Won Park bf3c1972b7 Migrate legacy exec policy allow rules (#34271) ...

## What changed

- On session startup, remove exact `allow` entries from `rules/default.rules`
  for command prefixes that Codex no longer suggests as policy amendments.
- Record the migration in `.sandbox_migration` so it runs only once, preserving
  rules created after the migration.
- Skip the migration when user and project exec policy rules are ignored.
- Expand the protected prefix list across shells, interpreters, package runners,
  and destructive or privilege-related commands.

## Testing

- Cover selective removal, case-insensitive matching, one-time behavior, and the
  startup path with ignored policy rules.

GitOrigin-RevId: a0c60e3f82b9630e621fd034b40462e3ab775102

2026-07-20 06:13:29 +00:00

..

amend.rs

[codex] reduce module visibility (#16978)

2026-04-07 08:03:35 -07:00

decision.rs

…

error.rs

…

execpolicycheck.rs

…

executable_name.rs

…

lib.rs

Migrate legacy exec policy allow rules (#34271)

2026-07-20 06:13:29 +00:00

main.rs

[codex] reduce module visibility (#16978)

2026-04-07 08:03:35 -07:00

parser.rs

deps: update starlark to 0.14.2 (#24820)

2026-06-07 17:35:33 -07:00

policy.rs

…

rule.rs

…

sandbox_migration_tests.rs

Migrate legacy exec policy allow rules (#34271)

2026-07-20 06:13:29 +00:00

sandbox_migration.rs

Migrate legacy exec policy allow rules (#34271)

2026-07-20 06:13:29 +00:00