Codex CLI 0.165 接入 Vertex AI 并扩展会话迁移

2026-08-20 · 0.149.0 stable (2026-08-20T21:04Z, in-window; preceded by five 0.149.0 alphas 8/19-8/20; 0.150.0-alpha.1 already out 8/20 22:06Z). New: interactive agents dashboard for searching, starting, opening, renaming and stopping tasks with configurable shortcuts (#39094 et al.) — first fleet-management UI in a stable CLI agent runtime; `codex queue` sends messages into existing local/remote sessions (#39092), with queued messages reliably waking idle sessions and better duplicate-session-name resolution — cross-session messaging lands in Codex stable, initiated by user/orchestrator rather than agent-to-agent (trend #3 criterion (a) partially satisfied); /cd, /pwd, /cwd TUI commands for working-directory management (#38894); vim mode change motions cw/c$/cc (#39661); codex doctor checks endpoint protection, network/proxy failures, desktop app state, update connectivity (#38827 et al.). Also: GPT-5.6 max context window raised (#39102, no figures in release notes); sandbox hardening — dropped capabilities from Linux sandbox processes (#39103), fail-closed PowerShell Tree-sitter lowerer (#39213), symlink-safe sensitive-file reader (#39200); WebRTC sideband reconnects after transport loss without losing output (#39257); SDK exact CLI config overrides + max/ultra reasoning effort (#38817, #39662); docs now warn on DNS exfiltration risks in secure devcontainers (#39283). Recommendation stays ADOPT.

2026-08-26 · Recovered from index (previous run wrote the update note to index/events.json only): 0.150.0 stable (19:37Z): @-mentions reference other Codex tasks; agents can read, create, or message tasks from the terminal (agent-initiated cross-task messaging in stable — meets trend #3 criterion (a)); /copy picker; auto task titles; Interrupt hooks (commands/MCP handlers on turn interruption); security: untrusted-project AGENTS.md ignored, credential redaction in app-server diagnostics, app signature verification, Bedrock multi-agent/compaction fixes

2026-08-27 · Recovered from index (previous run wrote the update note to index/events.json only): 0.150.1 (01:56Z): remote compaction counts retained images toward token budget (backport)

2026-08-29 · 0.151.0 stable (2026-08-29T09:55:39Z GitHub / 09:59:26Z npm, in-window; twelve 0.151.0 alphas 8/27-8/29 preceded it; 0.152.0-alpha.1 followed at 10:53Z). New: configurable grace period for discovering tools from optional MCP servers (#41199); extensions can inspect or replace MCP tool results before they reach the model (#41202) — an MCP middleware hook landing in stable; plugin catalogs combine per-repository configuration and report invalid project marketplaces without hiding valid plugins (#41208). Fixes: restored permission profiles preserved across TUI turns and /cd no longer weakening sandbox restrictions (#41192); tool availability and reasoning effort kept correct across model switches and fallbacks (#41195, #41206); remote sandbox enforcement using the executor's actual home directory, OS and path conventions (#41196/41204/41207/41209); structured MCP tool/resource errors preserved in app-server responses (#41196); nested subagent token usage counted toward root goal budgets (#41183); stale Guardian classifications no longer authorize actions after permission state changes (#41196). Recommendation stays ADOPT.

2026-09-02 · 0.152.0 stable (9/1T01:58Z): Vim mode / and ? search in drafts with n/N repeat; rate-limit banners with check-usage/manage-credits/reset-limits actions; credential-refresh progress surfaced in TUI and codex exec (incl. Bedrock reauthentication); MCP server names may contain : @ / . for package-style naming; per-MCP-tool output_token_limit with consistent truncation across session resumes; app-server clients can configure thread/shellCommand timeouts (>1h deadlines); security — cloud task requests reject untrusted backend URLs and disable redirects to protect saved credentials; MCP tools survive cache refreshes and remote plugin changes with refreshed auth headers; planning tool disabled by default (tools.update_plan.enabled). 0.152.1 (9/1T22:33Z): Guardian approval review honors Node REPL policies from model metadata; 0.153.0-alpha line started same day

2026-09-04 · 0.153.0 stable (9/3T01:37Z): vim-mode u/Ctrl-R undo preserving full drafts incl. pasted attachments; plugin CLI list/install/remove from remote marketplaces; tui.auto_recap; TUI history shows full patches; Plus/Team early warning when under half of the ~5h usage window remains; TUI auto-reconnect after app-server drop with drafts retained; Full-Access Guardian scoping for confirm-only operations; remembered MCP tool approvals scoped per app account; rollback compaction incl. shared history; structured async questions (request_user_input_async); experimental context_management mode (token-budgeted context + history notes + new_context tool — the Astra notes-across-context-windows feature, default for Astra in coming weeks). 0.153.1-0.153.4 (9/3-9/4): GPT-6-Astra rollout chain — API config support, Fast-tier '2x speed' wording fix, Bedrock model picker, and 0.153.4 making Astra the bundled default when no model is explicitly configured. Alpha channel: 0.154.0-alpha.1-3. Captured 2026-09-05 run

2026-09-24 · Codex 0.156.0/0.156.1: worktrees default in command center, fullscreen transcript, usage analytics, voice, sandbox hardening and GPT-6 Sol/Luna routing; stays ADOPT

2026-09-26 · Codex 0.157.0: automatic background server, cross-app fork/import and redirect-safe network enforcement; stays ADOPT

2026-09-28 · Codex 0.158.0: MCP OAuth client secrets, authenticated exec-server WebSockets, default terminal-input approval and cross-platform sandbox fixes; stays ADOPT