Summary
Codex CLI 0.148.0 (stable) is headlined by session forking: `codex exec fork` branches an existing session, and the TUI resume picker can now archive and restore sessions. Hooks can run commands asynchronously and invoke MCP tools. Amazon Bedrock Runtime becomes a built-in provider, with AWS profile and region selection and GPT-5.6 routing; `/status`, status lines and terminal titles now show estimated thread credits and cost. Also new: `/export` saves a conversation as markdown to the clipboard or a file, and prompts can be drafted while the TUI starts up. Fixes cover stale instructions after model switching, resumed sessions restoring cwd and approval policy, reconnection through provider outages, MCP recovery after OAuth re-auth, and sandbox restrictions that now fail closed for denied or unreadable paths on Linux and Windows.
Why it matters
Three engineering-relevant moves land in one release. Session forking reaches the stable channel, extending Codex's multi-agent primitives from subagent spawning to exec-level branch-and-parallel workflows. Async hooks that can call MCP tools turn Codex into a programmable orchestration point. And a built-in Bedrock provider gives AWS shops a first-party path to Codex models, while `/status` cost visibility closes a long-standing budgeting gap.
Technical details
| Version | 0.148.0 (stable) |
|---|---|
| Session Forking | codex exec fork; archive/restore from TUI resume picker |
| Hooks | async command execution; can invoke MCP tools |
| Bedrock | built-in Amazon Bedrock Runtime provider; AWS profile + region; GPT-5.6 routing |
| Cost Visibility | estimated thread credits/cost in /status, status lines, terminal titles |
| Export | /export markdown to clipboard or file |
| Hardening | sandbox fail-closed for denied/unreadable paths (Linux/Windows) · MCP recovery after OAuth re-auth · reconnect through provider outages · resumed sessions restore cwd + approval policy |
| V0 150 0 | 0.150.0 stable (2026-08-26T19:37Z): @-mentions reference other Codex tasks; agents can read, create, or message tasks from the terminal — agent-initiated cross-task messaging in stable; Interrupt hooks (commands/MCP handlers on turn interruption); security: untrusted-project AGENTS.md ignored, credential redaction in app-server diagnostics, app signature verification, Bedrock multi-agent/compaction fixes |
| V0 150 1 | 0.150.1 (2026-08-27T01:56Z): remote compaction counts retained images toward token budget (backport) |
Updates
2026-08-20 0.149.0 stable (2026-08-20T21:04Z, in-window; preceded by five 0.149.0 alphas 8/19-8/20; 0.150.0-alpha.1 already out 8/20 22:06Z). New: interactive agents dashboard for searching, starting, opening, renaming and stopping tasks with configurable shortcuts (#39094 et al.) — first fleet-management UI in a stable CLI agent runtime; `codex queue` sends messages into existing local/remote sessions (#39092), with queued messages reliably waking idle sessions and better duplicate-session-name resolution — cross-session messaging lands in Codex stable, initiated by user/orchestrator rather than agent-to-agent (trend #3 criterion (a) partially satisfied); /cd, /pwd, /cwd TUI commands for working-directory management (#38894); vim mode change motions cw/c$/cc (#39661); codex doctor checks endpoint protection, network/proxy failures, desktop app state, update connectivity (#38827 et al.). Also: GPT-5.6 max context window raised (#39102, no figures in release notes); sandbox hardening — dropped capabilities from Linux sandbox processes (#39103), fail-closed PowerShell Tree-sitter lowerer (#39213), symlink-safe sensitive-file reader (#39200); WebRTC sideband reconnects after transport loss without losing output (#39257); SDK exact CLI config overrides + max/ultra reasoning effort (#38817, #39662); docs now warn on DNS exfiltration risks in secure devcontainers (#39283). Recommendation stays ADOPT.
2026-08-26 Recovered from index (previous run wrote the update note to index/events.json only): 0.150.0 stable (19:37Z): @-mentions reference other Codex tasks; agents can read, create, or message tasks from the terminal (agent-initiated cross-task messaging in stable — meets trend #3 criterion (a)); /copy picker; auto task titles; Interrupt hooks (commands/MCP handlers on turn interruption); security: untrusted-project AGENTS.md ignored, credential redaction in app-server diagnostics, app signature verification, Bedrock multi-agent/compaction fixes
2026-08-27 Recovered from index (previous run wrote the update note to index/events.json only): 0.150.1 (01:56Z): remote compaction counts retained images toward token budget (backport)
2026-08-29 0.151.0 stable (2026-08-29T09:55:39Z GitHub / 09:59:26Z npm, in-window; twelve 0.151.0 alphas 8/27-8/29 preceded it; 0.152.0-alpha.1 followed at 10:53Z). New: configurable grace period for discovering tools from optional MCP servers (#41199); extensions can inspect or replace MCP tool results before they reach the model (#41202) — an MCP middleware hook landing in stable; plugin catalogs combine per-repository configuration and report invalid project marketplaces without hiding valid plugins (#41208). Fixes: restored permission profiles preserved across TUI turns and /cd no longer weakening sandbox restrictions (#41192); tool availability and reasoning effort kept correct across model switches and fallbacks (#41195, #41206); remote sandbox enforcement using the executor's actual home directory, OS and path conventions (#41196/41204/41207/41209); structured MCP tool/resource errors preserved in app-server responses (#41196); nested subagent token usage counted toward root goal budgets (#41183); stale Guardian classifications no longer authorize actions after permission state changes (#41196). Recommendation stays ADOPT.
2026-09-02 0.152.0 stable (9/1T01:58Z): Vim mode / and ? search in drafts with n/N repeat; rate-limit banners with check-usage/manage-credits/reset-limits actions; credential-refresh progress surfaced in TUI and codex exec (incl. Bedrock reauthentication); MCP server names may contain : @ / . for package-style naming; per-MCP-tool output_token_limit with consistent truncation across session resumes; app-server clients can configure thread/shellCommand timeouts (>1h deadlines); security — cloud task requests reject untrusted backend URLs and disable redirects to protect saved credentials; MCP tools survive cache refreshes and remote plugin changes with refreshed auth headers; planning tool disabled by default (tools.update_plan.enabled). 0.152.1 (9/1T22:33Z): Guardian approval review honors Node REPL policies from model metadata; 0.153.0-alpha line started same day
2026-09-04 0.153.0 stable (9/3T01:37Z): vim-mode u/Ctrl-R undo preserving full drafts incl. pasted attachments; plugin CLI list/install/remove from remote marketplaces; tui.auto_recap; TUI history shows full patches; Plus/Team early warning when under half of the ~5h usage window remains; TUI auto-reconnect after app-server drop with drafts retained; Full-Access Guardian scoping for confirm-only operations; remembered MCP tool approvals scoped per app account; rollback compaction incl. shared history; structured async questions (request_user_input_async); experimental context_management mode (token-budgeted context + history notes + new_context tool — the Astra notes-across-context-windows feature, default for Astra in coming weeks). 0.153.1-0.153.4 (9/3-9/4): GPT-6-Astra rollout chain — API config support, Fast-tier '2x speed' wording fix, Bedrock model picker, and 0.153.4 making Astra the bundled default when no model is explicitly configured. Alpha channel: 0.154.0-alpha.1-3. Captured 2026-09-05 run
Tags
codexopenaiclisession-forkinghooksmcpbedrockawscost-visibilityrelease