Codex CLI v0.164.0 Stable: /presets, Image Previews, Enterprise MCP GA, and Bedrock Default-On

Sketchnote diagram for: Codex CLI v0.164.0 Stable: /presets, Image Previews, Enterprise MCP GA, and Bedrock Default-On

Release date: 23 October 2026, 04:48 UTC Version: v0.164.0 stable Previous stable: v0.163.0 (15 October 2026)

Codex CLI v0.164.0 reached stable on 23 October 2026 after a twelve-iteration alpha sprint (alpha.1 through alpha.12, running 17–22 October). The release brings prompt management via /presets, inline image previews, the graduation of enterprise MCP authentication to general availability, Bedrock setup defaulting on, and a credential masking layer for remote execution environments.

This article covers the user-facing features in v0.164.0 stable. For the enterprise auth architecture that formed the backbone of the alpha sprint, see Bedrock Default-On: How v0.164.0’s Alpha.9–11 Sprint Completed the Enterprise Auth Architecture and MCP OAuth Default-On and the Enterprise Auth Overhaul.

New User-Facing Features

/presets — Reusable Prompt Slots

The /presets command introduces ten numbered slots for storing and reusing prompts and slash commands across sessions.

/presets

Entering /presets opens a keyboard shortcut menu showing the ten available slots. You can assign any prompt text or slash command to a slot, then invoke it by number during any subsequent session. Slots persist across sessions and are stored in user configuration.

This addresses a common friction point in longer-running workflows: repeating complex system-level prompts (e.g. “run the full test suite and fix any failures, committing after each fix”) or project-specific commands that do not belong in AGENTS.md but are nonetheless used daily.

The /presets system is particularly useful in team settings where a shared set of project prompts can be distributed via configuration bundles, giving every developer on the team access to the same standardised invocations.

/model and /permissions Inline

v0.164.0 allows the /model and /permissions commands to be used inline within a prompt turn, rather than requiring a separate command step.

/model codex-1 Write a migration script for the payments table
/permissions full-access Run the integration tests

Previously, changing the model or permission profile required entering a separate /model or /permissions command, waiting for acknowledgement, and then issuing the actual prompt. The inline form collapses two steps into one, which matters most in sessions with frequent context switches between tasks that require different model or permission configurations.

Image Previews in Fullscreen Transcript

Images — both generated by the agent and viewed during a session — now render as inline previews in the fullscreen transcript view on terminals that support Kitty graphics protocol or Sixel output.

Previously, image references in the transcript appeared as file paths or URLs only. The inline preview makes it practical to review visual output (generated diagrams, screenshots from test runs, UI mockups) without leaving the Codex session.

Preview rendering is bounded: images are scaled to fit the available column width without overflowing the transcript layout. On terminals that do not support Kitty or Sixel, images continue to display as references.

Enterprise MCP Authentication — General Availability

Enterprise MCP authentication graduates from experimental to general availability in v0.164.0. Three authentication paths are now fully supported:

Codex account grants — authenticate an enterprise MCP server using an existing Codex account session; no separate credentials required.
Dedicated MCP sign-in — sign in to an enterprise MCP server with its own identity provider, separate from the Codex account.
OAuth clients requiring secrets — authenticate MCP servers that require OAuth client credentials stored outside the Codex keychain.

The enterprise MCP auth path was introduced in alpha form during the v0.163.0 cycle and progressively hardened through the v0.164.0 alpha sprint (PRs #55334, #55859, #56001 and related fixes). GA status means the feature is now covered by stability guarantees and is suitable for production enterprise deployments.

For a detailed account of the auth architecture changes that underpinned this graduation, see Zero-Trust Agent Runtime: Ephemeral Registration and Signed Assertions.

Credential Masking for Remote Execution

Credentials referenced in remote Bash commands and Zsh snapshot sessions are now masked in logs, transcripts, and approval prompts.

The masking layer covers three credential paths:

Remote Bash commands — any value passed as a secret environment variable is redacted in approval UI and audit logs.
Zsh snapshot sessions — environment variables captured at session snapshot time are filtered against the credential store before recording.
Custom credential providers — credentials sourced via the provider plugin API receive the same masking treatment as built-in credential types.

This change addresses a compliance requirement that affected enterprise deployments using remote execution environments where Codex activity logs are retained and audited.

Bedrock Setup Wizard Default-On

The AWS Bedrock setup wizard is now enabled by default for all users. Previously, Bedrock configuration required manual setup; the wizard walked through AWS credential entry and Bedrock region selection only when explicitly invoked.

From v0.164.0, the Bedrock setup wizard appears in the onboarding flow for new installations and is accessible from the sign-in screen for existing installations. AWS Bedrock API key entry is grouped with other AWS sign-in methods rather than appearing in a separate configuration section.

For teams standardising on AWS Bedrock as the inference backend for Codex — a pattern that became common after the enterprise auth overhaul in the alpha sprint — this removes a setup step that previously required documentation or IT-desk guidance.

Selected Bug Fixes

Compaction No Longer Corrupts Conversation History

Two compaction-related fixes land in v0.164.0 stable (PRs #53932, #55581). Compaction — the process of summarising and truncating long conversation histories to stay within the context window — could previously fail in a way that left the conversation history in a corrupt state, causing subsequent turns to behave unpredictably or the session to fail to resume.

The fixes make compaction failures non-destructive: if a compaction attempt fails, the original history is preserved and the session continues from the last known-good state.

Session Resume Restores Compressed Histories and Thread Settings

Session resume (the ability to pick up a previous Codex session, including its conversation history) now correctly handles sessions whose histories were compressed (PRs #54008, #55923). Previously, resuming a session with a compressed history could result in an incomplete or missing context. Thread-level settings (model selection, permission profile, active tools) are also restored correctly on resume.

Windows Proxy Authentication

Windows users relying on HTTPS or WebSocket proxies that use Negotiate or NTLM authentication — common in enterprise network environments — previously encountered authentication failures when connecting through those proxies (PRs #55994, #56000). This is resolved in v0.164.0.

CLI Config Overrides Preserved Across Subcommand Levels

Configuration values set via CLI flags (--model, --approval-policy, etc.) are now correctly propagated across all subcommand invocation levels (PR #56022). Previously, config overrides applied at the top-level codex command could be silently dropped when control passed to a subcommand handler.

Queued Prompts Wait for Permission Selections

When a prompt triggers a permission approval request, any subsequently queued prompts now wait for the approval to complete before proceeding (PR #55682). Previously, queued prompts could advance past pending approvals, resulting in tool calls being made without the expected approval gating.

macOS Sandbox Hardening

The macOS sandbox has been hardened against two attack vectors (PRs #54273, #55384):

Case-variant metadata — filenames with case variations that could bypass sandbox path checks on case-insensitive macOS filesystems.
Replaceable symlinks — symlinks in sandbox-permitted paths that could be swapped to point outside the sandbox boundary between the check and the access.

Infrastructure and Chores

Disk usage — Unused installations are pruned automatically, daemon log files are bounded in size, and marketplace checkout directories are cleaned on session exit. This addresses a long-standing complaint from users on constrained disks.
V8 runtime — The embedded V8 JavaScript runtime is upgraded with Array.sort safety guards, resolving a class of non-deterministic sort behaviour that could surface in scripted Codex workflows using the JavaScript tool.

Upgrade

npm install -g @openai/codex@latest
codex --version  # should report v0.164.0

To pin to this version:

npm install -g @openai/codex@0.164.0

What Comes Next

The v0.163.0 backport track (addressing the macOS bootstrap failure, Ubuntu 24.04 hang, and Windows 11 26H2 daemon regression that shipped with v0.163.0 stable) is still active as v0.163.0-alpha.11.1 and alpha.11.2. No v0.163.1 patch has been cut; users on v0.163.0 who encountered any of those regressions should upgrade to v0.164.0.

The v0.165.0 alpha sprint has not yet begun at the time of writing. Based on the v0.164.0 sprint pattern, the next cycle is expected to start within a few days of stable shipping.

For the community reliability picture as of stable release — including the Daybreak Blue restrictions thread, Windows file deletion incident, and Linux OOM regression — see the changelog watch entry for 23 October 2026.