Codex CLI v0.152.0: Vim search in the composer and actionable rate-limit banners#
Part of the Codex CLI Version Tracker series. | Codex on GitHub | Official Changelog
Since v0.150.1, Codex CLI added Vim / and ? search inside the composer, rate-limit banners that link straight to usage and billing actions, per-tool MCP output limits, credential-refresh progress in the terminal, and turned the planning tool off by default.
What shipped#
Two releases land in this range, 0.151.0 and 0.152.0, and the user-facing additions cluster in the terminal and around MCP.
In the composer, Vim mode now supports / and ? search within a draft, with highlighted matches and n and N to repeat navigation.[2] A companion fix starts fresh drafts in Insert mode, including after submitting a message or dispatching a slash command.
Rate-limit banners became actionable. When you hit a limit, the banner offers to check usage, manage credits, reset limits, or manage plans.[2] The terminal and codex exec also show credential-refresh progress, including Amazon Bedrock reauthentication, so a stalled request tied to expiring credentials is visible instead of silent.
MCP gained several concrete controls. Individual MCP tools accept an output_token_limit, and truncation stays consistent when a session resumes.[2] MCP server names can now contain :, @, /, and ., which allows package-style names across CLI commands and authentication. From 0.151.0, extensions can inspect or replace an MCP tool result before it reaches the model, optional MCP servers get a configurable discovery grace period, and plugin catalogs combine per-repository configuration while still reporting invalid marketplaces rather than hiding valid plugins.[1]
App-server clients can set thread/shellCommand timeouts, including deadlines longer than an hour.[2] The planning tool is now disabled by default; re-enable it with tools.update_plan.enabled = true.[2]
The fix list is heavy on approval and sandbox correctness. Automatic approval reviews retain longer messages and a larger transcript, and preserve user instructions, answers, and valid authorizations across history compaction.[2] Cloud task requests reject untrusted backend URLs and disable redirects to protect saved credentials.[2] Resumed threads restore their saved working directory when none is supplied. On Windows, Codex fixed sandbox execution with Microsoft Store PowerShell, subprocess hangs on terminal queries, and cursor corruption in older JediTerm terminals.[2] From 0.151.0, /cd can no longer weaken sandbox restrictions, and remote sandbox enforcement uses the executor's actual home directory, operating system, and path conventions.[1]
Inside the release#
The span from rust-v0.150.1 to rust-v0.152.0 is 250 commits from 67 distinct authors, dated August 25 to September 1, covering the 0.151.0 and 0.152.0 minors. That works out to roughly 36 commits a day across about a week. The distribution is top-heavy and almost entirely staff: jif-oai accounts for 45 of the sampled commits, then bc-openai (14), felixxia-oai (13), tamird (11), and etraut-openai (11), with -oai and -openai handles filling the long tail. Work sits in one place, 292 of 300 sampled file changes under codex-rs, and the window is strongly additive at about 15,400 lines added against 476 removed.
One theme runs beneath the headline notes: Guardian, the automatic approval-review path. This range rolls Guardian context over before follow-up reviews, honors turn token budgets during that rollover, gives Guardian classifications distinct turn identities, and adds shared context and transcript primitives.[2] From 0.151.0, stale Guardian classifications can no longer authorize actions after permission state changes.[1] Sandbox work in the same window covers macOS Seatbelt read-only defaults alongside the Windows and remote-executor fixes above.[2]
What this tells us#
The Guardian work and the approval-review fixes point at running Codex with less standing human approval while keeping the safety checks coherent across compaction and permission changes. That is the same autonomous-with-guardrails direction Claude Code approaches through its permission and hook system.
The MCP investment is the other clear line. Per-tool output limits, extension-level result rewriting, configurable discovery timing, and package-style server names treat MCP as the primary extension surface rather than a bolt-on, comparable to how Claude Code and Gemini CLI lean on MCP for third-party tooling.
Sandbox correctness spans macOS Seatbelt, the Windows sandbox, and remote executors using their real home directory and OS conventions. Codex is spending heavily on making the same guarantees hold whether execution is local or cloud.
Sources#
This analysis is based on publicly available open-source code and release metadata, conducted for educational and research purposes. All trademarks and software referenced belong to their respective owners.