Fix macOS fs helper startup runtime policy

codex-rs/protocol/src/permissions.rs

@@ -213,6 +213,7 @@ struct ResolvedFileSystemEntry {
 struct FileSystemSemanticSignature {
     has_full_disk_read_access: bool,
     has_full_disk_write_access: bool,
+    include_platform_runtime_defaults: bool,
     include_platform_defaults: bool,
     readable_roots: Vec<AbsolutePathBuf>,
     writable_roots: Vec<WritableRoot>,
@@ -633,10 +634,9 @@ impl FileSystemSandboxPolicy {
         }
     }
 
-    /// Returns true when platform-default readable roots should be included.
-    pub fn include_platform_defaults(&self) -> bool {
-        !self.has_full_disk_read_access()
-            && matches!(self.kind, FileSystemSandboxKind::Restricted)
+    /// Returns true when minimum native runtime permissions should be included.
+    pub fn include_platform_runtime_defaults(&self) -> bool {
+        matches!(self.kind, FileSystemSandboxKind::Restricted)
             && self.entries.iter().any(|entry| {
                 matches!(
                     &entry.path,
@@ -647,6 +647,11 @@ impl FileSystemSandboxPolicy {
             })
     }
 
+    /// Returns true when platform-default readable roots should be included.
+    pub fn include_platform_defaults(&self) -> bool {
+        !self.has_full_disk_read_access() && self.include_platform_runtime_defaults()
+    }
+
     pub fn resolve_access_with_cwd(&self, path: &Path, cwd: &Path) -> FileSystemAccessMode {
         match self.kind {
             FileSystemSandboxKind::Unrestricted | FileSystemSandboxKind::ExternalSandbox => {
@@ -1233,6 +1238,7 @@ impl FileSystemSandboxPolicy {
         FileSystemSemanticSignature {
             has_full_disk_read_access: self.has_full_disk_read_access(),
             has_full_disk_write_access: self.has_full_disk_write_access(),
+            include_platform_runtime_defaults: self.include_platform_runtime_defaults(),
             include_platform_defaults: self.include_platform_defaults(),
             readable_roots: sorted_absolute_paths(self.get_readable_roots_with_cwd(cwd)),
             writable_roots: sorted_writable_roots(self.get_writable_roots_with_cwd(cwd)),

codex-rs/protocol/src/protocol.rs

@@ -4218,8 +4218,31 @@ mod tests {
         }]);
         assert!(read_only.has_full_disk_read_access());
         assert!(!read_only.has_full_disk_write_access());
+        assert!(!read_only.include_platform_runtime_defaults());
         assert!(!read_only.include_platform_defaults());
 
+        let read_only_with_minimal_runtime = FileSystemSandboxPolicy::restricted(vec![
+            FileSystemSandboxEntry {
+                path: FileSystemPath::Special {
+                    value: FileSystemSpecialPath::Root,
+                },
+                access: FileSystemAccessMode::Read,
+            },
+            FileSystemSandboxEntry {
+                path: FileSystemPath::Special {
+                    value: FileSystemSpecialPath::Minimal,
+                },
+                access: FileSystemAccessMode::Read,
+            },
+        ]);
+        assert!(read_only_with_minimal_runtime.has_full_disk_read_access());
+        assert!(read_only_with_minimal_runtime.include_platform_runtime_defaults());
+        assert!(!read_only_with_minimal_runtime.include_platform_defaults());
+        assert!(!read_only.is_semantically_equivalent_to(
+            &read_only_with_minimal_runtime,
+            std::path::Path::new("/")
+        ));
+
         let writable = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
             path: FileSystemPath::Special {
                 value: FileSystemSpecialPath::Root,