execpolicy: support scoped wildcards for approved swift test commands with output redirection

What issue are you seeing?

An existing swift test allow rule stops covering the command when Codex adds ordinary output redirection (> logfile 2>&1). The user must approve each variation of the full shell script, even though they have already authorized Swift tests.

The missing functionality is a reusable, Swift-specific wildcard/pattern allowance for varying test arguments and log filenames in redirected commands. Exact script rules are too brittle for normal development.

Environment

• Installed CLI: codex-cli 0.154.0
• macOS 26.6.2, zsh
• Observed during a Codex workspace session; independently checked with codex execpolicy check
• Workspace filesystem restrictions and approval_policy = "on-request"
• Existing rule: prefix_rule(pattern=["swift", "test"], decision="allow")

What steps can reproduce the bug?

1. Add the above Swift test rule to ~/.codex/rules/default.rules and load it in Codex.
2. Run swift test --filter SomeTests. The command matches the existing allowance.
3. Have Codex capture output with:

   swift test --filter SomeTests > /private/tmp/swift-review.log 2>&1
   

4. Observe a new approval prompt for the redirected invocation.
5. Save an allowance for the complete shell script.
6. Change the filter or log filename. The exact script allowance no longer covers it.

Policy-check evidence from this session (paths/test names below generalized):

codex execpolicy check --rules ~/.codex/rules/default.rules --pretty -- \
  swift test --filter SomeTests

Returns a matching ["swift", "test"] rule and "decision": "allow".

codex execpolicy check --rules ~/.codex/rules/default.rules --pretty -- \
  /bin/zsh -lc 'swift test > /private/tmp/swift-review.log 2>&1'

Returns {"matchedRules": []}.

An already-saved exact rule containing a different complete /bin/zsh -lc 'swift test > ... 2>&1' script was also checked and returned "decision": "allow". This confirms that exact script approval works, but does not generalize.

What is the expected behavior?

Provide a supported wildcard/pattern mechanism, or equivalent structured shell-command matching, that lets a user authorize this family once:

swift test > /private/tmp/swift-tests.log 2>&1
swift test --filter SomeTests > /private/tmp/swift-review-1.log 2>&1
swift test --filter OtherTests > /private/tmp/swift-review-2.log 2>&1
swift test --enable-code-coverage > /private/tmp/swift-coverage.log 2>&1

The allowance should support variable test arguments and an explicit glob for permitted output paths, while remaining scoped to the approved executable/subcommand and redirection operations. It should not require a blanket allowance for zsh -lc, disabling approval globally, or writing a separate wrapper executable.

A matching rule must not silently authorize an additional unrelated command, command substitution, or a redirect outside the permitted path pattern. A structured parser-aware implementation would satisfy the request; raw textual globbing is not required if it cannot preserve those boundaries.

Impact and related reports

Normal test logging repeatedly interrupts already-authorized work. Changing a log filename or test filter should not require another user decision. The current workaround accumulates one allow rule per complete script.

The documentation explicitly describes redirection falling back to whole-script matching, so this report requests an improvement to that documented limitation:
https://learn.chatgpt.com/docs/agent-configuration/rules

Related:

• #13175 — closed report about shell wrappers and prefix-rule matching.
• #15214 — broader open request for more expressive Starlark rules.

This report focuses on reusable wildcard support for an approved command with ordinary stdout/stderr redirection, with a reproduction on 0.154.0.

Start with the codex execpolicy check entry point and the ~/.codex/rules/default.rules examples, reproducing both the direct and /bin/zsh -lc commands from the report. Review the documented redirection limitation and related reports before defining the scope. Done means one supported allowance covers the shown Swift test variations and redirects without authorizing unrelated commands or paths.