Lack of wildcards in permission model forbids allowing many common commands

[dandv]

Codex’s permissions model is too limited for practical workflows. Literal argument matching makes common safe patterns difficult or impossible to express without overly broad permissions.

Use case: allowing git [show|log|...] if any number of arguments and their values intervene between git and show, such as --no-pager or -C <path>.

~/.claude/settings.json:

"Bash(git * show:*)"

~/.codex/rules/default.rules:

prefix_rule(
    pattern = ["git", "show"],  # doesn't cover intervening arguments
    decision = "allow",
)

prefix_rule(
    pattern = ["git", "-C", "/specific/path", "show"],  # doesn't cover arbitrary paths
    decision = "allow",
)

Please consider supporting constrained wildcards or richer argument-aware rules comparable to Claude Code’s permissions.

[youngjoel]

This problem is exacerbated by the gpt models' "creativity" in how they structure commands. sometimes ENV variables up front. Sometimes relative paths to commands. Sometimes absolute paths to commands, arguments in all sorts of orders.

It almost seems like an intensional strategy to force people to use the auto-approve AI model?