0.144.x regression: auto-review denies explicitly authorized git push to private origin

What version of Codex CLI is running?

0.144.1 (npm package @openai/codex@0.144.1)

The local launcher was updated on 2026-07-10 at 07:50 local time. The same workflow worked the previous day.

Platform

Windows, workspace-write sandbox, elevated Windows sandbox.

Relevant configuration:

approval_policy = "on-request"
sandbox_mode = "workspace-write"
approvals_reviewer = "auto_review"

[sandbox_workspace_write]
network_access = true

[projects.'<local-project-path>']
trust_level = "trusted"

Regression

A normal, non-force git push origin <current-branch> from a trusted local project to its configured private GitHub origin is denied by auto-review, even when the user:

1. directly orders the push;
2. is informed of the reviewer's stated risk;
3. explicitly re-approves the exact push; and
4. reiterates that the destination is the project's private repository.

The reviewer explicitly recognizes the user authorization but still denies the operation:

This push would export five local commits to a GitHub repository whose
trust/privacy is still unverified, and the policy denies sending potentially
private workspace or organization data to an untrusted external destination
even after explicit user approval.

A later retry after another direct order produced the same result:

The user explicitly ordered the push, but this action still sends five local
commits to a GitHub remote whose trust/privacy is not verified as an approved
internal or explicitly trusted destination.

The command is a regular push to the repository's existing origin, not a force push, default/protected-branch rewrite, new remote, or third-party upload.

Steps to reproduce

1. Use Codex CLI 0.144.1 with:

• approval_policy = "on-request"
• approvals_reviewer = "auto_review"
• a trusted local project

1. Work in a private GitHub repository with an existing origin.
2. Have local commits ahead of the upstream branch.
3. Ask Codex directly: git fetch, merge, push.
4. After the first denial, explicitly approve the exact push after seeing the stated risk.
5. Retry git push origin <branch>.

Actual behavior

Auto-review assigns high authorization but treats the configured private GitHub origin as an untrusted external destination. Post-denial user authorization cannot override the denial. No supported destination trust/allowlist setting is surfaced.

Expected behavior

A narrowly scoped, normal push to the existing origin of a trusted project should be allowed when the user explicitly requests it. At minimum, explicit post-denial approval of the exact remote and branch should work unless there is affirmative evidence of credential/secret exfiltration or an administrator-defined absolute deny.

If destination verification is required, Codex should expose an actionable way to trust a repository remote rather than asking for approval and then rejecting that approval.

Suspected regression boundary

This began immediately after updating from the previous stable release to 0.144.1.

Codex 0.144.0 includes #31480, “Update auto review prompting.” That PR changed the Guardian policy text in two relevant ways:

• Previous behavior gave explicit post-denial approval highest precedence over the default allow/deny rules.
• New behavior says post-denial approval can override only the default high-risk authorization threshold and cannot override stronger security-policy denial.
• The PR also removes permissions_instructions from the Guardian review session and restricts the reviewer tool set.

The PR's snapshot includes a git push layout, but I did not find behavioral integration coverage for this combination:

• trusted local project;
• private configured origin;
• ordinary non-force push;
• exact direct user order; and
• explicit post-denial reauthorization.

Release timing:

• 0.143.0: 2026-07-08
• #31480 merged: 2026-07-08
• 0.144.0: 2026-07-09
• 0.144.1: 2026-07-09
• local 0.144.1 installation: 2026-07-10
• first observed failure: 2026-07-10

Related issues

• #23211
• #23914
• #30071

Those cover similar over-conservative outbound-content denials, but this report is specifically a 0.144.x regression affecting a routine Git push to the trusted project's own private origin.