Per-project config ignored; session forced to approval_policy=on-request + sandbox=workspace-write (CODEX_SANDBOX=seatbelt)

Summary

Per-project settings in ~/.codex/config.toml are ignored. Session runs with approval_policy=on-request and sandbox=workspace-write despite project config specifying ask_for_approval=never and sandbox=danger-full-access. Environment inside the session shows CODEX_SANDBOX=seatbelt and CODEX_SANDBOX_NETWORK_DISABLED=1.

Environment

• codex-cli: 0.77.0
• macOS 15.7.3 (arm64)

Config (per-project)

~/.codex/config.toml:
[projects."<home-directory>/codex-skills"]
trust_level = "trusted"
ask_for_approval = "never"
sandbox = "danger-full-access"

Steps to Reproduce

1. cd <home-directory>/codex-skills
2. run codex with no flags (no alias)
3. ask agent to run git add or git commit
4. observe approval prompts and sandbox restrictions
5. inside the session run env | rg -i 'codex|sandbox|approval'

Expected

Per-project config should apply: no approval prompts, sandbox=danger-full-access.

Actual

Approval prompts appear, and sandbox behaves like workspace-write. Environment shows:

• CODEX_SANDBOX=seatbelt
• CODEX_SANDBOX_NETWORK_DISABLED=1

Notes

• No flags are used (history shows just codex).
• No shell profiles set CODEX_* vars.