Codex CLI 0.147 combines several changes that affect different trust boundaries. Treating the upgrade as one pass/fail event misses the failures that matter.
The short answer
Test five things independently:
- One portable Agent Plugin.
- One
--approve-for-meboundary. - One MCP server using the opt-in 2026-07-28 protocol.
- One imported skill or conversation.
- One interrupted Windows background process.
A successful launch proves only that Codex started. It does not prove that plugin provenance, approval scope, protocol negotiation, imported context, or process cleanup are correct.
Agent Plugins need a provenance receipt
Portable plugins can move instructions, tools, apps, and supporting files between environments. Before activation, record:
- source repository and reviewed revision,
- enabled scope,
- declared tools and network destinations,
- expected files or commands,
- one allowed operation and one denied operation.
Then disable the plugin and start a fresh session. The capability should disappear. Catalog visibility is not execution proof.
--approve-for-me is not unrestricted execution
The flag adds automatic approval review. It does not erase the sandbox, network policy, managed restrictions, or the need to verify side effects.
Use a disposable workspace and check:
- one operation that should be approved,
- one operation that should remain denied,
- the exact artifact created,
- the command and network evidence,
- the result after restarting the session.
Codex 0.147 also removes the deprecated codex exec --full-auto shortcut. Unattended workflows should declare sandbox and approval behavior explicitly.
MCP needs a protocol-level check
Opt-in MCP 2026-07-28 support adds capabilities such as paginated discovery and multi-round requests. A connected server can still fail during tool discovery, schema validation, one invocation, or response handling.
Record the negotiated protocol version, enumerate tools, call one bounded tool, and verify the artifact outside Codex.
Imported context needs ownership rules
Cursor-managed skills and imported Claude or Cursor conversations increase reusable context. They also increase the chance of stale instructions, duplicate guidance, and hidden conflicts.
Pin the source, inspect references, run a known-answer task, and confirm which instruction won when scopes conflict.
Windows needs a real interruption test
The release includes Windows process and path fixes. Verify them by starting a harmless bounded background task, interrupting it, and checking both the process tree and expected artifact state. A quiet terminal is not proof that the child process stopped.
Release gate
Upgrade only when every boundary has its own evidence receipt. If one check fails, roll back or disable only that capability instead of deleting unrelated configuration.
Official release:
https://github.com/openai/codex/releases/tag/rust-v0.147.0
Complete source-linked analysis and acceptance checklist:
https://tgwise.com/intelligence/codex-cli-0-147-agent-plugins-approve-for-me-mcp/
