From 5ab0269ba077c7d61de4dc153d68eba39c0103e2 Mon Sep 17 00:00:00 2001
From: viyatb-oai <viyatb@openai.com>
Date: Mon, 9 Mar 2026 21:50:41 -0700
Subject: [PATCH] fix: allow crashpad handshake for macos chromium

---
 codex-rs/core/README.md                   |  5 +++--
 codex-rs/core/src/seatbelt_permissions.rs | 15 ++++++++++++++-
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/codex-rs/core/README.md b/codex-rs/core/README.md
index 76c34842d6..7bf8116938 100644
--- a/codex-rs/core/README.md
+++ b/codex-rs/core/README.md
@@ -38,8 +38,9 @@ Seatbelt also supports macOS permission-profile extensions layered on top of
 - `macos_calendar = true`:
   enables `com.apple.CalendarAgent` mach lookup.
 - `macos_chromium = true`:
-  enables scoped Chromium Mach rendezvous `mach-register` and `mach-lookup`
-  permissions for `org.chromium.Chromium.MachPortRendezvousServer.*`.
+  enables scoped Chromium and Crashpad `mach-register` and `mach-lookup`
+  permissions for `org.chromium.Chromium.MachPortRendezvousServer.*` and
+  `org.chromium.crashpad.child_port_handshake.*`.
 
 ### Linux
 
diff --git a/codex-rs/core/src/seatbelt_permissions.rs b/codex-rs/core/src/seatbelt_permissions.rs
index 99b128f96c..c7d2ea2464 100644
--- a/codex-rs/core/src/seatbelt_permissions.rs
+++ b/codex-rs/core/src/seatbelt_permissions.rs
@@ -112,6 +112,14 @@ pub(crate) fn build_seatbelt_extensions(
             "(allow mach-lookup\n  (global-name-prefix \"org.chromium.Chromium.MachPortRendezvousServer.\"))"
                 .to_string(),
         );
+        clauses.push(
+            "(allow mach-register\n  (global-name-prefix \"org.chromium.crashpad.child_port_handshake.\"))"
+                .to_string(),
+        );
+        clauses.push(
+            "(allow mach-lookup\n  (global-name-prefix \"org.chromium.crashpad.child_port_handshake.\"))"
+                .to_string(),
+        );
     }
 
     if clauses.is_empty() {
@@ -227,7 +235,7 @@ mod tests {
     }
 
     #[test]
-    fn chromium_rendezvous_emits_scoped_mach_rules() {
+    fn chromium_permissions_emit_scoped_mach_rules() {
         let policy = build_seatbelt_extensions(&MacOsSeatbeltProfileExtensions {
             macos_chromium: true,
             ..Default::default()
@@ -239,6 +247,11 @@ mod tests {
                 .policy
                 .contains("org.chromium.Chromium.MachPortRendezvousServer.")
         );
+        assert!(
+            policy
+                .policy
+                .contains("org.chromium.crashpad.child_port_handshake.")
+        );
     }
 
     #[test]