Codex app browser tool fails on macOS when Node reads System OpenSSL config

Version

• Codex App: 26.730.61639 (build 6234)
• Bundled CLI: 0.147.0-alpha.1.2
• macOS: 26.3.1 (25D2128), arm64

Issue

Every Codex browser operation fails before the browser bridge initializes because the bundled Node process exits while loading the system OpenSSL configuration:

node_repl kernel exited unexpectedly
OpenSSL configuration error:
BIO_new_file:Operation not permitted
calling fopen(/System/Library/OpenSSL//openssl.cnf, rb)

Reproduction

1. Use a workspace permission profile with :minimal read access.
2. Ask Codex to use the browser tool.
3. The node_repl MCP helper exits during startup with the error above.

The same bundled node_repl handshake succeeds when read access to /System/Library/OpenSSL is added to the workspace permission profile.

Root cause

The macOS :minimal Seatbelt defaults in codex-rs/sandboxing/src/restricted_read_only_platform_defaults.sbpl allow standard config paths such as /etc and /private/etc, but not the system OpenSSL config directory. The bundled Node binary attempts to read /System/Library/OpenSSL/openssl.cnf during startup and is terminated by the sandbox before browser control can initialize.

Proposed fix

Add a read-only (subpath "/System/Library/OpenSSL") allowance to the macOS minimal platform defaults. I have a focused regression test that generates the Seatbelt policy for a :minimal filesystem profile and asserts that the OpenSSL config directory is readable. The test fails before the allowance and passes after it; the full codex-sandboxing suite passes 76/76, just fmt passes, and just fix -p codex-sandboxing passes.

Per the contribution policy, I am opening the issue first. I have the tested two-file patch ready and would be happy to submit it if a maintainer invites the PR.