Keeps asking for permission to run commands

Can you provide a more specific example of a series of commands where you saw this occur? It's likely that the commands differ slightly, so the approval engine categorized them as distinct commands.

@etraut-openai I think they are the same commands (but I will verify and get back to you), however they all have some other stuff before them (FOO=1 bar --baz). Could it be that the permission UI is correctly parsing just the command but when that check happens the next time it tries matching the full command string from the beginning?

Yeah, that's likely the cause. Specific examples would be useful when you have time. Thanks!

@etraut-openai Yep, just been collecting a few. All of these prompted permission requests (for cargo flamegraph):

mkdir -p perf && CARGO_PROFILE_RELEASE_DEBUG=true cargo flamegraph --bin foo --output perf/a.svg -- -S -c "input1"
mkdir -p perf && CARGO_PROFILE_RELEASE_DEBUG=true cargo flamegraph --bin foo --output perf/b.svg -- -S -c "input2"
mkdir -p perf && CARGO_PROFILE_RELEASE_DEBUG=true cargo flamegraph --bin foo --output perf/c.svg -- -c "input3"
mkdir -p perf && CARGO_PROFILE_RELEASE_DEBUG=true cargo flamegraph --bin foo --output perf/d.svg -- -S -c "input4"

Thanks for the example. The command parser currently doesn't handle commands with an environment variable assignment prefix. That explains why the calls in your example above are not exempted by the "Don't ask me again" logic. We'll need to think about this case more to figure out the best way to handle it. Thanks again for the examples — very helpful!

We've been experiencing this too. With any command starting 'Node -'. Despite choosing many times yes and don't ask again. Maybe it's the same bug you've identified.

Changing the Permission at the bottom of the Codex app to Full Permission also didn't fix this. It still asked if it can proceed with the commands starting 'node -'.

I can imagine you've thought through the permission model well. In my humble view, there could be room for:

1- a 'Yes continue and accept all requests in this session' or something similar, instead of having to babysit Codex as is the case now.

2- this can be a new permission option from the dropdown list, so it would be:
A- default sandbox (manual accept)
B- default sandbox (auto accept)
C- Full permissions

Something like... with the objective of having a simple way to auto accept what codex is asking for, but within the sandbox current permissions.

Hello everyone, can you please check this https://github.com/openai/codex/pull/11868

I've reproduced the issue, added a test, and verified that the test fails before my changes and passes after them.

I think it is happending when the tool being called is outside the sandbox. Here is my bug description (feature request?):

When I instruct Codex to use a command-line tool located outside the project directory (sandbox), it repeatedly asks for permission to run the tool, each time with slightly different arguments. This happens even though I defined a generic prefix_rule.

It appears that prefix_rules are not applied when the tool itself is located outside the sandbox. Ironically, the tool I’m calling is intended to operate only within the sandbox.

It would be helpful to have a rule that always allows a specific tool to run, without requiring repeated permission requests.

When I instruct Codex to use a command-line tool located outside the project directory (sandbox), it repeatedly asks for permission to run the tool, each time with slightly different arguments. This happens even though I defined a generic prefix_rule.

Yes @danielhoop checkout my comment here in another issue and let me know if this is what you are finding as well? https://github.com/openai/codex/issues/8537#issuecomment-4064805454

I thought it was just a Windows / PowerShell sandbox issue but maybe it is larger than that?

It makes Codex in the Windows Sandbox almost unusable because things like agent-browser SKILL / CLI Tool constantly need approval which means Codex cannot help with frontend web development unless I hand hold it approving every 15 seconds.