[codex-exec] Enforce add-dir for macOS sandbox

codex-rs/app-server-protocol/src/protocol/v2.rs

@@ -3790,6 +3790,8 @@ pub struct ThreadStartParams {
     pub service_tier: Option<Option<ServiceTier>>,
     #[ts(optional = nullable)]
     pub cwd: Option<String>,
+    #[ts(optional = nullable)]
+    pub project_roots: Option<Vec<AbsolutePathBuf>>,
     #[experimental(nested)]
     #[ts(optional = nullable)]
     pub approval_policy: Option<AskForApproval>,
@@ -3944,6 +3946,8 @@ pub struct ThreadResumeParams {
     pub service_tier: Option<Option<ServiceTier>>,
     #[ts(optional = nullable)]
     pub cwd: Option<String>,
+    #[ts(optional = nullable)]
+    pub project_roots: Option<Vec<AbsolutePathBuf>>,
     #[experimental(nested)]
     #[ts(optional = nullable)]
     pub approval_policy: Option<AskForApproval>,

codex-rs/app-server/src/request_processors/thread_processor.rs

@@ -728,6 +728,7 @@ impl ThreadRequestProcessor {
             model_provider,
             service_tier,
             cwd,
+            project_roots,
             approval_policy,
             approvals_reviewer,
             sandbox,
@@ -756,6 +757,7 @@ impl ThreadRequestProcessor {
             model_provider,
             service_tier,
             cwd,
+            project_roots,
             approval_policy,
             approvals_reviewer,
             sandbox,
@@ -1107,6 +1109,7 @@ impl ThreadRequestProcessor {
         model_provider: Option<String>,
         service_tier: Option<Option<codex_protocol::config_types::ServiceTier>>,
         cwd: Option<String>,
+        project_roots: Option<Vec<AbsolutePathBuf>>,
         approval_policy: Option<codex_app_server_protocol::AskForApproval>,
         approvals_reviewer: Option<codex_app_server_protocol::ApprovalsReviewer>,
         sandbox: Option<SandboxMode>,
@@ -1115,16 +1118,25 @@ impl ThreadRequestProcessor {
         developer_instructions: Option<String>,
         personality: Option<Personality>,
     ) -> ConfigOverrides {
+        let cwd = cwd.map(PathBuf::from);
+        let cwd_for_filter = cwd.as_deref();
+        let additional_writable_roots = project_roots
+            .unwrap_or_default()
+            .into_iter()
+            .map(AbsolutePathBuf::into_path_buf)
+            .filter(|root| Some(root.as_path()) != cwd_for_filter)
+            .collect();
         let mut overrides = ConfigOverrides {
             model,
             model_provider,
             service_tier,
-            cwd: cwd.map(PathBuf::from),
+            cwd,
             approval_policy: approval_policy
                 .map(codex_app_server_protocol::AskForApproval::to_core),
             approvals_reviewer: approvals_reviewer
                 .map(codex_app_server_protocol::ApprovalsReviewer::to_core),
             sandbox_mode: sandbox.map(SandboxMode::to_core),
+            additional_writable_roots,
             codex_linux_sandbox_exe: self.arg0_paths.codex_linux_sandbox_exe.clone(),
             main_execve_wrapper_exe: self.arg0_paths.main_execve_wrapper_exe.clone(),
             base_instructions,
@@ -2227,6 +2239,7 @@ impl ThreadRequestProcessor {
             model_provider,
             service_tier,
             cwd,
+            project_roots,
             approval_policy,
             approvals_reviewer,
             sandbox,
@@ -2262,6 +2275,7 @@ impl ThreadRequestProcessor {
             model_provider,
             service_tier,
             cwd,
+            project_roots,
             approval_policy,
             approvals_reviewer,
             sandbox,
@@ -2879,6 +2893,7 @@ impl ThreadRequestProcessor {
             model_provider,
             service_tier,
             cwd,
+            /*project_roots*/ None,
             approval_policy,
             approvals_reviewer,
             sandbox,

codex-rs/app-server/src/request_processors/thread_processor_tests.rs

@@ -514,6 +514,7 @@ mod thread_processor_behavior_tests {
             model_provider: None,
             service_tier: Some(Some(codex_protocol::config_types::ServiceTier::Fast)),
             cwd: None,
+            project_roots: None,
             approval_policy: None,
             approvals_reviewer: None,
             sandbox: None,

codex-rs/app-server/tests/suite/v2/skills_list.rs

@@ -664,6 +664,7 @@ async fn skills_changed_notification_is_emitted_after_skill_change() -> Result<(
             model_provider: None,
             service_tier: None,
             cwd: None,
+            project_roots: None,
             approval_policy: None,
             approvals_reviewer: None,
             sandbox: None,

codex-rs/core/src/config/config_tests.rs

@@ -2854,7 +2854,7 @@ async fn add_dir_override_extends_workspace_writable_roots() -> std::io::Result<
     std::fs::create_dir_all(&backend)?;
 
     let overrides = ConfigOverrides {
-        cwd: Some(frontend),
+        cwd: Some(frontend.clone()),
         sandbox_mode: Some(SandboxMode::WorkspaceWrite),
         additional_writable_roots: vec![PathBuf::from("../backend"), backend.clone()],
         ..Default::default()
@@ -2868,6 +2868,14 @@ async fn add_dir_override_extends_workspace_writable_roots() -> std::io::Result<
     .await?;
 
     let expected_backend = backend.abs();
+    assert_eq!(
+        config.project_roots,
+        vec![
+            frontend.abs(),
+            expected_backend.clone(),
+            expected_backend.clone()
+        ]
+    );
     if cfg!(target_os = "windows") {
         match &config.legacy_sandbox_policy() {
             SandboxPolicy::ReadOnly { .. } => {}
@@ -6366,6 +6374,7 @@ async fn test_precedence_fixture_with_o3_profile() -> std::io::Result<()> {
             user_instructions: None,
             notify: None,
             cwd: fixture.cwd(),
+            project_roots: vec![fixture.cwd()],
             cli_auth_credentials_store_mode: Default::default(),
             mcp_servers: Constrained::allow_any(HashMap::new()),
             mcp_oauth_credentials_store_mode: resolve_mcp_oauth_credentials_store_mode(
@@ -6568,6 +6577,7 @@ async fn test_precedence_fixture_with_gpt3_profile() -> std::io::Result<()> {
         user_instructions: None,
         notify: None,
         cwd: fixture.cwd(),
+        project_roots: vec![fixture.cwd()],
         cli_auth_credentials_store_mode: Default::default(),
         mcp_servers: Constrained::allow_any(HashMap::new()),
         mcp_oauth_credentials_store_mode: resolve_mcp_oauth_credentials_store_mode(
@@ -6724,6 +6734,7 @@ async fn test_precedence_fixture_with_zdr_profile() -> std::io::Result<()> {
         user_instructions: None,
         notify: None,
         cwd: fixture.cwd(),
+        project_roots: vec![fixture.cwd()],
         cli_auth_credentials_store_mode: Default::default(),
         mcp_servers: Constrained::allow_any(HashMap::new()),
         mcp_oauth_credentials_store_mode: resolve_mcp_oauth_credentials_store_mode(
@@ -6865,6 +6876,7 @@ async fn test_precedence_fixture_with_gpt5_profile() -> std::io::Result<()> {
         user_instructions: None,
         notify: None,
         cwd: fixture.cwd(),
+        project_roots: vec![fixture.cwd()],
         cli_auth_credentials_store_mode: Default::default(),
         mcp_servers: Constrained::allow_any(HashMap::new()),
         mcp_oauth_credentials_store_mode: resolve_mcp_oauth_credentials_store_mode(

codex-rs/core/src/config/mod.rs

@@ -561,6 +561,11 @@ pub struct Config {
     /// layer are resolved against this path.
     pub cwd: AbsolutePathBuf,
 
+    /// Absolute project roots for the session. This is the cwd plus any
+    /// user-requested additional roots, before implicit writable roots are
+    /// added to the effective permission profile.
+    pub project_roots: Vec<AbsolutePathBuf>,
+
     /// Preferred store for CLI auth credentials.
     /// file (default): Use a file in the Codex home directory.
     /// keyring: Use an OS-specific keyring service.
@@ -2950,6 +2955,9 @@ impl Config {
             .value
             .set(effective_permission_profile)
             .map_err(std::io::Error::from)?;
+        let project_roots = std::iter::once(resolved_cwd.clone())
+            .chain(requested_additional_writable_roots.iter().cloned())
+            .collect::<Vec<_>>();
         let config = Self {
             model,
             service_tier,
@@ -2959,6 +2967,7 @@ impl Config {
             model_provider_id,
             model_provider,
             cwd: resolved_cwd,
+            project_roots,
             startup_warnings,
             permissions: Permissions {
                 approval_policy: constrained_approval_policy.value,