BUG: --full-auto does not set 'on-failure' APPROVAL_POLICY as per --help

What version of Codex is running?

0.36.0

Which model were you using?

gpt-5-codex

What platform is your computer?

Linux 6.8.0-79-generic x86_64 x86_64

What steps can reproduce the bug?

Start codex with codex --full-auto and once TUI loads run /status and note the Approval Mode:

  • Approval Mode: on-request
  • Sandbox: workspace-write

Running codex --help the --full-auto is supposed to be setting APPROVAL_POLICY to on-failure:

      --full-auto
          Convenience alias for low-friction sandboxed automatic execution (-a on-failure, --sandbox workspace-write)

What is the expected behavior?

As documented in codex --help the --full-auto flag should run codex as follows -

  • Approval Mode: on-failure
  • Sandbox: workspace-write

What do you see instead?

Approval mode runs in on-request instead of on-failure in --full-auto.

Additional information

codex-rs/tui/src/lib.rs:92 should use AskForApproval::OnFailure rather than AskForApproval::OnRequest