chore(deps): update dependency openai/codex

[renovate]

This PR contains the following updates:

Package	Update	Change
openai/codex	minor	0.139.0 → 0.140.0
openai/codex	minor	rust-v0.139.0 → rust-v0.140.0

---

Release Notes

openai/codex (openai/codex)

v0.140.0: 0.140.0

Compare Source

New Features

• Added /usage views for daily, weekly, and cumulative account token activity. (#​27925)
• /goal now preserves oversized text, large pasted blocks, and image attachments, including in remote app-server sessions. (#​27508, #​27509, #​27510)
• Added permanent session deletion through codex delete, /delete, and app-server thread/delete, with confirmation safeguards and subagent cleanup. (#​25018, #​27476)
• Added /import for selectively importing setup, project configuration, and recent chats from Claude Code. (#​27070, #​27071, #​27703)
• Typing @ now opens the unified mentions menu for files, plugins, and skills by default. (#​27499)
• Added managed Amazon Bedrock API-key authentication and encrypted local storage for CLI and MCP OAuth credentials. (#​27443, #​27689, #​27504, #​27535, #​27539, #​27541)

Bug Fixes

• Corrupted SQLite state databases are now backed up and rebuilt automatically from rollout data, including malformed database-directory cases. (#​26859, #​27719)
• Prevented /review from crashing when Esc is pressed with queued guidance, while preserving that guidance when the review is canceled. (#​22879)
• Improved MCP reliability by retrying transient startup failures, reporting unusable OAuth credentials as logged out, and preserving explicitly disabled servers. (#​25147, #​26713, #​27414)
• Fixed remote plugin uninstall requests and correctly surfaced apps requiring authentication during installation. (#​27085, #​27223)
• Persisted “Don’t remind me” update dismissals reliably and cleared stale running-hook indicators after completed turns. (#​27619, #​27783)
• Non-TTY background commands can now be interrupted with Ctrl-C while preserving their final output and exit status. (#​26734)

Documentation

• Clarified contributor guidance around keeping crate APIs narrow and supporting Linux, macOS, and Windows. (#​27939, #​27966)

Chores

• Improved responsiveness for large repositories and long sessions by preserving Git’s built-in filesystem monitor, avoiding duplicate history reads, accelerating archive lookup, and caching turn-diff rendering. (#​26880, #​27031, #​27276, #​27489)
• Removed the experimental /realtime voice controls and related audio dependencies from the TUI. (#​27801)

Changelog

Full Changelog: openai/codex@rust-v0.139.0...rust-v0.140.0

• #​26880 [codex] preserve fsmonitor for worktree Git reads @​tamird
• #​27085 Use server app auth requirements for remote plugin install @​xl-openai
• #​27098 [codex] Return workspace directory installed plugins @​xl-openai
• #​27007 multi-agent: add path-based v2 activity tracking @​jif-oai
• #​27166 app-server: clear stale thread watches after v2 agent interruption @​jif-oai
• #​27080 [codex] Ignore pending PR review comments @​anp-oai
• #​26420 Avoid no-op backfill state writes @​zanie-oai
• #​27031 Avoid rereading rollout history during cold resume @​zanie-oai
• #​22879 fix: Prevent /review crash when entering Esc on steer message @​canvrno-oai
• #​27173 app-server: reject direct input to multi-agent v2 sub-agents @​jif-oai
• #​27184 Load selected executor skills through extensions @​jif-oai
• #​26835 [codex] Test extension API contracts @​anp-oai
• #​27063 [codex-analytics] add extensible feature thread sources @​marksteinbrick-oai
• #​26479 [codex] Speed up local nextest runs @​anp-oai
• #​27223 fix: use plugin service route for remote uninstall @​ericning-o
• #​22685 Add SOCKS5 TCP MITM coverage @​winston-openai
• #​26681 Allow creating a new goal after completion @​etraut-openai
• #​26711 Reduce TUI legacy core dependencies @​etraut-openai
• #​27110 [1/6] Add Python goal routing foundation @​aibrahim-oai
• #​27191 Route hosted Apps MCP through extensions @​jif-oai
• #​26830 [codex] Characterize global instruction lifecycle @​anp-oai
• #​26713 [codex] Report unusable MCP OAuth credentials as logged out @​anp-oai
• #​26734 [codex] Handle Ctrl-C for non-TTY unified exec @​pakrym-oai
• #​27116 Stop mirroring Codex user input into realtime @​guinness-oai
• #​27111 [2/6] Add private Python goal operations @​aibrahim-oai
• #​25147 [codex] Retry streamable HTTP initialize failures @​ssetty-oai
• #​27257 [codex] Tighten MCP connection manager API visibility and order @​aibrahim-oai
• #​26701 TUI Plugin Sharing 1 - add remote plugin identity @​canvrno-oai
• #​27129 feat: use provider defaults for memory models @​celia-oai
• #​27094 Add spans to build_tool_router @​mchen-oai
• #​24999 Add per-session realtime model and version overrides @​guinness-oai
• #​27078 [codex-analytics] emit goal lifecycle analytics @​marksteinbrick-oai
• #​27285 [codex] Fix post-merge analytics integration failures @​anp-oai
• #​27107 Add spans to run_turn @​mchen-oai
• #​27261 [codex] Make MCP connection startup fallible @​aibrahim-oai
• #​27174 feat: keep child MCP warnings out of parent transcript @​jif-oai
• #​27198 Use plugin-service MCP as the hosted plugin runtime @​jif-oai
• #​27375 [codex] Tag multi-agent spawn metrics with version @​jif-oai
• #​27383 Remove async-trait from extension contributors @​jif-oai
• #​27259 Use latest-wins MCP manager replacement @​charliemarsh-oai
• #​27264 [codex] Store compact window id in rollout @​pakrym-oai
• #​27280 [codex] add io PathUri native conversion APIs @​anp-oai
• #​27315 [codex] link Windows releases with LLD @​tamird
• #​27276 Reduce archive rollout lookup CPU @​etraut-openai
• #​27299 [codex] Outline ToolExecutor handler bodies @​anp-oai
• #​27391 Index visible thread list ordering @​zanie-oai
• #​27407 Fix compressed rollout search path matching @​jif-oai
• #​27304 [codex] Remove async_trait from ToolExecutor @​anp-oai
• #​26041 Add app-server background terminal process APIs @​etraut-openai
• #​25018 Add app-server thread/delete API @​etraut-openai
• #​26859 fix: Auto-recover from corrupted sqlite databases @​ddr-oai
• #​27064 [codex] remove blocking external agent migration flow @​stefanstokic-oai
• #​27421 [codex] Raise app-server recursion limit @​anp-oai
• #​27062 [codex] Retry transient Guardian review failures @​kbazzi
• #​27065 [codex] extract external agent import picker renderer @​stefanstokic-oai
• #​26409 [plugins] Inject remote_plugin_id into install elicitations @​adaley-openai
• #​27439 feat: make ThreadStore available on ThreadExtensionDependencies @​bolinfest
• #​27343 Guard core test subprocess cleanup @​etraut-openai
• #​27070 [codex] add external agent import picker UX @​stefanstokic-oai
• #​27321 [codex] Move release platform rules into bazel package @​anp-oai
• #​27071 [codex] add /import for external agents @​stefanstokic-oai
• #​27311 [codex] Skip local curated discovery for remote plugins @​xl-openai
• #​27414 [codex] Preserve disabled MCP servers across runtime overlays @​e-provencher
• #​27312 [codex] reuse release artifacts for npm staging @​tamird
• #​27319 Forward standalone assistant output to realtime @​guinness-oai
• #​27057 [codex] Add reusable OTEL gauge instruments @​richardopenai
• #​27245 image: add shared data URL preparation utilities @​fjord-oai
• #​27392 [codex-analytics] emit internally started turn events @​marksteinbrick-oai
• #​27322 [codex] Preserve build-script dependencies in rules_rs annotations @​anp-oai
• #​27489 core: cache turn diff rendering @​nornagon-openai
• #​27465 [codex] Remove redundant plugin app auth state @​xl-openai
• #​27484 Remove TUI legacy core test_support dependencies @​etraut-openai
• #​27476 Add session delete commands in CLI and TUI @​etraut-openai
• #​27247 core: resize all history images behind a feature flag @​fjord-oai
• #​27487 Trim TUI legacy telemetry and migration dependencies @​etraut-openai
• #​27438 [codex] Add token budget context feature @​pakrym-oai
• #​27501 [codex] Expand hosted web search citation guidance @​yuning-oai
• #​27526 tools: simplify default tool search text @​sayan-oai
• #​27488 [codex] Add new context window tool @​pakrym-oai
• #​27443 feat: add Bedrock API key as a managed auth mode @​celia-oai
• #​27532 [codex] Add comp_hash to model metadata @​aibrahim-oai
• #​27246 core: strip image detail from Responses Lite requests @​fjord-oai
• #​27517 [codex] Pass auth mode to plugin manager @​xl-openai
• #​27520 [codex] Compact when comp_hash changes @​aibrahim-oai
• #​27518 [codex] Add context remaining tool @​pakrym-oai
• #​27266 image: preserve metadata when resizing prompt images @​fjord-oai
• #​27103 [codex-analytics] report cached input tokens for v2 compaction @​rhan-oai
• #​27356 Use generic search metadata for dynamic tools @​sayan-oai
• #​27082 [codex-analytics] Emit structured compaction codex errors @​rhan-oai
• #​26513 [codex] Tune cloud config cache intervals @​alexsong-oai
• #​27387 skills: make backend plugin skills invocable without an executor @​jif-oai
• #​27403 skills: cache remote catalog failures per thread @​jif-oai
• #​27573 core: enable remote compaction v2 by default @​jif-oai
• #​27388 skills: expose remote skill resource tools @​jif-oai
• #​27569 multi-agent: move concurrency guidance into v2 usage hints @​jif-oai
• #​27585 nit: cap error @​jif-oai
• #​27404 test: cover referenced backend skill reads without an executor @​jif-oai
• #​27591 skills: render catalog locators by authority @​jif-oai
• #​27413 skills: decouple the skills extension from core @​jif-oai
• #​27527 [codex] publish npm packages concurrently @​tamird
• #​27528 [codex] publish DotSlash alongside npm @​tamird
• #​27529 [codex] download only release artifacts @​tamird
• #​27490 Remove TUI legacy Windows sandbox dependency @​etraut-openai
• #​27483 Emit plugin ID on MCP tool call analytics events @​chrisdong-oai
• #​27417 Print TUI session info on fatal exits @​etraut-openai
• #​27507 lint: allow self-documenting builder arguments @​anp-oai
• #​27420 [codex] Propagate plugin app categories @​charlesgong-openai
• #​27454 [codex] add cross-platform filesystem adapter coverage @​anp-oai
• #​27415 [codex] Surface runtime warnings in codex exec @​anp-oai
• #​27639 [codex] revert concurrent npm publishing @​tamird
• #​27646 feat: disable orchestrator skills for now @​jif-oai
• #​27323 [codex] Provide ARM64 MinGW powl compatibility support @​anp-oai
• #​27433 [codex] remove EnvironmentPathRef @​anp-oai
• #​27424 [codex] migrate ExecutorFileSystem paths to PathUri @​anp-oai
• #​27101 [codex] Load user instructions through an injected provider @​anp-oai
• #​27634 Resolve MCP server registrations through a catalog @​jif-oai
• #​27122 core: Consolidate Responses API Codex metadata @​owenlin0
• #​27450 [codex-rs] enforce PAT workspace restrictions @​cooper-oai
• #​27653 [codex] migrate exec-server filesystem protocol to PathUri @​anp-oai
• #​27663 Include thread id in token budget context @​pakrym-oai
• #​26418 [codex] Avoid duplicate hooks.json discovery with profiles @​abhinav-oai
• #​27689 feat: prefer managed Bedrock auth in model provider @​celia-oai
• #​27700 Remove fs/join and fs/parent from exec-server protocol @​anp-oai
• #​26426 Warn when hooks.json has unsupported top-level fields @​abhinav-oai
• #​27318 [codex] Move persistence policy application into ThreadStore @​wiltzius-openai
• #​27498 Route image extension reads through turn environments v2 @​won-openai
• #​27623 Add spans to turn lifecycle gaps @​mchen-oai
• #​27619 tui: clear stale hook row after turn completion @​kotakem-openai
• #​27711 Fix image extension PathUri conversion @​anp-oai
• #​27475 [codex] Remove async_trait from first-party code @​anp-oai
• #​27719 fix: Recover from sqlite directory being a file @​ddr-oai
• #​27715 ci(v8): gate Windows source builds on relevant changes @​cconger
• #​27702 [codex] parallelize release code generation @​tamird
• #​27709 [codex] resolve environment shell metadata eagerly @​pakrym-oai
• #​27445 feat(app-server): persist remote-control desired state @​apanasenko-oai
• #​27508 [1 of 3] Support long raw TUI goal objectives @​etraut-openai
• #​27256 Add request_user_input auto-resolution window contract @​shijie-oai
• #​27724 code-mode standalone: extract protocol and add host crate @​cconger
• #​27778 Translate non-English issues @​etraut-openai
• #​27316 Keep request_user_input direct-model only @​shijie-oai
• #​27696 [codex] Load AGENTS.md from all bound environments @​anp-oai
• #​27670 Make MCP server contributions thread-scoped @​jif-oai
• #​27732 [code-mode] Reject remote image URLs from output helpers @​rka-oai
• #​27692 Add executor-owned plugin resolution @​jif-oai
• #​27863 Extract shared plugin MCP config parsing @​jif-oai
• #​27703 [codex] restore source-specific import copy @​stefanstokic-oai
• #​27879 fix: serialize auth environment tests @​jif-oai
• #​27791 Reject transcript backtrack in side conversations @​etraut-openai
• #​27075 [ez][codex-rs] Support approvals reviewer in app defaults @​zamoshchin-openai
• #​27538 Use dependency groups for Python SDK tooling @​charliemarsh-oai
• #​27783 Persist update dismissal without cache @​etraut-openai
• #​27814 tui: Allow extra o's in /goal command @​btraut-openai
• #​27901 Use uv as Python SDK build backend @​charliemarsh-oai
• #​27720 realtime: add AVAS architecture override @​bakks
• #​27919 chore: prompt MAv2 @​jif-oai
• #​27816 sandboxing: migrate cwd inputs to PathUri @​anp-oai
• #​27890 [codex] expose remote plugin share URL @​ericning-o
• #​27913 [codex] unify apply patch parsing @​pakrym-oai
• #​27920 Handle standalone image generation failures as terminal items @​won-openai
• #​27927 [codex] Add size to internal filesystem metadata @​pakrym-oai
• #​27504 feat: add secret auth storage configuration @​celia-oai
• #​27674 [login] revoke existing auth before starting login @​cooper-oai
• #​27535 feat: add auth-specific encrypted secret namespaces @​celia-oai
• #​27939 [codex] Add crate API surface review rule @​pakrym-oai
• #​27926 [codex] Align implicit skill reads with parser @​alexsong-oai
• #​23254 fix(plugins) rm plugin descriptions @​dylan-hurd-oai
• #​27830 Support plaintext agent messages @​jif-oai
• #​27801 Remove TUI realtime voice support @​etraut-openai
• #​27539 feat: use encrypted local secrets for CLI auth @​celia-oai
• #​27076 Warn for structured feature toggles @​canvrno-oai
• #​27541 feat: use encrypted local secrets for MCP OAuth @​celia-oai
• #​27936 [codex] add roles to realtime append text @​agamble-oai
• #​27509 [2 of 3] Support long pasted text in TUI goals @​etraut-openai
• #​27109 Add Guardian catalog diagnostics metadata @​won-openai
• #​27966 Specify platform support in AGENTS.md @​anp-oai
• #​27855 [codex] parallelize Windows compression @​tamird
• #​27499 Promote TUI unified mentions in composer to default mentions feature @​canvrno-oai
• #​27972 [codex] Let generic test turns inherit their environment @​pakrym-oai
• #​27856 [codex] package Windows symbols in parallel @​tamird
• #​27976 [codex] make PathUri::from_abs_path infallible @​anp-oai
• #​27854 [codex] parallelize Windows package archives @​tamird
• #​27853 [codex] stage npm packages concurrently @​tamird
• #​27710 [codex] add latency tracing spans @​rphilizaire-openai
• #​27510 [3 of 3] Support images in TUI goals @​etraut-openai
• #​27925 feat(tui): reland token activity command @​fcoury-oai
• #​27988 [codex] Limit app-based plugin suggestions to remote catalogs @​xl-openai
• #​27652 [codex] Add auth mode to plugin manager constructor @​felixxia-oai
• #​27964 [codex] Add hermetic Wine test support @​anp-oai
• #​27459 [codex] Gate plugin MCP servers by auth route @​felixxia-oai
• #​27961 feat(app-server): enforce managed remote control disable @​apanasenko-oai
• #​27937 [codex] Add hermetic Wine exec-server test @​anp-oai
• #​27996 [codex] Send request-scoped turn state over WebSocket @​aibrahim-oai
• #​28002 [codex] Send turn state through compact requests @​aibrahim-oai

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.