execpolicy: unwrap PowerShell -Command wrappers on Windows by iceweasel-oai · Pull Request #20336 · openai/codex

iceweasel-oai · 2026-04-30T05:30:35Z

Why

On Windows, Codex runs shell commands through a top-level powershell.exe -NoProfile -Command ... wrapper. execpolicy was matching that wrapper instead of the inner command, so prefix rules like ["git", "push"] did not fire for PowerShell-wrapped commands even though the same normalization already happens for bash -lc on Unix.

This change makes the Windows shell wrapper transparent to rule matching while preserving the existing Windows unmatched-command safelist and dangerous-command heuristics.

What changed

add parse_powershell_command_plain_commands() in shell-command/src/powershell.rs to unwrap the top-level PowerShell -Command body with extract_powershell_command() and parse it with the existing PowerShell AST parser
update core/src/exec_policy.rs so commands_for_exec_policy() treats top-level PowerShell wrappers like bash -lc and evaluates rules against the parsed inner commands
carry a small ExecPolicyCommandOrigin through unmatched-command evaluation and expose is_safe_powershell_words() / is_dangerous_powershell_words() so Windows safelist and dangerous-command checks still work after unwrap
add Windows-focused tests for wrapped PowerShell prompt/allow matches, wrapper parsing, and unmatched safe/dangerous inner commands, and re-enable the end-to-end execpolicy_blocks_shell_invocation test on Windows

Testing

cargo test -p codex-shell-command

iceweasel-oai · 2026-04-30T05:37:13Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c6042b542e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

iceweasel-oai · 2026-04-30T17:32:44Z

@codex review

chatgpt-codex-connector · 2026-04-30T17:40:58Z

Codex Review: Didn't find any major issues. 👍

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

iceweasel-oai · 2026-04-30T19:49:46Z

            cmd,
-            sandbox_permissions,
-            used_complex_parsing,
+            crate::exec_policy::UnmatchedCommandContext {


this struct was introduced to fix a clippy warning about too many parameters due to me adding one new one (command_origin)

bolinfest · 2026-04-30T22:16:17Z

 #[cfg(test)]
 #[path = "exec_policy_tests.rs"]
 mod tests;


Can you create a separate file exec_policy_windows_tests.rs and include it here in the same way, but with #[cfg(all(windows, test))] so you don't have to #[cfg(windows)] in exec_policy_windows_tests itself?

bolinfest · 2026-04-30T22:17:43Z

-fn commands_for_exec_policy(command: &[String]) -> (Vec<Vec<String>>, bool) {
+fn commands_for_exec_policy(
+    command: &[String],
+) -> (Vec<Vec<String>>, bool, ExecPolicyCommandOrigin) {


I take responsibility for the original tuple return value being bad, so since you're touching this code, can you declare a small struct before this function to use as a return value and return that?

bolinfest · 2026-04-30T22:21:10Z

 use codex_protocol::permissions::FileSystemSandboxPolicy;
 use codex_protocol::protocol::AskForApproval;
 use codex_shell_command::is_dangerous_command::command_might_be_dangerous;
+#[cfg(windows)]


If you only use the function in one block in this file and that block already has #[cfg(windows)], I would favor doing the import in that block so the top-level imports are less noisy.

We should add that to AGENTS.md...

bolinfest · 2026-04-30T22:26:11Z

 ];

+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(crate) enum ExecPolicyCommandOrigin {


This needs a docstring because I'm a little fuzzy on what this means.

ExecPolicyCommandOrigin::PowerShell to me implies the command was targeted to be run under PowerShell, but looking at the code, it feels like it actually means "the type of shell parser that was used to parse the command." It's possible the user is on Windows but could be using a shell that isn't PowerShell, isn't it? Or no?

To that end, I'm not clear why the other variant is named Direct.

bolinfest · 2026-04-30T22:28:44Z

+            sandbox_permissions: SandboxPermissions::UseDefault,
+            prefix_rule: None,
+        },
+        ExecApprovalRequirement::Forbidden {


I'm confused, why isn't this ExecApprovalRequirement::NeedsApproval?

bolinfest · 2026-04-30T22:32:10Z


 #[tokio::test]
 async fn execpolicy_blocks_shell_invocation() -> Result<()> {
-    // TODO execpolicy doesn't parse powershell commands yet


Well, that explains that...

bolinfest · 2026-04-30T22:35:29Z

+/// This is intentionally narrower than the Windows safe-command parser: it only unwraps the
+/// `-Command`/`-c` body from a PowerShell invocation we already recognize, then delegates the
+/// script itself to the PowerShell AST parser.
+pub fn parse_powershell_command_plain_commands(command: &[String]) -> Option<Vec<Vec<String>>> {


Maybe parse_powershell_command_into_plain_commands()?

bolinfest · 2026-04-30T22:37:58Z

+    let (shell, script) = extract_powershell_command(command)?;
+    try_parse_powershell_ast_commands(shell, script)


I think executable is the more appropriate name here.

Suggested change

let (shell, script) = extract_powershell_command(command)?;

try_parse_powershell_ast_commands(shell, script)

let (executable, script) = extract_powershell_command(command)?;

try_parse_powershell_ast_commands(executable, script)

bolinfest · 2026-04-30T22:39:35Z

+    #[cfg(windows)]
+    #[test]
+    fn parses_plain_powershell_commands() {
+        let commands = parse_powershell_command_plain_commands(&[


Also add a test for a case where commands has more than one entry?

iceweasel-oai added 2 commits April 29, 2026 22:30

Unwrap PowerShell shell wrappers in execpolicy

7f2b66e

Add Windows execpolicy unwrap tests

c6042b5

iceweasel-oai changed the title ~~Unwrap PowerShell shell wrappers in execpolicy~~ Use inner powershell script/command in execpolicy Apr 30, 2026

Fix non-Windows clippy in powershell tests

d620b62

chatgpt-codex-connector Bot reviewed Apr 30, 2026

View reviewed changes

Comment thread codex-rs/core/src/exec_policy.rs Outdated

pass 'inner' powershell command to safe/dangerous detection

25baa6d

iceweasel-oai changed the title ~~Use inner powershell script/command in execpolicy~~ Use powershell AST parser in exec_command for prefix-rule matching Apr 30, 2026

iceweasel-oai added 2 commits April 30, 2026 10:51

Fix non-Windows exec policy origin enum

bdf9380

Refactor unmatched exec policy context

a197ed1

iceweasel-oai marked this pull request as ready for review April 30, 2026 18:13

iceweasel-oai requested a review from a team as a code owner April 30, 2026 18:13

iceweasel-oai requested a review from bolinfest April 30, 2026 18:13

iceweasel-oai added 2 commits April 30, 2026 11:40

Fix Clippy needless return in shell-command

3ab04af

Fix Clippy needless return in safe command helper

9d3afe3

iceweasel-oai commented Apr 30, 2026

View reviewed changes

iceweasel-oai changed the title ~~Use powershell AST parser in exec_command for prefix-rule matching~~ execpolicy: unwrap PowerShell -Command wrappers on Windows Apr 30, 2026

bolinfest approved these changes Apr 30, 2026

View reviewed changes

address review comments.

df3033e

iceweasel-oai enabled auto-merge (squash) May 1, 2026 00:39

iceweasel-oai merged commit 4f96001 into main May 1, 2026
25 checks passed

iceweasel-oai deleted the codex/windows-powershell-execpolicy-v2 branch May 1, 2026 00:56

github-actions Bot locked and limited conversation to collaborators May 1, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

execpolicy: unwrap PowerShell -Command wrappers on Windows#20336

execpolicy: unwrap PowerShell -Command wrappers on Windows#20336
iceweasel-oai merged 9 commits into
mainfrom
codex/windows-powershell-execpolicy-v2

iceweasel-oai commented Apr 30, 2026 •

edited by bolinfest

Loading

iceweasel-oai commented Apr 30, 2026

chatgpt-codex-connector Bot left a comment

Uh oh!

iceweasel-oai commented Apr 30, 2026

chatgpt-codex-connector Bot commented Apr 30, 2026

iceweasel-oai Apr 30, 2026

bolinfest Apr 30, 2026

bolinfest Apr 30, 2026

bolinfest Apr 30, 2026

bolinfest Apr 30, 2026

bolinfest Apr 30, 2026

bolinfest Apr 30, 2026

bolinfest Apr 30, 2026

bolinfest Apr 30, 2026

bolinfest Apr 30, 2026

Uh oh!

Labels

2 participants

		let (shell, script) = extract_powershell_command(command)?;
		try_parse_powershell_ast_commands(shell, script)

Conversation

iceweasel-oai commented Apr 30, 2026 • edited by bolinfest Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What changed

Testing

iceweasel-oai commented Apr 30, 2026

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

iceweasel-oai commented Apr 30, 2026

chatgpt-codex-connector Bot commented Apr 30, 2026

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Uh oh!

Labels

2 participants

iceweasel-oai commented Apr 30, 2026 •

edited by bolinfest

Loading