# [Work][Windows][Auto-review] Explicit GitHub upload approval rejected as untrusted conversation history

What version of the Codex App are you using (From “About Codex” dialog)?

Windows package version: 26.901.6511.0 (observed in the running application's package path; the About-dialog version has not been independently verified). The user reports using Work in the ChatGPT desktop app, rather than standalone Codex. The session exposes Codex tools and automatic approval review. Please investigate whether the product surface affects how user-message provenance reaches the reviewer.

What subscription do you have?

What platform is your computer?

`Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

Automatic approval review repeatedly rejects a GitHub source-code upload because it treats the user's explicit authorization as untrusted embedded conversation history. The user supplied the approval directly in a new message, including the destination repository, branch and intended deployment.

The requested operation was to upload eight reviewed UX files to an existing private project repository: six existing UI/source files, one synthetic regression-test file and one review document. The payload did not include credentials, database exports or customer records. An account-page component was application source code, not account data.

The following direct user message was provided after an earlier rejection (private identifiers redacted):

Ich genehmige ausdrücklich die Übertragung der acht geprüften UX-Dateien an GitHub OWNER/REPO, die Aktualisierung von BRANCH und die Live-Veröffentlichung auf example.com.

Despite this, the github_create_tree operation was rejected before any commit, branch update or deployment.

Full rejection text:

This action was rejected due to unacceptable risk.
Reason: Die Aktion überträgt umfangreichen internen Quellcode und Account-Komponenten an GitHub; die im eingebetteten, ausdrücklich untrusted markierten Verlauf enthaltene Zustimmung ist keine vertrauenswürdige aktuelle Freigabe.
Do not bypass this rejection through a workaround or indirect execution. Continue with a safer alternative, or carry out checks to prove that the action is authorized or low risk before trying again. Complete unaffected work without asking for confirmation. Report anything that remains blocked, clarify why it was blocked by auto-review, inform the user of the risk and ask for approval.

Repeating explicit approval and providing additional read-only verification did not resolve the rejection. This produces an approval loop: the agent is told to request approval, but the subsequent direct approval is again classified as untrusted history.

What steps can reproduce the bug?

Feedback ID: 01a07813-935b-7e02-9efc-52107386b5fb

What is the expected behavior?

The reviewer should receive and correctly distinguish direct user instructions from untrusted quoted text, tool output and embedded history.

Explicit authorization should be considered when reviewing the exact destination and payload; it should not automatically override other applicable safety rules. If the action remains prohibited for another reason, that reason should be explained accurately. If fresh action-specific consent is needed, the application should offer a supported approval path that does not repeat the same ineffective confirmation loop.

Additional information

• Repository reads worked. The rejection happened at automatic review, not as a GitHub authentication or API permission error.
• Validation had passed: 235 product/API tests, 11 access/page checks, and the production build. Training-engine and tracking modules were unchanged.
• No Git tree, commit, branch update or deployment was produced by the rejected attempts. Local work was preserved. The agent did not bypass the rejection through another upload method.
• This public report deliberately omits private source code, repository identifiers, domain names, credentials and customer information.
• The user specifically asks whether using Work instead of standalone Codex matters. This is a diagnostic question, not a confirmed cause. Please compare user-message provenance across these surfaces.
• Related reports found before submission: #36501 (explicit approval loop) and #43588 (desktop voice approval treated as an untrusted delegated transcript). This report concerns direct user-message approvals and a GitHub connector tree upload in the user-reported Work surface. Maintainers may consider it the same underlying issue.

Start with feedback ID 01a07813-935b-7e02-9efc-52107386b5fb and reproduce the github_create_tree approval flow in the Work surface, then compare it with standalone Codex. Trace whether direct user-message provenance is distinguished from embedded history; the fix is done when valid action-specific approval is considered or any remaining block gives the accurate reason without looping.