Unusual choice of macos seatbelt sandbox applying to the main gemini cli process

[dyamparala-sc]

I would have expected the sandboxing to be applicable only to any sub processes or tools spawned by gemini cli. That is how openai's codex cli works if I'm not mistaken. Am I mistaken here?