macOS Codex app updater times out waiting for Sparkle progress helper

What version of the Codex App are you using (From “About Codex” dialog)?

Before update: 26.415.40636, build 1799. After workaround: 26.422.21637, build 2056.

What subscription do you have?

Pro

What platform is your computer?

Darwin arm64 arm64; macOS 26.3; Apple Silicon / M4 Pro

What issue are you seeing?

The Codex desktop app repeatedly failed to update in-app with:

An error occurred while running the updater. Please try again later.

The repeated Sparkle error was:

Error Domain=SUSparkleErrorDomain Code=4005
NSUnderlyingError = Error Domain=SUSparkleErrorDomain Code=10 "Timeout: agent connection was never initiated"

I used Codex itself to troubleshoot the failure locally by inspecting Codex logs, Sparkle logs, macOS unified logs, launchd behavior, and code-signing state.

The update eventually succeeded only when I repeatedly forced Codex's Sparkle progress helper to start during the update window:

launchctl kickstart -k gui/<uid>/com.openai.codex-sparkle-progress

That points to a Sparkle helper launch/ordering issue rather than a damaged app bundle or a simple permissions problem.

What steps can reproduce the bug?

1. Open Codex desktop on macOS.
2. Trigger the in-app update flow.
3. Wait for Sparkle/Autoupdate to run.
4. The update downloads, extracts, and verifies, but then fails with the generic updater error.

Observed log sequence from redacted unified logs:

Codex activates: com.openai.codex-spki
launchd spawns: com.openai.codex-sparkle-updater
Autoupdate starts and registers:
  com.openai.codex-spki
  com.openai.codex-spkp
Autoupdate extracts the update ZIP
Autoupdate verifies: OK: EdDSA signature is correct
Autoupdate later logs:
  Error: Timeout: agent connection was never initiated
Codex later activates:
  com.openai.codex-spks
launchd spawns:
  com.openai.codex-sparkle-progress
Updater starts too late and fails to look up:
  com.openai.codex-spkp
with:
  No such process
Updater logs:
  Agent failed..
  Agent Invalidating without having the chance to reply to installer

The workaround was to keep com.openai.codex-sparkle-progress alive/started while the update was running. After that, the update completed successfully.

What is the expected behavior?

The in-app updater should download, verify, install, and relaunch Codex without requiring manual download or launchd intervention.

Additional information

I have a redacted support bundle ready to attach:

codex-updater-bug-report-20260424-minimal-redacted.zip

It excludes full Codex desktop logs and only includes redacted updater-specific excerpts. I scanned it for usernames, local paths, repo names, SSH paths, GitHub hostnames, emails, auth headers, tokens, passwords/secrets, session/request/conversation IDs, and private LAN IPs before preparing it.

The installed app bundle and the transient cached Sparkle Updater.app both verified successfully with codesign/spctl. The failure appears to occur after archive extraction and EdDSA verification, during the helper/XPC handoff.

codex-updater-bug-report-20260424-minimal-redacted.zip