Approval auto-review rejects first escalation as too many requests

Codex version

codex-cli 0.149.0

Platform

Linux 7.1.8-1-cachyos x86_64

Summary

Automatic approval review rejected the first outside-sandbox request in the turn as "too many approval requests," reporting only 1 consecutive, 1 in the last 50 reviews. The turn was then interrupted before the user could approve or deny the narrowly scoped command.

Context

• Sandbox mode: workspace-write / managed permissions
• Approval reviewer: automatic review
• The user explicitly asked whether Codex could run outside the sandbox.
• The command was non-destructive and scoped to the current workspace.
• The command itself enabled the repository's mandatory Bubblewrap wrapper, which denies network access and isolates target-controlled audit code.

No secrets, RPC URLs, or .env values were part of the command or justification.

Command

AUDIT_SANDBOX=1 ./scripts/scan.sh sources/aave-v4 reports/aave-v4-2026-08-21/scan-results

The tool call used sandbox_permissions: "require_escalated" with a justification explaining that the outer Codex sandbox needed escalation while the target code would remain isolated by Bubblewrap.

Actual behavior

Request denied for codex to run AUDIT_SANDBOX=1 ./scripts/scan.sh sources/aave-v4 reports/aave-v4-2026-08-21/...

• Ran AUDIT_SANDBOX=1 ./scripts/scan.sh sources/aave-v4 reports/aave-v4-2026-08-21/scan-results
  └ (no output)

⚠ Automatic approval review rejected too many approval requests for this turn (1 consecutive, 1 in the last 50 reviews);
  interrupting the turn.

Expected behavior

One scoped escalation request should not trip a "too many requests" threshold. Codex should either present the approval request to the user or return a normal policy denial without interrupting the entire turn.

Reproduction steps

1. Open a workspace-write session with automatic approval review.
2. Ask Codex to run a single non-destructive workspace command outside the sandbox.
3. Have Codex call exec_command once with sandbox_permissions: "require_escalated" and a scoped justification.
4. Observe that automatic review reports 1 consecutive, 1 in the last 50 reviews as too many and interrupts the turn.

Start at the automatic approval reviewer handling of exec_command requests with sandbox_permissions set to require_escalated, then reproduce the single-request scenario in a workspace-write session. Trace why one consecutive and one recent review is treated as too many. Done means the request reaches the user for approval, or a normal policy denial is returned without interrupting the turn, with regression coverage for this case.