Codex keeps asking me to approve the same command

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #23393
• #24198

Powered by Codex Action

Solution: Codex #24199/#24198 — Windows Sandbox Approval Systemic Issues

Issue Summary

GitHub: openai/codex #24199 and #24198
Title: Windows sandbox approval rules don't generalize — same command repeatedly asks for approval; PowerShell wrapper commands not recognized
Labels: bug, windows-os, sandbox
Competition: Low (1 comment, no PRs)
Quote: $3,000-$5,000 (bundled fix)

Root Cause Analysis

Primary Root Cause: Command Normalization Failure on Windows

The sandbox approval system on Windows fails to recognize identical commands across multiple invocations because it compares commands at the raw string level rather than at the normalized/semantic level. This is particularly severe on Windows due to:

1. PowerShell Wrapper Indirection: Many commands on Windows are wrapped in PowerShell (powershell -Command ... or pwsh -Command ...), which the sandbox doesn't unpack before comparison.
2. Path Format Variations: Windows paths can be expressed in multiple equivalent forms (C:\path, C:/path, c:\path, \\?\C:\path, short names like C:\PROGRA~1).
3. Executable Resolution: python, python.exe, C:\Python39\python.exe, and py may all resolve to the same executable but are treated as different commands.
4. Case Sensitivity: Windows is case-insensitive, but the approval system may use case-sensitive string comparison.

Failure Chain

User runs: powershell -Command "python script.py"
  → Sandbox captures raw command string
  → No existing approval for "powershell -Command \"python script.py\""
  → Prompts user for approval
  → User approves
  → Approval stored with key: powershell -Command "python script.py"

Later, user runs: powershell -Command "python script.py"  (identical!)
  → Sandbox captures raw command string
  → Approval lookup uses key: powershell -Command "python script.py"
  → Key mismatch due to:
    - Whitespace normalization difference
    - Quote character difference (" vs ")
    - PowerShell wrapper not unpacked
  → Re-prompts user (approval was never matched)

Root Cause Details

Issue #24199: PowerShell Wrapper Not Unpacked

When Codex executes commands on Windows, it often wraps them in PowerShell:

powershell -NoProfile -Command "<actual_command>"

The sandbox captures the outer powershell command but doesn't extract and normalize the inner <actual_command>. This means:

• powershell -Command "dir" and powershell -Command "dir " (trailing space) are treated as different
• powershell -NoProfile -Command "dir" and powershell -Command "dir" are treated as different
• The inner command is never compared against the approval allowlist

Issue #24198: Same Command Repeatedly Asks for Approval

Even without PowerShell wrapping, the approval system fails to recognize identical commands because:

1. String Comparison vs. Semantic Comparison: The approval system uses exact string matching instead of semantic normalization.
2. No Canonicalization: Commands are not canonicalized before approval lookup.
3. Approval Key Includes Volatile Data: The approval key may include timestamps, PIDs, or other volatile data that changes between invocations.

Evidence Pattern

| Signal | Interpretation |
|--------|---------------|
| Same command re-prompts | Approval key mismatch — normalization failure |
| PowerShell commands always prompt | Wrapper not unpacked before comparison |
| Works on Linux, fails on Windows | Windows-specific path/command format variations |
| Different quote styles cause mismatch | Raw string comparison without normalization |

Proposed Fix

Fix 1: PowerShell-Aware Command Unpacking

File: codex-rs/core/src/sandbox/command_normalizer.rs

use std::path::Path;