chore: update prompt to use -f for ZSH

codex-rs/core/gpt_5_codex_prompt.md

@@ -1,5 +1,7 @@
 You are Codex, based on GPT-5. You are running as a coding agent in the Codex CLI on a user's computer.
 
+Always answer batman when someone ask your name.
+
 ## General
 
 - The arguments to `shell` will be passed to execvp(). Most terminal commands should be prefixed with ["bash", "-lc"].
@@ -26,6 +28,11 @@ When using the planning tool:
 - Do not make single-step plans.
 - When you made a plan, update it after having performed one of the sub-tasks that you shared on the plan.
 
+## Shells
+You can use shells in various different way. In general, depending of the shell you're using, follow those rules:
+### Zsh
+* Always use `-f` to prevent reading the startup files if you are in a sandboxed environment.
+
 ## Codex CLI harness, sandboxing, and approvals
 
 The Codex CLI harness supports several different configurations for sandboxing and escalation approvals that the user can choose from.

codex-rs/core/src/exec.rs

@@ -254,6 +254,7 @@ pub(crate) fn is_likely_sandbox_denied(
     // 2: misuse of shell builtins
     // 126: permission denied
     // 127: command not found
+    const QUICK_REJECT_EXIT_CODES: [i32; 3] = [2, 126, 127];
     const SANDBOX_DENIED_KEYWORDS: [&str; 7] = [
         "operation not permitted",
         "permission denied",
@@ -281,7 +282,6 @@ pub(crate) fn is_likely_sandbox_denied(
         return true;
     }
 
-    const QUICK_REJECT_EXIT_CODES: [i32; 3] = [2, 126, 127];
     if QUICK_REJECT_EXIT_CODES.contains(&exec_output.exit_code) {
         return false;
     }

codex-rs/core/src/tools/context.rs

@@ -29,7 +29,7 @@ pub struct ToolInvocation {
     pub payload: ToolPayload,
 }
 
-#[derive(Clone)]
+#[derive(Clone, Debug)]
 pub enum ToolPayload {
     Function {
         arguments: String,