut-openai
- #16138 codex-tools: extract local host tool specs @bolinfest
- #16114 Remove TUI voice transcription feature @etraut-openai
- #16080 [mcp] Increase MCP startup timeout. @mzeng-openai
- #16141 codex-tools: extract collaboration tool specs @bolinfest
- #16041 Fix app-server TUI MCP startup warnings regression @etraut-openai
- #16110 Fix tui_app_server ghost subagent entries in /agent @etraut-openai
- #16154 codex-tools: extract utility tool specs @bolinfest
- #16204 [codex] Normalize Windows path in MCP startup snapshot test @etraut-openai
- #16010 feat: add mailbox concept for wait @jif-oai
- #16237 fix: ma1 @jif-oai
- #16193 codex-tools: extract discovery tool specs @bolinfest
- #16254 codex-tools: extract discoverable tool models @bolinfest
- #16253 fix: close Bazel argument-comment-lint CI gaps @bolinfest
- #16225 [codex-analytics] refactor analytics to use reducer architecture @rhan-oai
- #16279 Update code mode exec() instructions @andmis
- #16120 ci: run Windows argument-comment-lint via native Bazel @bolinfest
- #16286 auth: generalize external auth tokens for bearer-only sources @bolinfest
- #16287 auth: let AuthManager own external bearer auth @bolinfest
- #16288 core: support dynamic auth tokens for model providers @bolinfest