evawong-oai 5733e00c79 [sandboxing] Remove Darwin user cache write from Seatbelt network policy (#21443) ...

## Summary

1. Removes the broad `DARWIN_USER_CACHE_DIR` write rule from the macOS
Seatbelt network policy.
2. Removes the now unused policy parameter plumbing for that cache path.
3. Adds sandboxing coverage that keeps `com.apple.trustd.agent` for TLS
while rejecting the cache write rule.

## Why

This closes the exact cache poisoning boundary. The earlier `gh` TLS
issue is now covered by trustd access, so the cache write is no longer
needed.

## Validation

1. Rust formatting passed.
2. The sandboxing crate tests passed.
3. Local macOS Seatbelt repro with patched policy passed. `gh api`
returned `21442` without the cache write rule.

2026-05-08 16:43:07 +00:00

..

src

[sandboxing] Remove Darwin user cache write from Seatbelt network policy (#21443)

2026-05-08 16:43:07 +00:00

BUILD.bazel

Move macOS sandbox builders into codex-sandboxing (#15593)

2026-03-23 21:26:35 -07:00

Cargo.toml

Disable empty Cargo test targets (#21584)

2026-05-07 15:44:17 -07:00