Auto-review reviewer state is not shown with a custom permission profile

What version of the Codex App are you using (From “About Codex” dialog)?

26.803.61601

What subscription do you have?

plus

What platform is your computer?

Darwin 25.6.0 arm64 arm

What issue are you seeing?

The permissions menu combines reviewer selection with permission-profile selection, but it displays only the custom permission profile as active.

With default_permissions = "personal-workspace", selecting either Approve for me or Ask for approval changes the effective reviewer correctly. However, the composer pill and menu checkmark continue to show only personal-workspace. There is no visible indication whether Auto-review is currently on or off before submitting a task.

This makes unattended execution difficult to use safely because the user cannot verify who will review sandbox escalations.

What steps can reproduce the bug?

1. Configure approval_policy = "on-request", approvals_reviewer = "user", and default_permissions = "personal-workspace".
2. Define personal-workspace as a named permission profile extending :workspace.
3. In the desktop composer permissions menu, select Approve for me.
4. Reopen the menu. The effective reviewer is Auto-review, but the only checkmark and composer pill still show personal-workspace.
5. Select Ask for approval.
6. Reopen the menu. The effective reviewer is now the user, but the UI is visually unchanged and still shows only personal-workspace.
7. Repeat the two selections. Runtime behavior switches correctly, but the GUI provides no reviewer-state indication.

What is the expected behavior?

The UI should show the permission profile and approval reviewer as two independent active settings, or use a combined label that clearly indicates both.

For example:

• personal-workspace · Ask for approval
• personal-workspace · Approve for me

The user must be able to verify whether Auto-review is active before submitting a task without changing or replacing the selected custom sandbox profile.

Additional information

The global default is intentionally approvals_reviewer = "user". Auto-review is selected only for individual unattended tasks.

The reviewer switching itself works: tasks alternately arrived with user review and Auto-review according to the selected menu action. The problem is the missing visual state.

Permission profiles cannot solve this because they define filesystem/network boundaries and do not support a per-profile approvals_reviewer field.

Start at the desktop composer permissions menu and trace how the active permission label, checkmark, and composer pill are derived. Reproduce the issue with a custom personal-workspace profile, then verify that changing between Approve for me and Ask for approval visibly preserves the profile while showing the selected reviewer.