Safe commands prompting for permission even in workspace and no way to set allowed commands to run in sandbox

What version of the Codex App are you using (From “About Codex” dialog)?

26.601.21317

What subscription do you have?

business

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

In Windows Codex App, built-in safe commands such as rg and read-only git status require approval unless added to default.rules. Adding them to default.rules allows them outside the sandbox, which bypasses filesystem confinement. Likewise if I approve a tool like node it will run outside the sandbox bypassing filesystem restrictions set in the permission profile (global config.toml) and I see no way of marking a tool as safe so that it can run without prompting for approval while still running in the sandbox to restrict out of workspace writes for example.

What steps can reproduce the bug?

Tell codex to try running any tool that is supposed to be treated as safe and is not listed in .rules files, like rg, pwd, git status, ... It fails without escalation and requires user approval. If you add them or any other tool to .rules then they can run anywhere as they are launched outside the sandbox which apparently is by design how .rules files work.

What is the expected behavior?

Default safe commands should run inside workspace without prompting and without escalation and even outside the workspace if permissions profile specifies filesystem read permission elsewhere. There should also be a way to approve a tool to always run without prompting but still runs sandboxed so permission profile filesystem restrictions are respected.

Additional information

_No response_