On native Windows, external CLI commands are always wrapped by PowerShell, making permission rules hard to match reliably

Problem

When using Codex CLI on native Windows, external CLI commands appear to be wrapped and executed through PowerShell rather than being treated as direct command/argv invocations.

For example, I would expect a command like this to be recognized in a direct form:

["agent-browser", "open", "https://example.com"]

But in practice, execution appears closer to:

pwsh.exe -Command "agent-browser open https://example.com ..."

This makes permission rules, prefix matching, and command recognition much less reliable on Windows, especially for tools like agent-browser that are already standalone CLIs.

---

Current issue

1. External CLI commands on native Windows are generally wrapped inside PowerShell.
2. The rules system often sees pwsh.exe -Command "..." instead of the original external command and its arguments.
3. This makes it difficult to configure tools like agent-browser as reliably default-allowed via prefix rules.
4. Matching behavior may vary depending on arguments, URLs, or chained command forms, which reduces predictability.

---

Expected behavior

I would like Codex to provide more stable and predictable execution and rule-matching behavior for external CLI commands on native Windows.

From a user perspective, the expectation is:

1. External CLI commands should be recognized as close to their original command form as possible;
2. Permission rules should be able to reliably match the actual tool prefix users intend to allow;
3. Standalone CLIs such as agent-browser should be easier to configure as default-allowed without being affected by PowerShell wrapping behavior.

---

Codex information

• Codex CLI version: 0.116.0
• Platform: native Windows
• Shell: PowerShell / pwsh
• Approval mode: on-request
• Sandbox mode: workspace-write

---

Additional context

This mainly affects external CLI tool execution and permission rule matching on native Windows. The problem becomes especially visible when trying to default-allow specific command-line tools.