diff --git a/codex-rs/app-server-protocol/schema/typescript/FileSystemAccessMode.ts b/codex-rs/app-server-protocol/schema/typescript/FileSystemAccessMode.ts
new file mode 100644
index 0000000000..ccaa07a8bf
--- /dev/null
+++ b/codex-rs/app-server-protocol/schema/typescript/FileSystemAccessMode.ts
@@ -0,0 +1,12 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+/**
+ * Access mode for a filesystem entry.
+ *
+ * When two equally specific entries target the same path, we compare these by
+ * conflict precedence rather than by capability breadth: `none` beats
+ * `write`, and `write` beats `read`.
+ */
+export type FileSystemAccessMode = "read" | "write" | "none";
diff --git a/codex-rs/app-server-protocol/schema/typescript/FileSystemPath.ts b/codex-rs/app-server-protocol/schema/typescript/FileSystemPath.ts
new file mode 100644
index 0000000000..3b022f1744
--- /dev/null
+++ b/codex-rs/app-server-protocol/schema/typescript/FileSystemPath.ts
@@ -0,0 +1,7 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { AbsolutePathBuf } from "./AbsolutePathBuf";
+import type { FileSystemSpecialPath } from "./FileSystemSpecialPath";
+
+export type FileSystemPath = { "type": "path", path: AbsolutePathBuf, } | { "type": "special", value: FileSystemSpecialPath, };
diff --git a/codex-rs/app-server-protocol/schema/typescript/FileSystemSandboxEntry.ts b/codex-rs/app-server-protocol/schema/typescript/FileSystemSandboxEntry.ts
new file mode 100644
index 0000000000..f37cd0d63e
--- /dev/null
+++ b/codex-rs/app-server-protocol/schema/typescript/FileSystemSandboxEntry.ts
@@ -0,0 +1,7 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { FileSystemAccessMode } from "./FileSystemAccessMode";
+import type { FileSystemPath } from "./FileSystemPath";
+
+export type FileSystemSandboxEntry = { path: FileSystemPath, access: FileSystemAccessMode, };
diff --git a/codex-rs/app-server-protocol/schema/typescript/FileSystemSpecialPath.ts b/codex-rs/app-server-protocol/schema/typescript/FileSystemSpecialPath.ts
new file mode 100644
index 0000000000..8ba7b433a6
--- /dev/null
+++ b/codex-rs/app-server-protocol/schema/typescript/FileSystemSpecialPath.ts
@@ -0,0 +1,5 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type FileSystemSpecialPath = { "kind": "root" } | { "kind": "minimal" } | { "kind": "current_working_directory" } | { "kind": "project_roots", subpath?: string, } | { "kind": "tmpdir" } | { "kind": "slash_tmp" } | { "kind": "unknown", path: string, subpath?: string, };
diff --git a/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__approval_overlay__tests__approval_overlay_additional_permissions_special_entries_prompt.snap b/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__approval_overlay__tests__approval_overlay_additional_permissions_special_entries_prompt.snap
new file mode 100644
index 0000000000..0e868386cc
--- /dev/null
+++ b/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__approval_overlay__tests__approval_overlay_additional_permissions_special_entries_prompt.snap
@@ -0,0 +1,16 @@
+---
+source: tui/src/bottom_pane/approval_overlay.rs
+expression: "normalize_snapshot_paths(render_overlay_lines(&view, 120))"
+---
+  Would you like to run the following command?
+
+  Reason: need broader filesystem access
+
+  Permission rule: write `:root`; deny `/tmp/secret.txt`
+
+  $ cat /tmp/readme.txt
+
+› 1. Yes, proceed (y)
+  2. No, and tell Codex what to do differently (esc)
+
+  Press enter to confirm or esc to cancel
diff --git a/codex-rs/tui_app_server/src/bottom_pane/snapshots/codex_tui_app_server__bottom_pane__approval_overlay__tests__approval_overlay_additional_permissions_special_entries_prompt.snap b/codex-rs/tui_app_server/src/bottom_pane/snapshots/codex_tui_app_server__bottom_pane__approval_overlay__tests__approval_overlay_additional_permissions_special_entries_prompt.snap
new file mode 100644
index 0000000000..5f10f42df4
--- /dev/null
+++ b/codex-rs/tui_app_server/src/bottom_pane/snapshots/codex_tui_app_server__bottom_pane__approval_overlay__tests__approval_overlay_additional_permissions_special_entries_prompt.snap
@@ -0,0 +1,16 @@
+---
+source: tui_app_server/src/bottom_pane/approval_overlay.rs
+expression: "normalize_snapshot_paths(render_overlay_lines(&view, 120))"
+---
+  Would you like to run the following command?
+
+  Reason: need broader filesystem access
+
+  Permission rule: write `:root`; deny `/tmp/secret.txt`
+
+  $ cat /tmp/readme.txt
+
+› 1. Yes, proceed (y)
+  2. No, and tell Codex what to do differently (esc)
+
+  Press enter to confirm or esc to cancel