Approval policy config not being applied - defaults to 'Never' instead of reading config.toml

What version of the Codex App are you using (From “About Codex” dialog)?

v0.98.0

What subscription do you have?

Enterprise

What issue are you seeing?

Bug Report: Approval Policy Configuration Not Being Applied

Summary

Codex CLI ignores the ask_for_approval setting in config.toml and defaults to Never, which conflicts with cloud API requirements that only allow OnRequest.

Environment

• OS: Windows 10 (Build 26100)
• PowerShell: 5.1.26100.7462
• Node.js: v24.13.0
• npm: 11.6.2
• Codex CLI: v0.98.0
• Installation method: npm install -g @openai/codex@latest
• Authentication: Logged in using ChatGPT

Steps to Reproduce

1. Install Codex: npm install -g @openai/codex@latest
2. Authenticate: codex login
3. Create config file at ~/.codex/config.toml with:

``toml
ask_for_approval = "on-request"
``

1. Run: codex exec --skip-git-repo-check "test"

Expected Behavior

Codex should read the ask_for_approval = "on-request" setting from the config file and use it when making API calls.

Actual Behavior

Codex ignores the config file setting and defaults to approval_policy = "Never", which causes the API to reject the request with:

Error: invalid value for `approval_policy`: `Never` is not in the allowed set [OnRequest] (set by cloud requirements)

Error Message

node.exe : Error: invalid value for `approval_policy`: `Never` is not in the allowed set [OnRequest] (set by cloud requirements)
At C:\Users\amalla\AppData\Roaming\npm\codex.ps1:24 char:5
+     & "node$exe"  "$basedir/node_modules/@openai/codex/bin/codex.js"  ...
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (Error: invalid ...d requirements):String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError

Configuration File

Location: C:\Users\amalla\.codex\config.toml

Content:

# Codex CLI Configuration
# Comprehensive config with all approval policy variations

# Try the main config key
ask_for_approval = "on-request"

# Try alternative key name
approval_policy = "on-request"

# Try nested format
[exec]
ask_for_approval = "on-request"

[default]
ask_for_approval = "on-request"

Attempted Solutions

1. ✅ Created config file with ask_for_approval = "on-request"
2. ✅ Tried alternative key name approval_policy = "on-request"
3. ✅ Tried nested config format [exec] and [default] sections
4. ✅ Tried command-line override: codex exec --skip-git-repo-check -c "ask_for_approval=on-request" "test"
5. ✅ Tried command-line override with dotted path: codex exec --skip-git-repo-check -c "approval_policy=on-request" "test"
6. ✅ Tried environment variable: $env:CODEX_ASK_FOR_APPROVAL = "on-request"
7. ✅ Updated Codex to latest version (still v0.98.0)
8. ✅ Re-authenticated to ensure fresh settings
9. ✅ Verified config file location and format

None of these approaches resolved the issue.

Additional Information

• The error occurs before the API call is made, suggesting the config is not being read or applied correctly
• The error message indicates "set by cloud requirements" which suggests server-side enforcement
• The config file format appears correct based on Codex documentation
• The issue prevents any codex exec commands from working

Related Issues

• This appears to be a configuration loading/application bug in Codex CLI v0.98.0
• The config file is properly formatted but not being respected
• The default value (Never) conflicts with cloud API requirements

Workaround

Currently, there is no known workaround. The issue prevents using codex exec commands entirely.

---

Reported by: User experiencing the issue
Date: 2025-02-06
Priority: High (blocks all codex exec functionality)

What steps can reproduce the bug?

Mentioned above.

What is the expected behavior?

_No response_

Additional information

_No response_