Dylan Hurd be39aab9f4 Strengthen forced rm command detection (#33464) ...

## Why

Forced `rm` commands can appear inside complex shell syntax or use option and wrapper variants that the existing dangerous-command heuristic does not recognize.

## What changed

- Detect literal forced `rm` invocations in control flow, substitutions, pipelines, traps, nested shells, and `sudo` or `env` wrappers.
- Recognize combined, separate, and long-form force options, including when they follow operands.
- Require approval for these commands, or reject them with a safer-alternative explanation when approvals are disabled, even when the sandbox is disabled.
- Preserve existing rejection reasons for other dangerous commands and explicit policy rules.

## Testing

Add unit, policy, and end-to-end coverage for forced `rm` variants, complex shell scripts, approval requests, and rejection messages.

GitOrigin-RevId: e1fabc55324e788bae00ab24aae50d089eb7b058

2026-07-16 01:12:14 +00:00

..

src

Strengthen forced rm command detection (#33464)

2026-07-16 01:12:14 +00:00

BUILD.bazel

build: run buildifier from just fmt (#28125)

2026-06-13 21:43:39 -07:00

Cargo.toml

[codex] Add environment shell info (#26480)

2026-06-04 22:36:25 -07:00