feat: Add additional macOS Sandbox Permissions for Launch Services, Contacts, Reminders (#14155)

Add additional macOS Sandbox Permissions levers for the following:

- Launch Services
- Contacts
- Reminders
This commit is contained in:
Leo Shimonaka
2026-03-10 16:34:47 -07:00
committed by Michael Bolin
Unverified
parent 8ac27b2a16
commit 889b4796fc
25 changed files with 779 additions and 25 deletions
@@ -20,6 +20,7 @@ use codex_core::features::Features;
use codex_protocol::ThreadId;
use codex_protocol::mcp::RequestId;
use codex_protocol::models::MacOsAutomationPermission;
use codex_protocol::models::MacOsContactsPermission;
use codex_protocol::models::MacOsPreferencesPermission;
use codex_protocol::models::PermissionProfile;
use codex_protocol::protocol::ElicitationAction;
@@ -800,6 +801,17 @@ pub(crate) fn format_additional_permissions_rule(
if macos.macos_calendar {
parts.push("macOS calendar".to_string());
}
if macos.macos_reminders {
parts.push("macOS reminders".to_string());
}
if !matches!(macos.macos_contacts, MacOsContactsPermission::None) {
let value = match macos.macos_contacts {
MacOsContactsPermission::None => "none",
MacOsContactsPermission::ReadOnly => "readonly",
MacOsContactsPermission::ReadWrite => "readwrite",
};
parts.push(format!("macOS contacts {value}"));
}
}
if parts.is_empty() {
@@ -1401,8 +1413,11 @@ mod tests {
"com.apple.Calendar".to_string(),
"com.apple.Notes".to_string(),
]),
macos_launch_services: false,
macos_accessibility: true,
macos_calendar: true,
macos_reminders: true,
macos_contacts: MacOsContactsPermission::None,
}),
..Default::default()
}),
@@ -8,7 +8,7 @@ expression: "render_overlay_lines(&view, 120)"
Reason: need macOS automation
Permission rule: macOS preferences readwrite; macOS automation com.apple.Calendar, com.apple.Notes; macOS
accessibility; macOS calendar
accessibility; macOS calendar; macOS reminders
$ osascript -e 'tell application'