OpenAI Codex CLI

New Features

• Opt-in instant_interrupt lets new input steer Codex during model responses or long-running code-mode calls. (#48135, #48141)

• New sessions get a compact welcome screen and consistent headers, with occasional tips during and after turns. (#48513, #48562, #48352)

• The warnings viewer dismisses reviewed warnings when closed; press k to keep one for later. (#48205, #48206)

• You can scroll the transcript while deciding whether to implement a plan. (#48805)

• Native Mermaid rendering supports more flowchart edges, labels, and node groups. (#48814, #48895)

• App-server clients can paginate thread history from a specific item. (#48151)

Bug Fixes

• Windows launches avoid stray console windows for MCP servers, code-mode hosts, and piped commands; restrictive launchers can fall back to embedded mode. (#48138, #48238, #48483, #48491)

• Copying transcript selections preserves Markdown tables, formatting, and significant whitespace. More terminals now copy automatically on selection. (#48548, #48549, #48469)

• Blank sessions retain drafts when switching tasks, and threads can be archived and listed before their first turn. (#48628, #48828, #48199)

New Features

• Configure copy-on-select and right-click paste in the fullscreen TUI. Copied transcript selections now preserve Markdown formatting. (#47639, #47896, #48118)

• Connect to MCP servers that require pre-registered OAuth client secrets, including through codex mcp add --oauth-client-secret. (#47891)

• Secure direct exec-server WebSocket connections with bearer tokens, including connections configured through app-server. (#47601, #47648)

• Image generation and editing can explicitly request transparent backgrounds, and edits now accept file-backed conversation images. (#47484, #47956)

• Terminal input approval is enabled by default for commands running with elevated permissions; runtime-only grants no longer cause unnecessary reviews. (#47799, #48073)

Bug Fixes

• Fixed Windows sandbox failures involving ordinary Windows 10 paths, rejected stored credentials, and large permission policies. (#47672, #47695, #47919)

• Fixed Linux sandbox startup with nested writable roots and preserved Git metadata protections across writable roots on Linux and macOS. (#47623, #47974)