Dylan Hurd 215fb464f1 [release/0.144] fix(core) expand is_dangerous_command (#33455) ...

## Summary

Cherry-picks the seven commits from
[openai/codex-internal#1942](https://github.com/openai/codex-internal/pull/1942)
onto `release/0.144`.

This backport:

1. enables dangerous-command detection in danger-full-access mode
2. expands literal Bash parsing so additional forced `rm` forms are
detected
3. returns a specific rejection reason to the model when a dangerous
command is denied

The commits applied without conflicts or release-only changes. `git
range-diff` confirms every cherry-picked patch matches the source PR
exactly.

## Validation

- `just test -p codex-shell-command` (141 passed)
- `just test -p codex-core exec_policy` (107 passed)
- `just test -p codex-core` outside the sandbox (2,947 passed; 4
unrelated environment/setup failures)
- 3 RMCP tests could not locate the test-only `test_stdio_server` binary
- 1 user-shell environment test observed the tool runner's mandated
`CODEX_SANDBOX_NETWORK_DISABLED=1`
- `just fix -p codex-core`
- `just fix -p codex-shell-command`
- `just fmt`
- `git diff --check`

2026-07-15 18:09:11 -07:00

..

src

[release/0.144] fix(core) expand is_dangerous_command (#33455)

2026-07-15 18:09:11 -07:00

BUILD.bazel

build: run buildifier from just fmt (#28125)

2026-06-13 21:43:39 -07:00

Cargo.toml

[codex] Add environment shell info (#26480)

2026-06-04 22:36:25 -07:00