Asks for permission to run command `xcodebuild`, even after permitting all `xcodebuild` commands

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #10319
• #10187
• #8778
• #9298

Powered by Codex Action

Are subsequent commands exactly the same as the first one that you approved, or do they differ in their arguments?

@bholmesdev could you use /feedback and share the session id?

@etraut-openai I just confirmed that it is running with the exact same set of arguments. Andn @dylan-hurd-oai here is the feedback ID: 019c171d-d6a4-7690-a080-3994dbb86bda

To clarify, the command being run is xcodebuild -scheme Hubble -destination 'generic/platform=iOS' -quiet CODE_SIGNING_ALLOWED=NO build 2>&1. This is listed in my project rules file:

Rules

• Always run pnpm convex typecheck to check your work when updating convex files.
• To check if the app builds, run an applicable variant of: xcodebuild -scheme Hubble -destination 'generic/platform=iOS' -quiet CODE_SIGNING_ALLOWED=NO build 2>&1
• Don't commit code for me. I'll ask you to.

Overview

Hubble is an iOS/macOS app with a Convex backend. Built with XCode, with packages tracked in XCode.

For permission updates, instruct user on what to update in Xcode (ex. add microphone permissions in Target > Info).

Data Model

• Note: Voice/text note with transcript
• Lens: User-defined filter/tag for organizing notes
• NoteLens: Join table linking notes to lenses (many-to-many)

Conventions

• Views in Views/, reusable components in Views/Components/, modifiers in Views/Modifiers/
• Services handle external APIs, device managers, and AI features
• Convex functions: queries for reads, mutations for writes, actions for AI/external calls
• HTTP endpoints in convex/http.ts for streaming responses

Folder Structure

Hubble/
├── Hubble/
│   ├── Models/             # Note, Lens, LocalModels, AgentResponse, SyncStatus
│   ├── Views/
│   │   ├── Components/     # Reusable (NoteRow, LensDropdown, QABubble, etc.)
│   │   └── Modifiers/      # View modifiers (InnerShadow)
│   ├── Services/           # ConvexService, SyncEngine, transcription, AI services
│   ├── Helpers/            # MarkdownHelpers
│   ├── ContentView.swift
│   └── HubbleApp.swift
├── convex/
│   ├── schema.ts           # DB schema (notes, lenses, noteLenses tables)
│   ├── notes.ts            # Note queries/mutations
│   ├── lenses.ts           # Lens queries/mutations
│   ├── noteLenses.ts       # Note-lens relationship mutations
│   ├── agent.ts            # AI agent with RAG (askHubble, continueHubble)
│   ├── http.ts             # HTTP streaming endpoints
│   ├── lib/auth.ts         # Auth helpers
│   ├── migrations/         # Data migrations
│   └── _generated/
├── Hubble.xcodeproj/
├── HubbleTests/
├── HubbleUITests/
└── package.json

Commands

pnpm convex dev      # Start Convex dev server
pnpm convex deploy   # Deploy Convex
pnpm convex typecheck # Check types

Local-First Sync Engine

The app uses a local-first architecture with SwiftData for offline support. Data loads instantly from local storage; Convex syncs in the background.

Key Files

• Models/LocalModels.swift — SwiftData models (LocalNote, LocalLens) with sync metadata (serverId, syncStatus, lastModifiedLocally)
• Models/SyncStatus.swift — Enum: .synced, .pendingCreate, .pendingUpdate, .pendingDelete
• Services/NoteRepository.swift — Local CRUD, findByStableId(), upsertFromServer()
• Services/LensRepository.swift — Same pattern for lenses
• Services/SyncEngine.swift — Coordinates push/pull with Convex
• Services/NetworkMonitor.swift — Detects connectivity changes, triggers sync on reconnect

Sync Behavior

On app launch:

1. Load from SwiftData immediately (no auth required)
2. Authenticate with Convex
3. syncAll() → push pending changes, then start subscriptions

On edit:

1. Save to SwiftData with syncStatus = .pendingUpdate
2. Push to Convex in background
3. Subscriptions paused during push to prevent race conditions

On reconnect (airplane mode off):

1. NetworkMonitor detects connection restored
2. Triggers syncAll() automatically

Conflict Resolution

Device always wins. Push happens before pull, so offline edits overwrite server. The lastModifiedLocally timestamp is compared against serverNote.updatedAt only for incoming pull data — if local has pending changes with a newer timestamp, server data is ignored.

Schema Migrations

SwiftData uses HubbleMigrationPlan for versioned schemas. On schema mismatch (dev only), the local store auto-deletes and re-syncs from Convex.

Voice Input & AI

The user can interact with the Hubble Agent through voice or text. This agent is managed in Convex.

Transcription

• Services/SpeechTranscriberManager.swift — Apple Speech transcription
• Services/ParakeetTranscriberManager.swift — Enhanced local transcription
• Services/TranscriptionSettings.swift — User transcription preferences
• Views/VoiceNoteView.swift — Main recording flow
• Views/Components/TranscriptSheet.swift, TranscriptCard.swift — Transcript display

Live Q&A

• Services/LiveQAService.swift — Detects questions during transcription to interact with the Hubble agent
• Views/Components/QABubble.swift — Displays Q&A segments in transcript
• Services/TranscriptRefiner.swift — AI-powered transcript cleanup (streaming)

any updates here? anybody knows how to fix it? this is insane that you have to approve it every 5 minutes. I've tried to add as set of rules, but it didn't work:

prefix_rule(
    pattern = ["xcodebuild"],
    decision = "allow",
    justification = "Allow local build and test invocations without approval prompts.",
    match = [
        "xcodebuild -project table-ai.xcodeproj -scheme table-ai build",
        "xcodebuild test -project table-ai.xcodeproj -scheme table-ai -destination platform=macOS",
    ],
    not_match = [
        "xcrun xcresulttool get --path .build/DerivedData/Logs/Test/result.xcresult --format json",
    ],
)

what am i doing wrong?

I have the same issues with commands like this one:
xcodebuild -workspace ./ProjectName.xcworkspace -scheme ProjectName -configuration Debug -destination 'id=F94783BB-3585-4762-B652-656912287576' build > /tmp/cw_settings_build.log 2>&1;

When I instructed Codex to run "pure" xcodebuild commands instead, it seems to have fixed the issue.
The following command was run unsandboxed without approval, as expected:

xcodebuild -workspace ./ProjectName.xcworkspace -scheme ProjectName -configuration Debug -destination 'id=F94783BB-3585-4762-B652-656912287576' build

So the bug might have something to do with the output redirects.
While troubleshooting, I had also added this to my default.rules, but it did not work:

prefix_rule(pattern=["xcodebuild"], decision="allow")

I have this issue in general with most commands. I have a rules file for all the commands I want to auto-approve. If I use --ask-for--aproval=untrusted, it still prompts me to accept the commands, even if my ~/.codex/rules/<cmd>.rules file allows it.

Overall, this issue + my experience makes me think the rules and command approvals are not working as expected.

To reproduce:

repro.sh:

#!/usr/bin/env bash
set -euo pipefail

# Repro: .rules files don't auto-approve matching commands
# Expected: "sample-command-foo" should be auto-approved by the rules file
# Actual:   codex still prompts for approval

RULES_DIR="$HOME/.codex/rules"
BIN_DIR="$HOME/.local/bin"

###############################################################################
# 1. Create a rules file that allows "sample-command-foo"
###############################################################################
mkdir -p "$RULES_DIR"

cat > "$RULES_DIR/sample-command-foo.rules" <<'EOF'
# Sample command for repro
prefix_rule(
    pattern = ["sample-command-foo"],
    decision = "allow",
    match = ["sample-command-foo", "sample-command-foo --help"],
    not_match = [],
)
EOF

echo "[+] Created rules file: $RULES_DIR/sample-command-foo.rules"
cat "$RULES_DIR/sample-command-foo.rules"

###############################################################################
# 2. Create the sample-command-foo binary
###############################################################################
mkdir -p "$BIN_DIR"

cat > "$BIN_DIR/sample-command-foo" <<'SCRIPT'
#!/usr/bin/env bash
echo "sample-command-foo executed successfully"
SCRIPT

chmod +x "$BIN_DIR/sample-command-foo"

echo ""
echo "[+] Created executable: $BIN_DIR/sample-command-foo"
ls -la "$BIN_DIR/sample-command-foo"

# Make sure it's on PATH
export PATH="$BIN_DIR:$PATH"
echo "[+] Verify it runs directly:"
sample-command-foo

###############################################################################
# 3. Run codex with --ask-for-approval=untrusted and verbose
###############################################################################
echo ""
echo "=========================================="
echo " Running codex exec (verbose)"
echo "=========================================="
echo ""


# cd <some-git-repo>
codex --ask-for-approval untrusted

Then codex v0.99 still asks for permissions

<img width="2082" height="1678" alt="Image" src="https://github.com/user-attachments/assets/859bea5b-2e76-4d4f-b953-c9b4b51b8d11" />

I know this is not the same as the issue reported. But I'm sharing this here instead of a new issue because it feels like the root cause is the same

After digging a bit more into this, by using RUST_LOG=codex_core=debug + tail -f ~/.codex/log/codex-tui.log, I noticed a few of my .rules file had a syntax error. But those files were unrelated to the one for sample-command-foo documented here. Fixing them resolved the issue. So the problem may be a syntax error in another rule. This seems to have 2 main problems:

1. A syntax error in a .rules file invalidates all the other different .rules files
2. No errors are reported to the user in the main TUI when there's an error in one of the .rules files

I'll create a separate issue for this.

@etraut-openai @dylan-hurd-oai @polyrand can you please check this https://github.com/openai/codex/pull/11868

I get this too, at first I thought it was just for new items (it would ask permission repeatedly in one session, but the next session would pick up the rules file). But it's definitely for existing rules too.
I have the rule prefix_rule(pattern=["npm", "test"], decision="allow")

And it asks for permissions to run npm test -- appSettings

v0.101.0
thread ID 019c692f-d528-7152-888a-d435c1f9eba6

Hi folks - looks like we have 2 problems here:

1. Per our current rules documentation, we have historically been quite strict with what constitutes a prefix match. #11951 should help expand the potential matches to include redirects in simple commands. We'll continue to expand the matching logic carefully.
2. @davidgilbertson - your thread file does not contain the prefix_rule you mentioned, i suspect you might have a rules parsing error. If that is the case, #11686 should help identify this problem.

Re-opening for now to confirm the fix

@dylan-hurd-oai you're great! I cleared all the rules and now it works. Although neither I nor ChatGPT could see any syntax errors.

Actually it's happening again now, asking every time to run tests, and the only thing in my rules file is:

prefix_rule(pattern=["npm", "test"], decision="allow")

So the current state of things on Windows is quite bad. You can't use the new sandbox because then Codex can't even read files. With the older sandbox, Codex can't run tests in a sandbox because of the EPERM issue. It can escalate and run them outside a sandbox, but it can't remember that it's allowed to run tests. So in a session where its troubleshooting failing tests, you have to sit there and approve it again and again.

Actually it's happening again now, asking every time to run tests...

Yeah it seems that the prefix rules require exact full commands with PowerShell commands for Windows sandboxing. I described my similar issue I am still having here: https://github.com/openai/codex/issues/8537#issuecomment-4064805454

A solution has been found:

1. Create xcodebuild.sh:

#!/usr/bin/env bash
set -euo pipefail

BASE_CMD="xcodebuild -scheme Hubble -destination 'generic/platform=iOS'"
EXTRA="${1-}"

if [[ -n "$EXTRA" ]]; then
  bash -lc "$BASE_CMD $EXTRA"
else
  bash -lc "$BASE_CMD"
fi

1. Add xcodebuild.sh in Codex default.rules:

prefix_rule(pattern=["sh", "xcodebuild.sh"], decision="allow")

1. Ask Codex to use xcodebuild.sh for any project build, or write a skill for it:

In the future, always call any xcodebuild via xcodebuild.sh with the addition of the rest of the command, for example:
sh xcodebuild.sh "│ -quiet CODE_SIGNING_ALLOWED=NO build 2>&1"

Closing as resolved by #11951.