AIKIDO-2026-576243

TL;DR

On Windows, @openai/codex uses a PowerShell safe-command classifier to decide whether a command is read-only enough to run without asking the user for approval. The classifier parses the script but only lowers the statements in the end block into argv-like words that it checks against a safe-command allowlist. Code placed in parameter defaults, begin, process, or clean blocks, using preambles, or top-level trap handlers is never inspected, so a script whose end block looks read-only can still execute side-effecting commands and be auto-approved. The fix treats any script containing those un-lowered AST regions as unsupported and routes it through the normal approval path.