Codex CLI 0.147.0 removes the flag unattended runs use and adds one that approves for you

Two lines in today's release change harness configuration. The deprecated codex exec --full-auto flag is removed, with --sandbox workspace-write named as the replacement, so any script invoking Codex non-interactively needs editing. A new --approve-for-me flag enables "automatically reviewed approvals," moving the approval decision from the operator into the tool.

The rest is plugin surface and hardening. Portable Agent Plugins can now be installed and searched across "local, personal, workspace, and remote plugin catalogs," a new distribution path into a harness. Alongside it: plugin isolation hardened with network access denied when a policy update fails, explicit trust required for unfamiliar local projects, and secrets and bearer tokens redacted from displayed commands and replayed history. Dated July 31 in the same changelog: GPT-5.4 and GPT-5.4 mini retire from Codex on August 31 for users signed in with ChatGPT, staying available on the API.

Why it matters: The --full-auto removal is a small edit that will break unattended pipelines quietly, on the next upgrade, in the place least likely to be watched. Check your invocations now. Read --approve-for-me next to item 2: the approval gate is not being strengthened, it is being automated.