Codex CLI v0.158: MCP OAuth client secrets and approval for elevated commands

OpenAI shipped Codex CLI v0.158.0, which enables terminal input approval by default for commands running with elevated permissions and adds support for connecting to MCP servers that require pre-registered OAuth client secrets via the `codex mcp add --oauth-client-secret` flag. The release also fixes sandbox issues on Windows, Linux and macOS, including nested writable roots on Linux and Git metadata protections across writable roots, and secures direct exec-server WebSocket connections with bearer tokens. The `--oauth-client-secret` flag was not yet documented in the official configuration reference as of September 30, 2026, and v0.159.0 followed by protecting `.aws` directories by default under writable roots.

Originally published at https://aicoding-guide.com https://aicoding-guide.com/en/posts/codex-update-0-158/ . Codex CLI v0.158.0 lands changes that touch MCP, the sandbox and approvals — the parts you notice in daily use. Two items matter most: terminal input approval is now on by default for commands running with elevated permissions , and Codex can now connect to MCP servers that require pre-registered OAuth client secrets . This article works from the v0.158.0 release notes as the primary source, covering what affects your configuration, and then what followed in v0.159.0 and v0.159.2. Key point What you will learn - Approval becoming the default for elevated commands - MCP OAuth client secret support, and where the configuration reference has not caught up - The sandbox fixes on Windows, Linux and macOS From the v0.158.0 New Features: Terminal input approval is enabled by default for commands running with elevated permissions; runtime-only grants no longer cause unnecessary reviews. If you run commands with administrator or otherwise elevated permissions, expect an approval where there was none before. In the other direction, grants given only for the duration of a run should stop triggering repeat reviews. Two related fixes ship alongside it: For how approval policies and the sandbox combine, see Codex approval modes and sandbox https://aicoding-guide.com/en/posts/codex-approval-sandbox/ . From the New Features: Connect to MCP servers that require pre-registered OAuth client secrets, including through codex mcp add --oauth-client-secret . Servers that do not support Dynamic Client Registration make you register an OAuth app in their developer portal and take a client ID and secret back. Until now there was no way to hand Codex that secret, so those servers were out of reach. This flag is not in the configuration reference yet --oauth-client-secret appears in the v0.158.0 release notes, but it was not in the official configuration reference as of September 30, 2026 . The OAuth keys that page does document for an MCP server are oauth.client id , oauth.callback port and oauth.callback url , and it says nothing about where a client secret is stored. Treat the flag name and behavior as a release-note claim. What the reference does document today stops at the client ID and the callback: mcp servers.example url = "https://mcp.example.com/mcp" mcp servers.example.oauth client id = "your-client-id" callback port = 8080 The same release also secures direct exec-server WebSocket connections with bearer tokens, including connections configured through app-server. Three of the Bug Fixes concern the sandbox, split across platforms. | Platform | What the release notes say | |---|---| | Windows | Sandbox failures involving ordinary Windows 10 paths, rejected stored credentials, and large permission policies | | Linux | Sandbox startup with nested writable roots | | Linux and macOS | Git metadata protections preserved across writable roots | | macOS | Patch operations now recognize system path aliases covered by existing permissions, avoiding unnecessary approval prompts | If you configure several writable roots, a nested arrangement failed to start on Linux before this release. Configuration is covered in Extending where Codex can write with writable roots https://aicoding-guide.com/en/posts/codex-writable-roots/ . v0.159.0 widens the protection further: .aws directories are "protected by default under writable roots". That said, which directories are protected by default inside a writable root could not be confirmed on the official sandboxing page — read it as a release-note claim. v0.158.0 makes copy-on-select and right-click paste configurable in the fullscreen TUI, and copied transcript selections keep their Markdown formatting. Mermaid flowcharts render quoted labels and ampersands, and unsupported diagrams explain why they fall back to source. The v0.159.0 New Features: instant interrupt , letting new input steer Codex during model responses or long-running code-mode calls k to keep one instant interrupt also was not in the configuration reference as of September 30, 2026 , so where it goes and what value it takes are unconfirmed. For the file's structure generally, see Configuring Codex with config.toml https://aicoding-guide.com/en/posts/codex-config-toml/ . v0.159.2 is a Windows-only patch with a single fix: console windows no longer flash when Codex launches background processes and sandboxed commands. codex mcp add --oauth-client-secret --oauth-client-secret and