Windows PowerShell runtime approvals ignore execpolicy prefix_rule for external executables

Description

On Windows with PowerShell, .codex/rules/default.rules / ~/.codex/rules/default.rules prefix rules validated by codex execpolicy check do not consistently suppress runtime approval prompts for external executables.

The runtime approval path appears to match or persist the outer PowerShell command / rendered command string instead of consistently applying the documented inner-command prefix_rule matching.

Rules example

prefix_rule(pattern=["npm", "test"], decision="allow")
prefix_rule(pattern=["npm", "run", "build"], decision="allow")
prefix_rule(pattern=["node", "--test"], decision="allow")
prefix_rule(pattern=["git", "config", "--get"], decision="allow")
prefix_rule(pattern=["git", "config", "--global", "--get"], decision="allow")
prefix_rule(pattern=["git", "config", "--list"], decision="allow")
prefix_rule(pattern=["git", "config", "--global", "--list"], decision="allow")

Expected behavior

After restarting Codex, commands matching those prefixes should not prompt again.

Examples:

npm test
npm run build
node --test --version
git config --list
git config --get user.name

Actual behavior

Runtime shell execution can still ask for approval for commands covered by those rules, including:

npm test
npm run build
node --test --version
git config --list
git config --get user.name

The approval UI offered overly specific persisted prefixes such as:

node --test --version
git config --get user.name
git config --global --get user.name

When persisted from the prompt, rules also appeared to be saved in wrapper form involving PowerShell. For example, after approving npm test, the persisted line in default.rules is shaped like:

prefix_rule(pattern=["C:\\Program Files\\PowerShell\\7\\pwsh.exe", "-NoProfile", "-Command", "npm test"], decision="allow")

instead of the documented inner-command form:

prefix_rule(pattern=["npm", "test"], decision="allow")

Evidence

codex execpolicy check reports decision: "allow" for the same rules, but runtime shell execution can still ask for approval. This suggests that codex execpolicy check and the runtime approval path for Windows/PowerShell shell commands may not be using the same matching mechanism.

Environment

• OS: Microsoft Windows NT 10.0.26200.0
• Shell: PowerShell 7.6.1
• Codex version: codex-cli 0.128.0