: Intermittent “Awaiting approval” deadlock for safe read-only PowerShell commands
What version of the Codex App are you using (From “About Codex” dialog)?
Codex in VS Code
What subscription do you have?
Plus
What issue are you seeing?
Bug Report Draft: Approval Prompt Hangs in Codex Tool Calls
Title: Intermittent “Awaiting approval” deadlock for safe read-only PowerShell commands
Severity: High (blocks iterative development flow)
Environment:
Workspace: c:\Users\jorda\picks-pilot
Shell: PowerShell (pwsh)
Filesystem sandbox: read-only
Network: restricted
Occurs across multiple turns in same session
Observed behavior
Codex repeatedly gets stuck in an approval state for commands that are normally harmless/read-only and often already approved or matching approved prefixes.
The run does not proceed, and interaction stalls until manually redirected.
In several cases, tool call result was aborted or “awaiting approval” with no actionable next step.
Expected behavior
For read-only commands (especially Select-String, Get-Content) that match approved prefixes, command should execute without additional approval prompt.
If approval is required, prompt should reliably resolve and continue execution.
Representative commands that triggered hangs
slate-admin-client.tsx' -Pattern "modal-overlay|form-card|Cancel" -Context 1,6
page.tsx' -Pattern "pen-tool|plus|Create entry|entry" -Context 2,4
page.tsx' -Pattern "Add option|Remove option|arrow-up|arrow-down|Options" -Context 2,4
Frequency
Intermittent but frequent in this session (multiple times, across different commands/files).
Impact
Blocks progress mid-task.
Forces repeated retries and context loss.
Causes unnecessary user friction and longer turn times.
Workarounds used
Avoid chained/compound commands.
Use smaller, single-purpose commands.
Prefer direct patch edits once file context is known.
Avoid commands that trigger fresh approval checks if possible.
Additional notes
This appears to affect approval flow/state handling, not command correctness.
Same session had many approved prefixes, but issue still recurred.
What steps can reproduce the bug?
Environment hangs upon approval prompt for codex to execute command. Happens repeatedly. Have to kill VS code and reopen session. The model is attempting to avoid the trouble commands but keeps running into them.
What is the expected behavior?
No hang.
Additional information
_No response_
12 Comments
Duplicate of https://github.com/openai/codex/issues/10760
CODEX: One of the read commands triggered the approval gate, so I’m avoiding that path. I have enough context and will use only safe rg lookups to patch directly.
Here is the triggering command:
$p='src/app/site-admin/site-admin-client.tsx'; $lines=Get-Content -LiteralPath $p; for($i=520;$i -le 760;$i++){ if($i -le $lines.Length){ Write-Output (("{0,4}: " -f $i)+$lines[$i-1])}}
Here is another one.
Codex: Some large file reads are intermittently triggering the approval gate, so I’m switching to targeted safe edits using known anchors from rg matches. I’ll apply minimal, focused patches for adapters in tabs/table/modal.
Here is the triggering command:
Do you want to run this command?
$p='packages/ui-lib/src/standard-table.tsx'; $lines=Get-Content -LiteralPath $p; for($i=510;$i -le 620;$i++){ if($i -le $lines.Length){ Write-Output (("{0,4}: " -f $i)+$lines[$i-1])}}
Here is another command that his the gate and caused the hang
Get-Content -LiteralPath 'packages/ui-lib/src/sticky-tabs.tsx' | Select-String -Pattern 'type TabsLayoutProps|variant|return \(' -Context 2,4
Here's another -
Get-Content -LiteralPath 'src/app/libraries/reference/page.tsx' | Select-String -Pattern "Decoupling hooks implemented|API compatibility policy|Versioning and release" -Context 0,20
Here's another -
if (Test-Path '.github/workflows/ui-lib-tests.yml') { Get-Content -LiteralPath '.github/workflows/ui-lib-tests.yml' }
Do you want to run this command?
if (Test-Path '.github/workflows/ui-lib-tests.yml') { Get-Content -LiteralPath '.github/workflows/ui-lib-tests.yml' } else { Write-Output 'missing ui-lib-tests.yml' }
here's another
Get-Content -LiteralPath 'src/app/libraries/reference/page.tsx' | Select-String -Pattern 'Package|Current exports|Versioning and release|GitHub Packages|@jlarm2utah/stratixui|release tagging convention' -Context 0,2
Here's another
if (Test-Path '..\\stratixui') { git -C ..\\stratixui status --short }
Here's another
Select-String -LiteralPath 'src/app/libraries/page.tsx' -Pattern "Remaining: first scoped registry publish|versioning-release" -Context 1,2
here's another
if (Test-Path 'packages/ui-lib/RELEASE_PLAN.md') { Get-Content -LiteralPath 'packages/ui-lib/RELEASE_PLAN.md' } elseif (Test-Path 'RELEASE_PLAN.md') { Get-Content -LiteralPath 'RELEASE_PLAN.md' } else { Write-Output 'No RELEASE_PLAN found' }
Please update to the latest prerelease version of the extension (0.5.73). We think this is now fixed. Let us know what you find.