Codex Desktop ignores Full access / Never ask and injects workspace-write + auto-review per thread on personal Pro account

What version of the Codex App are you using (From “About Codex” dialog)?

Codex Desktop embedded in /Applications/ChatGPT.app: 26.803.41515, build 6321

Bundled Desktop CLI/app-server: 0.147.0-alpha.6.5

Standalone Homebrew CLI used for control test: codex-cli 0.147.0

What subscription do you have?

ChatGPT Pro, personal account. Not connected to a Business or Enterprise workspace.

What platform is your computer?

macOS

What issue are you seeing?

Codex Desktop shows Full access and Never ask for approval in every visible configuration source, but each newly created Desktop task is actually launched with a managed workspace-write sandbox and automatic approval review.

The same machine, repository, account, and local config work correctly in the standalone Codex CLI, which starts with unrestricted filesystem access and no approvals.

This appears to be a per-thread Codex Desktop host/runtime override after normal configuration resolution.

Visible Desktop configuration

The Codex Configuration UI shows the same effective values for all three sources:

• AppraisalScope project config: Full access / Never ask
• User config: Full access / Never ask
• Admin config: Full access / Never ask

Relevant local config values are:

sandbox_mode = "danger-full-access"
approval_policy = "never"

The Desktop app-server base config also resolves to Full access / Never ask.

Actual fresh Desktop task runtime

A newly created task reports:

sandbox_policy.type = "workspace-write"
approval_policy = "on-request"
approvals_reviewer = "auto_review"
permission_profile.type = "managed"

The recorded task rollout contains a turn_context with those values and identifies:

originator: "Codex Desktop"

The managed profile restricts writes to the project workspace plus task/temp directories rather than allowing unrestricted filesystem access.

What steps can reproduce the bug?

1. Use a personal ChatGPT Pro account on macOS.
2. Configure both user and trusted project Codex config with:

``toml
sandbox_mode = "danger-full-access"
approval_policy = "never"
``

1. Open Codex Desktop settings and confirm that AppraisalScope, User config, and Admin config all display:

• Sandbox: Full access
• Approval policy: Never ask for approval

1. Fully quit and restart Codex Desktop.
2. Start a completely new local task in the repository.
3. Ask the task to report its active sandbox, approval policy, reviewer, and permission profile.
4. Observe that the fresh task instead reports:

``text
workspace-write
on-request
auto_review
managed restricted permission profile
``

1. Inspect the task rollout JSONL and observe the same values in turn_context, with originator: "Codex Desktop".
2. As a control, launch the standalone CLI in the same repo with:

``bash
codex --sandbox danger-full-access --ask-for-approval never
``

1. Ask it to report its active configuration.
2. Observe that the CLI correctly reports:

``text
Sandbox mode: danger-full-access
Writable filesystem scope: unrestricted
Approval policy: never
Approvals reviewer: none
Permission profile: disabled with unrestricted filesystem access
Managed requirement/runtime override: none
``

Local sources eliminated

I checked the available local policy/configuration channels. None explain the Desktop task override:

• Project config sets danger-full-access, never; not the source
• User config sets danger-full-access, never; not the source
• No additional CLI profile files under ~/.codex/*.config.toml
• Desktop app-server launch args include only -c features.code_mode_host=true; no sandbox, approval, profile, or requirements override
• No relevant CODEX_* policy/profile environment variable is set
• /etc/codex/managed_config.toml is absent; Codex logs it as not found
• macOS managed preference keys requirements_toml_base64 and config_toml_base64 are absent; Codex logs both as not found
• profiles status -type enrollment reports MDM enrollment: No
• No OpenAI/Codex configuration profile is installed
• allowed_permission_profiles is not present in user/project TOML, /etc, managed preferences, or host-state JSON

The app uses ChatGPT auth and connects to the ChatGPT Codex backend, but the local logs expose no policy identifier or policy payload explaining the injected profile.

approvals_reviewer = "auto_review" appears in the same Desktop-created task context and is active; local logs show approval-review child tasks using codex-auto-review.

Expected behavior

If the Desktop UI and resolved config say Full access / Never ask, a newly created local task should start with the equivalent runtime configuration:

sandbox: danger-full-access
approval_policy: never
approvals_reviewer: none

If Codex Desktop intentionally imposes a separate restricted host-level policy for personal Pro tasks, the UI should show that effective policy rather than displaying Full access / Never ask, and the source/provenance of the restriction should be inspectable.

At minimum, Desktop should not silently replace the selected configuration after configuration resolution.

Actual behavior

Desktop displays Full access / Never ask, but fresh tasks are created as workspace-write / on-request / auto_review with a managed restricted permission profile.

The standalone CLI honors the exact requested full-access / approval-free configuration on the same machine and repo.

Additional information

This report intentionally does not attach the full rollout JSONL because it may contain private task content. I can provide a sanitized turn_context excerpt or relevant local log lines if useful.

The strongest local evidence establishes where the restrictive settings first appear: the Desktop-created per-thread turn_context. It does not establish whether the Desktop binary independently chooses the policy or receives task metadata from the ChatGPT backend immediately before thread creation.