From 45d36697ca63eb54f7fd9c3ff4f9d5b0137e201f Mon Sep 17 00:00:00 2001
From: Kyle Van Essen <k@kve.me>
Date: Sun, 9 Aug 2026 19:00:05 -0700
Subject: [PATCH] Allow GitHub CLI outside the project sandbox

---
 .codex/rules/github.rules | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 .codex/rules/github.rules

diff --git a/.codex/rules/github.rules b/.codex/rules/github.rules
new file mode 100644
index 000000000..a37c4b235
--- /dev/null
+++ b/.codex/rules/github.rules
@@ -0,0 +1,16 @@
+# The GitHub CLI authenticates through macOS Keychain, which is unavailable
+# inside the workspace sandbox. This repository is trusted to use the complete
+# CLI outside that sandbox rather than maintaining a brittle subcommand list.
+prefix_rule(
+    pattern = ["gh"],
+    decision = "allow",
+    match = [
+        "gh auth status",
+        "gh pr view 222",
+        "gh run view 31345555418 --log-failed",
+        "gh api repos/kyleve/Stuff/actions/runs/31345555418/artifacts",
+    ],
+    not_match = [
+        "git status --short",
+    ],
+)