Desktop-bundled Codex: guardian_subagent approvals reviewer enabled without consent; background memory jobs drain plan quota while idle #36733

Environment

• ChatGPT macOS desktop app with bundled Codex engine 0.146.0-alpha.9.2 (previously 0.145.0-alpha.30)
• macOS (Darwin 25.5.0)
• Standalone npm CLI on the same machine is codex-cli 0.142.5 (stable) — not involved in any of the issues below
• Paid ChatGPT plan; usage observed via the rate-limit meter

Issue 1 — approvals_reviewer = "guardian_subagent" enabled without consent

After an app auto-update, this line appeared in my ~/.codex/config.toml:

approvals_reviewer = "guardian_subagent"

I never opted in. (All of my own deliberate config edits carry dated comments; this line appeared unannotated.)

With it enabled, every command approval spawns a guardian subagent session (source: {subagent: {other: "guardian"}} in the rollout files) that reads AGENTS.md plus a transcript excerpt and outputs {"outcome":"allow"}.

Observed cost per decision (from a rollout file's token_count event):

input_tokens: 14,482 | cached_input_tokens: 4,352 | output_tokens: 81

Over just two days (Aug 2–3), my machine recorded 78 guardian sessions ≈ 7.0M total tokens (~1.4M non-cached) — all counted against my plan limits, with no indication anywhere in the UI.

Issue 2 — Background memory pipeline retries on oversized transcripts while idle

The bundled app runs memory_stage1 jobs over past session transcripts (memories_1.sqlite: jobs / stage1_outputs tables), while the machine is idle and without any user action.

One job targeting a 30MB rollout file fails with:

Codex ran out of room in the model's context window. Start a new thread or clear earlier history before retrying.

…and is re-scheduled with hourly backoff (retry_at), burning tokens on every attempt. The queue table currently holds 186 jobs, 36 of them not yet done.

Issue 3 — Zero visibility

My usage meter visibly drains while I am typing nothing. There is no surface in the app that shows guardian / memory / goals background features are consuming quota, so users cannot diagnose where their limit went.

Requests

1. Make quota-consuming background features (guardian reviewer, memory extraction, goals) opt-in, or at minimum announce them on update with a visible toggle.
2. Skip or cap memory jobs on transcripts that exceed the context window instead of retrying on a timer.
3. Provide a per-feature usage breakdown so background drains are explainable.