›_ Codex Issues
Codex Issues / #27891

macOS Computer Use app-group entitlement/provisioning mismatch

Open 💬 2 comments Opened Jun 12, 2026 by luvi-hub
💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

Summary

On macOS Intel x64, the Codex App fails to start the managed Computer Use service. As a result, Computer Use / Locked Computer Use cannot be enabled even after reinstalling the official Intel DMG and granting Accessibility + Screen Recording permissions.

This appears to be a packaging/signing/provisioning issue in the x64 app bundle: sky.node and the main app declare com.apple.security.application-groups for 2DC432GLL2.com.openai.sky.CUAService, but the embedded provisioning profile does not include that entitlement. macOS then rejects the Computer Use service startup.

Environment

  • Platform: macOS Intel x64
  • Codex App version: 26.609.30741
  • CFBundleVersion: 3808
  • Installer: Codex-latest-x64.dmg
  • DMG SHA256: fc9061de031b8e4918066f4db4c956482a5df2b424cd863552a3188cc938b5be
  • App path: /Applications/Codex.app

User Impact

  • Computer Use service fails to start.
  • Locked Computer Use cannot be enabled.
  • /Library/Security/SecurityAgentPlugins remains empty.
  • Accessibility and Screen Recording permissions are already granted.
  • Reinstalling the official x64 DMG does not resolve the issue.

Codex App Log

Latest log path pattern:

~/Library/Logs/com.openai.codex/2026/06/12/codex-desktop-a66c2cf7-8f06-4dfe-977f-239f6a829e68-94208-t0-i1-140959-0.log

Relevant app log:

Failed to reconcile managed Computer Use service appshotsEnabled=true
errorMessage="Failed to spawn managed Computer Use service"

macOS System Log Evidence

Captured around app startup:

taskgated-helper: com.openai.codex: Unsatisfied entitlements: com.apple.security.application-groups

launchd: failed lookup: name = com.openai.codex-spks, requestor = Codex, error = 3: No such process

AMFI: constraint violation /Applications/Codex.app/Contents/Resources/native/sky.node has entitlements but is not a main binary

taskgated-helper: Disallowing sky because no eligible provisioning profiles found

trustd: Entitlement com.apple.security.application-groups = (
    "2DC432GLL2.com.openai.sky.CUAService"
) is ignored because of invalid application signature or incorrect provisioning profile

Verification Commands

These pass when run in the normal system permission context:

codesign --verify --deep --strict --verbose=6 /Applications/Codex.app
codesign --verify --strict --verbose=6 /Applications/Codex.app/Contents/Resources/native/sky.node
codesign --verify --strict --verbose=6 /Applications/Codex.app/Contents/MacOS/Codex

However, Computer Use still fails because the embedded provisioning profile does not appear to include com.apple.security.application-groups, while the main app and sky.node declare the 2DC432GLL2.com.openai.sky.CUAService application group.

Expected Behavior

The official Codex-latest-x64.dmg should include a valid signing/provisioning setup for Computer Use on Intel macOS, or the bundle should avoid declaring unsupported entitlements from a non-main binary.

Actual Behavior

The managed Computer Use service fails to spawn on app startup, and Locked Computer Use cannot be enabled.

View original on GitHub ↗

2 Comments

github-actions[bot] contributor · 2 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

  • #26842
  • #27176

Powered by Codex Action

luvi-hub · 2 months ago

Template-aligned details for the Codex App Bug form:

What version of the Codex App are you using (From “About Codex” dialog)?

26.609.30741
CFBundleVersion: 3808
Installer: Codex-latest-x64.dmg
DMG SHA256: fc9061de031b8e4918066f4db4c956482a5df2b424cd863552a3188cc938b5be

What subscription do you have?

Not specified in this public issue.

What platform is your computer?

macOS Intel x64
uname -m: x86_64
arch: i386
Codex binary architecture: Mach-O 64-bit executable x86_64
sky.node architecture: Mach-O 64-bit bundle x86_64

What issue are you seeing?

Computer Use / Locked Computer Use cannot be enabled on the macOS Intel x64 Codex App. The managed Computer Use service fails to spawn at startup even after reinstalling the official Intel DMG and granting Accessibility + Screen Recording permissions.

App log:

Failed to reconcile managed Computer Use service appshotsEnabled=true
errorMessage="Failed to spawn managed Computer Use service"

macOS system log:

taskgated-helper: com.openai.codex: Unsatisfied entitlements: com.apple.security.application-groups
launchd: failed lookup: name = com.openai.codex-spks, requestor = Codex, error = 3: No such process
AMFI: constraint violation /Applications/Codex.app/Contents/Resources/native/sky.node has entitlements but is not a main binary
taskgated-helper: Disallowing sky because no eligible provisioning profiles found
trustd: Entitlement com.apple.security.application-groups = 2DC432GLL2.com.openai.sky.CUAService is ignored because of invalid application signature or incorrect provisioning profile

What steps can reproduce the bug?

  1. Install the official Intel build from Codex-latest-x64.dmg.
  2. Launch /Applications/Codex.app.
  3. Grant macOS Accessibility and Screen Recording permissions.
  4. Open Codex settings > Computer Use.
  5. Try to enable Locked Computer Use.
  6. Observe that the setting cannot be enabled and the Computer Use service fails to spawn.

Feedback ID:

019ebb3d-c6e5-79c3-9da8-ce6f6e9717d3

Relevant log path:

~/Library/Logs/com.openai.codex/2026/06/12/codex-desktop-a66c2cf7-8f06-4dfe-977f-239f6a829e68-94208-t0-i1-140959-0.log

What is the expected behavior?

The official macOS Intel x64 Codex build should include a signing/provisioning setup that allows the Computer Use service to start. Locked Computer Use should be enableable after the documented permissions are granted.

Additional information

The app bundle verifies successfully in a normal system permission context:

codesign --verify --deep --strict --verbose=6 /Applications/Codex.app
codesign --verify --strict --verbose=6 /Applications/Codex.app/Contents/Resources/native/sky.node
codesign --verify --strict --verbose=6 /Applications/Codex.app/Contents/MacOS/Codex

However, the embedded provisioning profile appears not to include com.apple.security.application-groups, while the main app and sky.node declare 2DC432GLL2.com.openai.sky.CUAService. This causes macOS to reject the Computer Use service path.