Codex 0.147.0: Remote Plugin Discovery and Sandbox Hardening
This episode explores how Codex 0.147.0 expands plugin discovery across local, team, and remote registries while unifying results with eligibility and authorization details. It also covers tighter sandbox protections, symlink blocking, and a few quality-of-life upgrades like section ordering, skill migration, and Ghostty fixes.
Chapter 1
Multi Tier Agent Plugin Catalogs and Remote Discovery in 0.147.0
Ethan Park
If you run codex plugin search right now on version zero point one forty seven point zero, something pretty radical happens behind the scenes. Before we break down this portable plugin architecture, a quick hat tip to Jellypod for keeping our daily show powered up. But yeah, instead of just reading a static manifest file sitting on your disk, Codex is doing something way more ambitious.
Maya
Wait, so when you type that search command, it is not just looking at your local folder anymore?
Ethan Park
Exactly. It actually queries four totally distinct tiers at the exact same time. It checks your local dot codex slash plugins directory, your personal user directory, your shared team workspace setup, and then remote registries across the web.
Maya
Four layers simultaneously. So, wait, how does it handle showing you all of that without turning into a total messy list of duplicates?
Ethan Park
It aggregates both the local and remote plugin indexes into a single unified result list. And under the hood, each entry comes back with its eligibility metadata, current installation state, and any authorization requirements attached to it. You do not have to mess around with manual path mapping or cloning repositories by hand anymore.
Maya
Oh, that is huge for team setups! I remember back in my testing days, every time someone built a useful script, they would just throw a custom script into a Slack channel. Then half the team is running outdated local setups that diverge immediately. Now you can literally just commit the declared capabilities right into the repository config, and everyone on the team gets instant, reproducible agent plugins.
Ethan Park
Precisely. It turns agent capability distribution into a clean, declared code dependency rather than a bunch of loose shell scripts passed around in chat.
Chapter 2
Sandbox Isolation, Symlink Protection, and QoL Roundup
Maya
Okay, but if we are pulling plugins from remote registries and shared workspace configs, what stops a malicious plugin from wandering off where it shouldn't?
Ethan Park
That is where the zero point one forty seven point zero security updates come in. They tightened up runtime execution to strictly enforce plugin boundaries. On top of that, if a network security policy update fails for any reason, the system automatically fails closed by completely denying network access. Plus, during plugin installation, Codex now explicitly skips symlinks to eliminate host path traversal risks.
Maya
Skip symlinks entirely? Wait... if you are building and testing a local plugin, doesn't that break the standard workflow where developers symlink their dev folder into dot codex slash plugins?
Ethan Park
Yep, you caught the friction point right there. Symlinking local development plugins into dot codex slash plugins is explicitly blocked during install now. So if you are authoring plugins, you have to pass direct path overrides during local testing instead of relying on filesystem symlinks.
Maya
A little bit of developer friction in exchange for not accidentally letting a bad actor path traverse out of the sandbox. Probably a fair trade-off.
Ethan Park
Definitely a fair trade. And there are some really slick quality of life additions in this release too. You get persistent manual section ordering to organize those massive conversation threads in the TUI interface. They also added automatic migration of Cursor managed skills during slash import, and it does it cleanly without creating duplicate session records.
Maya
Oh, and didn't they fix that annoying Ghostty terminal issue too?
Ethan Park
They did! They patched the terminal input queue for Ghostty so keypresses do not get dropped while the Model Context Protocol server is booting up. When you step back and look at it, pairing strict runtime sandboxing with multi tier remote catalog discovery really marks Codex turning the corner from a simple local CLI into a modular, enterprise ready agent runtime.
Maya
Yeah, it really feels like the tooling is growing up fast. Good stuff today. Talk soon, everyone!