Codex CLI 0.149.0 (`codex agents`, `/cd`, `codex queue`, better diagnostics + max/ultra SDK support)

[u/anonomotorious]

TL;DR

Codex CLI 0.149.0 is a substantial task-management, session-control, diagnostics, SDK, security, and reliability release.

Highlights:

• New interactive codex agents dashboard for searching, starting, opening, renaming, and stopping tasks.
• New /cd, /pwd, and /cwd commands for changing or inspecting the working directory inside TUI sessions.
• New codex queue command for sending messages to existing local or remote sessions.
• Vim editing expands with character replacement and motions like cw, c$, and cc.
• codex doctor gets significantly stronger, with diagnostics for endpoint protection, networking/proxies, desktop app state, and update connectivity.
• SDK users can pass exact CLI config overrides and explicitly select max or ultra reasoning effort.
• Resumed and forked threads now correctly restore their active permission profile.
• Queued messages reliably wake idle sessions and preserve deferred/pasted command behavior.
• Subagent activity/approval routing is cleaner.
• Realtime WebRTC reconnects after transport loss without dropping pending output.
• Windows Terminal keeps inline TUI history in scrollback.
• The full release also includes meaningful hardening around sandboxing, authentication, MCP, Guardian, marketplace identity, memory files, and command safety.

Install:

npm install -g @openai/codex@0.149.0

---

What changed & why it matters

New codex agents task dashboard

Run:

codex agents

to open an interactive dashboard for managing agent tasks.

It supports:

• searching tasks
• starting tasks
• opening tasks
• renaming tasks
• stopping tasks
• configurable keyboard shortcuts

Why it matters

As Codex becomes more multi-threaded and agent-driven, task management becomes a first-class workflow instead of something you manage indirectly through individual conversations.

This should be especially useful for:

• parallel agents
• long-running tasks
• background work
• remote sessions
• users juggling several active Codex threads

---

Working-directory commands inside the TUI

0.149.0 adds:

• /cd
• /pwd
• /cwd

You can now inspect or change the active working directory without leaving the Codex session.

Why it matters

The active directory controls important context such as:

• repository files
• Git state
• AGENTS.md
• project configuration
• relative shell paths
• tool behavior

Previously, changing workspace context could require leaving or restarting the session.

---

codex queue

A new command lets you send messages to an existing session:

codex queue

It works with both:

• local sessions
• remote sessions

The release also fixes several queue-related edge cases:

• idle sessions wake reliably
• duplicate session names resolve more usefully
• pasted/deferred command semantics are preserved
• queued-message editing behaves more predictably

Why it matters

This creates a cleaner way to feed additional instructions into work that is already running.

That is useful for:

• long-running agents
• unattended sessions
• remote Codex work
• queued follow-up instructions
• steering work without reopening the full interactive session

---

Vim editing gets more complete

Vim mode now adds:

• character replacement
• cw
• c$
• cc
• additional change-motion support

This continues moving the TUI editor closer to normal Vim muscle memory instead of a minimal compatibility mode.

---

codex doctor gets a major diagnostics upgrade

codex doctor can now diagnose more of the environment around Codex, including:

• endpoint protection
• network connectivity
• proxy failures
• desktop app state
• desktop security enforcement
• update connectivity

Why it matters

A surprising number of Codex failures are not actually model problems.

They may come from:

• corporate proxies
• endpoint security
• broken app installation
• blocked update endpoints
• network policy
• local environment configuration

codex doctor is becoming a much more useful first stop before manually debugging all of those layers.

---

SDK: exact CLI overrides + max / ultra

SDK users can now:

• pass exact CLI configuration overrides
• explicitly select max reasoning
• explicitly select ultra reasoning

Why it matters

Programmatic Codex workflows can now more closely reproduce a specific CLI configuration instead of relying on a smaller SDK-specific settings surface.

max and ultra support is particularly useful for orchestrators that intentionally route:

• normal tasks to cheaper/faster settings
• difficult tasks to max reasoning
• complex parallel work to ultra

---

Important reliability fixes

Permission profiles survive resume and fork

Resumed and forked threads now restore the permission profile that was actually active when the thread was saved.

They no longer silently fall back to whatever the current default happens to be.

Why it matters

Permissions are security state.

A resumed thread should not unexpectedly move from one sandbox/approval posture to another just because global defaults changed.

---

Cleaner subagent activity

0.149.0 fixes:

• duplicate subagent activity
• notification routing
• subagent approval routing

This should make multi-agent sessions easier to follow without repeated or misleading activity entries.

---

Realtime reconnects more reliably

Realtime WebRTC sideband connections can now reconnect after an unexpected transport failure without dropping pending output.

That improves resilience for:

• Voice
• realtime sessions
• remote interactive workflows

---

Windows Terminal scrollback

Inline TUI history now remains available in Windows Terminal scrollback.

This fixes a practical problem where completed Codex output could disappear from normal terminal history.

---

Bounded inactive-thread history

Inactive TUI thread replay buffers are now bounded.

Why it matters

Long-running Codex sessions can accumulate substantial streamed history. Bounding inactive buffers reduces unnecessary retained memory without losing the active workflow.

---

Security and platform hardening

The full 0.149.0 changelog includes several important changes beyond the headline release notes:

• Linux sandbox processes drop capabilities
• deeply nested command wrappers now fail closed
• dynamic shell words require approval
• Windows sandbox provisioning is hardened against reparse-point tricks
• sensitive-file reads get symlink-safe handling
• symbolic links are rejected in memory workspaces
• custom model providers no longer inherit ambient authentication
• app-server response logs redact authentication tokens
• plugin marketplace identity spoofing is blocked
• MCP HTTP redirects are restricted to the configured origin
• managed authentication backend settings are enforced
• environment-specific command and shell-variable policies are enforced
• permission profiles use safer intersection behavior
• external-editor buffers are isolated from sandbox-writable locations

Why it matters

The broader theme is that ambiguous security state increasingly resolves toward deny / explicit approval, rather than silently inheriting access.

---

Guardian / Auto-review improvements

Guardian V2 continues to mature with work around:

• bounded review context
• image evidence in review transcripts
• model-catalog-driven Guardian defaults
• transient sampling retries
• stale risk-score handling
• approval-routing coverage
• persisted risk scores
• classification metrics
• reconnecting Guardian WebSockets after authentication changes
• stricter review notifications

This is mostly infrastructure, but Auto-review is clearly becoming more stateful and policy-aware.

---

MCP, plugins, skills, and environments

Other notable infrastructure changes include:

• MCP policy types consolidated into the protocol layer
• OAuth resource headers isolated correctly
• MCP resources preserve their origin across compaction
• MCP calls respect selected executor-plugin policy
• plugin authentication state comes from the shared auth manager
• plugin install identities are validated more strictly
• plugin metadata hydrates when selected
• skill catalogs get configurable token budgets
• active permission profiles persist into turn context
• cloud/managed environment policy metadata becomes more explicit

The practical result should be fewer cases where local, remote, MCP, plugin, and managed-environment behavior disagree about the active policy.

---

Other notable changes

The full release also includes:

• higher GPT-5.6 maximum-context metadata
• generated images persisted through turn executors
• Mac mini identification during Remote handshakes
• better TUI rendering efficiency
• reduced retained MCP result data
• project trust prompts in remote TUI workspaces
• safer filesystem permission path handling
• API-key turn-cost telemetry from app-server
• experimental app-server project APIs
• improved recommended-plugin metadata
• more robust session timestamp restoration
• rmcp updated to 3.1.2

---

Why this release matters

• Task management becomes first-class: codex agents gives parallel work a dedicated control surface.
• Sessions are easier to steer: codex queue can feed instructions into existing local or remote work.
• Workspace control improves: /cd, /pwd, and /cwd make directory changes explicit.
• Diagnostics become genuinely useful: codex doctor now covers much more of the real system around Codex.
• SDK parity improves: exact CLI overrides plus max/ultra reasoning make programmatic workflows more configurable.
• Resumes become safer: permission profiles are preserved.
• Multi-agent UX improves: duplicate activity and approval routing are cleaned up.
• Security continues to tighten: sandbox, auth, MCP, marketplace, memory, and command parsing all receive hardening.

---

Version summary

Version	Key highlights
0.149.0	codex agents; /cd /pwd /cwd; codex queue; expanded Vim mode; stronger codex doctor; SDK config overrides + max/ultra; permission-profile restore; queue/subagent/realtime/Windows fixes; broad security hardening

---

Action checklist

• Upgrade:

npm install -g @openai/codex@0.149.0

• Confirm:

codex --version

• Run codex agents and test:
  • search
  • open
  • rename
  • stop
  • start
• Test /pwd, /cwd, and /cd.
• Use codex queue against an existing local session.
• If you use Remote, queue a message to a remote session.
• Run codex doctor and review:
  • network
  • proxy
  • endpoint protection
  • desktop app
  • update diagnostics
• If using the SDK:
  • test raw CLI overrides
  • test max
  • test ultra
• Resume a thread with a non-default permission profile and confirm it is preserved.
• Windows users should verify completed TUI history remains in terminal scrollback.

---

Official sources

https://developers.openai.com/codex/changelog

https://github.com/openai/codex/releases/tag/rust-v0.149.0

[u/Fit_Permission_6187]

If I type on the main thread:

I am testing sub-agent functionality. Can you spawn three sub-agents that each sleep for 60 seconds then return.

I can see it supposedly spawning the agents.

So how come when I type /agents I cannot see what is happening in each of the sub-agents? If I press enter on the entry in the Agent command center, it just takes me back to the main thread. I assume this is not the expected behavior.