From 00ff42d5943d59f7aa906c27781d4cb7edebc48f Mon Sep 17 00:00:00 2001
From: kevin zhao <zhao@openai.com>
Date: Mon, 10 Nov 2025 22:58:34 -0800
Subject: [PATCH] using shlex::try_join instead of " ".join()

---
 codex-rs/Cargo.lock              |  1 +
 codex-rs/execpolicy2/Cargo.toml  |  1 +
 codex-rs/execpolicy2/src/rule.rs | 10 ++++++++--
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/codex-rs/Cargo.lock b/codex-rs/Cargo.lock
index dae40a2727..b6af898ca5 100644
--- a/codex-rs/Cargo.lock
+++ b/codex-rs/Cargo.lock
@@ -1198,6 +1198,7 @@ dependencies = [
  "parking_lot",
  "serde",
  "serde_json",
+ "shlex",
  "starlark",
  "thiserror 2.0.17",
 ]
diff --git a/codex-rs/execpolicy2/Cargo.toml b/codex-rs/execpolicy2/Cargo.toml
index 4001daaeb8..91ca1aff94 100644
--- a/codex-rs/execpolicy2/Cargo.toml
+++ b/codex-rs/execpolicy2/Cargo.toml
@@ -24,3 +24,4 @@ thiserror = { workspace = true }
 multimap = { workspace = true }
 clap = { workspace = true, features = ["derive"] }
 parking_lot = { workspace = true }
+shlex = { workspace = true }
diff --git a/codex-rs/execpolicy2/src/rule.rs b/codex-rs/execpolicy2/src/rule.rs
index e0ad6073d6..fb52de379b 100644
--- a/codex-rs/execpolicy2/src/rule.rs
+++ b/codex-rs/execpolicy2/src/rule.rs
@@ -3,6 +3,7 @@ use crate::error::Error;
 use crate::error::Result;
 use serde::Deserialize;
 use serde::Serialize;
+use shlex::try_join;
 
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub enum PatternToken {
@@ -90,7 +91,7 @@ impl Rule {
             if self.matches(example).is_none() {
                 return Err(Error::ExampleDidNotMatch {
                     rule_id: self.id.clone(),
-                    example: example.join(" "),
+                    example: join_command(example),
                 });
             }
         }
@@ -98,10 +99,15 @@ impl Rule {
             if self.matches(example).is_some() {
                 return Err(Error::ExampleDidMatch {
                     rule_id: self.id.clone(),
-                    example: example.join(" "),
+                    example: join_command(example),
                 });
             }
         }
         Ok(())
     }
 }
+
+fn join_command(command: &[String]) -> String {
+    try_join(command.iter().map(String::as_str))
+        .expect("failed to render command with shlex::try_join")
+}