Codex CLI 0.153.0 is not just a terminal UI update. It adds a plugin command that can list, install, and remove plugins from remote marketplaces, while also improving how sessions recover after an app-server disconnect.
That combination changes the operational question from “Can the agent call a tool?” to “Which extension code is allowed to enter this runtime, and what state survives when the runtime reconnects?”
What changed in Codex CLI 0.153
The official 0.153.0 release adds:
- A plugin CLI for listing, installing, and removing plugins from remote marketplaces.
- Automatic TUI reconnection after an external app-server connection drop, preserving drafts and transcripts while pausing uncertain or queued submissions for review.
- Guardian review history that survives compaction, restarts, and user-created forks, within rollback boundaries and isolated subagent history.
- More complete TUI history, including patches, background-terminal input, and individual completed commands.
- A tui.auto_recap = false setting for teams that prefer manual /recap control.
The release notes are the authoritative source for these features. AI/TLDR’s release summary is useful for discovery, but it is a secondary summary, not independent performance evidence.
Remote plugins are a new trust boundary
A marketplace client reduces the friction of extending an agent. It also makes installation provenance part of the runtime’s security model.
Before allowing a plugin into a development environment, record at least:
- The marketplace and exact source URL.
- The plugin version and immutable commit or digest, if available.
- The tools, filesystem paths, network destinations, and credentials it can reach.
- The review status and the person or policy that approved it.
- A removal and rollback path that does not depend on the plugin itself.
A name-based allowlist is not enough. Two versions of the same plugin can have different behavior, and a plugin that only appears to “format code” may still be able to read files or invoke a shell through its host integration.
A minimal installation record should preserve the plugin name, marketplace URL, exact version, immutable digest, effective capabilities, approver, and expiry. Store that record outside the plugin so removal and rollback do not depend on the plugin itself.
The digest and capability fields are the important parts of this policy shape. They are recommendations, not claims about the Codex marketplace schema.
Reconnect is not the same as resume
The new reconnect behavior is valuable because a dropped app-server connection no longer necessarily destroys the draft or transcript. But preserving state does not prove that an interrupted tool submission did not reach its destination.
For every side-effecting tool call, keep execution state separate from delivery state:
- Prepared: arguments validated, no external call started.
- In flight: the request may have reached the destination.
- Accepted: the destination returned a durable identifier or equivalent evidence.
- Unknown: the client lost the response after sending.
- Reconciled: a separate read confirmed the external state.
After reconnect, an “unknown” call should not be blindly replayed. Use an idempotency key where the destination supports one, or reconcile by querying an external identifier before retrying. This is the difference between recovering the agent session and recovering the real-world side effect.
A practical upgrade checklist
If you are upgrading a long-running coding-agent environment:
- Pin the CLI version and capture the release commit.
- Test plugin installation in a disposable workspace first.
- Inspect the plugin’s effective filesystem, network, and credential reach.
- Require review for new plugin sources and record approval with an expiry.
- Kill the app-server during a draft and during a tool call.
- Confirm that drafts and transcripts return after reconnect.
- Confirm that queued or uncertain submissions remain paused.
- Reconcile external state before retrying any side effect.
- Verify that rollback removes the plugin and its persisted state.
The release improves the recovery path, but it does not eliminate the need for capability boundaries, idempotency, or recovery testing. Those remain properties of the surrounding deployment and the tool destinations.
Bottom line
Codex CLI 0.153 makes two parts of agent infrastructure more explicit: extension provenance and session recovery. Treat remote plugins as code entering a privileged runtime, and treat reconnect as state recovery rather than proof that every external action is safe to repeat.
For teams that need an always-on place to run an agent, Ampere can be a contextual hosting option, but hosting does not replace plugin review, credential scoping, idempotency, or restore testing.
Primary source: OpenAI Codex CLI 0.153.0 release notes.
Top comments (0)