macOS sandbox: Angular 22 ng build aborts with esbuild SIGABRT inside Codex sandbox but succeeds outside sandbox

What version of the Codex App are you using (From “About Codex” dialog)?

Version 26.602.71036

What subscription do you have?

Pro

What platform is your computer?

Darwin 24.6.0 x86_64 i386

What issue are you seeing?

Bug: Angular 22 build fails inside Codex macOS sandbox with esbuild SIGABRT

Summary

Angular 22 production builds fail inside the Codex macOS sandbox with an esbuild SIGABRT.

The same Angular application builds successfully outside the sandbox.

The issue is reproducible with a clean stock Angular 22 application and does not appear to be related to our monorepo configuration.

Environment

• Codex macOS sandbox
• Angular 22
• pnpm workspace
• Node v26.3.0
• macOS

Actual Behaviour

Angular build aborts with an esbuild SIGABRT during the Angular build process.

The failure occurs when Angular invokes esbuild via its build pipeline.

Current Workaround

Use normal TypeScript validation inside Codex:

pnpm --filter @factory/web exec tsc -p tsconfig.app.json --noEmit

and perform Angular production build validation outside the Codex sandbox.

---

Impact

Codex sessions investigating Angular build failures may incorrectly conclude that Angular, pnpm, TypeScript, workspace configuration, or application configuration is broken when the root cause appears to be a sandbox-specific interaction between Angular 22 and esbuild.

---

Additional Information

Happy to provide:

• full stack trace
• crash logs
• minimal reproduction repository
• Angular version output
• Node version output
• sandbox metadata

if useful.

What steps can reproduce the bug?

Reproduction

1. Create a clean Angular 22 application

pnpm dlx @angular/cli@latest new repro-app
cd repro-app

2. Build inside the Codex sandbox

ng build

Result:

• build aborts
• esbuild SIGABRT

3. Build the same application outside the Codex sandbox

ng build

Result:

• build succeeds

What is the expected behavior?

Expected Behaviour

A standard Angular 22 application should build successfully inside the Codex sandbox.

ng build

should complete successfully.

Additional information

Investigation Performed

Not caused by application configuration

The original repository was compared against a clean Angular 22 application.

Findings:

• angular.json is effectively stock Angular configuration
• tsconfig.app.json uses "types": []
• no unusual Angular builder configuration
• no custom esbuild integration

Clean Angular reproduction

A completely clean Angular 22 application reproduces the same failure inside the sandbox.

This strongly suggests the issue is not repository-specific.

TypeScript compilation succeeds

The following passes inside the sandbox:

tsc -p tsconfig.app.json --noEmit

This indicates the problem is not TypeScript compilation.

Basic esbuild succeeds

Standalone esbuild execution works inside the sandbox.

The failure appears to occur when Angular drives esbuild through its build service/plugin path.

Environment variable testing

Unsetting Codex-related variables did not resolve the issue:

unset CODEX_SANDBOX
unset CODEX_CI

while remaining inside the sandbox.

This suggests the issue is not caused by simple environment-variable branching.

Outside-sandbox validation

The same Angular application builds successfully outside the sandbox.

The original web application also builds successfully outside the sandbox using Node v26.3.0.

@angular/build:application
  → persistent compiler cache (default when CI≠true)
    → lmdb.open(".angular/cache/.../angular-compiler.db")
      → mdb_env_open()
        → semget() / semop() / semctl()    ← System V IPC
          → seatbelt DENY (ipc-sysv-sem not in allowlist)
            → SIGABRT (exit 134)

// mdb.c auto-detection on macOS:
#elif defined(__APPLE__) && !defined(MDB_USE_ROBUST)
# define MDB_USE_POSIX_SEM    1    // ← upstream default: POSIX
#elif defined(__APPLE__) || defined(BSD)
# define MDB_USE_SYSV_SEM    1    // ← with MDB_USE_ROBUST: SysV

U _semctl
U _semget
U _semop

(allow ipc-posix-sem)                              ← POSIX semaphores: allowed
(allow ipc-posix-shm-read-data ...                 ← POSIX SHM: only for OpenMP
  (ipc-posix-name-regex #"^/__KMP_REGISTERED_LIB_[0-9]+$"))
;; ipc-sysv-sem: NOT allowed → falls through to (deny default)