Skip sandboxed shell commands in Guardian v2 by default (#39631)

## What changed

- Exclude sandboxed `exec_command` and `shell_command` calls from Guardian v2 classification by default while continuing to classify calls that request `require_escalated` permissions.
- Add `guardianv2.review_scope.sandboxed_exec_commands` to opt sandboxed shell commands back into classification.
- Keep other tools and namespaced shell tools in scope, and advance tool-call progress when a call is skipped.

## Testing

- Cover the default and configured review scopes, tool namespaces, permission modes, and skipped-call progress tracking.

GitOrigin-RevId: 32fb540c69959b9a82569f0f2fc76b5517496e6b

codex-rs/features/src/feature_configs.rs

@@ -108,6 +108,15 @@ pub struct GuardianV2TranscriptConfigToml {
     pub max_recent_non_user_entries: Option<usize>,
 }
 
+/// Optional tool-call categories available to the Guardian v2 classifier.
+#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema)]
+#[serde(deny_unknown_fields)]
+pub struct GuardianV2ReviewScopeConfigToml {
+    /// Include sandboxed shell command calls in Guardian v2 classification.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub sandboxed_exec_commands: Option<bool>,
+}
+
 /// User-configurable prompt, approval, and context settings for Guardian v2.
 #[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, JsonSchema)]
 #[serde(deny_unknown_fields)]
@@ -133,6 +142,8 @@ pub struct GuardianV2ConfigToml {
     #[schemars(range(min = 100, max = 100000))]
     pub max_parent_compaction_tokens: Option<usize>,
     #[serde(skip_serializing_if = "Option::is_none")]
+    pub review_scope: Option<GuardianV2ReviewScopeConfigToml>,
+    #[serde(skip_serializing_if = "Option::is_none")]
     pub transcript: Option<GuardianV2TranscriptConfigToml>,
 }
 

codex-rs/features/src/lib.rs

@@ -22,6 +22,7 @@ pub use feature_configs::CurrentTimeReminderConfigToml;
 pub use feature_configs::CurrentTimeReminderDeliveryMode;
 pub use feature_configs::CurrentTimeSource;
 pub use feature_configs::GuardianV2ConfigToml;
+pub use feature_configs::GuardianV2ReviewScopeConfigToml;
 pub use feature_configs::GuardianV2TranscriptConfigToml;
 pub use feature_configs::GuardianV2TranscriptSource;
 pub use feature_configs::MultiAgentV2ConfigToml;

codex-rs/features/src/tests.rs

@@ -162,6 +162,9 @@ max_action_tokens = 512
 max_classifier_instruction_tokens = 256
 max_parent_compaction_tokens = 384
 
+[guardianv2.review_scope]
+sandboxed_exec_commands = true
+
 [guardianv2.transcript]
 sources = ["tool_outputs", "reasoning"]
 include_images = true
@@ -185,6 +188,9 @@ max_recent_non_user_entries = 12
             max_action_tokens: Some(512),
             max_classifier_instruction_tokens: Some(256),
             max_parent_compaction_tokens: Some(384),
+            review_scope: Some(crate::GuardianV2ReviewScopeConfigToml {
+                sandboxed_exec_commands: Some(true),
+            }),
             transcript: Some(crate::GuardianV2TranscriptConfigToml {
                 sources: Some(vec![
                     crate::GuardianV2TranscriptSource::ToolOutputs,