## Why
Unified exec can run commands on an OS that differs from the Codex host. Using
host path and shell semantics for approval checks can therefore miss dangerous
Windows and PowerShell commands sent to a remote executor.
## What changed
- Thread the executor platform through command parsing, executable-name
normalization, and dangerous-command classification. Legacy executors fall
back to the host platform, while unknown reported platforms use Windows rules
conservatively.
- Bound model-facing `exec_command` rejection messages and avoid echoing the
rejected command into the error.
- Keep deterministic process IDs reserved after release so rejected test
commands cannot reuse an earlier ID.
## Testing
- Add coverage that a long dangerous PowerShell command targeting a remote
Windows executor is rejected with a bounded response.
- Verify deterministic process IDs advance after release.
GitOrigin-RevId: a26b4a63ea3d6df7140032b88b3e7aec0b85b948
## What changed
Run both branches of the heuristically safe command policy test with the
Windows sandbox level set to `RestrictedToken`.
GitOrigin-RevId: ae5d754ec4a51d73a8e5f9d844f94a91f795fb72
## Why
Reducing a heredoc shell script to its inner executable lets a prefix rule for
that executable apply to the entire wrapper, even though the full script was
not parsed as a plain command.
## What changed
- Fall back to evaluating the complete shell wrapper when plain-command parsing
fails, including for heredoc scripts.
- Keep these commands sandboxed when only the inner executable is allowed.
- Propose the full wrapper as the exec policy amendment when approval is needed.
## Testing
Added exec policy, Unix escalation, and approval scenario coverage for unparsed
and heredoc shell wrappers.
GitOrigin-RevId: 8f65133acb6b7c638263917e1d9137e45990772c
## Why
An unfamiliar executable can ignore its arguments, so trust in an apparent
inner command must not implicitly trust the executable that runs it.
## What changed
- Evaluate unfamiliar shell executables alongside their parsed commands when
determining unified exec approval requirements. Inner commands can add
restrictions, but cannot grant trust to the executable.
- Include the executable in reusable approval keys so approval for one custom
shell does not apply to another.
- Parse literal PowerShell scripts without launching the requested executable,
preserving command policy checks before approval.
## Testing
Add cross-platform coverage for spoofed shell paths, allowed and forbidden
inner commands, explicit custom-shell approval, and session approval isolation.
GitOrigin-RevId: 0dd2c7e9a2ac30965ef5fe5de1a8d2968bb5f9d0
## What changed
- Add an optional restrictive execution policy to `EnvironmentConfig` and merge it over the active command policy for shell execution and approval decisions.
- Reject environment policies that contain allow rules, so environment configuration can only tighten command access.
- Include the environment policy fingerprint in cached approval keys so policy changes require fresh session approvals.
## Testing
- Cover restrictions overriding saved prefix approvals, policy changes invalidating session approvals, and environment overlays remaining effective when model-specific prefix filtering is active.
GitOrigin-RevId: e94f877549ed5e0f577b8cb52f3c1872c58f029d
## What changed
- Filter saved `allow` prefix rules from the execution policy for cyber-specialized models and models listed in `auto_review.ignore_rules`, while preserving prompt, forbidden, network, and host-executable policy entries.
- Apply the filtered policy consistently to permission instructions, shell commands, unified exec, and the zsh-fork backend.
- Limit cyber-model command approvals to one-time decisions without proposing reusable policy amendments. General models continue to honor saved prefixes, including after switching models within a thread.
## Testing
- Add policy-level coverage for filtering allow-prefix rules while retaining restrictive and network rules.
- Add end-to-end coverage across shell and unified exec paths, zsh-fork execution, user and automatic review, and model switching.
GitOrigin-RevId: f3bd3872424291b12354ec415f33986ec369a368
