0.149.0

New Features

• Added an interactive codex agents dashboard for searching, starting, opening, renaming, and stopping tasks, with configurable shortcuts. (#39094, #39112, #39114, #39142)
• Added /cd, /pwd, and /cwd commands for managing the working directory in TUI sessions. (#38894)
• Added codex queue for sending messages to existing local or remote sessions. (#39092)
• Expanded Vim editing with character replacement and more change motions such as cw, c$, and cc. (#39661)
• codex doctor now diagnoses endpoint protection, network/proxy failures, desktop app state, and update connectivity. (#38827, #38918, #39060, #39074)
• SDK users can now pass exact CLI config overrides and select max or ultra reasoning effort. (#38817, #39662)

Bug Fixes

• Queued messages now wake idle sessions reliably, resolve duplicate session names more usefully, and preserve pasted or deferred command semantics. (#39034, #39385, #39604)
• Resumed and forked threads now restore their active permission profile instead of silently falling back to current defaults. (#39153)
• Fixed duplicate sub-agent activity and tightened TUI routing for sub-agent notifications and approvals. (#39049, #39088)
• Realtime WebRTC sideband connections now reconnect after unexpected transport loss without dropping pending output. (#39257)
• Inline TUI history now remains available in Windows Terminal scrollback. (#39619)
• Inactive TUI thread replay buffers are now bounded to prevent excessive retained streamed output. (#39081)

Documentation

• Clarified that external contributions should go through issues and design discussion rather than pull requests. (#39089)
• Documented DNS exfiltration risks and trust limitations for secure devcontainers. (#39283)

Changelog

Full Changelog: rust-v0.148.0...rust-v0.149.0

• #38817 Add raw config overrides to the TypeScript SDK @copyberry
• #38819 Support metadata staging for reserved thread IDs @copyberry
• #38822 Avoid cloning TUI history span content @copyberry
• #38823 Avoid allocating per character when decorating hyperlinks @copyberry
• #38827 Add endpoint protection checks to codex doctor @copyberry
• #38830 Isolate external editor buffers from sandbox-writable paths @copyberry
• #38837 Share editor keymaps across TUI composer components @copyberry
• #38840 Identify Mac mini hosts in remote control handshakes @copyberry
• #38893 Restore thread timestamp maxima independently @copyberry
• #38894 Add working-directory commands to the TUI @copyberry
• #38899 Move requirements policy ownership to execpolicy @copyberry
• #38902 Honor per-environment shell variable policies @copyberry
• #38907 Edit queued messages with Vim history-up @copyberry
• #38913 Stop rendering columns after filling their area @copyberry
• #38916 Honor legacy :project_roots permission entries @copyberry
• #38918 Improve codex doctor network diagnostics @copyberry
• #38919 Reject obsolete app-server permission profile fields @copyberry
• #38921 Compact successful command activity in the TUI @copyberry
• #38940 Add experimental app-server project APIs @copyberry
• #38941 Prevent Noise auth tokens from reaching child processes @copyberry
• #38942 Enforce environment-specific command policies @copyberry
• #38947 Stop loading legacy managed config on Windows @copyberry
• #38978 Add a configurable skill catalog token budget @copyberry
• #38980 Bound Guardian v2 parent compaction context @copyberry
• #38987 Include images in Guardian v2 transcripts @copyberry
• #38990 Source Guardian v2 defaults from the model catalog @copyberry
• #38993 Evaluate recent and character-routed skill selection @copyberry
• #38994 Remove the workspace settings gate for apps and plugins @copyberry
• #38997 Retry transient Guardian sampling failures @copyberry
• #39001 Ignore stale Guardian tool risk scores @copyberry
• #39005 Disable Guardian V2 for managed automatic reviewers @copyberry
• #39006 Emit API-key turn cost telemetry from app-server @copyberry
• #39007 Wait for Guardian score progress in approval tests @copyberry
• #39008 Add task context to shadow skill selection @copyberry
• #39017 Move MCP policy types into codex-protocol @copyberry
• #39019 Isolate MCP resource headers during OAuth requests @copyberry
• #39020 Restrict Windows IDE pipe client impersonation @copyberry
• #39022 Hang soft-break whitespace in the TUI composer @copyberry
• #39023 Reduce retained MCP result data in TUI history @copyberry
• #39025 Speed up the large diff highlighting test @copyberry
• #39026 Use simulated time in the long typing test @copyberry
• #39028 Cache the test pet spritesheet encoding @copyberry
• #39030 Speed up the in-app resume cwd test @copyberry
• #39032 Encapsulate TUI shimmer under the motion module @copyberry
• #39033 Bound legacy resume preview scans @copyberry
• #39034 Dispatch queued messages written by other processes @copyberry
• #39035 Add app-server coverage for Guardian V2 approval routing @copyberry
• #39036 Allow config reads to join active app-server read batches @copyberry
• #39038 Restore Guardian risk scores across thread lifecycles @copyberry
• #39040 Preserve foreign paths in managed network approvals @copyberry
• #39043 Enforce managed authentication backend settings @copyberry
• #39045 Add managed gates for in-app chat and dictation @copyberry
• #39046 Restrict MCP HTTP redirects to the configured origin @copyberry
• #39047 Skip plugin hook loading when hooks are disabled @copyberry
• #39049 Avoid rendering sub-agent activity twice in the TUI @copyberry
• #39050 Prepare the telemetry shutdown worker during initialization @copyberry
• #39051 Use installed callable apps for TUI mentions @copyberry
• #39055 Add network policy metadata to environment configuration @copyberry
• #39056 Verify the pinned zsh manifest in release builds @copyberry
• #39057 Rate-limit TUI frames from their actual emission time @copyberry
• #39058 Tag Codex Apps protocol discovery metrics @copyberry
• #39060 Add desktop app diagnostics to codex doctor @copyberry
• #39061 Avoid rerendering streamed code fences @copyberry
• #39063 Render only visible rows in the transcript pager @copyberry
• #39064 Restrict queued-message editing to its dedicated binding @copyberry
• #39065 Limit terminal hyperlink layout to the visible viewport @copyberry
• #39067 Add desktop security enforcement diagnostics @copyberry
• #39068 Remove skill model delegation support @copyberry
• #39072 Persist generated images through turn executors @copyberry
• #39073 Propagate caller metadata to rendezvous connections @copyberry
• #39074 Add desktop update diagnostics to codex doctor @copyberry
• #39075 Avoid redundant terminal row clears @copyberry
• #39077 Build filesystem JSON params only for remote TUI sessions @copyberry
• #39078 Preserve tracing context for environment resolution @copyberry
• #39079 Apply user MCP policy to selected executor plugins @copyberry
• #39081 Bound TUI thread replay buffers by delta size @copyberry
• #39082 Prompt for project trust in remote TUI workspaces @copyberry
• #39083 Harden Windows sandbox provisioning against reparse points @copyberry
• #39084 Preserve filesystem permission path conventions @copyberry
• #39087 Read plugin authentication state from AuthManager @copyberry
• #39088 Harden TUI subagent navigation @copyberry
• #39089 Clarify the external contribution policy @copyberry
• #39092 Add a command to queue messages for existing sessions @copyberry
• #39094 Add an agents overview dashboard to the TUI @copyberry
• #39098 Trace exec-server requests from receipt through completion @copyberry
• #39100 Avoid redundant terminal size queries during history insertion @copyberry
• #39101 Update rmcp to 3.1.2 @copyberry
• #39102 Raise the GPT-5.6 maximum context window @copyberry
• #39103 Drop capabilities from Linux sandbox processes @copyberry
• #39112 Make the agents overview an interactive task dashboard @copyberry
• #39113 Surface interactive requests in realtime conversations @copyberry
• #39114 Add a dedicated codex agents dashboard command @copyberry
• #39115 Remove the experimental thread config endpoint @copyberry
• #39117 Reject lossy legacy permission projections @copyberry
• #39122 Fail closed on deeply nested command wrappers @copyberry
• #39131 Validate identifiers in plugin creator workflows @copyberry
• #39141 Redact auth tokens from app-server response logs @copyberry
• #39142 Add configurable shortcuts for the agents dashboard @copyberry
• #39143 Hydrate recommended plugin metadata on selection @copyberry
• #39145 Persist active permission profiles in turn context @copyberry
• #39147 Centralize persisted resume settings lookup @copyberry
• #39152 Update PyPI publish action to v1.14.2 @copyberry
• #39153 Restore permission profiles when resuming threads @copyberry
• #39154 Box the TUI future to bound CLI stack usage @copyberry
• #39155 Prepare Python SDK 0.147.0 stable release @copyberry
• #39157 Notify clients when Guardian requires strict review @copyberry
• #39159 Require approval for commands with dynamic shell words @copyberry
• #39163 Refresh collaboration instructions when their content changes @copyberry
• #39165 Prevent marketplace identity spoofing @copyberry
• #39174 Skip empty user messages for automatic idle turns @copyberry
• #39176 Drop descendant progress updates after remote compaction @copyberry
• #39187 Scope MCP app resource reads to their originating call @copyberry
• #39192 Preserve MCP resource origins across compaction @copyberry
• #39200 Add a symlink-safe reader for sensitive files @copyberry
• #39205 Reject symbolic links in memory workspaces @copyberry
• #39213 Add a fail-closed Tree-sitter PowerShell lowerer @copyberry
• #39214 Prevent custom providers from inheriting ambient auth @copyberry
• #39220 Reconnect Guardian sampling WebSockets after auth changes @copyberry
• #39221 Skip redirected external-agent migration destinations @copyberry
• #39224 Add Guardian v2 approval review metrics @copyberry
• #39227 Include node_repl screenshots in Guardian v2 reviews @copyberry
• #39235 Decouple Noise relay streams from JSON-RPC processing @copyberry
• #39240 Deduplicate remote plugin bundle syncs with shared semaphores @copyberry
• #39241 Record Guardian v2 classification metrics @copyberry
• #39242 Add safe permission profile intersection @copyberry
• #39244 Scope MCP resource reads by connector @copyberry
• #39246 Give Guardian classifier connections distinct thread identities @copyberry
• #39249 Add exec-server forwarding mode @copyberry
• #39256 Deduplicate rollout moves when archiving threads @copyberry
• #39257 Reconnect WebRTC Realtime sideband transports @copyberry
• #39259 Simplify unified exec output snapshots @copyberry
• #39261 Stop TUI chats on misalignment policy violations @copyberry
• #39262 Prevent ConPTY DLL loading from the current directory @copyberry
• #39264 Improve Guardian v2 risk classification @copyberry
• #39266 Require fresh approval beneath denied permission paths @copyberry
• #39267 Inject Node REPL policy into Guardian review sessions @copyberry
• #39273 Preserve thread names during rollout migration @copyberry
• #39274 Add provider-owned authentication recovery @copyberry
• #39277 Declare experimental Amazon Bedrock setup APIs @copyberry
• #39278 Preserve owner-provided environment configuration @copyberry
• #39279 Propagate Windows sandbox ACL update failures @copyberry
• #39281 Move shell snapshot scripts into codex-shell-command @copyberry
• #39283 Document secure devcontainer DNS exfiltration risk @copyberry
• #39284 Report network disconnects during approval @copyberry
• #39285 Show file destinations in TUI change approvals @copyberry
• #39287 Report diagnostic upload failures @copyberry
• #39288 Register the async message feature flag @copyberry
• #39290 Add Windows sandbox diagnostics to codex doctor @copyberry
• #39293 Remove app-server's direct reqwest dependency @copyberry
• #39294 Increase SQLite log sink batching @copyberry
• #39296 Enable MCP tool hooks in Codex sessions @copyberry
• #39298 Allow overriding Codex package versions @copyberry
• #39299 Restrict agent roles to bounded configuration overrides @copyberry
• #39301 Prevent Node REPL auth tokens from reaching child processes @copyberry
• #39303 Record Guardian v2 classification token usage @copyberry
• #39304 Keep Guardian v2 risk scores in memory @copyberry
• #39306 Honor managed config during project discovery @copyberry
• #39307 Fail closed on Guardian V2 risk scoring errors @copyberry
• #39309 Attribute executor skill invocations to plugins @copyberry
• #39311 Bind unified exec approvals to shell executables @copyberry
• #39312 Add async delivery metadata to agent messages @copyberry
• #39314 Run hooks with the captured session environment @copyberry
• #39315 Evict guardian transcript entries in cacheable chunks @copyberry
• #39316 Support Edu Plus and Edu Pro account plans @copyberry
• #39319 Add the async user message tool @copyberry
• #39320 Expand OAuth metadata redirect test coverage @copyberry
• #39322 Enforce workspace restrictions for header authentication @copyberry
• #39325 Stop migrating Cursor sandbox settings @copyberry
• #39331 Route hook MCP calls through current connections @copyberry
• #39335 Enforce environment MCP policies @copyberry
• #39372 Scope TUI approval requests to their threads @copyberry
• #39385 Prefer the most recent session when queueing by name @copyberry
• #39402 Remove npm package staging from repo checks @copyberry
• #39404 Support FD mounts with older system Bubblewrap versions @copyberry
• #39410 Refresh expired AWS credentials for Bedrock @copyberry
• #39452 Remove the feature gate for async user messages @copyberry
• #39474 Consolidate Guardian extensions into codex-guardian-v2 @copyberry
• #39480 Move shell snapshot tests into shell-command @copyberry
• #39493 Make head-tail buffer capacity const generic @copyberry
• #39494 Test panoramic Guardian transcript image resizing @copyberry
• #39496 Use default timeouts in cyber exec policy tests @copyberry
• #39497 Correct normalized dynamic tool coverage across response modes @copyberry
• #39501 Use a narrow fixture for the unified image resize test @copyberry
• #39505 Test text stringify errors in the code mode runtime @copyberry
• #39506 Test code mode notifications without a sync tool call @copyberry
• #39509 Test disabled enhanced Node REPL transcript images separately @copyberry
• #39510 Track built-in control tool calls in analytics @copyberry
• #39514 Use stored item types when materializing turn summaries @copyberry
• #39515 Use mem::take to drain unified exec output buffers @copyberry
• #39520 Isolate automatic plugin Git operations @copyberry
• #39523 Persist thread section moves before the first turn @copyberry
• #39524 Stop treating Git commands as inherently safe @copyberry
• #39584 Add a just recipe for assembling Codex packages @copyberry
• #39585 Test plugin sync isolation from repository Git config @copyberry
• #39586 Isolate IPC in Bubblewrap sandboxes @copyberry
• #39588 Preserve unparsed shell wrappers in exec policy @copyberry
• #39590 Harden plugin manifest handling during installation @copyberry
• #39592 Prevent SQLx warnings from feeding back into SQLite logs @copyberry
• #39594 Raise the MCP tool name limit to 128 bytes @copyberry
• #39595 Keep marketplace upgrade state out of config @copyberry
• #39597 Separate thread settings from environment configuration @copyberry
• #39599 Protect macOS Seatbelt writable root anchors @copyberry
• #39601 Keep async user messages on the direct tool surface @copyberry
• #39602 Use in-process parsing for PowerShell command classification @copyberry
• #39604 Preserve queued TUI input semantics @copyberry
• #39605 Hide approved automatic review warnings in the TUI @copyberry
• #39606 Enable user namespaces in shared CI setup @copyberry
• #39607 Resolve model-provided shells by type @copyberry
• #39608 Harden skill installation against unsafe symlinks @copyberry
• #39609 Limit Bazel integration test threads on macOS @copyberry
• #39611 Harden MCP OAuth fallback credential writes @copyberry
• #39614 Prevent apply_patch from widening write permissions @copyberry
• #39615 Bind MCP OAuth refresh tokens to their issuer @copyberry
• #39616 Validate linked worktrees before inheriting project trust @copyberry
• #39618 Apply composer editing preferences to TUI text prompts @copyberry
• #39619 Preserve inline TUI scrollback in Windows Terminal @copyberry
• #39620 Stream executor capability and skill file reads @copyberry
• #39623 Prevent protected-path rename bypasses in macOS Seatbelt @copyberry
• #39625 Add cwd-relative turn diff paths @copyberry
• #39629 Preserve parent repository discovery through sandbox metadata mounts @copyberry
• #39630 Retire the untrusted approval policy @copyberry
• #39631 Skip sandboxed shell commands in Guardian v2 by default @copyberry
• #39632 Expose permission profile resolution in the core API @copyberry
• #39635 Show strict review warnings in the TUI @copyberry
• #39637 Treat invalid_grant refresh failures as permanent @copyberry
• #39640 Prompt to unarchive sessions before resuming or forking @copyberry
• #39641 Sanitize developer context in full-history agent forks @copyberry
• #39645 Enforce managed residency for model providers @copyberry
• #39646 Exercise restricted-token sandboxing in cyber policy tests @copyberry
• #39649 Resolve bundled Windows helpers through bin junctions @copyberry
• #39653 Enforce filesystem permissions when loading AGENTS.md @copyberry
• #39655 Make core integration test permissions explicit @copyberry
• #39656 Advertise the Desktop app in graphical Linux sessions @copyberry
• #39657 Warn when launching the deprecated MCP server @copyberry
• #39658 Let Guardian V2 satisfy required model reviews @copyberry
• #39659 Harden unsandboxed patch filesystem access @copyberry
• #39661 Expand Vim change commands and add character replacement @copyberry
• #39662 Add max and ultra reasoning efforts to the SDKs @copyberry
• #39663 Restrict plugin migration to home scope @copyberry
• #39665 Add macOS Seatbelt filesystem integration tests @copyberry
• #39666 Improve no-follow filesystem behavior across platforms @copyberry