Execute user-issued bang commands without sandboxing #6013

AndrewNikolin · 2025-10-31T02:48:50Z

Current version of CLI fails to execute shell commands issued by user in a sandboxed environment (partially redacted example here). This makes the experience not as streamlined as doing many of those requires switching to a different terminal session to execute

Ran git commit -m "Test committing"
  └ /opt/homebrew/Library/Homebrew/cmd/shellenv.sh: line 18: /bin/ps: Operation not permitted
    fatal: Unable to create '/Users/andriinikolin/Git/****/.git/index.lock': Operation not permitted

Proposed change elevates bang-commands to skip sandboxing, so commands issued by user can be executed with full privileges

Used CLI itself while working on this, have basic knowledge of Rust fundamentals

…licy

github-actions · 2025-10-31T02:48:59Z

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

AndrewNikolin · 2025-10-31T02:49:15Z

I have read the CLA Document and I hereby sign the CLA

AndrewNikolin · 2025-10-31T02:49:29Z

recheck

Copilot

Pull Request Overview

This PR modifies user-initiated shell commands to bypass approval requirements and sandbox restrictions. The changes introduce an is_user_shell_command flag throughout the shell execution pipeline and set escalated permissions for all user shell commands.

Added is_user_shell_command flag to track user-initiated shell commands
User shell commands now run with escalated permissions and bypass approval checks
Added tests verifying user commands execute under various approval and sandbox policies

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
codex-rs/core/tests/suite/user_shell_cmd.rs	Added tests for user shell commands under different approval and sandbox policies
codex-rs/core/src/tools/runtimes/shell.rs	Modified approval logic to skip approval for user shell commands
codex-rs/core/src/tools/handlers/shell.rs	Extended escalation guard to exempt user shell commands
codex-rs/core/src/tasks/user_shell.rs	Set escalated permissions and justification for user shell commands

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-10-31T02:50:36Z

codex-rs/core/src/tasks/user_shell.rs

            timeout_ms: None,
-            with_escalated_permissions: None,
-            justification: None,
+            with_escalated_permissions: Some(true),


Setting with_escalated_permissions: Some(true) for all user-requested shell commands could be a security risk. User commands inherit escalated permissions without any validation, potentially allowing privilege escalation attacks. Consider requiring explicit user confirmation for commands that need escalation, or evaluate whether escalation is actually needed based on the command content.

Suggested change

with_escalated_permissions: Some(true),

with_escalated_permissions: Some(false),

Copilot · 2025-10-31T02:50:36Z

codex-rs/core/src/tools/runtimes/shell.rs

        sandbox_policy: &SandboxPolicy,
    ) -> bool {
+        if req.is_user_shell_command {
+            return false;


Bypassing approval checks for all user shell commands in wants_initial_approval removes an important safety mechanism. Even user-initiated commands can be dangerous (e.g., rm -rf /). Consider still applying approval logic for dangerous commands or when running with escalated permissions, even for user shell commands.

Suggested change

return false;

// Only bypass approval for user shell commands that are not dangerous and do not request escalation.

let wants_escalation = req.with_escalated_permissions.unwrap_or(false);

if !wants_escalation && !command_might_be_dangerous(&req.command) {

return false;

}

// Otherwise, fall through to approval logic for dangerous/escalated user commands.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2025-10-31T02:51:22Z

codex-rs/core/src/tools/runtimes/shell.rs

        policy: AskForApproval,
        sandbox_policy: &SandboxPolicy,
    ) -> bool {
+        if req.is_user_shell_command {
+            return false;
+        }


Skipping approval for any local shell call

The new is_user_shell_command flag short‑circuits wants_initial_approval whenever it is set, but ShellHandler sets this flag to true for every ToolPayload::LocalShell, including model‑initiated local shell calls. As a result, dangerous local shell commands emitted by the model under AskForApproval::OnRequest or AskForApproval::UnlessTrusted no longer trigger an approval request at all; they now execute immediately (still sandboxed, but without the human approval that these policies are meant to enforce). This quietly disables user‑configured approval policies for the model’s local shell tool, which seems unintended and opens a security hole.

Useful? React with 👍 / 👎.

…iate user shell commands

AndrewNikolin · 2025-10-31T03:31:13Z

@codex review

chatgpt-codex-connector · 2025-10-31T03:35:05Z

Codex Review: Didn't find any major issues. 🎉

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

etraut-openai · 2025-11-01T00:10:39Z

Thanks for the proof-of-concept PR.

We're discussing this behavioral change internally.

AndrewNikolin added 4 commits October 30, 2025 22:04

Run user bang shell commands without sandbox approval

fc96c13

Skip guard for user-issued commands

9d4fb78

Test that shell-guard is skipped for user-issued shell commands

eb130da

Add test for user shell command creating directory under read-only po…

1435da7

…licy

Copilot AI review requested due to automatic review settings October 31, 2025 02:48

github-actions bot added a commit that referenced this pull request Oct 31, 2025

@AndrewNikolin has signed the CLA in #6013

1a0d906

Copilot AI reviewed Oct 31, 2025

View reviewed changes

chatgpt-codex-connector bot reviewed Oct 31, 2025

View reviewed changes

Add is_user_shell_command flag to LocalShell payload to different…

5d15259

…iate user shell commands

etraut-openai closed this Nov 1, 2025

github-actions bot locked and limited conversation to collaborators Nov 1, 2025

openai unlocked this conversation Nov 1, 2025

AndrewNikolin mentioned this pull request Nov 2, 2025

user shell commands should always run outside of sandbox #6058

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Execute user-issued bang commands without sandboxing #6013

Execute user-issued bang commands without sandboxing #6013

AndrewNikolin commented Oct 31, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Oct 31, 2025 •

edited

Loading

Uh oh!

AndrewNikolin commented Oct 31, 2025

Uh oh!

AndrewNikolin commented Oct 31, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Oct 31, 2025

Uh oh!

Copilot AI Oct 31, 2025

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

chatgpt-codex-connector bot Oct 31, 2025

Uh oh!

AndrewNikolin commented Oct 31, 2025

Uh oh!

chatgpt-codex-connector bot commented Oct 31, 2025

Uh oh!

etraut-openai commented Nov 1, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	with_escalated_permissions: Some(true),
	with_escalated_permissions: Some(false),

-            return false;
+            // Only bypass approval for user shell commands that are not dangerous and do not request escalation.
+            let wants_escalation = req.with_escalated_permissions.unwrap_or(false);
+            if !wants_escalation && !command_might_be_dangerous(&req.command) {
+                return false;
+            }
+            // Otherwise, fall through to approval logic for dangerous/escalated user commands.

Execute user-issued bang commands without sandboxing #6013

Execute user-issued bang commands without sandboxing #6013

Conversation

AndrewNikolin commented Oct 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Oct 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

AndrewNikolin commented Oct 31, 2025

Uh oh!

AndrewNikolin commented Oct 31, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Oct 31, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 31, 2025

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Oct 31, 2025

Choose a reason for hiding this comment

Uh oh!

AndrewNikolin commented Oct 31, 2025

Uh oh!

chatgpt-codex-connector bot commented Oct 31, 2025

Uh oh!

etraut-openai commented Nov 1, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

AndrewNikolin commented Oct 31, 2025 •

edited

Loading

github-actions bot commented Oct 31, 2025 •

edited

Loading