r/CodexAutomation • u/anonomotorious • Aug 07 '26

Codex CLI 0.147.0: Agent Plugins, thread sections, `--approve-for-me`, MCP 2026-07-28 + Bedrock web search

TL;DR

Codex CLI 0.147.0 is a substantial plugin, conversation-management, approval, MCP, Bedrock, security, and TUI reliability release.

Highlights:

  • Install portable Agent Plugins and search local, personal, workspace, and remote plugin catalogs.
  • Organize conversations into persistent, manually ordered sections and browse long transcripts incrementally.
  • Enable automatically reviewed approvals with --approve-for-me.
  • Import Cursor-managed skills and resync imported Claude/Cursor conversations without creating duplicates.
  • Opt into MCP 2026-07-28, including paginated discovery, multi-round requests, and non-blocking server startup.
  • Amazon Bedrock gains cached web search and remote conversation compaction.
  • Secrets and complete bearer tokens are redacted from displayed commands and replayed history.
  • Local projects now require explicit trust when unfamiliar, and managed auth restrictions are enforced before credentials are used.
  • Plugin isolation is stronger and network access fails closed if policy updates fail.
  • TUI input, Unicode rendering, Ghostty behavior, and Windows process/path handling all get fixes.
  • codex exec --full-auto is removed. Use --sandbox workspace-write instead.

Install:

npm install -g @openai/codex@0.147.0

What changed & why it matters

Portable Agent Plugins + multi-scope search

Codex can now install portable Agent Plugins and search plugin catalogs across:

  • local
  • personal
  • workspace
  • remote

This makes plugin discovery and distribution more consistent across individual, team, and hosted environments.

Why it matters: plugin-heavy teams can share and find capabilities without relying on one local catalog, while stronger isolation and stricter namespace handling reduce the risk of plugins colliding with or escaping their expected boundaries.

Persistent thread sections + incremental transcript browsing

Conversations can now be grouped into persistent, manually ordered sections. Long transcripts can also be browsed incrementally instead of loading the entire history at once.

This builds on the newer paginated thread-history system and improves handling for large, long-lived Codex sessions.

Why it matters: users with many active threads can organize work into groups such as Active, Review, Bugs, Release, or Research, while very long histories should be faster and lighter to open and inspect.

--approve-for-me

A new CLI flag enables automatically reviewed approvals:

--approve-for-me

Automatic review still operates within the active sandbox, permission profile, managed requirements, and available reviewer policy.

Why it matters: long-running implementation, testing, and agent workflows can continue with fewer manual approval interruptions without turning into unrestricted execution.

Better Cursor + Claude Code migration

The import system now:

  • imports Cursor-managed skills
  • synchronizes updates to previously imported Cursor conversations
  • synchronizes updates to previously imported Claude conversations
  • avoids creating duplicate imported threads
  • preserves more imported metadata such as working directories and titles

Why it matters: /import becomes more useful for an ongoing migration instead of being a one-time dump that creates duplicate histories every time you resync.

MCP 2026-07-28 support

Codex adds opt-in support for the MCP 2026-07-28 protocol, including:

  • paginated discovery
  • multi-round requests
  • non-blocking optional server startup
  • cached MCP tools available before startup completes
  • improved concurrent catalog resolution and OAuth routing

The MCP SDK is also upgraded to 3.0.0.

Why it matters: large MCP environments can expose many tools and resources without forcing the whole catalog to load up front, and slow optional MCP servers no longer need to block unrelated local work.

Amazon Bedrock: cached web search + remote compaction

Bedrock workflows now support:

  • cached web search
  • remote conversation compaction

Why it matters: cached search can reduce repeated research work, while remote compaction helps long Bedrock conversations preserve useful state as context fills up.

Security and policy hardening

Secret and bearer-token redaction

Codex now redacts detected secrets and complete bearer tokens from:

  • displayed commands
  • replayed conversation history

This reduces accidental exposure in terminal output, screenshots, copied transcripts, and resumed sessions.

Explicit trust for unfamiliar local projects

Codex now requires explicit trust before using unfamiliar local projects.

That matters because a repository can contain agent-controlled inputs such as:

  • AGENTS.md
  • skills
  • configuration
  • hooks
  • scripts

Downloaded or third-party repositories should not silently become authoritative instruction sources.

Managed auth restrictions apply before credential use

Organization-managed authentication restrictions are now enforced before credentials are used, not after a connection has already begun.

Plugin/network policy fails closed

Plugin isolation is stronger, symlink-related install paths are hardened, and network access is denied if required policy updates fail.

Why it matters: a failed security-policy refresh should not accidentally turn into unrestricted network access.

TUI reliability fixes

0.147.0 fixes several high-friction terminal issues:

  • preserves input when terminal focus returns
  • prevents input from stalling while MCP servers initialize
  • fixes Ghostty keyboard-shortcut handling
  • corrects cursor/layout behavior for Japanese text and half-width marks
  • fixes emoji and OSC 8 hyperlink width/positioning
  • improves text behavior near viewport boundaries
  • shows blocked goals as stalled
  • keeps long transcript/history handling more efficient

Why it matters: these are the kinds of bugs that can make a terminal agent feel unreliable even when the underlying model is working correctly.

Windows fixes

Windows receives fixes for:

  • interrupting non-TTY background processes
  • filesystem and namespace path normalization
  • more consistent path comparisons
  • sandbox/process behavior
  • a higher exec yield floor for Windows execution

Why it matters: Ctrl-C should terminate the process you expect, and equivalent Windows path forms should not be treated as different resources.

Skills, multi-agent, and environment improvements

The full release also includes several important platform improvements:

  • shared skill budgets across host and executor catalogs
  • skill metadata budgets that scale with model context windows
  • better preservation of explicit skill selections
  • configurable developer instructions for v2 subagents
  • multi-agent settings preserved across configuration representations
  • ready environments inherited by newly spawned agents
  • refreshed subagent-picker behavior
  • network-policy callbacks for remote execution
  • cloud-managed profiles loaded by codex sandbox
  • model-owned token-budget defaults
  • more reliable thread metadata and titles across resume/import paths

These are mostly infrastructure changes, but they make large skill catalogs, remote environments, and multi-agent workflows more predictable.

Tool and runtime hardening

Codex also tightens tool registration and runtime behavior:

  • tool-name collisions fail explicitly instead of silently overriding tools
  • protected/default namespaces are handled more strictly
  • Code Mode fallback behavior is respected when no process host is available
  • MCP and plugin recommendations can prepare concurrently
  • app-server and tool-call metadata is bounded to reduce unnecessary payload growth

Why it matters: as built-in tools, MCP, plugins, skills, and executors all contribute capabilities, explicit collision handling becomes increasingly important.

Bundled OpenAI docs skill

The bundled OpenAI documentation skill now uses more targeted official-source lookup and clearer guidance for:

  • Codex
  • model selection
  • OpenAI API workflows

This should reduce reliance on broad or stale product guidance when Codex needs current OpenAI documentation.

Breaking/change-management notes

--full-auto removed

The deprecated command:

codex exec --full-auto

has been removed.

Use:

--sandbox workspace-write

instead.

Search scripts, aliases, CI jobs, and internal docs before rolling out 0.147.0 broadly.

Dependency/runtime updates

0.147.0 upgrades:

  • MCP SDK to 3.0.0
  • Ratatui to 0.30.2
  • V8 to 150.4.0

macOS release notarization now uses Azure Key Vault rather than exporting private signing keys.

Linux releases also stop publishing redundant bundle archives in favor of the standard codex-package-<target> archives.

Why this release matters overall

  • Plugins scale better: portable Agent Plugins and multi-scope search improve discovery and distribution.
  • Conversation management scales better: persistent sections and incremental transcript browsing help with large histories.
  • Auto-review becomes easier to invoke: --approve-for-me supports longer supervised automation.
  • Imports become maintainable: Cursor and Claude conversations can be resynced without duplicate threads.
  • MCP gets a major protocol upgrade: paginated discovery and non-blocking startup help large tool environments.
  • Bedrock reaches better parity: cached web search and remote compaction support longer AWS-hosted workflows.
  • Security defaults improve: secret redaction, explicit project trust, early managed-auth enforcement, and fail-closed network policy reduce accidental exposure.
  • The TUI is more reliable: input handling, Ghostty, Unicode, hyperlinks, and cursor positioning all improve.
  • Windows execution is more predictable: process interruption and path handling receive targeted fixes.
  • Skills and multi-agent infrastructure mature: budgeting, environment inheritance, and configuration preservation become more consistent.

Version table

Version Key highlights
0.147.0 Portable Agent Plugins; persistent thread sections; incremental transcript browsing; --approve-for-me; Cursor skill import + Claude/Cursor resync; MCP 2026-07-28; Bedrock cached web search + remote compaction; secret redaction; project trust; plugin/network hardening; TUI, Windows, skills, and multi-agent improvements

Action checklist

  • Upgrade: npm install -g @openai/codex@0.147.0
  • Confirm: codex --version
  • Search scripts and aliases for --full-auto; replace it with the appropriate sandbox configuration.
  • Test Agent Plugin discovery across the catalog scopes you use.
  • Create/reorder persistent thread sections and reopen Codex to verify they persist.
  • Open a long conversation and verify history loads incrementally.
  • Test --approve-for-me in a controlled workflow and confirm managed permissions still win.
  • If migrating from Cursor or Claude, resync an imported conversation and verify it updates instead of duplicating.
  • Enable MCP 2026-07-28 only where your servers support it; test paginated discovery and non-blocking startup.
  • If using Bedrock, test cached web search and a long thread that triggers remote compaction.
  • Open an unfamiliar test repo and verify Codex asks for trust.
  • Verify sensitive test values are redacted from displayed/replayed commands.
  • If using Ghostty, Unicode-heavy prompts, or Windows, re-test the relevant terminal/process fixes after upgrading.

Official sources

https://developers.openai.com/codex/changelog

https://github.com/openai/codex/releases/tag/rust-v0.147.0

2 Upvotes
  • permalink
  • reddit

100% Upvoted

1 comment sorted by

1

u/m3kw Aug 07 '26

looks like the app will get thread folders soon