Support Unix socket allowlists in macOS sandbox (#17654)

## Changes

Allows sandboxes to restrict overall network access while granting
access to specific unix sockets on mac.

## Details

- `codex sandbox macos`: adds a repeatable `--allow-unix-socket` option.
- `codex-sandboxing`: threads explicit Unix socket roots into the macOS
Seatbelt profile generation.
- Preserves restricted network behavior when only Unix socket IPC is
requested, and preserves full network behavior when full network is
already enabled.

## Verification

- `cargo test -p codex-cli -p codex-sandboxing`
- `cargo build -p codex-cli --bin codex`
- verified that `codex sandbox macos --allow-unix-socket /tmp/test.sock
-- test-client` grants access as expected

codex-rs/cli/src/debug_sandbox.rs

@@ -18,7 +18,10 @@ use codex_protocol::config_types::SandboxMode;
 use codex_protocol::permissions::NetworkSandboxPolicy;
 use codex_sandboxing::landlock::create_linux_sandbox_command_args_for_policies;
 #[cfg(target_os = "macos")]
-use codex_sandboxing::seatbelt::create_seatbelt_command_args_for_policies;
+use codex_sandboxing::seatbelt::CreateSeatbeltCommandArgsParams;
+#[cfg(target_os = "macos")]
+use codex_sandboxing::seatbelt::create_seatbelt_command_args;
+use codex_utils_absolute_path::AbsolutePathBuf;
 use codex_utils_cli::CliConfigOverrides;
 use tokio::process::Child;
 use tokio::process::Command as TokioCommand;
@@ -39,6 +42,7 @@ pub async fn run_command_under_seatbelt(
 ) -> anyhow::Result<()> {
     let SeatbeltCommand {
         full_auto,
+        allow_unix_sockets,
         log_denials,
         config_overrides,
         command,
@@ -50,6 +54,7 @@ pub async fn run_command_under_seatbelt(
         codex_linux_sandbox_exe,
         SandboxType::Seatbelt,
         log_denials,
+        &allow_unix_sockets,
     )
     .await
 }
@@ -78,6 +83,7 @@ pub async fn run_command_under_landlock(
         codex_linux_sandbox_exe,
         SandboxType::Landlock,
         /*log_denials*/ false,
+        &[],
     )
     .await
 }
@@ -98,6 +104,7 @@ pub async fn run_command_under_windows(
         codex_linux_sandbox_exe,
         SandboxType::Windows,
         /*log_denials*/ false,
+        &[],
     )
     .await
 }
@@ -116,6 +123,8 @@ async fn run_command_under_sandbox(
     codex_linux_sandbox_exe: Option<PathBuf>,
     sandbox_type: SandboxType,
     log_denials: bool,
+    #[cfg_attr(not(target_os = "macos"), allow(unused_variables))]
+    allow_unix_sockets: &[AbsolutePathBuf],
 ) -> anyhow::Result<()> {
     let config = load_debug_sandbox_config(
         config_overrides
@@ -252,14 +261,15 @@ async fn run_command_under_sandbox(
     let mut child = match sandbox_type {
         #[cfg(target_os = "macos")]
         SandboxType::Seatbelt => {
-            let args = create_seatbelt_command_args_for_policies(
+            let args = create_seatbelt_command_args(CreateSeatbeltCommandArgsParams {
                 command,
-                &config.permissions.file_system_sandbox_policy,
-                config.permissions.network_sandbox_policy,
-                sandbox_policy_cwd.as_path(),
-                /*enforce_managed_network*/ false,
-                network.as_ref(),
-            );
+                file_system_sandbox_policy: &config.permissions.file_system_sandbox_policy,
+                network_sandbox_policy: config.permissions.network_sandbox_policy,
+                sandbox_policy_cwd: sandbox_policy_cwd.as_path(),
+                enforce_managed_network: false,
+                network: network.as_ref(),
+                extra_allow_unix_sockets: allow_unix_sockets,
+            });
             let network_policy = config.permissions.network_sandbox_policy;
             spawn_debug_sandbox_child(
                 PathBuf::from("/usr/bin/sandbox-exec"),