Codex Updates & Release Notes

New Features

• Open /config to search preferences across categories, change supported settings immediately, and see which changes require a restart. (#52990, #53429)
• Send a follow-up while Codex is responding to steer it immediately. Interrupting a turn also stops active Code Mode cells and their nested tool calls. (#51812, #51835)
• Configure a leader key in /keymap. The default is Ctrl+X, shortcut hints stay open until you choose or cancel, and voice mute moves to F9. (#52273)
• Restart a managed background server from /daemon. Codex warns about work the restart could interrupt, then reconnects automatically. (#53173)
• Codex can run independent read-only tools in parallel, including skill, memory, and conversation-history lookups. (#52245)
• Daybreak is enabled by default for eligible accounts. codex exec can also select it with an OpenAI API key when the server offers access. (#53701, #53717)

Bug Fixes

• Resuming a saved thread restores its permissions and network approvals, while respecting explicit overrides and current managed policy. (#53150, #53419, #53424)
• The network proxy now checks permission before a DNS lookup, rejects duplicate Host headers, and prevents credential aliases from bypassing inspection hooks. (#51650, #52661, #53506)
• Return to an existing side conversation with /side after switching threads. Answers to pending prompts also go back to the thread that asked. (#52184, #53436)
• On Windows, Ctrl+V and Shift+Insert paste text as well as images. On WSL, repeated pastes reuse the clipboard reader, and copy attempts time out instead of hanging. (#53224, #52967, #53453)
• Local commands finish promptly when a child keeps an output pipe open. Remote commands preserve late-arriving output so the final poll can still collect it. (#52652, #53331, #53622)
• codex exec no longer prints the same file diff again after an unrelated command. (#53444)

Documentation

• Updated the bundled OpenAI Docs guidance for migrations to the GPT-6 family, including model-specific reasoning, tool use, and data residency considerations. (#51768)
• Clarified how the Linux sandbox uses bubblewrap for filesystem isolation and seccomp for syscall filtering. (#52610)

Chores

• Codex now uses its standard shell executor and no longer bundles a patched zsh. Configurations using the retired shell flags receive a migration notice. (#52160, #52213)
• Reduced Linux and macOS release package size by stripping symbols from packaged binaries while preserving them in the original build outputs. (#52178)

Changelog

Full Changelog: rust-v0.162.0...rust-v0.163.0

• #51539 Add completion-aware realtime attachment and session-scoped detach @zahan-oai
• #51547 Add a Windows MXC sandbox opt-out @iceweasel-oai
• #51556 Complete dynamic tool lifecycles on cancellation @mikelam-oai
• #51575 Expose package assembly helpers and support gzip DotSlash artifacts @bolinfest
• #51595 Add thread ID exclusions to thread/list @btraut-openai
• #51602 Distinguish thread listing failures from exhausted history @btraut-openai
• #51611 Signal abandonment of unanswered MCP elicitations @nicksteele-oai
• #51627 Stabilize Guardian snapshot prefixes by separating assistant context @jif-oai
• #51642 Fix retained context handling for typed section content @jif-oai
• #51650 Require hostname authorization before proxy DNS lookups @jif-oai
• #51651 Persist Guardian review failures for reports across restarts @jif-oai
• #51652 Record telemetry for AGENTS.md changes made by apply_patch @jif-oai
• #51678 Move Windows sandbox tests into a dedicated integration binary @jif-oai
• #51683 Roll back stale Guardian reviews before reusing reviewer history @olliem-oai
• #51689 Wait for helper completion in HTTP header cancellation tests @jif-oai
• #51690 Add a feature flag for Code Mode tool description ordering @swastik-oai
• #51704 Honor tool-description-first ordering in Code Mode @swastik-oai
• #51710 Fix a discovery race in the external auth refresh test @jgershen-oai
• #51734 Load persisted sender context for Guardian reviews @jif-oai
• #51755 Reuse MCP handler metadata for cache comparisons @owenlin0
• #51761 Reduce tool metadata cloning in the code-mode runtime @akira-oai
• #51768 Expand OpenAI Docs migration guidance to the GPT-6 model family @kkahadze-oai
• #51775 Prevent recursive Tokio tracing in telemetry and SQLite logs @zbarsky-openai
• #51786 Preserve sandbox overrides across execution requests @iceweasel-oai
• #51794 Advertise Ultrafast for GPT-6.1 Sol on Amazon Bedrock @celia-oai
• #51800 Remove duplicate field initializers in extension registry tests @anp-oai
• #51808 Preserve diagnostic reasons for MCP user verification failures @berkdeniz-oai
• #51812 Enable instant interrupts by default @pakrym-oai
• #51819 Migrate the MXC sandbox to the 1.0.0 SDK @iceweasel-oai
• #51822 Avoid sharing violations when repairing Windows runtime ACLs @johnl-oai
• #51823 Share MCP binding tool metadata with prepared calls @owenlin0
• #51828 Add policy-based file contents integrity checks @iceweasel-oai
• #51831 Add MXC sandbox integrity dependency and policy preparation @iceweasel-oai
• #51835 Enable code mode interruption by default @won-openai
• #51840 Add a bubblewrap backend for sandbox integrity checks @iceweasel-oai
• #51841 Add a macOS Seatbelt backend for sandbox integrity @iceweasel-oai
• #51842 Add a sandbox integrity runner with outcome and timing metrics @iceweasel-oai
• #51843 Run sandbox integrity checks before commands and filesystem operations @iceweasel-oai
• #51847 Preserve Cargo package names in Bazel Rust builds @dkovalenko-oai
• #51848 Align Bazel release builds with Cargo and fix platform compatibility @dkovalenko-oai
• #51849 Fix package smoke tests for Cargo and Bazel debug symbols @dkovalenko-oai
• #51850 Add Bazel release staging archives @dkovalenko-oai
• #51855 Add Bazel support to the Codex package build action @dkovalenko-oai
• #51856 Build Bazel release artifacts alongside Cargo artifacts @dkovalenko-oai
• #51857 Add an app-server prompt prefix compatibility test @jif-oai
• #51865 Use readable plugin mentions without suppressing same-name skills @canvrno-oai
• #51866 Preserve line breaks and links in multiline async questions @pash-openai
• #51868 Record tool registration metrics for each sampling request @akira-oai
• #51872 Keep global app-server config independent of the launch directory @etraut-openai
• #51884 Add experimental prediction forks that inherit parent context @liame-oai
• #51890 Add the missing mxc-sdk UTF-8 resource patch for Bazel @iceweasel-oai
• #51892 Preserve tool call completeness when recorded arguments are truncated @ningyi-oai
• #51893 Record metrics for incremental tool updates @akira-oai
• #51895 Report specific reasons for WebSocket continuation failures @pakrym-oai
• #51896 Preserve native errors in Windows sandbox ACL diagnostics @alishobeiri-oai
• #51897 Use a dedicated matcher for network domain policies @rafael-oai
• #51908 Honor the user input setting for asynchronous questions @mandal-OAI
• #51930 Support model-specific function description prefixes @tz-openai
• #51963 Attribute compaction analytics to the correct voice session @reia-oai
• #51974 Log Windows sandbox availability and backend selection @iceweasel-oai
• #52034 Preserve agent state when unloading idle multi-agent v2 children @jif-oai
• #52040 Add regression coverage for cancelled agent reloads @jif-oai
• #52048 Cover instant interruption in steered-input persistence tests @jif-oai
• #52061 Run Guardian conversation classifiers concurrently and preserve action order @felixxia-oai
• #52062 Add scenario coverage for worker context across idle eviction @jif-oai
• #52065 Require assessment text in the Guardian parser @ioanbudea-OAI
• #52081 Fix idle cleanup for disconnected multi-agent v2 children @jif-oai
• #52119 Expose originating tool call metadata in command environments @leo-oai
• #52160 Remove the patched zsh shell execution backend @jif-oai
• #52164 Make environment context date and timezone configurable @surajs-oai
• #52176 Show AWS GovCloud guidance at startup and remember acknowledgment @jackz100
• #52177 Set a User-Agent for package archive downloads @bolinfest
• #52178 Strip symbols from source-built release package binaries @bolinfest
• #52182 Expose a verified sandbox launcher to local MCP servers @bolinfest
• #52183 Add optional descriptions to agent message board channels @jif-oai
• #52184 Preserve side conversations across thread navigation @etraut-openai
• #52193 Enforce managed MXC requirements on Windows @iceweasel-oai
• #52195 Track source attribution for individual context parts @tz-openai
• #52200 Allow plugin toggles while searching and preserve filters on refresh @fcoury-oai
• #52203 Expose Codex lifecycle status in iTerm2 sessions @fcoury-oai
• #52213 Stop bundling patched zsh in Codex packages @jif-oai
• #52215 Enforce application network policy in standalone MCP commands @lsingh-oai
• #52220 Add configurable default plugin activation policy @stevenlee-oai
• #52223 Enforce application network policy for daemon updates @jackz100
• #52225 Fix config rebuild call in the Windows MXC preference test @virajrai-oai
• #52226 Include foreground activity in iTerm2 session status @fcoury-oai
• #52228 Honor API-key feature gates in TUI Daybreak selection @julee-oai
• #52234 Support request IDs in exec-server WebSocket handshakes @mattj-openai
• #52235 Recover gRPC code-mode sessions after missing-session errors @surajs-oai
• #52241 Preserve subagent capabilities independently of forked history @anp-oai
• #52245 Enable parallel execution for read-only tools @zamoshchin-openai
• #52250 Add opt-in Guardian trust for orchestrator connector identities @ankushg
• #52256 Normalize formatting in docs, web assets, and sample scripts @anp-oai
• #52268 Preserve large arguments in executed tool call metadata @ningyi-oai
• #52270 Enable text selection

Composer predictions adds autocomplete-style suggestions for your next message in the Codex desktop app. After Codex responds, it uses the current conversation to suggest a follow-up prompt in the message box. Press Tab to accept the suggestion as an editable draft, or type your own message. Accepting a prediction doesn’t send it for you.

The feature is available in beta to users aged 18 and older with personal ChatGPT Pro plans in supported regions, in local and SSH threads with GPT-6 Astra and GPT-6.1 Sol.

Learn more about composer predictions.

New Features

• Add tools for creating and listing managed Git worktrees from trusted local projects when the worktrees feature is enabled. (#50148)
• Pin tasks in the agent Command Center with p and keep them in a shared Pinned group when supported by the server. (#51500)
• Navigate and copy transcript blocks with /copy, use Ctrl+Insert to copy selections, and tune mouse-wheel scrolling with tui.mouse_scroll_speed. (#50434, #50215, #50209)
• Make URLs clickable in approval headers, questions, MCP prompts, warnings, banners, and verification prompts, including when links wrap across lines. (#51439, #51449, #51450, #51451, #51452, #51458)
• Configure live web access and remote compaction capabilities for custom Responses-compatible model providers. (#50459)
• Add JavaScript helpers for streaming promise results as they settle, plus opt-in ranked tool search in Code Mode. (#51126, #51209)

Bug Fixes

• Respect server model and reasoning-summary defaults for new TUI threads while retaining explicit launch overrides. (#50013, #50811, #50913)
• Preserve existing CRLF line endings in apply_patch updates without requiring an opt-in. (#51203)
• Fix Linux sandbox startup with multiple denied files, reject writable sandbox-construction executables, and keep ripgrep configuration from weakening deny-glob masks. (#50059, #51211, #51407, #51527)
• Restore ordinary drive-letter file access on Windows 10 and match Windows sandbox temp permissions to the child process environment. (#51511, #51512)
• Honor server Retry-After advice for retryable Responses and WebSocket failures. (#50418, #51440)
• Fix archive checksum verification when installing through Windows PowerShell with PowerShell 7 module paths present. (#51257)

Chores

• Publish a signed PowerShell installer with Windows releases. (#51158)
• Keep older stable releases and prereleases from replacing newer stable download targets or installer aliases. (#51186, #51425)

Changelog

Full Changelog: rust-v0.161.0...rust-v0.162.0

• Honor server model defaults when starting fresh TUI threads @etraut-openai
• Use descriptor-safe helpers for executable test fixtures @jif-oai
• Protect the guardian decisions API key from environment forwarding @swastik-oai
• Preserve user restrictions in Guardian handoff context @jif-oai
• Follow MCP tool pagination in legacy protocol mode @jif-oai
• Keep transcript Find results readable after closing the query @fcoury-oai
• Keep transcript Find expansion scoped to the current match @fcoury-oai
• Stabilize Windows voice build cache keys across tool reinstalls @anp-oai
• Keep plugin and skill snapshots scoped to each step @sayan-oai
• Preserve question context in recovered TUI answer drafts @imac-oai
• Check token estimate filtering directly on the tracing subscriber @tamird
• Upgrade Windows bindings to windows-sys 0.61.2 @tamird
• Fix Linux sandbox startup with multiple denied files @yuzhu-oai
• Add a bounded Decisions transport for Guardian comparison classification @swastik-oai
• Enable dynamic tool inheritance for fresh V2 subagents @ke-oai
• Add paginated reverse lookup for thread attachments @joeytrasatti-openai
• Preserve queued agent mail across session eviction @jif-oai
• Prevent shared instruction providers from delegating to themselves @bryanashley
• Add attachment owner lookup to the app-server @joeytrasatti-openai
• Add opt-in Decisions comparison for Guardian V2 @swastik-oai
• Consolidate chat composer footer logic in footer_state @imac-oai
• Keep fullscreen prompts bounded and scrollable @imac-oai
• Centralize TUI loading glyphs and frame scheduling @imac-oai
• Add a native gRPC client for cloud thread resume and attach @bc-openai
• Expose the model selected for a running turn's next step @sayan-oai
• Preserve Windows environment variables for remote MCP servers @aidanv-oai
• Add opt-in JSON diagnostics for TCP tunnels @richardopenai
• Use the server permission catalog for TUI permission shortcuts @etraut-openai
• Add managed worktree tools to the TUI @bc-openai
• Bound in-flight file opens in exec-server @anp-oai
• Upgrade age to 0.12.1 and remove the obsolete advisory exception @michaelm-openai
• Enable writable file streaming in exec-server @anp-oai
• Add dots to issue labeler guidance @etraut-openai
• Replace the Figma OAuth exception with Mercado Pago @mzeng-openai
• Restore the account email in /status after account updates @etraut-openai
• Report the configured TUI mode in codex doctor @etraut-openai
• Release stable Markdown tables into scrollback during streaming @etraut-openai
• Make transcript mouse scroll speed configurable @etraut-openai
• Support Ctrl+Insert for copying TUI selections @etraut-openai
• Use the shared text editor for command-center task renaming @bc-openai
• Bound tmux option probes to one second @etraut-openai
• Record Guardian V2 Decisions agreement and latency metrics @swastik-oai
• Add end-to-end coverage for MCP sandbox state enforcement @bolinfest
• Keep the subagent picker consistent with thread archive state @etraut-openai
• Back off automatic remote control reconnects with jitter @cooper-oai
• Skip unrelated subtrees during config alias normalization @btraut-openai
• Render ANSI styles in TUI hook system messages @etraut-openai
• Remove initial messages from session configuration events @owenlin0
• Use printable ASCII terminal titles under GNU Screen @imac-oai
• Fix thread unloading after disconnect during MCP startup @yuzhu-oai
• Allow opting into 16 KiB ARM64 code pages for macOS signing @chess-oai
• Honor configured keybindings before transcript navigation @etraut-openai
• Honor pager bindings for transcript page keys @bc-openai
• Consolidate command execution output into aggregated_output @owenlin0
• Clarify Git worktree choices for new and forked conversations @bc-openai
• Honor Retry-After headers in failed Responses events @anp-oai
• Cap persisted command output in paginated history at 64 KiB @owenlin0
• Preserve terminal hyperlinks in agents overview previews @bc-openai
• Allow API-key accounts to use Daybreak in the TUI @etraut-openai
• Add keyboard copy selection to the owned transcript @bc-openai
• Persist additional tool definitions in rollout history @pakrym-oai
• Add a CLI command to uninstall the legacy Windows sandbox @chess-oai
• Support ordered response items in world-state context updates @pakrym-oai
• Preserve native USD amounts in thread usage responses @asohrabi-oai
• Stabilize paused-time code-mode service tests @seanh-oai
• Assert that only direct tool calls emit timing events @seanh-oai
• Bundle rollout attachments into a gzip tar archive @dkovalenko-oai
• Remove the provider capability gate for tool namespaces @pakrym-oai
• Measure rollout persistence size reductions @owenlin0
• Truncate oversized MCP results in paginated thread history @owenlin0
• Add capability overrides for custom model providers @celia-oai
• Populate thread previews from delegated task inputs @bc-openai
• Add the incremental_tools feature flag @pakrym-oai
• Retry registry authentication outages and jitter executor reconnects @apanasenko-oai
• Copy transcript selections as literal text while preserving rich HTML @fcoury-oai
• Account for JSON overhead when truncating MCP tool results @owenlin0
• Enable Ultrafast service tiers for Amazon Bedrock Astra models @celia-oai
• Use the app-server default output cap for TUI workspace commands @etraut-openai
• Skip managed config loading for registered Windows sandbox refreshes @zm-oai
• Include installer stderr in daemon update failures @etraut-openai
• Use Enter to accept transcript Find results and Escape to cancel @fcoury-oai
• Center TUI confirmations over their retained backdrop @bc-openai
• Keep Command Center selection adjacent after task removal @bc-openai
• Record Windows sandbox service stop diagnostics @zm-oai
• Require GovCloud guidance acknowledgment after Bedrock setup @jackz100
• Add scenario coverage for remote /compact context preservation @pakrym-oai
• Reject unknown TUI keys in strict config validation @etraut-openai
• Persist realtime transcript tails before closure without inference @guinness-oai
• Keep shared MCP types stable in Code Mode exec descriptions @aibrahim-oai
• Send incremental tool catalog updates in Responses Lite @pakrym-oai
• Keep MCP resource helpers available in code mode @aibrahim-oai
• Skip daemon auto-start for Windows-mounted WSL homes @etraut-openai
• Avoid reading the current directory when resolving absolute paths @etraut-openai
• Distinguish daemon release identity from executable contents @etraut-openai
• Keep Code Mode tool discovery guidance stable across catalog changes @aibrahim-oai
• Allow transcript selection and copying while bottom modals are open @etraut-openai
• Keep third-party tools deferred in strict Code Mode Only @aibrahim-oai
• Preserve local Markdown link labels in the TUI @bc-openai
• Let the transport create the Windows remote-control socket directory @etraut-openai
• Decode Windows Terminal's mapped Shift+Enter sequence @bc-openai
• Show model and reasoning effort near the top of task details @etraut-openai
• Keep environment-backed tools exposed across readiness changes @won-openai
• Show unavai...

New Features

• GPT-6.1 Sol is now the default model in the bundled and Amazon Bedrock catalogs. (#49318, #49339)
• Amazon Bedrock supports multi-agent V2 and Ultra reasoning on compatible models; Bedrock Mantle also accepts AWS GovCloud regions. (#49345, #49813)
• Sign in to MCP servers from an active terminal session with /mcp login <name>. (#49290)
• Choose your microphone, speaker, and microphone input channels for voice conversations, with preferences saved locally. (#49437, #49836)
• Daybreak is opt-in through --enable cli_daybreak or features.cli_daybreak=true; daybreak=true alone is insufficient. By default, controls and indicators are hidden, /daybreak is unavailable, and automatic Cyber routing is omitted—even for saved Daybreak threads. Saved preferences remain intact. Opt-in routing requires eligible ChatGPT sign-in, the OpenAI provider, and advertised model/program support. (#49856, #49858, #49859, #49861, #51207)
• Select a Cyber access program per turn with codex exec --cyber-access-program or the TypeScript SDK’s cyberAccessProgram option. The explicit exec override remains available with cli_daybreak disabled and leaves the saved choice unchanged. (#49939, #51207)

Bug Fixes

• Approved filesystem escalation can now grant broader write access while preserving denied reads and network restrictions. Background tasks retain their originating turn’s permissions. (#49353, #49880)
• Explicit launch permissions survive terminal reconnects and new sessions, while implicit client settings no longer overwrite server or saved-thread web-search settings. (#49809, #49799)
• Elevated Windows terminal sessions can start using an embedded server, and sandboxed PowerShell preserves relative paths beneath protected user profiles. (#49855, #49690)
• Enter correctly submits buffered input after paste detection expires, including in Vim insert mode. (#49810)
• Thread resume includes the latest committed history. Startup detects recoverable SQLite corruption earlier and preserves damaged databases as backups. (#49599, #49701)
• Responses retries and WebSocket-to-HTTP fallback honor server retry guidance, reducing premature failures during overload. (#49441)

Documentation

• Authentication guidance now accounts for keyring storage instead of implying credentials always reside in auth.json. (#49361)

Chores

• Publishing an older alpha or hotfix no longer moves npm alpha tags backward. (#49704)

Changelog

Full Changelog: rust-v0.160.0...rust-v0.161.0

New Features

• Browse older tasks in the agent command center with a keyboard-accessible “Show more” action. (#49106)
• Select transcript text and paste with middle-click in fullscreen mode on supported local Linux X11 terminals. (#49112)
• Start sessions outside a project with workspace defaults when policy permits, and restore saved permissions when resuming. (#49160)
• Added opt-in Guardian review capabilities to retrieve earlier user instructions and include context from agent handoffs. (#49036, #49057)

Bug Fixes

• Unsent queued messages now resume after reconnection once uncertain submissions are resolved, avoiding duplicate sends. (#49105)
• The terminal UI now preserves server provider, reasoning-summary, and verbosity settings and shows the correct sessions in resume and fork history. (#49144, #49161, #49171)
• Fixed Windows sandbox PowerShell fallbacks and long-path permission repairs, and suppressed unwanted console windows from background helpers. (#49019, #49058, #49098, #49164, #49386)
• Subagents now retain environments that are still starting and receive their configuration or preparation failure. (#49075)
• Prevented SQLite stalls during connection setup and logging, and surfaced initialization errors instead of masking them as timeouts. (#49032, #49102)
• Explicit provider model catalogs no longer include unsupported bundled models or reuse stale entries after refresh failures. (#49135)

Documentation

• Clarified how provider credentials use the configured storage backend and how env_key identifies the API-key environment variable. (#49118)

Chores

• Reduced repeated plugin-loading work by caching parsed manifests and reusing HTTP connections for remote plugin requests. (#49099, #49100)
• Added background reclamation of unused log database space to reduce disk usage. (#49069)

Changelog

Full Changelog: rust-v0.159.0...rust-v0.160.0

New Features

• Opt-in instant_interrupt lets new input steer Codex during model responses or long-running code-mode calls. (#48135, #48141)
• New sessions get a compact welcome screen and consistent headers, with occasional tips during and after turns. (#48513, #48562, #48352)
• The warnings viewer dismisses reviewed warnings when closed; press k to keep one for later. (#48205, #48206)
• You can scroll the transcript while deciding whether to implement a plan. (#48805)
• Native Mermaid rendering supports more flowchart edges, labels, and node groups. (#48814, #48895)
• App-server clients can paginate thread history from a specific item. (#48151)

Bug Fixes

• Windows launches avoid stray console windows for MCP servers, code-mode hosts, and piped commands; restrictive launchers can fall back to embedded mode. (#48138, #48238, #48483, #48491)
• Copying transcript selections preserves Markdown tables, formatting, and significant whitespace. More terminals now copy automatically on selection. (#48548, #48549, #48469)
• Blank sessions retain drafts when switching tasks, and threads can be archived and listed before their first turn. (#48628, #48828, #48199)
• Local ChatGPT sign-in opens the browser reliably; onboarding also provides a shortcut to copy the login link. (#48502, #48544)
• Approved commands retain explicit filesystem denials, and .aws directories are protected by default under writable roots. (#48155, #48176)
• Fixed macOS TLS access in network-enabled sandboxes and remote environments that require proxy access. (#48565, #48198)

Chores

• Removed automatic follow-up prompt suggestions and the tui.prompt_suggestions setting. (#48621)
• Removed the bundled plugin-creator skill. (#48604)

Changelog

Full Changelog: rust-v0.158.0...rust-v0.159.0

New Features

• Configure copy-on-select and right-click paste in the fullscreen TUI. Copied transcript selections now preserve Markdown formatting. (#47639, #47896, #48118)
• Connect to MCP servers that require pre-registered OAuth client secrets, including through codex mcp add --oauth-client-secret. (#47891)
• Secure direct exec-server WebSocket connections with bearer tokens, including connections configured through app-server. (#47601, #47648)
• Image generation and editing can explicitly request transparent backgrounds, and edits now accept file-backed conversation images. (#47484, #47956)
• Terminal input approval is enabled by default for commands running with elevated permissions; runtime-only grants no longer cause unnecessary reviews. (#47799, #48073)

Bug Fixes

• Fixed Windows sandbox failures involving ordinary Windows 10 paths, rejected stored credentials, and large permission policies. (#47672, #47695, #47919)
• Fixed Linux sandbox startup with nested writable roots and preserved Git metadata protections across writable roots on Linux and macOS. (#47623, #47974)
• macOS patch operations now recognize system path aliases covered by existing permissions, avoiding unnecessary approval prompts. (#47879)
• Approval reviews now retry when new user input arrives, so a status question does not automatically abort a pending action. (#47819)
• Mermaid flowcharts now render quoted labels and ampersands; unsupported diagrams explain why they fall back to source. (#47572, #47678)
• Command completion events now include early output and report process-launch failures to clients. (#47529, #47665)

Changelog

Full Changelog: rust-v0.157.0...rust-v0.158.0