[cli security] Different command is run compared to what is approved

What version of Codex CLI is running?

0.98.0

What subscription do you have?

plus

Which model were you using?

gpt-5.3-codex

What platform is your computer?

Linux 6.8.0-88-generic x86_64 x86_64

What terminal emulator and version are you using (if applicable)?

Terminator

What issue are you seeing?

This has happened twice now. I approved to run a build, and I guess it had also already queued a test run command, which got run instead of what I approved.

This could be a major security issue if something like a delete runs instead of what the user approved.

<img width="721" height="208" alt="Image" src="https://github.com/user-attachments/assets/8ec97ced-71e6-4257-a62c-b1845aa49937" />

What steps can reproduce the bug?

Disable edits-without-approval
Get the model to make 2 edits directly in a row

What is the expected behavior?

_No response_

Additional information

_No response_