Codex CLI 0.140.0: /import, Encryption, and Self-Healing State

Ethan Park

We've got a lot of migration and robustness updates in the latest Codex release, specifically Codex CLI 0.140.0, which dropped on June 15, 2026. And before we dive into the weeds, a quick shout-out: thanks to Jellypod to help make this daily show a reality. Now, Maya, the headline feature in 0.140.0 is this new `/import` command designed specifically for teams moving over from Claude Code. [excited]

Maya

Right, and if you've spent weeks tweaking your Claude Code environment, the last thing you want is to lose your custom instructions. The `/import` tool pulls in setups, project configs, and even active chat logs directly into Codex. It basically keeps your workspace rules and system prompts intact without you having to manually copy-paste JSON configurations. [appreciative]

Ethan Park

Exactly, it targets the CLAUDE_DIR environment variables and parses the local state files. But under the hood, there are a few execution details developers need to watch out for. For starters, the import script expects strict read-write permissions on the source directories. If your Claude Code setup was running under a different user privilege or inside a restricted container, `/import` will throw a permission denied error without a very descriptive fallback. [measured]

Maya

Ah, so the classic "it works on my machine" but fails when you try to port a shared environment setup. [chuckles] What about path resolutions? If I have absolute paths defined in my workspace rules for things like local linter scripts, does `/import` translate those?

Ethan Park

[measured] It doesn't. It imports them verbatim. So if your colleague's path was `/Users/alice/bin/linter` and you import that config on your machine, it's going to break immediately on startup. You have to go in and manually adjust those to relative paths or environment variables post-import.

Maya

That's a really important caveat. So it's a massive time-saver for system prompts and context, but you still need to audit those hardcoded paths before you run your first build.

Ethan Park

Now, once you actually have your context imported, 0.140.0 also completely rewrites how Codex handles local data security and database stability. They've finally eliminated plaintext exposure for sensitive tokens. [serious]

Maya

Thank goodness. [laughs] Storing credentials in plaintext config files was always a massive security risk, especially for team environments. Now, any MCP OAuth tokens and Amazon Bedrock credentials are encrypted locally. What's the encryption standard they're using here?

Ethan Park

They're using AES-256-GCM. The key management integrates directly with OS-level secret stores—so Keychain on macOS, Secret Service on Linux, and Data Protection API on Windows. If the system keyring is unavailable, it falls back to a locally generated key stored in a restricted user-only read file, which isn't perfect, but it's a massive step up from before. [calm]

Maya

That OS-level integration is crucial. But what happens if the database itself gets corrupted? I know earlier versions of Codex had issues where a sudden terminal crash or power cut would corrupt the local SQLite database, and the CLI would just hang indefinitely on the next launch.

Ethan Park

That was a nightmare. [chuckles] To fix that, they've introduced a self-healing SQLite state mechanism. Now, on boot, Codex checks the database integrity using a quick `PRAGMA integrity_check`. If it detects corruption, it automatically moves the damaged database to a `.bak` file, initializes a clean schema, and attempts to rebuild your session state from the encrypted transaction logs.

Maya

[thoughtfully] Wait, does it rebuild the *entire* history, or just the configuration state?

Ethan Park

Just the core configuration, active workspace variables, and recent session metadata. You might lose some deep chat history from a corrupted file, but your CLI won't crash on startup anymore, and your key configurations remain intact.

Maya

That's a fair trade-off to avoid a complete manual reinstall. On the usability side, I also noticed they added a `/usage` command. Is that tracking token spend or local resource utilization?

Ethan Park

Both, actually. `/usage` displays a breakdown of input, output, and cache-hit tokens for your current session, along with an estimated dollar cost based on the provider you're targeting—whether that's Bedrock or Anthropic directly. It's incredibly handy if you're trying to optimize your system prompts to avoid hitting rate limits. [enthused]

Maya

[warmly] Oh, that's excellent. And they cleaned up Ctrl-C handling, right?

Ethan Park

Yes! If you trigger a background task or run Codex in a non-TTY environment like an automated CI/CD pipeline, hitting Ctrl-C now sends a clean termination signal to all child processes instead of leaving zombie Node processes hanging around in your background. It's a small but vital fix for pipeline stability.

Maya

It really shows they're maturing this from an interactive developer toy into something you can actually trust in automated production pipelines. [reflective]

Ethan Park

Definitely. That's Codex CLI 0.140.0. I'm Ethan Park, alongside Maya, and we'll catch you in the next one. [warmly]