Codex headless (codex exec)

Drive OpenAI Codex CLI non-interactively. The commands below were verified with codex-cli 0.153.2.

Auto-review invariant

Every invocation must use Auto-review, including resume, background runs, read-only audits, and CI:

-c approval_policy=on-request -c approvals_reviewer=auto_review

Keep both settings explicit on the command line so user, project, or system config cannot select a different reviewer. For a new codex exec run, --approve-for-me is a shorter equivalent that also selects the workspace-write sandbox. Prefer the explicit settings in scripts because the same form works with codex exec resume.

Core call