Permissions system doesn't support compound commands

What version of Codex CLI is running?

codex-cli 0.120.0

What subscription do you have?

The most expensive one

Which model were you using?

gpt-5.4

What platform is your computer?

Linux 6.17.0-14-generic x86_64 unknown

What terminal emulator and version are you using (if applicable)?

_No response_

What issue are you seeing?

The permission system doesn't support compound commands and it's not possible to prompt gpt-5.4 to not use them. Just add compound command support in codex or automate permission rejections back to model that instruct it to not use compound commands.

I've auto-approved simple commands such as git. Despite clear prompting in AGENTS.md to not run compound commands such as "git pull && git status", gpt-5.4 keeps running them. Even though git * is approved, the compound combination is not approved by the harness.

There's numerous simple fixes for this. If in a compound command all individual commands are approved, you could approve them. Or you could make it possible to auto-reject compound commands and to instruct the model to run them as separate, individual commands.

Right now the permissions system is unusable with the model. Please, just copy claude code's permission system verbatim.

What steps can reproduce the bug?

Uploaded thread: 019d8572-8c0e-7613-bac0-475dfb8f997d

What is the expected behavior?

Permissions system actually works for the model.

Additional information

_No response_