second pass at tui integration

codex-rs/core/src/tools/handlers/shell.rs

@@ -9,7 +9,7 @@ use crate::apply_patch::convert_apply_patch_to_protocol;
 use crate::codex::TurnContext;
 use crate::exec::ExecParams;
 use crate::exec_env::create_env;
-use crate::exec_policy::create_approval_requirement_for_command;
+use crate::exec_policy::command_approval_outcome_for_command;
 use crate::function_tool::FunctionCallError;
 use crate::is_safe_command::is_known_safe_command;
 use crate::protocol::ExecCommandSource;
@@ -297,6 +297,14 @@ impl ShellHandler {
         let event_ctx = ToolEventCtx::new(session.as_ref(), turn.as_ref(), &call_id, None);
         emitter.begin(event_ctx).await;
 
+        let exec_policy = session.current_exec_policy().await;
+        let approval_outcome = command_approval_outcome_for_command(
+            exec_policy.as_ref(),
+            &exec_params.command,
+            turn.approval_policy,
+            &turn.sandbox_policy,
+            SandboxPermissions::from(exec_params.with_escalated_permissions.unwrap_or(false)),
+        );
         let req = ShellRequest {
             command: exec_params.command.clone(),
             cwd: exec_params.cwd.clone(),
@@ -304,13 +312,8 @@ impl ShellHandler {
             env: exec_params.env.clone(),
             with_escalated_permissions: exec_params.with_escalated_permissions,
             justification: exec_params.justification.clone(),
-            approval_requirement: create_approval_requirement_for_command(
-                &turn.exec_policy,
-                &exec_params.command,
-                turn.approval_policy,
-                &turn.sandbox_policy,
-                SandboxPermissions::from(exec_params.with_escalated_permissions.unwrap_or(false)),
-            ),
+            approval_requirement: approval_outcome.requirement,
+            approval_allow_prefix: approval_outcome.allow_prefix,
         };
         let mut orchestrator = ToolOrchestrator::new();
         let mut runtime = ShellRuntime::new();

codex-rs/core/src/tools/runtimes/apply_patch.rs

@@ -127,6 +127,7 @@ impl Approvable<ApplyPatchRequest> for ApplyPatchRuntime {
                             cwd,
                             Some(reason),
                             risk,
+                            None,
                         )
                         .await
                 } else if user_explicitly_approved {

codex-rs/core/src/tools/runtimes/shell.rs

@@ -32,6 +32,7 @@ pub struct ShellRequest {
     pub with_escalated_permissions: Option<bool>,
     pub justification: Option<String>,
     pub approval_requirement: ApprovalRequirement,
+    pub approval_allow_prefix: Option<Vec<String>>,
 }
 
 impl ProvidesSandboxRetryData for ShellRequest {
@@ -100,13 +101,22 @@ impl Approvable<ShellRequest> for ShellRuntime {
             .clone()
             .or_else(|| req.justification.clone());
         let risk = ctx.risk.clone();
+        let allow_prefix = req.approval_allow_prefix.clone();
         let session = ctx.session;
         let turn = ctx.turn;
         let call_id = ctx.call_id.to_string();
         Box::pin(async move {
             with_cached_approval(&session.services, key, move || async move {
                 session
-                    .request_command_approval(turn, call_id, command, cwd, reason, risk)
+                    .request_command_approval(
+                        turn,
+                        call_id,
+                        command,
+                        cwd,
+                        reason,
+                        risk,
+                        allow_prefix,
+                    )
                     .await
             })
             .await

codex-rs/core/src/tools/runtimes/unified_exec.rs

@@ -35,6 +35,7 @@ pub struct UnifiedExecRequest {
     pub with_escalated_permissions: Option<bool>,
     pub justification: Option<String>,
     pub approval_requirement: ApprovalRequirement,
+    pub approval_allow_prefix: Option<Vec<String>>,
 }
 
 impl ProvidesSandboxRetryData for UnifiedExecRequest {
@@ -65,6 +66,7 @@ impl UnifiedExecRequest {
         with_escalated_permissions: Option<bool>,
         justification: Option<String>,
         approval_requirement: ApprovalRequirement,
+        approval_allow_prefix: Option<Vec<String>>,
     ) -> Self {
         Self {
             command,
@@ -73,6 +75,7 @@ impl UnifiedExecRequest {
             with_escalated_permissions,
             justification,
             approval_requirement,
+            approval_allow_prefix,
         }
     }
 }
@@ -120,10 +123,19 @@ impl Approvable<UnifiedExecRequest> for UnifiedExecRuntime<'_> {
             .clone()
             .or_else(|| req.justification.clone());
         let risk = ctx.risk.clone();
+        let allow_prefix = req.approval_allow_prefix.clone();
         Box::pin(async move {
             with_cached_approval(&session.services, key, || async move {
                 session
-                    .request_command_approval(turn, call_id, command, cwd, reason, risk)
+                    .request_command_approval(
+                        turn,
+                        call_id,
+                        command,
+                        cwd,
+                        reason,
+                        risk,
+                        allow_prefix,
+                    )
                     .await
             })
             .await