gpt-5.5 Code Mode crashes with SIGTRAP (EXC_BREAKPOINT in v8::Isolate::New) on macOS — hardened runtime blocks V8 JIT

Summary

On macOS (Intel), starting any Code Mode tool call with gpt-5.5 crashes the codex process with SIGTRAP / EXC_BREAKPOINT. The crash is inside V8 isolate creation (v8::Isolate::New → CodeRange::InitReservation → OS::SetPermissions), because the shipped codex binary is signed with hardened runtime, which prevents V8 from allocating JIT-executable memory.

In the VS Code extension this surfaces as:

Codex process errored: Codex app-server process exited unexpectedly
(code=unknown, signal=SIGTRAP). Last CLI error: codex_rollout::list: state db
discrepancy during find_thread_path_by_id_str_in_subdir: falling_back

(The state db discrepancy ... falling_back line is an unrelated warning — it's just the last log line before the V8 trap. The real fault is the SIGTRAP.)

Why gpt-5.5 specifically

gpt-5.5 advertises tool_mode: "code_mode_only" in the models metadata, so every tool execution spins up a V8 isolate to run the tool call as JS. gpt-5.4 (no tool_mode) never initializes V8 and works fine. A gpt-5.5 turn that only returns text (no tool call) also works — the crash requires an actual tool execution, which is why it can look intermittent.

features.code_mode=false / features.code_mode_only=false do not avoid it (model metadata forces code mode). V8_FLAGS=--jitless is not honored.

Environment

• codex-cli 0.142.3 (bundled in VS Code extension openai.chatgpt 26.623.x, darwin-x64) and 0.142.4 (npm @openai/codex) — both crash.
• macOS 26.5.1 (build 25F80), Intel Core i7-9750H (native x86_64, no Rosetta).
• Bundled binary signature: codesign shows flags=0x10000(runtime) (hardened runtime), entitlement com.apple.security.cs.allow-jit present.

Crash backtrace (faulting thread)

termination: Trace/BPT trap: 5 | EXC_BREAKPOINT / SIGTRAP
  codex  v8::base::OS::SetPermissions(void*, unsigned long, v8::base::OS::MemoryPermission)
  codex  v8::internal::CodeRange::InitReservation(v8::PageAllocator*, unsigned long, bool)
  codex  v8::internal::Heap::SetUp(v8::internal::LocalHeap*)
  codex  v8::internal::Isolate::Init(...)
  codex  v8::internal::Isolate::InitWithSnapshot(...)
  codex  v8::internal::Snapshot::Initialize(v8::internal::Isolate*)
  codex  v8::Isolate::Initialize(v8::Isolate*, v8::Isolate::CreateParams const&)
  codex  v8::Isolate::New(v8::Isolate::CreateParams const&)
  codex  v8::isolate::Isolate::new::h...

(from ~/Library/Logs/DiagnosticReports/codex-*.ips)

Reproduce

1. macOS Intel, default model gpt-5.5.
2. Run a turn that executes a tool, e.g.:

``
codex exec --skip-git-repo-check "run the shell command 'echo hi' and show me the output"
``

1. Process dies with Trace/BPT trap: 5 (exit 133). Same via the VS Code extension app-server on any tool call.

A text-only turn (codex exec "say: OK") does not crash (V8 never initializes).

Root cause

allow-jit alone is insufficient for this V8 build under hardened runtime on macOS — CodeRange::InitReservation calls OS::SetPermissions to map executable memory and V8's internal CHECK traps when it fails. The binary likely also needs com.apple.security.cs.allow-unsigned-executable-memory (and/or disable-executable-page-protection), or V8 must use MAP_JIT + pthread_jit_write_protect_np correctly.

Workaround (confirmed working)

Ad-hoc re-sign the codex Mach-O without hardened runtime + add executable-memory entitlements (flags 0x10000(runtime) → 0x2(adhoc)):

cat > ent.plist <<'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "https://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict>
<key>com.apple.security.cs.allow-jit</key><true/>
<key>com.apple.security.cs.allow-unsigned-executable-memory</key><true/>
<key>com.apple.security.cs.disable-executable-page-protection</key><true/>
</dict></plist>
EOF
codesign --remove-signature <codex-binary>
codesign --force --sign - --entitlements ent.plist <codex-binary>

After this, gpt-5.5 Code Mode tool calls run fine (exit 0). Has to be re-applied after every update since updates restore the hardened-runtime signature.

Suggested fix

Ship the macOS codex binary with the entitlements V8 needs for JIT under hardened runtime (notarization allows allow-unsigned-executable-memory), or build V8 to use MAP_JIT so plain allow-jit suffices.