`codex sandbox` aborts (SIGABRT, no diagnostic) when a permission profile omits `/` as a readable root

Summary

On Codex CLI 0.146.1 (macOS, arm64), a [permissions.<name>.filesystem] policy that lists only specific readable roots causes the sandbox to abort with SIGABRT and no diagnostic output at all — empty stdout, empty stderr, and nothing additional under RUST_BACKTRACE=1.

Adding "/" = "read" makes the same profile work. So the restricted-root configuration appears to be unsupported, but it fails as a silent crash rather than a configuration error.

Environment

Codex CLI : 0.146.1
OS        : macOS 15 (Darwin 25.6.0), arm64
Install   : npm @openai/codex

Reproducer

Works — sandbox executes, reads succeed, writes are denied:

[permissions.reviewer]
[permissions.reviewer.filesystem]
"/" = "read"

Also works — the deny carve-out is enforced:

[permissions.reviewer]
[permissions.reviewer.filesystem]
"/" = "read"
"/some/dir" = "deny"

SIGABRT — only explicit readable roots:

[permissions.reviewer]
[permissions.reviewer.filesystem]
"/path/to/workdir" = "read"

SIGABRT — explicit readable roots including system/runtime paths:

[permissions.reviewer]
[permissions.reviewer.filesystem]
"/usr" = "read"
"/bin" = "read"
"/sbin" = "read"
"/System" = "read"
"/Library" = "read"
"/private/var" = "read"
"/path/to/workdir" = "read"

Command:

CODEX_HOME=<tmp> codex sandbox --permission-profile reviewer -C <workdir> -- /bin/cat <workdir>/file

Observed

exit code : 134 (SIGABRT)
stdout    : (empty)
stderr    : (empty)
RUST_BACKTRACE=1 : no additional output

The positive control (/bin/echo) aborts identically, so nothing executes — this is not a filesystem-denial result, it is a crash during sandbox setup.

Expected

Either the restricted-readable-root configuration is supported, or Codex reports a clear configuration error explaining that a / readable root is required. A silent SIGABRT gives callers no way to distinguish "unsupported configuration" from "sandbox failed".

Why it matters

Building a review sandbox that can read only a specific directory currently isn't expressible: the only working shape is "/" = "read" plus deny entries, i.e. an unbounded denylist of everything sensitive on the host rather than a bounded allowlist. workspace_roots doesn't help — its fields are booleans, not paths — and --sandbox-state-readable-root exists on codex sandbox but not on codex review.