Codex CLI ignores approval_policy = never from global config.toml in Ubuntu 26.04 LTS

What version of Codex CLI is running?

0.139.0

What subscription do you have?

Azure OpenAI Endpoint

Which model were you using?

gpt-5.4-mini

What platform is your computer?

Linux 7.0.0-22-generic x86_64 unknown

What terminal emulator and version are you using (if applicable)?

Ubuntu standard terminal

Codex doctor report

Can't fully paste it due to path info I cannot expose.
If you need specific details, I can redact that portion and provide it.

What issue are you seeing?

In my global $HOME/.codex/.config.toml I have these settings:

sandbox_mode = "workspace-write"
approval_policy = "never"

When I start codex and check /status it says the approval policy is on-request , so it ignores the setting.
If I instead explicitely start codex via codex -c approval_policy=never, the effect is as expected and codex does not ask for approval.

What steps can reproduce the bug?

Install codex 0.139.0 via npm.
Add these settings to the global $HOME/.codex/config.toml:

sandbox_mode = "workspace-write"
approval_policy = "never"

Start codex via codex command. Check /status to see it is not using never but on-request.

Then start codex via codex -c approval_policy=never and check /status. It will show never as expected.

What is the expected behavior?

The expected behavior is to have codex running with never when started without explicit extra argument and only having the setting in the global $HOME/.codex/config.toml.

Additional information

_No response_