From 7754dd1b89c763b7ebba9f01a51f23a58dab2989 Mon Sep 17 00:00:00 2001 From: Dylan Hurd Date: Fri, 20 Mar 2026 15:57:06 -0700 Subject: [PATCH] chore(core) update prefix_rule guidance (#15231) ## Summary Small tweaks to the prefix_rule guidance. ## Testing - [x] in progress --- codex-rs/protocol/src/models.rs | 2 +- .../approval_policy/{on_request_rule.md => on_request.md} | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) rename codex-rs/protocol/src/prompts/permissions/approval_policy/{on_request_rule.md => on_request.md} (90%) diff --git a/codex-rs/protocol/src/models.rs b/codex-rs/protocol/src/models.rs index 1368a93f6..8fe93e677 100644 --- a/codex-rs/protocol/src/models.rs +++ b/codex-rs/protocol/src/models.rs @@ -478,7 +478,7 @@ const APPROVAL_POLICY_UNLESS_TRUSTED: &str = const APPROVAL_POLICY_ON_FAILURE: &str = include_str!("prompts/permissions/approval_policy/on_failure.md"); const APPROVAL_POLICY_ON_REQUEST_RULE: &str = - include_str!("prompts/permissions/approval_policy/on_request_rule.md"); + include_str!("prompts/permissions/approval_policy/on_request.md"); const APPROVAL_POLICY_ON_REQUEST_RULE_REQUEST_PERMISSION: &str = include_str!("prompts/permissions/approval_policy/on_request_rule_request_permission.md"); diff --git a/codex-rs/protocol/src/prompts/permissions/approval_policy/on_request_rule.md b/codex-rs/protocol/src/prompts/permissions/approval_policy/on_request.md similarity index 90% rename from codex-rs/protocol/src/prompts/permissions/approval_policy/on_request_rule.md rename to codex-rs/protocol/src/prompts/permissions/approval_policy/on_request.md index 3928a91b7..092f375c1 100644 --- a/codex-rs/protocol/src/prompts/permissions/approval_policy/on_request_rule.md +++ b/codex-rs/protocol/src/prompts/permissions/approval_policy/on_request.md @@ -19,6 +19,8 @@ This is treated as two command segments: ["tee", "output.txt"] +Commands that use more advanced shell features like redirection (>, >>, <), substitutions ($(...), ...), environment variables (FOO=bar), or wildcard patterns (*, ?) will not be evaluated against rules, to limit the scope of what an approved rule allows. + ## How to request escalation IMPORTANT: To request approval to execute a command that will require escalated privileges: @@ -44,7 +46,7 @@ While commands are running inside the sandbox, here are some scenarios that will When choosing a `prefix_rule`, request one that will allow you to fulfill similar requests from the user in the future without re-requesting escalation. It should be categorical and reasonably scoped to similar capabilities. You should rarely pass the entire command into `prefix_rule`. ### Banned prefix_rules -Avoid requesting overly broad prefixes that the user would be ill-advised to approve. For example, do not request ["python3"], ["python", "-"], or other similar prefixes. +Avoid requesting overly broad prefixes that the user would be ill-advised to approve. For example, do not request ["python3"], ["python", "-"], or other similar prefixes that would allow arbitrary scripting. NEVER provide a prefix_rule argument for destructive commands like rm. NEVER provide a prefix_rule if your command uses a heredoc or herestring. @@ -52,5 +54,4 @@ NEVER provide a prefix_rule if your command uses a heredoc or herestring. Good examples of prefixes: - ["npm", "run", "dev"] - ["gh", "pr", "check"] -- ["pytest"] - ["cargo", "test"]