Codex CLI 0.154.0

• [removed] The /voice slash command and the realtime WebRTC stack are gone, including the related TUI voice strip and realtime delivery UI.
• [removed] codex app-server daemon update is no longer available (shell completions updated accordingly). Use your normal install/upgrade path instead of updating through the managed daemon.
• [new] Windows sandbox support ships as its own crate, including deny-read path resolution for tighter filesystem policy on Windows.
• [new] Exec can process events with JSONL output, making machine-readable run logs easier to consume downstream.
• [changed] Network-proxy credential brokering is reworked around provider modules (including GitHub and OpenAI), replacing the older brokered-tunnel / connection-lifecycle layout.
• [removed] Shell-snapshot sandbox capture helpers and several one-off app-server paths (manual daemon update, memory-status request handling, legacy user-verification UI wiring) are cleaned out of this build.

Under the hood

• Workspace layout swaps out realtime-webrtc for windows-sandbox-rs.
• Config and protocol models are trimmed and reshaped (memories, network-proxy TOML, thread settings, model-provider AWS auth, models cache entries, and related payloads), with new shapes for remote-control pairing, background terminals, and context management.
• A number of snapshot/proxy and install/release environment flags from the alpha line are dropped; dependency surface shrinks slightly (e.g. blake3, headers, rand_regex no longer required).
• Bash, fish, and zsh completions track the daemon subcommand list; package metadata moves to the stable 0.154.0 channel.

Upgrade notes

• If you relied on /voice or in-app realtime voice delivery, those entry points are not in 0.154.0.
• Replace any scripts that called codex app-server daemon update with your usual Codex upgrade mechanism, then restart the daemon if needed (restart / start remain).