Repository: openai/codex
File: codex-rs/core/src/exec_policy.rs (Rust)

Code before:
        ];

        let manager = ExecPolicyManager::new(policy);
        let requirement = manager
            .create_exec_approval_requirement_for_command(ExecApprovalRequest {
                command: &forbidden_script,
                approval_policy: AskForApproval::OnRequest,
                sandbox_policy: &SandboxPolicy::DangerFullAccess,
                sandbox_permissions: SandboxPermissions::UseDefault,
                prefix_rule: None,
            })
            .await;

        assert_eq!(
            requirement,
            ExecApprovalRequirement::Forbidden {
                reason: "`bash -lc 'rm -rf /some/important/folder'` rejected: policy forbids commands starting with `rm`".to_string()
            }
        );
    }

    #[test]
    fn commands_for_exec_policy_falls_back_for_empty_shell_script() {
        let command = vec!["bash".to_string(), "-lc".to_string(), "".to_string()];

        assert_eq!(commands_for_exec_policy(&command), (vec![command], false),);
    }

    #[test]
    fn commands_for_exec_policy_falls_back_for_whitespace_shell_script() {
        let command = vec![
            "bash".to_string(),
            "-lc".to_string(),
            "  \n\t  ".to_string(),
        ];

        assert_eq!(commands_for_exec_policy(&command), (vec![command], false),);
    }

    #[tokio::test]
    async fn evaluates_heredoc_script_against_prefix_rules() {
        let policy_src = r#"prefix_rule(pattern=["python3"], decision="allow")"#;
        let mut parser = PolicyParser::new();
        parser
            .parse("test.rules", policy_src)
            .expect("parse policy");
        let policy = Arc::new(parser.build());
        let command = vec![
            "bash".to_string(),
            "-lc".to_string(),
            "python3 <<'PY'\nprint('hello')\nPY".to_string(),

Review comment (suggestion):
autoformat leftover?

```suggestion
        assert_eq!(commands_for_exec_policy(&command), (vec![command], false));
```

Code after:
        ];

        let manager = ExecPolicyManager::new(policy);
        let requirement = manager
            .create_exec_approval_requirement_for_command(ExecApprovalRequest {
                command: &forbidden_script,
                approval_policy: AskForApproval::OnRequest,
                sandbox_policy: &SandboxPolicy::DangerFullAccess,
                sandbox_permissions: SandboxPermissions::UseDefault,
                prefix_rule: None,
            })
            .await;

        assert_eq!(
            requirement,
            ExecApprovalRequirement::Forbidden {
                reason: "`bash -lc 'rm -rf /some/important/folder'` rejected: policy forbids commands starting with `rm`".to_string()
            }
        );
    }

    #[test]
    fn commands_for_exec_policy_falls_back_for_empty_shell_script() {
        let command = vec!["bash".to_string(), "-lc".to_string(), "".to_string()];

        assert_eq!(commands_for_exec_policy(&command), (vec![command], false));
    }

    #[test]
    fn commands_for_exec_policy_falls_back_for_whitespace_shell_script() {
        let command = vec![
            "bash".to_string(),
            "-lc".to_string(),
            "  \n\t  ".to_string(),
        ];

        assert_eq!(commands_for_exec_policy(&command), (vec![command], false));
    }

    #[tokio::test]
    async fn evaluates_heredoc_script_against_prefix_rules() {
        let policy_src = r#"prefix_rule(pattern=["python3"], decision="allow")"#;
        let mut parser = PolicyParser::new();
        parser
            .parse("test.rules", policy_src)
            .expect("parse policy");
        let policy = Arc::new(parser.build());
        let command = vec![
            "bash".to_string(),
            "-lc".to_string(),
            "python3 <<'PY'\nprint('hello')\nPY".to_string(),