sandbox: allow writing xcrun db

[cho-m]

Without permission, clang outputs multiple errors like:

clang: error: couldn't create cache file '/var/folders/*/*/T/xcrun_db-*' (errno=Operation not permitted)

Formula in following PR can reproduce this behavior

• various(crystal dependents): add deny_network_access! and fetch homebrew-core#301831
• https://github.com/Homebrew/homebrew-core/actions/runs/33590971181/job/100125992369?pr=301831#step:4:70

Sometimes these are non-impacting, but other times they will fail the build. One example is building nokogiri gem which fails with

gumbo.c:32:10: fatal error: 'nokogiri_gumbo.h' file not found
   32 | #include "nokogiri_gumbo.h"
      |          ^~~~~~~~~~~~~~~~~~

This had been covered by following regex when not using def fetch

brew/Library/Homebrew/extend/os/mac/sandbox.rb

Line 50 in a8820d0

allow_write path: "^/private/var/folders/[^/]+/[^/]+/[C,T]/", type: :regex

For now, went with more restrictive regex to avoid unnecessary permissions until someone confirms it is needed.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

---

[Copilot]

🟡 Changes recommended

The regex permits broader writes than intended and lacks regression coverage.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Allows sandboxed macOS builds to write xcrun cache database files, preventing compiler failures.

Changes:

• Adds a targeted writable-path regex for temporary xcrun_db files.

File summaries

File	Description
Library/Homebrew/extend/os/mac/sandbox.rb	Adds the macOS sandbox permission.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 2
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

The sandbox permission is narrowly scoped and covered by the updated test.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[MikeMcQuaid]

Thanks!