chore(deps): update dependency openai/codex

[renovate]

This PR contains the following updates:

Package	Update	Change
openai/codex	minor	0.136.0 → 0.137.0
openai/codex	minor	rust-v0.136.0 → rust-v0.137.0

---

Release Notes

openai/codex (openai/codex)

v0.137.0: 0.137.0

Compare Source

New Features

• TUI controls now support F13-F24 keybindings, paste in searchable menus, and a compact reasoning-only status/title item (#​25329, #​25400, #​25504).
• Enterprise/admin flows now show monthly credit limits and can apply cloud-managed config bundles, including EDU workspaces (#​24812, #​24617, #​24619, #​24620, #​24622, #​25963).
• Remote-control clients can start pairing and list or revoke controller grants through app-server v2 RPCs (#​25675, #​25785).
• Plugin workflows gained machine-readable codex plugin list --json output and cached remote catalog suggestions (#​25330, #​25457).
• Hosted web and image tools are available in more code-mode flows, with standalone web searches able to run in parallel (#​25176, #​25702, #​25890, #​25923).
• Multi-agent v2 keeps runtime choice with each thread and exposes cleaner follow-up and metadata defaults for spawned agents (#​25266, #​25636, #​25720, #​25721, #​25722, #​25841, #​26114).

Bug Fixes

• Cancelling a submitted prompt before visible output now restores the draft, attachments, and collaboration mode for editing (#​25316).
• Slash-command filtering and footer shortcut hints now reset or render according to the current UI state (#​25492, #​25625).
• Platform reliability improved for macOS app launches and Windows SQLite startup, thread resume, and sandbox setup refreshes (#​25485, #​25490, #​25509, #​25949).
• Plugin loading preserves app manifest order, deduplicates local/remote curated installs, and treats malformed skills fields as warnings (#​25491, #​25681, #​25717, #​25782).
• Permission requests and approvals now carry environment identity, and managed MITM proxying exports readable CA bundles to child commands (#​25850, #​25858, #​25862, #​22668).
• Local session history is safer for compressed rollouts, renamed titles, pathless side-chat reloads, and stack-heavy startup/config rebuilds (#​25087, #​25624, #​25661, #​25814, #​25844, #​25847).

Documentation

• Added app-server docs and generated schema updates for monthly credit limits, remote-control RPCs, and environment-scoped permission approvals (#​24812, #​25675, #​25785, #​25862).
• Moved repo review rules and contributor conventions into AGENTS.md, including Rust test-module layout and Python 3 compatibility guidance (#​25682, #​25690, #​25738).

Chores

• Root formatting and Justfile workflows are more complete and Windows-aware (#​24983, #​25165, #​25683).
• Rust CI and release workflows use the git CLI for Cargo fetches to avoid intermittent libgit2/submodule failures (#​25644, #​25775).
• Python SDK releases now publish runtime wheels from the SDK workflow and pin to a glibc-compatible runtime package (#​25906, #​25907).
• Bazel CI’s BuildBuddy wrapper was reintroduced with Windows-safe process handling and validation (#​25915).
• Shared prompts, context fragments, and skills plumbing moved into dedicated crates/extension paths to reduce codex-core coupling (#​25151, #​25953, #​25959, #​26106, #​26122, #​26167).

Changelog

Full Changelog: openai/codex@rust-v0.136.0...rust-v0.137.0

• #​25329 feat(tui): allow function keys through f24 in keymaps @​fcoury-oai
• #​24617 Add config bundle transport types @​joeflorencio-openai
• #​25435 Add build_unsigned_archive release mode @​shijie-oai
• #​24619 Compose requirements layers @​joeflorencio-openai
• #​24620 Add cloud-managed config layer support @​joeflorencio-openai
• #​25462 Revert "Add build_unsigned_archive release mode" @​shijie-oai
• #​25113 store and expose parent_thread_id on Threads @​owenlin0
• #​25266 Set multi-agent v2 dogfood defaults @​jif-oai
• #​25060 Add goal extension idle continuation @​jif-oai
• #​25576 Use templates for goal steering prompts @​jif-oai
• #​25577 Remove Plan-mode gate from idle turn injection @​jif-oai
• #​25096 Add goal extension GoalApi @​jif-oai
• #​25087 Read compressed rollouts and materialize before append @​jif-oai
• #​25628 [codex] fix compressed rollout fixture SessionMeta initialization @​fcoury-oai
• #​25316 feat(tui): restore output-free cancelled prompts @​fcoury-oai
• #​23763 Preserve auto-review approval policy in codex exec @​won-openai
• #​25400 Allow paste in searchable selection menus @​charliemarsh-oai
• #​25485 Use deep links for macOS codex app paths @​etraut-openai
• #​25492 Reset slash popup selection when filter changes @​etraut-openai
• #​25504 Add reasoning-only status surface item @​etraut-openai
• #​25624 Preserve renamed thread titles during reconciliation @​jif-oai
• #​25089 Compress cold local rollouts @​jif-oai
• #​25490 Disable SQLite intrinsics for Windows x64 releases @​etraut-openai
• #​25603 [codex] Inherit raw events for spawned child listeners @​vivi
• #​25644 [codex] Use git CLI for release Cargo fetches @​shijie-oai
• #​25655 nit: drop todo @​jif-oai
• #​25654 Parallelize cold rollout compression @​jif-oai
• #​25121 exec-server: add environment path refs @​starr-openai
• #​25636 [codex] Rename multi-agent v2 assign_task to followup_task @​jif-oai
• #​25491 Preserve plugin app manifest order @​charlesgong-openai
• #​24983 [codex] Make justfile recipes Windows-aware @​iceweasel-oai
• #​25151 [codex] Consolidate shared prompts in codex-prompts @​anp-oai
• #​25659 Throttle repeated rollout compression runs @​jif-oai
• #​25165 Check root Python script formatting in CI @​anp-oai
• #​23767 [codex-rs] auto-review model override @​won-openai
• #​25149 exec-server: canonicalize bound filesystem paths @​starr-openai
• #​25669 fix: deflake zsh-fork approval test @​jif-oai
• #​24979 feat: gate unified exec zsh fork composition @​bolinfest
• #​24980 refactor: hide shell override for zsh fork unified exec @​bolinfest
• #​25679 Add rollout compression counters @​jif-oai
• #​25682 [codex] document out-of-line test module convention @​anp-oai
• #​25680 Add rollout compression histograms @​jif-oai
• #​25689 [codex] Generalize deferred nested tool guidance @​sayan-oai
• #​25690 Add Python version compatibility guidance @​anp-oai
• #​25681 fix: Deduplicate installed local and remote curated plugins @​xl-openai
• #​25701 fix: rename McpServer to TestAppServer @​bolinfest
• #​25702 [codex] enable parallel standalone web search calls @​sayan-oai
• #​25705 Fix stale TestAppServer rename in plugin_list test @​bolinfest
• #​25684 Move tool search metadata onto ToolExecutor @​jif-oai
• #​25625 fix(tui): clarify footer shortcut overlay hints @​fcoury-oai
• #​25649 [codex] Publish release symbol artifacts @​nornagon-openai
• #​25661 Reject directory rollout paths for pathless side chats @​bolinfest
• #​22668 Wire managed MITM CA trust into child env @​winston-openai
• #​25712 app-server: remove experimental persist_extended_history bool flag @​owenlin0
• #​24621 Move cloud requirements crate to cloud config @​joeflorencio-openai
• #​25717 Handle invalid plugin skills manifest field @​xli-oai
• #​25675 feat(remote-control): add pairing start @​apanasenko-oai
• #​25683 [codex] Add comprehensive root formatting check @​anp-oai
• #​25738 Move code review rules into AGENTS @​pakrym-oai
• #​24812 feat: show enterprise monthly credit limits in status @​efrazer-oai
• #​25330 [codex] Add plugin list JSON output @​xl-openai
• #​25457 [codex] Cache remote plugin catalog for suggestions @​xl-openai
• #​25783 [codex] Move plugin discoverable logic into core-plugins @​xl-openai
• #​25782 [codex] Validate plugin skill base names @​xl-openai
• #​25814 feat: reuse compressed rollout search snippets @​jif-oai
• #​25720 Add multi-agent runtime metadata types @​jif-oai
• #​25721 Persist multi-agent runtime metadata @​jif-oai
• #​25722 Resolve per-thread multi-agent runtime @​jif-oai
• #​25841 session: keep startup prewarm aligned with resolved multi-agent runtime @​jif-oai
• #​25840 fix: main oops @​jif-oai
• #​25723 Test remote multi-agent runtime selector override @​jif-oai
• #​25724 Test runtime selector before first turn @​jif-oai
• #​25844 Reduce stack pressure in session startup and config rebuilds @​jif-oai
• #​25857 flake: Keep plugin test homes alive @​jif-oai
• #​25847 Run Codex async main on a sized stack @​jif-oai
• #​25775 [codex] Use git CLI for Cargo fetches across Rust workflows @​anp-oai
• #​25167 [app-server][core] Add connector-level Guardian reviewer overrides @​zamoshchin-openai
• #​25868 Skip startup prewarm when websockets are disabled @​jif-oai
• #​25156 Route Bazel CI through shared BuildBuddy remote config wrapper @​anp-oai
• #​25739 core: derive built-in permission profiles from raw policies @​bolinfest
• #​25909 [codex] Revert shared BuildBuddy Bazel wrapper @​anp-oai
• #​25850 Key request-permission grants by environment @​jif-oai
• #​25707 [codex-analytics] Track CodexErr details in turn analytics @​rhan-oai
• #​25858 Add environmentId to request_permissions @​jif-oai
• #​25176 Route standalone image generation through host finalization md @​won-openai
• #​25916 Fix Windows release PDB staging @​shijie-oai
• #​25862 Propagate permission approval environment id @​jif-oai
• #​25907 [codex] Pin Python SDK to glibc-compatible runtime @​aibrahim-oai
• #​24859 Use environment secrets for Azure signing @​shijie-oai
• #​25509 Fix Windows running thread resume path normalization @​etraut-openai
• #​25135 Populate workspace kind on Codex turn events @​knittel-openai
• #​24622 Switch runtime to cloud config bundle @​joeflorencio-openai
• #​25938 fix: update image generation test helper rename @​joeflorencio-openai
• #​25911 core: stop passing legacy SandboxPolicy to guardian reviews @​bolinfest
• #​25668 Split cloud config bundle service modules @​joeflorencio-openai
• #​25890 [codex] Keep hosted tools visible in code-only mode @​aibrahim-oai
• #​25867 Add remote request permissions integration coverage @​jif-oai
• #​25943 config: remove dead profile sandbox fallback @​bolinfest
• #​25948 Revert "Use environment secrets for Azure signing" @​shijie-oai
• #​25923 Expose standalone image generation in code mode @​won-openai
• #​25906 [codex] Publish Python runtime wheels with Python SDK releases @​aibrahim-oai
• #​25953 feat: add skills extension scaffold @​jif-oai
• #​25915 [codex] Fix Windows BuildBuddy Bazel wrapper execution @​anp-oai
• #​25926 config: express implicit sandbox defaults as permission profiles @​bolinfest
• #​25959 feat: add extension turn-input contributors @​jif-oai
• #​25963 Allow EDU accounts to fetch cloud config bundles @​joeflorencio-openai
• #​25785 feat(app-server): add remote control client management RPCs @​apanasenko-oai
• #​25988 revert: publish release symbol artifacts @​shijie-oai
• #​26114 feat: default hide_spawn_agent_metadata to true @​jif-oai
• #​26122 chore: extract context fragments into dedicated crate @​jif-oai
• #​26144 Reject MAv2 close_agent self-targets @​jif-oai
• #​26106 skills: resolve per-turn catalogs from turn input context @​jif-oai
• #​26155 fix: serialize goal progress accounting @​jif-oai
• #​26156 chore: mechanical rename @​jif-oai
• #​26167 Implement v1 skills extension prompt injection @​jif-oai
• #​26176 fix: main @​jif-oai
• #​25949 [codex] Restore setup helper UAC manifest @​iceweasel-oai

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.