Codex 0.147.0: Smarter Approvals, Safer Automation

Ethan Park

You leave an AI agent running a refactor, you come back twenty minutes later expecting a finished pull request, and instead it is sitting there stuck on step two asking if it can read a file in src.

Maya

Oh, the prompt fatigue is real! You either click yes fifty times in a row without looking, or you get tempted to just turn off all safety controls entirely.

Ethan Park

Exactly. And before we dig into how the new release fixes that, a quick shout out to Jellypod for helping make this daily show possible. Now, in Codex version 0.147.0, they hit this problem head on. Enable automatically reviewed approvals with the new approve for me CLI flag. That is literally what they added, while officially removing the deprecated full auto flag.

Maya

So wait, full auto is completely gone now? What actually happens under the hood when you pass approve for me?

Ethan Park

Yeah, full auto is gone. When you run double dash approve for me, it configures your approval policy to on request inside a workspace write sandbox environment. So, if the model wants to make routine file reads or edits within your repository, the local policy engine automatically evaluates the risk and lets it proceed instantly.

Maya

Okay, so routine file tweaks pass right through. But what if the agent tries to do something, well, sketchy? Like making external web requests or pulling down third party authentication tokens?

Ethan Park

That is where the boundary holds. If it attempts external code egress, or tries to refresh third party auth credentials, the automated reviewer flags it as high risk and halts for a human decision. It is not blind permission. It is contextual review.

Maya

That is huge for batch workflows! Like if I execute codex exec double dash approve for me refactor parser module inside a nightly script, it does not die on the first trivial edit, but it will still stop before doing anything dangerous.

Ethan Park

Right! And what is really neat is how those rules propagate. If your session forks, or if you pause and later run codex resume, that approve for me policy carries over seamlessly. You can even set approval policy equals on request globally inside your dot codex slash config dot toml file if you want it everywhere.

Maya

Man, going from binary yes or no prompts to intelligent automated reviews changes the whole vibe of headless runs. You lose the prompt exhaustion without handing over total master keys to the system.

Ethan Park

Though, there are definitely a few edge cases you need to watch out for if you are spinning this up across different platforms.

Maya

Oh, really? Like what kind of edge cases?

Ethan Park

Well, on Windows repositories specifically, there is a known latency bottleneck right now. When apply patch runs under automated review across dozens of files, it can trigger repeated filesystem RPC helper restarts and refresh the access control list setups for every single file touch.

Maya

Wow, so a multi file patch on Windows could suddenly take minutes instead of seconds just spinning on security setup checks?

Ethan Park

Exactly. It works correctly, but it gets bogged down in RPC overhead. The other thing people are hitting is classifier denials. If your agent script tries to pipe code out to external tools, say calling claude p in a subprocess, the engine throws auto review denied high risk and freezes the task.

Maya

And I bet the instinct when people see auto review denied is to try and disable the sandbox entirely!

Ethan Park

Right! But the fix is not to lower your guardrails. The right approach is to selectively grant specific tool permissions or update your policy configuration rather than turning the safety layers off.

Maya

That makes sense. What else made it into this 0.147.0 release on the polish side?

Ethan Park

A few really nice quality of life updates. They switched macOS build notarization over to Azure Key Vault for better signing security. Terminal rendering got a fix too, specifically Japanese halfwidth characters rendering incorrectly in Ratatui version 0.30.2. And codex doctor now explicitly enforces project trust settings before running diagnostic checks.

Maya

You can really see the direction here. As terminal agents get more capable, we cannot rely on all or nothing switches like full auto anymore. Policy driven sandboxing is where everything is moving.

Ethan Park

Exactly. Keep the sandbox tight, let routine workspace edits flow, and only intervene when the risk actually spikes. Good rule for daily dev workflows.

Maya

Alright, that is it for today's quick take. Catch you all next time!