From aa3c4d3d1f289b6ee8f82f2b4b2cc4ea88ecad2d Mon Sep 17 00:00:00 2001
From: kevin zhao <zhao@openai.com>
Date: Fri, 21 Nov 2025 15:30:46 -0500
Subject: [PATCH] moving args around

---
 codex-rs/core/src/exec_policy.rs               | 18 +++++++++---------
 codex-rs/core/src/tools/handlers/shell.rs      |  2 +-
 .../core/src/unified_exec/session_manager.rs   |  2 +-
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/codex-rs/core/src/exec_policy.rs b/codex-rs/core/src/exec_policy.rs
index 482a395745..51768612b9 100644
--- a/codex-rs/core/src/exec_policy.rs
+++ b/codex-rs/core/src/exec_policy.rs
@@ -172,9 +172,9 @@ fn allow_prefix_if_applicable(
 
 pub(crate) fn create_approval_requirement_for_command(
     policy: &Policy,
+    features: &Features,
     command: &[String],
     approval_policy: AskForApproval,
-    features: &Features,
     sandbox_policy: &SandboxPolicy,
     sandbox_permissions: SandboxPermissions,
 ) -> ApprovalRequirement {
@@ -350,9 +350,9 @@ prefix_rule(pattern=["rm"], decision="forbidden")
 
         let requirement = create_approval_requirement_for_command(
             &policy,
+            &Features::with_defaults(),
             &forbidden_script,
             AskForApproval::OnRequest,
-            &Features::with_defaults(),
             &SandboxPolicy::DangerFullAccess,
             SandboxPermissions::UseDefault,
         );
@@ -377,9 +377,9 @@ prefix_rule(pattern=["rm"], decision="forbidden")
 
         let requirement = create_approval_requirement_for_command(
             &policy,
+            &Features::with_defaults(),
             &command,
             AskForApproval::OnRequest,
-            &Features::with_defaults(),
             &SandboxPolicy::DangerFullAccess,
             SandboxPermissions::UseDefault,
         );
@@ -405,9 +405,9 @@ prefix_rule(pattern=["rm"], decision="forbidden")
 
         let requirement = create_approval_requirement_for_command(
             &policy,
+            &Features::with_defaults(),
             &command,
             AskForApproval::Never,
-            &Features::with_defaults(),
             &SandboxPolicy::DangerFullAccess,
             SandboxPermissions::UseDefault,
         );
@@ -427,9 +427,9 @@ prefix_rule(pattern=["rm"], decision="forbidden")
         let empty_policy = Policy::empty();
         let requirement = create_approval_requirement_for_command(
             &empty_policy,
+            &Features::with_defaults(),
             &command,
             AskForApproval::UnlessTrusted,
-            &Features::with_defaults(),
             &SandboxPolicy::ReadOnly,
             SandboxPermissions::UseDefault,
         );
@@ -498,9 +498,9 @@ prefix_rule(pattern=["rm"], decision="forbidden")
         let empty_policy = Policy::empty();
         let requirement = create_approval_requirement_for_command(
             &empty_policy,
+            &Features::with_defaults(),
             &command,
             AskForApproval::UnlessTrusted,
-            &Features::with_defaults(),
             &SandboxPolicy::ReadOnly,
             SandboxPermissions::UseDefault,
         );
@@ -523,9 +523,9 @@ prefix_rule(pattern=["rm"], decision="forbidden")
 
         let requirement = create_approval_requirement_for_command(
             &Policy::empty(),
+            &features,
             &command,
             AskForApproval::UnlessTrusted,
-            &features,
             &SandboxPolicy::ReadOnly,
             SandboxPermissions::UseDefault,
         );
@@ -551,9 +551,9 @@ prefix_rule(pattern=["rm"], decision="forbidden")
 
         let requirement = create_approval_requirement_for_command(
             &policy,
+            &Features::with_defaults(),
             &command,
             AskForApproval::OnRequest,
-            &Features::with_defaults(),
             &SandboxPolicy::DangerFullAccess,
             SandboxPermissions::UseDefault,
         );
@@ -576,9 +576,9 @@ prefix_rule(pattern=["rm"], decision="forbidden")
         ];
         let requirement = create_approval_requirement_for_command(
             &Policy::empty(),
+            &Features::with_defaults(),
             &command,
             AskForApproval::UnlessTrusted,
-            &Features::with_defaults(),
             &SandboxPolicy::ReadOnly,
             SandboxPermissions::UseDefault,
         );
diff --git a/codex-rs/core/src/tools/handlers/shell.rs b/codex-rs/core/src/tools/handlers/shell.rs
index 78765addb2..47a5495063 100644
--- a/codex-rs/core/src/tools/handlers/shell.rs
+++ b/codex-rs/core/src/tools/handlers/shell.rs
@@ -243,9 +243,9 @@ impl ShellHandler {
             justification: exec_params.justification.clone(),
             approval_requirement: create_approval_requirement_for_command(
                 &exec_policy,
+                &features,
                 &exec_params.command,
                 turn.approval_policy,
-                &features,
                 &turn.sandbox_policy,
                 SandboxPermissions::from(exec_params.with_escalated_permissions.unwrap_or(false)),
             ),
diff --git a/codex-rs/core/src/unified_exec/session_manager.rs b/codex-rs/core/src/unified_exec/session_manager.rs
index 01d04cdacf..e1b3672fce 100644
--- a/codex-rs/core/src/unified_exec/session_manager.rs
+++ b/codex-rs/core/src/unified_exec/session_manager.rs
@@ -566,9 +566,9 @@ impl UnifiedExecSessionManager {
             justification,
             create_approval_requirement_for_command(
                 &exec_policy,
+                &features,
                 command,
                 context.turn.approval_policy,
-                &features,
                 &context.turn.sandbox_policy,
                 SandboxPermissions::from(with_escalated_permissions.unwrap_or(false)),
             ),