Add /auto-review-denials retry approval flow by won-openai · Pull Request #19058 · openai/codex

won-openai · 2026-04-23T00:20:57Z

Why

Auto-review can deny an action that the user later decides they want to retry. Today there is no TUI surface for selecting a recent denial and sending explicit approval context back into the session, so users have to restate intent manually and the retry can be reviewed without the original denied action context.

This adds a narrow TUI-driven path for approving a recent denied action while still keeping the retry inside the normal auto-review flow.

What Changed

Added /auto-review-denials to open a picker of recent denied auto-review actions.
Added a small in-memory TUI store for the 10 most recent denied auto-review events.
Selecting a denial sends the structured denied event back through the existing core/app-server op path.
Core now injects a developer message containing the approved action JSON rather than the full assessment event.
Auto-review transcript collection now preserves this specific approval developer message so follow-up review sessions can see the user approval context.
Added TUI snapshot/unit coverage for the picker and approval dispatch path.
Added core coverage for retaining the approval developer message in the auto-review transcript.

Verification

cargo test -p codex-core collect_guardian_transcript_entries_keeps_manual_approval_developer_message
cargo test -p codex-tui auto_review_denials
cargo test -p codex-tui approving_recent_denial_emits_structured_core_op_once

Notes

This intentionally keeps retries going through auto-review. The approval signal is context for the exact previously denied action, not a blanket bypass for similar future actions.

won-openai · 2026-04-23T00:46:50Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 075815efa6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

etraut-openai · 2026-04-23T02:24:14Z

/auto-review-denials is a pretty long slash command name — much longer than any others we currently have. I also don't think we should have built-in slash commands with hyphens in the name. Maybe shorten to just /autoreview?

won-openai · 2026-04-23T04:12:30Z

/auto-review-denials is a pretty long slash command name — much longer than any others we currently have. I also don't think we should have built-in slash commands with hyphens in the name. Maybe shorten to just /autoreview?

or we can do /denials, i think it's more intuitive! thoughts? @etraut-openai @dylan-hurd-oai

etraut-openai · 2026-04-23T04:28:18Z

I guess I'd lean toward /autoreview over /denials. I suspect we may want to provide additional controls over auto-review parameters in the future, and this would allow us to expand the UI without adding another slash command.

chatgpt-codex-connector

💡 Codex Review

codex/codex-rs/tui/src/chatwidget.rs

Line 2362 in 11c469c

self.thread_id = Some(event.session_id);

Clear denial cache when switching to a different thread

on_session_configured_with_display_and_fork_parent_title replaces self.thread_id but never resets recent_auto_review_denials. Since that cache is stored once on ChatWidget, a new thread can inherit denials from the previous thread, and /denials may submit a stale GuardianAssessmentEvent against the wrong thread context.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

won-openai · 2026-04-26T07:02:12Z

@codex review

won-openai · 2026-04-26T07:02:40Z

                    content_entry(GuardianTranscriptEntryKind::User, content)
                }
            }
+            ResponseItem::Message { role, content, .. } if role == "developer" => {


so that auto-review is able to send the override message

chatgpt-codex-connector

💡 Codex Review

codex/codex-rs/core/src/guardian/prompt.rs

Lines 303 to 304 in 101e973

    
           if entry.kind.is_user() || retained_non_user_entries >= GUARDIAN_RECENT_ENTRY_LIMIT { 
        
               continue;

Prevent pruning of preserved manual-approval context

Manual-approval developer entries are collected, but transcript rendering treats them as generic non-user entries under GUARDIAN_RECENT_ENTRY_LIMIT and message token budget. With enough newer entries, this approval context is dropped, so follow-up guardian reviews can miss the very retry-approval context this change intends to preserve.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-26T07:15:56Z

+    }
+
+    pub(crate) fn approve_recent_auto_review_denial(&mut self, thread_id: ThreadId, id: String) {
+        let Some(event) = self.recent_auto_review_denials.take(&id) else {


Keep denied action available until submit succeeds

approve_recent_auto_review_denial removes the selected denial from recent_auto_review_denials before the async SubmitThreadOp is actually sent/acknowledged. If thread_approve_guardian_denied_action fails, the user cannot reselect that denial and must wait for a new denial event. This makes transient app-server failures permanently consume the retry option.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-04-26T07:15:56Z

+    #[strum(to_string = "autoreview")]
+    AutoReviewDenials,


Match slash command token to documented feature name

The change is described as adding /auto-review-denials, but this variant is wired with #[strum(to_string = "autoreview")], making autoreview the serialized/parsed command token. Users invoking /auto-review-denials will not match this command, creating an intent/documentation mismatch for the new flow.

Useful? React with 👍 / 👎.

@won-openai which one are we using here? Let's keep this simple

chatgpt-codex-connector · 2026-04-26T07:15:56Z

+Treat this as approval to perform that exact action in the same context in which it was originally requested.
+Do not assume this also authorizes similar operations with different payloads.

-Stored Guardian assessment event JSON:
-{event_json}"#,
+Approved action:
+{approved_action_json}"#,


Restore untrusted-data warning for approved action JSON

This developer message now embeds event.action JSON without the previous "untrusted data" guard. Because action fields can contain model/user-controlled text (e.g., command/tool args), that text is now placed in a privileged developer-role prompt and may be followed as instructions, weakening prompt-injection defenses in approval retries.

Useful? React with 👍 / 👎.

dylan-hurd-oai

Approved with a few small things to address

dylan-hurd-oai · 2026-04-26T20:45:18Z

+
+        self.bottom_pane.show_selection_view(SelectionViewParams {
+            title: Some("Auto-review Denials".to_string()),
+            subtitle: Some("Select one denied action to approve for one retry.".to_string()),


Select a denied action to approve. - let's keep this simple for now

dylan-hurd-oai · 2026-04-26T20:45:42Z

+    #[strum(to_string = "autoreview")]
+    AutoReviewDenials,


@won-openai which one are we using here? Let's keep this simple

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 78a4d346d3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-27T03:35:10Z

        return;
    }

-    let event_json = match serde_json::to_string_pretty(&event) {
-        Ok(event_json) => event_json,
+    let approved_action = serde_json::json!({
+        "action": &event.action,
+        "outcome": "allowed",
+    });


Verify denied review ID before injecting approval context

approve_guardian_denied_action only checks event.status == Denied and then turns the client-supplied payload into a developer approval message. A forged/stale GuardianAssessmentEvent can therefore authorize an action that was never actually denied in this thread. Validate event.id (and thread/turn binding) against server-side denied-review state before honoring it.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-04-27T03:35:10Z

+Approved action:
+{approved_action_json}"#,


Treat approved action payload as untrusted text

The developer message now inlines {approved_action_json} but no longer says to ignore instructions inside that JSON. Since action fields can contain model/user-controlled strings (commands, args), this can inject instruction-like text into privileged developer context and bias subsequent auto-review decisions.

Useful? React with 👍 / 👎.

won-openai changed the title ~~No findings~~ Add /auto-review-denials retry approval flow Apr 23, 2026

won-openai marked this pull request as ready for review April 23, 2026 00:43

won-openai requested a review from a team as a code owner April 23, 2026 00:43

chatgpt-codex-connector Bot reviewed Apr 23, 2026

View reviewed changes

Comment thread codex-rs/tui/src/chatwidget.rs

Comment thread codex-rs/core/src/session/handlers.rs

Comment thread codex-rs/core/src/guardian/prompt.rs

Comment thread codex-rs/tui/src/chatwidget.rs Outdated

Comment thread codex-rs/core/src/session/handlers.rs

github-actions Bot mentioned this pull request Apr 23, 2026

📊 AI CLI 工具社区动态日报 2026-04-23 gsscsd/big_model_radar#230

Open

won-openai force-pushed the auto-review-denial-ux branch 4 times, most recently from fe7d9a3 to cc47130 Compare April 26, 2026 05:22

chatgpt-codex-connector Bot reviewed Apr 26, 2026

View reviewed changes

won-openai commented Apr 26, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Apr 26, 2026

View reviewed changes

won-openai assigned won-openai and dylan-hurd-oai Apr 26, 2026

dylan-hurd-oai approved these changes Apr 26, 2026

View reviewed changes

won-openai enabled auto-merge (squash) April 27, 2026 01:32

This was referenced Apr 27, 2026

📊 AI CLI 工具社区动态日报 2026-04-27 borq168/big_model_radar#39

Open

📊 AI CLI Tools Digest 2026-04-27 borq168/big_model_radar#42

Open

won-openai added 7 commits April 26, 2026 20:06

wiring logic for session + TUI rendering logic

c8515f5

lint

f428e3e

codex: address auto-review denial feedback

6b848c5

auto review denial update

58b2344

active based to thread based

53eee17

cache clearing

ffa3a36

removing placeholder

f3d1349

addressing review feedbacks

78a4d34

won-openai force-pushed the auto-review-denial-ux branch from 3fb01fb to 78a4d34 Compare April 27, 2026 03:18

chatgpt-codex-connector Bot reviewed Apr 27, 2026

View reviewed changes

won-openai merged commit 8033b6a into main Apr 27, 2026
25 checks passed

won-openai deleted the auto-review-denial-ux branch April 27, 2026 03:43

github-actions Bot locked and limited conversation to collaborators Apr 27, 2026

	if entry.kind.is_user() \|\| retained_non_user_entries >= GUARDIAN_RECENT_ENTRY_LIMIT {
	continue;

Conversation

won-openai commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What Changed

Verification

Notes

Uh oh!

won-openai commented Apr 23, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

etraut-openai commented Apr 23, 2026

Uh oh!

won-openai commented Apr 23, 2026

Uh oh!

etraut-openai commented Apr 23, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

won-openai commented Apr 26, 2026

Uh oh!

won-openai Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

dylan-hurd-oai Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

dylan-hurd-oai left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

dylan-hurd-oai Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

dylan-hurd-oai Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

won-openai commented Apr 23, 2026 •

edited

Loading