Support project-scoped loopback listener allowlists without enabling allow_local_binding

What variant of Codex are you using?

Codex Desktop and CLI on macOS.

What feature would you like to see?

Add a first-class permission for narrowly allowing loopback listeners by address and port within a named permission profile.

For example, an illustrative configuration might be:

[permissions.workspace-tests.network]
enabled = true
allow_local_binding = false

[[permissions.workspace-tests.network.listeners]]
addresses = ["127.0.0.1", "::1"]
ports = "ephemeral"

This would let tests create local HTTP servers using an OS-assigned port without broadly enabling local binding or access to other local/private-network services.

The setting should:

• Be usable from a trusted project's .codex/config.toml.
• Apply only when that project's permission profile is selected.
• Permit bind() only on the declared loopback addresses and ports.
• Not allow non-loopback listeners.
• Not grant additional outbound access to local or private-network targets.
• Be supported consistently by CLI and Desktop execution.
• Keep the global allow_local_binding = false default intact.

Motivation

Some unit tests create an in-process loopback server:

import socket

server = socket.socket()
server.bind(("127.0.0.1", 0))
print(server.getsockname())

With allow_local_binding = false, this fails with:

PermissionError: [Errno 1] Operation not permitted

Setting allow_local_binding = true permits the tests, but is broader than necessary. The current macOS policy permits wildcard local binds when enabled and also uses the setting for a DNS carve-out (current Seatbelt implementation, PR #17370).

A typed listener allowlist would provide a portable, auditable least-privilege alternative.

Related issues

• #23973 concerns Desktop ignoring allow_local_binding = true.
• #33227 concerns outbound connections to explicitly allowlisted loopback targets.
• #24742 proposes raw user-provided macOS Seatbelt rules. That could offer a platform-specific escape hatch, but not a validated, cross-platform listener permission.