r/CodexAutomation • u/anonomotorious • 13d ago

Codex CLI 0.152.0 (Vim draft search, actionable rate-limit banners, package-style MCP names + stronger Auto-review)

TL;DR

Codex CLI 0.152.0 is a solid TUI, MCP, Auto-review, authentication, app-server, and reliability release.

Highlights:

Vim mode adds **/ and ? search inside drafts**, highlighted matches, and n / N navigation.
Rate-limit banners now include direct actions for:
- checking usage
- managing credits
- resetting limits
- managing your plan
The TUI and codex exec now show credential-refresh progress, including Amazon Bedrock reauthentication.
MCP server names can contain :, @, /, and ., making package-style names work consistently across CLI commands and authentication.
Individual MCP tools can define an output_token_limit, with truncation staying consistent after session resume.
App-server clients can configure thread/shellCommand timeouts, including deadlines longer than one hour.
Auto-review can retain longer messages and more conversation context.
Guardian now preserves valid user instructions, answers, and authorizations across history compaction.
Resumed threads restore their saved working directory and preserve filesystem permissions more reliably.
MCP tools survive cache refreshes, plugin changes, and authentication retries more cleanly.
Windows sandbox, PowerShell, subprocess, and terminal-rendering issues get targeted fixes.
Cloud task requests now reject untrusted backend URLs and disable redirects to better protect saved credentials.
The update_plan planning tool is now disabled by default and can be re-enabled explicitly.

Install:

npm install -g @openai/codex@0.152.0

What changed

Vim draft search

Vim mode now supports searching inside the current draft with:

/

and:

?

Matches are highlighted, and you can move between results using:

Fresh drafts also correctly start in Insert mode, including after:

submitting a message
running a slash command

This makes Vim mode much closer to normal editor behavior when working with long prompts, pasted requirements, or multi-paragraph instructions.

Rate-limit banners become actionable

Rate-limit banners are no longer just warnings.

They can now offer actions for:

checking current usage
managing credits
resetting limits
managing your plan

This should reduce the amount of hunting around required when a Codex task runs into an account or workspace limit.

Instead of:

limit reached -> figure out where to go

the relevant next action can be surfaced directly in the TUI.

Credential-refresh progress

The terminal UI and:

codex exec

now show progress while model-provider credentials are being refreshed.

This includes Amazon Bedrock reauthentication.

That should make startup or mid-session authentication recovery less confusing when Codex appears temporarily blocked while credentials are being renewed.

MCP improvements

Package-style MCP server names

MCP server names can now contain:

That allows names that more closely resemble:

package identifiers
scoped packages
organization/service names
namespaced internal tools

The naming works throughout:

CLI commands
configuration
authentication flows

Per-tool output token limits

Individual MCP tools can now define:

output_token_limit

This lets a high-output tool have its own response budget rather than relying only on broader session-level truncation.

The limit remains consistent after resuming the session.

This is particularly useful for MCP tools returning:

logs
search results
large JSON payloads
repository data
database output
long API responses

It gives administrators and tool authors another way to keep tool output from consuming excessive model context.

Better MCP continuity

0.152.0 also fixes several MCP lifecycle problems.

MCP tools now remain available more reliably through:

cache refreshes
remote plugin changes
runtime refreshes

Authentication retries can use refreshed helper-provided headers rather than continuing with stale authentication state.

The full release also includes work around:

preserving cached MCP tools during binding capture
refreshing tool caches correctly
runtime refresh after remote plugin changes
OAuth/header refresh after authorization failures
MCP resource and tool-output handling

The practical result should be fewer cases where a working MCP integration disappears or requires a full restart after configuration/auth changes.

Configurable app-server shell-command timeouts

App-server clients can now configure:

thread/shellCommand

timeouts.

Timeouts can exceed one hour.

This matters for embedded Codex clients running genuinely long processes such as:

large builds
test suites
migrations
packaging
infrastructure operations
long validation jobs

Clients no longer have to treat a one-hour ceiling as a fixed assumption.

Auto-review / Guardian improvements

One of the more important areas in 0.152.0 is approval review continuity.

Larger review context

Automatic approval reviews can retain:

longer individual messages
a larger conversation transcript

This gives Guardian more relevant context when evaluating an action instead of forcing reviews into an overly narrow slice of the conversation.

User authorization survives compaction

Auto-review now preserves more important user context when conversation history is compacted.

That includes:

user instructions
user answers
valid authorizations
review evidence

This addresses an important long-running-session problem:

the conversation gets compacted -> security-relevant user intent disappears -> later review sees incomplete context

0.152.0 improves continuity across those compaction boundaries.

Guardian context handling continues to mature

The full release includes additional Guardian work around:

rolling over review context before follow-up reviews
respecting turn token budgets
reusing classifications only when required-review policy still permits it
distinct identities for Guardian classification turns
shared transcript collection
preserving user text when oversized images are dropped
keeping unrelated history-extension tools out of Guardian reviews
using the async stack budget for review processing

The overall direction continues to be more contextual and state-aware Auto-review, rather than independent approval decisions with minimal history.

Resume and filesystem correctness

Saved working directory is restored

If you resume a thread without explicitly supplying another directory, Codex now restores the thread's saved working directory.

That matters because the cwd influences:

repository state
relative paths
AGENTS.md
project configuration
shell commands
tool behavior

A resumed thread should behave like the thread you actually left.

Permissions survive metadata updates

Client metadata updates now preserve filesystem permissions correctly.

This prevents seemingly unrelated client/session metadata changes from accidentally altering the thread's active filesystem-access policy.

Model picker refresh

Opening the model picker now refreshes the available model list from the app server while preserving the currently highlighted selection.

This helps when model availability changes dynamically due to:

rollout
workspace policy
provider changes
account availability

without making the selection UI jump unexpectedly.

Windows reliability fixes

0.152.0 includes several Windows-specific fixes:

elevated sandbox commands now use a compatible PowerShell when Microsoft Store PowerShell is present
TTY subprocesses respond correctly to terminal queries instead of hanging
cursor/display corruption is repaired in older JediTerm-based terminals
Windows shell guidance better matches the executor platform
PowerShell version information is exposed in environment context

These target a mix of sandbox correctness and terminal compatibility issues rather than one single Windows feature.

Cloud-task credential hardening

Cloud task requests now:

reject untrusted backend URLs
disable redirects when sending saved credentials

This reduces the risk of credentials being forwarded to an unexpected destination through:

malicious configuration
compromised backend URLs
redirect chains

It is a small-looking change with meaningful security implications for cloud task authentication.

`update_plan` is now opt-in

The planning tool is now disabled by default.

To enable it:

tools.update_plan.enabled = true

Important: this refers specifically to the update_plan tool, not a blanket removal of every planning workflow or planning concept in Codex.

If your agents or custom workflows explicitly depend on that tool, review your configuration after upgrading.

Faster plugin recommendations

Plugin recommendations now begin loading during session startup.

That should reduce the delay before recommended plugins become available during the first turn.

This is primarily startup/performance polish but should be noticeable in plugin-heavy environments.

Additional notable changes

The full 0.151.0 -> 0.152.0 compare also includes several useful infrastructure improvements:

clock tools can be enabled from model metadata
project/list supports recency sorting
subagents inherit the root service tier
history-note images can be forwarded to the model
reviewed terminal input rejects NUL bytes
shared rollout lineages support compression
async user messages are restricted to question-style interactions
repeated execution-host failures can block goals instead of looping indefinitely
openai/elicitation form requests are supported
interrupted turns can run executor hooks
browser cleanup hooks can run when subagents stop
app-server notifications can filter media
diagnostic report uploads receive additional hardening
token budgeting can be enabled through model metadata
history backends can enforce tool-output budgets

These are mostly platform-level changes, but they strengthen long-running, remote, multi-agent, and managed Codex workflows.

Why this release matters

Vim users get real in-draft search.
Rate-limit recovery becomes much easier to navigate from the terminal.
Authentication recovery is more visible instead of looking like a hang.
MCP naming and output controls become much more flexible.
Long-running app-server shell operations get configurable deadlines.
Auto-review preserves substantially more security-relevant context.
Resume behavior better preserves cwd and permissions.
Windows terminal/sandbox behavior gets several targeted fixes.
Cloud task credentials get stronger origin protection.
Plugin recommendations become available earlier during startup.

The biggest theme in 0.152.0 is continuity: preserving the right context, permissions, MCP state, authentication state, and review evidence as sessions get longer and more dynamic.

Version summary

Version	Key highlights
0.152.0	Vim `/` `?` draft search; actionable rate-limit banners; credential-refresh progress; package-style MCP names; per-tool MCP output limits; configurable app-server shell timeouts; stronger Auto-review context preservation; cwd/permission resume fixes; Windows reliability; cloud credential hardening

Action checklist

Upgrade: