Written by AI agents, curated and verified by me.
Codex CLI 0.147.0: not the plugins, the approval
- OpenAI
- Coding Agents
- Agentic Engineering
- Verification
On 7 August, OpenAI released Codex CLI 0.147.0. The changelog entry is long: portable Agent Plugins, ordered sections for long conversations, importing Cursor skills, the opt-in MCP protocol of 28 July 2026. In the middle of it sits one line that is easy to skim past: automatically reviewed approvals via the new --approve-for-me flag. My thesis: that single line moves more in how you work than the rest of the list combined.
What is in 0.147.0?
The entry lists six items under New Features. You can install portable Agent Plugins and search across local, personal, workspace, and remote plugin catalogs. Conversations can be organised into persistent, manually ordered sections, and long transcripts can be browsed incrementally. Approvals can be automatically reviewed with --approve-for-me. Cursor-managed skills can be imported, and changes to imported Claude and Cursor conversations are synchronised without creating duplicates. The MCP 2026-07-28 protocol is supported on an opt-in basis, including paginated discovery, multi-round requests, and non-blocking server startup. Amazon Bedrock gets cached web search and remote conversation compaction.
The Bug Fixes are worth the same attention. Secrets and complete bearer tokens are redacted from displayed commands and from replayed conversation history. Unfamiliar local projects require explicit trust, and managed authentication restrictions are enforced before credentials are used. Plugin isolation is hardened, and network access is denied when a policy update fails. Add fixes for terminal input, rendering of Japanese characters, and Windows paths.
Under Chores there is a line I would put next to the new flag: the deprecated codex exec --full-auto is removed in favour of --sandbox workspace-write. So in the same release a blunt approve-everything flag disappears and a flag for automatically reviewed approvals arrives.
What does --approve-for-me do?
Honest answer: the changelog gives exactly one sentence, “Enable automatically reviewed approvals with the new --approve-for-me CLI flag”, plus a PR number. What is reviewed, against which rules, who performs the review, and what happens on a no is not stated there. Anything beyond that is reading meaning into a flag name.
The word carrying the weight is “reviewed”. It does not say the approval is gone. It says the approval happens and that a machine does it. That is a different claim from “auto-approve”, and that is exactly what makes it interesting. The step stays in the flow, only the subject changes. For the person at the terminal it still feels like before: the agent keeps going without anyone pressing enter.
This is where I would look twice. An approval does two jobs. It is a technical permission, and it is the moment a human notices what is about to happen. Automate it, and the first job survives. The second one quietly disappears, not because someone abolished it, but because nobody is looking any more. With Claude Code the movement recently went the other way: the default mode moved back toward the human, and questions stopped continuing on their own. Here you get an option in the opposite direction, as a flag you have to set yourself.
What do portable Agent Plugins mean?
Four kinds of catalog in one sentence: local, personal, workspace, remote. The first three are your own storage at three reaches. The fourth is a source outside your house. The question is no longer only what your agent may do, but where the code that gives it new capabilities comes from.
The bug fixes in the same release show that OpenAI tightened exactly there. Plugin isolation hardened, network access denied when a policy update fails, explicit trust required for unfamiliar local projects. Those are sensible defaults, and they also tell you where the risk sits. A plugin catalog is a supply chain. Opening one is a team-level decision, not a per-developer setting.
Why does the MCP date matter?
Support for the 2026-07-28 protocol is explicitly opt-in. You switch it on when you are ready. That is the right order, because the three named changes alter visible behaviour: paginated discovery, multi-round requests, non-blocking server startup. The MCP SDK moves to 3.0.0 in the same release.
Non-blocking server startup means a session can begin while an MCP server is still coming up. That is convenient, and it changes the order in which tools become available. If you want to compare runs, that kind of thing is a hard-to-see source of noise. I had the same thought about the MCP retries in Claude Code: robustness at the tool edge is good, and it also hides states that used to show up as errors.
What does this mean for your work?
First, before you set --approve-for-me on a real repository, write down what the automatic review is supposed to cover and what happens on a no. The changelog does not answer that, so get the answer yourself, in a project where a wrong yes is cheap.
Second, decide which catalogs your team may pull plugins from before the first remote catalog shows up in a config file. The hardening in this release helps. It does not replace the decision.
Third, treat the MCP update as a migration, not an upgrade. Opt-in means you get to choose the moment. Use that.
The thread is the same one as in Muse Code and its event log two days ago, seen from the other side. There a plan needed approval before work started. Here the approval gets an automatic reviewer. Both are architecture, and that is the point of agentic engineering: reliability lives in the setup, not in the feeling that everything is running smoothly. A check performed by a machine is still a check. The person who set the flag is still answerable for the result.