Support project-scoped loopback listener allowlists without enabling allow_local_binding

Start with codex-rs/sandboxing/src/seatbelt.rs, especially the linked lines 283-309, and review related issues #23973, #33227, and #24742. Map how permission profiles are represented and enforced in CLI and Desktop before defining the cross-platform design. Done means project-scoped loopback address and port allowlists work without enabling broader local binding or outbound access.

What variant of Codex are you using?

Codex Desktop and CLI on macOS.

What feature would you like to see?

Add a first-class permission for narrowly allowing loopback listeners by address and port within a named permission profile.

For example, an illustrative configuration might be:

[permissions.workspace-tests.network]
enabled = true
allow_local_binding = false

[[permissions.workspace-tests.network.listeners]]
addresses = ["127.0.0.1", "::1"]
ports = "ephemeral"

This would let tests create local HTTP servers using an OS-assigned port without broadly enabling local binding or access to other local/private-network services.

The setting should:

• Be usable from a trusted project's .codex/config.toml.
• Apply only when that project's permission profile is selected.
• Permit bind() only on the declared loopback addresses and ports.
• Not allow non-loopback listeners.
• Not grant additional outbound access to local or private-network targets.
• Be supported consistently by CLI and Desktop execution.
• Keep the global allow_local_binding = false default intact.

Motivation

Some unit tests create an in-process loopback server:

import socket

server = socket.socket()
server.bind(("127.0.0.1", 0))
print(server.getsockname())

With allow_local_binding = false, this fails with:

PermissionError: [Errno 1] Operation not permitted

Setting allow_local_binding = true permits the tests, but is broader than necessary. The current macOS policy permits wildcard local binds when enabled and also uses the setting for a DNS carve-out (current Seatbelt implementation, PR #17370).

A typed listener allowlist would provide a portable, auditable least-privilege alternative.

Related issues

• #23973 concerns Desktop ignoring allow_local_binding = true.
• #33227 concerns outbound connections to explicitly allowlisted loopback targets.
• #24742 proposes raw user-provided macOS Seatbelt rules. That could offer a platform-specific escape hatch, but not a validated, cross-platform listener permission.