1
00:00:00,100 --> 00:00:04,880
So, uh, if you were trying to push code
late last Tuesday and suddenly found

2
00:00:04,920 --> 00:00:09,640
yourself completely locked out of your own
private GitHub repo by your own CLI,

3
00:00:09,700 --> 00:00:11,300
you- you weren't losing your mind.

4
00:00:11,840 --> 00:00:18,750
Codex CLI version 0.144.0 dropped, and
with it came this- this

5
00:00:18,840 --> 00:00:23,250
absolutely brutal prompting regression in
the Guardian safety system.

6
00:00:24,000 --> 00:00:29,560
It was basically treating standard,
everyday git pushes as malicious exfiltration

7
00:00:29,600 --> 00:00:30,050
attempts.

8
00:00:30,750 --> 00:00:33,860
Thanks to Jellypod for helping make this
daily show a reality.

9
00:00:34,480 --> 00:00:40,860
We're breaking down how the 0.144.2 and
0.144.3

10
00:00:40,940 --> 00:00:44,449
emergency patches had to walk this back
immediately.

11
00:00:45,167 --> 00:00:48,317
Wait, it- it actually blocked normal git
pushes?

12
00:00:48,456 --> 00:00:49,097
Like, not even force pushes, just a
regular git push to a verified private repo?

13
00:00:49,200 --> 00:00:49,900
Yeah, exactly.

14
00:00:50,280 --> 00:00:52,660
A plain old git push origin main.

15
00:00:53,180 --> 00:00:58,060
The system's autonomous reviewer,
Guardian, which is supposed to watch the sandbox

16
00:00:58,140 --> 00:01:04,810
boundary, looked at those outbound SSH and
HTTPS payloads and basically went into

17
00:01:04,840 --> 00:01:06,980
full-blown panic mode.

18
00:01:07,040 --> 00:01:09,800
It flagged them as data exfiltration.

19
00:01:09,820 --> 00:01:14,700
And the worst part was, it- it totally
ignored explicit user overrides.

20
00:01:15,280 --> 00:01:20,300
You'd tell it, "No, really, let this go
through," and the agent would just loop back

21
00:01:20,340 --> 00:01:21,260
and reject it again.

22
00:01:22,869 --> 00:01:25,269
That sounds incredibly frustrating.

23
00:01:25,769 --> 00:01:28,809
An infinite loop of "No, I know better
than you."

24
00:01:29,649 --> 00:01:33,589
What actually broke in the prompts to make
it go that paranoid?

25
00:01:34,522 --> 00:01:40,252
It- it comes down to how they refactored
the prompt templates in 0.144.0.

26
00:01:40,922 --> 00:01:44,502
They tried to tighten the security
boundaries around LLM tool usage,

27
00:01:45,082 --> 00:01:50,322
but the new instructions made the LLM
interpret *any* encrypted outbound network

28
00:01:50,442 --> 00:01:54,982
socket connection to an external IP as a
high-severity threat.

29
00:01:55,782 --> 00:02:02,002
Since git uses SSH or TLS, the LLM
couldn't inspect the raw payload inside the

30
00:02:02,012 --> 00:02:07,182
stream, and its default fallback in the
new prompt was "deny everything."

31
00:02:07,922 --> 00:02:14,842
So they had to rush out 0.144.2 to
literally rip those new prompt templates out

32
00:02:14,882 --> 00:02:18,912
and restore the old, stable system prompt
and tool definitions.

33
00:02:19,653 --> 00:02:24,933
So 0.144.2 was a direct rollback of the
prompts.

34
00:02:24,973 --> 00:02:29,353
But wait, you- you mentioned 0.144.3 as
well.

35
00:02:29,393 --> 00:02:31,662
Why did they need another hotfix right
after that?

36
00:02:32,567 --> 00:02:39,316
Right, so 0.144.2 fixed the core prompt
logic, but they realized there was a

37
00:02:39,487 --> 00:02:44,096
lingering race condition in how the tool
parameters were being validated under the

38
00:02:44,167 --> 00:02:46,667
hood when the Guardian circuit breaker
tripped.

39
00:02:47,387 --> 00:02:51,607
If a developer tried to push during that
split second the agent was failing,

40
00:02:51,667 --> 00:02:53,947
it would hang the terminal UI entirely.

41
00:02:54,947 --> 00:03:01,707
0.144.3 went out to cleanly reset those
internal state variables so the CLI

42
00:03:01,807 --> 00:03:02,967
didn't freeze up your terminal.

43
00:03:03,624 --> 00:03:05,284
Okay, that makes sense.

44
00:03:06,004 --> 00:03:10,544
But let's actually look under the hood of
how this auto-review mechanism is supposed

45
00:03:10,553 --> 00:03:13,044
to work when it's *not* breaking.

46
00:03:13,164 --> 00:03:18,034
Because the whole concept of having a
secondary agent sit at the sandbox boundary is

47
00:03:18,084 --> 00:03:19,764
pretty fascinating.

48
00:03:19,804 --> 00:03:24,434
You set approvals_reviewer = "auto_review"
in your config, right?

49
00:03:25,390 --> 00:03:27,040
Yeah, that's the configuration key.

50
00:03:27,690 --> 00:03:33,350
What that does is spin up a separate,
highly specialized agent whose only job is to

51
00:03:33,390 --> 00:03:36,260
evaluate proposed actions from the primary
agent.

52
00:03:36,970 --> 00:03:41,770
If the primary agent tries to run a bash
command or write to a sensitive path,

53
00:03:41,780 --> 00:03:46,570
the auto-reviewer intercepts it and
evaluates it against your defined policy file,

54
00:03:47,110 --> 00:03:51,170
which is configured under .policy.

55
00:03:51,793 --> 00:03:53,922
And that's where the circuit breaker comes
in.

56
00:03:54,633 --> 00:03:58,122
I read that if the auto-reviewer denies a
command too many times,

57
00:03:58,552 --> 00:04:01,283
it completely trips and locks down the
session.

58
00:04:02,190 --> 00:04:04,050
Right, it's a security circuit breaker.

59
00:04:04,750 --> 00:04:09,490
If you get consecutive denials, the system
assumes the primary agent is in an

60
00:04:09,550 --> 00:04:14,580
unstable loop or has been compromised, and
it stops execution entirely.

61
00:04:15,390 --> 00:04:17,010
But they did build an escape hatch.

62
00:04:17,710 --> 00:04:22,300
If you are sitting there in the terminal
UI, you can manually override a blocked

63
00:04:22,370 --> 00:04:28,510
state or a tripped circuit breaker by
typing the /approve command directly into the

64
00:04:28,590 --> 00:04:29,510
interactive prompt.

65
00:04:30,270 --> 00:04:33,850
It's designed to let a human step in and
say, "Hey, I've looked at this,

66
00:04:34,150 --> 00:04:36,070
the command is safe, keep going."

67
00:04:36,737 --> 00:04:42,597
Which, of course, is exactly what was
broken in 0.144.0 because the prompt

68
00:04:42,677 --> 00:04:48,037
regression was so severe it was overriding
even that manual /approve command.

69
00:04:49,337 --> 00:04:53,757
But, besides that mess, they did add some
pretty solid quality-of-life features in

70
00:04:53,767 --> 00:04:56,897
0.144.0 that are actually worth talking
about.

71
00:04:57,725 --> 00:04:58,645
Absolutely.

72
00:04:58,685 --> 00:05:01,065
The big one is the new writes approval
mode.

73
00:05:01,685 --> 00:05:06,685
Before this, you basically had two
choices: either approve every single action

74
00:05:06,765 --> 00:05:12,065
manually, which is exhausting, or
auto-approve everything, which is terrifying.

75
00:05:12,685 --> 00:05:15,125
approvals_mode = "writes" is the middle
ground.

76
00:05:15,745 --> 00:05:19,945
It automatically allows read-only
operations-like reading files,

77
00:05:20,445 --> 00:05:26,545
listing directories, or checking system
status-but pauses and prompts you the moment

78
00:05:26,555 --> 00:05:31,155
the agent tries to write a file change,
delete something, or modify your

79
00:05:31,185 --> 00:05:32,305
environment.

80
00:05:32,424 --> 00:05:35,424
Honestly, that makes so much sense for
daily use.

81
00:05:35,924 --> 00:05:40,264
I don't need to click approve twenty times
just for an agent to search a codebase,

82
00:05:40,784 --> 00:05:45,104
but I definitely want a prompt before it
starts rewriting my config files.

83
00:05:45,764 --> 00:05:48,704
Did they do anything to make
authentication less painful too?

84
00:05:49,415 --> 00:05:49,955
They did.

85
00:05:50,375 --> 00:05:56,375
They added interactive MCP, or Model
Context Protocol, authentication directly

86
00:05:56,415 --> 00:05:57,735
inside the terminal workflow.

87
00:05:58,475 --> 00:06:03,435
So if an agent needs to authenticate with
an external service or a secure database

88
00:06:03,505 --> 00:06:08,735
connector, you don't have to jump out to a
browser or manually copy-paste tokens

89
00:06:08,835 --> 00:06:10,255
into your env files anymore.

90
00:06:10,895 --> 00:06:14,855
It handles the auth handshake directly in
the interactive console stream.

91
00:06:15,455 --> 00:06:20,235
It's a huge step toward making the CLI
feel like a cohesive developer environment

92
00:06:20,295 --> 00:06:22,075
rather than a loose collection of scripts.

93
00:06:22,845 --> 00:06:26,865
Yeah, it really feels like they're trying
to polish the rough edges of how we

94
00:06:26,985 --> 00:06:30,225
actually interact with these agents on a
daily basis.

95
00:06:30,305 --> 00:06:36,755
The 0.144.2 and .3 patches seem to have
put out the immediate fire,

96
00:06:37,045 --> 00:06:41,535
so we can actually enjoy those new
features without our git workflows getting

97
00:06:41,545 --> 00:06:42,635
completely nuked.

98
00:06:43,400 --> 00:06:44,070
Exactly.

99
00:06:44,520 --> 00:06:46,300
Standard service has been resumed.

100
00:06:46,780 --> 00:06:48,560
Keep your CLI updated, folks.

101
00:06:49,180 --> 00:06:50,480
Alright, that's it for us today.

102
00:06:50,940 --> 00:06:51,680
Talk to you soon.

103
00:06:52,288 --> 00:06:52,918
Catch you later.