feat: include sandbox config with escalation request

codex-rs/core/src/config/mod.rs

@@ -49,8 +49,6 @@ use crate::project_doc::LOCAL_PROJECT_DOC_FILENAME;
 use crate::protocol::AskForApproval;
 use crate::protocol::ReadOnlyAccess;
 use crate::protocol::SandboxPolicy;
-#[cfg(target_os = "macos")]
-use crate::seatbelt_permissions::MacOsSeatbeltProfileExtensions;
 use crate::unified_exec::DEFAULT_MAX_BACKGROUND_TERMINAL_TIMEOUT_MS;
 use crate::unified_exec::MIN_EMPTY_YIELD_TIME_MS;
 use crate::windows_sandbox::WindowsSandboxLevelExt;
@@ -66,6 +64,7 @@ use codex_protocol::config_types::TrustLevel;
 use codex_protocol::config_types::Verbosity;
 use codex_protocol::config_types::WebSearchMode;
 use codex_protocol::config_types::WindowsSandboxLevel;
+use codex_protocol::models::MacOsSeatbeltProfileExtensions;
 use codex_protocol::openai_models::ModelsResponse;
 use codex_protocol::openai_models::ReasoningEffort;
 use codex_rmcp_client::OAuthCredentialsStoreMode;
@@ -82,8 +81,6 @@ use std::path::Path;
 use std::path::PathBuf;
 #[cfg(test)]
 use tempfile::tempdir;
-#[cfg(not(target_os = "macos"))]
-type MacOsSeatbeltProfileExtensions = ();
 
 use crate::config::permissions::network_proxy_config_from_permissions;
 use crate::config::profile::ConfigProfile;

codex-rs/core/src/exec.rs

@@ -219,6 +219,8 @@ pub async fn process_exec_tool_call(
             enforce_managed_network,
             network: network.as_ref(),
             sandbox_policy_cwd: sandbox_cwd,
+            #[cfg(target_os = "macos")]
+            macos_seatbelt_profile_extensions: None,
             codex_linux_sandbox_exe: codex_linux_sandbox_exe.as_ref(),
             use_linux_sandbox_bwrap,
             windows_sandbox_level,

codex-rs/core/src/sandboxing/mod.rs

@@ -17,14 +17,16 @@ use crate::protocol::SandboxPolicy;
 #[cfg(target_os = "macos")]
 use crate::seatbelt::MACOS_PATH_TO_SEATBELT_EXECUTABLE;
 #[cfg(target_os = "macos")]
-use crate::seatbelt::create_seatbelt_command_args;
+use crate::seatbelt::create_seatbelt_command_args_with_extensions;
 #[cfg(target_os = "macos")]
 use crate::spawn::CODEX_SANDBOX_ENV_VAR;
 use crate::spawn::CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR;
 use crate::tools::sandboxing::SandboxablePreference;
 use codex_network_proxy::NetworkProxy;
 use codex_protocol::config_types::WindowsSandboxLevel;
 use codex_protocol::models::FileSystemPermissions;
+#[cfg(target_os = "macos")]
+use codex_protocol::models::MacOsSeatbeltProfileExtensions;
 use codex_protocol::models::PermissionProfile;
 pub use codex_protocol::models::SandboxPermissions;
 use codex_protocol::protocol::ReadOnlyAccess;
@@ -73,6 +75,8 @@ pub(crate) struct SandboxTransformRequest<'a> {
     // to make shared ownership explicit across runtime/sandbox plumbing.
     pub network: Option<&'a NetworkProxy>,
     pub sandbox_policy_cwd: &'a Path,
+    #[cfg(target_os = "macos")]
+    pub macos_seatbelt_profile_extensions: Option<&'a MacOsSeatbeltProfileExtensions>,
     pub codex_linux_sandbox_exe: Option<&'a PathBuf>,
     pub use_linux_sandbox_bwrap: bool,
     pub windows_sandbox_level: WindowsSandboxLevel,
@@ -342,6 +346,8 @@ impl SandboxManager {
             enforce_managed_network,
             network,
             sandbox_policy_cwd,
+            #[cfg(target_os = "macos")]
+            macos_seatbelt_profile_extensions,
             codex_linux_sandbox_exe,
             use_linux_sandbox_bwrap,
             windows_sandbox_level,
@@ -370,12 +376,13 @@ impl SandboxManager {
             SandboxType::MacosSeatbelt => {
                 let mut seatbelt_env = HashMap::new();
                 seatbelt_env.insert(CODEX_SANDBOX_ENV_VAR.to_string(), "seatbelt".to_string());
-                let mut args = create_seatbelt_command_args(
+                let mut args = create_seatbelt_command_args_with_extensions(
                     command.clone(),
                     &effective_policy,
                     sandbox_policy_cwd,
                     enforce_managed_network,
                     network,
+                    macos_seatbelt_profile_extensions,
                 );
                 let mut full_command = Vec::with_capacity(1 + args.len());
                 full_command.push(MACOS_PATH_TO_SEATBELT_EXECUTABLE.to_string());

codex-rs/core/src/seatbelt_permissions.rs

@@ -3,60 +3,36 @@
 use std::collections::BTreeSet;
 use std::path::PathBuf;
 
-#[allow(dead_code)]
-#[derive(Debug, Clone, PartialEq, Eq, Default)]
-pub enum MacOsPreferencesPermission {
-    // IMPORTANT: ReadOnly needs to be the default because it's the security-sensitive default.
-    // it's important for allowing cf prefs to work.
-    #[default]
-    ReadOnly,
-    ReadWrite,
-    None,
-}
-
-#[allow(dead_code)]
-#[derive(Debug, Clone, PartialEq, Eq, Default)]
-pub enum MacOsAutomationPermission {
-    #[default]
-    None,
-    All,
-    BundleIds(Vec<String>),
-}
-
-#[allow(dead_code)]
-#[derive(Debug, Clone, PartialEq, Eq, Default)]
-pub struct MacOsSeatbeltProfileExtensions {
-    pub macos_preferences: MacOsPreferencesPermission,
-    pub macos_automation: MacOsAutomationPermission,
-    pub macos_accessibility: bool,
-    pub macos_calendar: bool,
-}
+pub use codex_protocol::models::MacOsAutomationPermission;
+pub use codex_protocol::models::MacOsPreferencesPermission;
+pub use codex_protocol::models::MacOsSeatbeltProfileExtensions;
 
 #[derive(Debug, Clone, PartialEq, Eq, Default)]
 pub(crate) struct SeatbeltExtensionPolicy {
     pub(crate) policy: String,
     pub(crate) dir_params: Vec<(String, PathBuf)>,
 }
 
-impl MacOsSeatbeltProfileExtensions {
-    pub fn normalized(&self) -> Self {
-        let mut normalized = self.clone();
-        if let MacOsAutomationPermission::BundleIds(bundle_ids) = &self.macos_automation {
-            let bundle_ids = normalize_bundle_ids(bundle_ids);
-            normalized.macos_automation = if bundle_ids.is_empty() {
-                MacOsAutomationPermission::None
-            } else {
-                MacOsAutomationPermission::BundleIds(bundle_ids)
-            };
-        }
-        normalized
+fn normalized_extensions(
+    extensions: &MacOsSeatbeltProfileExtensions,
+) -> MacOsSeatbeltProfileExtensions {
+    let mut normalized = extensions.clone();
+    if let MacOsAutomationPermission::BundleIds(bundle_ids) = &extensions.macos_automation {
+        let bundle_ids = normalize_bundle_ids(bundle_ids);
+        normalized.macos_automation = if bundle_ids.is_empty() {
+            MacOsAutomationPermission::None
+        } else {
+            MacOsAutomationPermission::BundleIds(bundle_ids)
+        };
     }
+
+    normalized
 }
 
 pub(crate) fn build_seatbelt_extensions(
     extensions: &MacOsSeatbeltProfileExtensions,
 ) -> SeatbeltExtensionPolicy {
-    let extensions = extensions.normalized();
+    let extensions = normalized_extensions(extensions);
     let mut clauses = Vec::new();
 
     match extensions.macos_preferences {

codex-rs/core/src/skills/permissions.rs

@@ -8,6 +8,7 @@ use codex_protocol::models::MacOsAutomationValue;
 use codex_protocol::models::MacOsPermissions;
 #[cfg(target_os = "macos")]
 use codex_protocol::models::MacOsPreferencesValue;
+use codex_protocol::models::MacOsSeatbeltProfileExtensions;
 use codex_protocol::models::PermissionProfile;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use dirs::home_dir;
@@ -20,10 +21,6 @@ use crate::config::types::ShellEnvironmentPolicy;
 use crate::protocol::AskForApproval;
 use crate::protocol::ReadOnlyAccess;
 use crate::protocol::SandboxPolicy;
-#[cfg(target_os = "macos")]
-use crate::seatbelt_permissions::MacOsSeatbeltProfileExtensions;
-#[cfg(not(target_os = "macos"))]
-type MacOsSeatbeltProfileExtensions = ();
 
 pub(crate) fn compile_permission_profile(
     skill_dir: &Path,

codex-rs/core/src/tools/js_repl/mod.rs

@@ -613,6 +613,8 @@ impl JsReplManager {
                 enforce_managed_network: has_managed_network_requirements,
                 network: None,
                 sandbox_policy_cwd: &turn.cwd,
+                #[cfg(target_os = "macos")]
+                macos_seatbelt_profile_extensions: None,
                 codex_linux_sandbox_exe: turn.codex_linux_sandbox_exe.as_ref(),
                 use_linux_sandbox_bwrap: turn
                     .features