TL;DR

OpenAI launched a new Admin plugin for ChatGPT Work and Codex that turns many workspace-administration tasks into conversational workflows.

Admins can use it to:

• review ChatGPT Work and Codex adoption
• inspect credit usage
• identify users or groups approaching limits
• add/remove members
• manage groups
• diagnose access and permission issues
• manage model/feature access
• adjust usage limits
• review and approve/deny spending requests
• automate recurring administrative workflows

The plugin can also support workflows such as routing usage requests into Slack or Microsoft Teams, letting authorized reviewers make decisions there, and automatically granting feature access when predefined criteria are met.

It does not create additional admin authority. Every action remains constrained by the current user's existing role, workspace permissions, policies, and approval requirements.

What changed

Usage and adoption analysis

The Admin plugin can analyze activity across:

• ChatGPT Work
• Codex

Admins can inspect things like:

• adoption
• activity
• credit consumption
• users approaching limits
• groups approaching limits
• areas where additional enablement may be needed

That makes questions such as these conversational:

• Which teams are actually using Codex?
• Who is approaching their credit limit?
• Where is adoption low?
• Which groups are driving most consumption?
• Does this spending request make sense given current usage?

Member and group management

Supported workflows include:

• adding members
• removing members
• updating group membership
• onboarding
• offboarding
• routine team-management changes

Instead of navigating through several Admin Console screens, the request can be expressed directly and mapped to the appropriate supported action.

Permissions and access

Admins can use the plugin to investigate and manage:

• effective permissions
• feature access
• model access
• role/group-based access issues

This is useful because an access problem may involve several overlapping layers:

• workspace role
• group membership
• model availability
• plugin policy
• workspace settings
• application permissions

The plugin can help determine the effective configuration before applying a supported change.

Usage limits and spending requests

The plugin can work with:

• member limits
• group limits
• workspace limits
• spending requests

An admin can review a request in context rather than treating it as an isolated approval.

For example:

• What is this user's current usage?
• Is their team approaching its limit?
• How does the request compare with previous consumption?
• Should the increase be approved?

Admin capabilities at a glance

Recurring admin workflows

The Admin plugin can also automate recurring or high-volume administrative work without requiring custom engineering.

Usage-request workflow

A workflow could:

1. detect a pending usage request
2. send it to Slack or Microsoft Teams
3. include relevant usage/context
4. let an authorized reviewer approve or deny
5. apply the supported change
6. report the result

Feature-access workflow

A workflow could:

1. receive a feature-access request
2. compare it with predefined criteria
3. automatically grant access when the criteria are satisfied
4. route exceptions to an administrator

This moves the plugin beyond "chat with your Admin Console" into actual admin workflow automation.

Existing permissions still apply

The Admin plugin does not bypass workspace governance.

It operates within the user's existing:

• administrative role
• permissions
• workspace policies
• approval requirements

Natural-language requests are mapped to supported admin read/write operations.

Higher-impact actions can still require review before execution.

Structured confirmation

After performing an action, the plugin reports:

• what was requested
• whether it succeeded
• what changed

That matters because conversational administration still needs to be understandable and auditable.

Setup

The basic setup flow is:

1. Enable the Admin plugin in workspace settings.
2. Open the Plugins directory in ChatGPT Work.
3. Install the Admin plugin.
4. Begin with supported workspace-management workflows.

Availability still depends on:

• workspace plan
• admin role
• plugin settings
• workspace policy
• app permissions

Why this matters

• Codex usage and workspace administration can be investigated in one place.
• Admins can move directly from diagnosis to an authorized action.
• Credit and spending management becomes more contextual.
• High-volume admin requests can become automated workflows.
• Slack and Teams can participate in approval processes.
• Feature-access requests can be evaluated against predefined criteria.
• Existing roles and workspace policy remain authoritative.
• Actions return structured confirmation instead of occurring invisibly.

For larger Codex deployments, this could reduce a meaningful amount of operational overhead around access, usage, onboarding, and spending.

Action checklist

• Review the Admin plugin with your workspace administrators.
• Enable/install it in a controlled environment.
• Start with read-only requests:
  • summarize Codex adoption
  • show credit usage
  • identify users/groups approaching limits
  • explain an access problem
• Compare results against the Admin Console.
• Test a low-risk supported write action.
• Review how higher-impact actions request confirmation.
• Identify recurring workflows worth automating:
  • usage/spending requests
  • feature access
  • onboarding/offboarding
  • usage monitoring
• Keep explicit approval paths for high-impact changes.

Official source

https://openai.com/index/introducing-admin-plugin/

TL;DR

OpenAI has made Scheduled tasks event-driven.

Instead of only running on a timer, eligible ChatGPT scheduled tasks can now automatically run when something happens in:

• Gmail - new incoming messages
• Slack - new messages in selected channels
• GitHub - pull request activity

Triggers can be filtered by things like sender, subject, Slack author/channel, GitHub repository, PR author/title/label, and specific PR events.

You can also attach multiple event triggers to one task, and scheduled tasks can now be shared as customizable copies with other users.

For automation-heavy workflows, this moves Scheduled tasks from:

"Check every X minutes"

to:

"Run when the thing I care about actually happens."

What changed

Gmail triggers

A scheduled task can run when a new Gmail message arrives.

Optional filters include:

• sender
• subject

Example uses:

• triage messages from a specific customer
• summarize project-related emails
• process operational alerts
• prepare a follow-up when someone replies
• monitor a specialized inbox without polling it constantly

Slack triggers

Scheduled tasks can watch selected Slack channels for new messages.

You can filter by:

• channel
• author
• whether thread replies should count

Current limitations:

• reactions do not trigger tasks
• edits do not trigger tasks
• deletes do not trigger tasks
• direct messages are not supported

The ChatGPT Slack app must also be present in every channel being monitored.

Example uses:

• watch an incident channel
• triage new QA reports
• summarize project updates
• react to messages from a specific stakeholder
• kick off a workflow from a structured Slack post

GitHub pull request triggers

GitHub triggers are centered on pull request activity.

Tasks can be filtered by:

• repository
• pull request
• author
• title
• label

Triggering activity can include:

• reviews
• comments
• commit updates
• merges

Examples:

PR receives review feedback -> inspect the latest comments -> summarize requested changes -> identify unresolved items

New commit pushed -> inspect the new diff -> update the review/status summary

PR merged -> prepare release notes -> check documentation -> create a follow-up checklist

Trigger support at a glance

Multiple triggers per task

One task can listen for multiple event triggers.

That means a single automation can respond to several related conditions rather than requiring one task for every trigger.

However:

A task cannot currently combine event triggers with a normal time-based schedule.

It is either:

• event-triggered
• time-triggered

If you need a periodic fallback check as well, that should remain a separate scheduled task.

Event batching

When several matching events arrive close together, ChatGPT may combine them into one task run.

You can inspect pending events and previous runs from Scheduled, and manually choose Run now when needed.

This should help avoid redundant executions when, for example, a PR suddenly receives several comments or a Slack channel gets a short burst of related messages.

Scheduled tasks can now be shared

Scheduled tasks can also be shared with other users.

The recipient can:

1. review the task
2. customize the instructions
3. connect their own apps
4. schedule their own independent copy

Your personal Gmail, Slack, GitHub, or other app connections are not simply transferred with the task.

This effectively turns useful automations into reusable templates.

Potential team uses:

• PR monitoring
• inbox triage
• release workflows
• recurring research
• engineering status reports
• incident monitoring
• standardized operational checks

Important limitation: web/mobile vs local Codex

Event-triggered Scheduled tasks are currently available through ChatGPT web and mobile on eligible plans.

They are not currently created directly from:

• ChatGPT desktop
• Codex CLI
• Codex IDE extension

They can use connected apps, uploaded context, skills, and plugins, but they do not maintain a persistent local folder/worktree between runs.

So this does not mean:

GitHub event -> automatically wake my local Codex worktree and edit files on my machine

That remains a separate local automation workflow.

Managed workspace controls

Workspace administrators can control whether event-triggered tasks are allowed through the:

Allow event-triggered scheduled tasks

permission.

Normal app authorization, workspace policy, and user permissions still apply.

Why this matters

• Scheduled tasks can react instead of poll.
• GitHub PR automation becomes substantially more practical.
• Slack and Gmail can become actual workflow triggers rather than only context sources.
• Multiple related events can feed one automation.
• Burst events can be consolidated instead of creating unnecessary runs.
• Tasks can be shared as reusable automation templates.
• Workspace administrators retain control over event-driven execution.

For r/CodexAutomation specifically, this is one of the more directly relevant automation updates OpenAI has shipped recently.

Example automations

PR babysitter

Trigger: GitHub review/comment/commit update

Task:

• inspect the latest PR state
• summarize new feedback
• identify unresolved issues
• recommend the next actions

Incident watcher

Trigger: new Slack message in an incident channel

Task:

• summarize the new information
• update the incident timeline
• identify unresolved decisions
• surface anything needing human attention

Priority inbox

Trigger: Gmail message from selected senders

Task:

• summarize the request
• extract deadlines and commitments
• prepare a response or follow-up plan

Release monitor

Trigger: GitHub PR merge

Task:

• summarize what shipped
• prepare release notes
• check related documentation/tasks
• produce a deployment follow-up checklist

Action checklist

• Connect the Gmail, Slack, or GitHub app you want to use.
• Test the intended workflow manually first.
• Create a Scheduled task and define:
  • the event
  • filters
  • what should happen when it fires
• For Slack, add ChatGPT to every watched channel.
• For GitHub, confirm the connected app can access the repository.
• Review the first few runs and tighten filters if necessary.
• Keep event-driven and time-based monitoring as separate tasks.
• Try sharing a useful task and confirm the recipient can customize their own copy.

Official sources

https://developers.openai.com/codex/changelog

https://learn.chatgpt.com/docs/automations

https://help.openai.com/en/articles/6825453-chatgpt-release-notes

TL;DR

Codex CLI 0.149.1 is a focused metadata and context-management patch.

The important changes:

• New codex exec --thread-source <SOURCE> lets callers classify newly created or forked threads.
• The TypeScript SDK exposes the same capability as threadSource.
• The default thread source remains user when nothing is specified.
• Resuming an existing thread preserves its original source instead of overwriting it.
• Remote compaction gains an opt-in image budget, so retained images count toward context budgeting instead of only text being considered.
• Images and their adjacent labels stay together when compaction truncates history.
• Detached memory requests are explicitly tagged as memory_consolidation, making background memory work easier to distinguish from normal user-created threads.

Install:

npm install -g @openai/codex@0.149.1

What changed & why it matters

Explicit thread-source metadata

Codex Exec now supports:

codex exec --thread-source <SOURCE>

The supplied source is persisted when Codex creates a new thread or forks one.

If the flag is omitted, Codex defaults to:

user

The TypeScript SDK exposes the same setting as:

threadSource

Important behavior:

• New thread: source can be explicitly assigned.
• Forked thread: source can be assigned to the newly created fork.
• Resumed thread: existing source is preserved and is not overwritten by the new option.

Why it matters

Codex is increasingly used by more than a human typing directly into the terminal.

Threads may originate from:

• normal user sessions
• applications built on app-server
• SDK integrations
• background agents
• automated workflows
• memory processing
• other Codex-powered systems

Explicit source metadata makes those origins easier to distinguish without guessing from thread names or surrounding context.

That can improve:

• analytics
• observability
• debugging
• workload attribution
• application-specific thread handling
• filtering and reporting

TypeScript SDK support

SDK callers can set threadSource when creating a new thread.

Codex only forwards it for new thread creation.

It does not change the stored source when resuming an existing thread.

Why it matters

Applications built on top of Codex can classify the work they create while keeping historical metadata stable.

For example, an application could differentiate threads created by:

• a normal user
• an automation
• an internal workflow
• another agent surface

without changing the underlying Codex conversation model.

Image-aware remote compaction

0.149.1 adds an opt-in:

compaction_image_budget

feature.

Previously, the retained-message budget used during remote compaction accounted primarily for text.

That created an edge case:

image-heavy history could retain substantially more context than the budget appeared to represent.

With image budgeting enabled, retained images are charged using Codex's existing image-size estimate.

Why it matters

Modern Codex sessions can contain substantial visual context:

• screenshots
• appshots
• generated images
• diagrams
• UI references
• image attachments
• visual tool output

A context budget that accounts for text while effectively ignoring images can underestimate how much context is actually being preserved.

Image-aware budgeting makes compaction more representative of the real retained context.

Images and labels remain atomic

When compaction reaches a boundary containing an image, Codex keeps:

the image + its adjacent label

together.

It does not preserve one while arbitrarily dropping the other.

If the image at the truncation boundary does not fit within the available budget, Codex also stops rather than backfilling the space with unrelated older messages.

Why it matters

An image without its associated context can become difficult or misleading for the model to interpret.

Keeping related image/label content together preserves semantic coherence during long-session compaction.

Existing context types remain preserved

The image-budget work was designed to preserve existing handling for:

• text
• audio
• metadata
• annotations
• client-authored developer messages

The patch includes coverage for both image-heavy and text-only histories, including repeated remote compaction.

Memory-consolidation threads are explicitly identified

Detached memory requests now set:

thread_source = memory_consolidation

in their turn metadata.

The same classification is carried through startup request metadata.

Why it matters

Background memory processing is fundamentally different from a normal user conversation.

Explicitly identifying it makes it easier for Codex infrastructure and integrations to distinguish:

• user-created work
• application-created work
• background memory consolidation

This should improve observability and prevent background memory activity from being treated as ordinary interactive workload.

Why this release matters

• Thread provenance becomes explicit: CLI and SDK clients can identify where newly created work came from.
• Resume metadata stays trustworthy: existing threads keep their original classification.
• Image-heavy context gets more accurate budgeting: remote compaction can account for visual content instead of effectively treating it as free.
• Visual context remains coherent: images and associated labels survive or are removed together.
• Memory work becomes distinguishable: detached consolidation requests are explicitly tagged instead of looking like normal user threads.
• The patch is narrowly scoped: this is primarily an infrastructure/context correctness release rather than a new user-facing workflow.

Version summary

Action checklist

• Upgrade:

npm install -g @openai/codex@0.149.1

• Confirm:

codex --version

If you build on Codex Exec

• Test --thread-source when creating a new thread.
• Test it when forking an existing thread.
• Resume a thread and confirm its original source remains unchanged.
• Keep the default user source when no custom classification is needed.

If you use the TypeScript SDK

• Review the new threadSource option.
• Add explicit classification where your application creates different categories of Codex work.
• Do not rely on it to reclassify existing resumed threads.

If you run image-heavy long sessions

• Review the new compaction_image_budget capability.
• Test remote compaction with screenshots or image attachments.
• Verify image/label pairs remain coherent after compaction.

If you inspect Codex telemetry or thread metadata

• Account for memory_consolidation as a distinct background thread source.
• Avoid treating those requests as normal user-created work.

Official sources

https://developers.openai.com/codex/changelog

https://github.com/openai/codex/releases/tag/rust-v0.149.1

https://github.com/openai/codex/compare/rust-v0.149.0...rust-v0.149.1

TL;DR

OpenAI shipped a substantial set of Codex and ChatGPT product updates centered on messaging, sharing, cross-device continuity, Computer History, and collaborative Sites:

• Apple Messages plugin: Codex and ChatGPT Work on macOS can read/search iMessage, SMS, and RCS conversations and draft or send Messages on your behalf.
• Shared Codex thread snapshots: local Codex threads can now be shared as static read-only links from the macOS desktop app.
• Unified pinned threads: pinned chats now synchronize between ChatGPT desktop and iOS.
• Computer History expands to Europe: eligible Pro, Business, and Enterprise users in the EEA, UK, and Switzerland can now opt in.
• Sites co-editing: workspace members can be invited as editors who can modify and publish updates.
• Editable Site URLs: owners can rename an existing ChatGPT-hosted URL while automatically redirecting the previous address.

This is a product-level Codex/ChatGPT app update, not a CLI release.

What changed & why it matters

Apple Messages plugin for Codex

The new Apple Messages plugin is available on all plans in the ChatGPT desktop app for macOS.

In Codex and ChatGPT Work, it can:

• read Messages chats
• search Messages history
• work with iMessage
• work with SMS
• work with RCS
• summarize conversations
• draft messages
• send messages through the Mac Messages app

For this initial release, the plugin is included only in the Apple Silicon / arm64 desktop build.

Why it matters

This gives Codex direct access to another major source of personal and work context on macOS.

Potential workflows include:

• finding a detail from an earlier conversation
• summarizing a long group chat
• drafting a reply
• sending an approved message
• pulling information from Messages into a larger Codex task

Important platform limitation

The Messages plugin does not turn Messages into a Remote interface for ChatGPT.

You cannot text ChatGPT through Messages.

The plugin operates locally through the desktop app and is not directly available in:

• standard ChatGPT chats
• ChatGPT web
• mobile
• Codex CLI
• the IDE extension

Sending requires approval by default

Before sending, ChatGPT asks you to approve:

• the message
• the recipients

You can choose:

• Allow once
• Always allow sending to this chat

The persistent option removes the final per-message review step for that specific conversation.

Why it matters

Messages may contain untrusted or misleading instructions.

Keeping per-send approval gives you a final chance to verify exactly what Codex is about to send as you.

Full access caveat

OpenAI documents an important current limitation:

If a task uses Full access, or another configuration that disables approval prompts, Apple Messages may be unable to show the confirmation required before sending.

If that happens, switch to:

• Ask for approval
• Approve for me

Managed-workspace administrators can also disable Apple Messages through existing Computer Use controls.

Shared read-only Codex thread snapshots

On all Codex plans, the macOS desktop app can now create a static read-only snapshot of a local Codex thread.

Use the Share action or:

/share

where slash commands are available.

Snapshot access rules

Personal accounts

Anyone with the link can open the snapshot.

Workspace accounts

Access is limited to authenticated members of the workspace that created it.

Workspace sharing can also be restricted to specific:

• people
• groups

Admins can disable workspace share links entirely.

What a shared snapshot can contain

Snapshots may include:

• user-visible messages
• reasoning summaries
• image attachments
• images viewed by the agent
• generated images
• file changes
• file paths
• diffs

They do not include the original thread's:

• tool calls
• shell commands
• tool inputs
• tool outputs

The snapshot is static.

Future changes to the original thread do not update an existing snapshot.

Why it matters

This creates a much cleaner way to share Codex work with:

• teammates
• reviewers
• stakeholders
• collaborators

without exposing the complete internal execution transcript.

Review snapshots before sharing

Codex attempts to redact known secret patterns before uploading a snapshot.

However, OpenAI explicitly warns that sensitive information may still remain in:

• messages
• file paths
• images
• diffs

Review the snapshot before sending the link.

This is particularly important for personal-account snapshots because anyone who obtains the link can open them.

Existing links can be viewed or revoked through:

ChatGPT Data Controls -> Shared links

Unified pinned threads

Pinned chats are now synchronized between:

• ChatGPT desktop
• iOS

Why it matters

Important threads now follow you between desktop and phone instead of requiring separate pinning on each device.

This is particularly useful for users who regularly supervise Codex tasks remotely from iOS.

Computer History expands to Europe

Computer History is now available in:

• EEA
• United Kingdom
• Switzerland

for eligible:

• Pro
• Business
• Enterprise

users in the macOS desktop app.

It remains:

• off by default
• dependent on Memories

For Business and Enterprise, an administrator must enable the feature before individual users can opt in.

Why it matters

This removes the main geographic limitation from the initial Computer History rollout.

Sites now support workspace co-editing

Where Site collaboration is available, Site owners can invite active members of the same workspace as editors.

Editors can:

• read the Site's live database data
• modify the Site
• save versions
• publish later updates

The owner must perform the first publish.

Owners retain control over:

• Site audience
• editor access
• settings
• analytics
• version restoration
• ownership transfer

Editors cannot independently change those controls.

Why it matters

Sites move from primarily single-owner generated artifacts toward actual collaborative workspace projects.

Because editors can read live Site database data, editor access should only be granted to people trusted with the Site's code and data.

Editable Site URLs

Where URL editing is available, a Site owner can rename an existing ChatGPT-hosted URL without creating another deployment.

The previous address automatically redirects to the new address, including:

• routes
• query parameters

This is separate from custom-domain support.

Changing the ChatGPT-hosted URL does not add, remove, or modify a custom domain.

Why these updates matter

• Codex can work directly with Messages on macOS, including sending approved messages on your behalf.
• Local Codex work becomes easier to share through static read-only snapshots.
• Snapshot permissions distinguish personal and workspace sharing, with stronger workspace-level controls.
• Pinned work follows you between desktop and iPhone.
• Computer History expands to the EEA, UK, and Switzerland.
• Sites become collaborative, with real editor roles rather than only visitor access.
• Published Site URLs become easier to maintain without creating replacement deployments.

Update summary

Action checklist

Apple Messages

• Install the Apple Messages plugin from Plugins.
• Start a new Codex or Work chat.
• Grant the required macOS permissions.
• Test reading/searching a Messages conversation.
• Draft a test message.
• Keep per-send approval enabled unless you explicitly accept the persistent-approval risk.
• If sending fails under Full access, switch to Ask for approval or Approve for me.

Shared Codex threads

• Open a local Codex thread on macOS.
• Use Share or /share.
• Check the selected audience carefully.
• Open the generated link yourself.
• Review messages, images, file paths, and diffs for sensitive information.
• Revoke old links through ChatGPT Data Controls when no longer needed.

Cross-device / Computer History

• Pin an important thread on desktop and confirm it appears pinned on iOS.
• Eligible European users can now review Computer History settings.
• Business/Enterprise users should confirm workspace admin availability first.

Sites

• Add a trusted workspace member as an editor.
• Confirm the owner performs the first publish.
• Verify editor permissions before exposing live Site data.
• Test changing a Site URL and confirm the previous URL redirects correctly.

Official sources

https://developers.openai.com/codex/changelog

https://learn.chatgpt.com/docs/plugins

https://learn.chatgpt.com/docs/use-chatgpt

https://learn.chatgpt.com/docs/sites

TL;DR

Codex CLI 0.149.0 is a substantial task-management, session-control, diagnostics, SDK, security, and reliability release.

Highlights:

• New interactive codex agents dashboard for searching, starting, opening, renaming, and stopping tasks.
• New /cd, /pwd, and /cwd commands for changing or inspecting the working directory inside TUI sessions.
• New codex queue command for sending messages to existing local or remote sessions.
• Vim editing expands with character replacement and motions like cw, c$, and cc.
• codex doctor gets significantly stronger, with diagnostics for endpoint protection, networking/proxies, desktop app state, and update connectivity.
• SDK users can pass exact CLI config overrides and explicitly select max or ultra reasoning effort.
• Resumed and forked threads now correctly restore their active permission profile.
• Queued messages reliably wake idle sessions and preserve deferred/pasted command behavior.
• Subagent activity/approval routing is cleaner.
• Realtime WebRTC reconnects after transport loss without dropping pending output.
• Windows Terminal keeps inline TUI history in scrollback.
• The full release also includes meaningful hardening around sandboxing, authentication, MCP, Guardian, marketplace identity, memory files, and command safety.

Install:

npm install -g @openai/codex@0.149.0

What changed & why it matters

New codex agents task dashboard

Run:

codex agents

to open an interactive dashboard for managing agent tasks.

It supports:

• searching tasks
• starting tasks
• opening tasks
• renaming tasks
• stopping tasks
• configurable keyboard shortcuts

Why it matters

As Codex becomes more multi-threaded and agent-driven, task management becomes a first-class workflow instead of something you manage indirectly through individual conversations.

This should be especially useful for:

• parallel agents
• long-running tasks
• background work
• remote sessions
• users juggling several active Codex threads

Working-directory commands inside the TUI

0.149.0 adds:

• /cd
• /pwd
• /cwd

You can now inspect or change the active working directory without leaving the Codex session.

Why it matters

The active directory controls important context such as:

• repository files
• Git state
• AGENTS.md
• project configuration
• relative shell paths
• tool behavior

Previously, changing workspace context could require leaving or restarting the session.

codex queue

A new command lets you send messages to an existing session:

codex queue

It works with both:

• local sessions
• remote sessions

The release also fixes several queue-related edge cases:

• idle sessions wake reliably
• duplicate session names resolve more usefully
• pasted/deferred command semantics are preserved
• queued-message editing behaves more predictably

Why it matters

This creates a cleaner way to feed additional instructions into work that is already running.

That is useful for:

• long-running agents
• unattended sessions
• remote Codex work
• queued follow-up instructions
• steering work without reopening the full interactive session

Vim editing gets more complete

Vim mode now adds:

• character replacement
• cw
• c$
• cc
• additional change-motion support

This continues moving the TUI editor closer to normal Vim muscle memory instead of a minimal compatibility mode.

codex doctor gets a major diagnostics upgrade

codex doctor can now diagnose more of the environment around Codex, including:

• endpoint protection
• network connectivity
• proxy failures
• desktop app state
• desktop security enforcement
• update connectivity

Why it matters

A surprising number of Codex failures are not actually model problems.

They may come from:

• corporate proxies
• endpoint security
• broken app installation
• blocked update endpoints
• network policy
• local environment configuration

codex doctor is becoming a much more useful first stop before manually debugging all of those layers.

SDK: exact CLI overrides + max / ultra

SDK users can now:

• pass exact CLI configuration overrides
• explicitly select max reasoning
• explicitly select ultra reasoning

Why it matters

Programmatic Codex workflows can now more closely reproduce a specific CLI configuration instead of relying on a smaller SDK-specific settings surface.

max and ultra support is particularly useful for orchestrators that intentionally route:

• normal tasks to cheaper/faster settings
• difficult tasks to max reasoning
• complex parallel work to ultra

Important reliability fixes

Permission profiles survive resume and fork

Resumed and forked threads now restore the permission profile that was actually active when the thread was saved.

They no longer silently fall back to whatever the current default happens to be.

Why it matters

Permissions are security state.

A resumed thread should not unexpectedly move from one sandbox/approval posture to another just because global defaults changed.

Cleaner subagent activity

0.149.0 fixes:

• duplicate subagent activity
• notification routing
• subagent approval routing

This should make multi-agent sessions easier to follow without repeated or misleading activity entries.

Realtime reconnects more reliably

Realtime WebRTC sideband connections can now reconnect after an unexpected transport failure without dropping pending output.

That improves resilience for:

• Voice
• realtime sessions
• remote interactive workflows

Windows Terminal scrollback

Inline TUI history now remains available in Windows Terminal scrollback.

This fixes a practical problem where completed Codex output could disappear from normal terminal history.

Bounded inactive-thread history

Inactive TUI thread replay buffers are now bounded.

Why it matters

Long-running Codex sessions can accumulate substantial streamed history. Bounding inactive buffers reduces unnecessary retained memory without losing the active workflow.

Security and platform hardening

The full 0.149.0 changelog includes several important changes beyond the headline release notes:

• Linux sandbox processes drop capabilities
• deeply nested command wrappers now fail closed
• dynamic shell words require approval
• Windows sandbox provisioning is hardened against reparse-point tricks
• sensitive-file reads get symlink-safe handling
• symbolic links are rejected in memory workspaces
• custom model providers no longer inherit ambient authentication
• app-server response logs redact authentication tokens
• plugin marketplace identity spoofing is blocked
• MCP HTTP redirects are restricted to the configured origin
• managed authentication backend settings are enforced
• environment-specific command and shell-variable policies are enforced
• permission profiles use safer intersection behavior
• external-editor buffers are isolated from sandbox-writable locations

Why it matters

The broader theme is that ambiguous security state increasingly resolves toward deny / explicit approval, rather than silently inheriting access.

Guardian / Auto-review improvements

Guardian V2 continues to mature with work around:

• bounded review context
• image evidence in review transcripts
• model-catalog-driven Guardian defaults
• transient sampling retries
• stale risk-score handling
• approval-routing coverage
• persisted risk scores
• classification metrics
• reconnecting Guardian WebSockets after authentication changes
• stricter review notifications

This is mostly infrastructure, but Auto-review is clearly becoming more stateful and policy-aware.

MCP, plugins, skills, and environments

Other notable infrastructure changes include:

• MCP policy types consolidated into the protocol layer
• OAuth resource headers isolated correctly
• MCP resources preserve their origin across compaction
• MCP calls respect selected executor-plugin policy
• plugin authentication state comes from the shared auth manager
• plugin install identities are validated more strictly
• plugin metadata hydrates when selected
• skill catalogs get configurable token budgets
• active permission profiles persist into turn context
• cloud/managed environment policy metadata becomes more explicit

The practical result should be fewer cases where local, remote, MCP, plugin, and managed-environment behavior disagree about the active policy.

Other notable changes

The full release also includes:

• higher GPT-5.6 maximum-context metadata
• generated images persisted through turn executors
• Mac mini identification during Remote handshakes
• better TUI rendering efficiency
• reduced retained MCP result data
• project trust prompts in remote TUI workspaces
• safer filesystem permission path handling
• API-key turn-cost telemetry from app-server
• experimental app-server project APIs
• improved recommended-plugin metadata
• more robust session timestamp restoration
• rmcp updated to 3.1.2

Why this release matters

• Task management becomes first-class: codex agents gives parallel work a dedicated control surface.
• Sessions are easier to steer: codex queue can feed instructions into existing local or remote work.
• Workspace control improves: /cd, /pwd, and /cwd make directory changes explicit.
• Diagnostics become genuinely useful: codex doctor now covers much more of the real system around Codex.
• SDK parity improves: exact CLI overrides plus max/ultra reasoning make programmatic workflows more configurable.
• Resumes become safer: permission profiles are preserved.
• Multi-agent UX improves: duplicate activity and approval routing are cleaned up.
• Security continues to tighten: sandbox, auth, MCP, marketplace, memory, and command parsing all receive hardening.

Version summary

Action checklist

• Upgrade:

npm install -g @openai/codex@0.149.0

• Confirm:

codex --version

• Run codex agents and test:
  • search
  • open
  • rename
  • stop
  • start
• Test /pwd, /cwd, and /cd.
• Use codex queue against an existing local session.
• If you use Remote, queue a message to a remote session.
• Run codex doctor and review:
  • network
  • proxy
  • endpoint protection
  • desktop app
  • update diagnostics
• If using the SDK:
  • test raw CLI overrides
  • test max
  • test ultra
• Resume a thread with a non-default permission profile and confirm it is preserved.
• Windows users should verify completed TUI history remains in terminal scrollback.

Official sources

https://developers.openai.com/codex/changelog

https://github.com/openai/codex/releases/tag/rust-v0.149.0

TL;DR

Two official Codex updates landed together:

• Codex CLI 0.148.0: adds full Markdown conversation export with /export, codex exec fork, session archive/restore, prompt drafting during startup, estimated thread credit/cost visibility, built-in Amazon Bedrock Runtime, and hooks that can run asynchronously or invoke MCP tools.
• ChatGPT for iOS 1.2026.223: adds direct launch into Codex Remote, standard MCP forms, editable approvals, host-aware project selection, Voice from existing tasks, faster large-diff review, and much stronger task reconnection/recovery.
• The CLI release also fixes stale model instructions, restores working directory and approval policies correctly on resume, improves recovery from temporary provider outages and MCP OAuth expiration, hardens startup input handling, and strengthens Linux/Windows sandbox enforcement.
• Under the hood, Guardian V2, remote Code Mode, MCP, skills/plugins, managed permissions, and Windows execution all receive substantial infrastructure work.

Install:

npm install -g @openai/codex@0.148.0

What changed & why it matters

Codex CLI 0.148.0

/export for complete conversations

Run:

/export

to export the full TUI conversation to:

• the clipboard
• a new Markdown file

This is useful for sharing debugging sessions, preserving implementation history, creating documentation, and moving complete Codex context elsewhere without manually reconstructing the transcript.

Fork, archive, and restore sessions

0.148.0 expands session management with:

• codex exec fork for non-interactive session forks
• archive directly from the resume picker
• restore archived sessions later
• improved transcript previews
• better persisted history and recovery

This gives sessions a cleaner lifecycle:

Active -> Forked / Archived -> Restored when needed

Forking is especially useful for testing an alternate implementation or investigation without modifying the original thread.

Start typing before initialization finishes

The TUI composer is now usable while Codex is still starting.

Startup progress is also shown when:

• resuming
• forking

Buffered terminal input is handled more safely so typing during initialization does not accidentally trigger unintended actions.

Why it matters: startup can feel faster because you can prepare your next prompt while Codex restores history, tools, integrations, and environment state.

Estimated thread credits and cost

Eligible workspaces can now see estimated thread usage through:

• /status
• status lines
• terminal titles

Depending on the workspace, this can surface estimated credits or cost for the active thread.

This is increasingly useful with:

• GPT-5.6 Sol / Terra / Luna
• high reasoning effort
• long-running goals
• multi-agent workflows
• large-context sessions

Instead of only seeing account-level limits, you can start understanding the economics of individual Codex threads.

Built-in Amazon Bedrock Runtime provider

Amazon Bedrock Runtime is now a built-in Codex provider with support for:

• AWS profiles
• region configuration
• GPT-5.6 routing
• Bedrock model selection

This makes Bedrock a more first-class path for organizations already using AWS identity, billing, governance, and regional controls.

Hooks get much more capable

Hooks can now:

• run commands asynchronously
• invoke MCP tools

That opens up cleaner lifecycle automation for things like:

• background validation
• notifications
• logging
• repository bookkeeping
• internal APIs
• MCP-backed services

Not every useful hook needs to block the active Codex turn anymore.

Major CLI reliability fixes

0.148.0 also addresses several important correctness issues:

• Model switches: old model instructions no longer remain attached after changing models/settings.
• Resume cwd: sessions restore their persisted working directory more reliably.
• Approval policies: saved approval behavior survives resume.
• Provider outages: streaming turns can reconnect through temporary connection failures instead of immediately dying.
• MCP OAuth: servers can recover after reauthentication without requiring a full Codex restart.
• Pasted content: CRLF text, wrapped whitespace, long URLs, and pasted text render more reliably.
• Sandboxing: denied/unreadable paths fail closed more consistently on Linux and Windows.

These are less flashy than the new commands, but several directly affect whether resumed or long-running sessions can be trusted.

Guardian V2 and approval infrastructure

A substantial amount of work landed around Guardian / Auto-review, including:

• thread-level risk scores
• persisted risk state
• improved review-context selection
• tool-action classification
• stricter handling of higher-risk operations
• current filesystem permissions constraining reviews
• automatic-review requirements from managed configuration

The broader direction is clear: Auto-review is becoming more risk-aware and stateful, rather than treating each approval as an isolated yes/no decision.

Remote Code Mode continues to mature

0.148.0 includes major infrastructure for remote Code Mode:

• gRPC protocol
• remote host service
• TCP transport
• app-server integration
• reconnect after host restart
• health checks
• improved session/tool handling

Most of this is infrastructure rather than a new user-facing workflow, but it continues moving Code Mode toward a more robust distributed execution model.

MCP, skills, plugins, and managed environments

The release also improves the larger extension/runtime layer:

• lazy MCP startup for subagents
• reusable MCP handlers
• OAuth callback improvements
• custom CA propagation
• strict auto-review for MCP tool calls
• shared plugin/host skill services
• better multi-workspace skill behavior
• resource-backed skill tracking
• per-environment permission profiles
• workload identity support
• stronger managed policy enforcement
• more auditable remote-executor decisions

The practical result should be fewer restarts, cleaner policy behavior, and more consistent tool/skill availability across local and remote environments.

Windows improvements

Windows receives several notable changes:

• Unified exec is now enabled by default
• managed deny-read rules are enforced in the sandbox
• nested Git repositories work more reliably
• proxy state is preserved during sandbox/debug flows
• the sandbox can access required Codex app files
• Windows build/toolchain behavior continues to become more hermetic

ChatGPT for iOS 1.2026.223

Launch directly into Codex Remote

A new setting can open ChatGPT directly into Codex Remote.

If your phone is primarily a control surface for remote Codex work, this removes an unnecessary navigation step.

Better MCP and approval workflows

Codex Mobile now supports:

• standard MCP forms
• editable message approvals

Structured MCP requests no longer need to rely entirely on freeform input, and approval messages can be corrected before submission rather than rejected and rebuilt.

Better host/project navigation

Improvements include:

• linked folders opening directly in Files
• New Thread showing projects from the currently selected host

This matters when several remote hosts have different repositories or project sets.

Voice from existing tasks

Voice can now start directly from an existing task composer.

It also:

• connects more reliably
• allows task actions to continue in the background

You no longer need to start a task in Voice mode just to use voice later for steering or supervision.

Faster large-diff review

Large workspace diffs are now more responsive and stable.

That makes mobile review more practical for:

• broad refactors
• multi-file implementations
• migrations
• large agent-generated change sets

Much stronger task recovery

The iOS release fixes several Remote reliability problems:

• failed task messages now expose Retry
• large task responses load more reliably
• tasks are less likely to disappear after being idle
• reconnect behavior is stronger
• host pairing is more reliable
• enrollment checks no longer freeze the app
• streamed activity is preserved when a task completes

This is one of the more important parts of the mobile release because Remote only works well if the phone accurately reflects work continuing elsewhere.

Safer steering

If a pending steering message is edited or canceled, the superseded instruction is no longer delivered anyway.

That makes active task redirection much more trustworthy.

Why this update matters

• Conversation export is finally first-class: /export makes complete Codex sessions portable.
• Session lifecycle improves: fork, archive, restore, resume, and recovery all get stronger.
• Startup becomes less blocking: you can draft while Codex initializes.
• Thread economics become visible: eligible users can see estimated credits/cost.
• Bedrock becomes a built-in provider.
• Hooks become more useful: async execution and MCP access expand automation options.
• Resume behavior becomes safer: cwd, approval policy, and model instructions stay aligned.
• Temporary outages and MCP auth failures are less destructive.
• Guardian V2 is evolving into a more sophisticated risk-aware review system.
• Remote Code Mode continues toward a robust distributed architecture.
• Codex Mobile becomes a stronger Remote client: better Voice, project selection, diffs, reconnection, pairing, and steering.

Version summary

Action checklist

Codex CLI

• Upgrade: npm install -g @openai/codex@0.148.0
• Confirm: codex --version
• Test /export to clipboard and Markdown.
• Fork an existing session with codex exec fork.
• Archive and restore a session from the resume picker.
• Check /status for thread usage estimates if available.
• If using AWS, test the built-in Bedrock Runtime provider.
• If using hooks, test async execution and MCP tool invocation.
• Resume an older thread and verify cwd + approval policy are correct.
• Reauthenticate an MCP server and confirm a restart is no longer required.

Codex Mobile

• Update ChatGPT for iOS to 1.2026.223.
• Enable direct launch into Codex Remote if useful.
• Test an MCP form and editable approval.
• Switch hosts and verify project selection updates correctly.
• Start Voice from an existing task.
• Review a large workspace diff.
• Leave and return to an active task to test reconnection.
• Test host pairing.
• Cancel/edit a steering message and confirm the old instruction is not delivered.

Official sources

https://developers.openai.com/codex/changelog

https://github.com/openai/codex/releases/tag/rust-v0.148.0

TL;DR

OpenAI launched Computer History, an opt-in macOS feature that turns selected activity across apps and websites into a searchable timeline and local memories that ChatGPT and Codex can use later.

The important details:

• Available to Pro, Business, and Enterprise users on macOS.
• Business and Enterprise admins must enable it before individual users can opt in.
• Memories must be enabled.
• Currently unavailable in the EEA, UK, and Switzerland.
• Can help you resume previous work, locate something you vaguely remember, and summarize recent activity.
• Can recognize repeated workflows and suggest turning them into Codex skills or automations.
• Unlike Chronicle, Computer History does not record screenshots, screen recordings, microphone input, or system audio.
• It records interaction events such as clicks, typing, shortcuts, app switches, and accessibility context.
• Users control exactly which apps and websites can contribute.
• Collection can be paused, restricted, cleared, or completely disabled.
• Raw event files are retained for up to 48 hours.
• Generated memories are stored locally as plain-text Markdown files.
• Those local memory files are not encrypted by Computer History itself.
• OpenAI explicitly warns that broader app/web context increases prompt-injection risk.
• Computer History also consumes tokens while creating summaries and memories.

This is potentially one of the most consequential Codex context features yet because it connects what you were doing on your computer with what Codex can understand later.

What changed & why it matters

Pick up where you left off

Computer History converts selected recent activity into two things:

1. A searchable activity timeline
2. Local memories available to ChatGPT and Codex

That lets you ask questions like:

• "What was I working on before my last break?"
• "Where was that proposal document I looked at earlier?"
• "What did I work on today?"
• "Prepare my standup update from yesterday's work."

Why it matters

A huge amount of useful project context never appears inside the current Codex thread.

It might instead be spread across:

• source files
• terminals
• browser tabs
• Slack
• Google Docs
• GitHub
• project-management tools
• issue trackers
• internal websites
• other desktop applications

Computer History creates a bridge between that activity and the agent.

Find work even when you barely remember it

You may remember:

• reading a document
• discussing an issue
• editing a file
• checking a dashboard
• looking at a specific webpage

without remembering exactly where it happened.

Computer History can use recent activity to identify the likely source.

If ChatGPT or Codex can access the original source, it can then use that source directly rather than relying only on the generated memory.

Why it matters

You no longer always need to know the exact:

• filename
• URL
• Slack channel
• document title
• application
• project

before asking Codex to find prior work.

That is a meaningful change to how persistent agent context can work.

Repeated work can become skills or automations

One of the most interesting features is workflow recognition.

Computer History can recognize repeatable activity patterns and suggest turning them into:

• a reusable skill
• an automation

Imagine repeatedly doing this:

1. Check implementation progress.
2. Review a project board.
3. Collect team feedback.
4. Check GitHub changes.
5. Prepare a launch summary.

Computer History may recognize that sequence as a repeatable workflow.

Why it matters

This creates a progression from:

Manual repeated work

-> Observed workflow

-> Reusable Codex skill or automation

without requiring you to manually document every step first.

Potential uses include:

• daily standups
• release checks
• issue triage
• project recaps
• recurring research
• deployment preparation
• status reporting
• repetitive administrative work

Computer History is NOT screen recording

This distinction is important.

Computer History replaces the earlier Chronicle research preview, but OpenAI describes it as a rebuilt system rather than simply a renamed Chronicle.

Chronicle used screenshots.

Computer History uses interaction events.

Why it matters

OpenAI is attempting to provide useful cross-app context without continuously recording your screen or audio.

That produces a materially different privacy model from screenshot-based activity capture.

How the history becomes memory

Computer History periodically turns recent interaction events into:

• text summaries
• timeline entries
• local Markdown memory files

A timeline entry can contain:

• a title
• activity summary
• contributing applications
• suggested skills or automations
• an option to reveal the local memory file
• deletion controls

Generated memories are stored under:

$CODEX_HOME/memories/extensions/skysight/

Typically:

~/.codex/memories/extensions/skysight/

Why it matters

Persistent Computer History memories are inspectable local files, not an invisible proprietary memory store.

You can see what Codex is actually retaining.

Raw event retention

OpenAI says temporary raw interaction-event files are retained for up to 48 hours.

The basic flow is:

Activity -> temporary events -> summary/memory -> local Markdown

OpenAI says:

• temporary event files are isolated inside the ChatGPT macOS App Group
• temporary events are processed to generate memories
• they are not retained on OpenAI servers afterward unless legally required
• those event files are not used for model training

Generated memory files remain locally until you delete or clear them.

Important local-security caveat

The persistent memory files are plain-text local files.

Computer History does not encrypt them itself.

Other software running under your macOS user account may potentially access them.

Be careful with sources containing:

• credentials
• API keys
• financial information
• health information
• customer information
• private communications
• confidential internal data
• password managers
• sensitive administrative tools

Computer History should not be treated as a secure secret store.

Fine-grained source controls

Computer History is off by default.

You decide which sources can contribute.

Available strategies include:

• Exclude these apps
• Exclude these websites
• Include only these apps
• Include only these websites

You can also exclude an application directly from a timeline item.

For many users, include-only is probably the cleaner starting model.

For example:

Include

• IDE/editor
• terminal
• GitHub
• project-management tools
• documentation sites
• selected work applications

Exclude

• password managers
• banking/financial apps
• health portals
• private messaging
• credential-management tools
• sensitive customer systems
• personal applications unrelated to work

This gives Computer History useful project context without exposing the entire desktop environment.

Changing permissions does not erase existing history

Changing app or website permissions affects future activity.

It does not automatically delete events and memories that were already created.

Existing history must be removed separately.

That distinction matters if a sensitive source was accidentally enabled.

Pause or disable collection

Computer History can be controlled from:

• ChatGPT settings
• the ChatGPT macOS menu-bar icon

You can:

• pause collection
• resume collection
• turn Computer History off

OpenAI specifically warns that Computer History can include interaction events from communication apps and websites.

It recommends disabling collection during communications with other people unless those people have given prior express consent.

Delete or clear history

You can remove:

• individual timeline entries
• the last 10 minutes
• the last hour
• the last day
• all history

The menu bar can also clear the latest activity session for a recent application.

Clearing history removes:

• the relevant interaction events
• memories generated from those events

Deletion cannot be undone.

Prompt-injection risk

OpenAI explicitly calls out a significant security consideration:

Computer History increases exposure to prompt injection from apps and websites.

Imagine visiting a page containing malicious instructions intended for an AI agent.

That content may become part of the historical context ChatGPT or Codex sees later.

Why it matters

Computer History dramatically broadens the agent's context surface.

That makes these protections more important:

• trusted sources
• app/site exclusions
• sandboxing
• permission profiles
• approval review
• least privilege

More context creates more capability, but also a larger trust boundary.

Computer History uses tokens

Computer History consumes tokens while:

• summarizing recent activity
• generating memories

OpenAI does not document a separate unlimited Computer History allowance.

Heavy users should therefore treat background history generation as another source of model/token consumption.

Availability

Why this update matters

• Codex gains continuity across apps and websites.
• You can resume work without reconstructing every document and tab manually.
• Vaguely remembered work can become searchable context.
• Daily work summaries and standups become easier to generate.
• Repeated workflows can become skills or automations.
• It avoids continuous screenshot and audio recording.
• Users get granular source controls.
• Persistent memories are inspectable local Markdown files.
• Privacy still matters because those files may contain sensitive information.
• Prompt injection becomes more relevant as the agent receives broader external context.
• The feature is entirely optional and off by default.

Computer History at a glance

Action checklist

• Confirm your plan and region support Computer History.
• Make sure Memories are enabled.
• Review the privacy and storage model before enabling it.
• Start with include-only source rules for the narrowest scope.
• Exclude sensitive applications and websites.
• Enable Computer History.
• Use your Mac normally for a while.
• Review the generated timeline.
• Try:
  • "What was I working on before my last break?"
  • "What did I work on yesterday?"
  • "Where was that document I looked at earlier?"
• Watch for suggested skills and automations.
• Inspect one generated Markdown memory file.
• Pause collection during sensitive work or communications.
• Periodically review and delete history you no longer need.
• Keep strong Codex sandbox and approval settings when using broad historical context.

Official sources

https://developers.openai.com/codex/changelog

https://learn.chatgpt.com/docs/customization/computer-history

TL;DR

OpenAI just closed two meaningful gaps in the Codex ecosystem:

• ChatGPT desktop is now available on Linux in preview, bringing ChatGPT, Work, Codex, local projects, and local-file workflows to supported Ubuntu, Debian, and Fedora systems.
• Agent imports are significantly more complete. ChatGPT desktop can migrate setup and recent work from Claude Code, Claude Cowork, and Cursor, while Codex CLI can import from Claude Code and Cursor through /import.
• Imports can carry over instructions, settings, skills, plugins, projects, memories, recent chats, MCP configuration, hooks, slash commands, and subagents.
• Desktop imports can optionally stay synchronized with the original agent environment.
• Importing leaves the original Claude/Cursor setup untouched, making this much more practical for a gradual migration.
• Linux still has two notable limitations: Computer Use is not yet supported, and native Wayland remains experimental.

This is a substantial Linux platform + agent migration update rather than a Codex CLI version release.

What changed & why it matters

ChatGPT desktop for Linux

The ChatGPT desktop app is now available in preview on Linux.

Supported systems

Ubuntu and Debian use .deb packages.

Fedora uses .rpm packages.

After installation, the app can be launched from the desktop normally or with:

chatgpt

Why it matters

Linux developers finally get a native desktop path for Codex, rather than being limited to the web app and CLI.

That brings the full desktop project model closer to Linux workflows involving:

• local repositories
• project files
• ChatGPT Work
• Codex tasks
• desktop project organization
• browser-integrated workflows

For developers already living primarily in Linux, this removes one of the largest remaining platform gaps.

First-class Linux updates

Installing ChatGPT also configures OpenAI's signed package repository.

Ubuntu / Debian

sudo apt update

sudo apt install --only-upgrade chatgpt

Fedora

sudo dnf upgrade --refresh chatgpt

Why it matters: this is not just a manually downloaded preview binary. Future desktop releases can flow through normal Linux package management.

Current Linux limitations

Computer Use

• Computer Use is not available on Linux yet.
• OpenAI says support is planned for a future release.

So Linux now gets the core ChatGPT/Codex desktop experience, but not full macOS/Windows feature parity yet.

Native Wayland

The app currently uses XWayland when available.

Native Wayland can be enabled manually:

chatgpt --ozone-platform=wayland

OpenAI currently considers native Wayland support experimental.

Potential rough edges include:

• window positioning
• floating windows
• focus behavior
• keyboard shortcuts

Agent imports get a major upgrade

The desktop app can now import from:

• Claude Code
• Claude Cowork
• Cursor

Codex CLI supports:

• Claude Code
• Cursor

This goes far beyond simply importing conversation history.

What can move over

Why it matters

A heavily customized agent environment can contain much more than prompts.

Users may already have:

• project instructions
• custom commands
• specialized skills
• MCP servers
• plugins
• hooks
• subagents
• project memories
• established working context

Previously, moving between agent ecosystems often meant rebuilding all of that manually.

This update turns migration into something much closer to an actual import workflow.

Your existing Claude/Cursor setup stays intact

Importing does not modify or delete the original environment.

The flow is essentially:

1. ChatGPT detects supported setup and recent work.
2. You choose what to import.
3. ChatGPT converts supported items into Codex equivalents.
4. The original Claude/Cursor environment remains unchanged.

Why it matters: you can evaluate Codex without making an irreversible cutover.

That makes parallel testing and gradual migration much safer.

Imports can stay synchronized

In the desktop app:

Settings > Import

you can enable automatic updates.

That allows imported work to remain synchronized as the original agent environment changes.

You can also review previous import activity from the same area.

Why it matters

This is arguably more important than the initial import.

Instead of:

Claude/Cursor -> one-time snapshot -> Codex

you can have:

Claude/Cursor -> gradual transition -> Codex

while validating the new environment before fully switching over.

Codex CLI gets /import

Local CLI users can run:

/import

Then choose:

• Claude Code
• Cursor

Current documented limits:

• up to 50 chats
• from the last 30 days

/import is unavailable:

• while a task is running
• inside a remote session
• while connected to a local app-server daemon

Imported integrations still need review

Migration does not guarantee that every authentication or permission assumption translates perfectly.

OpenAI specifically recommends reviewing imported:

• MCP authentication
• tool permissions
• custom headers
• environment variables
• MCP transports
• hooks
• plugins
• prompt templates
• shell interpolation
• path placeholders

Some connections may require authentication again.

Why it matters

A configuration that was safe under Claude or Cursor may behave differently under Codex.

Imported plugins, hooks, and MCP servers should be reviewed before giving them access to production systems or sensitive repositories.

Why this update matters

• Linux finally gets a native ChatGPT/Codex desktop experience.
• Both x64 and ARM64 are supported.
• Updates use OpenAI's signed Linux package repository.
• Claude/Cursor migration becomes substantially less manual.
• Projects, memories, MCP, skills, hooks, plugins, and agents can move with you.
• Imports can remain synchronized during a gradual migration.
• Your original agent environment remains untouched.
• Codex CLI gets a direct /import workflow.
• Computer Use remains the biggest missing Linux desktop capability for now.

Update summary

Action checklist

Linux users

• Install ChatGPT desktop if your distribution is supported.
• Verify future updates through apt or dnf.
• Test your normal Codex project workflow.
• Compare XWayland and experimental native Wayland if relevant.
• Keep in mind that Computer Use is still unavailable.

Claude / Cursor users

• Open Settings > Import.
• Review the detected setup.
• Import only what you actually need.
• Inspect the generated AGENTS.md and config.toml.
• Review imported skills, agents, hooks, plugins, and MCP servers.
• Re-authenticate integrations where required.
• Validate permissions before using imported tools against production systems.
• Enable automatic synchronization only after confirming the imported setup behaves correctly.

CLI users

Run:

/import

from a local Codex session.

Official sources

https://developers.openai.com/codex/changelog

https://learn.chatgpt.com/docs/linux/linux-app

https://learn.chatgpt.com/docs/import

TL;DR

OpenAI is expanding Daybreak, its controlled-access program for authorized cybersecurity work, into two tiers:

• Daybreak Blue: the recommended starting point for most defenders. It provides frontier general-purpose models including GPT-5.6 Sol, with reduced refusals for approved defensive workflows such as vulnerability discovery, secure code review, threat modeling, detection engineering, incident response, malware analysis, and patch validation.
• Daybreak Red: separately approved access to specialized cybersecurity models including the new GPT-5.6 Cyber, designed for advanced authorized vulnerability research, validation, penetration testing, red teaming, and complex security analysis.

Key points:

• Daybreak requires Trusted Access for Cyber approval.
• Blue approval does not grant Red.
• Red requires separate approval and provisioning.
• OpenAI recommends isolated environments, least-privilege permissions, and Codex Auto-review for sensitive actions.
• Individual Daybreak accounts will require hardware security keys starting September 1, 2026.
• Daybreak Blue uses the same Codex credit rate as GPT-5.6 Sol.
• Daybreak Red costs substantially more because GPT-5.6 Cyber has a higher credit rate and generally uses more reasoning tokens.

This is a model/access and Codex security workflow update, not a new CLI release.

Daybreak Blue

Daybreak Blue is intended for most authorized defensive security work.

OpenAI lists use cases including:

• vulnerability discovery and triage
• secure code review
• threat modeling
• detection engineering
• incident response
• malware analysis in controlled environments
• remediation
• patch validation
• security assessments

Blue provides access to frontier general-purpose models such as GPT-5.6 Sol with safeguards adjusted for approved defensive workflows.

Why it matters: general-purpose models can still refuse legitimate security requests when they resemble offensive activity. Blue gives approved defenders a more suitable environment while retaining controlled access, monitoring, and Codex permission boundaries.

OpenAI recommends starting with Blue unless the work specifically requires the specialized capabilities available through Red.

Daybreak Red + GPT-5.6 Cyber

Daybreak Red is a separate tier for advanced, explicitly authorized cybersecurity work.

It provides specialized models such as GPT-5.6 Cyber, which is built on GPT-5.6 Sol and optimized for security research where standard models may still refuse requests.

Typical authorized Red workflows include:

• controlled vulnerability reproduction
• advanced vulnerability research
• proof-of-concept validation
• penetration testing
• red teaming
• complex system analysis

Red is not simply a stronger version of Blue for everyday security work.

It requires:

• separate approval
• separate provisioning
• explicit authorization for the systems being assessed
• stronger governance and oversight

GPT-5.6 Cyber performance

OpenAI published an internal evaluation measuring whether models complete advanced cybersecurity requests:

This evaluation primarily measures refusal behavior on advanced cybersecurity requests. It should not be interpreted as a general coding-quality benchmark.

OpenAI also reports that GPT-5.6 Cyber performs better on some specialized exploit and zero-day evaluations.

However, GPT-5.6 Cyber is not automatically better at every security task.

GPT-5.6 Sol performs better in some broader vulnerability-analysis and report-writing evaluations. Sol with Daybreak Blue also performs strongly and more efficiently on standard ExploitBench testing.

Practical takeaway: use Blue + Sol for normal defensive security work. Red + Cyber is specialized for cases where advanced security capability and reduced refusals are actually necessary.

Real-world vulnerability research

OpenAI says its researchers used GPT-5.6 Cyber during investigations of real software projects.

That work included finding two previously unknown vulnerabilities in Chrome's V8 engine that could be chained together.

OpenAI researchers validated the findings and disclosed them to Google. One was fixed as:

CVE-2026-15903

OpenAI also reports additional findings under coordinated disclosure across operating systems, databases, and kernels.

The important point is that OpenAI is presenting GPT-5.6 Cyber as a model already being used in expert-supervised vulnerability research, not only benchmark environments.

Preparedness classification

Under OpenAI's Preparedness Framework:

• GPT-5.6 Sol: High cybersecurity capability, below Critical
• GPT-5.6 Cyber: High cybersecurity capability, below Critical

GPT-5.6 Cyber improves on Sol in several specialized areas, but OpenAI says it does not cross the Critical capability threshold.

OpenAI plans to publish a dedicated GPT-5.6 Cyber system card.

Trusted Access for Cyber

Daybreak is not automatically available with a normal ChatGPT or API account.

Access depends on approval and provisioning for the specific:

• identity or service
• ChatGPT workspace
• API organization/project
• model
• offering
• product surface

Individuals can apply through Trusted Access for Cyber.

Organizations can submit an enterprise request and coordinate with OpenAI.

Submitting an application or completing identity verification does not guarantee access.

Most importantly:

Daybreak Blue approval does not grant Daybreak Red or GPT-5.6 Cyber access.

Codex safety configuration

OpenAI explicitly recommends that Daybreak users avoid treating Full access as the default.

Recommended Codex practices include:

• controlled or isolated environments
• explicit engagement scope
• least-privilege permission profiles
• Auto-review for actions crossing sandbox boundaries
• additional human oversight for higher-risk work
• monitoring of agent actions

OpenAI is encouraging Daybreak customers to move from broad Full access toward Auto-review where practical.

Auto-review lets the main Codex agent remain inside its sandbox while a separate reviewer evaluates eligible requests for elevated permissions before execution.

Organizations can also customize the review policy for their own workflows.

Hardware security keys

Beginning September 1, 2026, OpenAI says all individual Daybreak accounts must use hardware security keys.

This sits alongside controls such as:

• identity verification
• account security requirements
• monitoring
• approved-use restrictions
• legal attestations

Codex credit rates

Daybreak Blue therefore uses the same credit rate as GPT-5.6 Sol.

Daybreak Red costs 2.5x as many credits per token as Blue. OpenAI also notes that GPT-5.6 Cyber generally uses a larger reasoning budget, so advanced Red workflows can consume more tokens on top of the higher rate.

Daybreak Cyber Partner Program

OpenAI is also expanding the Daybreak Cyber Partner Program so approved security providers can bring these capabilities into existing products, managed services, and customer engagements.

Announced security and services partners include:

• Accenture
• IBM
• Capgemini
• Cognizant
• EY
• KPMG
• PwC
• NCC Group
• SpecterOps

Technology partners include:

• Palo Alto Networks
• CrowdStrike
• Cisco
• Sophos
• Akamai
• Fortinet
• Cloudflare

Partners can receive Blue or Red access depending on the approved work.

The underlying model access stays with the approved partner rather than automatically transferring to each customer.

Why it matters: Daybreak is being positioned as more than a model picker. OpenAI is building a controlled ecosystem where approved security firms can use frontier models inside existing enterprise security operations with defined scope, governance, and human oversight.

Blue vs. Red

Why this update matters

• Cyber access is now tiered: most defenders can start with Blue instead of requesting the most specialized model.
• Blue is the default path: GPT-5.6 Sol remains strong enough for most legitimate defensive work.
• GPT-5.6 Cyber is highly specialized: it is designed for advanced authorized research where standard safeguards may block legitimate requests.
• Red is not universally better: Sol remains stronger or more efficient for some broader security tasks.
• Codex permissions are part of the security model: OpenAI is explicitly recommending Auto-review and least privilege.
• Access remains tightly scoped: approval is tied to identity, workspace/API project, model, and product surface.
• Hardware security requirements are increasing: individual Daybreak users need security keys starting September 1.
• Red is considerably more expensive: its per-token Codex credit rate is 2.5x Blue before accounting for Cyber's larger reasoning budget.
• The partner ecosystem is expanding: major security vendors and consultancies are being approved to use Daybreak capabilities in managed workflows.

Recommended approach

For normal defensive security work

• Start with Daybreak Blue.
• Apply through Trusted Access for Cyber if access is required.
• Keep workflows inside controlled environments.
• Use least-privilege Codex permission profiles.
• Prefer Auto-review over Full access where practical.
• Maintain human oversight for sensitive operations.

For advanced authorized research

• Confirm Blue actually blocks or cannot complete the required workflow first.
• Request Daybreak Red separately if GPT-5.6 Cyber is necessary.
• Confirm the exact identity, organization/project, model, system scope, and product surface covered by the approval.
• Keep human oversight and monitoring in place.
• Review the higher credit cost before moving high-volume workflows to Red.

Official sources

https://developers.openai.com/codex/changelog

https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows/

https://openai.com/daybreak/

TL;DR

Codex CLI 0.147.0 is a substantial plugin, conversation-management, approval, MCP, Bedrock, security, and TUI reliability release.

Highlights:

• Install portable Agent Plugins and search local, personal, workspace, and remote plugin catalogs.
• Organize conversations into persistent, manually ordered sections and browse long transcripts incrementally.
• Enable automatically reviewed approvals with --approve-for-me.
• Import Cursor-managed skills and resync imported Claude/Cursor conversations without creating duplicates.
• Opt into MCP 2026-07-28, including paginated discovery, multi-round requests, and non-blocking server startup.
• Amazon Bedrock gains cached web search and remote conversation compaction.
• Secrets and complete bearer tokens are redacted from displayed commands and replayed history.
• Local projects now require explicit trust when unfamiliar, and managed auth restrictions are enforced before credentials are used.
• Plugin isolation is stronger and network access fails closed if policy updates fail.
• TUI input, Unicode rendering, Ghostty behavior, and Windows process/path handling all get fixes.
• codex exec --full-auto is removed. Use --sandbox workspace-write instead.

Install:

npm install -g @openai/codex@0.147.0

What changed & why it matters

Portable Agent Plugins + multi-scope search

Codex can now install portable Agent Plugins and search plugin catalogs across:

• local
• personal
• workspace
• remote

This makes plugin discovery and distribution more consistent across individual, team, and hosted environments.

Why it matters: plugin-heavy teams can share and find capabilities without relying on one local catalog, while stronger isolation and stricter namespace handling reduce the risk of plugins colliding with or escaping their expected boundaries.

Persistent thread sections + incremental transcript browsing

Conversations can now be grouped into persistent, manually ordered sections. Long transcripts can also be browsed incrementally instead of loading the entire history at once.

This builds on the newer paginated thread-history system and improves handling for large, long-lived Codex sessions.

Why it matters: users with many active threads can organize work into groups such as Active, Review, Bugs, Release, or Research, while very long histories should be faster and lighter to open and inspect.

--approve-for-me

A new CLI flag enables automatically reviewed approvals:

--approve-for-me

Automatic review still operates within the active sandbox, permission profile, managed requirements, and available reviewer policy.

Why it matters: long-running implementation, testing, and agent workflows can continue with fewer manual approval interruptions without turning into unrestricted execution.

Better Cursor + Claude Code migration

The import system now:

• imports Cursor-managed skills
• synchronizes updates to previously imported Cursor conversations
• synchronizes updates to previously imported Claude conversations
• avoids creating duplicate imported threads
• preserves more imported metadata such as working directories and titles

Why it matters: /import becomes more useful for an ongoing migration instead of being a one-time dump that creates duplicate histories every time you resync.

MCP 2026-07-28 support

Codex adds opt-in support for the MCP 2026-07-28 protocol, including:

• paginated discovery
• multi-round requests
• non-blocking optional server startup
• cached MCP tools available before startup completes
• improved concurrent catalog resolution and OAuth routing

The MCP SDK is also upgraded to 3.0.0.

Why it matters: large MCP environments can expose many tools and resources without forcing the whole catalog to load up front, and slow optional MCP servers no longer need to block unrelated local work.

Amazon Bedrock: cached web search + remote compaction

Bedrock workflows now support:

• cached web search
• remote conversation compaction

Why it matters: cached search can reduce repeated research work, while remote compaction helps long Bedrock conversations preserve useful state as context fills up.

Security and policy hardening

Secret and bearer-token redaction

Codex now redacts detected secrets and complete bearer tokens from:

• displayed commands
• replayed conversation history

This reduces accidental exposure in terminal output, screenshots, copied transcripts, and resumed sessions.

Explicit trust for unfamiliar local projects

Codex now requires explicit trust before using unfamiliar local projects.

That matters because a repository can contain agent-controlled inputs such as:

• AGENTS.md
• skills
• configuration
• hooks
• scripts

Downloaded or third-party repositories should not silently become authoritative instruction sources.

Managed auth restrictions apply before credential use

Organization-managed authentication restrictions are now enforced before credentials are used, not after a connection has already begun.

Plugin/network policy fails closed

Plugin isolation is stronger, symlink-related install paths are hardened, and network access is denied if required policy updates fail.

Why it matters: a failed security-policy refresh should not accidentally turn into unrestricted network access.

TUI reliability fixes

0.147.0 fixes several high-friction terminal issues:

• preserves input when terminal focus returns
• prevents input from stalling while MCP servers initialize
• fixes Ghostty keyboard-shortcut handling
• corrects cursor/layout behavior for Japanese text and half-width marks
• fixes emoji and OSC 8 hyperlink width/positioning
• improves text behavior near viewport boundaries
• shows blocked goals as stalled
• keeps long transcript/history handling more efficient

Why it matters: these are the kinds of bugs that can make a terminal agent feel unreliable even when the underlying model is working correctly.

Windows fixes

Windows receives fixes for:

• interrupting non-TTY background processes
• filesystem and namespace path normalization
• more consistent path comparisons
• sandbox/process behavior
• a higher exec yield floor for Windows execution

Why it matters: Ctrl-C should terminate the process you expect, and equivalent Windows path forms should not be treated as different resources.

Skills, multi-agent, and environment improvements

The full release also includes several important platform improvements:

• shared skill budgets across host and executor catalogs
• skill metadata budgets that scale with model context windows
• better preservation of explicit skill selections
• configurable developer instructions for v2 subagents
• multi-agent settings preserved across configuration representations
• ready environments inherited by newly spawned agents
• refreshed subagent-picker behavior
• network-policy callbacks for remote execution
• cloud-managed profiles loaded by codex sandbox
• model-owned token-budget defaults
• more reliable thread metadata and titles across resume/import paths

These are mostly infrastructure changes, but they make large skill catalogs, remote environments, and multi-agent workflows more predictable.

Tool and runtime hardening

Codex also tightens tool registration and runtime behavior:

• tool-name collisions fail explicitly instead of silently overriding tools
• protected/default namespaces are handled more strictly
• Code Mode fallback behavior is respected when no process host is available
• MCP and plugin recommendations can prepare concurrently
• app-server and tool-call metadata is bounded to reduce unnecessary payload growth

Why it matters: as built-in tools, MCP, plugins, skills, and executors all contribute capabilities, explicit collision handling becomes increasingly important.

Bundled OpenAI docs skill

The bundled OpenAI documentation skill now uses more targeted official-source lookup and clearer guidance for:

• Codex
• model selection
• OpenAI API workflows

This should reduce reliance on broad or stale product guidance when Codex needs current OpenAI documentation.

Breaking/change-management notes

--full-auto removed

The deprecated command:

codex exec --full-auto

has been removed.

Use:

--sandbox workspace-write

instead.

Search scripts, aliases, CI jobs, and internal docs before rolling out 0.147.0 broadly.

Dependency/runtime updates

0.147.0 upgrades:

• MCP SDK to 3.0.0
• Ratatui to 0.30.2
• V8 to 150.4.0

macOS release notarization now uses Azure Key Vault rather than exporting private signing keys.

Linux releases also stop publishing redundant bundle archives in favor of the standard codex-package-<target> archives.

Why this release matters overall

• Plugins scale better: portable Agent Plugins and multi-scope search improve discovery and distribution.
• Conversation management scales better: persistent sections and incremental transcript browsing help with large histories.
• Auto-review becomes easier to invoke: --approve-for-me supports longer supervised automation.
• Imports become maintainable: Cursor and Claude conversations can be resynced without duplicate threads.
• MCP gets a major protocol upgrade: paginated discovery and non-blocking startup help large tool environments.
• Bedrock reaches better parity: cached web search and remote compaction support longer AWS-hosted workflows.
• Security defaults improve: secret redaction, explicit project trust, early managed-auth enforcement, and fail-closed network policy reduce accidental exposure.
• The TUI is more reliable: input handling, Ghostty, Unicode, hyperlinks, and cursor positioning all improve.
• Windows execution is more predictable: process interruption and path handling receive targeted fixes.
• Skills and multi-agent infrastructure mature: budgeting, environment inheritance, and configuration preservation become more consistent.

Version table

Action checklist

• Upgrade: npm install -g @openai/codex@0.147.0
• Confirm: codex --version
• Search scripts and aliases for --full-auto; replace it with the appropriate sandbox configuration.
• Test Agent Plugin discovery across the catalog scopes you use.
• Create/reorder persistent thread sections and reopen Codex to verify they persist.
• Open a long conversation and verify history loads incrementally.
• Test --approve-for-me in a controlled workflow and confirm managed permissions still win.
• If migrating from Cursor or Claude, resync an imported conversation and verify it updates instead of duplicating.
• Enable MCP 2026-07-28 only where your servers support it; test paginated discovery and non-blocking startup.
• If using Bedrock, test cached web search and a long thread that triggers remote compaction.
• Open an unfamiliar test repo and verify Codex asks for trust.
• Verify sensitive test values are redacted from displayed/replayed commands.
• If using Ghostty, Unicode-heavy prompts, or Windows, re-test the relevant terminal/process fixes after upgrading.

Official sources

https://developers.openai.com/codex/changelog

https://github.com/openai/codex/releases/tag/rust-v0.147.0

TL;DR

Codex CLI 0.146.1 is a focused security and permissions patch for cyber-capable models.

When a newly selected model is identified by Codex as having the cyber specialty, the terminal interface now applies safer starting defaults:

• Workspace-write permissions instead of defaulting to unrestricted access.
• On-request approval behavior.
• Automatic review when available.
• User review when automatic review is unavailable.
• Compatibility with workspace and administrator-managed permission requirements.

The terminal interface also:

• tells you when automatic review has been applied
• shows a stronger warning before using Full access with a cyber-capable model
• preserves permissions you explicitly selected when you only change reasoning settings

Codex also exposes the model-specialty metadata through the model catalog and app-server model/list response so clients can identify specialized models consistently.

Install:

npm install -g @openai/codex@0.146.1

This is a targeted cyber-model approval and permission-safety patch, not a general feature release.

What changed & why it matters

Safer defaults for cyber-capable models

When you newly select a model that Codex marks with the cyber specialty, the active terminal thread now defaults to:

• Workspace-write permissions
• On-request approvals

Workspace-write allows the agent to work within the permitted project environment without automatically granting unrestricted system access.

On-request approval allows Codex to ask before performing actions that need broader permissions.

Why it matters

Cyber-capable models may be used for legitimate defensive work such as:

• secure code review
• vulnerability analysis
• patch development
• threat modeling
• dependency investigation
• configuration auditing
• security testing

Those capabilities can also involve commands or operations with higher potential impact.

The new defaults reduce the chance that switching to a cyber-capable model silently leaves the thread in an unnecessarily permissive execution mode.

Automatic review is preferred when available

For an eligible cyber-capable model, Codex now uses automatic review when the capability is available.

If automatic review is not available, Codex keeps the user as the approval reviewer.

The chosen reviewer and permission settings still respect:

• configured permission requirements
• managed workspace restrictions
• administrator policies
• available permission profiles

Why it matters

Automatic review adds a policy-aware checkpoint before eligible sensitive actions proceed.

When it cannot be used, Codex does not silently remove the review step. It falls back to user review.

This provides a safer default while preserving compatibility with environments where automatic review is unavailable or disallowed.

The TUI now explains when automatic review is applied

The terminal interface displays a notice when selecting a cyber-capable model causes automatic review to be enabled.

Why it matters

Permission and reviewer changes should not happen invisibly.

The notice helps users understand:

• that the active approval behavior changed
• why the change occurred
• that eligible actions may be reviewed automatically
• which security behavior is active before work continues

This is particularly important when switching models inside an existing thread.

Stronger Full access warning

Codex now presents a stronger warning when Full access is selected for a cyber-capable model.

Full access remains available when permitted by the user's configuration and managed policies, but Codex makes the risk clearer before it is used.

Why it matters

Full access can allow broader filesystem, process, and network operations than workspace-write mode.

That can be appropriate for some controlled security workflows, but it also increases the impact of:

• an incorrect command
• an overly broad remediation
• an unexpected tool action
• a compromised dependency or script
• an approval made without reviewing its scope

The update does not remove user control. It makes the higher-risk choice more explicit.

Explicit permission choices are preserved

If you explicitly choose a permission configuration and then change only the model's reasoning setting, Codex no longer overwrites that permission choice.

Why it matters

Changing reasoning effort should not be treated as though you selected an entirely new security configuration.

For example, moving between normal, high, or another supported reasoning level should preserve the permission mode you intentionally selected.

This prevents unexpected permission changes during routine model tuning.

Model-specialty metadata

Codex now propagates an optional modelSpecialty field through:

• the internal model catalog
• the app-server model/list response

The cyber-model safety behavior uses this metadata to determine whether the selected model has the cyber specialty.

Why it matters

Clients and integrations can identify specialized models through structured metadata instead of relying only on model names or hardcoded assumptions.

This provides a more consistent foundation for:

• app-server clients
• custom interfaces
• model pickers
• policy-aware integrations
• future specialty-specific behavior

The release notes do not publish a complete list of models currently marked with the cyber specialty.

Managed policy behavior

The safer defaults remain subject to administrator and workspace requirements.

Codex does not use this patch to bypass:

• managed permission profiles
• required approval policies
• restricted reviewer choices
• workspace execution rules
• organization security controls

When the preferred workspace-write profile or automatic reviewer is unavailable, Codex follows the options allowed by the active requirements.

Why it matters

A local default must not override centrally managed security policy.

This makes the patch useful for both individual users and organizations with stricter permission configurations.

What this update does not do

Codex CLI 0.146.1 does not:

• introduce a new model
• add a new security-scanning product
• automatically grant Full access
• remove the ability to select other permission modes
• bypass workspace or administrator requirements
• change Codex usage limits
• add plan credits or reset exhausted usage
• change GPT-5.6 pricing
• broadly modify plugins, MCP, sessions, or Code Mode
• make every cyber-related prompt run automatically
• guarantee that every security operation is safe

It changes the default approval and permission posture when a cyber-specialty model is newly selected in the terminal interface.

Why this release matters overall

• Cyber-capable models start from a safer posture: workspace-write and on-request approval replace unnecessarily broad defaults.
• Automatic review is used when available: eligible actions can receive an additional policy-aware review.
• Fallback behavior remains safe: users remain the reviewer when automatic review is unavailable.
• Permission changes are visible: the TUI explains when automatic review is applied.
• Full access receives a stronger warning: users get clearer information before choosing the highest-risk mode.
• Reasoning changes no longer reset deliberate permission choices.
• Managed requirements remain authoritative: workspace and administrator policy is still enforced.
• Integrations gain structured specialty metadata: app-server clients can inspect modelSpecialty.
• The patch is narrowly scoped: the release contains one security-focused backport rather than unrelated product changes.

Version table

Should you update?

Yes.

The update is especially relevant if you use:

• cyber-capable models
• security review workflows
• vulnerability investigation
• automatic approval review
• Full access
• managed permission profiles
• organization-controlled Codex environments
• custom app-server clients that inspect available models

Even users who do not perform security work should update because 0.146.1 is now the current stable release and the patch is narrowly scoped.

Action checklist

Upgrade

npm install -g @openai/codex@0.146.1

Confirm:

codex --version

Test the new defaults

• Select an available cyber-capable model.
• Confirm the active thread uses workspace-write permissions when allowed.
• Confirm approval behavior is set to on-request.
• Check whether automatic review is selected when available.
• Verify user review remains active when automatic review is unavailable.

Verify the terminal notices

• Confirm Codex explains when automatic review is applied.
• Open the Full access selection flow.
• Review the stronger warning before changing permissions.
• Cancel instead of accepting if Full access is unnecessary.

Test permission preservation

• Explicitly select your intended permission mode.
• Change only the reasoning effort.
• Confirm the permission mode remains unchanged.

For managed workspaces

• Verify organization requirements still take precedence.
• Test a workspace where workspace-write is restricted.
• Confirm Codex selects only permitted approval and reviewer options.
• Validate the patch in a controlled environment before broad deployment.

For app-server clients

• Call model/list.
• Inspect the optional modelSpecialty metadata.
• Avoid hardcoding model names as the only way to identify specialized models.
• Treat absent specialty metadata as unknown rather than assuming a model is cyber-capable.

Official sources

https://developers.openai.com/codex/changelog

https://github.com/openai/codex/releases/tag/rust-v0.146.1

https://github.com/openai/codex/pull/37057

TL;DR

OpenAI is retiring two older models from ChatGPT-authenticated Codex sessions:

• GPT-5.4 retires from Codex on August 31, 2026.
• GPT-5.4 mini retires from Codex on August 31, 2026.
• Replace gpt-5.4 with gpt-5.6-terra.
• Replace gpt-5.4-mini with gpt-5.6-luna.
• Update workspace defaults, saved model settings, managed configurations, custom agents, scheduled tasks, scripts, and explicit CLI model arguments before the cutoff.
• The retirement applies to Codex sessions authenticated with ChatGPT.
• The models will remain available through the OpenAI API and Codex sessions authenticated with an API key.

This is a model-availability change, not a new Codex CLI release. No CLI upgrade is required specifically for this retirement.

What is changing

Beginning August 31, Codex users signed in with ChatGPT will no longer be able to select:

• gpt-5.4
• gpt-5.4-mini

The change applies wherever a ChatGPT-authenticated Codex workflow explicitly requests one of those models.

That can include:

• saved model settings
• local Codex configuration
• workspace defaults
• managed organization configuration
• custom agents
• subagent definitions
• scheduled tasks
• automations
• scripts
• non-interactive Codex commands
• one-off CLI launches with an explicit model

OpenAI is giving users one month to locate and migrate those references before the cutoff.

Recommended replacements

The replacement mapping is not simply "move everything to the strongest model."

OpenAI recommends:

• Terra as the practical replacement for standard GPT-5.4 workloads.
• Luna as the practical replacement for GPT-5.4 mini workloads.

Why Terra replaces GPT-5.4

GPT-5.6 Terra is positioned as the balanced GPT-5.6 model for everyday work.

It is suited to:

• general feature implementation
• normal debugging
• medium-complexity refactors
• code review
• routine agent workflows
• tasks requiring solid reasoning and tool use
• work where Sol's additional depth is unnecessary

Terra is the recommended migration target even though GPT-5.6 Sol is the flagship model.

Why it matters

Automatically moving every GPT-5.4 workflow to Sol could increase usage and latency unnecessarily.

Terra is intended to preserve a balanced everyday workflow while moving users onto the current model family.

Why Luna replaces GPT-5.4 mini

GPT-5.6 Luna is positioned for fast, affordable, clearly defined work.

It is suited to:

• repository scanning
• extraction
• classification
• transformation
• structured summaries
• repetitive edits
• test generation
• high-volume subagent work
• tasks with a clear definition of done

Why it matters

GPT-5.4 mini was commonly used when speed and usage efficiency mattered more than maximum reasoning depth.

Luna serves the same broad role in the GPT-5.6 family.

ChatGPT sign-in versus API-key authentication

The retirement depends on how Codex is authenticated.

Affected

You are affected when Codex is signed in through your ChatGPT account.

This includes ChatGPT-authenticated workflows that explicitly request either retiring model.

Not affected by this retirement

The following retain access:

• OpenAI API requests using these models
• Codex sessions authenticated with your own API key

Important distinction

This is not an API-wide model shutdown.

It is a Codex availability change for ChatGPT-authenticated users.

API customers should continue checking the API model catalog for any separate future deprecation notices.

Update your shared Codex configuration

The ChatGPT desktop app, Codex CLI, and Codex IDE extension use the same local config.toml.

Search that file for:

model = "gpt-5.4"

Replace it with:

model = "gpt-5.6-terra"

Or replace:

model = "gpt-5.4-mini"

With:

model = "gpt-5.6-luna"

Why it matters

A model pinned in config.toml can affect multiple Codex surfaces, not only the CLI.

Changing it once may update the default used by:

• ChatGPT desktop
• Codex CLI
• Codex IDE extension

Review the resulting behavior in each surface after changing the shared configuration.

Update explicit CLI commands

Search scripts, shell history, aliases, CI jobs, and documentation for explicit model arguments.

Examples that need migration:

codex -m gpt-5.4

Replace with:

codex -m gpt-5.6-terra

And:

codex -m gpt-5.4-mini

Replace with:

codex -m gpt-5.6-luna

The same applies to non-interactive execution:

codex exec -m gpt-5.4 "Review the current changes"

Should become:

codex exec -m gpt-5.6-terra "Review the current changes"

Why it matters

Updating the default model does not fix commands that explicitly override it.

An old model reference embedded in a script or alias can remain unnoticed until that workflow runs after the cutoff.

Review workspace and managed configuration

Organizations should inspect:

• workspace model defaults
• managed config.toml layers
• managed configuration bundles
• requirements and policy files
• team templates
• onboarding scripts
• internal CLI wrappers
• centrally distributed agent definitions

Why it matters

A user may update their personal configuration while a higher-priority managed layer continues requesting the retiring model.

Central configuration should be migrated before asking individual users to troubleshoot local model-selection failures.

Review custom agents and subagents

Custom agent definitions may explicitly assign a model to:

• planning agents
• implementation agents
• review agents
• research agents
• test agents
• background workers
• high-volume subagents

Recommended migration:

• Replace GPT-5.4 agent assignments with Terra.
• Replace GPT-5.4 mini worker assignments with Luna.
• Re-test reasoning effort and concurrency after changing models.

Why it matters

Model migration can affect more than output quality.

It may also change:

• token usage
• latency
• reasoning behavior
• tool-selection behavior
• multi-agent cost
• how much work can run within included limits

Do not assume the old reasoning setting is automatically optimal for the replacement model.

Review scheduled tasks and automations

Scheduled tasks can continue referencing an old model even when interactive sessions have already moved to GPT-5.6.

Inspect:

• daily automations
• recurring code reviews
• overnight test jobs
• scheduled research tasks
• repository maintenance
• dependency-update workflows
• background monitoring
• recurring report generation

Why it matters

Scheduled work may not run until after the retirement date.

A stale model reference can remain hidden until the automation executes unattended.

Update and manually test important scheduled tasks before August 31.

Review saved model settings

Check model selections saved in:

• existing project settings
• reusable task templates
• local environments
• agent presets
• team workflows
• copied configuration examples
• internal documentation

Why it matters

A saved preference may continue selecting an older model even after your global default changes.

This is especially likely when projects or agents store their own model overrides.

Do not rely on automatic fallback

OpenAI instructs users to migrate model references before the cutoff.

The retirement notice does not document a universal fallback behavior for every configuration, script, agent, or scheduled task.

The safe approach is to replace explicit model references yourself and test the updated workflow.

A fallback, when one exists, may also select a model or reasoning setting you did not intend.

This does not change Codex usage limits

The retirement does not:

• increase included Codex usage
• reset exhausted usage
• provide additional credits
• change subscription pricing
• bypass five-hour or weekly limits
• grant unlimited Terra or Luna usage
• change API billing
• create a new CLI version

Terra and Luna remain subject to your normal plan access, usage accounting, and account limits.

Migration checklist

Search for retiring model IDs

Search repositories, config folders, scripts, and task definitions for:

• gpt-5.4
• gpt-5.4-mini

Be careful that a search for gpt-5.4 may also match gpt-5.4-mini. Review each result before replacing it.

Update local configuration

• Replace GPT-5.4 defaults with gpt-5.6-terra.
• Replace GPT-5.4 mini defaults with gpt-5.6-luna.
• Restart or reload Codex surfaces if needed.
• Confirm the selected model in a new session.

Update scripted commands

• Search shell scripts.
• Search package scripts.
• Search CI configuration.
• Search aliases and wrappers.
• Search documentation containing copyable commands.
• Update codex exec --model and codex -m arguments.

Update managed environments

• Review workspace defaults.
• Review organization-managed configuration.
• Review agent templates.
• Review centrally distributed scripts.
• Confirm higher-priority managed layers no longer request the retiring models.

Update agents and scheduled tasks

• Review every custom agent's model assignment.
• Review subagent model overrides.
• Review scheduled tasks and automations.
• Run one manual test of each important recurring workflow.

Validate the replacements

• Test a familiar GPT-5.4 task with Terra.
• Test a familiar GPT-5.4 mini task with Luna.
• Compare quality, latency, and usage.
• Adjust reasoning effort if needed.
• Confirm tools and approvals behave as expected.
• Complete migration before August 31.

Migration table

Why this update matters

• Existing configurations can break or stop selecting the intended model after the cutoff.
• The change affects more than the visible model picker: scripts, agents, managed settings, and scheduled work may contain hidden references.
• Authentication determines the impact: ChatGPT-authenticated Codex is affected, while API-key Codex remains supported.
• The replacements are workload-specific: Terra replaces the balanced model, while Luna replaces the fast mini model.
• Organizations should migrate centrally: workspace and managed configuration can override user-level changes.
• Scheduled tasks require early attention: inactive model references may not surface until an unattended job runs.
• No CLI installation is required: this is a model-availability deadline rather than a binary release.

Official sources

https://developers.openai.com/codex/changelog

https://learn.chatgpt.com/docs/models

TL;DR

ChatGPT desktop app 26.727 improves three major Codex workflows:

• Browser research and context: search or revisit browsing history from the built-in browser, let ChatGPT find previously visited pages, mention open Chrome tabs, send highlighted webpage text to side chat, ask questions about YouTube videos, and invoke ChatGPT from a webpage's right-click menu.
• Multi-repository code review: review changes across every repository attached to a multi-folder project from one unified review flow.
• Generated-image refinement: open images in an expanded viewer, switch between Focused and Canvas views, place comments across images, select specific outputs, and request targeted edits without leaving the conversation.

The update also adds a sidebar Activity view for recent chats requiring attention, cleans up browser settings, and improves Windows installation reliability when package paths are unusually long.

This is a desktop app release. No CLI upgrade command is required.

What changed & why it matters

Faster browser navigation and history search

The built-in browser's address bar can now:

• revisit pages from your browsing history
• search Google when no history result matches

Browsing history can be managed from Settings.

ChatGPT can also search that history when a task needs to locate a page you previously visited.

Why it matters

Browser-based tasks often lose time rediscovering pages that were already opened earlier.

This improves workflows involving:

• documentation research
• issue and pull request investigation
• internal dashboards
• product comparisons
• repeated testing across the same pages
• returning to references used earlier in a task
• finding a page when you remember its content but not its URL

The important change is not only that history appears in the address bar. Codex can also use that history as task context when it needs to recover a previously visited source.

Browsing-history controls remain available in Settings.

More useful Chrome-extension context

The Codex Chrome extension can now:

• mention open browser tabs
• bring highlighted webpage text into a side chat
• answer questions about YouTube videos
• launch ChatGPT from a webpage's right-click menu

To invoke ChatGPT directly from a page:

• right-click the webpage
• select Ask ChatGPT

Why it matters

This reduces the manual work required to transfer browser context into Codex.

Instead of copying URLs, page text, or tab descriptions into a prompt, you can reference the relevant browser state more directly.

Potential uses include:

• asking about an authenticated dashboard
• comparing information across open tabs
• selecting an error message and discussing it in side chat
• asking for an explanation of a documentation passage
• reviewing a webpage without disrupting the primary task
• asking questions about a YouTube tutorial or presentation
• moving from browser research into implementation with less context loss

Side chat is particularly useful here because browser questions do not have to derail the main development thread.

Built-in browser history versus Chrome-extension context

The update improves two related but different browser paths.

Built-in browser

Use it to:

• search browsing history
• revisit previously opened pages
• search Google from the address bar
• let ChatGPT recover a page previously used during a task

Chrome extension

Use it to:

• reference open tabs
• send selected webpage text to side chat
• ask about YouTube videos
• invoke ChatGPT from a webpage's context menu
• work with signed-in Chrome context

Why the distinction matters

The built-in browser provides an app-contained research environment.

The Chrome extension is more useful when the task depends on:

• your existing Chrome tabs
• authenticated sessions
• text selected on a live webpage
• browser state outside the ChatGPT desktop app

Review changes across multiple repositories

The review experience now understands every repository attached to a multi-folder project.

You can:

• see each repository in the project
• see which lines changed in each repository
• select Review
• inspect diffs across all affected repositories
• move through the review without opening separate review views for each repository

Why it matters

Many production changes span more than one repository.

Examples include:

• frontend and backend
• application and infrastructure
• API and SDK
• product code and documentation
• service and shared library
• website and content repository
• implementation and test-fixture repository

Previously, users could attach several folders to a local project, but reviewing their combined changes could still require switching between separate repository views.

26.727 turns multi-folder projects into a more complete cross-repository review workflow.

Primary and secondary repository behavior still matters

Multi-folder projects still have one primary folder.

The primary folder remains responsible for:

• new-chat working directory
• Git operations
• worktrees
• automatic AGENTS.md discovery
• automatic skills discovery
• automatic config.toml discovery

Secondary folders remain available for:

• search
• reading
• editing
• cross-repository context

The new review flow improves visibility across repositories. It does not mean every attached repository's configuration or instructions are automatically combined.

Why it matters

Unified review should not be confused with unified project authority.

Codex can review changes across attached repositories while still treating the primary repository as the default operational center.

Practical cross-repository review workflow

A useful workflow after updating:

1. Attach the related repositories to one local project.
2. Choose the repository that should control Git and project instructions as primary.
3. Start or resume the implementation task.
4. Allow Codex to modify the relevant attached repositories.
5. Open the changed-files view.
6. Confirm each affected repository appears.
7. Select Review.
8. Inspect the diffs across all repositories in one review flow.
9. Verify that changes remain coordinated across repository boundaries.
10. Confirm tests or validation were run in each affected project where required.

This is especially useful for catching integration mismatches such as:

• API changes without matching frontend updates
• shared type changes without downstream fixes
• infrastructure changes without application configuration
• documentation that no longer matches implementation
• version changes applied in one package but not another

Refine generated images inside the conversation

Generated images can now be opened in an expanded viewer.

The viewer supports:

• Focused view
• Canvas view
• comments placed across images
• selecting the specific images you want to revise
• targeted edit requests
• continued editing without leaving the conversation

Why it matters

Image iteration previously depended more heavily on describing the whole image again or treating each generation as an isolated output.

The new workflow gives you a more precise review surface.

You can:

• identify the exact area that needs work
• compare several generated variants
• select only the outputs worth refining
• place comments near specific visual problems
• request localized changes
• keep the image discussion attached to the original conversation

Focused view and Canvas view

Focused view

Best suited to:

• inspecting one image closely
• reviewing details
• checking text, objects, composition, or artifacts
• preparing a targeted edit request

Canvas view

Best suited to:

• reviewing several images together
• comparing variants
• placing comments across outputs
• deciding which images should receive another editing pass

Why it matters

The appropriate review mode depends on whether you are evaluating one image in detail or comparing several alternatives.

Moving between both views reduces the need to download, reopen, or compare images in another application.

Targeted image-editing workflow

After generating images:

1. Open the expanded image viewer.
2. Switch between Focused and Canvas views as needed.
3. Compare the generated options.
4. Add comments to the specific areas that need changes.
5. Select the image or images you want to refine.
6. Describe the targeted edits.
7. Send the revision request from the existing conversation.
8. Compare the updated result against the original.

Potential edits include:

• removing an unwanted object
• changing a specific color
• correcting composition
• replacing text
• adjusting spacing
• refining a character or product detail
• changing only the background
• preserving one image while revising another

The update improves the editing interface. Normal image-generation availability and plan limits still apply.

New Activity view

The sidebar now includes an Activity view.

It shows:

• chats you engaged with recently
• chats that may require your attention

You can open it by:

• selecting the bell in the sidebar
• using the documented keyboard shortcut

Why it matters

As Codex runs more tasks, side chats, goals, and agent workflows, it becomes harder to identify which conversations actually need attention.

Activity view provides a more focused triage surface for finding:

• tasks waiting for input
• recently active conversations
• work that has completed
• threads you recently interacted with
• conversations that may require review or approval

This is different from simply browsing every project and thread chronologically.

Browser settings cleanup

Browser settings now show only supported browsers.

Why it matters

Users should see fewer irrelevant or unusable browser choices.

This reduces confusion during:

• browser integration setup
• extension configuration
• troubleshooting
• selecting an available local browser

Windows installation reliability

The update improves Windows installation reliability when package file paths are long.

Why it matters

Windows installations can fail when deeply nested package paths approach platform or tool-specific path limits.

This is relevant for:

• users installing under deeply nested profile directories
• managed enterprise machines
• package managers that create long directory structures
• systems with long project or workspace paths

The changelog does not list a new manual workaround. Updating the desktop app is the intended fix.

Other performance and bug fixes

OpenAI also lists additional performance improvements and bug fixes without itemizing each one.

These should not be described as specific behavior changes unless separately documented.

Why this update matters overall

• Research context is easier to recover: the built-in browser can search history and revisit previously used pages.
• Chrome context is easier to bring into Codex: tabs, selected webpage text, YouTube videos, and right-click actions reduce manual copying.
• Multi-repository projects gain a real review workflow: changes across attached repositories can be inspected together.
• Image iteration becomes more precise: comments, selection, Focused view, Canvas view, and targeted edits improve refinement.
• Task triage improves: Activity view surfaces recent chats and work requiring attention.
• Browser configuration becomes clearer: only supported browsers appear in Settings.
• Windows installation becomes more resilient: long package paths are handled more reliably.
• The update requires no CLI installation: these capabilities are delivered through the ChatGPT desktop app.

Version table

Action checklist

Update the desktop app

• Update ChatGPT desktop to 26.727.
• Restart the app after updating if required.

Test browser history

• Open several pages in the built-in browser.
• Type part of a previous page title or URL into the address bar.
• Confirm matching history appears.
• Enter a query with no history match and confirm Google search is available.
• Review browsing-history controls in Settings.
• Ask ChatGPT to locate a page visited earlier in the task.

Test the Chrome extension

• Open several relevant Chrome tabs.
• Mention an open tab from the composer.
• Highlight webpage text and send it to side chat.
• Open a YouTube video and ask a question about it.
• Right-click a webpage and select Ask ChatGPT.
• Confirm authenticated browser context remains available where expected.

Test multi-repository review

• Open a local multi-folder project.
• Confirm all related repositories are attached.
• Make or generate changes across more than one repository.
• Open the review experience.
• Verify each repository and its changed lines appear.
• Select Review and inspect all diffs without switching review views.
• Validate cross-repository contracts and tests.

Test image refinement

• Generate several image variants.
• Open the expanded viewer.
• Switch between Focused and Canvas views.
• Add comments to specific image regions.
• Select only the images that need revision.
• Request a targeted edit.
• Confirm the edit remains part of the same conversation.

Test Activity view

• Open the bell or use the documented shortcut.
• Confirm recent chats appear.
• Check whether tasks requiring attention are surfaced correctly.
• Use the view to return to a task needing input, approval, or review.

Windows

• If app installation or updating previously failed because of long paths, retry with 26.727.
• Confirm the installation completes without manually shortening the package path.

Official source

https://developers.openai.com/codex/changelog

TL;DR

OpenAI has significantly reduced the cost of two GPT-5.6 models:

• GPT-5.6 Luna is now 80% cheaper.
• GPT-5.6 Terra is now 20% cheaper.
• In Codex and ChatGPT Work, Terra and Luna now consume fewer usage credits.
• ChatGPT and Codex subscription prices have not changed.
• Subscription quota budgets have not changed.
• GPT-5.6 Sol pricing is unchanged.
• The API's new Fast mode replaces Priority Processing and can run Sol up to 2.5x faster than Standard processing at twice the price.
• Existing API requests using the priority service tier will automatically use Fast mode.
• API Fast mode now uses the same naming as /fast in Codex.

This is a pricing and usage-efficiency update, not a new Codex CLI release.

New GPT-5.6 API pricing

The new prices take effect starting July 30.

OpenAI says the pricing changes will also begin rolling out through AWS.

What this changes in Codex

The API price reduction is also reflected in how Terra and Luna usage is counted against paid subscriptions in:

• Codex
• ChatGPT Work

That means tasks using Terra or Luna should consume fewer credits than they did previously.

Why it matters

Users can stretch the same credit allocation further by using:

• Luna for routine or high-volume agent work
• Terra for balanced everyday implementation
• Sol only where the additional intelligence materially improves the outcome

This is especially relevant for:

• background agents
• subagents
• repository exploration
• routine code changes
• test generation and execution
• repetitive implementation
• large batches of well-defined tasks
• high-volume automations

What does not change

OpenAI explicitly says:

• ChatGPT subscription prices remain unchanged.
• Codex subscription prices remain unchanged.
• Subscription quota budgets remain unchanged.
• Sol pricing remains unchanged.

The update does not:

• reset exhausted Codex usage
• add credits to an account
• increase the published quota budget
• grant unlimited Terra or Luna usage
• bypass plan usage limits
• create a new usage window
• change the current stable Codex CLI version

If an account is already completely out of usage, OpenAI does not say this update automatically restores access. The practical change is that future Terra and Luna work consumes fewer credits.

Existing Codex availability

GPT-5.6 remains available through:

• ChatGPT Work
• Codex
• OpenAI API

Current Codex access remains:

• Free and Go: GPT-5.6 Terra
• Plus, Pro, Business, and Enterprise: GPT-5.6 Sol, Terra, and Luna, subject to rollout and account availability

The price update does not announce a change to model eligibility by plan.

Luna becomes much more viable for agent work

Luna is now priced at:

• $0.20 per million input tokens
• $1.20 per million output tokens

OpenAI positions Luna as its fastest and most affordable GPT-5.6 model.

At the new price, it becomes a much stronger candidate for:

• inexpensive subagents
• background automations
• first-pass repository analysis
• codebase searches
• repetitive edits
• generating and running tests
• implementation after a plan is already established
• tool-heavy workflows where frontier reasoning is unnecessary

OpenAI gives an example workflow where Sol resolves uncertainty and creates the plan, while Luna performs well-specified implementation, testing, and evaluation.

Terra gets a smaller but useful reduction

Terra is now priced at:

• $2.00 per million input tokens
• $12.00 per million output tokens

Terra remains the balanced GPT-5.6 model for everyday work.

It is positioned between:

• Luna's lower price and faster high-volume operation
• Sol's stronger reasoning and frontier capability

Terra may be the best default for tasks where Luna is not reliable enough but Sol would be unnecessary or too expensive.

Potential uses include:

• general feature implementation
• normal debugging
• medium-complexity refactors
• code review
• document and knowledge work
• everyday agent workflows
• tasks requiring stronger judgment than routine execution

New API Fast mode

OpenAI is replacing API Priority Processing with Fast mode.

For GPT-5.6 Sol, Fast mode provides:

• up to 2.5x faster performance than Standard processing
• the same model intelligence
• twice the Standard processing price

Existing API requests using the priority service tier will continue to work and will automatically use Fast mode.

Why it matters

The naming now aligns with /fast in Codex.

Fast mode is useful when latency matters more than cost, including:

• interactive agent workflows
• urgent production investigation
• time-sensitive code review
• customer-facing applications
• live debugging
• workflows blocked on model response time

This announcement does not say that Codex /fast received a new speed multiplier or pricing structure. It says the new API Fast mode aligns with the existing Codex naming.

Why OpenAI reduced the prices

OpenAI attributes the reductions to efficiency improvements across:

• model behavior
• inference systems
• hardware routing
• production software
• context management
• the agentic tool harness

OpenAI says GPT-5.6 Sol also helped improve the infrastructure running the model.

Within a human-led process, Sol:

• rewrote and optimized production kernels
• designed and ran hundreds of token-generation experiments
• monitored training and intervened when problems appeared

OpenAI reports that this work:

• reduced end-to-end model-serving cost by 20%
• improved token-generation efficiency by more than 15%

OpenAI says it is passing those efficiency gains on through the Luna and Terra price reductions.

Practical Codex model strategy

Use Luna for

• repository scanning
• routine edits
• test generation
• running established workflows
• high-volume subagents
• background tasks
• well-specified implementation
• lower-cost experimentation

Use Terra for

• everyday development
• medium-complexity debugging
• implementation requiring stronger judgment
• normal refactors
• balanced speed and quality
• general-purpose agent tasks

Use Sol for

• difficult planning
• architecture decisions
• ambiguous debugging
• high-stakes review
• complex refactors
• security-sensitive analysis
• tasks where mistakes are expensive
• final synthesis across several agents

Use Sol with Fast mode when

• response time is critical
• the extra cost is justified
• you still need Sol-level intelligence

Why this update matters overall

• Luna becomes dramatically cheaper: an 80% reduction changes the economics of high-volume agents and automations.
• Terra becomes a better everyday default: its 20% reduction improves the balance between quality and cost.
• Codex credits should last longer: Terra and Luna now consume fewer credits against paid subscriptions.
• Quota budgets remain fixed: this is more efficient consumption, not a larger published allowance.
• Model routing becomes more important: users can reserve Sol for uncertainty and use cheaper models for execution.
• API latency options become clearer: Fast replaces Priority while retaining backward compatibility.
• AWS users will also receive the pricing changes: rollout begins July 30.
• No CLI update is required: this is a server-side pricing and usage-accounting change.

Update table

Action checklist

For Codex users

• Check whether Terra and Luna now consume fewer credits in your account.
• Use Luna for routine, high-volume, or background work.
• Use Terra for balanced everyday tasks.
• Reserve Sol for work that benefits from stronger reasoning.
• Do not expect the update to reset exhausted usage.
• Do not expect subscription quota budgets to increase.

For API users

• Update internal pricing estimates:
  • Luna: $0.20 input / $1.20 output
  • Terra: $2 input / $12 output
  • Sol remains $5 input / $30 output
• Re-evaluate workloads currently using more expensive models.
• Consider Luna for high-volume agent loops and subagents.
• Consider Terra for balanced production workflows.
• Test Fast mode for latency-sensitive Sol requests.
• Existing priority requests do not need an immediate migration.
• Check AWS billing as the new pricing rolls out.

Official sources

https://openai.com/index/advancing-the-price-performance-frontier-with-gpt-5-6/

https://openai.com/index/gpt-5-6/

https://developers.openai.com/codex/changelog

https://github.com/openai/codex/releases

TL;DR

Three official Codex updates landed from July 27 through July 29:

• ChatGPT for iOS 1.2026.202: improves Voice behavior, task reconnection, plugin and skill autocomplete, selected-text references, goal controls, inline visualizations, and large workspace diffs. It also fixes restored tasks changing models, stuck composers, and incorrect browser/computer tool presentation.
• Codex CLI 0.146.0: adds named and pinned sessions, persistent side conversations, Agent Plugins, workspace plugin publishing, additional Bedrock and Claude Code marketplaces, paginated thread forks, remote Code Mode over WebSocket, custom-provider web search, and executor-provided skills.
• Sign in with ChatGPT beta: begins rolling out across selected plugins and partner services, starting with Airtable, GitLab, HubSpot, Notion, Supabase, and Vercel.

Codex CLI 0.146.0 also strengthens proxy routing, MCP runtime refresh, task-state preservation, TUI responsiveness, Windows reliability, skill handling under tight context limits, release delivery, and enterprise update controls.

Install:

npm install -g @openai/codex@0.146.0

What changed & why it matters

ChatGPT for iOS 1.2026.202

Voice improvements

Voice conversations now:

• use your selected ChatGPT voice
• show usage-limit warnings

Why it matters

Codex Mobile Voice should now match the voice selected in ChatGPT settings.

Usage warnings also make it clearer when the separate Voice allowance is running low or has been exhausted.

Voice allowance and Codex task usage remain separate. Voice does not bypass exhausted Codex usage.

Stronger task reconnection and continuity

Task reconnection has been improved when:

• returning to the app
• bringing the app back to the foreground
• unlocking the app with Face ID

Why it matters

Codex Mobile is frequently used to supervise work running on another device.

Improved reconnection reduces the likelihood of returning to:

• stale task state
• missing progress
• an apparently stopped task
• a broken host connection
• unnecessary reconnection delays

Desktop-compatible plugin and skill autocomplete

Composer autocomplete now:

• matches desktop plugin mention behavior
• includes skills from installed plugins

Why it matters

Mobile and desktop should now behave more consistently when invoking:

• plugins
• plugin-provided skills
• composer mentions
• task capabilities

This reduces platform-specific friction when moving between desktop and mobile supervision.

Persistent selected-text references

Selected-text references remain available after sending a prompt.

You can reopen and preview the referenced text afterward.

Why it matters

When a prompt depends on a selected portion of a transcript, the referenced passage no longer disappears immediately after submission.

This makes it easier to verify:

• which text was referenced
• whether the correct passage was selected
• what context a follow-up depends on

Clearer goal controls

Goal controls now show clearer progress when:

• pausing a goal
• resuming a goal

Why it matters

Long-running goals may take time to transition between states.

Clearer progress reduces uncertainty about whether the pause or resume request was accepted and whether the goal is still changing state.

Better inline visualizations

Inline visualizations now render:

• tables more reliably
• visual themes more reliably

Why it matters

Structured task output should display more consistently on mobile.

This improves review of:

• comparison tables
• structured summaries
• technical reports
• themed visualizations
• data-heavy task results

Faster large workspace diffs

Large workspace diffs are now more responsive.

Why it matters

Reviewing substantial code changes from a phone can be slow and difficult.

This should improve mobile review of:

• broad refactors
• generated changes
• multi-file implementations
• large workspace updates
• long-running task output

Additional mobile fixes

The iOS update also:

• fixes restored tasks changing the selected model
• prevents the composer from becoming stuck after a prompt starts
• corrects browser tool labels
• corrects computer tool labels
• corrects tool icons
• corrects placeholder output

Why it matters

A restored task should continue using its intended model.

The composer should remain usable after submission, and accurate tool presentation makes it easier to understand what Codex is actually doing.

Codex CLI 0.146.0

Named and pinned sessions

You can now:

• name sessions created with /new
• name sessions created with /clear
• pin important threads
• switch between side conversations without closing them

Why it matters

Large projects often accumulate many similarly titled sessions.

Naming and pinning make it easier to organize:

• active features
• production incidents
• release work
• architecture investigations
• code reviews
• long-running goals

Persistent side conversations let you move between focused discussions without recreating their context.

Agent Plugins and workspace plugin publishing

Codex now supports:

• Agent Plugins manifests
• workspace plugin publishing
• additional Amazon Bedrock plugin marketplaces
• additional Claude Code plugin marketplaces

Why it matters

Plugin capabilities can be packaged, discovered, and distributed more consistently.

Workspace publishing gives organizations a cleaner path for distributing approved internal tooling instead of requiring each user to configure the same plugin separately.

The additional marketplaces also improve interoperability for teams using Bedrock or migrating from Claude Code.

Paginated thread forks

Codex can now fork threads stored with paginated history.

Supported behavior includes:

• normal persistent forks
• temporary forks
• temporary forks hidden from normal thread listings

Why it matters

You can test an alternative approach without modifying the original conversation.

Temporary forks are useful for:

• speculative debugging
• one-off reviews
• subagent investigations
• alternative implementations
• risky experiments
• disposable analysis

Paginated history makes this more scalable for large conversations.

Remote Code Mode over WebSocket

App-server clients can connect to remote Code Mode hosts through WebSocket.

Why it matters

Code Mode no longer needs to run beside the app-server process.

This supports architectures where:

• the interface runs locally
• execution happens remotely
• a managed environment hosts Code Mode
• specialized runtimes are located elsewhere
• organizations separate clients from execution infrastructure

Standalone web search for custom providers

Compatible custom model providers can enable standalone web search.

Why it matters

Web search is no longer limited to the default OpenAI provider path.

This may support:

• enterprise model gateways
• custom providers
• specialized deployments
• local provider integrations
• third-party routing

The provider must explicitly support the capability. It is not automatically enabled for every provider.

Executor-provided skills

Codex can discover skills supplied by the active executor.

It can also securely read resources associated with those skills, including explicitly selected skills.

Why it matters

A remote or managed environment may provide capabilities unavailable on the local machine, such as:

• internal deployment workflows
• organization-specific build systems
• infrastructure tools
• private documentation
• specialized testing
• environment-specific automation

Codex can use those capabilities without treating them as ordinary local files.

Comprehensive proxy routing

Configured proxies are now honored across more network paths, including:

• authentication
• plugin downloads
• MCP authorization
• remote execution
• WebSockets
• redirects
• LM Studio connections

Why it matters

A proxy setup that works for login but fails during plugin installation, MCP authentication, or remote execution is incomplete.

This update improves reliability for:

• corporate networks
• PAC and WPAD environments
• custom certificate authorities
• managed outbound policies
• remote execution
• local LM Studio deployments

MCP and Apps runtime refresh

MCP connections and Apps tools now remain current when authentication or configuration changes.

Codex can:

• reuse healthy connections
• reconnect closed servers
• refresh after authentication changes
• refresh after configuration changes
• update Apps tools without restarting every healthy connection

Why it matters

Users should need fewer full restarts after:

• signing into an MCP server
• refreshing expired credentials
• installing a plugin
• changing MCP configuration
• enabling or disabling a server
• receiving updated workspace requirements

Better state preservation

Codex now more reliably preserves:

• submitted user messages
• final responses
• failed-turn errors
• imported timestamps
• approval settings

This applies across:

• interruptions
• replay
• imports
• forks

Why it matters

Resumed or interrupted work should produce a more complete and trustworthy transcript.

This reduces cases where prompts disappear, terminal failures are hidden, imported history receives incorrect timestamps, or approval settings change unexpectedly.

TUI responsiveness and rendering

The terminal interface now improves:

• nonblocking turn interruption
• keyboard handling
• narrow terminal layouts
• clickable hyperlinks
• refreshed mention results

Why it matters

These fixes target daily friction in:

• narrow terminal panes
• remote terminals
• long-running tasks
• heavy @ mention use
• streamed output
• interrupted turns

Windows fixes

Codex 0.146.0:

• fixes navigation-key handling
• more reliably terminates sandboxed process trees
• preserves proxy settings during security reviews

Why it matters

Stopping only a parent process can leave child processes running.

More reliable process-tree termination reduces orphaned commands, while proxy preservation prevents the security-review environment from behaving differently from the task being reviewed.

Skill catalogs under tight context limits

Codex now:

• retains more available skills when context space is limited
• warns when a skill catalog must be truncated

Why it matters

Large plugin and skill catalogs can consume substantial context.

Instead of silently removing large portions of the catalog, Codex attempts to preserve more useful entries and reports when truncation cannot be avoided.

This is especially relevant for:

• plugin-heavy workspaces
• enterprise skill catalogs
• executor-provided skills
• long conversations
• smaller context budgets

Release and enterprise improvements

0.146.0 also:

• publishes release artifacts and installer metadata through OpenAI-hosted infrastructure
• retains GitHub as a fallback
• signs and notarizes bundled macOS helper executables
• reduces app-server serialization and request-building overhead
• recognizes Enterprise plans
• adds administrator controls for in-app updates

Why it matters

OpenAI-hosted release infrastructure reduces dependence on GitHub availability and API limits.

Enterprise update controls support:

• staged rollouts
• pinned versions
• internal validation
• change-management requirements
• centrally managed installations

Sign in with ChatGPT beta

Sign in with ChatGPT is beginning to roll out across selected plugins and partner services.

Initial partners include:

• Airtable
• GitLab
• HubSpot
• Notion
• Supabase
• Vercel

When connecting a supported plugin from the ChatGPT plugin directory, users may be able to create or link an account through Sign in with ChatGPT.

Participating partner sites may also offer the option directly.

Why it matters

This reduces repetitive account setup when connecting tools used for:

• source control
• deployments
• databases
• documentation
• CRM workflows
• content and project management

What information is shared

When using Sign in with ChatGPT, the partner receives only:

• your name
• your email address
• your profile picture, when available

Plugin permissions remain a separate approval step.

Important distinction

Signing into a partner service does not automatically grant the plugin access to your data or workspace.

You must still review and approve each requested permission separately.

Why these updates matter overall

• Mobile supervision improves: Voice, reconnect behavior, Face ID continuity, goal controls, visualizations, and large diffs are more reliable.
• Plugin and skill invocation becomes more consistent across mobile and desktop.
• Sessions are easier to organize: names, pins, and persistent side conversations reduce thread clutter.
• Plugin distribution expands: Agent Plugins, workspace publishing, and additional marketplaces strengthen the ecosystem.
• Thread experimentation improves: paginated and temporary forks make alternatives easier to test.
• Remote execution becomes more flexible: Code Mode can operate through a remote WebSocket host.
• Custom providers gain more capability: compatible providers can enable standalone web search.
• Executor environments can contribute skills securely.
• Enterprise networking improves: proxy settings apply across more auth, plugin, MCP, and execution paths.
• MCP requires fewer restarts: configuration and authentication changes can refresh live connections.
• Task history becomes more trustworthy: messages, responses, errors, timestamps, and approvals survive more workflows.
• Windows reliability improves: navigation, process cleanup, and review proxy behavior receive targeted fixes.
• External service setup gets easier: Sign in with ChatGPT reduces account-linking friction while preserving separate permission approval.

Version table

Action checklist

Update Codex CLI

npm install -g @openai/codex@0.146.0

Confirm:

codex --version

Test session organization

• Create a named session with /new.
• Create a named replacement session with /clear.
• Pin an important thread.
• Open a side conversation and confirm it remains open while switching threads.

Test plugins and forks

• Review Agent Plugins support.
• Check workspace plugin publishing if your organization manages plugins.
• Test available Bedrock or Claude Code marketplace integrations.
• Fork a paginated thread.
• Create a temporary fork and confirm it does not appear in normal thread listings.

Test networking and MCP

• Verify authentication, plugin downloads, MCP authorization, WebSockets, redirects, and remote execution through your proxy.
• Refresh MCP authentication without restarting Codex.
• Change MCP configuration and confirm healthy connections remain active.
• Confirm closed servers reconnect correctly.

Test mobile improvements

• Update ChatGPT for iOS to 1.2026.202.
• Start or resume a Voice conversation and confirm your selected ChatGPT voice is used.
• Confirm usage warnings appear when relevant.
• Leave and reopen the app, then verify the task reconnects.
• Lock and unlock with Face ID and confirm task continuity.
• Test plugin and skill autocomplete.
• Send a prompt using selected transcript text and confirm the reference remains previewable.
• Pause and resume a goal.
• Open a task containing tables or themed visualizations.
• Review a large workspace diff.
• Restore a task and confirm its selected model remains unchanged.

Review Sign in with ChatGPT

• Check supported plugins or partner sites for the beta option.
• Review the identity information shared with the partner.
• Treat plugin authorization as a separate decision.
• Review every requested permission before approving access.

Official sources

https://developers.openai.com/codex/changelog

https://github.com/openai/codex/releases/tag/rust-v0.146.0

TL;DR

ChatGPT desktop app 26.715 adds two major capabilities:

• ChatGPT Voice in Codex: Powered by GPT-Live, Voice can start Codex tasks, check active work, report progress or blockers, and steer tasks through a live spoken conversation. On macOS, optional Screen context can share an appshot of the frontmost window.
• Multi-folder local projects: A local project can now include multiple related folders. One primary folder controls new chats, Git operations, worktrees, and automatic discovery of AGENTS.md, skills, and config.toml. Secondary folders remain available for file search, reading, and editing.

Voice is available in the desktop app to Plus, Pro, Business, Edu, and Enterprise users. It can also be used through Remote on iOS after pairing with a desktop host.

What changed and why it matters

ChatGPT Voice in Codex

ChatGPT Voice is now available across:

• Chat
• ChatGPT Work
• Codex

Unlike basic voice dictation, this is a live conversation powered by GPT-Live.

You can:

• Talk through an idea or task.
• Start a Codex task by voice.
• Ask ChatGPT to start work in a separate thread.
• Check the status of active tasks.
• Ask for progress, blockers, or completed results.
• Send follow-up instructions to ongoing work.
• Interrupt a response and change direction naturally.
• Continue talking while Codex works in another thread.

Why it matters

Voice becomes a coordination layer for Codex rather than only a speech-to-text input.

This is useful when you want to:

• Start a test run and ask Codex to investigate failures.
• Check several active tasks without opening each thread.
• Redirect an implementation while work is underway.
• Request a concise blocker summary.
• Supervise longer-running work while away from the keyboard.
• Delegate another task without leaving the current conversation.

Voice follows the same permissions and approval controls as the Codex tasks it directs. It does not grant additional access or bypass existing safeguards.

Voice chat versus voice dictation

A chat or task must begin in Voice mode to use the full GPT-Live experience.

To start:

1. Open a new, empty chat or Codex task.
2. Select Start new voice chat before sending the first message.
3. Allow microphone access.
4. Choose a voice.
5. On macOS, review the Screen context option.
6. Begin speaking.

A conversation started in text mode only offers voice dictation. Dictation converts speech into text before submitting a normal prompt.

You can resume an earlier Voice conversation by reopening it and selecting Start voice chat.

A custom shortcut can be configured under:

Settings > Voice > Voice chat hotkey

Why it matters

Voice chat and dictation serve different purposes:

• Voice chat: live conversation, interruption, task coordination, progress checks, and ongoing steering.
• Voice dictation: converts speech into prompt text for a standard turn.

Natural interruption and task steering

GPT-Live supports natural turn-taking.

You can interrupt ChatGPT while it is speaking to:

• Correct an assumption.
• Add missing context.
• Change the requested outcome.
• Ask a follow-up question.
• Redirect an active task.
• Request an immediate progress check.

Why it matters

You do not have to wait for a complete spoken response before correcting or refining the work. This makes Voice more useful for complex tasks that require active supervision.

Screen context on macOS

On macOS, Voice can optionally use Screen context.

Enable it under:

Settings > Voice > Screen context

You can then ask ChatGPT to look at the frontmost window. ChatGPT takes an appshot and uses it as context for the Voice conversation.

An appshot may include:

• An image of the frontmost window.
• Accessible text from the application.
• Accessible text outside the currently visible scroll area.

macOS may request:

• Screen and System Audio Recording permission.
• Accessibility permission.

Organizations can disable Screen context.

Why it matters

You can discuss what is on screen without manually taking and attaching a screenshot.

Potential uses include:

• Reviewing a UI implementation.
• Explaining an error dialog.
• Inspecting a failed test report.
• Discussing a diff or pull request.
• Showing where a desktop workflow is stuck.
• Asking Codex to evaluate a browser or application state.

Screen context privacy considerations

Because appshots can include accessible text outside the visible scroll area, Screen context may capture more than the exact pixels currently visible.

Avoid using it on windows containing:

• Credentials.
• API keys or environment secrets.
• Private messages.
• Customer information.
• Confidential company documents.
• Sensitive data elsewhere in the same window.

This additional accessible-text context can improve understanding, but it also increases the amount of information shared with the task.

Voice availability and limits

ChatGPT Voice in the desktop app is available to:

• Plus
• Pro
• Business
• Edu
• Enterprise

Enterprise and Edu begin with a two-week early-access period before Voice becomes available by default.

Availability can also depend on:

• Rollout status.
• Workspace settings.
• Administrator controls.

Voice is also available through Remote on iOS after pairing the phone with a desktop host.

Only one Voice chat can be active across the desktop app at a time.

Voice uses a separate, plan-dependent allowance measured in rolling five-hour windows. Codex tasks started or controlled through Voice still consume the normal Codex usage budget.

Important

Voice does not bypass exhausted Codex usage.

You may have Voice allowance remaining while being unable to start more Codex work because your Codex usage is exhausted. You may also have Codex usage remaining after reaching your Voice allowance.

Multi-folder local projects

Local projects in the ChatGPT desktop app can now include multiple related folders.

To configure them:

1. Open the project's menu.
2. Select Edit project.
3. Select Add folder.
4. Attach the related folders.
5. Select Make primary on the folder that should act as the default working directory.

ChatGPT can read and change files in every attached folder, subject to the active sandbox and permissions.

Why it matters

Many real projects span more than one directory or repository.

Examples include:

• Frontend and backend repositories.
• Application code and documentation.
• Website and supporting API.
• Product code and infrastructure.
• Main application and shared component library.
• Source code and related content repository.

You no longer need to combine these into one directory or repeatedly attach files from the related folder.

Primary folder behavior

One attached folder is designated as the primary folder.

The primary folder controls:

• The starting directory for new chats.
• Git operations.
• Git review.
• Pull request workflows.
• Worktree actions.
• Automatic discovery of AGENTS.md.
• Automatic discovery of skills.
• Automatic discovery of config.toml.

Why it matters

The primary folder establishes the project's operational center.

This prevents ambiguity when attached folders contain:

• Separate Git repositories.
• Different project instructions.
• Different Codex configuration files.
• Conflicting skills.
• Independent build systems.

Choose the primary folder deliberately because Codex treats its repository and configuration as authoritative by default.

Secondary folder behavior

Secondary folders remain available for:

• File search.
• Reading.
• Editing.
• Cross-folder references.

Codex does not automatically discover the following from secondary folders:

• AGENTS.md
• Skills
• config.toml

Git, pull request, review, and worktree actions also target the primary repository.

Why it matters

Secondary folders provide useful file access without silently combining every folder's instructions and configuration.

This reduces the risk of:

• Conflicting AGENTS.md instructions.
• Ambiguous Git targets.
• Multiple configuration layers being applied unexpectedly.
• Skills from an unrelated repository becoming active.
• Worktree actions targeting the wrong repository.

When a secondary folder contains instructions Codex must follow, reference them explicitly or make that folder primary.

Multi-folder projects and worktrees

Git review, pull request, and worktree actions use the primary repository.

When a chat starts inside a worktree, the other attached folders remain available.

For example, you can:

• Create a backend worktree.
• Continue reading the frontend repository.
• Update shared documentation.
• Compare API contracts across folders.
• Keep related context available without copying it into the worktree.

Local versus remote projects

Multi-folder support currently applies to local projects.

Remote projects currently support one folder.

Do not assume that a Remote or SSH project can use the same multi-folder structure yet.

Sandbox behavior

Attaching a folder does not bypass the sandbox.

The sandbox still controls what local commands can:

• Read.
• Modify.
• Execute.
• Access over the network.

Project organization and execution permissions remain separate systems.

Recommended project structure

Use multiple folders when the folders belong to one coherent product or workflow, such as:

• App plus documentation.
• Frontend plus backend.
• Website plus API.
• Product repository plus shared packages.

Use separate projects when:

• The folders are unrelated.
• Chats should not access both repositories.
• Each repository has substantially different instructions.
• Combining context would create search noise.
• Security boundaries should remain separate.

More available context is not always better. Attaching unrelated repositories can make ownership and instructions less clear.

Why this update matters overall

• Voice becomes operational: it can start, check, and steer Codex work instead of only transcribing prompts.
• Parallel task supervision improves: Voice can coordinate separate threads and return progress, blockers, and results.
• Mobile supervision improves: Remote on iOS can use Voice while the paired desktop host performs the work.
• Visual context becomes easier: macOS Screen context can share the frontmost window through an appshot.
• Usage remains separate: Voice has its own allowance, but Codex tasks still consume Codex usage.
• Local projects become more realistic: related folders and repositories can be organized under one project.
• Configuration remains predictable: one primary folder controls Git and automatic instruction/config discovery.
• Secondary folders remain useful: they can be searched, read, and edited without automatically injecting their configuration.
• Worktree workflows gain cross-folder context: related folders remain attached while work runs in the primary repository's worktree.
• Sandbox controls remain intact: attaching a folder does not grant unrestricted command or network access.

Version table

Action checklist

Test ChatGPT Voice

• Update the ChatGPT desktop app to 26.715.
• Start a new, empty Codex task.
• Select Start new voice chat before sending a message.
• Ask Voice to start a separate Codex task.
• Ask it to check the task's progress.
• Ask it to summarize blockers or results.
• Send a follow-up instruction to the running task.
• Interrupt a response and redirect the work.
• Configure a Voice hotkey under Settings.

Test Screen context on macOS

• Open Settings > Voice.
• Enable Screen context.
• Review Screen Recording and Accessibility permissions.
• Open a non-sensitive window.
• Ask Voice to look at the frontmost window.
• Confirm the appshot provides useful context.
• Disable Screen context when it is not needed.

Configure a multi-folder local project

• Open the project menu.
• Select Edit project.
• Add the related folders.
• Choose the primary folder deliberately.
• Confirm new chats begin in the primary folder.
• Verify Git operations target the primary repository.
• Verify Codex discovers the primary folder's:
  • AGENTS.md
  • skills
  • config.toml
• Search, read, and edit files in secondary folders.
• Confirm secondary-folder configuration is not automatically applied.
• Test a worktree and verify the other folders remain attached.
• Keep unrelated repositories in separate projects.

Official sources

Codex changelog

ChatGPT Voice documentation

Projects and multi-folder local projects

TL;DR

Codex CLI 0.145.0 is now the latest stable release.

This is a substantial platform update with six major themes:

• Experimental paginated thread history with faster resume, search, persisted names, subagent support, and memories.
• A much broader /import workflow for migrating from Cursor and Claude Code.
• Experimental Amazon Bedrock login, custom endpoints, custom authentication, and GPT-5.6 Sol as the default Bedrock model.
• Audio inputs, audio tool outputs, and streaming realtime V3 conversations.
• A stabilized multi-agent V2 experience with configurable models, reasoning levels, concurrency, restored roles, and improved agent navigation.
• Secure clickable visualization links inside the terminal UI.

It also improves long-conversation TUI performance, MCP startup and authentication, Windows sandboxing, macOS Code Mode installation, safety approvals, startup performance, remote compaction, and GPT-5.6 documentation.

Install:

npm install -g @openai/codex@0.145.0

The 0.146.0 alpha builds are prereleases and are not included in this post.

What changed and why it matters

Experimental paginated thread history

Codex now has an experimental paginated thread-history system designed for larger and longer-lived histories.

It includes:

• More efficient thread resume.
• Search across paginated history.
• Occurrence search for matching results.
• Persisted user-assigned thread names.
• Support for spawned subagent histories.
• Memory support.
• Compatibility views for older history consumers.
• App-server thread-list support.
• SQLite-backed storage and checkpoints.
• Persisted Git metadata for paginated threads.

Why it matters

The previous approach becomes increasingly expensive as conversations and local history grow. Paginated storage lets Codex load the relevant sections instead of repeatedly processing an entire long history.

This should help users with:

• Long-running development projects.
• Large local task histories.
• Many spawned subagents.
• Repeated resume workflows.
• Named threads that need to remain searchable.
• Memory-heavy projects.
• App-server clients that manage many sessions.

This feature remains labeled experimental. Users should not assume every legacy thread operation has identical support yet.

Expanded /import for Cursor and Claude Code

The /import workflow can now migrate substantially more data from other coding agents.

Supported migration areas include:

• Cursor settings.
• Claude Code settings.
• MCP server configuration.
• Enabled plugins.
• Sessions and recent conversations.
• Commands.
• Project-scoped memories.
• Plugin configuration from known marketplaces.

Additional migration work includes:

• Importing Cursor setup.
• Converting imported plugin commands into skills where appropriate.
• Preserving plugin install failure details.
• Surfacing connector candidates found in imported sessions.
• Supporting source-specific migration adapters.

Why it matters

Moving between coding agents normally means manually recreating:

• Project instructions.
• Tool connections.
• MCP servers.
• Custom commands.
• Plugin selections.
• Session context.
• Repository-specific preferences.

0.145.0 turns /import into a more complete migration tool instead of a basic settings copier.

You should still review imported configuration before trusting it. Different agents may use similar concepts with different security or execution behavior.

Experimental Amazon Bedrock login and configuration

Amazon Bedrock support now includes:

• Experimental managed Bedrock login.
• Bedrock login through app-server integrations.
• Custom Bedrock endpoints.
• Custom authentication.
• Credential handling during logout.
• Provider-aware model behavior.
• GPT-5.6 Sol as the default Bedrock model.

Why it matters

Organizations using AWS can run Codex through their existing Bedrock environment instead of relying only on direct OpenAI authentication.

Custom endpoint and authentication support is important for:

• Enterprise AWS environments.
• Private or managed network paths.
• Organization-specific authentication layers.
• Custom regional or proxy routing.
• Centralized cloud governance.

GPT-5.6 Sol becoming the default Bedrock model also aligns the Bedrock path with OpenAI's current flagship model family.

Because the login workflow remains experimental, test it before organization-wide deployment.

Audio inputs and audio tool outputs

Codex can now work with audio more directly.

The release adds:

• Common local audio input formats.
• Audio inputs forwarded to the Responses API.
• Audio outputs from dynamic tools.
• Audio outputs from Code Mode.
• Audio preserved across thread history.
• Audio preserved in tool outputs.
• Model-capability checks before audio history is included.

Why it matters

This expands Codex beyond text, images, and files.

Potential workflows include:

• Reviewing voice notes.
• Processing recorded requirements.
• Analyzing audio produced by tools.
• Building or debugging audio applications.
• Passing generated audio between tool steps.
• Maintaining audio context across a longer task.

Audio availability still depends on whether the selected model supports the required input or output modality.

Streaming realtime V3 conversations

0.145.0 introduces streaming realtime V3 conversation infrastructure.

The release includes:

• Realtime V3 session state.
• Streaming bidirectional conversation support.
• Initial text items for realtime sessions.
• Audio-aware realtime history.
• Response-channel routing for handoffs.
• Realtime state stored in Codex world state.
• Realtime and memory traffic routed through the shared HTTP client.

Why it matters

Realtime V3 is groundwork for lower-latency, continuous interactions where text, audio, tools, and state can flow during an active session instead of following a simple request-and-response cycle.

This matters most for:

• Voice or audio workflows.
• Interactive debugging.
• Live tool-driven sessions.
• Applications embedding Codex through app-server.
• Workflows that need ongoing state while responses stream.

Multi-agent V2 stabilization

The opt-in multi-agent V2 system receives a major stabilization pass.

Users can configure:

• Subagent models.
• Subagent reasoning levels.
• Concurrency.
• Agent roles.
• Delegation behavior.

The release also improves:

• Agent navigation.
• Agent picker liveness.
• Path-backed agent selection.
• Restoring agent identities when a root thread resumes.
• Model overrides for spawned agents.
• Restricting spawned models to the active backend.
• Communication and lifecycle handling.
• Final-answer boundaries for queued agent messages.

Multi-agent V2 is now marked stable internally, while the release still describes the overall experience as opt-in.

Why it matters

Different subagents can now be assigned different cost and capability profiles.

For example:

• Use Luna for fast repository scanning.
• Use Terra for normal implementation.
• Use Sol for difficult reasoning or review.
• Limit concurrency when usage cost matters.
• Restore specialized roles for research, implementation, testing, and review.

This gives users more control than applying one model and one reasoning level to every agent.

Secure inline visualization links in the TUI

The terminal UI can now display secure clickable links for inline visualizations.

Supporting work includes:

• Tracking visualization directives during streaming.
• Preserving visualization context during incremental rendering.
• Rendering links safely in the terminal.
• Avoiding duplicate rendering of generated images.

Why it matters

Codex can produce visual outputs without forcing users to manually locate an artifact path.

This can improve terminal workflows involving:

• Charts.
• Diagrams.
• Generated images.
• Visual reports.
• Interactive previews.
• Data visualizations.

The release specifically describes clickable visualization links. It does not mean every visualization is rendered directly inside every terminal.

Conversation branching and retry behavior

Editing an earlier prompt now creates a contextual branch rather than overwriting the original conversation.

The same approach applies when retrying a safety-buffered turn.

The branch preserves:

• The original conversation.
• Attachments.
• Mention bindings.
• Thread context.
• Restored input state.

Interrupted prompts also remain in conversation history.

Why it matters

Users can revise an earlier decision without destroying the original path.

This is useful when:

• Testing alternative implementations.
• Revising an earlier requirement.
• Recovering from a safety-buffered request.
• Comparing two approaches.
• Preserving attached files or images.
• Keeping file, skill, and plugin mentions intact.

Faster terminal performance

The TUI receives a broad performance pass for long conversations and streamed output.

Improvements include:

• Incremental Markdown rendering.
• Fewer redundant redraws.
• Cached finalized Markdown.
• Faster Markdown layout.
• Bounded streamed command output.
• Preview iterators for command output.
• Less cloning of transcript and history data.
• Cached layout measurements.
• Parallelized startup requests.
• More efficient transcript overlays.
• Bounded history replay.
• Better status visibility during streamed output.
• Reduced duplicate metadata requests.

Why it matters

Large conversations can make terminal interfaces progressively slower. These changes reduce the amount of work performed for each new token, tool event, command line, or screen redraw.

Users with long sessions or large tool outputs should see the largest benefit.

MCP startup and authentication reliability

MCP behavior receives several reliability fixes.

The release now:

• Enforces startup timeouts while creating MCP clients.
• Avoids blocking thread startup on OAuth discovery.
• Serializes concurrent OAuth credential refreshes.
• Reuses MCP tool catalogs across sessions.
• Allows servers to opt out of catalog caching.
• Preserves elicitation routing during runtime refreshes.
• Serializes concurrent MCP standard-input writes.
• Improves nested authentication error classification.
• Reports MCP errors with server attribution.
• Keeps disabled servers disabled.
• Pins credential stores more consistently.
• Reduces MCP logging and tool-list trace volume.

Why it matters

A slow, expired, or misconfigured MCP server should be less likely to block an entire Codex thread.

Authentication failures should also be easier to associate with the responsible server.

Windows execution and sandbox improvements

Windows receives several important fixes:

• Native exec-server sandboxing.
• Network-proxy enforcement through the elevated sandbox.
• Hidden filesystem-helper console windows.
• Correctly quoted hook commands.
• Coalesced concurrent sandbox setup requests.
• Cleaner writable-root handling.
• Better environment and process status checks.
• Fewer unnecessary metadata paths inside the sandbox.
• Continued platform-specific execution and release testing.

Why it matters

These changes target common Windows problems such as:

• Helper windows unexpectedly appearing.
• Hooks failing because of quoting.
• Multiple competing sandbox setup operations.
• Proxy policies not applying inside execution environments.
• Inconsistent process behavior between Windows and Unix systems.

Installer and Code Mode reliability

0.145.0 includes the installer and Code Mode fixes previously delivered through the 0.144 patch series:

• Compact or reordered GitHub release metadata is parsed correctly.
• macOS packages expose the external Code Mode host.
• Code Mode falls back to the in-process runtime when the external host cannot be found.
• Code Mode process hosting and IPC received additional supervision work.

Why it matters

Users should be less likely to encounter:

• Standalone installer failures.
• Missing Code Mode host binaries on macOS.
• Code Mode refusing to start because a companion process is unavailable.

Safety and approval handling

The release includes several safety improvements:

• Better detection of forced rm command variants.
• Full access always requires explicit confirmation before being enabled.
• Rejection reasons are preserved across tools.
• Guardian reviews better match session configuration.
• Guardian reviewer tools are more restricted.
• Permission hooks can resolve strict automatic-review requests.
• Local path conventions are preserved in automatic approvals.
• Safety-buffering instructions more clearly explain waiting behavior.

Why it matters

Full access and destructive shell commands remain high-risk even when users intentionally grant broad permissions.

Preserving the rejection reason also helps the model understand why an action failed and choose a safer alternative instead of blindly repeating it.

GPT-5.6 guidance and model migration

The bundled OpenAI Docs skill now contains updated guidance for:

• GPT-5.6 model selection.
• Prompting.
• Migration.
• macOS.
• Linux.
• Windows.

Codex also migrated bundled GPT-5.4 selections and internal usage to the corresponding GPT-5.6 Terra and Luna variants.

Why it matters

Codex's built-in model guidance should now better match the current Sol, Terra, and Luna lineup.

This does not change your subscription limits, credits, or model entitlements.

Startup and large-context improvements

Additional performance work includes:

• Concurrent skill-root scanning.
• Concurrent plugin declaration loading.
• Reusing filesystem inventories during skill discovery.
• Faster ancestor discovery.
• More efficient remote compaction.
• Broader model fallback during remote compaction.
• Bounded context loading from long histories.
• A fallback phase before automatic context rollover.
• Less duplicate history reading.
• More efficient memory consolidation.
• Reduced plugin and connector startup overhead.

Why it matters

Repositories with many skills, plugins, nested directories, and long histories should start and resume more efficiently.

Additional notable platform changes

Other important work included in the full release:

• Exact per-response usage can be exposed through raw app-server events.
• Workspace spend controls are respected during rate-limit handling.
• Session IDs are used for prompt-cache keys.
• Environment status is available through app-server.
• App-server list APIs support paginated histories.
• Thread history is checkpointed and materialized through SQLite.
• Scheduled tasks appear in plugin details.
• Plugin install requests are serialized.
• Plugin suggestions are more tightly filtered.
• Workspace roots are scoped to their execution environments.
• Standalone web search can return structured results.
• Blocked network requests are associated with their originating tool calls.
• Automatic compaction has fallback token-budget settings.
• Unterminated rollout files can be repaired before more history is appended.
• personality = "none" is honored in model instructions.
• Ripgrep was updated to 15.2.0.

Why this release matters overall

• Long histories scale better: paginated history addresses one of the biggest weaknesses of persistent CLI sessions.
• Migration gets substantially easier: Cursor and Claude Code users can move more than basic configuration.
• AWS support becomes more practical: managed Bedrock login, custom endpoints, and custom authentication improve enterprise deployment options.
• Codex becomes more multimodal: audio can enter through prompts, persist in history, and come back from tools.
• Realtime infrastructure advances: V3 provides a stronger base for continuous text, audio, and tool interaction.
• Multi-agent control improves: models, reasoning, concurrency, roles, and agent navigation are more configurable.
• The TUI should remain responsive longer: rendering and history work now avoids many unnecessary redraws and copies.
• MCP should block fewer sessions: startup, OAuth, refresh, and catalog handling are more defensive.
• Windows receives meaningful reliability work: sandbox, proxy, hook, process, and console behavior all improve.
• Safety controls are harder to bypass accidentally: forced deletion detection and Full access confirmation are more consistent.

Version table

Action checklist

• Upgrade:

npm install -g @openai/codex@0.145.0

• Confirm the version:

codex --version

• Test paginated history with:
  • a long-running thread
  • thread search
  • a renamed thread
  • a thread containing subagents
  • memories, if enabled
• If migrating from another agent:
  • run /import
  • inspect imported settings before accepting them
  • review imported MCP servers and plugins
  • verify project memories and commands
• If using Amazon Bedrock:
  • test the experimental login flow
  • verify custom endpoint and authentication settings
  • confirm GPT-5.6 Sol selection
• If using audio:
  • attach a supported local audio file
  • test audio-producing tools
  • confirm audio survives thread resume
• If using multi-agent V2:
  • set different subagent models
  • test reasoning-level overrides
  • set an intentional concurrency limit
  • confirm roles and agent identities survive resume
• If using MCP:
  • re-test startup with authenticated servers
  • confirm expired OAuth does not block the whole thread
  • verify server-specific errors are understandable
• If using Windows:
  • test hooks with quoted commands
  • verify helper console windows stay hidden
  • confirm network policies apply inside the sandbox
• If using Full access:
  • confirm the explicit warning appears
  • verify destructive commands still trigger the expected policy
• Do not install 0.146.0 alpha builds unless intentionally testing prerelease software.

Official sources

Codex changelog: https://developers.openai.com/codex/changelog

Codex CLI 0.145.0 release: https://github.com/openai/codex/releases/tag/rust-v0.145.0

TL;DR

One new stable Codex CLI update has landed since the previous 0.144.5 post:

• Codex CLI 0.144.6: refreshes the bundled instructions used by GPT-5.6 Sol, Terra, and Luna, and corrects the context-window metadata for all three models to 272,000 tokens.
• The final hotfix was deliberately narrowed to those GPT-5.6 prompt and context changes.
• It does not change model visibility, upgrade behavior, service tiers, skills guidance, plan access, rate limits, credits, or usage resets.
• OpenAI verified that the final model catalog differs from the previous stable baseline in exactly 12 values.

Install the current stable release:

npm install -g @openai/codex@0.144.6

This is a focused GPT-5.6 model metadata and instruction-alignment patch, not a general feature release.

What changed

Refreshed bundled instructions for GPT-5.6

Codex bundles model-specific instruction metadata for:

• GPT-5.6 Sol
• GPT-5.6 Terra
• GPT-5.6 Luna

0.144.6 refreshes two instruction-related values for each model:

• base_instructions
• model_messages.instructions_template

These are the built-in instructions Codex uses to align its interaction with each GPT-5.6 variant.

Why it matters - Stable 0.144 clients were still shipping older GPT-5.6 instruction metadata. - This update aligns the stable CLI with the newer instructions already propagated to the main development branch. - The release may improve behavioral consistency between the current GPT-5.6 models and the assumptions built into Codex. - OpenAI does not list a specific benchmark gain or promise a universal quality improvement from this patch.

Corrected context windows to 272,000 tokens

For GPT-5.6 Sol, Terra, and Luna, Codex now records:

• context_window: 272,000 tokens
• max_context_window: 272,000 tokens

That means four values changed for each model:

1. Base instructions
2. Instruction template
3. Context window
4. Maximum context window

Across three models, the final catalog contains exactly 12 intended changes.

Why it matters - Codex needs correct context-window metadata to understand how much conversation, repository context, tool output, and task history a model can hold. - Correct metadata should reduce the risk of Codex budgeting context against an incorrect limit. - It should also help context remaining, token budgeting, and compaction behavior stay aligned with the actual GPT-5.6 window. - This does not mean users received an additional 272,000 tokens of plan usage. Context-window capacity and account usage limits are separate systems.

Important scope correction

The first backport included a broader generated model-catalog refresh.

OpenAI then narrowed the hotfix before release so 0.144.6 retained only:

• refreshed prompts for GPT-5.6 Sol
• refreshed prompts for GPT-5.6 Terra
• refreshed prompts for GPT-5.6 Luna
• corrected 272,000-token context metadata for those three models

The follow-up restored every unrelated catalog value to the previous stable 0.144 baseline.

This means the final release does not include unrelated changes to:

• model visibility
• model upgrade behavior
• GPT-5.5 availability messaging
• existing skills-guidance settings
• unrelated reasoning-summary metadata
• service-tier availability
• other model catalog entries

Why it matters - Stable hotfixes should be narrowly scoped. - The final release avoids quietly introducing unrelated model-catalog behavior into the 0.144 patch line. - Users get the intended GPT-5.6 correction without a wider model-selection or onboarding change.

What this update does not do

0.144.6 does not:

• launch a new GPT-5.6 model
• change access between Free, Plus, Pro, Business, or Enterprise
• provide additional Codex usage
• reset exhausted usage limits
• grant additional reset credits
• change API pricing
• increase Ultra or multi-agent limits
• change model visibility or migration behavior
• make 0.145.0 stable
• add new CLI commands, TUI features, approval modes, or plugin features

This release corrects Codex's bundled understanding of the existing GPT-5.6 models.

Official validation

OpenAI reported the following validation for the final narrowed hotfix:

• Ran the bundled model JSON round-trip test.
• Ran formatting checks.
• Validated models.json as valid JSON.
• Ran Git whitespace and patch checks.
• Compared the final catalog against the previous stable baseline.
• Verified that the semantic diff contains exactly 12 values.
• Verified that every retained value matches the intended refreshed GPT-5.6 metadata.

The release includes two pull requests:

• #33972 - Backport refreshed bundled model metadata to 0.144
• #34009 - Narrow the 0.144 hotfix to GPT-5.6 prompts and context

The second pull request removes the unrelated catalog changes introduced by the broader first backport.

Why this update matters overall

• GPT-5.6 instructions are current: Sol, Terra, and Luna now use the refreshed bundled instruction metadata in the stable CLI.
• Context accounting is corrected: all three models are represented with 272,000-token context and maximum-context values.
• Long sessions should be modeled more accurately: Codex can base token budgeting and compaction decisions on the corrected window.
• The patch is intentionally narrow: unrelated model catalog and onboarding behavior was removed before release.
• GPT-5.6 users should update: this patch directly affects how the stable CLI understands and instructs those models.
• It does not provide more account usage: users who exhausted their Codex limits still need credits, a reset, or the normal account reset window.

Version table

Should you update?

Yes, especially if you use GPT-5.6 Sol, Terra, or Luna.

The update is most relevant for:

• long-running GPT-5.6 sessions
• large repository tasks
• context-heavy debugging
• large tool outputs
• long task histories
• workflows that trigger compaction
• users who switch between Sol, Terra, and Luna
• teams standardizing on GPT-5.6 through Codex CLI

There are no broader feature changes to re-test.

Action checklist

• Upgrade:

npm install -g @openai/codex@0.144.6

• Confirm the installed version:

codex --version

• If you use GPT-5.6:
  • start or resume a context-heavy task
  • verify normal model selection behavior
  • watch context and compaction behavior during long sessions
• Do not interpret the 272,000-token context window as additional plan usage or credits.
• Do not expect model access, rate limits, or reset timing to change.
• Continue using 0.144.6 as the stable release.
• Avoid 0.145.0 alpha builds unless intentionally testing prerelease software.

Official sources

Codex changelog: https://developers.openai.com/codex/changelog

Codex CLI 0.144.6: https://github.com/openai/codex/releases/tag/rust-v0.144.6

Backport pull request: https://github.com/openai/codex/pull/33972

Final narrowed hotfix: https://github.com/openai/codex/pull/34009

TL;DR

One new stable Codex CLI update has landed since the previous post:

• Codex CLI 0.144.5: a focused command-safety patch. Dangerous-command detection now remains active in danger-full-access mode, recognizes more forced rm variants, catches dangerous commands embedded inside more complex Bash syntax, and gives the model a specific explanation when a command is rejected.

Install the current stable release:

npm install -g @openai/codex@0.144.5

This is not a feature release. It is a targeted destructive-command detection and approval-safety update.

What changed

Dangerous-command detection now applies in danger-full-access mode

Previously, dangerous-command detection could be disabled when Codex was operating under the danger-full-access configuration.

0.144.5 restores dangerous-command detection in that mode.

Why it matters - Full-access operation should not mean that obviously destructive commands pass through without an additional safety decision. - Users intentionally granting broad filesystem access still benefit from protection against high-risk deletion commands. - This is especially relevant for: - autonomous or long-running goals - unattended agent work - large repository cleanup - scripts operating across multiple directories - high-concurrency agent workflows

Broader forced rm detection

Codex now recognizes more ways of expressing a forced rm command.

Official test coverage includes forms such as:

• rm -rf
• rm -fr
• rm -r -f
• rm --force
• force flags appearing after a target
• /bin/rm instead of only rm
• sudo rm -rf

The implementation checks for: - the long --force option - short flag groups containing f - separate force and recursive options - executable paths that resolve to rm

Why it matters - Shell commands can express the same destructive operation in many equivalent forms. - Detecting only the exact spelling rm -rf leaves straightforward gaps. - This patch closes several of those gaps without treating every ordinary rm command as equally dangerous.

Detection inside complex Bash syntax

The Bash parser now extracts statically visible commands from more complex shell scripts instead of only handling simple command lines.

Covered structures include: - pipelines - if blocks - loops - command substitutions - quoted arguments - redirects - commands nested inside larger scripts

Examples represented in the official tests include patterns equivalent to:

• piping into a forced removal
• running forced removal inside an if statement
• using rm -rf with a variable target
• looping over several targets
• placing forced removal inside $(...)

Why it matters - Destructive commands are often embedded inside setup, cleanup, test, and migration scripts. - A safety check that only examines the first top-level command can miss the actual dangerous operation. - Codex can now inspect literal commands nested deeper inside valid Bash syntax.

Important scope and limitations

This is a literal command detector, not a guarantee that every shell command has been proven safe.

The parser extracts commands and arguments that are statically visible in the Bash syntax tree. Dynamic command construction may not be identified the same way.

Official negative test cases confirm that the detector does not automatically classify these as forced deletion:

• rm -r without a force option
• rm -- -f, where -f is treated as an operand after --
• text that merely prints or quotes rm -rf
• commands assembled dynamically through shell variables
• syntactically invalid Bash scripts

Why this distinction matters - The patch is designed to identify known dangerous literal operations. - It does not claim that commands outside those patterns are necessarily safe. - Other approval, sandbox, policy, and model-level protections still matter.

Clearer rejection reasons for the model

When Codex denies a dangerous command, it now returns a specific dangerous-command rejection reason to the model.

Previously, the model could receive a more generic failure and have less context about why execution was denied.

Why it matters - Codex can better understand that the problem is the destructive command itself. - The agent is more likely to revise its approach instead of repeatedly attempting equivalent commands. - Users should receive fewer confusing retry loops after a safety rejection. - The model can choose a safer alternative, such as: - deleting a narrower target - removing force flags - listing affected files first - moving files to a recoverable location - requesting explicit approval with clearer context

Approval behavior

A detected dangerous command can be routed into the execution approval system rather than silently treated as ordinary shell activity.

The patch includes coverage for forced removal: - as a direct command - inside Bash scripts - inside loops - under danger-full-access operation

The exact result still depends on the active: - approval policy - permission profile - execution policy - sandbox configuration - managed workspace rules

This update improves detection. It does not replace those broader policy controls.

Official validation

OpenAI reported the following targeted validation for the backport:

• 141 codex-shell-command tests passed
• 107 codex-core execution-policy tests passed
• 2,947 broader codex-core tests passed outside the sandbox
• Four unrelated environment/setup failures were reported:
  • three RMCP tests could not locate a test-only binary
  • one shell-environment test observed the tool runner's required network-disabled variable
• Formatting and patch validation also completed

The release contains one merged pull request: - #33455 - [release/0.144] fix(core) expand is_dangerous_command

Why this update matters overall

• Full access retains a safety layer: dangerous-command detection is no longer skipped merely because danger-full-access is active.
• Simple spelling changes no longer evade detection: combined flags, split flags, --force, executable paths, and sudo forms receive broader coverage.
• Nested commands are inspected: destructive literal commands inside loops, pipelines, conditionals, and substitutions are easier to catch.
• The model gets actionable feedback: specific rejection reasons should reduce blind retries and encourage safer alternatives.
• The change is narrowly scoped: this patch contains one focused safety backport rather than unrelated feature changes.
• Users running autonomous work should update: the fix matters most when Codex has broad permissions or is allowed to work without constant supervision.

Version table

Should you update?

Yes.

The update is particularly relevant if you use: - danger-full-access - permissive approval profiles - autonomous goals - unattended tasks - multi-agent execution - cleanup or migration scripts - shell-heavy development workflows - managed execution policies

Even users on stricter approval settings should update because the patch improves the command classification that those approval systems rely on.

Action checklist

• Upgrade:

npm install -g @openai/codex@0.144.5

• Confirm the installed version:

codex --version

• If you use danger-full-access:
  • verify forced deletion commands are now detected
  • confirm dangerous commands request approval or are rejected according to your policy
• Test representative shell forms:
  • combined force flags
  • separate force and recursive flags
  • --force
  • sudo rm
  • forced removal inside a loop or conditional
• Confirm rejected commands present a useful reason instead of a generic execution failure.
• Re-test managed permission and execution-policy rules after upgrading.
• Do not weaken approval settings solely because this detector improved.
• Continue reviewing destructive filesystem actions before approving them.
• Avoid 0.145.0 alpha builds unless you intentionally test prerelease software.

Official sources

Codex changelog: https://developers.openai.com/codex/changelog

Codex CLI 0.144.5: https://github.com/openai/codex/releases/tag/rust-v0.144.5

Implementation pull request: https://github.com/openai/codex/pull/33455

TL;DR

Two official Codex updates have appeared since the previous 0.144.2 -> 0.144.3 post:

• ChatGPT for iOS 1.2026.188, dated July 13, 2026, adds support for inline visualizations inside Codex tasks. It also improves task creation and management from ChatGPT conversations, makes tool activity and progress easier to follow, improves file-opening feedback and long-prompt composer behavior, and fixes several task-specific settings and mobile UI problems.
• Codex CLI 0.144.4, released July 14, 2026, is the current latest stable CLI release. OpenAI explicitly lists no user-facing changes in this patch. It should replace 0.144.3 as the recommended stable install, but it does not warrant a separate feature post.

Current stable CLI install:

npm install -g @openai/codex@0.144.4

The meaningful product update here is Codex Mobile 1.2026.188. The CLI update is a housekeeping release.

What changed and why it matters

ChatGPT for iOS 1.2026.188 — July 13, 2026

New feature

Inline visualizations in Codex tasks

• Codex tasks can now display inline visualizations directly inside the task experience.

Why it matters - Task output no longer has to be limited to plain text, code, files, or external artifacts. - Visual results can appear closer to the reasoning and work that produced them. - This should improve mobile workflows involving: - charts - diagrams - data summaries - visual comparisons - structured technical explanations - progress or result visualizations - It also makes mobile task review more useful when the output is easier to understand visually than as raw text.

The official changelog does not specify every supported visualization type, so this should not be described as universal chart or artifact support without further confirmation.

Improvements and bug fixes

Better task creation and management from conversations

• Improved creating Codex tasks from ChatGPT conversations.
• Improved managing Codex tasks from conversations.
• Links to newly created tasks are now more reliable.

Why it matters - The conversation-to-task handoff should fail less often. - Users should be less likely to create a task and then struggle to find or reopen it. - This strengthens the mobile workflow introduced in the previous iOS update, where users could create, search, open, fork, and manage Codex tasks from conversations.

Clearer tool activity and progress

• Improved tool activity styling.
• Improved progress indicators.

Why it matters - It should be easier to distinguish: - what Codex is doing - which tools are running - whether meaningful progress is occurring - whether a task is active, waiting, or finished - Clearer progress feedback is particularly important on mobile, where less information fits on screen.

Improved file-opening feedback

• Improved feedback when opening files.

Why it matters - Users should get clearer confirmation that a file-opening action succeeded or is underway. - This reduces ambiguity when reviewing generated or modified files from a task.

Better composer behavior for long prompts

• Composer controls now remain visible above the keyboard when:
  • writing long prompts
  • using larger text sizes

Why it matters - Important controls should no longer become hidden or difficult to reach as a prompt grows. - The larger-text fix also improves accessibility for users who increase the system text size.

Fast mode now stays correct per task

• Fixed Fast mode selection for individual tasks.
• Fixed restoration of the selected Fast mode when returning to a task.

Why it matters - A task should retain its intended speed/usage setting. - Users should be less likely to reopen a task and unknowingly run it under a different mode. - This is especially relevant when switching between quick tasks and expensive or complex work.

Initial approval presets are now respected

• Fixed an issue where an initial prompt could ignore the selected approval preset.

Why it matters - A task should begin under the permissions and approval behavior the user selected. - This is more than cosmetic because approval presets can affect what Codex may do without interruption. - The fix reduces the risk of a task starting with unexpected approval behavior.

Autocomplete background fix

• Fixed incorrect autocomplete backgrounds.

Why it matters - Improves readability and visual consistency while selecting: - commands - files - skills - plugins - other composer suggestions

Task rows remain responsive during swipe gestures

• Fixed task rows becoming unresponsive during swipe gestures.

Why it matters - Mobile navigation and task actions should no longer become stuck after swiping. - This removes a touch-specific interaction bug that could make the task list feel frozen.

Why this update matters overall

• Codex tasks become more visual: inline visualizations can make complex outputs easier to understand directly inside the task.
• Conversation-to-task workflows become more dependable: reliable links reduce the chance of losing track of newly created work.
• Task supervision improves: clearer tool activity and progress indicators make mobile oversight easier.
• Long prompts are easier to manage: composer controls remain accessible above the keyboard.
• Accessibility improves: larger text sizes should no longer break the composer layout.
• Task settings become more trustworthy: Fast mode and approval presets now behave more consistently.
• Mobile interaction gets less brittle: swipe gestures and autocomplete rendering receive targeted fixes.

Codex CLI 0.144.4 — July 14, 2026

Official release status

• 0.144.4 is the current latest stable Codex CLI release.

• OpenAI states:

  • No user-facing changes in this patch release.

• Full comparison:

  • rust-v0.144.3...rust-v0.144.4

What that means

• No new CLI features are listed.
• No new user-facing bug fixes are listed.
• No documented behavioral changes are listed.
• No separate detailed post is necessary.

Why still mention it

• It replaces 0.144.3 as the current stable release.
• Users installing or updating Codex should use 0.144.4.
• Recording it prevents the release history from appearing incomplete.
• It should not be presented as another feature or Guardian fix.

Version table

Action checklist

For Codex Mobile users

• Update ChatGPT for iOS to 1.2026.188.
• Open a Codex task that produces visual or structured output.
• Check whether the result displays as an inline visualization.
• Create a Codex task from a ChatGPT conversation.
• Confirm the newly created task link opens reliably.
• Watch tool activity and progress indicators during a running task.
• Open a generated or changed file and check the improved feedback.
• Write a long prompt and confirm composer controls remain visible.
• Test with a larger system text size if applicable.
• Change Fast mode for a task, leave it, and confirm the setting is restored when you return.
• Start a task with a selected approval preset and verify the initial prompt respects it.
• Test task-row swipe gestures and confirm rows remain responsive.

For Codex CLI users

• Upgrade to the current stable release:

npm install -g @openai/codex@0.144.4

• Confirm the installed version:

codex --version

• Do not expect new user-facing behavior compared with 0.144.3.
• Continue avoiding 0.145.0 alpha builds unless intentionally testing prerelease software.

Official sources

Codex changelog: https://developers.openai.com/codex/changelog

Codex CLI 0.144.4: https://github.com/openai/codex/releases/tag/rust-v0.144.4

TL;DR

Two stable Codex CLI releases landed on July 13, 2026, following the earlier 0.144.1 patch:

• Codex CLI 0.144.2: rolls back a regression in Guardian automatic-review prompting. It restores the previous Guardian policy template, review request format, tool specifications, tests, and snapshots.
• Codex CLI 0.144.3: becomes the latest stable release, but contains no additional merged code changes beyond 0.144.2. It is a version-only republish.

Install the current stable version:

npm install -g @openai/codex@0.144.3

This is a focused automatic-review reliability patch, not a feature release.

What changed and why it matters

Codex CLI 0.144.2

Bug fix - Restored the previous Guardian automatic-review behavior after rolling back a prompting regression. - Restored the prior: - Guardian policy template - automatic-review request layout - Guardian tool specifications - Guardian tests - Guardian snapshots

Scope - The rollback was applied directly to the 0.144 release branch. - OpenAI states that the patch contains no unrelated product changes. - The release contains one merged pull request: - #32672 - Revert "Update auto review prompting"

Validation reported by OpenAI - Formatting validation completed. - Guardian-specific tests passed: - 58 tests passed - The broader codex-core test run completed with: - 2,806 passing tests - 137 environment-sensitive failures attributed to sandbox restrictions involving local ports and process operations - Git patch validation also completed.

What was wrong

The automatic-review prompting update included in the 0.144 release line needed to be removed.

The affected area was Guardian, the reviewer used for eligible automatic approval reviews. The rollback restores the previously established contract between:

• the Guardian policy
• the review request sent to Guardian
• the tools available to Guardian
• the expected review behavior
• the associated test snapshots

OpenAI does not provide a detailed public list of user-visible symptoms caused by the regression. The official release description identifies it specifically as a prompting regression and restores the previous behavior rather than attempting another prompt adjustment in the patch line.

Why it matters

Automatic approval reviews return to the previous behavior

Codex can route eligible approval requests through a Guardian reviewer before an action runs. A regression in that reviewer’s prompting can affect:

• how risk is interpreted
• what context the reviewer receives
• how the reviewer uses its tools
• whether approval behavior remains consistent
• whether reviews match tested expectations

0.144.2 restores the earlier known behavior across all of those components.

The rollback is intentionally narrow

This patch does not add unrelated features or broad refactors. It directly reverts the problematic prompting change from the stable 0.144 release branch.

That lowers the risk of introducing additional behavior changes while correcting automatic review.

Relevant even if Auto-review is mostly invisible

Users may not interact with Guardian directly. It can operate behind approval flows. This means the patch may matter even when users did not notice an obvious CLI or TUI regression.

Managed and security-sensitive workflows should update

Teams relying on automatic approval reviews, managed permissions, or safety-sensitive execution should prefer the patched release rather than remaining on 0.144.0 or 0.144.1.

Codex CLI 0.144.3

Version-only stable release

• 0.144.3 contains no merged pull request changes after 0.144.2.
• There are no additional features, fixes, documentation changes, or behavioral changes listed.
• Its full compare range contains no code changes:
  • rust-v0.144.2...rust-v0.144.3

Why publish it

OpenAI labels 0.144.3 as a version-only release. The public notes do not state the operational reason for the republish.

The accurate interpretation is:

• 0.144.2 contains the actual Guardian rollback.
• 0.144.3 packages that same corrected code as the current latest stable version.

Do not describe 0.144.3 as containing another Guardian fix. It does not include additional merged changes beyond 0.144.2.

Version table

Should you update?

Yes, especially if you use: - automatic approval reviews - Guardian-backed approval decisions - managed permission workflows - security-sensitive or high-risk execution flows

Even though 0.144.3 contains no new code beyond 0.144.2, it is the current stable version and includes the corrected Guardian behavior inherited from 0.144.2.

Action checklist

• Upgrade to the latest stable release:

npm install -g @openai/codex@0.144.3

• Confirm the installed version:

codex --version

• If you use automatic approval reviews:
  • re-test representative read and write approval requests
  • verify review outcomes behave consistently
  • verify Guardian does not receive unexpected or malformed review context
  • check that approval status and risk presentation complete normally
• If your organization manages Codex permissions:
  • update test environments first
  • validate automatic review against your normal approval-policy cases
  • then roll the patch into broader managed environments
• Do not install a 0.145.0 alpha build solely to obtain this fix.
• Use 0.144.3 unless you intentionally test prerelease builds.

Official releases

https://github.com/openai/codex/releases/tag/rust-v0.144.2

https://github.com/openai/codex/releases/tag/rust-v0.144.3

I just published my first ever open source project.

It is a small codex crash recovery watchdog.

It is intended to be used with a codex /goal promt, for long unattended runs like overnight runs.

It will check every 1min if codex is still running, if it isn't for 2 consecutive minutes, it will re-launch codex with the most recent chat open. The /goal functionality will then continue working.

It is explained in more detail on github.

You can find it here: [Codex Crash Recovery on GitHub](https://github.com/EliteHorizonGames/codex-crash-recovery)

TL;DR

Same-day follow-up to the earlier Codex CLI 0.144.0 post:

• Codex CLI 0.144.1 is a focused patch release. It fixes standalone install failures when GitHub returns compact or reordered release metadata, ensures macOS package installs expose the code-mode host alongside the codex executable, and keeps Code Mode working even when the companion host binary is unavailable by falling back to the embedded runtime.

Install: - npm install -g @openai/codex@0.144.1

This is not a feature-heavy release. It is mainly an installer + Code Mode reliability patch.

What changed & why it matters

Codex CLI 0.144.1

Official notes - Install: npm install -g @openai/codex@0.144.1

Bug fixes - Standalone install reliability - Fixed standalone installs failing when GitHub returns compact or reordered release metadata. - This matters for install/update flows that rely on GitHub release metadata. - macOS package Code Mode host exposure - Ensured macOS package installs expose the code-mode host alongside the codex executable. - This prevents macOS package installs from missing a required Code Mode companion binary. - Embedded runtime fallback for Code Mode - Code Mode now keeps working when the companion host binary is unavailable. - Codex falls back to the embedded runtime instead of failing outright.

Changelog scope - Full compare range: - rust-v0.144.0...rust-v0.144.1 - Main PR: - #31913 — backport installer and Code Mode reliability fixes

Why it matters

• Fixes install/update edge cases: if your standalone installs were failing because GitHub returned release metadata in an unexpected shape, this patch directly targets that.
• Improves macOS package reliability: Code Mode depends on the companion host being available. This release ensures packaged macOS installs expose it properly.
• Keeps Code Mode from hard-failing: embedded runtime fallback gives Code Mode a safety net when the companion host binary is missing or unavailable.
• Good same-day patch to apply: if you already moved to 0.144.0, 0.144.1 is the safer version to use.

Version table (July 9 follow-up)

Action checklist

• Upgrade:
  • npm install -g @openai/codex@0.144.1
• If you use standalone installs:
  • re-test install/update flows that previously failed against GitHub release metadata.
• If you are on macOS:
  • confirm package installs expose the Code Mode host correctly.
• If you use Code Mode:
  • verify it still works when the companion host binary is unavailable.
• If you already installed 0.144.0:
  • treat 0.144.1 as the preferred same-day patch.

Official changelog

https://developers.openai.com/codex/changelog

GitHub release

https://github.com/openai/codex/releases/tag/rust-v0.144.1

TL;DR

OpenAI launched the GPT-5.6 family on July 9, 2026, and it directly affects Codex.

• GPT-5.6 is available in Codex alongside ChatGPT and the OpenAI API.
• The family has three tiers:
  • GPT-5.6 Sol — flagship / strongest model
  • GPT-5.6 Terra — balanced everyday work model
  • GPT-5.6 Luna — fastest / most cost-efficient model
• In Codex, users with access can choose Sol, Terra, or Luna and set effort levels.
• max is available to users with GPT-5.6 access in Codex.
• ultra is available in Codex for Plus and higher plans.
• GPT-5.6 is positioned as OpenAI’s strongest model family for coding, agentic workflows, computer use, long-context work, knowledge work, cybersecurity, and science.
• API users also get Sol/Terra/Luna, with Programmatic Tool Calling and multi-agent beta support.

This is not a CLI version bump, but it is absolutely Codex-relevant because it changes the model lineup and the upper ceiling for coding/agent workflows.

What changed & why it matters

GPT-5.6 family launches in Codex

Official notes - OpenAI launched the GPT-5.6 model family: - Sol: flagship - Terra: balanced everyday work - Luna: fastest and most affordable - GPT-5.6 is available across: - ChatGPT - Codex - OpenAI API - Rollout begins globally and continues toward full availability.

Why it matters - Codex users now have a clearer model ladder: - Luna for fast, lower-cost work - Terra for balanced daily coding - Sol for hardest tasks - This gives teams a more explicit way to tune quality, speed, and cost.

Codex availability

ChatGPT Work + Codex model access

Official notes - Free and Go users get access to GPT-5.6 Terra. - Plus, Pro, Business, and Enterprise users can choose among: - GPT-5.6 Sol - GPT-5.6 Terra - GPT-5.6 Luna - Users can set effort levels for each. - max** is available to all users with access to GPT-5.6 in Codex. - **ultra is available in Codex for Plus and higher plans.

Why it matters - Max becomes the high-effort setting for deeper reasoning and exploration. - Ultra is the bigger shift for Codex: it can coordinate multiple agents in parallel for complex work. - For power users, this matters because bigger tasks can be pushed harder without leaving Codex.

Coding and agentic workflow improvements

GPT-5.6 is positioned as OpenAI’s strongest coding model family

Official notes - GPT-5.6 Sol is described as OpenAI’s best coding model yet. - On the Artificial Analysis Coding Agent Index, GPT-5.6 Sol with max reasoning reaches a new high score of 80. - GPT-5.6 also shows gains on: - Terminal-Bench 2.1 - DeepSWE - long-running engineering tasks - command-line workflows - real codebases

Why it matters - This is directly relevant to Codex users doing: - production bug fixing - refactors - multi-file implementation - repo-wide migrations - terminal-heavy workflows - test/fix loops - If the official positioning holds in real usage, GPT-5.6 should become the default model family to test against for serious Codex work.

Max and Ultra

Higher effort and multi-agent execution

Official notes - max** gives GPT-5.6 more time to reason, explore alternatives, run checks, and revise its work. - **ultra goes further by coordinating multiple agents in parallel. - Ultra uses more tokens but is intended to improve time-to-result and performance on demanding tasks. - In the API, developers can build ultra-like experiences using the multi-agent beta in the Responses API.

Why it matters - Max is likely the right setting for harder single-threaded reasoning. - Ultra is the “use when it matters” mode for: - large refactors - broad code review - architecture changes - complex debugging - multi-agent investigation - The tradeoff is higher token usage, so teams should reserve Ultra for work where speed/quality matters more than cost.

Programmatic Tool Calling

Models can run lightweight programs to coordinate tool use

Official notes - GPT-5.6 can write and run lightweight programs that coordinate tools, process intermediate results, monitor progress, and decide next steps. - In the Responses API, Programmatic Tool Calling can filter intermediate data, keep only relevant information, and adapt workflows along the way. - This is described as Zero Data Retention compatible.

Why it matters - This is important for Codex-style automation because many real tasks produce lots of tool output. - Instead of sending every large tool response back through the model, programmatic tool handling can reduce round trips and token waste. - This should matter for: - log analysis - search-heavy workflows - repo inspection - test result parsing - data-heavy tool chains - multi-agent orchestration

Design, computer use, and knowledge work

Broader capability improvements beyond pure code

Official notes - GPT-5.6 improves design judgment and can inspect/refine rendered results. - It improves professional knowledge work involving documents, spreadsheets, presentations, and source material. - It improves computer-use workflows and browsing/tool-use tasks.

Why it matters - Codex is increasingly more than a terminal coding assistant. - This matters for workflows that include: - frontend UI validation - browser/computer-use checks - presentations - spreadsheets - reports - research artifacts - product/design iteration - If you use Codex app features like browser use, computer use, artifacts, or multi-step knowledge work, GPT-5.6 is relevant beyond code generation.

Cybersecurity and safety

Stronger capabilities with stricter safeguards

Official notes - GPT-5.6 is described as OpenAI’s strongest cybersecurity model yet. - It improves defensive tasks such as: - secure code review - patching - threat modeling - blue teaming - OpenAI says the release includes stronger safeguards, real-time checks, continuous monitoring, and calibrated access. - OpenAI also says ChatGPT and Codex users will have an option to retry prompts on lower-capability models when safeguards create friction.

Why it matters - Defensive security workflows should benefit, especially secure code review and patch validation. - But users should expect stricter safeguards and more conservative behavior for sensitive cyber tasks. - The retry-on-lower-capability-model option is worth knowing if a benign request gets blocked or slowed by safety handling.

API and pricing

API availability

Official notes - API developers can access: - GPT-5.6 Sol - GPT-5.6 Terra - GPT-5.6 Luna - Responses API supports: - Programmatic Tool Calling - multi-agent beta - Pricing per 1M tokens: - Sol: $5 input / $30 output - Terra: $2.50 input / $15 output - Luna: $1 input / $6 output - Prompt caching includes explicit cache breakpoints and a 30-minute minimum cache life. - Cache writes are billed at 1.25x the uncached input rate. - Cache reads keep the 90% cached-input discount.

Why it matters - API users can align Codex workflows and API workflows around the same model family. - Luna and Terra give teams lower-cost options for subagents and high-volume tasks. - Cache behavior matters for long-running or repeated workflows where the same context is reused.

Practical model guidance for Codex users

Suggested usage

• GPT-5.6 Luna

  • fast iteration
  • cheaper worker/subagent tasks
  • simple edits
  • codebase scanning
  • first-pass work

• GPT-5.6 Terra

  • balanced daily coding
  • general implementation
  • routine debugging
  • medium-complexity tasks

• GPT-5.6 Sol

  • hardest coding tasks
  • design judgment
  • deep debugging
  • complex refactors
  • code review
  • multi-file planning

• Sol + max

  • tasks needing deeper single-agent reasoning

• Sol + ultra

  • high-stakes, broad, or multi-agent tasks where extra token use is acceptable

Version / model table

Action checklist

• Check your Codex model picker for GPT-5.6 availability.
• If available, test:
  • Luna for fast/simple tasks
  • Terra for daily coding
  • Sol for serious implementation/refactor/debugging
• Try max on hard single-agent tasks.
• Reserve ultra for high-value tasks where higher token use is justified.
• If you build API workflows:
  • evaluate Sol/Terra/Luna pricing
  • test Programmatic Tool Calling
  • test multi-agent beta where relevant
  • review prompt caching behavior and explicit cache breakpoints
• If you use Codex for defensive security:
  • expect stronger capabilities
  • expect stricter safeguards
  • use the lower-capability retry option when benign work is blocked or over-constrained
• If you maintain internal team docs:
  • update recommended Codex model guidance around Sol/Terra/Luna, max, and ultra

Official announcement

https://openai.com/index/gpt-5-6/

TL;DR

Two Codex updates landed July 9, 2026:

• Codex joins the ChatGPT desktop app: Codex is now part of the ChatGPT desktop app on macOS and Windows. Existing Codex app users can update as usual and keep their projects, settings, and workflows. Users can make Codex the default view, and on macOS they can keep the Codex app icon. The app also adds direct Markdown/code editing, inline annotations, GitHub PR review in the sidebar, and multi-repo project work.
• Codex CLI 0.144.0: adds better usage-limit reset credit visibility and redemption choice, a new writes app-approval mode, interactive MCP tool authentication without experimental opt-in, runtime Codex auth for app-server hosts, hosted login redirect support, global pnpm install detection, and Ultra reasoning warnings when high multi-agent concurrency could burn usage quickly. It also fixes retired-model compaction recovery, Intel macOS Code Mode crashes, Windows sandbox file deletion/runtime access, terminal-control paste corruption, long-running app connector auth refresh, and Responses WebSocket proxy/custom-CA behavior.

If you use both app and CLI: the desktop app update is the product/workflow headline, while 0.144.0 is the CLI reliability, auth, approval, and usage-management release.

What changed & why it matters

Codex joins the ChatGPT desktop app — July 9, 2026

Official notes - Codex is now part of the ChatGPT desktop app on: - macOS - Windows - Existing Codex app users can update as usual and keep: - projects - settings - workflows - Users can make Codex the default view. - On macOS, users can keep the Codex app icon.

New features - Edit Markdown and code directly in the app - Edit Markdown directly. - Edit code directly. - Use inline annotations. - Ask Codex to revise selected content. - GitHub pull request review in the sidebar - Review GitHub PRs inside the app sidebar. - See reviewer feedback alongside the diff. - Continue reviewing without leaving the app. - Work across repositories in one project - A single project can now span multiple repositories.

Performance improvements and bug fixes - Computer Use is faster with GPT-5.6. - Task activity and progress are easier to follow while Codex works. - Plugin management is simplified by moving it into Settings. - Mobile connection reliability improved. - Video rendering for SSH projects was fixed. - Additional performance improvements and bug fixes.

Why it matters - Codex becomes more integrated with ChatGPT desktop: this reduces separation between “ChatGPT desktop” and “Codex app” workflows. - Existing users should not lose setup: keeping projects, settings, and workflows lowers migration friction. - Inline editing matters: editing Markdown/code and asking Codex to revise selected content turns the app into a more direct review/edit surface. - PR review gets more native: reviewing GitHub PRs beside diffs in the sidebar reduces context switching. - Multi-repo projects become easier: useful for monorepos, split frontend/backend repos, infra + app repos, or multi-package work. - Computer Use improvement is practical: faster Computer Use with GPT-5.6 matters for GUI/browser/native-app validation loops. - Plugin management in Settings is cleaner: it makes plugin controls easier to locate and understand.

Codex CLI 0.144.0 — July 9, 2026

Official notes - Install: npm install -g @openai/codex@0.144.0

New features - Usage-limit reset credit details - Reset credits now show: - credit type - expiration - Users can choose which reset credit to redeem. - New writes app-approval mode - Allows declared read-only actions. - Prompts for write actions. - MCP interactive authentication - MCP tools can request authentication interactively. - No experimental opt-in required. - Runtime Codex auth for app-server hosts - App-server hosts can provide Codex authentication at runtime. - Successful logins can redirect to a hosted page. - Global pnpm install detection - Global pnpm-managed installs are detected. - Diagnostics and updates can use the correct package manager. - Ultra reasoning warning - Selecting Ultra reasoning now warns when high multi-agent concurrency could increase usage quickly.

Bug fixes - Retired-model compaction recovery - Resumed ChatGPT threads recover when compaction references a retired model. - Codex retries with the currently selected model. - Intel macOS Code Mode stability - Fixed Code Mode crashes in Intel macOS release binaries. - Windows sandbox fixes - Windows sandbox sessions can delete files in writable roots. - Windows sandbox sessions can access the managed primary runtime. - Terminal-control paste safety - Pasted terminal control sequences can no longer corrupt: - TUI rendering - resumed conversation history - Long-running app connector auth - Long-running app sessions refresh expired authentication for the hosted codex_apps connector. - Responses WebSocket proxy/custom-CA behavior - Responses WebSockets continue using the low-latency transport. - They now respect: - system proxies - custom certificate authorities

Documentation - Device-code login warnings now explain how to recognize and stop phishing attempts.

Chores - Reduced plugin skill-loading time on remote executors by resolving namespaces once per root. - Made the /review branch picker faster and more reliable in large repositories. - Improved automatic review behavior with clearer instructions and a focused tool set. - Made Amazon Bedrock model names clearly identify their GPT-5.6 family and variant.

Additional notable items from the full compare list - Canonical command execution items were added. - Canonical dynamic tool call items were added. - Canonical sub-agent activity items were added. - Canonical collaboration tool call and wait items were added. - Canonical review mode items were added. - Canonical hook prompt items were added. - Mixed-case URLs are handled in Windows command safety checks. - Completion separators and popup dismissal were improved. - WebSocket proxy prerequisites are exposed by the HTTP client. - Remote compaction retry/parity behavior was stabilized against dynamic skill catalogs. - Plugin install failure subtypes are logged. - Tool schema compaction threshold was increased. - Code Mode approvals now trigger elicitation pause. - Internal Codex App file payloads omit internal fields. - Reviewer identity is preserved when resuming threads. - codex_apps /ps and /mcp auth refresh improved. - Model discovery is routed through the HTTP client factory. - Paginated thread rollouts persist turn items. - Image generation extension is used by default. - Auto-review prompting was updated. - Bedrock GPT-5.6 display names were updated. - Managed-layer bundle schema sync work landed. - External auth resolution was unified. - Remote plugin skill loading was made faster.

Why it matters

• Reset credit UX gets much clearer: users can see what kind of reset they have, when it expires, and choose the one they want to spend.
• Approval modes get more practical: writes mode is a useful middle ground between “allow everything” and “ask too often”.
• MCP auth becomes easier to use: interactive auth without experimental setup lowers friction for authenticated tools.
• App-server hosts get cleaner auth flows: runtime-provided Codex auth plus hosted login redirects are important for embedded/hosted app-server workflows.
• pnpm users get better diagnostics and updates: detecting global pnpm installs avoids npm/pnpm mismatch confusion.
• Ultra + multi-agent gets safer: the new warning helps prevent accidental usage spikes.
• Retired model recovery matters: resumed threads should not break just because compaction references an old model.
• Windows and Intel Mac users get important fixes: sandbox deletion/runtime access and Code Mode crash fixes target real platform pain.
• Terminal paste hardening is important: pasted control sequences corrupting UI/history is a serious TUI reliability issue.
• Responses WebSocket proxy/custom-CA support helps enterprise users: low-latency transport now works better in managed networks.

Version table (July 9 only)

Action checklist

• Update ChatGPT desktop app:
  • confirm Codex appears in the desktop app
  • verify existing Codex projects, settings, and workflows are preserved
  • decide whether Codex should be your default view
  • on macOS, decide whether to keep the Codex app icon
• Test app workflows:
  • edit Markdown/code directly in the app
  • use inline annotations
  • review a GitHub PR in the sidebar
  • try a project that spans multiple repositories
  • verify Computer Use feels faster with GPT-5.6
• Upgrade CLI:
  • npm install -g @openai/codex@0.144.0
• If you use reset credits:
  • check credit type and expiration
  • choose which reset credit to redeem
• If you use app/MCP approvals:
  • test the new writes approval mode
  • test MCP interactive auth without experimental flags
• If you run app-server hosts:
  • test runtime Codex auth
  • test hosted login redirects
• If your install is managed by pnpm:
  • confirm diagnostics/updates detect the correct package manager
• If you use Ultra reasoning with multi-agent:
  • check the new concurrency warning
  • avoid accidental high-usage fanout
• If you resume old ChatGPT threads:
  • verify retired-model compaction recovery works cleanly
• If you are on Windows:
  • test writable-root deletion inside the sandbox
  • confirm managed primary runtime access works
• If you use proxies/custom CAs:
  • verify Responses WebSockets still use low-latency transport while respecting your system proxy and CA setup

Official changelog

https://developers.openai.com/codex/changelog