Make the list of auto-approved commands configurable via `execpolicy`

I believe this is a much-needed feature. While this gets polished and made available to users, maybe allowing to pass custom Starlark .policy files when running codex could be a good starting point?

Cursor CLI has a nice UI for choosing which tools to allow:

<img width="823" height="145" alt="Image" src="https://github.com/user-attachments/assets/78138cd1-4d1d-4908-a352-4ebc28567561" />

How can one create an allowed tools list as in claude code?

Thought I would use Codex CLI to migrate some tests to use Testcontainers. Really want to be able to let the sandbox interact with docker!

Would love to have this implemented!

The recent PR #7033 by @zhao-oai adds a version of prefix allowance during TUI execution, it would be awesome to configure a pre-approved list of prefix commands before execution. Anyone is working on this?

Recently noticed that:

  Would you like to run the following command?

  Reason: Check if DB accepts connections

  $ PGPASSWORD=pass psql -h 127.0.0.1 -p 5432 -U my_user -d local_db -c "select 1;"

› 1. Yes, proceed (y)
  2. Yes, and don't ask again for commands that start with `PGPASSWORD=pass psql -h 127.0.0.1 -p 5432 -U my_user -d local_db -c "select 1;"` (p)
  3. No, and tell Codex what to do differently (esc)

it's getting the wrong prefix selection. I would like to set everything before the first quotes to be auto-approved. @zhao-oai was this intentional? (p) is also harder to reach than (a) (it was "always approve this command (a)" before)

Thanks for the work on the rules feature! I think this issue can be closed - no config.toml changes are needed since prefix-based auto-approval already works via rules files.

Here's docs for future people who stumble upon this issue thread:

How to use prefix-based auto-approval today

The feature exists via rules files (landed in PR #6641, refined in #7888 and #8453).

Setup

Place .rules files in one of:

• ~/.codex/rules/*.rules (global)
• .codex/rules/*.rules (project-level)

Example rule

prefix_rule(
  pattern = ["git", "add"],
  decision = "allow",
)

This auto-approves any command starting with git add (e.g., git add ., git add -p file.txt).

How matching works

• Exact token prefix only – no regex or wildcards
• Each element in pattern must match a command argument in order
• Trailing arguments after the prefix are allowed
• Use codex execpolicy check --rules <path> <command> to test rules

Common patterns

# Git operations
prefix_rule(pattern = ["git", "add"], decision = "allow")
prefix_rule(pattern = ["git", "commit"], decision = "allow")
prefix_rule(pattern = ["git", "status"], decision = "allow")

# Package managers (could write data outside cwd)
prefix_rule(pattern = ["npm", "list"], decision = "allow")
prefix_rule(pattern = ["cargo", "tree"], decision = "allow")

# Test runners (write cache outside cwd)
prefix_rule(pattern = ["cargo", "test"], decision = "allow")
prefix_rule(pattern = ["go", "test", "./..."], decision = "allow")

# Database queries (stop at -c to allow any query) (oftentimes need networking)
prefix_rule(
  pattern = ["env", "PGPASSWORD=dev_pass", "psql", "-h", "127.0.0.1", "-p", "5432", 
             "-U", "dev_user", "-d", "dev_db", "-c"],
  decision = "allow",
)

Parser caveat: environment variables

Bare env assignments like PGPASSWORD=... psql ... are parsed as a single token, not separate arguments. This causes prefix matching to capture the whole command as one "word".

Workaround 1: Use env explicitly

prefix_rule(
  pattern = ["env", "PGPASSWORD=dev_pass", "psql", "-h", "127.0.0.1", "-p", "5432",
             "-U", "dev_user", "-d", "dev_db", "-c"],
  decision = "allow",
)

Workaround 2: Set environment in config, approve command only

# ~/.codex/config.toml
[shell_environment_policy]
set = { PGPASSWORD = "dev_pass" }

# ~/.codex/rules/postgres.rules
prefix_rule(
  pattern = ["psql", "-h", "127.0.0.1", "-p", "5432", "-U", "dev_user", "-d", "dev_db", "-c"],
  decision = "allow",
)

Testing your rules

# Check if a command would be allowed
codex execpolicy check --rules ~/.codex/rules/default.rules -- git add .

# Check with multiple rule files
codex execpolicy check \
  --rules ~/.codex/rules/git.rules \
  --rules ~/.codex/rules/npm.rules \
  -- npm list --depth=0

Related issues

• Original request: #1260 (this one)
• Implementation: #6641, #7888, #8453
• TUI prefix option: #7033

Notes on my proposal in #9006

My simpler config-based approach ([execpolicy].auto_allow_prefixes = [...]) was proposed but not merged due to the above. Use the rules files.

Thank you for your time.