摘要

Codex CLI 0.148.0 稳定版发布，主打会话分叉：用 `codex exec fork` 可以从现有会话开出分支，TUI 的恢复选择器也支持归档和恢复会话。hooks 现在可以异步执行命令，还能调用 MCP 工具。Amazon Bedrock Runtime 成为内置 provider，支持 AWS profile、区域选择和 GPT-5.6 路由；`/status`、状态栏和终端标题会显示会话的预估 credits 和成本。其他新增：`/export` 把对话导出为 markdown（到剪贴板或文件），TUI 启动期间就能先起草 prompt。修复包括：模型切换后残留旧指令、恢复会话时还原工作目录与 approval policy、provider 故障期间的重连、OAuth 重新认证后的 MCP 恢复；Linux 和 Windows 沙箱对被拒或不可读的路径改为默认拒绝（fail closed）。

为什么重要
对用 Codex 搭多 agent 工作流的人来说，这一个版本里有三件事值得注意。会话分叉进入稳定通道，Codex 的多 agent 原语从 subagent 派生扩展到了 exec 级别的分支与并行。能调用 MCP 工具的异步 hooks，让 Codex 变成一个可编程的编排点。内置 Bedrock provider 给 AWS 团队一条跑 Codex 模型的第一方路径，`/status` 的成本显示也补上了长期缺失的预算管理环节。
技术细节
版本 0.148.0（stable）
会话分叉 codex exec fork；可在 TUI 恢复选择器中归档、恢复会话
Hooks 异步命令执行；可调用 MCP 工具
Bedrock 内置 Amazon Bedrock Runtime provider；支持 AWS profile 与区域选择；GPT-5.6 路由
成本可见性 /status、状态栏和终端标题显示会话预估 credits 与成本
导出 /export 导出 markdown 到剪贴板或文件
加固 沙箱对被拒绝或不可读的路径默认拒绝（fail-closed，Linux/Windows） · OAuth 重新认证后 MCP 恢复 · provider 故障期间自动重连 · 恢复的会话还原工作目录与 approval policy
V0 150 0 0.150.0 stable（2026-08-26T19:37Z）：@ 引用其他 Codex 任务；agent 可在终端读取、创建或向任务发消息——agent 发起的跨任务消息进入 stable；Interrupt hooks（回合被中断时执行命令或 MCP handler）；安全：不可信项目不再注入 AGENTS.md、app-server 诊断凭据脱敏、应用签名校验、Bedrock multi-agent/压缩兼容修复
V0 150 1 0.150.1（2026-08-27T01:56Z）：远程压缩将保留图片计入 token 预算（backport）
后续更新
2026-08-20 0.149.0 stable (2026-08-20T21:04Z, in-window; preceded by five 0.149.0 alphas 8/19-8/20; 0.150.0-alpha.1 already out 8/20 22:06Z). New: interactive agents dashboard for searching, starting, opening, renaming and stopping tasks with configurable shortcuts (#39094 et al.) — first fleet-management UI in a stable CLI agent runtime; `codex queue` sends messages into existing local/remote sessions (#39092), with queued messages reliably waking idle sessions and better duplicate-session-name resolution — cross-session messaging lands in Codex stable, initiated by user/orchestrator rather than agent-to-agent (trend #3 criterion (a) partially satisfied); /cd, /pwd, /cwd TUI commands for working-directory management (#38894); vim mode change motions cw/c$/cc (#39661); codex doctor checks endpoint protection, network/proxy failures, desktop app state, update connectivity (#38827 et al.). Also: GPT-5.6 max context window raised (#39102, no figures in release notes); sandbox hardening — dropped capabilities from Linux sandbox processes (#39103), fail-closed PowerShell Tree-sitter lowerer (#39213), symlink-safe sensitive-file reader (#39200); WebRTC sideband reconnects after transport loss without losing output (#39257); SDK exact CLI config overrides + max/ultra reasoning effort (#38817, #39662); docs now warn on DNS exfiltration risks in secure devcontainers (#39283). Recommendation stays ADOPT.
2026-08-26 Recovered from index (previous run wrote the update note to index/events.json only): 0.150.0 stable (19:37Z): @-mentions reference other Codex tasks; agents can read, create, or message tasks from the terminal (agent-initiated cross-task messaging in stable — meets trend #3 criterion (a)); /copy picker; auto task titles; Interrupt hooks (commands/MCP handlers on turn interruption); security: untrusted-project AGENTS.md ignored, credential redaction in app-server diagnostics, app signature verification, Bedrock multi-agent/compaction fixes
2026-08-27 Recovered from index (previous run wrote the update note to index/events.json only): 0.150.1 (01:56Z): remote compaction counts retained images toward token budget (backport)
2026-08-29 0.151.0 stable (2026-08-29T09:55:39Z GitHub / 09:59:26Z npm, in-window; twelve 0.151.0 alphas 8/27-8/29 preceded it; 0.152.0-alpha.1 followed at 10:53Z). New: configurable grace period for discovering tools from optional MCP servers (#41199); extensions can inspect or replace MCP tool results before they reach the model (#41202) — an MCP middleware hook landing in stable; plugin catalogs combine per-repository configuration and report invalid project marketplaces without hiding valid plugins (#41208). Fixes: restored permission profiles preserved across TUI turns and /cd no longer weakening sandbox restrictions (#41192); tool availability and reasoning effort kept correct across model switches and fallbacks (#41195, #41206); remote sandbox enforcement using the executor's actual home directory, OS and path conventions (#41196/41204/41207/41209); structured MCP tool/resource errors preserved in app-server responses (#41196); nested subagent token usage counted toward root goal budgets (#41183); stale Guardian classifications no longer authorize actions after permission state changes (#41196). Recommendation stays ADOPT.
2026-09-02 0.152.0 stable (9/1T01:58Z): Vim mode / and ? search in drafts with n/N repeat; rate-limit banners with check-usage/manage-credits/reset-limits actions; credential-refresh progress surfaced in TUI and codex exec (incl. Bedrock reauthentication); MCP server names may contain : @ / . for package-style naming; per-MCP-tool output_token_limit with consistent truncation across session resumes; app-server clients can configure thread/shellCommand timeouts (>1h deadlines); security — cloud task requests reject untrusted backend URLs and disable redirects to protect saved credentials; MCP tools survive cache refreshes and remote plugin changes with refreshed auth headers; planning tool disabled by default (tools.update_plan.enabled). 0.152.1 (9/1T22:33Z): Guardian approval review honors Node REPL policies from model metadata; 0.153.0-alpha line started same day
2026-09-04 0.153.0 stable (9/3T01:37Z): vim-mode u/Ctrl-R undo preserving full drafts incl. pasted attachments; plugin CLI list/install/remove from remote marketplaces; tui.auto_recap; TUI history shows full patches; Plus/Team early warning when under half of the ~5h usage window remains; TUI auto-reconnect after app-server drop with drafts retained; Full-Access Guardian scoping for confirm-only operations; remembered MCP tool approvals scoped per app account; rollback compaction incl. shared history; structured async questions (request_user_input_async); experimental context_management mode (token-budgeted context + history notes + new_context tool — the Astra notes-across-context-windows feature, default for Astra in coming weeks). 0.153.1-0.153.4 (9/3-9/4): GPT-6-Astra rollout chain — API config support, Fast-tier '2x speed' wording fix, Bedrock model picker, and 0.153.4 making Astra the bundled default when no model is explicitly configured. Alpha channel: 0.154.0-alpha.1-3. Captured 2026-09-05 run
标签
codexopenaiclisession-forkinghooksmcpbedrockawscost-visibilityrelease