Exec Rules do not effectively capture pipelines

What version of Codex is running?

v0.79.0

What subscription do you have?

Pro

Which model were you using?

gpt-5.2-codex

What platform is your computer?

Linux 6.6.87.2-microsoft-standard-WSL2 x86_64 unknown

What issue are you seeing?

Codex cannot reliably allow-list commands that include pipelines.

Because of the way the tool harness works, it is pretty much mandatory to pipe any command with inspectable output through tee so the model can inspect the output. (I've added set -o pipefail and a trap timeout to a custom bashprofile so the model no longer needs to add these itsself).

If Codex runs make lint 2>&1 | tee /tmp/foo-lint.log, the only allow-listing is to allow make lint 2>&1 | tee /tmp/foo-lint.log in full.

This is allow listed as:

prefix_rule(pattern=["/bin/bash", "-lc", "make lint 2>&1 | tee /tmp/foo-lint.log"], decision="allow")

This means that if the model wants to tee to any files other file in /tmp, the command needs to be allow-listed again, and the various permutations clog up the allow list.

What steps can reproduce the bug?

Ask the model to run: make lint 2>&1 | tee /tmp/foo-lint.log. Add the command to the allow list. Inspect "~/.codex/rules/default.rules"

What is the expected behavior?

make lint and tee /tmp/foo-lint.log should be allow-listed separately at the very least.

Additional information

This wouldn't be such a problem if the model was allowed inspect any part of the command output itself rather than only being shown a short extract of the output.