v0.2.1

Changes

• Fix cancellation of native MCP requests across HTTP-to-ACP request ID translation, with per-connection tracking and bounded cleanup.
• Load the selected Plan or Default preset's own instructions when changing collaboration mode, preserving the current model and reasoning effort.
• Preserve MCP Apps binding metadata in _meta.codex.mcpToolCall on live and replayed root/child tool updates. Arguments and result _meta remain separate and intact.
• Bundle the unmodified Codex app-server 0.153.4, with matching source and package checksums, license notices, and corresponding sources.

MCP Apps iframe rendering, AppBridge hosting, CSP enforcement, and UI permissions remain the ACP client's responsibility. See the MCP Apps setup and metadata contract.

Downloads

Each platform download is a self-contained native executable with the pinned Codex runtime; no separate Codex or Node.js installation is required. Choose Linux x86_64, Linux ARM64, Apple Silicon macOS, or Windows x86_64. Model access still requires a configured provider/account.

codex-backend-sources-0.153.4.zip contains the corresponding backend sources and pinned rebuild inputs. SHA256SUMS covers all four executables and the source archive. Verify checksums and GitHub build provenance before running a download; see the installation instructions.

Verification And Limits

• Native Rust checks, Clippy, tests, documentation checks, and standalone bundled-runtime checks passed on all four supported targets.
• Linux x86_64 deep checks exercised the actual bundled Codex runtime against a local deterministic provider: approvals and execution, dynamic callbacks, stdio/native MCP, MCP Apps metadata/resource/UI tool calls, child execution, durable replay, provider errors, and cancellation.
• The corresponding-source archive passed full extraction and an offline bubblewrap rebuild with pinned Rust 1.95.0 and an empty Cargo home.
• No paid inference or machine account credentials were used. Client widget rendering and hosted-app authentication were not exercised.

Known bundled dependency advisories remain documented in SECURITY.md; this backend patch does not resolve them.

Full changelog: v0.2.0...v0.2.1

v0.2.0

What's Changed

• Bundle pinned Codex in self-extracting native releases by @VikashLoomba in #3

Full Changelog: v0.1.1...v0.2.0

v0.1.1

What's Changed

• Fix draft publication and prepare v0.1.1 by @VikashLoomba in #2

New Contributors

• @VikashLoomba made their first contribution in #2

Full Changelog: v0.1.0...v0.1.1