f237fe560d
- Renamed directories: codex-rs -> llmx-rs, codex-cli -> llmx-cli
- Updated package.json files:
- Root: llmx-monorepo
- CLI: @llmx/llmx
- SDK: @llmx/llmx-sdk
- Updated pnpm workspace configuration
- Renamed binary: codex.js -> llmx.js
- Updated environment variables: CODEX_* -> LLMX_*
- Changed repository URLs to valknar/llmx
🤖 Generated with Claude Code
96 lines
2.9 KiB
Plaintext
96 lines
2.9 KiB
Plaintext
(version 1)
|
|
|
|
; inspired by Chrome's sandbox policy:
|
|
; https://source.chromium.org/chromium/chromium/src/+/main:sandbox/policy/mac/common.sb;l=273-319;drc=7b3962fe2e5fc9e2ee58000dc8fbf3429d84d3bd
|
|
; https://source.chromium.org/chromium/chromium/src/+/main:sandbox/policy/mac/renderer.sb;l=64;drc=7b3962fe2e5fc9e2ee58000dc8fbf3429d84d3bd
|
|
|
|
; start with closed-by-default
|
|
(deny default)
|
|
|
|
; child processes inherit the policy of their parent
|
|
(allow process-exec)
|
|
(allow process-fork)
|
|
(allow signal (target same-sandbox))
|
|
|
|
; Allow cf prefs to work.
|
|
(allow user-preference-read)
|
|
|
|
; process-info
|
|
(allow process-info* (target same-sandbox))
|
|
|
|
(allow file-write-data
|
|
(require-all
|
|
(path "/dev/null")
|
|
(vnode-type CHARACTER-DEVICE)))
|
|
|
|
; sysctls permitted.
|
|
(allow sysctl-read
|
|
(sysctl-name "hw.activecpu")
|
|
(sysctl-name "hw.busfrequency_compat")
|
|
(sysctl-name "hw.byteorder")
|
|
(sysctl-name "hw.cacheconfig")
|
|
(sysctl-name "hw.cachelinesize_compat")
|
|
(sysctl-name "hw.cpufamily")
|
|
(sysctl-name "hw.cpufrequency_compat")
|
|
(sysctl-name "hw.cputype")
|
|
(sysctl-name "hw.l1dcachesize_compat")
|
|
(sysctl-name "hw.l1icachesize_compat")
|
|
(sysctl-name "hw.l2cachesize_compat")
|
|
(sysctl-name "hw.l3cachesize_compat")
|
|
(sysctl-name "hw.logicalcpu_max")
|
|
(sysctl-name "hw.machine")
|
|
(sysctl-name "hw.memsize")
|
|
(sysctl-name "hw.ncpu")
|
|
(sysctl-name "hw.nperflevels")
|
|
; Chrome locks these CPU feature detection down a bit more tightly,
|
|
; but mostly for fingerprinting concerns which isn't an issue for codex.
|
|
(sysctl-name-prefix "hw.optional.arm.")
|
|
(sysctl-name-prefix "hw.optional.armv8_")
|
|
(sysctl-name "hw.packages")
|
|
(sysctl-name "hw.pagesize_compat")
|
|
(sysctl-name "hw.pagesize")
|
|
(sysctl-name "hw.physicalcpu")
|
|
(sysctl-name "hw.physicalcpu_max")
|
|
(sysctl-name "hw.tbfrequency_compat")
|
|
(sysctl-name "hw.vectorunit")
|
|
(sysctl-name "kern.hostname")
|
|
(sysctl-name "kern.maxfilesperproc")
|
|
(sysctl-name "kern.maxproc")
|
|
(sysctl-name "kern.osproductversion")
|
|
(sysctl-name "kern.osrelease")
|
|
(sysctl-name "kern.ostype")
|
|
(sysctl-name "kern.osvariant_status")
|
|
(sysctl-name "kern.osversion")
|
|
(sysctl-name "kern.secure_kernel")
|
|
(sysctl-name "kern.usrstack64")
|
|
(sysctl-name "kern.version")
|
|
(sysctl-name "sysctl.proc_cputype")
|
|
(sysctl-name "vm.loadavg")
|
|
(sysctl-name-prefix "hw.perflevel")
|
|
(sysctl-name-prefix "kern.proc.pgrp.")
|
|
(sysctl-name-prefix "kern.proc.pid.")
|
|
(sysctl-name-prefix "net.routetable.")
|
|
)
|
|
|
|
; Allow Java to set CPU type grade when required
|
|
(allow sysctl-write
|
|
(sysctl-name "kern.grade_cputype"))
|
|
|
|
; IOKit
|
|
(allow iokit-open
|
|
(iokit-registry-entry-class "RootDomainUserClient")
|
|
)
|
|
|
|
; needed to look up user info, see https://crbug.com/792228
|
|
(allow mach-lookup
|
|
(global-name "com.apple.system.opendirectoryd.libinfo")
|
|
)
|
|
|
|
; Added on top of Chrome profile
|
|
; Needed for python multiprocessing on MacOS for the SemLock
|
|
(allow ipc-posix-sem)
|
|
|
|
(allow mach-lookup
|
|
(global-name "com.apple.PowerManagement.control")
|
|
)
|