ADR 025 Fixed Plugin Sandbox and Legacy Migration - joeroberts/release-radar GitHub Wiki

  • ID: ADR-025
  • Status: Accepted
  • Date: 2026-08-28
  • Date meaning: Original dated decision/source section; extraction recorded 2026-10-02.
  • Implementation: No implementation information was recorded in the source status; tickets own progress.
  • Approval qualification: Recorded accepted decision; dated delivery conditions are historical, not new execution authorization.

Context

The fixed plugin helper requires narrowly bounded local access and exact legacy-entry recognition for the recorded Codex CLI integration.

Decision

Live signed-app testing established that macOS rejects a sandboxed application registering an unsandboxed SMAppService login-item helper. The production helper therefore remains sandboxed. The owner approved the minimum local, single-user exceptions needed by the installed Codex CLI: read-write access to ~/.codex/; read-only access to ~/.cache/codex-runtimes/codex-primary-runtime/plugins/openai-primary-runtime/ and ~/Documents/dev/joeroberts/ai-tools/integrations/codex/; read-only access to /private/var/empty/; and Mach lookup of com.apple.security.syspolicy. The two marketplace roots are required because this installed CLI reads every configured marketplace even when Release Radar issues a targeted marketplace or plugin command. The helper still has no network, database, project-wide, Keychain, credential, bookmark, or app-group access, and ~/.codex/ remains its only writable filesystem area. A request for any additional unrelated root requires a new owner decision.

SMAppService may launch the helper with a relative argv[0]. The helper uses _NSGetExecutablePath to locate its own signed bundle and derive the bundled marketplace root instead of interpreting that relative argument as a path. This decision establishes only the helper's minimum sandbox access needed for the fixed CLI operations; the four-method XPC surface, exact-entry migration, official-CLI ownership, and local-only runtime boundary are unchanged.

The plugin and marketplace retain the single canonical product identity release-radar. The plugin-provided MCP server uses machine identifier release_radar, which is required for Codex to form a callable tool namespace. It is an internal identifier in the one plugin, not a second plugin or durable product alias. A pre-existing owner-configured release-radar MCP entry is eligible for one-time replacement only when supported codex mcp get release-radar --json output proves that it is enabled STDIO with no disabled reason, arguments, working directory, or non-empty environment and its command is exactly /Applications/ReleaseRadar.app/Contents/Helpers/ReleaseRadarAgentTools. An absent entry is also allowed. Additional CLI fields are tolerated only when they do not contradict the required semantics; malformed, duplicate, or contradictory values fail closed. Any other same-name entry fails closed.