[Windows app] Full Access -> Custom leaves stale approvals_reviewer=user and bypasses Auto-review

What version of the Codex App are you using (From “About Codex” dialog)?

Version 26.810.52044

The same state-transition pattern also reproduced on this same computer in a separate task on July 19, 2026, while running the then-current Codex Desktop version.

What subscription do you have?

Not included in this public report; the issue appears to be local Desktop permission-state handling rather than subscription-specific behavior.

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

Switching a running Codex Desktop task from Custom (config.toml) to Full Access, then back to Custom, can restore the sandbox and approval policy but leave the approval reviewer from Full Access.

My user-level config is:

approval_policy = "on-request"
approvals_reviewer = "auto_review"
sandbox_mode = "workspace-write"

The expected Custom state is therefore:

approval_policy = on-request
approvals_reviewer = auto_review
sandbox_policy = workspace-write

However, the affected task transitions as follows:

1. Custom
   approval_policy = on-request
   approvals_reviewer = auto_review
   sandbox_policy = workspace-write

2. Switch to Full Access
   approval_policy = never
   approvals_reviewer = user
   sandbox_policy = danger-full-access

3. Switch back to Custom
   approval_policy = on-request
   approvals_reviewer = user        <-- stale / incorrect
   sandbox_policy = workspace-write

At step 3, approval requests are routed directly to the human UI. Auto-review never receives them, even though config.toml still says approvals_reviewer = "auto_review".

This produces the user-visible symptom of manual approval dialogs appearing for a task that is expected to be using Auto-review.

A fresh task at the same time correctly uses:

approval_policy = on-request
approvals_reviewer = auto_review
sandbox_policy = workspace-write

That rules out a malformed global config and points to stale per-thread/task permission state.

This has now reproduced in two separate tasks at different times. The earlier reproduction on July 19 showed the same transition:

on-request + auto_review
-> Full Access: never + user
-> back to managed/Custom: on-request + user

The later reproduction showed the same reviewer leak again after returning from Full Access.

What steps can reproduce the bug?

1. On Windows Codex Desktop, configure:

   approval_policy = "on-request"
   approvals_reviewer = "auto_review"
   sandbox_mode = "workspace-write"
   

2. Start a fresh task in Custom (config.toml).

3. Verify the effective task settings are:

   approval_policy = on-request
   approvals_reviewer = auto_review
   sandbox_policy = workspace-write
   

4. Switch the same running task to Full Access.

5. Verify the effective task settings become approximately:

   approval_policy = never
   approvals_reviewer = user
   sandbox_policy = danger-full-access
   

6. Switch the same task back to Custom (config.toml).

7. Trigger any operation that requires an escalation/approval under the managed sandbox.

8. Inspect the effective task settings and approval routing.

Observed:

approval_policy = on-request
approvals_reviewer = user
sandbox_policy = workspace-write

The approval is shown to the user manually.

Expected:

approval_policy = on-request
approvals_reviewer = auto_review
sandbox_policy = workspace-write

The request should be routed to the Auto-review reviewer agent.

What is the expected behavior?

Switching permission modes should replace the complete effective permission context atomically.

When switching Full Access -> Custom (config.toml), Codex Desktop should restore all relevant fields from the configured Custom state, including approvals_reviewer.

A field from Full Access (approvals_reviewer = user) must not remain attached to the task after the sandbox and approval policy have already returned to the Custom values.

Additional information

This appears related to #32338, which reports broader permission-profile desynchronization and field mixing on Windows, but this report is intentionally narrower: it describes a repeatable Full Access -> Custom reviewer-state leak with a concrete three-state transition and a specific user-visible consequence: Auto-review is bypassed and manual approvals appear.

It also differs from reports where Auto-review rejects or fails an approval. In this case Auto-review is not involved at all: the task's effective approvals_reviewer has changed to user.

Manually selecting Approve for me restores approvals_reviewer = auto_review, and a new task also reads the global config correctly. This further suggests the bug is in per-thread/task permission-state restoration or field-wise merging during the Full Access -> Custom transition, rather than config parsing.

No source file, test, or entry point is named. Start by tracing the Windows task permission-state transition described in the reproduction, focusing on Full Access to Custom restoration; done means the complete Custom context restores approvals_reviewer=auto_review and the reported approval-routing scenario no longer shows manual approval dialogs.