`full-auto` doesn't activate `on-failure` approval policy

What version of Codex is running?

codex-cli 0.45.0

Which model were you using?

gpt-5-codex

What platform is your computer?

Darwin 25.0.0 arm64 arm

What steps can reproduce the bug?

Run codex --help and view --full-auto description. It says "Convenience alias for low-friction sandboxed automatic execution (-a on-failure, --sandbox workspace-write)"

Run codex --full-auto and /status. It shows Approval: on-request, Sandbox: workspace-write. The same effect without --full-auto.

What is the expected behavior?

The expected behavior is the on-failure mode for the approval policy when using --full-auto, as described in the help section.

Same when working in an approved directory.

What do you see instead?

I see Approval: on-request reported by /status.

Additional information

In "on-request" mode, the model is confused by commands such as "dotnet build" that attempt to reach the Internet and then sit silently and time out without reporting an error.