Codex rust-v0.149.0

## New Features - Added an interactive `codex agents` dashboard for searching, starting, opening, renaming, and stopping tasks, with configurable shortcuts. (#39094, #39112, #39114, #39142) - Added `/cd`, `/pwd`, and `/cwd` commands for managing the working directory in TUI sessions. (#38894) - Added `codex queue` for sending messages to existing local or remote sessions. (#39092) - Expanded Vim editing with character replacement and more change motions such as `cw`, `c$`, and `cc`. (#39661) - `codex doctor` now diagnoses endpoint protection, network/proxy failures, desktop app state, and update connectivity. (#38827, #38918, #39060, #39074) - SDK users can now pass exact CLI config overrides and select `max` or `ultra` reasoning effort. (#38817, #39662) ## Bug Fixes - Queued messages now wake idle sessions reliably, resolve duplicate session names more usefully, and preserve pasted or deferred command semantics. (#39034, #39385, #39604) - Resumed and forked threads now restore their active permission profile instead of silently falling back to current defaults. (#39153) - Fixed duplicate sub-agent activity and tightened TUI routing for sub-agent notifications and approvals. (#39049, #39088) - Realtime WebRTC sideband connections now reconnect after unexpected transport loss without dropping pending output. (#39257) - Inline TUI history now remains available in Windows Terminal scrollback. (#39619) - Inactive TUI thread replay buffers are now bounded to prevent excessive retained streamed output. (#39081) ## Documentation - Clarified that external contributions should go through issues and design discussion rather than pull requests. (#39089) - Documented DNS exfiltration risks and trust limitations for secure devcontainers. (#39283) ## Changelog Full Changelog: https://github.com/openai/codex/compare/rust-v0.148.0...rust-v0.149.0 - #38817 Add raw config overrides to the TypeScript SDK @copyberry - #38819 Support metadata staging for reserved thread IDs @copyberry - #38822 Avoid cloning TUI history span content @copyberry - #38823 Avoid allocating per character when decorating hyperlinks @copyberry - #38827 Add endpoint protection checks to `codex doctor` @copyberry - #38830 Isolate external editor buffers from sandbox-writable paths @copyberry - #38837 Share editor keymaps across TUI composer components @copyberry - #38840 Identify Mac mini hosts in remote control handshakes @copyberry - #38893 Restore thread timestamp maxima independently @copyberry - #38894 Add working-directory commands to the TUI @copyberry - #38899 Move requirements policy ownership to execpolicy @copyberry - #38902 Honor per-environment shell variable policies @copyberry - #38907 Edit queued messages with Vim history-up @copyberry - #38913 Stop rendering columns after filling their area @copyberry - #38916 Honor legacy `:project_roots` permission entries @copyberry - #38918 Improve `codex doctor` network diagnostics @copyberry - #38919 Reject obsolete app-server permission profile fields @copyberry - #38921 Compact successful command activity in the TUI @copyberry - #38940 Add experimental app-server project APIs @copyberry - #38941 Prevent Noise auth tokens from reaching child processes @copyberry - #38942 Enforce environment-specific command policies @copyberry - #38947 Stop loading legacy managed config on Windows @copyberry - #38978 Add a configurable skill catalog token budget @copyberry - #38980 Bound Guardian v2 parent compaction context @copyberry - #38987 Include images in Guardian v2 transcripts @copyberry - #38990 Source Guardian v2 defaults from the model catalog @copyberry - #38993 Evaluate recent and character-routed skill selection @copyberry - #38994 Remove the workspace settings gate for apps and plugins @copyberry - #38997 Retry transient Guardian sampling failures @copyberry - #39001 Ignore stale Guardian tool risk scores @copyberry - #39005 Disable Guardian V2 for managed automatic reviewers @copyberry - #39006 Emit API-key turn cost telemetry from app-server @copyberry - #39007 Wait for Guardian score progress in approval tests @copyberry - #39008 Add task context to shadow skill selection @copyberry - #39017 Move MCP policy types into `codex-protocol` @copyberry - #39019 Isolate MCP resource headers during OAuth requests @copyberry - #39020 Restrict Windows IDE pipe client impersonation @copyberry - #39022 Hang soft-break whitespace in the TUI composer @copyberry - #39023 Reduce retained MCP result data in TUI history @copyberry - #39025 Speed up the large diff highlighting test @copyberry - #39026 Use simulated time in the long typing test @copyberry - #39028 Cache the test pet spritesheet encoding @copyberry - #39030 Speed up the in-app resume cwd test @copyberry - #39032 Encapsulate TUI shimmer under the motion module @copyberry - #39033 Bound legacy resume preview scans @copyberry - #39034 Dispatch queued messages written by other processes @copyberry - #39035 Add app-server coverage for Guardian V2 approval routing @copyberry - #39036 Allow config reads to join active app-server read batches @copyberry - #39038 Restore Guardian risk scores across thread lifecycles @copyberry - #39040 Preserve foreign paths in managed network approvals @copyberry - #39043 Enforce managed authentication backend settings @copyberry - #39045 Add managed gates for in-app chat and dictation @copyberry - #39046 Restrict MCP HTTP redirects to the configured origin @copyberry - #39047 Skip plugin hook loading when hooks are disabled @copyberry - #39049 Avoid rendering sub-agent activity twice in the TUI @copyberry - #39050 Prepare the telemetry shutdown worker during initialization @copyberry - #39051 Use installed callable apps for TUI mentions @copyberry - #39055 Add network policy metadata to environment configuration @copyberry - #39056 Verify the pinned zsh manifest in release builds @copyberry - #39057 Rate-limit TUI frames from their actual emission time @copyberry - #39058 Tag Codex Apps protocol discovery metrics @copyberry - #39060 Add desktop app diagnostics to `codex doctor` @copyberry - #39061 Avoid rerendering streamed code fences @copyberry - #39063 Render only visible rows in the transcript pager @copyberry - #39064 Restrict queued-message editing to its dedicated binding @copyberry - #39065 Limit terminal hyperlink layout to the visible viewport @copyberry - #39067 Add desktop security enforcement diagnostics @copyberry - #39068 Remove skill model delegation support @copyberry - #39072 Persist generated images through turn executors @copyberry - #39073 Propagate caller metadata to rendezvous connections @copyberry - #39074 Add desktop update diagnostics to `codex doctor` @copyberry - #39075 Avoid redundant terminal row clears @copyberry - #39077 Build filesystem JSON params only for remote TUI sessions @copyberry - #39078 Preserve tracing context for environment resolution @copyberry - #39079 Apply user MCP policy to selected executor plugins @copyberry - #39081 Bound TUI thread replay buffers by delta size @copyberry - #39082 Prompt for project trust in remote TUI workspaces @copyberry - #39083 Harden Windows sandbox provisioning against reparse points @copyberry - #39084 Preserve filesystem permission path conventions @copyberry - #39087 Read plugin authentication state from AuthManager @copyberry - #39088 Harden TUI subagent navigation @copyberry - #39089 Clarify the external contribution policy @copyberry - #39092 Add a command to queue messages for existing sessions @copyberry - #39094 Add an agents overview dashboard to the TUI @copyberry - #39098 Trace exec-server requests from receipt through completion @copyberry - #39100 Avoid redundant terminal size queries during history insertion @copyberry - #39101 Update rmcp to 3.1.2 @copyberry - #39102 Raise the GPT-5.6 maximum context window @copyberry - #39103 Drop capabilities from Linux sandbox processes @copyberry - #39112 Make the agents overview an interactive task dashboard @copyberry - #39113 Surface interactive requests in realtime conversations @copyberry - #39114 Add a dedicated `codex agents` dashboard command @copyberry - #39115 Remove the experimental thread config endpoint @copyberry - #39117 Reject lossy legacy permission projections @copyberry - #39122 Fail closed on deeply nested command wrappers @copyberry - #39131 Validate identifiers in plugin creator workflows @copyberry - #39141 Redact auth tokens from app-server response logs @copyberry - #39142 Add configurable shortcuts for the agents dashboard @copyberry - #39143 Hydrate recommended plugin metadata on selection @copyberry - #39145 Persist active permission profiles in turn context @copyberry - #39147 Centralize persisted resume settings lookup @copyberry - #39152 Update PyPI publish action to v1.14.2 @copyberry - #39153 Restore permission profiles when resuming threads @copyberry - #39154 Box the TUI future to bound CLI stack usage @copyberry - #39155 Prepare Python SDK 0.147.0 stable release @copyberry - #39157 Notify clients when Guardian requires strict review @copyberry - #39159 Require approval for commands with dynamic shell words @copyberry - #39163 Refresh collaboration instructions when their content changes @copyberry - #39165 Prevent marketplace identity spoofing @copyberry - #39174 Skip empty user messages for automatic idle turns @copyberry - #39176 Drop descendant progress updates after remote compaction @copyberry - #39187 Scope MCP app resource reads to their originating call @copyberry - #39192 Preserve MCP resource origins across compaction @copyberry - #39200 Add a symlink-safe reader for sensitive files @copyberry - #39205 Reject symbolic links in memory workspaces @copyberry - #39213 Add a fail-closed Tree-sitter PowerShell lowerer @copyberry - #39214 Prevent custom providers from inheriting ambient auth @copyberry - #39220 Reconnect Guardian sampling WebSockets after auth changes @copyberry - #39221 Skip redirected external-agent migration destinations @copyberry - #39224 Add Guardian v2 approval review metrics @copyberry - #39227 Include node_repl screenshots in Guardian v2 reviews @copyberry - #39235 Decouple Noise relay streams from JSON-RPC processing @copyberry - #39240 Deduplicate remote plugin bundle syncs with shared semaphores @copyberry - #39241 Record Guardian v2 classification metrics @copyberry - #39242 Add safe permission profile intersection @copyberry - #39244 Scope MCP resource reads by connector @copyberry - #39246 Give Guardian classifier connections distinct thread identities @copyberry - #39249 Add exec-server forwarding mode @copyberry - #39256 Deduplicate rollout moves when archiving threads @copyberry - #39257 Reconnect WebRTC Realtime sideband transports @copyberry - #39259 Simplify unified exec output snapshots @copyberry - #39261 Stop TUI chats on misalignment policy violations @copyberry - #39262 Prevent ConPTY DLL loading from the current directory @copyberry - #39264 Improve Guardian v2 risk classification @copyberry - #39266 Require fresh approval beneath denied permission paths @copyberry - #39267 Inject Node REPL policy into Guardian review sessions @copyberry - #39273 Preserve thread names during rollout migration @copyberry - #39274 Add provider-owned authentication recovery @copyberry - #39277 Declare experimental Amazon Bedrock setup APIs @copyberry - #39278 Preserve owner-provided environment configuration @copyberry - #39279 Propagate Windows sandbox ACL update failures @copyberry - #39281 Move shell snapshot scripts into `codex-shell-command` @copyberry - #39283 Document secure devcontainer DNS exfiltration risk @copyberry - #39284 Report network disconnects during approval @copyberry - #39285 Show file destinations in TUI change approvals @copyberry - #39287 Report diagnostic upload failures @copyberry - #39288 Register the async message feature flag @copyberry - #39290 Add Windows sandbox diagnostics to `codex doctor` @copyberry - #39293 Remove app-server's direct reqwest dependency @copyberry - #39294 Increase SQLite log sink batching @copyberry - #39296 Enable MCP tool hooks in Codex sessions @copyberry - #39298 Allow overriding Codex package versions @copyberry - #39299 Restrict agent roles to bounded configuration overrides @copyberry - #39301 Prevent Node REPL auth tokens from reaching child processes @copyberry - #39303 Record Guardian v2 classification token usage @copyberry - #39304 Keep Guardian v2 risk scores in memory @copyberry - #39306 Honor managed config during project discovery @copyberry - #39307 Fail closed on Guardian V2 risk scoring errors @copyberry - #39309 Attribute executor skill invocations to plugins @copyberry - #39311 Bind unified exec approvals to shell executables @copyberry - #39312 Add async delivery metadata to agent messages @copyberry - #39314 Run hooks with the captured session environment @copyberry - #39315 Evict guardian transcript entries in cacheable chunks @copyberry - #39316 Support Edu Plus and Edu Pro account plans @copyberry - #39319 Add the async user message tool @copyberry - #39320 Expand OAuth metadata redirect test coverage @copyberry - #39322 Enforce workspace restrictions for header authentication @copyberry - #39325 Stop migrating Cursor sandbox settings @copyberry - #39331 Route hook MCP calls through current connections @copyberry - #39335 Enforce environment MCP policies @copyberry - #39372 Scope TUI approval requests to their threads @copyberry - #39385 Prefer the most recent session when queueing by name @copyberry - #39402 Remove npm package staging from repo checks @copyberry - #39404 Support FD mounts with older system Bubblewrap versions @copyberry - #39410 Refresh expired AWS credentials for Bedrock @copyberry - #39452 Remove the feature gate for async user messages @copyberry - #39474 Consolidate Guardian extensions into `codex-guardian-v2` @copyberry - #39480 Move shell snapshot tests into shell-command @copyberry - #39493 Make head-tail buffer capacity const generic @copyberry - #39494 Test panoramic Guardian transcript image resizing @copyberry - #39496 Use default timeouts in cyber exec policy tests @copyberry - #39497 Correct normalized dynamic tool coverage across response modes @copyberry - #39501 Use a narrow fixture for the unified image resize test @copyberry - #39505 Test text stringify errors in the code mode runtime @copyberry - #39506 Test code mode notifications without a sync tool call @copyberry - #39509 Test disabled enhanced Node REPL transcript images separately @copyberry - #39510 Track built-in control tool calls in analytics @copyberry - #39514 Use stored item types when materializing turn summaries @copyberry - #39515 Use `mem::take` to drain unified exec output buffers @copyberry - #39520 Isolate automatic plugin Git operations @copyberry - #39523 Persist thread section moves before the first turn @copyberry - #39524 Stop treating Git commands as inherently safe @copyberry - #39584 Add a just recipe for assembling Codex packages @copyberry - #39585 Test plugin sync isolation from repository Git config @copyberry - #39586 Isolate IPC in Bubblewrap sandboxes @copyberry - #39588 Preserve unparsed shell wrappers in exec policy @copyberry - #39590 Harden plugin manifest handling during installation @copyberry - #39592 Prevent SQLx warnings from feeding back into SQLite logs @copyberry - #39594 Raise the MCP tool name limit to 128 bytes @copyberry - #39595 Keep marketplace upgrade state out of config @copyberry - #39597 Separate thread settings from environment configuration @copyberry - #39599 Protect macOS Seatbelt writable root anchors @copyberry - #39601 Keep async user messages on the direct tool surface @copyberry - #39602 Use in-process parsing for PowerShell command classification @copyberry - #39604 Preserve queued TUI input semantics @copyberry - #39605 Hide approved automatic review warnings in the TUI @copyberry - #39606 Enable user namespaces in shared CI setup @copyberry - #39607 Resolve model-provided shells by type @copyberry - #39608 Harden skill installation against unsafe symlinks @copyberry - #39609 Limit Bazel integration test threads on macOS @copyberry - #39611 Harden MCP OAuth fallback credential writes @copyberry - #39614 Prevent `apply_patch` from widening write permissions @copyberry - #39615 Bind MCP OAuth refresh tokens to their issuer @copyberry - #39616 Validate linked worktrees before inheriting project trust @copyberry - #39618 Apply composer editing preferences to TUI text prompts @copyberry - #39619 Preserve inline TUI scrollback in Windows Terminal @copyberry - #39620 Stream executor capability and skill file reads @copyberry - #39623 Prevent protected-path rename bypasses in macOS Seatbelt @copyberry - #39625 Add cwd-relative turn diff paths @copyberry - #39629 Preserve parent repository discovery through sandbox metadata mounts @copyberry - #39630 Retire the untrusted approval policy @copyberry - #39631 Skip sandboxed shell commands in Guardian v2 by default @copyberry - #39632 Expose permission profile resolution in the core API @copyberry - #39635 Show strict review warnings in the TUI @copyberry - #39637 Treat `invalid_grant` refresh failures as permanent @copyberry - #39640 Prompt to unarchive sessions before resuming or forking @copyberry - #39641 Sanitize developer context in full-history agent forks @copyberry - #39645 Enforce managed residency for model providers @copyberry - #39646 Exercise restricted-token sandboxing in cyber policy tests @copyberry - #39649 Resolve bundled Windows helpers through bin junctions @copyberry - #39653 Enforce filesystem permissions when loading AGENTS.md @copyberry - #39655 Make core integration test permissions explicit @copyberry - #39656 Advertise the Desktop app in graphical Linux sessions @copyberry - #39657 Warn when launching the deprecated MCP server @copyberry - #39658 Let Guardian V2 satisfy required model reviews @copyberry - #39659 Harden unsandboxed patch filesystem access @copyberry - #39661 Expand Vim change commands and add character replacement @copyberry - #39662 Add max and ultra reasoning efforts to the SDKs @copyberry - #39663 Restrict plugin migration to home scope @copyberry - #39665 Add macOS Seatbelt filesystem integration tests @copyberry - #39666 Improve no-follow filesystem behavior across platforms @copyberry