+codex agents, codex queue, codex exec fork, codex exec --worktree, codex debug models | prompt-input
+--approve-for-me, --worktree, --no-daemon, exec --color
+/agents, /recap, /export, /cd (+ /pwd, /cwd), /worktree, /presets, /daybreak, /voice (F8), /config, /tui, /pets, /daemon, /warnings
+Hook events PreModelRequest, PostModelRequest, Interrupt, SessionEnd; mcp_tool hook handler
+agents.max_concurrent_threads_per_session, agents.enabled, agents.default_subagent_model
+trust_level = "untrusted" project entry; CODEX_SQLITE_HOME
~--ask-for-approval — untrusted removed; now on-request | never
~--remote — now also supported by codex agents and codex queue; other subcommands reject it
~codex fork — --worktree support
~/clear, /new, /model, /permissions, /mcp, /import — new arguments (name, flags, login, Cursor)
~Subagent sandbox — custom agent files don't override sandbox_mode, approval_policy, model_provider or mcp_servers
~Config precedence — now lists a cloud-managed defaults layer; docs now use gpt-6.1-sol
~[windows] sandbox — now the legacy fallback to MXC (prefer_mxc)
~.aws added to protected paths in writable roots
~CODEX_API_KEY — now also read by review, SDK, and remote exec-server
−codex mcp-server — removed upstream; use the app server
−--full-auto — no longer supported; use --sandbox workspace-write or --approve-for-me
−approval policy untrusted — retired; use trust_level = "untrusted" on a project