approval_policy = "untrusted" is not respected by vscode extension

What version of Codex is running?

Extension - Version 0.4.21

What subscription do you have?

Business

Which model were you using?

gpt-5-codex

What platform is your computer?

Darwin 24.6.0 arm64 arm

What issue are you seeing?

If i put approval_policy = "untrusted" in ~/.codex/config.toml it is not respected by the agent. It can still run e.g. mkdir whatever. When you ask the agent what policy it has currently, it says on-request.
The policy is respected when running codex directly as a cli though, but _not_ via the extension

What steps can reproduce the bug?

See above

What is the expected behavior?

Should ask for any shell command

Additional information

_No response_