So, I was looking through the zero point one four six point zero release of Codex,
and, uh, the thing that immediately jumped out at me is how they are handling agent
plugins now.
It is, it is basically trying to kill off toolchain fragmentation.
Wait, zero point one four six point zero?
What did they, what did they actually change with plugins?
They introduced support for standardized Agent Plugins manifests.
It is a file called dot codex slash plugin point manifest point json,
and it works with workspace plugin publishing.
But here is the big part, Maya.
This same manifest format works across Amazon Bedrock, Claude Code,
and Codex.
Wait, so Amazon Bedrock and Claude Code are using the exact same plugin manifest?
That, that actually means you do not have to write custom wrappers for every single
AI toolchain anymore.
Exactly!
You package your AI skills once with defined permissions, resource paths,
and tool schemas, and it just runs across those different agent environments.
No more vendor locked command line extensions.
Okay, so walk me through how this actually works in a real project.
Where do these files live?
Right, so in your local workspace, you structure your plugins under dot codex slash
plugins.
And let us say you update a manifest while you are working.
You do not have to kill your active TUI session to pick up the changes.
You just run codex plugin list space, force refetch...
wait, no, scratch the dashes, you run codex plugin list with the force refetch flag.
The force refetch flag, got it.
So it reloads updated manifests on the fly while your terminal session stays
completely alive?
Yep, on the fly.
And when you want to share these custom tools with your team,
you just check that manifest directly into your project repository.
Everyone on the repo gets the exact same custom tools instantly,
without needing any external public plugin registry.
Oh, that is huge for team setup.
I remember at my old job, getting everyone on the exact same local script version
was an absolute nightmare.
Having it checked into git under dot codex means zero setup friction.
It really is.
But, um, you know, when you start pulling in remote plugin dependencies across
workspaces, security becomes the immediate elephant in the room.
Right, because if an agent can execute remote plugin code, a malicious or tampered
manifest could just execute arbitrary stuff on your machine during an update.
Precisely.
So in pull request thirty four six four four, they enforced mandatory Git commit SHA
verification when you pin remote plugin dependencies.
Combined with PR thirty four five nine seven for exact managed configuration
policies, Codex basically blocks unauthorized code execution when plugins pull down
updates.
Commit SHA verification.
So even if a remote branch gets force pushed or compromised,
the build fails unless the exact commit SHA matches.
That is real supply chain defense.
Yeah, exactly.
And, uh, speaking of terminal stability, they also fixed some really annoying TUI
performance bugs that used to freeze up the interface.
Oh?
What kind of bugs?
Well, PR thirty four seven nine six addresses large file rendering.
If you ever inspected a minified JavaScript bundle, a massive SQL dump,
or a huge JSON payload where a single line exceeded four KiB,
the syntax highlighter would basically choke and lock up your whole terminal.
Oh, four kilobytes on a single line!
Yeah, minified code will do that every single time.
It tries to calculate tokens across fifty thousand characters without a line break
and just melts.
Right!
So now, if a line exceeds four KiB, Codex automatically bypasses syntax highlighting
for that line.
It just renders the raw text so your terminal never freezes up.
Plus, in PR thirty four five seven zero, they added native C plus plus syntax
highlighting for CUDA source files, like dot cu and dot cuh files.
Oh, CUDA support directly in the TUI!
Machine learning engineers working on GPU kernels are going to love that.
And did I see something about process management in the release notes too?
Yeah, PR thirty four six one two.
They fixed background tasks hanging terminal I O by doing non interactive subprocess
stdin detachment.
So background processes do not block your input stream anymore.
Man, zero point one four six point zero is packed.
But, you know, looking at this whole universal plugin manifest standard across
Bedrock, Claude Code, and Codex...
I am kind of torn.
Part of me wonders if this universal standard will lead to super bloated multi agent
ecosystems, or if lean, repo local configs will stay the norm.
That is the tension, right?
Standardizing makes ecosystem expansion effortless, but repo local plugins checked
into git keep things clean and predictable.
Time will tell which way engineering teams lean.
Well, either way, having verified commit SHAs and a terminal that does not freeze on
four KiB lines makes my day a lot better.
Good chat, Ethan.