Codex CLI 0.152: The Small Release That Changes Agent Control

OpenAI’s Codex CLI 0.152.0 release is easy to read as a routine feature update. The more useful reading is operational: it changes how a coding agent plans, consumes MCP output, handles long-running commands, and protects credentials during cloud-task requests.\n\nThis is not a benchmark claim. It is a release-level change list, and the practical impact depends on how you run Codex.\n\n## 1. Planning is now opt-in\n\nThe release disables the update_plan tool by default. If your workflow depends on explicit plans, enable it with:\n\n tools.update_plan.enabled = true\n\nThat is a small configuration change with a large workflow implication. A plan is not the same thing as execution state. If you use plans for review, handoff, or recovery after interruption, store the important state somewhere your process can recover rather than relying on a transient conversation view.\n\n## 2. MCP output gets a per-tool budget\n\nCodex 0.152.0 adds an output_token_limit setting for individual MCP tools, and the release notes say truncation is consistent across session resumes. This is useful because one verbose tool can otherwise crowd out the context needed for the actual coding task.\n\nA practical starting point is to set limits by tool role:\n\n- Small limits for status and metadata tools\n- Moderate limits for search and diagnostics\n- Larger, explicitly reviewed limits for logs or generated reports\n\nThe tradeoff is obvious: truncation controls context pressure, but it can also hide the line that explains a failure. Tool output should therefore carry a cursor, artifact link, or continuation mechanism instead of silently dropping information.\n\n## 3. Long commands need an explicit deadline\n\nApp-server clients can configure thread/shellCommand timeouts, including deadlines longer than one hour. That helps with builds, test suites, and migrations, but a longer timeout is not a cancellation contract. A production runner still needs progress reporting, cancellation behavior, retry rules, and a durable record of whether the command actually completed.\n\n## 4. Credential protection is part of the agent feature set\n\nThe release notes also say cloud task requests reject untrusted backend URLs and disable redirects. That matters because redirects are not just a networking detail when a task can access saved credentials. A safer request path needs an explicit origin policy, and the policy should be tested with redirects, DNS changes, expired credentials, and resumed sessions.\n\n## Where a hosted runtime fits\n\nIf Codex is part of an always-on remote workflow, a hosted runtime such as Ampere can be a convenient place to keep the process and its surrounding automation available. That does not remove the need for state contracts, scoped credentials, isolation, idempotency, or recovery tests. Hosting solves a runtime-placement problem; it does not automatically solve the control-plane problem.\n\n## A practical upgrade checklist\n\nAfter upgrading to 0.152.0, I would test four things before trusting a long-running workflow:\n\n1. Start a task with planning enabled and confirm the setting survives a new session.\n2. Send oversized output through each important MCP tool and verify truncation is visible and recoverable.\n3. Interrupt and resume a long shell command, checking whether execution state is unambiguous.\n4. Attempt a cloud-task redirect to an untrusted origin and confirm it is rejected without exposing credentials.\n\nCodex CLI 0.152.0 is therefore less about a flashy new capability and more about making agent behavior bounded and inspectable. Those defaults are worth reviewing before treating an upgrade as a drop-in replacement.\n\n### Sources\n\n- OpenAI Codex CLI 0.152.0 release notes\n- OpenAI Codex CLI changelog\n- AI/TLDR release summary