Permanently allow specific bash commands to run outside the sandbox (like `xcodebuild ...`)

What feature would you like to see?

There are some commands that do not work in the sandbox. For example xcodebuild, which is needed to build iOS projects. Running this in the Codex sandbox causes an error. According to Codex itself, it's because the sandbox is blocking the CoreSimulator services:

The command needs to talk to CoreSimulator (CoreSimulatorService, simdiskimaged, FSEvents) but the sandbox denies the XPC connections, causing Connection invalid errors.

Here's a very simple command that already fails:

xcodebuild -workspace MyProject.xcworkspace -list

xcodebuild: warning: confstr() failed with code 5: couldn't get path of DARWIN_USER_TEMP_DIR; using /tmp instead
xcodebuild: error: couldn't create cache file '/tmp/xcrun_db-yq7L1lIQ' (errno=Operation not permitted)
xcodebuild: warning: confstr() failed with code 5: couldn't get path of DARWIN_USER_TEMP_DIR; using /tmp instead
xcodebuild: error: couldn't create cache file '/tmp/xcrun_db-DXTWnWEI' (errno=Operation not permitted)
2025-10-09 09:20:40.690 xcodebuild[59146:42694680]  DVTFilePathFSEvents: Failed to start fs event stream.
2025-10-09 09:20:40.945 xcodebuild[59146:42694678] [MT] DVTDeveloperPaths: Failed to get length of DARWIN_USER_CACHE_DIR from confstr(3), error = Error Domain=NSPOSIXErrorDomain Code=5 "Input/output error". Using NSCachesDirectory instead.
2025-10-09 09:20:41.451 xcodebuild[59144:42694690]  DVTFilePathFSEvents: Failed to start fs event stream.
2025-10-09 09:20:41.613 xcodebuild[59144:42694686] [MT] DVTDeveloperPaths: Failed to get length of DARWIN_USER_CACHE_DIR from confstr(3), error = Error Domain=NSPOSIXErrorDomain Code=5 "Input/output error". Using NSCachesDirectory instead.
2025-10-09 09:20:41.900 xcodebuild[59144:42694689] CoreSimulatorService connection became invalid.  Simulator services will no longer be available.
2025-10-09 09:20:41.900 xcodebuild[59144:42694689] Logging connecton invalid: <OS_xpc_error: <dictionary: 0x20e209460> { count = 1, transaction: 0, voucher = 0x0, contents =
        "XPCErrorDescription" => <string: 0x20e2095a8> { string cache = 0x0, length = 18, contents = "Connection invalid" }
}>
2025-10-09 09:20:41.901 xcodebuild[59144:42694689] Error opening log file (/Users/swiftedmind/Library/Logs/CoreSimulator/CoreSimulator.com.apple.dt.xcodebuild.log): Operation not permitted
[-[SimServiceContext sendRequest:]:1743] ERROR : Unable to deliver request ({
    "developer_dir" = "/Applications/Xcode.app/Contents/Developer";
    request = "set_developer_dir";
}) because we are not connected to CoreSimulatorService.
Command line invocation:
    /Applications/Xcode.app/Contents/Developer/usr/bin/xcodebuild -workspace MyProject.xcworkspace -list

"--yolo" mode can circumvent this issue but I'm a bit scared of that mode 😅 It would be amazing to have some kind of allowlist that gives Codex the option to run specific commands outside the sandbox. Currently, it can request elevated privileges to run such commands, but the permission is only stored for the current session, which is a bit annoying.

Additional information

There is a really cool MCP that wraps xcodebuild in some nice tools: https://github.com/cameroncooke/XcodeBuildMCP

But I'm currently experimenting with reducing the number of MCPs in my context and relying more on basic bash commands.