Allow user to create rules with improved Starlark support

What variant of Codex are you using?

CLI

What feature would you like to see?

Currently the rules only support prefix_rule which is very limiting because it only matches the whole literal. There were multiple issues before and the solution would be to improve the rules engine (say, https://github.com/openai/codex/issues/11298, https://github.com/openai/codex/issues/8537, https://github.com/openai/codex/issues/13175 and probably more)

Personally, I am using codex to handle some ops command calls. And in lot of cases (>80% of the time), the commands are just differed from each other a little bit. Let's say, cat xxx | head -5 and cat xxx | head -6. However, due to how the prefix_rule is implemented, codex will ask for approval for each of these variants.

<img width="1239" height="203" alt="Image" src="https://github.com/user-attachments/assets/eb397e1c-90d6-43dc-bd2b-85d0737dfb3e" />

( I need to approve for different file and message each time :-( )

For projects that requires mixed use of kubectl and bash, it is very typical for user to review and approve 5-10 very similar commands for each message that the user sends. The non-stop approval steps are actually not safe (or dangerous) because people will get tired and approve something that should not be approved.

Since the rules are using Starlark syntax. I would propose to create another kind of rule, called general_rule(), which accepts a custom Starlark function to approve / reject. For example,

def my_rules(args):
  return args[0] == "super-cli"

def is_inline_shell_script(func):
  def _inner(args):
    return args[0] in ("bash", "zsh") and args[1] == "-c" and func(args[2:])
  return _inner

general_rule(predicate=my_rules, decision="allow")
general_rule(predicate=is_inline_shell_script(my_rules), decision="allow")

This can allow user to leverage the community (or AI) to build better rule handling system. Let's say, people can implement rules to handle && and || shell conditions - by implementing a shell script parser and intersection of nested rules.

Additional information

_No response_