test: replace vendor-specific mach service examples

Co-authored-by: Codex <noreply@openai.com>

codex-rs/app-server-protocol/src/protocol/v2.rs

@@ -5908,7 +5908,7 @@ mod tests {
                     "automations": {
                         "bundle_ids": ["com.apple.Notes"]
                     },
-                    "machServices": ["2BUA8C4S2C.com.1password.browser-helper"],
+                    "machServices": ["com.vendor.helper"],
                     "launchServices": false,
                     "accessibility": false,
                     "calendar": false,
@@ -5937,7 +5937,7 @@ mod tests {
                 }),
             Some((
                 CoreMacOsAutomationPermission::BundleIds(vec!["com.apple.Notes".to_string(),]),
-                vec!["2BUA8C4S2C.com.1password.browser-helper".to_string()],
+                vec!["com.vendor.helper".to_string()],
                 false,
                 CoreMacOsContactsPermission::ReadOnly,
             ))
@@ -6064,20 +6064,16 @@ mod tests {
             ),
             (
                 json!({
-                    "machServices": ["2BUA8C4S2C.com.1password.browser-helper"],
+                    "machServices": ["com.vendor.helper"],
                 }),
                 Some(GrantedMacOsPermissions {
-                    mach_services: Some(vec![
-                        "2BUA8C4S2C.com.1password.browser-helper".to_string(),
-                    ]),
+                    mach_services: Some(vec!["com.vendor.helper".to_string()]),
                     ..Default::default()
                 }),
                 Some(CoreMacOsSeatbeltProfileExtensions {
                     macos_preferences: CoreMacOsPreferencesPermission::None,
                     macos_automation: CoreMacOsAutomationPermission::None,
-                    macos_mach_services: vec![
-                        "2BUA8C4S2C.com.1password.browser-helper".to_string(),
-                    ],
+                    macos_mach_services: vec!["com.vendor.helper".to_string()],
                     macos_launch_services: false,
                     macos_accessibility: false,
                     macos_calendar: false,

codex-rs/core/src/sandboxing/macos_permissions_tests.rs

@@ -31,7 +31,7 @@ fn merge_extensions_widens_permissions() {
             "com.apple.Calendar".to_string(),
         ]),
         macos_mach_services: vec![
-            "2BUA8C4S2C.com.1password.browser-helper".to_string(),
+            "com.vendor.helper".to_string(),
             "com.apple.logd".to_string(),
         ],
         macos_launch_services: true,
@@ -53,7 +53,7 @@ fn merge_extensions_widens_permissions() {
                 "com.apple.Notes".to_string(),
             ]),
             macos_mach_services: vec![
-                "2BUA8C4S2C.com.1password.browser-helper".to_string(),
+                "com.vendor.helper".to_string(),
                 "com.apple.logd".to_string(),
             ],
             macos_launch_services: true,

codex-rs/core/src/sandboxing/mod_tests.rs

@@ -405,7 +405,7 @@ fn effective_permissions_merge_macos_extensions_with_additional_permissions() {
                 macos_automation: MacOsAutomationPermission::BundleIds(vec![
                     "com.apple.Notes".to_string(),
                 ]),
-                macos_mach_services: vec!["2BUA8C4S2C.com.1password.browser-helper".to_string()],
+                macos_mach_services: vec!["com.vendor.helper".to_string()],
                 macos_launch_services: true,
                 macos_accessibility: true,
                 macos_calendar: true,
@@ -425,7 +425,7 @@ fn effective_permissions_merge_macos_extensions_with_additional_permissions() {
                 "com.apple.Notes".to_string(),
             ]),
             macos_mach_services: vec![
-                "2BUA8C4S2C.com.1password.browser-helper".to_string(),
+                "com.vendor.helper".to_string(),
                 "com.apple.logd".to_string(),
             ],
             macos_launch_services: true,

codex-rs/core/src/seatbelt_permissions_tests.rs

@@ -68,18 +68,14 @@ fn automation_bundle_ids_are_normalized_and_scoped() {
 fn mach_services_emit_mach_lookup_clauses() {
     let policy = build_seatbelt_extensions(&MacOsSeatbeltProfileExtensions {
         macos_mach_services: vec![
-            " 2BUA8C4S2C.com.1password.browser-helper ".to_string(),
+            " com.vendor.helper ".to_string(),
             "com.apple.logd".to_string(),
             "bad service".to_string(),
             "com.apple.logd".to_string(),
         ],
         ..Default::default()
     });
-    assert!(
-        policy
-            .policy
-            .contains("2BUA8C4S2C.com.1password.browser-helper")
-    );
+    assert!(policy.policy.contains("com.vendor.helper"));
     assert!(policy.policy.contains("com.apple.logd"));
     assert!(!policy.policy.contains("bad service"));
 }

codex-rs/core/src/tools/spec.rs

@@ -525,7 +525,7 @@ fn create_macos_permissions_schema() -> JsonSchema {
                 JsonSchema::Array {
                     items: Box::new(JsonSchema::String { description: None }),
                     description: Some(
-                        "Exact macOS global Mach service names to allow for mach-lookup (for example, 1Password app integration uses `2BUA8C4S2C.com.1password.browser-helper`)."
+                        "Exact macOS global Mach service names to allow for mach-lookup (for example, `com.vendor.helper`)."
                             .to_string(),
                     ),
                 },

codex-rs/protocol/src/models.rs

@@ -1729,7 +1729,7 @@ mod tests {
             serde_json::from_value::<MacOsSeatbeltProfileExtensions>(serde_json::json!({
                 "preferences": "read_write",
                 "automations": ["com.apple.Notes"],
-                "mach_services": ["2BUA8C4S2C.com.1password.browser-helper"],
+                "mach_services": ["com.vendor.helper"],
                 "launch_services": true,
                 "accessibility": true,
                 "calendar": true,
@@ -1745,7 +1745,7 @@ mod tests {
                 macos_automation: MacOsAutomationPermission::BundleIds(vec![
                     "com.apple.Notes".to_string(),
                 ]),
-                macos_mach_services: vec!["2BUA8C4S2C.com.1password.browser-helper".to_string()],
+                macos_mach_services: vec!["com.vendor.helper".to_string()],
                 macos_launch_services: true,
                 macos_accessibility: true,
                 macos_calendar: true,
@@ -1760,7 +1760,7 @@ mod tests {
         let permissions =
             serde_json::from_value::<MacOsSeatbeltProfileExtensions>(serde_json::json!({
                 "mach_services": [
-                    "2BUA8C4S2C.com.1password.browser-helper",
+                    "com.vendor.helper",
                     "com.apple.logd",
                 ]
             }))
@@ -1772,7 +1772,7 @@ mod tests {
                 macos_preferences: MacOsPreferencesPermission::ReadOnly,
                 macos_automation: MacOsAutomationPermission::None,
                 macos_mach_services: vec![
-                    "2BUA8C4S2C.com.1password.browser-helper".to_string(),
+                    "com.vendor.helper".to_string(),
                     "com.apple.logd".to_string(),
                 ],
                 macos_launch_services: false,

codex-rs/protocol/src/prompts/permissions/approval_policy/on_request_rule_request_permission.md

@@ -13,7 +13,7 @@ When you need extra sandboxed permissions for one command, use:
   - `file_system.write`: list of paths that need write access
   - `macos.preferences`: `read_only` or `read_write`
   - `macos.automations`: list of bundle IDs that need Apple Events access
-  - `macos.mach_services`: list of exact global Mach service names that need `mach-lookup` (for 1Password desktop app integration, request `2BUA8C4S2C.com.1password.browser-helper`)
+  - `macos.mach_services`: list of exact global Mach service names that need `mach-lookup` (for example, `com.vendor.helper`)
   - `macos.launch_services`: set to `true` to allow Launch Services access
   - `macos.accessibility`: set to `true` to allow accessibility APIs
   - `macos.calendar`: set to `true` to allow Calendar access

codex-rs/tui/src/bottom_pane/approval_overlay.rs

@@ -1429,9 +1429,7 @@ mod tests {
                         "com.apple.Calendar".to_string(),
                         "com.apple.Notes".to_string(),
                     ]),
-                    macos_mach_services: vec![
-                        "2BUA8C4S2C.com.1password.browser-helper".to_string(),
-                    ],
+                    macos_mach_services: vec!["com.vendor.helper".to_string()],
                     macos_launch_services: false,
                     macos_accessibility: true,
                     macos_calendar: true,

codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__approval_overlay__tests__approval_overlay_additional_permissions_macos_prompt.snap

@@ -8,7 +8,7 @@ expression: "render_overlay_lines(&view, 120)"
   Reason: need macOS automation
 
   Permission rule: macOS preferences readwrite; macOS automation com.apple.Calendar, com.apple.Notes; macOS mach
-  services 2BUA8C4S2C.com.1password.browser-helper; macOS accessibility; macOS calendar; macOS reminders
+  services com.vendor.helper; macOS accessibility; macOS calendar; macOS reminders
 
   $ osascript -e 'tell application'