OpenAI Codex CLI Files

New Features

• Remote executors now use authenticated, end-to-end encrypted Noise relay channels. (#26242, [#26245])
• Cross-platform remote execution now preserves executor-native working directories and shells, including filesystem permission paths across app-server and exec-server boundaries. (#27819, [#27995], [#28032], [#28122], [#28165], [#28367])
• Selected executor plugins can activate their stdio MCP servers per thread; plugin discovery also adds a created-by-me marketplace and auth-specific curated catalogs. (#27870, [#27884], [#27893], [#28203], [#28383])
• App-server clients can list immediate child threads, correlate external-agent imports with detailed results, and read or redeem rate-limit reset credits. (#26662, [#28008], [#28143])
• Realtime clients can explicitly append speech, control how Codex responses enter conversations, and omit startup context. (#27917, [#28405])
• TUI input prompts can auto-resolve after inactivity, with a countdown that pauses on interaction. (#28235)

Bug Fixes

• Hook trust bypass now persists through codex exec thread start and resume, while blocking PostToolUse hooks correctly reject code-mode tool calls. (#26434, [#28365])
• Plugin capabilities now route consistently by authentication mode, deduplicate conflicting App/MCP declarations, and preserve remote marketplace ordering. (#27461, [#27602], [#27607], [#27902], [#27958], [#28395])
• Windows sandbox execution repairs stale credentials automatically and gives PowerShell commands more time before backgrounding. (#27086, [#27944])
• Idle exec-server relays remain connected, and steered user input immediately interrupts wait_agent. (#28286, [#28341])
• Bundled SQLite is pinned to a version containing the WAL-reset corruption fix. (#27992)
• TLS connections now support P-521 certificate signatures commonly used by enterprise proxies. (#27706)

Chores

• Reduced latency and memory use in large, tool-heavy sessions by caching tool search and eliminating repeated request and history copies. (#27258, [#27813], [#28306], [#28309], [#28313], [#28323], [#28327])
• Bounded prompt-image caching to 64 MiB and feedback uploads to eight related threads. (#28294, [#28332])
• Terminal resize reflow is now always enabled, ignoring obsolete disabled settings. (#27794)

Changelog

Full Changelog: https://github.com/openai/codex/compare/rust-v0.140.0...rust-v0.141.0

• [#28001] [codex] package Windows ARM64 on x64 @tamird
• [#28032] [codex] Carry exec-server cwd as PathUri @anp-oai
• [#27607] [codex] Dedupe plugin MCPs by app declaration name @felixxia-oai
• [#27992] [codex] Pin bundled SQLite to fixed WAL-reset version @gpeal
• [#28125] build: run buildifier from just fmt @anp-oai
• [#28120] bazel: add PowerShell to Wine test harness @anp-oai
• [#27819] path-uri: render native paths across platforms @anp-oai
• [#28122] [codex] exec-server honors remote environment cwd and shell @anp-oai
• [#26662] feat(app-server): filter threads by parent @btraut-openai
• [#27884] Add selected-plugin precedence and attribution to the MCP catalog @jif-oai
• [#27870] Discover stdio MCP servers from selected executor plugins @jif-oai
• [#28283] [codex] update multi-agent v2 prompts @jif-oai
• [#27602] [codex] Preserve plugin apps in connector listings @felixxia-oai
• [#27461] [codex] Skip plugin MCP OAuth for matching app routes @felixxia-oai
• [#27893] Activate selected executor plugin MCPs in app-server @jif-oai
• [#28332] [codex] Cap feedback upload subtrees @jif-oai
• [#27365] Represent dynamic tools with explicit namespaces internally @sayan-oai
• [#28333] skills: hide orchestrator skills with a local executor @jif-oai
• [#27756] [codex] simplify shell snapshot ownership @pakrym-oai
• [#27794] Remove terminal resize reflow flag gates @etraut-openai
• [#28286] chore: restore exec-server relay keepalives @jif-oai
• [#28164] [codex] simplify memory read metrics @pakrym-oai
• [#27371] Expose explicit dynamic tool namespaces in thread start @sayan-oai
• [#28309] linearize history output normalization @jif-oai
• [#28306] avoid cloning sampling request input @jif-oai
• [#28323] serialize websocket requests directly @jif-oai
• [#28313] avoid cloning websocket request history @jif-oai
• [#28344] [codex] remove stale PathExt import @pakrym-oai
• [#27059] [codex] Cover OTLP HTTP log and trace event export @richardopenai
• [#28327] reuse encoded Responses request bodies @jif-oai
• [#27995] [codex] preserve explicit environment cwd @pakrym-oai
• [#28285] guardian: isolate review context from skills and memories @jif-oai
• [#26702] TUI Plugin Sharing 2 - add remote plugin section plumbing @canvrno-oai
• [#28294] bound prompt image cache retention @jif-oai
• [#28257] Support staging OAuth client ID overrides @apanasenko-oai
• [#28341] core: let steer interrupt wait_agent @jif-oai
• [#28336] skills: cache orchestrator resources per thread @jif-oai
• [#28357] Extract shared Windows sandbox session runner @iceweasel-oai
• [#27706] Use aws-lc-rs for rustls crypto provider @malsamiri-oai
• [#28347] [codex] add path-types skill @anp-oai
• [#28235] Add request user input auto-resolution timer @shijie-oai
• [#28234] [mcp] Increase default tool timeout to 300 seconds @adaley-openai
• [#28008] [codex] Add external agent import result accounting @charlesgong-openai
• [#27944] recover stale Windows sandbox credentials @iceweasel-oai
• [#27086] Add Windows unified exec yield floor @iceweasel-oai
• [#28358] Add hidden Windows sandbox wrapper entrypoint @iceweasel-oai
• [#27258] core: cache the tool search handler per session @mchen-oai
• [#28143] feat(app-server): expose rate-limit reset credits @jayp-oai
• [#28355] feat(core): add metadata field to ResponseItem @owenlin0
• [#28203] [codex] Add created-by-me remote plugin marketplace @ericning-o
• [#28365] Respect blocking PostToolUse hooks in code mode @abhinav-oai
• [#27813] [codex] Reuse Apps policy evaluation across MCP tool exposure @mzeng-openai
• [#28300] Deflake realtime handoff steering test @felixxia-oai
• [#28395] [codex] Preserve remote plugin directory order @jameswt-oai
• [#27955] [codex] retain resolved environments across turns @pakrym-oai
• [#27917] Add realtime speech append control @guinness-oai
• [#27093] [codex-analytics] Analytics Capture to File in Debug Builds @jameswt-oai
• [#26242] exec-server: add Noise relay transport @viyatb-oai
• [#28165] Use PathUri in filesystem permission paths for exec-server @anp-oai
• [#28415] [codex] Fix missing response item metadata in tests @adaley-openai
• [#27058] [codex] Add second-based OTEL duration histograms @richardopenai
• [#27902] [codex] Centralize plugin auth capability filtering @felixxia-oai
• [#28405] Add a toggle for realtime startup context @guinness-oai
• [#26434] Preserve hook trust bypass in codex exec threads @abhinav-oai
• [#26245] exec-server: default remote transport to Noise @viyatb-oai
• [#28383] [codex] Load API curated marketplace by auth @felixxia-oai
• [#27958] [codex] Make plugin details capability aware @felixxia-oai
• [#28367] Use ApiPathString in app-server filesystem permission paths @anp-oai
• [#28421] [codex] Bind shell snapshots to retained thread environments @pakrym-oai
• [#28429] [codex] Add interruptible sleep tool @pakrym-oai
• [#28441] [codex] Use expect in integration tests @pakrym-oai
• [#28163] [codex] Use local environment for user shell commands @pakrym-oai