Windows approval rules do not generalize for PowerShell-wrapped gh issue --json commands

On Windows Codex Desktop, approval rules/exclusions appear not to generalize correctly for PowerShell-wrapped GitHub CLI issue commands, especially when using gh's comma-separated --json field list.

Observed in Codex Desktop app version 26.519.5221.0, active CLI/app-server path using codex-cli 0.133.0-alpha.1.

Setup:

• User rules include prefix_rule(pattern=["gh", "issue"], decision="allow").
• codex execpolicy check reports allow for gh issue view 137 --repo Alien-AV/gangster-game --json number,title,state,url.
• The project is trusted. I tested with both Default permissions and Custom config.toml.

Experiment:

1. gh issue in an escalated shell request succeeds after approval.
2. gh issue view runs without a new approval prompt, but fails at the gh level because no issue number was supplied.
3. gh issue view 137 and gh issue view 138 both run without a new approval prompt.
4. gh issue view 138 --repo Alien-AV/gangster-game runs without a new approval prompt.
5. gh issue view 138 --repo Alien-AV/gangster-game --json number runs without a new approval prompt.
6. gh issue view 138 --repo Alien-AV/gangster-game --json number,title,state,url asks for approval again.

This is surprising because the documented Rules page says plain shell words joined by safe operators should be split before rules are applied, and its own example includes gh pr view 7888 --json title,body,comments. The documented advanced-shell-feature exclusions mention redirection, substitutions, env vars, wildcards, and control flow, but not commas.

Relevant docs: https://developers.openai.com/codex/rules#shell-wrappers-and-compound-commands

Expected: a rule such as ["gh", "issue"] should cover PowerShell-wrapped gh issue commands regardless of comma-separated --json values, or the docs/UI should clarify why this form cannot be generalized.

Actual: the approval system appears to require an overly specific command string for the comma-separated --json form.