 
     // Allow writing only to certain directories.
     var writableDirectoriesExpression = writableDirectories.map {
-        "(subpath \"\(resolveSymlinks($0).pathString)\")"
+        "(subpath \(resolveSymlinks($0).quotedAsSubpathForSandboxProfile))"
     }
     // The following accesses are only needed when interpreting the manifest (versus running a compiled version).
     if strictness == .manifest_pre_53 {

    return contents
}

extension TSCUtility.Platform {
    fileprivate static let threadSafeDarwinCacheDirectories = ThreadSafeArrayStore<AbsolutePath>(Self.darwinCacheDirectories())
}

    else if strictness == .writableTemporaryDirectory {
        writableDirectoriesExpression.append("(subpath \"/private/tmp\")")
        if let tmpDir = try? TSCBasic.determineTempDirectory() {
            writableDirectoriesExpression += ["(subpath \(resolveSymlinks(tmpDir).quotedAsSubpathForSandboxProfile))"]
        }
    }

