Persistent sandbox bypassing

What feature would you like to see?

There's sandbox feature implemented in codex, which is really handy to disallow codex to do unavoidable damage to the user say by modifying/deleting it's homedir without strict permission. This feature can be configured by [sandbox_workspace_write.writable_roots].

However there are common cases where it's just not enough [read too complicated setup required] to just add additional paths for a specific setup to work on a certain projects

One of which is iOS/macOS project setup (xcodebuild -scheme SomeScheme -destination 'generic/platform=iOS Simulator' build -quiet) -- which is me personally failed to setup right, so whatever either me or codex have been putting into such writable_roots list codex still have been requiring to privilege escalation to make it run.

So to make codex run autonomously in a debug loop (modify - build - repeat) I've been forced to either wait till the first build command execution to allow it surpass the sandbox per whole session or to run the codex in danger-full-access in advance and just to take all the risks of it breaking something occasionally on me (luckily never happened).

On the other hand, danger-full-access is a bit of overkill for my goal in this case, I don't want to give codex full access, I just want it to be able to run pretty specific command set without of sandbox restrictions, like I grant it in within session for such. And currently there's no way to configure sandboxing this way in codex.

So I want to have following options to configure the list of commands to be excluded from within sandbox execution per config so as per attribute on all the levels (global, profile, project), like:

sandbox_bypass = [  # global scope
  "xcodebuild -scheme SomeScheme -destination 'generic/platform=iOS Simulator' build",
  "xcodebuild -scheme SomeScheme -destination 'generic/platform=iOS Simulator' build -quiet",
]

[profiles.ios-build] # profile scope
sandbox_bypass = [
  "xcodebuild -scheme SomeScheme -destination 'generic/platform=iOS Simulator' build",
  "xcodebuild -scheme SomeScheme -destination 'generic/platform=iOS Simulator' build -quiet",
]

[projects."/Users/home/path/to/project"]  # project scope
sandbox_bypass = [
  "xcodebuild -scheme SomeScheme -destination 'generic/platform=iOS Simulator' build",
  "xcodebuild -scheme SomeScheme -destination 'generic/platform=iOS Simulator' build -quiet",
]

This parts of config have been red at the codex start to be mapped in in-memory storage of commands to be ran out of sandbox.

By implementing this level of granularity user will be capable to strictly set the commands codex to run without violating safeness by running it in danger-full-access mode meanwhile keeping the highest autonomous level.

Additional information

_No response_