What happened
Followed the skill's documented Codex invocation and the call failed immediately, before Codex did any work:
codex exec --skip-git-repo-check -C "<workdir>" --sandbox workspace-write -a never \
-o "<scratchpad>/codex-result-viewer.md" "<prompt>" < /dev/null
error: unexpected argument '-a' found
tip: to pass '-a' as a value, use '-- -a'
Usage: codex exec [OPTIONS] [PROMPT]
codex exec [OPTIONS] <COMMAND> [ARGS]
Exit code 2. Because this ran via run_in_background, the failure surfaced only as a completion notification, so the real cost was a wasted round trip plus the time spent diagnosing a flag the skill presented as current.
Expected vs actual
Expected: the skill's two copy-paste invocation blocks under "Driving Codex (codex exec)" run as written.
Actual: both blocks are broken. -a / --ask-for-approval is no longer a codex exec flag. codex exec --help on 0.147.0 lists no -a, no --ask-for-approval, and no --full-auto. Approval policy has moved to config-only.
Working form
codex exec --skip-git-repo-check -C "<workdir>" --sandbox workspace-write \
-c approval_policy='"never"' \
-o "<file>" "<prompt>" < /dev/null
Note the nested quoting: -c parses its value as TOML, so the string needs its own quotes inside the shell quotes. -c approval_policy=never alone is a bare TOML token and does not reliably parse as the string.
The adjacent flags in the skill all still verify fine on 0.147.0: --skip-git-repo-check, -C/--cd, --sandbox, -o/--output-last-message, --json, --output-schema, --add-dir, --ephemeral. Only -a is dead. --approve-for-me and --dangerously-bypass-approvals-and-sandbox are the new approval-adjacent flags, but neither is the equivalent of -a never.
Suggested fix
Replace -a never with -c approval_policy='"never"' in both invocation blocks in SKILL.md, and in references/codex-exec.md wherever it appears. Worth adding a one-line note that approval policy is config-only on codex exec now, since the old flag name is what everyone will reach for.
Environment
- codex-cli 0.147.0
- Windows 11 Pro 10.0.26200, Git Bash via the Claude Code Bash tool
- Called from Claude Code (Opus 5), background Bash, stdin closed with
< /dev/null per the skill's hard rule 1 (that rule itself worked correctly)
What happened
Followed the skill's documented Codex invocation and the call failed immediately, before Codex did any work:
Exit code 2. Because this ran via
run_in_background, the failure surfaced only as a completion notification, so the real cost was a wasted round trip plus the time spent diagnosing a flag the skill presented as current.Expected vs actual
Expected: the skill's two copy-paste invocation blocks under "Driving Codex (
codex exec)" run as written.Actual: both blocks are broken.
-a/--ask-for-approvalis no longer acodex execflag.codex exec --helpon 0.147.0 lists no-a, no--ask-for-approval, and no--full-auto. Approval policy has moved to config-only.Working form
Note the nested quoting:
-cparses its value as TOML, so the string needs its own quotes inside the shell quotes.-c approval_policy=neveralone is a bare TOML token and does not reliably parse as the string.The adjacent flags in the skill all still verify fine on 0.147.0:
--skip-git-repo-check,-C/--cd,--sandbox,-o/--output-last-message,--json,--output-schema,--add-dir,--ephemeral. Only-ais dead.--approve-for-meand--dangerously-bypass-approvals-and-sandboxare the new approval-adjacent flags, but neither is the equivalent of-a never.Suggested fix
Replace
-a neverwith-c approval_policy='"never"'in both invocation blocks inSKILL.md, and inreferences/codex-exec.mdwherever it appears. Worth adding a one-line note that approval policy is config-only oncodex execnow, since the old flag name is what everyone will reach for.Environment
< /dev/nullper the skill's hard rule 1 (that rule itself worked correctly)