OpenAI Codex release notes: 0.147 alpha makes execution permissions explicit

OpenAI followed Codex CLI 0.147.0-alpha.2 with alpha.3 and alpha.4 on July 31, 2026. The two test releases tighten how scripts and clients express execution permissions. The hidden --full-auto flag is gone from codex exec, and a shell call with a justification is rejected when it does not include an explicit sandbox permission request.

OpenAI Codex release notes: what changes in 0.147 alpha.3 and alpha.4?

Codex CLI is OpenAI's local coding agent for the terminal. A sandbox limits which files, directories, and network resources the agent's commands may reach.

The GitHub pages for alpha.3 and alpha.4 show their version numbers and publication times but contain no detailed notes. The concrete changes are in the pull requests included in each tag. npm now marks 0.147.0-alpha.4 as alpha, while latest remains stable 0.146.0.

Source: OpenAI Codex 0.147.0-alpha.3.

Source: OpenAI Codex 0.147.0-alpha.4.

Source: npm registry metadata for @openai/codex.

codex exec stops accepting --full-auto

codex exec is the command for scripted runs and CI jobs that should finish without an interactive conversation. In alpha.3, OpenAI removes the hidden and already deprecated --full-auto flag. It previously selected the workspace-write sandbox implicitly. A script that still passes the old flag must select --sandbox workspace-write instead.

This is a migration, not a new autonomy tier. OpenAI's CLI reference recommends workspace-write for unattended local work that can stay inside the workspace. It also advises against bypassing both approvals and the sandbox unless Codex runs inside a dedicated sandbox VM.

Source: OpenAI PR #36054 removing --full-auto.

Source: OpenAI Codex CLI reference for codex exec and sandbox modes.

A justification no longer doubles as a permission request

alpha.4 tightens the contract for the underlying shell_command and unified exec_command tool calls. A call with justification but no sandbox_permissions is rejected before the command starts. The error tells the caller to request require_escalated explicitly or remove the justification.

This mainly affects developers of Codex clients, hosts, and tool integrations. A normal user should not type internal tool-call JSON into the composer. The change prevents a client from treating an explanatory sentence as permission to leave the sandbox's normal boundary.

Source: OpenAI PR #36350 on explicit sandbox permissions.

What this means for Nordic automation teams

Search the jobs that launch Codex from CI, scheduled runs, or internal developer tools. An old --full-auto flag can become a startup failure when the team tests the 0.147 branch. If you maintain an app-server client, its tests should also distinguish between a justification and an actual request for higher permission.

This is a better integration contract than a vague automatic mode. Give Codex write access where the job needs it, keep API keys in environment variables or a secret manager, and use approval gates for actions outside the defined workspace. Record the selected sandbox, requested exceptions, and result in the run log.

Human step

Use 0.147.0-alpha.4 only in a test environment until the branch becomes stable. If an existing codex exec script still uses the old flag, replace:

--full-auto

Use this instead:

--sandbox workspace-write

Leave the rest of the already verified command unchanged. If you develop a client that sends tool calls, include justification only when the call also requests the appropriate sandbox_permissions; require_escalated is the value named by the pull request for escalated execution.

Source: OpenAI PR #36054 with the exact replacement flag.

Source: OpenAI PR #36350 with the sandbox_permissions tool field.

Short example: use the new Codex feature

Run this prompt after a person has opened the intended test workspace with the selected alpha build:

Review this repository's Codex scripts and app-server tests. Find codex exec --full-auto usage and shell or exec calls that send justification without sandbox_permissions. Write a migration plan with file and line references. Do not edit files or run the affected commands.

Good output should:

• Point to real files and lines instead of guessing where configuration lives.
• Separate CLI flags from internal tool fields.
• Recommend --sandbox workspace-write only where the job should write inside the workspace.
• Leave the repository, CI, and external systems unchanged.

What should you watch next?

Watch whether OpenAI keeps the same migration when 0.147 becomes stable and whether client documentation gains more examples for sandbox_permissions. Today, 0.146.0 remains the npm version for normal installations. alpha.3 and alpha.4 matter to teams that can test scripts and client contracts before the next stable upgrade.

Yesterday's article covered MCP 2026 and thread sections. This update changes the execution contract itself: the old automation flag is gone, and higher permission must be requested explicitly. If several workflows need the same contract, Tool Forge can document the version, sandbox, approval point, and run log in one place.