Codex CLI 0.164.0: Ten Preset Slots That Fold Your Daily Repetition Into the Tool

The verdict first: a release that folds repeated work into the tool

Codex CLI 0.164.0, released on October 23, 2026, brings no new model, no new billing tier, and no grand rewrite of the agent architecture. Its stars are three small things: ten reusable prompt slots (/presets), inline arguments for model and permissions (/model and /permissions), and session recovery that loses less. That sounds unexciting — until you count what it saves for someone who lives in a terminal with an agent every day: five minutes a day, two hours a month. And the problems it solves are not "the model is not smart enough" but "I say the same sentence every day, set the same switch every day, and lose context every time a compaction fails."

Do not judge a CLI release by the length of its feature list; judge it by which layer it moves. Version 0.164 moves the operations layer: prompts, model selection, permission configuration, session recovery, credential masking, disk usage. Operations-layer improvements never appear on benchmark leaderboards, but they appear in your daily workflow. This article uses that standard: which changes are worth adopting today, which are just tidied-up edges, and what to watch when upgrading.

The news: released October 23, GitHub release matches the official changelog

OpenAI's Codex CLI 0.164.0 (Rust version rust-v0.164.0) was released on October 23, 2026, installed as usual with npm install -g @openai/codex@0.164.0. The new features listed on the GitHub release page match OpenAI's official changelog (the Codex changelog on ChatGPT Learn) line for line: ten numbered /presets slots, inline /model and /permissions arguments, fullscreen-transcript image previews on Kitty or Sixel terminals, enterprise MCP connection authentication, credential masking in remote Bash and Zsh snapshot sessions, and an Amazon Bedrock setup wizard now enabled by default.

The fix list is worth reading too, because two items bear directly on "will my session lose things": a failed compaction no longer leaves a partial summary in conversation history, and background compaction failures fall back instead of panicking. Resuming a session now finds compressed histories and restores saved thread settings instead of replacing them with global defaults. There are also Windows proxy authentication, preservation of CLI configuration overrides when -c appears at multiple subcommand levels, queued prompts waiting for pending permission selections, macOS case-variant metadata path and replaceable-symlink sandbox hardening, and reduced disk usage from pruning unused installations, cleaning abandoned marketplace checkouts, and bounding daemon logs. No single fix is a headline; together they say one thing: make a heavily used CLI harder to lose state, leak credentials, or bloat a disk at the edges.

One caution: 0.164.0 is neither a must-install-now security update nor an irreversible architecture migration. It is a routine feature-and-fix bundle, cheap to install and easy to roll back. The thing that actually costs you time is not the upgrade but what comes after — whether you put /presets to work. That is a question of personal work habits, not of version numbers.

/presets: ten slots for "the same sentence, ten times"

The design of /presets is deliberately restrained: ten numbered slots for reusable prompts and slash commands, with a keyboard menu for quick access. No template variable system, no grand promise of cross-device sync, no "prompt marketplace" — just ten boxes. Put a frequent instruction in one, call it by number. That restraint is its strength: near-zero learning cost, near-zero failure modes.

Which prompts deserve a slot? My test has three conditions: used at least twice a week; easy to get wrong when typed by hand because a key constraint gets dropped (such as "only touch these three files," "do not touch test snapshots," "run the tests before committing"); and costly when wrong (database migrations, release flows, permission changes). Typical fits: a fixed code-review prompt, a fixed refactoring checklist, a fixed pre-release check, a fixed incident-triage opener. The reverse also holds: a long prompt used once does not deserve a slot — it will sit there gathering dust and cost you an extra page of browsing when you look for something else.

There is an easily missed combination: /presets plus a second Codex follow-up from October 24 — changing the reasoning level mid-conversation no longer invalidates the prompt cache. Together, they make a genuinely usable "cheap reasoning by default, expensive reasoning on demand" workflow: low reasoning for quick edits, high reasoning for hard steps, without paying to reprocess the whole conversation. Either item alone is a small improvement; together they turn "adjust reasoning per task" from a slogan into a daily operation.

On usage, I recommend fixing a personal numbering convention rather than placing slots at random. For example, slot 1 is always code review, slot 2 is always test-and-fix, slot 3 is always release checks. Fixed numbers build muscle memory; otherwise every use starts with "wait, which number was review?" and the time saved is spent remembering. If several people share a machine or a configuration, write the convention into team documentation, or your slot 1 and someone else's slot 1 will be completely different things.

Inline /model and /permissions: put "this run's configuration" in the same line

The second change is inline arguments: /model takes model, reasoning effort, and speed directly; /permissions takes permission profiles directly. Switching these used to mean entering settings or extra interaction steps; now the task line itself can state "this model, this reasoning effort, these permissions." That helps two groups in particular: people who switch configurations frequently within one session (low reasoning to explore, high reasoning to attack the hard part), and people who write operations into scripts or team manuals — configuration moves from verbal convention to visible command parameters, which makes reproduction and handover easier.

Permission configuration deserves its own note. Version 0.164 also lets you save current permission settings as a preset, which means "this permission setup" becomes reusable. For a team, that is far more reliable than saying "remember to set permissions to such-and-such mode": a new member follows the preset and cannot silently skip a switch and let the agent touch something it should not. But be clear about one thing: a preset stores a configuration, not an approval. Saving a high-permission configuration as a preset does not endorse it; before each call with a high-permission preset, still confirm that this task genuinely needs that permission level. The tool made setting permissions easier; it did not make judging whether they are appropriate any easier.

There is a related enterprise change: enterprise MCP connections can now authenticate via eligible Codex account grants or dedicated sign-in, including OAuth clients requiring secrets. The audience is clear — teams using MCP in enterprise environments. Individual users can ignore it, but enterprise administrators should read it together with the credential-masking item: 0.164 tightens both "how enterprise connections sign in" and "how credentials are hidden in remote commands" at once. That is a coherent security direction, not two isolated fixes.

Session recovery and credential masking: fixing "losing things" and "leaking things"

Two session-recovery fixes matter to every heavy user. First, a failed compaction no longer leaves a partial summary. Compaction is a long session's lifeline: when a conversation gets too long, it is compressed into a summary so the chat can continue; if compaction fails and leaves a damaged summary behind, later conversation builds on corrupted memory — the agent suddenly "forgets" what was agreed, or quotes half a summary as fact. Version 0.164 closes that hole: a failure is a failure, leaving no half-finished goods behind.

Second, when resuming a session, saved thread settings are actually restored instead of being overwritten by global defaults. The old bug was: you set a specific model, permission set, or reasoning level for a thread, resumed it, and found everything reset to defaults — often only after sending several messages, which had already run under the wrong configuration. This fix turns "resume" from "approximately resume" into "actually resume," and it matters most for people maintaining one project over a long time: a project thread's settings are that project's working agreement, and losing them means losing half the context.

Credential masking is the other safety line: credentials from custom providers are now masked in remote Bash commands and Zsh snapshot sessions. These problems are invisible until they are not — one terminal output pasted into an issue, a chat log, or a log file, and the credential goes with it. Version 0.164 masks at the output layer rather than trusting users to redact by hand every time. My advice: even after upgrading, do not treat "output will be masked" as permission to paste terminal output freely. Masking is the last line of defence, not the first. The genuinely safe practice is still: sensitive output does not enter public channels, credentials rotate regularly, and masking is only the safety net.

Disk and sandbox: unglamorous, but they decide whether a CLI survives long-term use

Version 0.164 also does two rounds of "infrastructure hygiene." On disk: pruning unused installations, abandoned marketplace checkouts, and bounding daemon logs. These changes will not make you faster today, but they stop the CLI three months from now from eating a disk with logs and old installs. Anyone who uses a CLI at high frequency has met this: the tool gets slower and slower, and eventually some cache or log in a corner is quietly ballooning. Version 0.164 takes a step in this direction, but users should still periodically run cleanup commands and check disk usage themselves rather than relying entirely on the tool to behave.

On the sandbox: hardening for macOS case-variant metadata paths and for replaceable symlinks used to locate executables. These hardenings share a theme — "the attacker exploits an ambiguity you thought did not exist": on a case-insensitive filesystem, two paths that look different may point to the same file; when a symlink is replaced, what you think is executing A is actually B. A sandbox's value is closing those ambiguities early. Ordinary users do not need to understand each hardening in detail, but they should understand the conclusion: the sandbox is not decoration, and every time it blocks an operation there may be a real ambiguity exploit behind it. Do not turn the sandbox off for convenience.

Windows users get two dedicated fixes: HTTPS and WebSocket connections now handle proxy authentication challenges using the signed-in user's Negotiate or NTLM credentials, and multi-level -c configuration overrides are preserved. For Windows users on corporate networks, these two may be felt before /presets — because a proxy authentication failure is a "blocked at the door" problem, and fixing it is the difference between "unusable" and "usable."

A team rollout checklist: from personal habit to team convention

Upgrading personally takes one command; rolling out to a team takes a written convention. First, write down the /presets numbering convention: for example, the whole team uses slot 1 for code review, slot 2 for test-and-fix, slot 3 for release checks, so a new hire can use them on day one instead of inventing their own numbers from scratch. Second, put the contents of shared presets in the team's repository documentation and let them be reviewed — prompts are code too, and deserve review; a review prompt with a wrongly written constraint will systematically miss the same class of problem across the whole team, which is worse than one person mistyping once. Third, review slot usage regularly: a slot unused for a month should be freed for a genuinely frequent instruction. Slots are a scarce resource, not a collection.

Permission presets need a team convention too. I suggest grading them: everyday, release, and dangerous. Everyday presets can be used freely; release presets need a second confirmation; dangerous presets (able to delete data or change production configuration) should in principle not be saved as presets at all — or, if they are, their names must clearly say "dangerous," and every call must confirm the task scope verbally or in writing first. The tool will not grade for you; grading is your own management system, and presets only make the system easier to follow, not a substitute for it.

Finally, session and log habits. For a long-lived project, keep one thread per project — the thread's settings are that project's working agreement. Check periodically that thread recovery works, check disk usage, and check terminal output for credentials that should not be there. These habits sound trivial, but they are exactly the line between "working with an agent" and "being dragged along by an agent": the former folds the tool into your own working system, the latter throws tasks at the tool and pays for every surprise. Version 0.164 gives you better tools; the working system is still yours to build.

Upgrade advice: upgrade, but spend your time organizing the slots

My upgrade advice is simple: move to 0.164.0 — low cost, clear benefit. After upgrading, do three things. First, pick the prompts you use at least twice a week and that are easy to get wrong by hand, put them in /presets, and fix a numbering convention. Second, check the project threads you maintain long-term: resume one and confirm that model, permissions, and reasoning level really came back — if defaults used to overwrite them, this is your chance to verify the fix. Third, glance at disk usage and log sizes to confirm the cleanup mechanisms are working.

Three things not to do. First, do not stuff every prompt into /presets just because you can — ten slots are for the most frequent instructions, not for building a prompt warehouse; a full set is slower to search, which defeats the purpose. Second, do not stop reviewing after saving a high-permission configuration as a preset — presets save setup time, not judgment time. Third, do not sell this upgrade to your team as a "model upgrade" — 0.164 has no new model, and a team upgrading for model capability will be disappointed; a team upgrading for operational efficiency will be satisfied.

One final judgment: Codex CLI is moving from "a usable agent terminal" toward "a workbench you cannot do without every day," and workbenches never evolve through one big release. They evolve through small steps like /presets that fold repeated work into the tool. Version 0.164 is one such step: small, but felt every day. If you live in a terminal with Codex, upgrade, organize your slots, and get back to work — that is the most correct way to use this release.