Codex in PowerShell should handle a prefix for a command correctly

Open 💬 7 comments Opened Dec 24, 2025 by ScottArbeit

What version of Codex is running?

codex-cli 0.77.0

What subscription do you have?

ChatGPT Pro

Which model were you using?

gpt-5.2-codex

What platform is your computer?

Microsoft Windows NT 10.0.26220.0 x64

What issue are you seeing?

I have to approve every form of "dotnet" command in PowerShell; I want to be able to approve all commands that start with "dotnet" in PowerShell, but the rules checking isn't actually a "prefix" check, it's a full-string check.

Here's an example rule (that I manually created) from my default.rules file:

prefix_rule(pattern=["C:\\Program Files\\PowerShell\\7\\pwsh.exe", "-Command", "dotnet build"], decision="allow")

That rule _should_ allow any command that starts with "dotnet build" to be approved, but that's not what Codex is doing.

What steps can reproduce the bug?

Uploaded thread: 019b51e5-05a6-7b60-a2a7-47f3788b68a1

What is the expected behavior?

I want to be able to approve all commands that start with "dotnet" in PowerShell, but the StarLark rules checking isn't actually a "prefix" check, it's a full-string check.

Additional information

The instructions in this issue template for Windows users to gather the version information should be $([Environment]::OSVersion | ForEach-Object VersionString) + ' ' + $(if ([Environment]::Is64BitOperatingSystem) { "x64" } else { "x86" }). Notice the + ' ' + added between the two $() expressions.

View original on GitHub ↗

7 Comments

arthur-st · 5 months ago

Can confirm this behavior with Codex v0.98.0 and PowerShell 7.5.4. OS build 26100.7462.

GitMurf · 4 months ago

This is killing me! I am using the Windows Sandbox and it needs to escalate privileges for commands for tools like “agent-browser” but as the OP said, I can’t just use prefix with agent-browser or even “agent-browser snapshot” as it must be exact match like “agent-browser snapshot -i”.

I believe it’s because it is invoking with prefix params like [“powershell_path", "-Command", “the actual cmd to run”] and the way it works doesn’t allow “the actual cmd to run” to match just a prefix as it requires the full command.

I am thinking maybe something to do with the third param or something because if I just do [“powershell_path", "-Command"] that works as a “prefix” as it let’s everything bypass the sandbox elevated privileges and approves all commands.

Examples

Here are some entries that get added to the default.rules when you ask it to "always approve" in the Codex App GUI:

prefix_rule(pattern=["C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "-Command", "agent-browser open http://localhost:3000"], decision="allow")
prefix_rule(pattern=["C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "-Command", "agent-browser click '@e17'"], decision="allow")
prefix_rule(pattern=["C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "-Command", "agent-browser snapshot -i"], decision="allow")

The main problem is things like the agent-browser click commands because they are going to have a specific element reference to click and unless you add every single potential name (e.g., @e17 etc.) then you are going to constantly have to approve the commands.

My expectation is that the below should work as a "prefix" to allow anything after agent-browser click, but it does not work.

prefix_rule(pattern=["C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "-Command", "agent-browser click"], decision="allow")

And yes I have tried all the different variations like separating each word as an array arg like this:

prefix_rule(pattern=["C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "-Command", "agent-browser", "click"], decision="allow")

bratter · 4 months ago

Concur that this is not the ideal behavior!

msg7086 · 3 months ago

Hope this get resolved soon and I don't have to sit there and keep clicking allow for git add and git commit.

petitchamp · 2 months ago

I am also facing this problem. codex keeps asking me for approval. Still no fix ?

Message00 · 2 months ago

Coming from half a year later.
It is genuinely hard to believe that this very basic design issue, which has a significant negative impact on the user experience, has seen no progress at all in half a year.
I have already seen a number of similar issues, and none of them has had any substantive progress — not even a viable workaround.
It is difficult to understand how such a poor user experience can exist in something being built as the absolute core of OpenAI’s product.

srcejon · 2 months ago

@codex can you vibe a fix for us?