Originally published at https://aicoding-guide.com.
Codex CLI v0.158.0 lands changes that touch MCP, the sandbox and approvals — the parts you notice in daily use.
Two items matter most: terminal input approval is now on by default for commands running with elevated permissions, and Codex can now connect to MCP servers that require pre-registered OAuth client secrets.
This article works from the v0.158.0 release notes as the primary source, covering what affects your configuration, and then what followed in v0.159.0 and v0.159.2.
Key point
What you will learn
- Approval becoming the default for elevated commands
- MCP OAuth client secret support, and where the configuration reference has not caught up
- The sandbox fixes on Windows, Linux and macOS
From the v0.158.0 New Features:
Terminal input approval is enabled by default for commands running with elevated permissions; runtime-only grants no longer cause unnecessary reviews.
If you run commands with administrator or otherwise elevated permissions, expect an approval where there was none before. In the other direction, grants given only for the duration of a run should stop triggering repeat reviews.
Two related fixes ship alongside it:
For how approval policies and the sandbox combine, see Codex approval modes and sandbox.
From the New Features:
Connect to MCP servers that require pre-registered OAuth client secrets, including through codex mcp add --oauth-client-secret.
Servers that do not support Dynamic Client Registration make you register an OAuth app in their developer portal and take a client ID and secret back. Until now there was no way to hand Codex that secret, so those servers were out of reach.
This flag is not in the configuration reference yet
--oauth-client-secret appears in the v0.158.0 release notes, but it was not in the official configuration reference as of September 30, 2026. The OAuth keys that page does document for an MCP server are oauth.client_id, oauth.callback_port and oauth.callback_url, and it says nothing about where a client secret is stored. Treat the flag name and behavior as a release-note claim.
What the reference does document today stops at the client ID and the callback:
[mcp_servers.example]
url = "https://mcp.example.com/mcp"
[mcp_servers.example.oauth]
client_id = "your-client-id"
callback_port = 8080
The same release also secures direct exec-server WebSocket connections with bearer tokens, including connections configured through app-server.
Three of the Bug Fixes concern the sandbox, split across platforms.
| Platform | What the release notes say |
|---|---|
| Windows | Sandbox failures involving ordinary Windows 10 paths, rejected stored credentials, and large permission policies |
| Linux | Sandbox startup with nested writable roots |
| Linux and macOS | Git metadata protections preserved across writable roots |
| macOS | Patch operations now recognize system path aliases covered by existing permissions, avoiding unnecessary approval prompts |
If you configure several writable roots, a nested arrangement failed to start on Linux before this release. Configuration is covered in Extending where Codex can write with writable_roots.
v0.159.0 widens the protection further: .aws directories are "protected by default under writable roots". That said, which directories are protected by default inside a writable root could not be confirmed on the official sandboxing page — read it as a release-note claim.
v0.158.0 makes copy-on-select and right-click paste configurable in the fullscreen TUI, and copied transcript selections keep their Markdown formatting. Mermaid flowcharts render quoted labels and ampersands, and unsupported diagrams explain why they fall back to source.
The v0.159.0 New Features:
instant_interrupt, letting new input steer Codex during model responses or long-running code-mode callsk to keep one
instant_interrupt also was not in the configuration reference as of September 30, 2026, so where it goes and what value it takes are unconfirmed. For the file's structure generally, see Configuring Codex with config.toml.
v0.159.2 is a Windows-only patch with a single fix: console windows no longer flash when Codex launches background processes and sandboxed commands.
codex mcp add --oauth-client-secret)--oauth-client-secret and