{"url":"https://api.github.com/repos/openai/codex/pulls/39524","id":4316302250,"node_id":"PR_kwDOOYsS4c8AAAABAUWLqg","html_url":"https://github.com/openai/codex/pull/39524","diff_url":"https://github.com/openai/codex/pull/39524.diff","patch_url":"https://github.com/openai/codex/pull/39524.patch","issue_url":"https://api.github.com/repos/openai/codex/issues/39524","commits_url":"https://api.github.com/repos/openai/codex/pulls/39524/commits","review_comments_url":"https://api.github.com/repos/openai/codex/pulls/39524/comments","review_comment_url":"https://api.github.com/repos/openai/codex/pulls/comments{/number}","comments_url":"https://api.github.com/repos/openai/codex/issues/39524/comments","statuses_url":"https://api.github.com/repos/openai/codex/statuses/3b45c29062ff0e76e71c91b6753290400e7fa8da","number":39524,"state":"closed","locked":true,"title":"Stop treating Git commands as inherently safe","user":{"login":"copyberry[bot]","id":240088373,"node_id":"BOT_kgDODk91NQ","avatar_url":"https://avatars.githubusercontent.com/in/2173631?v=4","gravatar_id":"","url":"https://api.github.com/users/copyberry%5Bbot%5D","html_url":"https://github.com/apps/copyberry","followers_url":"https://api.github.com/users/copyberry%5Bbot%5D/followers","following_url":"https://api.github.com/users/copyberry%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/copyberry%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/copyberry%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/copyberry%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/copyberry%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/copyberry%5Bbot%5D/repos","events_url":"https://api.github.com/users/copyberry%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/copyberry%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"body":"Stop treating Git commands as inherently safe\n\n## Why\n\nRepository configuration can cause even read-only Git commands to execute\nhelpers, so Git command arguments alone are not enough to establish trust.\n\n## What changed\n\n- Remove Git commands from the known-safe command classification on Unix and\n  Windows, including commands nested in supported shells.\n- Under the `unless-trusted` approval policy, require approval for commands such\n  as `git status` unless an explicit execution policy rule allows them.\n\n## Testing\n\n- Cover direct, shell-wrapped, absolute-path, and PowerShell Git commands.\n- Verify `git status` approval behavior with and without an explicit allow rule.\n\n<!-- copyberry-projection-id: 28cfe8c3b698142ee5d10af46b3b6c14212da75491e10fef594d60a594bc82c0 -->","labels":[],"milestone":null,"active_lock_reason":null,"created_at":"2026-08-19T18:01:18Z","updated_at":"2026-08-19T18:02:44Z","closed_at":"2026-08-19T18:02:32Z","merged_at":"2026-08-19T18:02:32Z","merge_commit_sha":"3b45c29062ff0e76e71c91b6753290400e7fa8da","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"head":{"label":"openai:copyberry/codex-internal-to-codex-oss/dd04e0ddca0c56ba64ae64abe6e658bae7bf5a4d","ref":"copyberry/codex-internal-to-codex-oss/dd04e0ddca0c56ba64ae64abe6e658bae7bf5a4d","repo":{"id":965415649,"node_id":"R_kgDOOYsS4Q","name":"codex","full_name":"openai/codex","owner":{"login":"openai","id":14957082,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE0OTU3MDgy","avatar_url":"https://avatars.githubusercontent.com/u/14957082?v=4","gravatar_id":"","url":"https://api.github.com/users/openai","html_url":"https://github.com/openai","followers_url":"https://api.github.com/users/openai/followers","following_url":"https://api.github.com/users/openai/following{/other_user}","gists_url":"https://api.github.com/users/openai/gists{/gist_id}","starred_url":"https://api.github.com/users/openai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openai/subscriptions","organizations_url":"https://api.github.com/users/openai/orgs","repos_url":"https://api.github.com/users/openai/repos","events_url":"https://api.github.com/users/openai/events{/privacy}","received_events_url":"https://api.github.com/users/openai/received_events","type":"Organization","user_view_type":"public","site_admin":false},"private":false,"fork":false,"archived":false,"disabled":false,"description":"Lightweight coding agent that runs in your terminal","homepage":"","language":"Rust","visibility":"public","is_template":false,"topics":[],"forks_count":20097,"forks":20097,"stargazers_count":128288,"watchers_count":128288,"watchers":128288,"open_issues_count":21327,"open_issues":21327,"size":671190,"default_branch":"main","has_issues":true,"has_projects":false,"has_wiki":false,"has_pages":false,"has_downloads":false,"has_discussions":true,"has_pull_requests":true,"pushed_at":"2026-10-08T06:32:11Z","created_at":"2025-04-13T05:37:54Z","updated_at":"2026-10-08T07:12:47Z","allow_forking":true,"web_commit_signoff_required":false,"pull_request_creation_policy":"collaborators_only","license":{"key":"apache-2.0","name":"Apache License 2.0","url":"https://api.github.com/licenses/apache-2.0","spdx_id":"Apache-2.0","node_id":"MDc6TGljZW5zZTI="},"url":"https://api.github.com/repos/openai/codex","html_url":"https://github.com/openai/codex","archive_url":"https://api.github.com/repos/openai/codex/{archive_format}{/ref}","assignees_url":"https://api.github.com/repos/openai/codex/assignees{/user}","blobs_url":"https://api.github.com/repos/openai/codex/git/blobs{/sha}","branches_url":"https://api.github.com/repos/openai/codex/branches{/branch}","collaborators_url":"https://api.github.com/repos/openai/codex/collaborators{/collaborator}","comments_url":"https://api.github.com/repos/openai/codex/comments{/number}","commits_url":"https://api.github.com/repos/openai/codex/commits{/sha}","compare_url":"https://api.github.com/repos/openai/codex/compare/{base}...{head}","contents_url":"https://api.github.com/repos/openai/codex/contents/{+path}","contributors_url":"https://api.github.com/repos/openai/codex/contributors","deployments_url":"https://api.github.com/repos/openai/codex/deployments","downloads_url":"https://api.github.com/repos/openai/codex/downloads","events_url":"https://api.github.com/repos/openai/codex/events","forks_url":"https://api.github.com/repos/openai/codex/forks","git_commits_url":"https://api.github.com/repos/openai/codex/git/commits{/sha}","git_refs_url":"https://api.github.com/repos/openai/codex/git/refs{/sha}","git_tags_url":"https://api.github.com/repos/openai/codex/git/tags{/sha}","git_url":"git://github.com/openai/codex.git","issue_comment_url":"https://api.github.com/repos/openai/codex/issues/comments{/number}","issue_events_url":"https://api.github.com/repos/openai/codex/issues/events{/number}","issues_url":"https://api.github.com/repos/openai/codex/issues{/number}","keys_url":"https://api.github.com/repos/openai/codex/keys{/key_id}","labels_url":"https://api.github.com/repos/openai/codex/labels{/name}","languages_url":"https://api.github.com/repos/openai/codex/languages","merges_url":"https://api.github.com/repos/openai/codex/merges","milestones_url":"https://api.github.com/repos/openai/codex/milestones{/number}","notifications_url":"https://api.github.com/repos/openai/codex/notifications{?since,all,participating}","pulls_url":"https://api.github.com/repos/openai/codex/pulls{/number}","releases_url":"https://api.github.com/repos/openai/codex/releases{/id}","ssh_url":"org-14957082@github.com:openai/codex.git","stargazers_url":"https://api.github.com/repos/openai/codex/stargazers","statuses_url":"https://api.github.com/repos/openai/codex/statuses/{sha}","subscribers_url":"https://api.github.com/repos/openai/codex/subscribers","subscription_url":"https://api.github.com/repos/openai/codex/subscription","tags_url":"https://api.github.com/repos/openai/codex/tags","teams_url":"https://api.github.com/repos/openai/codex/teams","trees_url":"https://api.github.com/repos/openai/codex/git/trees{/sha}","clone_url":"https://github.com/openai/codex.git","mirror_url":null,"hooks_url":"https://api.github.com/repos/openai/codex/hooks","svn_url":"https://github.com/openai/codex"},"sha":"3b45c29062ff0e76e71c91b6753290400e7fa8da","user":{"login":"openai","id":14957082,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE0OTU3MDgy","avatar_url":"https://avatars.githubusercontent.com/u/14957082?v=4","gravatar_id":"","url":"https://api.github.com/users/openai","html_url":"https://github.com/openai","followers_url":"https://api.github.com/users/openai/followers","following_url":"https://api.github.com/users/openai/following{/other_user}","gists_url":"https://api.github.com/users/openai/gists{/gist_id}","starred_url":"https://api.github.com/users/openai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openai/subscriptions","organizations_url":"https://api.github.com/users/openai/orgs","repos_url":"https://api.github.com/users/openai/repos","events_url":"https://api.github.com/users/openai/events{/privacy}","received_events_url":"https://api.github.com/users/openai/received_events","type":"Organization","user_view_type":"public","site_admin":false}},"base":{"label":"openai:main","ref":"main","repo":{"id":965415649,"node_id":"R_kgDOOYsS4Q","name":"codex","full_name":"openai/codex","owner":{"login":"openai","id":14957082,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE0OTU3MDgy","avatar_url":"https://avatars.githubusercontent.com/u/14957082?v=4","gravatar_id":"","url":"https://api.github.com/users/openai","html_url":"https://github.com/openai","followers_url":"https://api.github.com/users/openai/followers","following_url":"https://api.github.com/users/openai/following{/other_user}","gists_url":"https://api.github.com/users/openai/gists{/gist_id}","starred_url":"https://api.github.com/users/openai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openai/subscriptions","organizations_url":"https://api.github.com/users/openai/orgs","repos_url":"https://api.github.com/users/openai/repos","events_url":"https://api.github.com/users/openai/events{/privacy}","received_events_url":"https://api.github.com/users/openai/received_events","type":"Organization","user_view_type":"public","site_admin":false},"private":false,"fork":false,"archived":false,"disabled":false,"description":"Lightweight coding agent that runs in your terminal","homepage":"","language":"Rust","visibility":"public","is_template":false,"topics":[],"forks_count":20097,"forks":20097,"stargazers_count":128288,"watchers_count":128288,"watchers":128288,"open_issues_count":21327,"open_issues":21327,"size":671190,"default_branch":"main","has_issues":true,"has_projects":false,"has_wiki":false,"has_pages":false,"has_downloads":false,"has_discussions":true,"has_pull_requests":true,"pushed_at":"2026-10-08T06:32:11Z","created_at":"2025-04-13T05:37:54Z","updated_at":"2026-10-08T07:12:47Z","allow_forking":true,"web_commit_signoff_required":false,"pull_request_creation_policy":"collaborators_only","license":{"key":"apache-2.0","name":"Apache License 2.0","url":"https://api.github.com/licenses/apache-2.0","spdx_id":"Apache-2.0","node_id":"MDc6TGljZW5zZTI="},"url":"https://api.github.com/repos/openai/codex","html_url":"https://github.com/openai/codex","archive_url":"https://api.github.com/repos/openai/codex/{archive_format}{/ref}","assignees_url":"https://api.github.com/repos/openai/codex/assignees{/user}","blobs_url":"https://api.github.com/repos/openai/codex/git/blobs{/sha}","branches_url":"https://api.github.com/repos/openai/codex/branches{/branch}","collaborators_url":"https://api.github.com/repos/openai/codex/collaborators{/collaborator}","comments_url":"https://api.github.com/repos/openai/codex/comments{/number}","commits_url":"https://api.github.com/repos/openai/codex/commits{/sha}","compare_url":"https://api.github.com/repos/openai/codex/compare/{base}...{head}","contents_url":"https://api.github.com/repos/openai/codex/contents/{+path}","contributors_url":"https://api.github.com/repos/openai/codex/contributors","deployments_url":"https://api.github.com/repos/openai/codex/deployments","downloads_url":"https://api.github.com/repos/openai/codex/downloads","events_url":"https://api.github.com/repos/openai/codex/events","forks_url":"https://api.github.com/repos/openai/codex/forks","git_commits_url":"https://api.github.com/repos/openai/codex/git/commits{/sha}","git_refs_url":"https://api.github.com/repos/openai/codex/git/refs{/sha}","git_tags_url":"https://api.github.com/repos/openai/codex/git/tags{/sha}","git_url":"git://github.com/openai/codex.git","issue_comment_url":"https://api.github.com/repos/openai/codex/issues/comments{/number}","issue_events_url":"https://api.github.com/repos/openai/codex/issues/events{/number}","issues_url":"https://api.github.com/repos/openai/codex/issues{/number}","keys_url":"https://api.github.com/repos/openai/codex/keys{/key_id}","labels_url":"https://api.github.com/repos/openai/codex/labels{/name}","languages_url":"https://api.github.com/repos/openai/codex/languages","merges_url":"https://api.github.com/repos/openai/codex/merges","milestones_url":"https://api.github.com/repos/openai/codex/milestones{/number}","notifications_url":"https://api.github.com/repos/openai/codex/notifications{?since,all,participating}","pulls_url":"https://api.github.com/repos/openai/codex/pulls{/number}","releases_url":"https://api.github.com/repos/openai/codex/releases{/id}","ssh_url":"org-14957082@github.com:openai/codex.git","stargazers_url":"https://api.github.com/repos/openai/codex/stargazers","statuses_url":"https://api.github.com/repos/openai/codex/statuses/{sha}","subscribers_url":"https://api.github.com/repos/openai/codex/subscribers","subscription_url":"https://api.github.com/repos/openai/codex/subscription","tags_url":"https://api.github.com/repos/openai/codex/tags","teams_url":"https://api.github.com/repos/openai/codex/teams","trees_url":"https://api.github.com/repos/openai/codex/git/trees{/sha}","clone_url":"https://github.com/openai/codex.git","mirror_url":null,"hooks_url":"https://api.github.com/repos/openai/codex/hooks","svn_url":"https://github.com/openai/codex"},"sha":"1b450c79126cc56df29b833110a8c702f82de882","user":{"login":"openai","id":14957082,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE0OTU3MDgy","avatar_url":"https://avatars.githubusercontent.com/u/14957082?v=4","gravatar_id":"","url":"https://api.github.com/users/openai","html_url":"https://github.com/openai","followers_url":"https://api.github.com/users/openai/followers","following_url":"https://api.github.com/users/openai/following{/other_user}","gists_url":"https://api.github.com/users/openai/gists{/gist_id}","starred_url":"https://api.github.com/users/openai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openai/subscriptions","organizations_url":"https://api.github.com/users/openai/orgs","repos_url":"https://api.github.com/users/openai/repos","events_url":"https://api.github.com/users/openai/events{/privacy}","received_events_url":"https://api.github.com/users/openai/received_events","type":"Organization","user_view_type":"public","site_admin":false}},"_links":{"comments":{"href":"https://api.github.com/repos/openai/codex/issues/39524/comments"},"commits":{"href":"https://api.github.com/repos/openai/codex/pulls/39524/commits"},"statuses":{"href":"https://api.github.com/repos/openai/codex/statuses/3b45c29062ff0e76e71c91b6753290400e7fa8da"},"html":{"href":"https://github.com/openai/codex/pull/39524"},"issue":{"href":"https://api.github.com/repos/openai/codex/issues/39524"},"review_comments":{"href":"https://api.github.com/repos/openai/codex/pulls/39524/comments"},"review_comment":{"href":"https://api.github.com/repos/openai/codex/pulls/comments{/number}"},"self":{"href":"https://api.github.com/repos/openai/codex/pulls/39524"}},"author_association":"NONE","auto_merge":null,"draft":false,"merged":true,"mergeable":null,"rebaseable":null,"mergeable_state":"unknown","merged_by":{"login":"copyberry[bot]","id":240088373,"node_id":"BOT_kgDODk91NQ","avatar_url":"https://avatars.githubusercontent.com/in/2173631?v=4","gravatar_id":"","url":"https://api.github.com/users/copyberry%5Bbot%5D","html_url":"https://github.com/apps/copyberry","followers_url":"https://api.github.com/users/copyberry%5Bbot%5D/followers","following_url":"https://api.github.com/users/copyberry%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/copyberry%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/copyberry%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/copyberry%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/copyberry%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/copyberry%5Bbot%5D/repos","events_url":"https://api.github.com/users/copyberry%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/copyberry%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"comments":0,"review_comments":0,"maintainer_can_modify":false,"commits":1,"additions":170,"deletions":436,"changed_files":5}