`codex exec --help` references `-a on-request` but `codex exec --ask-for-approval` is rejected

[kankosanin-gif]

What version of Codex CLI is running?

codex-cli 0.106.0

What subscription do you have?

Plus

Which model were you using?

No response

What platform is your computer?

No response

What terminal emulator and version are you using (if applicable)?

No response

What issue are you seeing?

The codex exec --help text suggests approval behavior via --full-auto alias (-a on-request, --sandbox workspace-write), but codex exec does not accept --ask-for-approval directly.

Repro command:

codex exec --sandbox read-only --ask-for-approval never "test"

Actual output:

error: unexpected argument '--ask-for-approval' found

This creates confusion because top-level codex --help advertises --ask-for-approval, while exec help references -a semantics indirectly.

What steps can reproduce the bug?

1. Run codex --help and note that --ask-for-approval is listed.
2. Run codex exec --help and note --full-auto description references -a on-request behavior.
3. Execute:

   codex exec --sandbox read-only --ask-for-approval never "test"

4. Observe the parser error: unexpected argument '--ask-for-approval' found.

This appears to be a UX/docs inconsistency between top-level and exec subcommand options.

What is the expected behavior?

Expected one of the following:

• codex exec should accept --ask-for-approval if approval policy is intended to be configurable in exec mode, or
• codex exec --help should avoid referencing -a on-request semantics and clearly document what approval options are actually supported for exec.

Additional information

This is likely a CLI UX/documentation mismatch. Happy to open a docs PR if maintainers prefer clarifying help text first.

[etraut-openai]

I've updated the help text so it's consistent with the implementation.