Codex 0.164.0 Adds Presets and Permission Controls

Codex 0.164.0 is a tooling release

The official `openai/codex` repository published its `rust-v0.164.0` release on October 23 UTC. The notes list reusable prompt presets, inline model and permission arguments, terminal image previews, enterprise MCP authentication, credential masking in supported remote shell contexts, and several reliability and sandbox fixes. These are changes to the Codex tool, not a launch of a new language model. The release page links individual pull requests and a comparison with the prior tag, which gives maintainers a way to inspect implementation details. Availability can differ by platform, account, terminal capability and enabled feature, so the changelog is a feature inventory rather than proof that every local installation already behaves the same way.

Presets and inline settings affect repeatability

The notes say users can save reusable prompts and slash commands in ten numbered `/presets` slots and pick them from a keyboard menu. They also describe inline `/model` and `/permissions` arguments for model, reasoning effort, speed and permission profiles. For a team that repeats code review or release checks, these affordances can reduce manual setup mistakes. They do not replace a versioned repository instruction or a recorded run configuration. A reviewer should still capture the actual model, working directory, permissions, input revision and tool results when a run is used as evidence. A named preset may change after an individual edits it; the name alone is not a complete reproducibility record.

The permissions control is particularly consequential. Choosing a more capable model and changing the filesystem or network profile are separate decisions. An inline command makes the selected profile visible at invocation, but the real boundary is the tool enforcement underneath. Teams should test a denied file and a denied network destination under the chosen profile, then review what the agent can do in a fresh session. The release notes describe the interface change; they do not certify that a user's custom environment has a correct security policy. A preset that asks for wide access should remain subject to the same review as an ad hoc prompt.

Integration and display changes

The release supports authentication for eligible enterprise MCP connections through Codex account grants or a dedicated sign-in, including OAuth clients that require secrets. This can make a managed tool connection more usable, but authentication is not authorization to every resource behind it. Administrators need to map the account grant to the server's own scopes and audit logs. The notes also say credential masking was added for supported remote Bash commands and Zsh snapshot sessions, including custom provider credentials. Masking lowers the chance of sensitive text appearing in a transcript; it is not a reason to paste credentials into prompts or to assume every possible output sink is covered. Test the exact supported command path with a non-secret sentinel.

Image previews can appear in the full-screen transcript on terminals supporting Kitty or Sixel graphics. That is a local display capability, not a change to the image file or to the quality of a generated image. An image review workflow should still preserve the source file and explain what was inspected. Terminal support and multiplexers can affect whether the preview is visible, so a text-only path remains useful. The release also enables the Amazon Bedrock setup wizard by default and groups API-key entry with other AWS sign-in options when credentials are detected. Operators should verify the chosen account and region rather than infer them from a wizard's availability.

Fixes that matter to long-running work

The bug fixes include compaction behavior after a failed summary, restoration of compressed histories and thread settings when sessions resume, preservation of CLI configuration overrides across subcommands, and a queue that waits for pending permission selections. These all relate to a session's continuity: a resumed task should not silently lose its settings, and a queued prompt should not race ahead of a human permission choice. The notes also describe Windows proxy authentication fixes and stronger macOS sandbox checks for case-variant metadata paths and replaceable executable symlinks. The practical test for any one team is focused on its actual operating system and workflow; one successful launch does not exercise the corrected edge cases.

A safe way to evaluate the upgrade

Install or stage the tagged release in a disposable workspace, then run a small preset with recorded inputs and compare its output against the previous version. Verify that inline permissions take effect, that a denied action remains denied, that a paused permission request blocks queued prompts, and that a resumed session restores its intended settings. Where an enterprise MCP server is used, test account grant, expiry and revocation with a test resource. If remote shell masking is important, use a deliberately fake credential pattern and inspect all expected logs. These are proposed acceptance checks drawn from the change list, not claims of tests performed for this article.

The release is meaningful because it improves the control surface and failure handling of an agent developers may already use. It does not prove that Codex performs coding tasks better than another agent, and the notes publish no comparative task benchmark for these features. The October 25 issue date reflects editorial timing; the upstream GitHub release is dated October 23. Readers should link a decision to that tag and its pull requests, especially if a fast-moving installation may already have advanced further.