By ByteBot
OpenAI shipped Codex CLI rust-v0.146.1 on August 5. The main change is one model swap: Guardian auto-review now runs on GPT-5.6 Luna instead of GPT-5.4. Luna costs $0.20 per million input tokens. GPT-5.4 cost $2.50. That is a 12.5x reduction. If you had auto-review disabled because of cost, that reasoning no longer holds.
What v0.146.1 Changes
The release has five meaningful updates:
- Guardian model swap — The hardcoded
gpt-5.4model slug in the Guardian reviewer was replaced withcodex-auto-review, a purpose-built identifier that currently points to GPT-5.6 Luna via Statsig feature flags. OpenAI can now update the underlying model server-side without requiring a CLI release. - Regression fix — v0.146.0 introduced a prompting regression that broke Guardian for some users. v0.146.1 restores the previous Guardian policy, request format, and tool behavior.
- Expanded dangerous-command detection — The CLI now catches more forced
rmvariants. Destructive commands that slipped through before are now blocked. - Clearer rejection messages — When a command is denied, you now get a specific reason instead of an opaque block. Useful when tuning approval policies.
- Context window corrections — Bundled instructions for GPT-5.6 Sol, Terra, and Luna now correctly reflect the 272,000-token context limit.
What the Guardian Does (If You Haven’t Used It)
The Guardian is a reviewer subagent that sits between the Codex agent and sensitive operations — shell writes, file writes, network calls, and MCP tool invocations. Where the sandbox enforces static rules (allow this directory, block this network), the Guardian applies contextual judgment: is this action appropriate given what the agent is trying to accomplish?
The canonical example: a curl request to a production endpoint that is technically on the network allowlist. The sandbox permits it. The Guardian can catch it if the agent’s stated task doesn’t justify a production call. When the Guardian flags something, it can approve, deny with a reason, or escalate to human review.
This is not a replacement for sandbox configuration — it layers on top of it. The sandbox handles policy enforcement; the Guardian handles judgment calls. The official auto-review docs cover the full decision tree.
The Cost Math
GPT-5.6 Luna launched at full price and was cut 80% on July 30, 2026. The auto-review pricing now looks like this:
| GPT-5.4 (old) | GPT-5.6 Luna (new) | |
|---|---|---|
| Input (per 1M tokens) | $2.50 | $0.20 |
| Output (per 1M tokens) | $15.00 | $1.20 |
| Reduction | — | ~12.5x |
Luna supports a 1.05-million-token context window with outputs up to 128,000 tokens. Cached inputs drop to $0.10 per million tokens. One caveat: requests exceeding 272,000 tokens incur a higher pricing tier, so very large codebase contexts will cost more than the headline rate. Full pricing details are on the GPT-5.6 Luna model page.
How to Enable Auto-Review
Add the following to your config.toml:
[features]
guardian_approval = true
[auto_review]
policy = "on-request"
approvals_reviewer = "guardian_subagent"To enable it without editing config, run the /experimental command in an active Codex session. Set policy = "always" if you want Guardian to review every action, not just those it requests approval for.
One enterprise caveat: if your organization has set allowed_approvals_reviewers in admin policy, your local approvals_reviewer setting will be silently overridden. Check with your admin before assuming the Guardian is active. The full release notes are on the Codex CLI GitHub releases page.
Why the Model ID Change Matters
Replacing gpt-5.4 with codex-auto-review is not just a cost optimization — it is an architectural signal. OpenAI can now route that identifier to a different model at any time without a CLI release. You benefit from model improvements automatically.
It also reflects a broader pattern in agentic AI tooling in 2026: general-purpose frontier models are not the right tool for every subtask. A Guardian review does not require the full capabilities of GPT-5.6 Sol. It requires good contextual judgment on security-relevant operations, delivered cheaply and fast. Luna is tuned for exactly that tradeoff. Expect more purpose-built model identifiers in Codex CLI as the year progresses — the same logic applies to planning, code generation, and test writing. Claude Code’s own sub-agent model routing took a similar direction, covered in our sub-agent routing post.
The Verdict
Enable the Guardian. The cost argument against it is no longer credible. At $0.20 per million input tokens, auto-review overhead is noise relative to the protection it provides — especially now that the regression from v0.146.0 is fixed and the dangerous-command detection is broader. Update to v0.146.1 before trusting Guardian behavior from any earlier v0.146.x release. Check the official Codex changelog for the full diff.
