So, uh, if you were trying to push code late last Tuesday and suddenly found
yourself completely locked out of your own private GitHub repo by your own CLI,
you- you weren't losing your mind.
Codex CLI version 0.144.0 dropped, and with it came this- this
absolutely brutal prompting regression in the Guardian safety system.
It was basically treating standard, everyday git pushes as malicious exfiltration
attempts.
Thanks to Jellypod for helping make this daily show a reality.
We're breaking down how the 0.144.2 and 0.144.3
emergency patches had to walk this back immediately.
Wait, it- it actually blocked normal git pushes?
Like, not even force pushes, just a regular git push to a verified private repo?
Yeah, exactly.
A plain old git push origin main.
The system's autonomous reviewer, Guardian, which is supposed to watch the sandbox
boundary, looked at those outbound SSH and HTTPS payloads and basically went into
full-blown panic mode.
It flagged them as data exfiltration.
And the worst part was, it- it totally ignored explicit user overrides.
You'd tell it, "No, really, let this go through," and the agent would just loop back
and reject it again.
That sounds incredibly frustrating.
An infinite loop of "No, I know better than you."
What actually broke in the prompts to make it go that paranoid?
It- it comes down to how they refactored the prompt templates in 0.144.0.
They tried to tighten the security boundaries around LLM tool usage,
but the new instructions made the LLM interpret *any* encrypted outbound network
socket connection to an external IP as a high-severity threat.
Since git uses SSH or TLS, the LLM couldn't inspect the raw payload inside the
stream, and its default fallback in the new prompt was "deny everything."
So they had to rush out 0.144.2 to literally rip those new prompt templates out
and restore the old, stable system prompt and tool definitions.
So 0.144.2 was a direct rollback of the prompts.
But wait, you- you mentioned 0.144.3 as well.
Why did they need another hotfix right after that?
Right, so 0.144.2 fixed the core prompt logic, but they realized there was a
lingering race condition in how the tool parameters were being validated under the
hood when the Guardian circuit breaker tripped.
If a developer tried to push during that split second the agent was failing,
it would hang the terminal UI entirely.
0.144.3 went out to cleanly reset those internal state variables so the CLI
didn't freeze up your terminal.
Okay, that makes sense.
But let's actually look under the hood of how this auto-review mechanism is supposed
to work when it's *not* breaking.
Because the whole concept of having a secondary agent sit at the sandbox boundary is
pretty fascinating.
You set approvals_reviewer = "auto_review" in your config, right?
Yeah, that's the configuration key.
What that does is spin up a separate, highly specialized agent whose only job is to
evaluate proposed actions from the primary agent.
If the primary agent tries to run a bash command or write to a sensitive path,
the auto-reviewer intercepts it and evaluates it against your defined policy file,
which is configured under .policy.
And that's where the circuit breaker comes in.
I read that if the auto-reviewer denies a command too many times,
it completely trips and locks down the session.
Right, it's a security circuit breaker.
If you get consecutive denials, the system assumes the primary agent is in an
unstable loop or has been compromised, and it stops execution entirely.
But they did build an escape hatch.
If you are sitting there in the terminal UI, you can manually override a blocked
state or a tripped circuit breaker by typing the /approve command directly into the
interactive prompt.
It's designed to let a human step in and say, "Hey, I've looked at this,
the command is safe, keep going."
Which, of course, is exactly what was broken in 0.144.0 because the prompt
regression was so severe it was overriding even that manual /approve command.
But, besides that mess, they did add some pretty solid quality-of-life features in
0.144.0 that are actually worth talking about.
Absolutely.
The big one is the new writes approval mode.
Before this, you basically had two choices: either approve every single action
manually, which is exhausting, or auto-approve everything, which is terrifying.
approvals_mode = "writes" is the middle ground.
It automatically allows read-only operations-like reading files,
listing directories, or checking system status-but pauses and prompts you the moment
the agent tries to write a file change, delete something, or modify your
environment.
Honestly, that makes so much sense for daily use.
I don't need to click approve twenty times just for an agent to search a codebase,
but I definitely want a prompt before it starts rewriting my config files.
Did they do anything to make authentication less painful too?
They did.
They added interactive MCP, or Model Context Protocol, authentication directly
inside the terminal workflow.
So if an agent needs to authenticate with an external service or a secure database
connector, you don't have to jump out to a browser or manually copy-paste tokens
into your env files anymore.
It handles the auth handshake directly in the interactive console stream.
It's a huge step toward making the CLI feel like a cohesive developer environment
rather than a loose collection of scripts.
Yeah, it really feels like they're trying to polish the rough edges of how we
actually interact with these agents on a daily basis.
The 0.144.2 and .3 patches seem to have put out the immediate fire,
so we can actually enjoy those new features without our git workflows getting
completely nuked.
Exactly.
Standard service has been resumed.
Keep your CLI updated, folks.
Alright, that's it for us today.
Talk to you soon.
Catch you later.