macOS: session init fails loading AGENTS.md instructions under a default_permissions filesystem profile (fs sandbox helper EPERM)

Summary

With a custom permission profile set as default_permissions, codex-cli 0.150.1 on macOS fails to initialize any session because the fs sandbox helper that loads AGENTS.md instructions for environment local cannot start. The same config initialized fine on 0.145.x.

Environment

• codex-cli 0.150.1 (Homebrew cask, binary at /opt/homebrew/bin/codex)
• macOS Darwin 25.6.0

Repro

Isolated home with only auth.json and this config.toml:

approval_policy = "never"
default_permissions = "agent-eval"

[permissions.agent-eval]
description = "Isolated agent evaluation"

[permissions.agent-eval.filesystem]
":minimal" = "read"

[permissions.agent-eval.filesystem.":workspace_roots"]
"." = "write"

[permissions.agent-eval.network]
enabled = false

From an empty workspace directory:

env HOME=$ISOLATED CODEX_HOME=$ISOLATED codex debug prompt-input -c "skills.config=[]" "preflight"

Fails with:

Error: Fatal error: Failed to initialize session: failed to load AGENTS.md instructions for environment `local`: fs sandbox helper failed with status exit status: 71: sandbox-exec: execvp() of '/opt/homebrew/bin/codex' failed: Operation not permitted

The helper's own profile apparently cannot execute the codex binary from /opt/homebrew, so any default_permissions filesystem profile whose read set excludes the install prefix makes session init fail even though no project doc exists to load.

When the same invocation runs under an outer sandbox-exec wrapper (a common pattern for evaluation harnesses fencing writes), the failure becomes the nested-sandbox variant:

fs sandbox helper failed with status exit status: 71: sandbox-exec: sandbox_apply: Operation not permitted

That nested aspect looks like the same class as #26262 and #30615.

Expected

Session init should not require the instruction-loading helper to re-exec codex from a path outside the profile's read set, and an absent or unreadable project doc should degrade to skipping instructions rather than failing the whole session.

Workaround

project_doc_max_bytes = 0 in the same config bypasses the loader entirely; global CODEX_HOME/AGENTS.md instructions still load normally, so only environment/project doc discovery is affected.

Drafted with AI assistance (Claude Code, claude-fable-5). Reviewed by @downtempo.

Start with session initialization and the AGENTS.md instruction loader for the local environment, then inspect how the fs sandbox helper re-executes codex under default_permissions. Reproduce the command with the supplied config and an empty workspace, including the nested sandbox variant. Done means session initialization no longer fails when the install prefix is outside the profile's read set or when project instructions are absent or unreadable.