Codex CLI 0.147: Test Agent Plugins, Approvals, and MCP Separately

Codex CLI 0.147 combines several changes that affect different trust boundaries. Treating the upgrade as one pass/fail event misses the failures that matter.

Test Five Things Independently

The short answer: Test five things independently:

• One portable Agent Plugin.
• One --approve-for-me boundary.
• One MCP server using the opt-in 2026-07-28 protocol.
• One imported skill or conversation.
• One interrupted Windows background process.

A successful launch proves only that Codex started. It does not prove that plugin provenance, approval scope, protocol negotiation, imported context, or process cleanup are correct.

Agent Plugins Need a Provenance Receipt

Portable plugins can move instructions, tools, apps, and supporting files between environments. Before activation, record:

• source repository and reviewed revision,
• enabled scope,
• declared tools and network destinations,
• expected files or commands,
• one allowed operation and one denied operation.

Then disable the plugin and start a fresh session. The capability should disappear. Catalog visibility is not execution proof.

--approve-for-me Is Not Unrestricted Execution

The flag adds automatic approval review. It does not erase the sandbox, network policy, managed restrictions, or the