[codex core] Require approval for fake shell escalation

[evawong-oai]

Summary

1. Require approval when a known safe command also requests sandbox expansion.
2. Keep the shell executable identity in approval cache keys for Bash and PowerShell wrappers.
3. Treat a model supplied exec command shell as mutating, then cover the fake shell path with an integration regression.

Why

CLI 8725 reported that a fake bash wrapper could hide behind an inner ls call and run outside the sandbox with no user approval. This PR keeps command safety separate from permission safety.

Validation

1. Ran formatter.
2. Ran the codex core fake shell integration regression.
3. Ran the focused codex core policy, canonicalization, and mutating shell tests.
4. Ran the codex core clippy fix check.
5. AWS macOS VM reproduced current main and passed the patched worktree. Current main created the proof file. The patched worktree created no proof file.

Tickets

CLI 8725

[chatgpt-codex-connector]

💡 Codex Review

codex/codex-rs/core/src/exec_policy.rs

Lines 345 to 349 in a8b6f3e

	proposed_execpolicy_amendment: requested_amendment.or_else(|| {
	if auto_amendment_allowed {
	try_derive_execpolicy_amendment_for_prompt_rules(
	&evaluation.matched_rules,
	)

Omit unsafe amendments for shell overrides

The fake-shell path now prompts, but it still proposes an execpolicy amendment for only the parsed inner command (for /tmp/.../bash -lc ls, ['ls']). If the user accepts that amendment, it is persisted as an allow rule, so the same fake shell with RequireEscalated later becomes an explicit policy allow and bypasses the sandbox without another approval. Suppress amendments for sandbox overrides/model shells or include the wrapper identity.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".