Codex CLI 0.147.0: Agent Plugins, opt-in MCP 2026-07-28, `--full-auto` removed

New features

• Install portable Agent Plugins; search local, personal, workspace, and remote plugin catalogs (#36544, #36409, #36919, #36796)
• Persistent, manually ordered conversation sections and incremental browsing of long transcripts (#35722, #36007, #36380, #36948, #36950)
• --approve-for-me flag for automatically reviewed approvals (#36373)
• Import Cursor-managed skills; sync changes to imported Claude and Cursor conversations without duplicates (#36361, #36356, #35623)
• Opt-in MCP 2026-07-28 protocol: paginated discovery, multi-round requests, non-blocking server startup (#35724, #35725, #35590, #35742)
• Cached web search and remote conversation compaction for Amazon Bedrock (#36938, #36981)

Bug fixes

• Redact secrets and complete bearer tokens from displayed commands and replayed history (#36893, #36908)
• Fix lost/stalled terminal input on focus return, MCP init, and Ghostty keyboard shortcuts (#35649, #35957, #36834)
• Fix rendering and cursor positioning for Japanese characters, emoji, hyperlinks, and text near viewport boundaries
• Correct Windows background-process interruption and filesystem path handling
• Require explicit trust for unfamiliar local projects; enforce managed authentication restrictions before credentials are used (#36960, #37132)
• Harden plugin isolation; deny network access when policy updates fail (#37027, #36967, #36037)

Removals and chores

• Removed deprecated codex exec --full-auto — use --sandbox workspace-write (#36054)
• Stopped publishing redundant Linux bundle archives; use codex-package-<target> archives (#36342)
• MCP SDK to 3.0.0, Ratatui to 0.30.2, V8 to 150.4.0
• macOS release notarization moved to Azure Key Vault instead of exporting private signing keys (#37154)