Codex 0.142 Turns Agent Governance Into a Runtime Surface

Codex 0.142.0 is not a “look, the agent writes code now” release. That era is over. The interesting work has moved down a layer, into the places where coding agents either become operable software or remain expensive autocomplete with a shell.

OpenAI’s stable Codex 0.142.0 release, published June 22, packages a week of alpha churn into a clearer thesis: the competitive surface for coding agents is becoming runtime control. Budget, plugin provenance, delegation mode, permission profiles, web access, scheduled time, proxy trust, and reset credits are now product features. Not because they demo well. Because without them, teams cannot tell what the agent did, why it stopped, what it was allowed to touch, or how much it cost.

The release lands after same-day alpha tags and a substantial diff from 0.141.0: GitHub’s compare reports 181 commits ahead, one behind, and the API-capped 300 surfaced files with 10,455 additions and 1,396 deletions. That is a lot of plumbing. In agent products, plumbing is where the blast radius lives.

The invoice is moving into the task loop

The most practical feature is rollout budgeting. Codex now tracks token usage across agent threads, sends remaining-budget reminders, and aborts turns when a configured budget is exhausted. PR #29423 sharpens that design by replacing a single reminder interval with explicit remaining-token thresholds such as 65,536, 32,768, 16,384, 8,192, 4,096, 2,048, 1,024, and 512 tokens.

That matters because an agent run is not one prompt. It is a rollout: multiple turns, tool calls, retries, possible subagents, summaries, compactions, model switches, and background work. A reminder every N tokens spent is less useful than a warning at the moment capacity becomes strategically scarce. At 65K remaining, the agent can keep exploring. At 4K, it needs to summarize, narrow scope, or ask. At 512, continuing may be worse than stopping because the next response is likely to be an under-contextualized shrug wearing a confident face.

Codex also expands /usage so it can show and redeem earned usage-limit reset credits with confirmation, retry, and refreshed availability states. That is small in UI terms and large in operating-model terms. Usage is no longer just a billing artifact after the fact; it is becoming a live control surface inside the development workflow.

Plugins are becoming supply chain, not decoration

The plugin work points in the same direction. Codex now organizes remote plugins into OpenAI Curated, Workspace, and Shared with me sections. Eligible turns can recommend and install relevant plugins. OpenAI’s plugin docs describe plugins as bundles of skills, app integrations, and MCP servers, with approval settings still applying after installation and external apps or MCP servers potentially requiring separate authentication.

That combination is powerful and uncomfortable. A plugin is not just a prompt pack. It may be a route to tools, services, app context, and authenticated MCP servers. Provenance therefore needs to be visible. “OpenAI Curated” and “Workspace” are not marketing labels; they are trust hints. PR #27669 goes even more operational, persisting authoritative backend remote plugin IDs in an atomic .codex-remote-plugin-install.json sidecar with schema versioning. The validation note says 268 codex-core-plugins tests passed.

That is the kind of boring metadata that prevents future incident reports from turning into archaeology. If an agent used a plugin, teams need to know which plugin, from which source, under which backend identity, after which refresh. Otherwise “the agent had a tool” is not an audit trail. It is a campfire story.

Security UX is finally admitting policy exists

Permission profiles also get more honest. PR #26678 adds an allowed field to each permission-profile summary, letting clients show profiles that exist but are disabled by enterprise policy. That is better than making forbidden options disappear. Invisible policy trains users to believe the product is inconsistent. Visible policy teaches them where the boundary is.

The custom CA and managed MITM fix in PR #29014 is narrower, but it is exactly the kind of enterprise-network detail that separates a serious tool from a demo. When Codex starts with SSL_CERT_FILE=/path/to/corp-ca.pem, the managed proxy now loads platform roots without inherited override variables, appends startup CA material, shares those roots with the upstream TLS connector, excludes the Codex-managed MITM CA from upstream trust, and copies certificate material without exposing private keys or unrelated text through the public bundle.

Corporate TLS interception is messy. Agent tools that execute code, fetch resources, and talk to model backends cannot hand-wave it. A broken CA path is annoying; trusting the wrong CA material upstream is a security bug with better lighting.

The release also lands alongside security maintenance: PR #29487 upgrades bundled OpenSSL from 3.5.5 to 3.6.3 because 3.5.5 falls within affected ranges for later-fixed issues and the Rust openssl-src wrapper does not publish OpenSSL 3.5.7. Again: not glamorous. Also exactly the work you want from software that may sit between your repo, your shell, your network, and a model.

The agent now has a clock, a web boundary, and a delegation policy

Codex 0.142.0 also exposes controls that sound unrelated until you view them as one state machine. App-server clients can configure multi-agent delegation as disabled, explicit-request-only, or proactive. Indexed web search can permit live searches while restricting direct page access to server-approved URLs. Codex can receive scheduled UTC reminders and query current time, including through client-provided app-server clocks.

Those are all ways of replacing prompt vibes with runtime facts. “Be careful with subagents” is not a policy. “Use explicit-request-only delegation for this thread” is. “Search the web if needed” is not a boundary. “Search an index, but only access server-approved URLs directly” is. “Remember this later” is not reliable infrastructure. A scheduled UTC reminder with a client-provided clock is at least a real interface.

This is where Codex is becoming more interesting as an architecture reference than as a single CLI. If you are building an internal coding-agent harness, 0.142.0 is a checklist: do you have task-level budgets, remaining-capacity warnings, visible permission policy, plugin provenance, approval persistence, remote/plugin identity, web-access boundaries, scheduled time, and enterprise-network trust handling? If the answer is “we have a system prompt,” that is not the same thing.

The risk is knob explosion. Budgets, plugins, permission profiles, indexed search, scheduled reminders, delegation modes, remote environments, and proxy trust are all legitimate controls. They are also enough surface area to recreate Kubernetes, except now the pod can argue with you. The product challenge is making defaults conservative and explanations precise. New threads defaulting toward explicit delegation and clients showing disallowed profiles are good signs. Hidden feature flags and fast alpha churn are still the tax of building in public.

For teams running Codex, this is a release to test deliberately rather than install reflexively. Exercise /usage, budget thresholds, plugin install and recommendation flows, permission profiles, remote plugin refresh, corporate CA behavior, and UTC reminders together. The failure cases are the point: exhausted budget, disallowed profile, stale plugin identity, proxy startup with custom CA material, and a reminder across time-zone assumptions.

The headline is not that Codex 0.142.0 can code. The headline is that OpenAI is moving agent operations into the product surface. That is the right fight. The serious coding-agent race is now about who can expose budget, permissions, plugins, web access, time, and enterprise network constraints without turning every developer into a runtime administrator.

Sources: OpenAI Codex 0.142.0 release, GitHub compare, PR #29423, PR #26678, PR #29014, OpenAI Codex plugin docs