.

Author: zhao-oai

codex-rs/core/src/codex.rs

@@ -862,6 +862,10 @@ impl Session {
         .await
     }
 
+    /// Adds a prefix rule to the exec policy
+    ///
+    /// This mutates the in-memory execpolicy so the current conversation can use the new
+    /// prefix and persists the change in default.execpolicy so new conversations will also allow the new prefix.
     pub(crate) async fn persist_command_allow_prefix(
         &self,
         prefix: &[String],

codex-rs/core/src/exec_policy.rs

@@ -16,12 +16,13 @@ use codex_protocol::protocol::SandboxPolicy;
 use thiserror::Error;
 use tokio::fs;
 use tokio::sync::RwLock;
+use tokio::task::spawn_blocking;
 
 use crate::bash::parse_shell_lc_plain_commands;
 use crate::features::Feature;
 use crate::features::Features;
 use crate::sandboxing::SandboxPermissions;
-use crate::tools::sandboxing::ApprovalRequirement;
+use crate::tools::sandboxing::ExecApprovalRequirement;
 
 const FORBIDDEN_REASON: &str = "execpolicy forbids this command";
 const PROMPT_REASON: &str = "execpolicy requires approval for this command";
@@ -55,6 +56,9 @@ pub enum ExecPolicyUpdateError {
     #[error("failed to update execpolicy file {path}: {source}")]
     AppendRule { path: PathBuf, source: AmendError },
 
+    #[error("failed to join blocking execpolicy update task: {source}")]
+    JoinBlockingTask { source: tokio::task::JoinError },
+
     #[error("failed to update in-memory execpolicy: {source}")]
     AddRule {
         #[from]
@@ -114,41 +118,47 @@ pub(crate) async fn append_allow_prefix_rule_and_update(
     prefix: &[String],
 ) -> Result<(), ExecPolicyUpdateError> {
     let policy_path = default_policy_path(codex_home);
-    blocking_append_allow_prefix_rule(&policy_path, prefix).map_err(|source| {
-        ExecPolicyUpdateError::AppendRule {
-            path: policy_path,
-            source,
-        }
+    let prefix = prefix.to_vec();
+    spawn_blocking({
+        let policy_path = policy_path.clone();
+        let prefix = prefix.clone();
+        move || blocking_append_allow_prefix_rule(&policy_path, &prefix)
+    })
+    .await
+    .map_err(|source| ExecPolicyUpdateError::JoinBlockingTask { source })?
+    .map_err(|source| ExecPolicyUpdateError::AppendRule {
+        path: policy_path,
+        source,
     })?;
 
     current_policy
         .write()
         .await
-        .add_prefix_rule(prefix, Decision::Allow)?;
+        .add_prefix_rule(&prefix, Decision::Allow)?;
 
     Ok(())
 }
 
 fn requirement_from_decision(
     decision: Decision,
     approval_policy: AskForApproval,
-) -> ApprovalRequirement {
+) -> ExecApprovalRequirement {
     match decision {
-        Decision::Forbidden => ApprovalRequirement::Forbidden {
+        Decision::Forbidden => ExecApprovalRequirement::Forbidden {
             reason: FORBIDDEN_REASON.to_string(),
         },
         Decision::Prompt => {
             let reason = PROMPT_REASON.to_string();
             if matches!(approval_policy, AskForApproval::Never) {
-                ApprovalRequirement::Forbidden { reason }
+                ExecApprovalRequirement::Forbidden { reason }
             } else {
-                ApprovalRequirement::NeedsApproval {
+                ExecApprovalRequirement::NeedsApproval {
                     reason: Some(reason),
                     allow_prefix: None,
                 }
             }
         }
-        Decision::Allow => ApprovalRequirement::Skip {
+        Decision::Allow => ExecApprovalRequirement::Skip {
             bypass_sandbox: true,
         },
     }
@@ -170,17 +180,16 @@ fn allow_prefix_if_applicable(
     }
 }
 
-pub(crate) async fn create_approval_requirement_for_command(
+pub(crate) async fn create_exec_approval_requirement_for_command(
     exec_policy: &Arc<RwLock<Policy>>,
     features: &Features,
     command: &[String],
     approval_policy: AskForApproval,
     sandbox_policy: &SandboxPolicy,
     sandbox_permissions: SandboxPermissions,
-) -> ApprovalRequirement {
+) -> ExecApprovalRequirement {
     let commands = parse_shell_lc_plain_commands(command).unwrap_or_else(|| vec![command.to_vec()]);
-    let policy = exec_policy.read().await;
-    let evaluation = policy.check_multiple(commands.iter());
+    let evaluation = exec_policy.read().await.check_multiple(commands.iter());
 
     match evaluation {
         Evaluation::Match { decision, .. } => requirement_from_decision(decision, approval_policy),
@@ -191,12 +200,12 @@ pub(crate) async fn create_approval_requirement_for_command(
                 command,
                 sandbox_permissions,
             ) {
-                ApprovalRequirement::NeedsApproval {
+                ExecApprovalRequirement::NeedsApproval {
                     reason: None,
                     allow_prefix: allow_prefix_if_applicable(&commands, features),
                 }
             } else {
-                ApprovalRequirement::Skip {
+                ExecApprovalRequirement::Skip {
                     bypass_sandbox: false,
                 }
             }
@@ -349,7 +358,7 @@ prefix_rule(pattern=["rm"], decision="forbidden")
             "rm -rf /tmp".to_string(),
         ];
 
-        let requirement = create_approval_requirement_for_command(
+        let requirement = create_exec_approval_requirement_for_command(
             &policy,
             &Features::with_defaults(),
             &forbidden_script,
@@ -361,14 +370,14 @@ prefix_rule(pattern=["rm"], decision="forbidden")
 
         assert_eq!(
             requirement,
-            ApprovalRequirement::Forbidden {
+            ExecApprovalRequirement::Forbidden {
                 reason: FORBIDDEN_REASON.to_string()
             }
         );
     }
 
     #[tokio::test]
-    async fn approval_requirement_prefers_execpolicy_match() {
+    async fn exec_approval_requirement_prefers_execpolicy_match() {
         let policy_src = r#"prefix_rule(pattern=["rm"], decision="prompt")"#;
         let mut parser = PolicyParser::new();
         parser
@@ -377,7 +386,7 @@ prefix_rule(pattern=["rm"], decision="forbidden")
         let policy = Arc::new(RwLock::new(parser.build()));
         let command = vec!["rm".to_string()];
 
-        let requirement = create_approval_requirement_for_command(
+        let requirement = create_exec_approval_requirement_for_command(
             &policy,
             &Features::with_defaults(),
             &command,
@@ -389,15 +398,15 @@ prefix_rule(pattern=["rm"], decision="forbidden")
 
         assert_eq!(
             requirement,
-            ApprovalRequirement::NeedsApproval {
+            ExecApprovalRequirement::NeedsApproval {
                 reason: Some(PROMPT_REASON.to_string()),
                 allow_prefix: None,
             }
         );
     }
 
     #[tokio::test]
-    async fn approval_requirement_respects_approval_policy() {
+    async fn exec_approval_requirement_respects_approval_policy() {
         let policy_src = r#"prefix_rule(pattern=["rm"], decision="prompt")"#;
         let mut parser = PolicyParser::new();
         parser
@@ -406,7 +415,7 @@ prefix_rule(pattern=["rm"], decision="forbidden")
         let policy = Arc::new(RwLock::new(parser.build()));
         let command = vec!["rm".to_string()];
 
-        let requirement = create_approval_requirement_for_command(
+        let requirement = create_exec_approval_requirement_for_command(
             &policy,
             &Features::with_defaults(),
             &command,
@@ -418,18 +427,18 @@ prefix_rule(pattern=["rm"], decision="forbidden")
 
         assert_eq!(
             requirement,
-            ApprovalRequirement::Forbidden {
+            ExecApprovalRequirement::Forbidden {
                 reason: PROMPT_REASON.to_string()
             }
         );
     }
 
     #[tokio::test]
-    async fn approval_requirement_falls_back_to_heuristics() {
-        let command = vec!["python".to_string()];
+    async fn exec_approval_requirement_falls_back_to_heuristics() {
+        let command = vec!["cargo".to_string(), "build".to_string()];
 
         let empty_policy = Arc::new(RwLock::new(Policy::empty()));
-        let requirement = create_approval_requirement_for_command(
+        let requirement = create_exec_approval_requirement_for_command(
             &empty_policy,
             &Features::with_defaults(),
             &command,
@@ -441,7 +450,7 @@ prefix_rule(pattern=["rm"], decision="forbidden")
 
         assert_eq!(
             requirement,
-            ApprovalRequirement::NeedsApproval {
+            ExecApprovalRequirement::NeedsApproval {
                 reason: None,
                 allow_prefix: Some(command)
             }
@@ -499,10 +508,10 @@ prefix_rule(pattern=["rm"], decision="forbidden")
 
     #[tokio::test]
     async fn allow_prefix_is_present_for_single_command_without_policy_match() {
-        let command = vec!["python".to_string()];
+        let command = vec!["cargo".to_string(), "build".to_string()];
 
         let empty_policy = Arc::new(RwLock::new(Policy::empty()));
-        let requirement = create_approval_requirement_for_command(
+        let requirement = create_exec_approval_requirement_for_command(
             &empty_policy,
             &Features::with_defaults(),
             &command,
@@ -514,7 +523,7 @@ prefix_rule(pattern=["rm"], decision="forbidden")
 
         assert_eq!(
             requirement,
-            ApprovalRequirement::NeedsApproval {
+            ExecApprovalRequirement::NeedsApproval {
                 reason: None,
                 allow_prefix: Some(command)
             }
@@ -523,12 +532,12 @@ prefix_rule(pattern=["rm"], decision="forbidden")
 
     #[tokio::test]
     async fn allow_prefix_is_disabled_when_execpolicy_feature_disabled() {
-        let command = vec!["python".to_string()];
+        let command = vec!["cargo".to_string(), "build".to_string()];
 
         let mut features = Features::with_defaults();
         features.disable(Feature::ExecPolicy);
 
-        let requirement = create_approval_requirement_for_command(
+        let requirement = create_exec_approval_requirement_for_command(
             &Arc::new(RwLock::new(Policy::empty())),
             &features,
             &command,
@@ -540,7 +549,7 @@ prefix_rule(pattern=["rm"], decision="forbidden")
 
         assert_eq!(
             requirement,
-            ApprovalRequirement::NeedsApproval {
+            ExecApprovalRequirement::NeedsApproval {
                 reason: None,
                 allow_prefix: None,
             }
@@ -557,7 +566,7 @@ prefix_rule(pattern=["rm"], decision="forbidden")
         let policy = Arc::new(RwLock::new(parser.build()));
         let command = vec!["rm".to_string()];
 
-        let requirement = create_approval_requirement_for_command(
+        let requirement = create_exec_approval_requirement_for_command(
             &policy,
             &Features::with_defaults(),
             &command,
@@ -569,7 +578,7 @@ prefix_rule(pattern=["rm"], decision="forbidden")
 
         assert_eq!(
             requirement,
-            ApprovalRequirement::NeedsApproval {
+            ExecApprovalRequirement::NeedsApproval {
                 reason: Some(PROMPT_REASON.to_string()),
                 allow_prefix: None,
             }
@@ -581,9 +590,9 @@ prefix_rule(pattern=["rm"], decision="forbidden")
         let command = vec![
             "bash".to_string(),
             "-lc".to_string(),
-            "python && echo ok".to_string(),
+            "cargo build && echo ok".to_string(),
         ];
-        let requirement = create_approval_requirement_for_command(
+        let requirement = create_exec_approval_requirement_for_command(
             &Arc::new(RwLock::new(Policy::empty())),
             &Features::with_defaults(),
             &command,
@@ -595,7 +604,7 @@ prefix_rule(pattern=["rm"], decision="forbidden")
 
         assert_eq!(
             requirement,
-            ApprovalRequirement::NeedsApproval {
+            ExecApprovalRequirement::NeedsApproval {
                 reason: None,
                 allow_prefix: None,
             }

codex-rs/core/src/tools/handlers/shell.rs

@@ -6,7 +6,7 @@ use std::sync::Arc;
 use crate::codex::TurnContext;
 use crate::exec::ExecParams;
 use crate::exec_env::create_env;
-use crate::exec_policy::create_approval_requirement_for_command;
+use crate::exec_policy::create_exec_approval_requirement_for_command;
 use crate::function_tool::FunctionCallError;
 use crate::is_safe_command::is_known_safe_command;
 use crate::protocol::ExecCommandSource;
@@ -232,7 +232,7 @@ impl ShellHandler {
         emitter.begin(event_ctx).await;
 
         let features = session.features().await;
-        let approval_requirement = create_approval_requirement_for_command(
+        let exec_approval_requirement = create_exec_approval_requirement_for_command(
             &turn.exec_policy,
             &features,
             &exec_params.command,
@@ -241,15 +241,15 @@ impl ShellHandler {
             SandboxPermissions::from(exec_params.with_escalated_permissions.unwrap_or(false)),
         )
         .await;
-    
+
         let req = ShellRequest {
             command: exec_params.command.clone(),
             cwd: exec_params.cwd.clone(),
             timeout_ms: exec_params.expiration.timeout_ms(),
             env: exec_params.env.clone(),
             with_escalated_permissions: exec_params.with_escalated_permissions,
             justification: exec_params.justification.clone(),
-            approval_requirement,
+            exec_approval_requirement,
         };
         let mut orchestrator = ToolOrchestrator::new();
         let mut runtime = ShellRuntime::new();

codex-rs/core/src/tools/orchestrator.rs

@@ -11,14 +11,14 @@ use crate::error::get_error_message_ui;
 use crate::exec::ExecToolCallOutput;
 use crate::sandboxing::SandboxManager;
 use crate::tools::sandboxing::ApprovalCtx;
-use crate::tools::sandboxing::ApprovalRequirement;
+use crate::tools::sandboxing::ExecApprovalRequirement;
 use crate::tools::sandboxing::ProvidesSandboxRetryData;
 use crate::tools::sandboxing::SandboxAttempt;
 use crate::tools::sandboxing::SandboxOverride;
 use crate::tools::sandboxing::ToolCtx;
 use crate::tools::sandboxing::ToolError;
 use crate::tools::sandboxing::ToolRuntime;
-use crate::tools::sandboxing::default_approval_requirement;
+use crate::tools::sandboxing::default_exec_approval_requirement;
 use codex_protocol::protocol::AskForApproval;
 use codex_protocol::protocol::ReviewDecision;
 
@@ -54,17 +54,17 @@ impl ToolOrchestrator {
         // 1) Approval
         let mut already_approved = false;
 
-        let requirement = tool.approval_requirement(req).unwrap_or_else(|| {
-            default_approval_requirement(approval_policy, &turn_ctx.sandbox_policy)
+        let requirement = tool.exec_approval_requirement(req).unwrap_or_else(|| {
+            default_exec_approval_requirement(approval_policy, &turn_ctx.sandbox_policy)
         });
         match requirement {
-            ApprovalRequirement::Skip { .. } => {
+            ExecApprovalRequirement::Skip { .. } => {
                 otel.tool_decision(otel_tn, otel_ci, &ReviewDecision::Approved, otel_cfg);
             }
-            ApprovalRequirement::Forbidden { reason } => {
+            ExecApprovalRequirement::Forbidden { reason } => {
                 return Err(ToolError::Rejected(reason));
             }
-            ApprovalRequirement::NeedsApproval { reason, .. } => {
+            ExecApprovalRequirement::NeedsApproval { reason, .. } => {
                 let mut risk = None;
 
                 if let Some(metadata) = req.sandbox_retry_data() {