From 9ce72b7ff221aa9b6136f2377d20aac184c128fc Mon Sep 17 00:00:00 2001
From: Jiro <j.code.public@gmail.com>
Date: Wed, 29 Jul 2026 15:51:53 +0900
Subject: [PATCH] chore: allow frozen bun installs

Add an explicit allow rule for bun install --frozen-lockfile so dependency installation can run without prompting while preserving the lockfile.\n\nVerified with codex execpolicy check and make deploy-dry-run.
---
 codex/rules/allow.rules | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/codex/rules/allow.rules b/codex/rules/allow.rules
index 5f56cb1..3f7a4e5 100644
--- a/codex/rules/allow.rules
+++ b/codex/rules/allow.rules
@@ -206,6 +206,12 @@ prefix_rule(
     justification = "ローカル操作は安全"
 )
 
+prefix_rule(
+    pattern = ["bun", "install", "--frozen-lockfile"],
+    decision = "allow",
+    justification = "ロックファイルを変更しない依存関係のインストールは安全"
+)
+
 prefix_rule(
     pattern = ["bundle", ["exec", "install"]],
     decision = "allow",