Codex rust-v0.147.0

## New Features - Install portable Agent Plugins and search across local, personal, workspace, and remote plugin catalogs. (#36544, #36409, #36919, #36796) - Organize conversations into persistent, manually ordered sections and browse long transcripts incrementally. (#35722, #36007, #36380, #36948, #36950) - Enable automatically reviewed approvals with the new `--approve-for-me` CLI flag. (#36373) - Import Cursor-managed skills and synchronize changes to imported Claude and Cursor conversations without creating duplicates. (#36361, #36356, #35623) - Support the opt-in MCP 2026-07-28 protocol, including paginated discovery, multi-round requests, and non-blocking server startup. (#35724, #35725, #35590, #35742) - Enable cached web search and remote conversation compaction for Amazon Bedrock. (#36938, #36981) ## Bug Fixes - Redact secrets and complete bearer tokens from displayed commands and replayed conversation history. (#36893, #36908) - Prevent lost or stalled terminal input when focus returns, MCP servers initialize, or Ghostty handles keyboard shortcuts. (#35649, #35957, #36834) - Correct rendering and cursor positioning for Japanese characters, emoji, hyperlinks, and text near viewport boundaries. (#35960, #35962, #37166) - Properly interrupt Windows background processes and handle Windows filesystem paths consistently. (#35655, #35851, #37129) - Require explicit trust for unfamiliar local projects and enforce managed authentication restrictions before credentials are used. (#36960, #37132) - Harden plugin isolation and deny network access when policy updates fail. (#37027, #36967, #36037) ## Documentation - Improve the bundled OpenAI documentation skill with targeted official-source lookup and clearer guidance for Codex, model selection, and API workflows. (#36014) ## Chores - Upgrade the MCP SDK to 3.0.0, Ratatui to 0.30.2, and V8 to 150.4.0. (#36001, #35959, #35831) - Secure macOS release notarization using Azure Key Vault instead of exporting private signing keys. (#37154) - Remove the deprecated `codex exec --full-auto` flag; use `--sandbox workspace-write` instead. (#36054) - Stop publishing redundant Linux bundle archives; use the standard `codex-package-<target>` release archives. (#36342) ## Changelog Full Changelog: https://github.com/openai/codex/compare/rust-v0.146.0...rust-v0.147.0 - #35590 Expose cached MCP tools before server startup @copyberry - #35594 Recommend longer waits in the v2 wait_agent schema @copyberry - #35595 Allow alpha hotfix versions in R2 releases @copyberry - #35597 Add metrics for extension-rendered skill catalogs @copyberry - #35607 Record metrics for empty skill catalogs @copyberry - #35608 Support model-owned token budget defaults @copyberry - #35621 Skip restored token usage replay for exec resumes @copyberry - #35623 Parse Claude and Cursor session records separately @copyberry - #35642 Make OpenTelemetry provider shutdown idempotent @copyberry - #35644 Preserve thread metadata when rollout files are missing @copyberry - #35649 Preserve TUI input when terminal focus returns @copyberry - #35652 Enable network policy callbacks for remote exec @copyberry - #35653 Test developer instruction inheritance for multi-agent workers @copyberry - #35655 Terminate Windows non-TTY processes on interrupt @copyberry - #35656 Preserve multi-agent settings across config representations @copyberry - #35661 Place host skills before permission instructions @copyberry - #35663 Evaluate character matching over skill routing metadata @copyberry - #35665 Fix the async watcher test harness on Windows @copyberry - #35668 Expose the network proxy spec constructor @copyberry - #35670 Raise the Windows exec yield floor to 10 seconds @copyberry - #35671 Route curated plugins by authentication mode @copyberry - #35675 Prepare MCP and plugin recommendations concurrently @copyberry - #35678 Preserve paginated thread metadata across resumes @copyberry - #35685 Load cloud-managed profiles for `codex sandbox` @copyberry - #35688 Point crossterm patch to the OpenAI OSS fork @copyberry - #35689 Preserve item timestamps in thread history projections @copyberry - #35691 Include empty-preview threads in relationship listings @copyberry - #35693 Refresh the subagent picker in the background @copyberry - #35695 Honor the configured SQLite home in the logs client @copyberry - #35708 Add configurable developer instructions for v2 subagents @copyberry - #35715 Support streaming bodies in route-aware HTTP requests @copyberry - #35717 Reuse route-aware clients for OpenAI file uploads @copyberry - #35720 Upgrade rmcp to 3.0.0-beta.3 @copyberry - #35721 Honor disabled code mode fallback without a process host @copyberry - #35722 Add persisted sections for organizing threads @copyberry - #35724 Add MCP 2026-07-28 discovery support @copyberry - #35725 Complete MCP 2026 client support @copyberry - #35738 Add bounded metadata for executed tool calls @copyberry - #35742 Avoid blocking turns on optional MCP startup @copyberry - #35744 Keep agent registry identities consistent @copyberry - #35766 Emit host skill budget warnings from world state @copyberry - #35769 Share the skills budget across host and executor catalogs @copyberry - #35772 Throttle models cache TTL renewals @copyberry - #35773 Scale skill metadata budgets with context windows @copyberry - #35777 Resolve MCP tool catalogs concurrently @copyberry - #35779 Load thread titles concurrently during session startup @copyberry - #35785 Support self-serve Business ProLite accounts @copyberry - #35787 Gate paginated thread history on the state database @copyberry - #35794 Wait for MCP readiness in the curated sync test @copyberry - #35802 Tag reports with the selected turn's model and effort @copyberry - #35806 Route MCP OAuth through configured HTTP clients @copyberry - #35814 Use configured HTTP clients for all MCP OAuth requests @copyberry - #35818 Advance latest-alpha-cli after release publishing completes @copyberry - #35821 Use the shared HTTP client for TUI network checks @copyberry - #35825 Use the shared HTTP client for announcement tips @copyberry - #35828 Enforce centralized SQLite connection creation @copyberry - #35830 Route WebRTC sideband joins to the Realtime API @copyberry - #35831 Update rusty_v8 to 150.4.0 @copyberry - #35835 Track parent turns for nested Codex requests @copyberry - #35836 Clean up cancelled MCP elicitation requests @copyberry - #35837 Expose plugin eligibility metadata in app-server summaries @copyberry - #35839 Decouple recommended plugins from tool suggestions @copyberry - #35840 Handle legacy MCP discovery prevalidation errors @copyberry - #35843 Tie remote exec servers to their parent stdin @copyberry - #35845 Support plaintext collaboration tool messages @copyberry - #35850 Preserve foreign paths in background terminal listings @copyberry - #35851 Normalize Windows namespace paths in path URIs @copyberry - #35854 Box app-server event payloads @copyberry - #35856 Resolve imported connectors by MCP server name @copyberry - #35857 Add Bazel unit test targets for Rust binaries @copyberry - #35859 Expose plugin installation timestamps in app-server summaries @copyberry - #35870 Include session titles in external agent import history @copyberry - #35874 Mark the primary environment in model context @copyberry - #35875 Allow environment readiness updates in place @copyberry - #35878 Use step environments for MCP file uploads @copyberry - #35886 Show blocked goals as stalled in the TUI @copyberry - #35887 Clean up side conversations in the background @copyberry - #35895 Inherit ready step environments when spawning agents @copyberry - #35937 Let unrelated tools run while MCP servers start @copyberry - #35941 Bound MCP namespace descriptions @copyberry - #35942 Update tests for current tool call and app-server event types @copyberry - #35944 Report direct input capability for listed subagents @copyberry - #35957 Fix TUI input queue handling during MCP startup @copyberry - #35959 Upgrade Ratatui to 0.30.2 @copyberry - #35960 Preserve hyperlink cell widths during terminal diffing @copyberry - #35962 Fix TUI layout for halfwidth Japanese sound marks @copyberry - #35982 Avoid cloning rollout history when truncating forks @copyberry - #35989 Display title-only reasoning summaries in the TUI @copyberry - #35990 Test exec-server compatibility across Codex versions @copyberry - #35992 Group external agent config migration into a module @copyberry - #35997 Remove obsolete rusty_v8 146.4.0 Bazel targets @copyberry - #36001 Upgrade rmcp to 3.0.0 @copyberry - #36002 Resolve MCP file uploads with environment-native paths @copyberry - #36006 Reduce response serialization and rollout scan overhead @copyberry - #36007 Add persisted manual ordering for thread sections @copyberry - #36008 Route pet asset downloads through the shared HTTP client @copyberry - #36011 Share optional MCP startup grace across connection sets @copyberry - #36014 Refine OpenAI docs skill source routing @copyberry - #36020 Avoid cloning ignored analytics notifications @copyberry - #36030 Increase the app-server tracing test stack size @copyberry - #36031 Load cloud-managed servers in MCP CLI commands @copyberry - #36033 Use the shared HTTP client in codex-protocol @copyberry - #36035 Exit the stdio app-server when its connection closes @copyberry - #36036 Allow naming forked chats from the TUI @copyberry - #36037 Deny network access when an allow amendment fails @copyberry - #36039 Limit MCP catalog pagination @copyberry - #36043 Document the Responses API proxy reqwest exception @copyberry - #36045 Distinguish unknown MCP authentication status @copyberry - #36047 Extract MCP environment headers into a local variable @copyberry - #36049 Keep tool-call metrics out of Statsig exports @copyberry - #36051 Avoid overwriting symlinked migration targets @copyberry - #36054 Remove legacy `--full-auto` handling from `codex exec` @copyberry - #36055 Expose MCP read-only hints in tool call items @copyberry - #36076 Remove codex-core's direct reqwest dependency @copyberry - #36078 Route Ollama through the shared HTTP client @copyberry - #36083 Handle fractional rate limits in thread history projection @copyberry - #36092 Correlate image requests and explicit interrupts with turns @copyberry - #36119 Unify tool runtime assembly before router construction @copyberry - #36120 Delegate readiness waits to tool runtimes @copyberry - #36121 Sandbox executor skill resource reads @copyberry - #36124 Respect filesystem permissions during capability discovery @copyberry - #36127 Centralize tool registration and protect host tools @copyberry - #36128 Preserve delegated tasks across remote compaction @copyberry - #36129 Resolve normalized tool name collisions in code mode @copyberry - #36133 Preserve executor workspace permissions for apply_patch @copyberry - #36138 Isolate apply-patch permission test variants @copyberry - #36139 Bound the code mode output termination test @copyberry - #36140 Wait for memory consolidation shutdown before finishing jobs @copyberry - #36146 Stabilize approval scenario tests @copyberry - #36148 Harden the file change approval integration test @copyberry - #36149 Strengthen session file change approval coverage @copyberry - #36165 Stabilize file approval replay test @copyberry - #36166 Make pending realtime sideband test deterministic @copyberry - #36167 Harden the auto-review model override test @copyberry - #36168 Make tool telemetry tag collection synchronous @copyberry - #36171 Test workspace-root patch protection for metadata @copyberry - #36177 Test remote Guardian network approval scoping @copyberry - #36181 Record attempted tool calls in response metadata @copyberry - #36183 Use permission profiles throughout sandbox execution @copyberry - #36184 Coalesce concurrent remote metadata requests @copyberry - #36187 Refresh environment dates from the configured clock @copyberry - #36188 Make thread history projection resilient to malformed rollouts @copyberry - #36191 Label explicit skill injection metrics @copyberry - #36194 Avoid shifting bytes in streaming output buffers @copyberry - #36207 Record normalized sandbox violation events @copyberry - #36212 Precompute app-server protocol exports @copyberry - #36217 Run code mode exclusively through the standalone host @copyberry - #36218 Expose connector candidates in external agent detection @copyberry - #36221 Ignore passthrough metadata when reconciling rollout items @copyberry - #36223 Preserve executor paths in read command actions @copyberry - #36228 Support Enterprise automation account plans @copyberry - #36237 Ignore symbolic slash-tmp permissions on Windows @copyberry - #36239 Refresh precomputed app-server protocol exports @copyberry - #36264 Prefer the bundled resource for the code mode host @copyberry - #36271 Derive report prompt hashes from persisted rollouts @copyberry - #36306 Restrict hosted MCP credentials to local environments @copyberry - #36309 Use the host skill provider catalog in world state @copyberry - #36310 Isolate MCP OAuth credentials by environment @copyberry - #36311 Include skills in debug prompt input output @copyberry - #36327 Preserve discovery order for host skill path aliases @copyberry - #36329 Restrict `shell_command` to a single local environment @copyberry - #36336 Detect connectors used in external agent sessions @copyberry - #36339 Enable skills in the MCP server @copyberry - #36342 Stop publishing legacy Linux bundle archives @copyberry - #36350 Require explicit sandbox permissions with shell justifications @copyberry - #36351 Use model catalog collaboration mode messages @copyberry - #36354 Pass sessions directly to session tasks @copyberry - #36355 Keep MCP tool calls bound to their thread @copyberry - #36356 Sync updates to imported external agent sessions @copyberry - #36357 Use the step-scoped router for tool execution @copyberry - #36359 Consolidate MCP config editing in codex-core @copyberry - #36360 Use MCP bindings as the step tool catalog @copyberry - #36361 Migrate Cursor-managed skills into Codex @copyberry - #36364 Move skill catalog rendering out of core @copyberry - #36365 Add strict automatic review for MCP elicitations @copyberry - #36367 Keep effective tool exposure in the registry @copyberry - #36372 Run native Windows Bazel tests with MSVC @copyberry - #36373 Add an `--approve-for-me` CLI flag @copyberry - #36374 Enable sandboxed V8 for code mode @copyberry - #36378 Load local session pickers from the state DB first @copyberry - #36380 Add thread section management APIs @copyberry - #36384 Load turn summaries with paginated queries @copyberry - #36385 Add acknowledged user message submission to core @copyberry - #36388 Track image preparation details in turn analytics @copyberry - #36389 Enforce single-writer ownership for all thread histories @copyberry - #36393 Avoid redundant filesystem probes @copyberry - #36402 Declare the experimental plugin search API @copyberry - #36408 Allow custom Codex instructions for realtime transitions @copyberry - #36409 Implement remote plugin search @copyberry - #36410 Make user input blocking behavior explicit @copyberry - #36411 Use Git repositories as pre-tool hook test markers @copyberry - #36413 Add a realtime delegation acknowledgement control @copyberry - #36440 Extract exec-server request dispatching @copyberry - #36482 Avoid querying terminal size on every TUI redraw @copyberry - #36485 Increase remote plugin bundle size limits @copyberry - #36507 Retain attempted tool metadata across prompts @copyberry - #36511 Support two-stroke TUI key chords @copyberry - #36534 Raise the MCP catalog item limit to 2,048 @copyberry - #36544 Support portable Agent Plugins throughout installation @copyberry - #36632 Preserve SQLite thread metadata during goal mutations @copyberry - #36635 Expose onboarding hints in login completion notifications @copyberry - #36641 Capture rollout budget units from response usage @copyberry - #36715 Use provider-reported rollout budget units @copyberry - #36716 Deduplicate MCP resource operation handling @copyberry - #36727 Simplify turn metadata state ownership @copyberry - #36729 Correlate code mode tool analytics with model responses @copyberry - #36732 Stabilize the cloud environment HTTP test @copyberry - #36734 Deduplicate MCP resource list handling @copyberry - #36740 Store turn skill state in extension data @copyberry - #36742 Simplify contextual user fragment registration @copyberry - #36744 Store the extension registry directly in its builder @copyberry - #36745 Consolidate apply_patch runtime execution @copyberry - #36757 Wait for patch events before reading shell snapshots @copyberry - #36759 Harden the TUI focus palette regression test @copyberry - #36764 Avoid building code-mode definitions during registration @copyberry - #36769 Stabilize the startup Git enrichment integration test @copyberry - #36770 Stabilize deferred goal fork testing @copyberry - #36771 Harden Linux managed proxy helper lifecycles @copyberry - #36772 Raise the host-owned Codex Apps catalog limit @copyberry - #36773 Derive the active user config layer from the layer stack @copyberry - #36774 Clarify config layer iteration APIs @copyberry - #36779 Stabilize network policy event capture in concurrent tests @copyberry - #36781 Add per-surface MCP tool exposure controls @copyberry - #36782 Add Guardian session reuse and interruption tests @copyberry - #36787 Consolidate model instructions in `ModelMessages` @copyberry - #36792 Gate plugin usage instructions by model capability @copyberry - #36793 Terminate timed-out Git process trees @copyberry - #36796 Add Agent Plugins MCP config parsing @copyberry - #36797 Normalize rusty_v8 checksum manifest line endings @copyberry - #36800 Avoid reinjecting permissions after command approvals @copyberry - #36807 Extract audio preparation into a utility crate @copyberry - #36808 Prefer SQLite names for local session archive commands @copyberry - #36809 Prefer the state database for `exec resume --last` @copyberry - #36810 Add MCP client conformance regression gates @copyberry - #36811 Honor per-environment login shell policy @copyberry - #36812 Add a dual-WebSocket transport for code mode @copyberry - #36815 Identify agents by name in token budget context @copyberry - #36822 Fix typo in approval resolver name @copyberry - #36825 Consolidate approval telemetry context @copyberry - #36830 Time out stalled code-mode host requests @copyberry - #36834 Avoid requesting key-release events in Ghostty @copyberry - #36840 Keep API request metrics out of Statsig exports @copyberry - #36856 Support deferred loading for freeform tools @copyberry - #36857 Support custom tools in namespaces @copyberry - #36862 Consolidate thread spawning behind a request object @copyberry - #36871 Parallelize R2 asset publishing with DotSlash @copyberry - #36877 Move executor skill bundle loading into the skills extension @copyberry - #36880 Move direct executor skill discovery into the skills extension @copyberry - #36882 Preserve complete MCP namespace descriptions @copyberry - #36884 Add host skill root loading @copyberry - #36892 Support leaf models in multi-agent v2 @copyberry - #36893 Redact secrets from app-server command execution items @copyberry - #36895 Handle late MCP startup results after lag timeout @copyberry - #36898 Avoid redundant filesystem metadata probes @copyberry - #36900 Register app tools independently of the connector list @copyberry - #36901 Propagate updated permissions to review threads @copyberry - #36903 Load skill interface metadata in the host loader @copyberry - #36904 Limit RMCP logs persisted to SQLite @copyberry - #36906 Preserve model providers when reloading v2 agents @copyberry - #36908 Improve bearer token secret redaction @copyberry - #36910 Negotiate MCP extensions per app-server session @copyberry - #36912 Read approval policy from the current turn configuration @copyberry - #36913 Move skill policy resolution into `codex-skills` @copyberry - #36916 Centralize app enabled-state evaluation @copyberry - #36917 Test explicit plugin mentions with disabled apps @copyberry - #36919 Merge local plugins into plugin search results @copyberry - #36921 Move the host skills service into the skills extension @copyberry - #36924 Reject implicitly discovered bare Git repositories @copyberry - #36930 Read turn permissions from the current configuration @copyberry - #36935 Trust undecided local projects automatically @copyberry - #36938 Enable cached web search for Amazon Bedrock @copyberry - #36939 Include policy approval reasons in Guardian reviews @copyberry - #36941 Use current session settings for review threads @copyberry - #36943 Move host skill root resolution into the skills extension @copyberry - #36945 Grant the blob size policy job read access to contents @copyberry - #36947 Accept user input when starting idle turns @copyberry - #36948 Paginate transcript history in the TUI @copyberry - #36949 Improve paginated TUI history loading @copyberry - #36950 Paginate TUI transcript history @copyberry - #36951 Harden paginated history handling in the TUI @copyberry - #36952 Add durable per-thread user submission queues @copyberry - #36954 Add tool registry collision policy configuration @copyberry - #36956 Keep image resize notices attached during remote compaction @copyberry - #36959 Track connectors detected in external agent sessions @copyberry - #36960 Prompt before trusting local project directories @copyberry - #36963 Link Codex attribution in pull request bodies @copyberry - #36964 Preserve working directories when importing external sessions @copyberry - #36966 Allow disabling the built-in image viewer @copyberry - #36967 Skip symlinks when installing plugins @copyberry - #36970 Make token budget context identity configurable @copyberry - #36976 Honor explicit-only orchestrator skills @copyberry - #36977 Improve connector detection for migrated sessions @copyberry - #36979 Add Fence auditing to the blob size workflow @copyberry - #36981 Enable remote compaction for Amazon Bedrock @copyberry - #36983 Preserve ChatGPT auth for trusted staging MCP servers @copyberry - #36984 Support configured ChatGPT cookies in HTTP clients @copyberry - #36986 Add process-scoped PSP routing for ChatGPT requests @copyberry - #36987 Add opt-in concurrent exec-server request dispatch @copyberry - #36989 Preserve shared bundled skill caches @copyberry - #36990 Remove legacy collaboration mode variants @copyberry - #36992 Allow injecting model catalog caches @copyberry - #36993 Support `includeTurns` reads for paginated threads @copyberry - #36998 Support deferred custom tools in tool search @copyberry - #37000 Keep shared skill caches fresh across plugin loads @copyberry - #37020 Enforce strict tool name collision errors @copyberry - #37022 Canonicalize default tools under the `functions` namespace @copyberry - #37027 Enforce Agent Plugin runtime boundaries @copyberry - #37031 Apply permission profile updates to future turn environments @copyberry - #37035 Align registry tests with canonical tool names @copyberry - #37038 Use turn environment permissions for tool execution @copyberry - #37040 Use turn environment permissions for context and discovery @copyberry - #37053 Reject conflicting namespace descriptions in strict tool mode @copyberry - #37055 Add safer TUI defaults for cyber models @copyberry - #37066 Preserve longer MCP source descriptions in tool search @copyberry - #37068 Fall back to per-process MCP cleanup on macOS @copyberry - #37083 Consolidate unified exec output state @copyberry - #37101 Reuse stable MCP bindings across sampling steps @copyberry - #37103 Use Luna for API-key Guardian reviews @copyberry - #37109 Bound interactive telemetry shutdown @copyberry - #37114 Add per-session code-mode execution limits @copyberry - #37128 Centralize tool approval handling in `Session` @copyberry - #37129 Make Windows path URI comparisons ASCII-case-insensitive @copyberry - #37132 Enforce managed authentication requirements locally @copyberry - #37134 Report prompt image resizing to the model @copyberry - #37144 Preserve discovery paths for symlinked skills @copyberry - #37145 Gate Apps usage instructions by model capability @copyberry - #37147 Track provisioned environment state across registration @copyberry - #37149 Project orchestrator skills through world state @copyberry - #37151 Coalesce concurrent Git status scans @copyberry - #37154 Use Azure Key Vault for macOS notarization @copyberry - #37156 Test remote environments reported ready before selection @copyberry - #37157 Harden named session lookup in the TUI @copyberry - #37162 Load host skill roots through the skills extension @copyberry - #37166 Keep textarea cursors and rendering inside the viewport @copyberry - #37167 Expose session sources to MCP contributors @copyberry - #37168 Bound remote MCP handshake HTTP requests @copyberry - #37169 Move plugin skill snapshot integration tests into core @copyberry - #37174 Centralize skill invocation helpers in `codex-skills` @copyberry - #37175 Add legacy rollout migration to paginated history @copyberry - #37177 Move explicit skill selection into the skills crate @copyberry - #37178 Preserve image transparency metadata in app-server items @copyberry - #37188 Reserve the `tool_search` namespace for the search tool @copyberry - #37189 Track multi-agent usage hints in world state @copyberry