App-server SIGTRAP in v8::base::OS::SetPermissions (V8 isolate init) on Intel Mac / macOS 26 — only under VS Code, CLI works

Summary

On an Intel Mac (x86_64, native, no Rosetta) running macOS 26, the Codex VS Code extension's app-server crashes with signal=SIGTRAP immediately on startup. The error surfaced in the VS Code UI is misleading — the macOS crash report shows the real cause is a crash during V8 isolate initialization (JIT / executable-memory reservation).

Environment

• Hardware: Intel MacBook Pro, x86_64 (native, translated: None)
• OS: macOS 26.5.1
• VS Code extension: openai.chatgpt 26.616.71553-darwin-x64
• Bundled CLI: codex-cli 0.142.0
• Binary has com.apple.security.cs.allow-jit entitlement + hardened runtime; no MDM; no EDR/AV; no DYLD_* injection.

Misleading "Last CLI error"

The UI reports one of these as the "Last CLI error", but all of them are WARNs that merely happen to be the last logged line before the process dies:

• codex_rollout::list: state db discrepancy during find_thread_path_by_id_str_in_subdir: falling_back
• rmcp::service::client: Received unexpected message ... window/logMessage ... "Server started (PID: ...)"
• codex_core_plugins::manifest: ignoring interface.defaultPrompt[0]: prompt must be at most 128 characters (curated ngs-analysis plugin)

None of these are the actual fault.

Actual root cause (from macOS crash report .ips)

exception: EXC_BREAKPOINT (SIGTRAP)
responsibleProc: Code
parentProc: Code Helper (Plugin)

Crashed thread stack:
#0 v8::base::OS::SetPermissions(void*, unsigned long, v8::base::OS::MemoryPermission)
#1 v8::internal::CodeRange::InitReservation(v8::PageAllocator*, unsigned long, bool)
#2 v8::internal::Heap::SetUp(v8::internal::LocalHeap*)
#3 v8::internal::Isolate::Init(...)
#4 v8::internal::Isolate::InitWithSnapshot(...)
#5 v8::internal::Snapshot::Initialize(v8::internal::Isolate*)
#6 v8::Isolate::Initialize(...)
#7 v8::Isolate::New(v8::Isolate::CreateParams const&)
#8 v8::isolate::Isolate::new::h73bb8a3ceb41a1b1

The process dies in v8::base::OS::SetPermissions while reserving executable (W^X / JIT) memory during v8::Isolate::New.

Key diagnostic finding

The crash only happens when the app-server is spawned by VS Code (parentProc: Code Helper (Plugin)).

Running the exact same bundled binary directly from a shell — <ext>/bin/macos-x86_64/codex app-server driven over stdio with initialize, thread/new, thread/list, and MCP server init — never crashes (exit code 0, no new crash report generated). I confirmed multiple times that my shell-spawned runs produced zero new .ips reports, while every VS Code launch produced one.

So this is a JIT / executable-memory reservation failure in the embedded V8, specific to the process environment that VS Code's Electron helper passes to the child on Intel macOS 26. MallocNanoZone=0 (injected by VS Code) alone does not reproduce it from a shell.

Ruled out

config.toml, thread/state DB (state_5.sqlite, session_index.jsonl), OAuth, MCP servers, and the ngs-analysis curated plugin — none of these touch the V8 init path, and modifying/resetting them does not change the crash.

Workaround found

Downgrading the extension to 26.602.71036 (bundles CLI 0.137.0-alpha.4) — per the lead in #28330. Running Codex via the CLI in a terminal also works (it never initializes V8).

Related

• #21734 (state db discrepancy — same red-herring warning)
• #28330 (older extension 26.602.71036 reported working)
• Community thread: same setup (Intel MacBook Pro), same crash, no confirmed fix.