Cannot set `approval_policy = "on-failure"` from within CLI

What version of Codex is running?

0.29.0

Which model were you using?

gpt-5

What platform is your computer?

Darwin 24.6.0 arm64 arm

What steps can reproduce the bug?

In ~/.codex/config.toml, set approval_policy = "on-failure". Then in codex, use /approvals to change the approval mode to something else. You won't be able to get approval_policy = "on-failure" again within the same session.

Critically, the Auto mode, which the docs say is equivalent to --sandbox workspace-write + --ask-for-approval on-failure, is actually equivalent to --sandbox workspace-write + --ask-for-approval on-request.

What is the expected behavior?

Selecting /approvals = Auto should set approval mode to on-failure.

Given that there are 4*2 = 8 options total for approval + sandbox, there should probably just be separate /approvals and /sandbox commands so that the user has full access to all configuration options from within a session.

What do you see instead?

After setting /approvals to Auto,

  • Approval Mode: on-request
  • Sandbox: workspace-write

This is not --full-auto as described in the docs.

Additional information

_No response_