Codex CLI 0.148.0 (stable) is headlined by session forking: `codex exec fork` branches an existing session, and the TUI resume picker can now archive and restore sessions. Hooks can run commands asynchronously and invoke MCP tools. Amazon Bedrock Runtime becomes a built-in provider, with AWS profile and region selection and GPT-5.6 routing; `/status`, status lines and terminal titles now show estimated thread credits and cost. Also new: `/export` saves a conversation as markdown to the clipboard or a file, and prompts can be drafted while the TUI starts up. Fixes cover stale instructions after model switching, resumed sessions restoring cwd and approval policy, reconnection through provider outages, MCP recovery after OAuth re-auth, and sandbox restrictions that now fail closed for denied or unreadable paths on Linux and Windows.
Codex CLI 0.165 adds Vertex AI and broader session portability
Codex CLI 0.165 adds a built-in Google Vertex AI provider, GPT-6.1 Terra in the model catalog, repository filters and directory grouping. It also makes memory v2 the default for fresh profiles, adds external memory import, and experiments with attached thread forks and mid-conversation reasoning changes. Fixes cover approval defaults, MCP cancellation, queued messages after interruption and marketplace URL validation.
Imported from the existing research archive. Migration preserves the recorded judgment and is not a fresh verification.
What this means for you
For teams that move coding-agent sessions across providers or workspaces, this release reduces setup friction and makes accumulated memory more portable. The experimental fork and effort controls still need regression tests around permissions, interruption and replay.
Evidence & related material
Codex 0.158.0 stable supports pre-registered MCP OAuth client secrets and bearer-token authentication for exec-server, enables terminal-input approval by default for elevated commands, and fixes sandbox-boundary failures across Windows, Linux and macOS.
Codex 0.159.0 stable adds in-flight steering and app-server history pagination while preserving filesystem denials, protecting `.aws`, and fixing macOS network-sandbox and Windows MCP process boundaries.
Codex 0.160.0 adds opt-in Guardian retrieval of prior context and improves resume, reconnect and long-running reliability.
Codex 0.161.0 expands Bedrock multi-agent support and hardens remote sessions and sandbox boundaries.
Codex 0.162.0 enables managed-worktree creation, task pinning and ranked tool discovery while fixing cross-platform sandboxes.
Codex 0.163.0 strengthens parallel reads, steering and sandbox boundaries
Codex CLI 0.164.0 adds enterprise MCP authentication and fixes remote-shell and local-execution boundary issues.
Codex 0.165 adds Vertex AI, portable memory and experimental attached forks.
Subsequent changes
Codex 0.158.0 hardens MCP authentication, command approval and cross-platform sandboxes
Codex 0.159.0 adds in-flight steering and tightens local execution boundaries
Codex 0.160.0 adds Guardian context retrieval and improves resume reliability
Codex 0.161.0 expands Bedrock multi-agent support and hardens remote sessions and sandbox boundaries.
Codex 0.162.0 enables managed worktrees and task pinning
Codex 0.163.0 strengthens parallel reads, steering and sandbox boundaries
Codex 0.164.0 adds enterprise MCP authentication and hardens remote shells
Codex 0.165 adds Vertex AI, portable memory and experimental attached forks
Technical details & scores
| Version | 0.148.0 (stable) |
|---|---|
| Session Forking | codex exec fork; archive/restore from TUI resume picker |
| Hooks | async command execution; can invoke MCP tools |
| Bedrock | built-in Amazon Bedrock Runtime provider; AWS profile + region; GPT-5.6 routing |
| Cost Visibility | estimated thread credits/cost in /status, status lines, terminal titles |
| Export | /export markdown to clipboard or file |
| Hardening | macOS case-variant paths, replaceable executable symlinks and permission ordering |
| V0 150 0 | 0.150.0 stable (2026-08-26T19:37Z): @-mentions reference other Codex tasks; agents can read, create, or message tasks from the terminal — agent-initiated cross-task messaging in stable; Interrupt hooks (commands/MCP handlers on turn interruption); security: untrusted-project AGENTS.md ignored, credential redaction in app-server diagnostics, app signature verification, Bedrock multi-agent/compaction fixes |
| V0 150 1 | 0.150.1 (2026-08-27T01:56Z): remote compaction counts retained images toward token budget (backport) |
| Latest Stable | 0.165.0 |
| Enterprise Mcp Auth | eligible Codex grants, dedicated OAuth and confidential clients |
| Remote Shell | masks credentials in Bash/Zsh snapshots |
| Reliability | compaction recovery and thread settings |
| Published At | 2026-10-27T20:09:38Z |
| V0 165 0 | Built-in Vertex AI provider, GPT-6.1 Terra catalog, repository filters and directory grouping, memory v2 default for fresh profiles, external memory import, experimental attached forks and mid-conversation reasoning changes |
Historical update notes
· 0.149.0 stable (2026-08-20T21:04Z, in-window; preceded by five 0.149.0 alphas 8/19-8/20; 0.150.0-alpha.1 already out 8/20 22:06Z). New: interactive agents dashboard for searching, starting, opening, renaming and stopping tasks with configurable shortcuts (#39094 et al.) — first fleet-management UI in a stable CLI agent runtime; `codex queue` sends messages into existing local/remote sessions (#39092), with queued messages reliably waking idle sessions and better duplicate-session-name resolution — cross-session messaging lands in Codex stable, initiated by user/orchestrator rather than agent-to-agent (trend #3 criterion (a) partially satisfied); /cd, /pwd, /cwd TUI commands for working-directory management (#38894); vim mode change motions cw/c$/cc (#39661); codex doctor checks endpoint protection, network/proxy failures, desktop app state, update connectivity (#38827 et al.). Also: GPT-5.6 max context window raised (#39102, no figures in release notes); sandbox hardening — dropped capabilities from Linux sandbox processes (#39103), fail-closed PowerShell Tree-sitter lowerer (#39213), symlink-safe sensitive-file reader (#39200); WebRTC sideband reconnects after transport loss without losing output (#39257); SDK exact CLI config overrides + max/ultra reasoning effort (#38817, #39662); docs now warn on DNS exfiltration risks in secure devcontainers (#39283). Recommendation stays ADOPT.
· Recovered from index (previous run wrote the update note to index/events.json only): 0.150.0 stable (19:37Z): @-mentions reference other Codex tasks; agents can read, create, or message tasks from the terminal (agent-initiated cross-task messaging in stable — meets trend #3 criterion (a)); /copy picker; auto task titles; Interrupt hooks (commands/MCP handlers on turn interruption); security: untrusted-project AGENTS.md ignored, credential redaction in app-server diagnostics, app signature verification, Bedrock multi-agent/compaction fixes
· Recovered from index (previous run wrote the update note to index/events.json only): 0.150.1 (01:56Z): remote compaction counts retained images toward token budget (backport)
· 0.151.0 stable (2026-08-29T09:55:39Z GitHub / 09:59:26Z npm, in-window; twelve 0.151.0 alphas 8/27-8/29 preceded it; 0.152.0-alpha.1 followed at 10:53Z). New: configurable grace period for discovering tools from optional MCP servers (#41199); extensions can inspect or replace MCP tool results before they reach the model (#41202) — an MCP middleware hook landing in stable; plugin catalogs combine per-repository configuration and report invalid project marketplaces without hiding valid plugins (#41208). Fixes: restored permission profiles preserved across TUI turns and /cd no longer weakening sandbox restrictions (#41192); tool availability and reasoning effort kept correct across model switches and fallbacks (#41195, #41206); remote sandbox enforcement using the executor's actual home directory, OS and path conventions (#41196/41204/41207/41209); structured MCP tool/resource errors preserved in app-server responses (#41196); nested subagent token usage counted toward root goal budgets (#41183); stale Guardian classifications no longer authorize actions after permission state changes (#41196). Recommendation stays ADOPT.
· 0.152.0 stable (9/1T01:58Z): Vim mode / and ? search in drafts with n/N repeat; rate-limit banners with check-usage/manage-credits/reset-limits actions; credential-refresh progress surfaced in TUI and codex exec (incl. Bedrock reauthentication); MCP server names may contain : @ / . for package-style naming; per-MCP-tool output_token_limit with consistent truncation across session resumes; app-server clients can configure thread/shellCommand timeouts (>1h deadlines); security — cloud task requests reject untrusted backend URLs and disable redirects to protect saved credentials; MCP tools survive cache refreshes and remote plugin changes with refreshed auth headers; planning tool disabled by default (tools.update_plan.enabled). 0.152.1 (9/1T22:33Z): Guardian approval review honors Node REPL policies from model metadata; 0.153.0-alpha line started same day
· 0.153.0 stable (9/3T01:37Z): vim-mode u/Ctrl-R undo preserving full drafts incl. pasted attachments; plugin CLI list/install/remove from remote marketplaces; tui.auto_recap; TUI history shows full patches; Plus/Team early warning when under half of the ~5h usage window remains; TUI auto-reconnect after app-server drop with drafts retained; Full-Access Guardian scoping for confirm-only operations; remembered MCP tool approvals scoped per app account; rollback compaction incl. shared history; structured async questions (request_user_input_async); experimental context_management mode (token-budgeted context + history notes + new_context tool — the Astra notes-across-context-windows feature, default for Astra in coming weeks). 0.153.1-0.153.4 (9/3-9/4): GPT-6-Astra rollout chain — API config support, Fast-tier '2x speed' wording fix, Bedrock model picker, and 0.153.4 making Astra the bundled default when no model is explicitly configured. Alpha channel: 0.154.0-alpha.1-3. Captured 2026-09-05 run
· Codex 0.156.0/0.156.1: worktrees default in command center, fullscreen transcript, usage analytics, voice, sandbox hardening and GPT-6 Sol/Luna routing; stays ADOPT
· Codex 0.157.0: automatic background server, cross-app fork/import and redirect-safe network enforcement; stays ADOPT
· Codex 0.158.0: MCP OAuth client secrets, authenticated exec-server WebSockets, default terminal-input approval and cross-platform sandbox fixes; stays ADOPT