Support per-command sandbox exclusion rule without bypass permission or review

What variant of Codex are you using?

CLI

What feature would you like to see?

I would like Codex to support a per-command sandbox exclusion mechanism, similar to Claude Code's sandbox.exclude configuration field.

The desired behavior is that when the original command requested by the agent matches a configured pattern, Codex automatically runs that command outside the sandbox, even if the agent requested a normal sandboxed execution.

This is not the same as the existing exec policy allow decision. An exclusion rule should only decide sandbox placement. It must not grant permission, bypass review, or override any existing approval, deny, or prompt policy. If a matching command would otherwise require approval, it should still require approval. If another rule forbids it, it should still be forbidden.

In other words, this feature should separate "where the command runs" from "whether the command is allowed to run."

For example:

sandbox_exclude = [
  ["gh"],
  ["xcodebuild"],
]

Or as part of the existing rule system:

prefix_rule(
    pattern = ["gh"],
    decision = "prompt",
    sandbox = "outside",
)

Use case: tools such as gh need access to normal user auth state, for example ~/.config/gh/hosts.yml, which may intentionally not be exposed inside the sandbox. I want gh to run outside the sandbox so it can access its normal credentials, but I do not want to allow gh automatically or remove the approval prompt. This is specifically about forcing the matching command out of the sandbox while preserving the existing permission and review model.

Additional information

_No response_