Codex Chrome extension stays Disconnected on macOS: native pipe rejects signed host as untrusted-code-signing-identity

What version of the Codex App are you using (From "About Codex" dialog)?

26.623.101652

Additional observed versions:

• Codex app bundle build: 4674
• Bundled Chrome plugin: 26.623.101652
• Codex CLI: 0.142.5
• Codex Chrome Extension: 1.1.5

What subscription do you have?

Unknown / not provided

What platform is your computer?

macOS 15.6, build 24G84, arm64

Google Chrome 149.0.7827.201

What issue are you seeing?

The Codex Chrome Extension remains Disconnected on macOS even though the extension, Chrome profile registration, native messaging host manifest, and host binary all appear to be installed correctly.

Chrome extension popup shows:

Disconnected
Use the Chrome plugin in Codex to connect.
Version v1.1.5

Codex cannot discover the Chrome extension backend:

{
  "list": [],
  "getError": "Error: Browser is not available: extension"
}

The relevant Codex app log shows repeated native pipe authorization failures:

browser-use native pipe rejected socket peer reason=untrusted-code-signing-identity

This still reproduces after fully quitting and restarting both Codex and Chrome.

What steps can reproduce the bug?

1. Use Codex Desktop on macOS arm64.
2. Install / enable the Chrome plugin from Codex.
3. Install the Codex Chrome Extension v1.1.5 in Google Chrome stable.
4. Confirm the extension is installed and enabled in the selected Chrome profile.
5. Confirm the native messaging host manifest exists and is correct.
6. Fully quit and restart both Codex and Chrome.
7. Open the Codex Chrome Extension popup.
8. Try to use the Chrome extension backend from Codex.

Observed result:

• The extension popup remains Disconnected.
• agent.browsers.list() returns [].
• agent.browsers.get("extension") fails with Browser is not available: extension.
• Codex app logs show untrusted-code-signing-identity rejections from browser-use-native-pipe-server.

What is the expected behavior?

The Codex Chrome Extension should connect successfully when:

• The extension is installed and enabled.
• The selected Chrome profile is correct.
• The native messaging host manifest is correct.
• The native host process starts from the bundled Codex Chrome plugin.
• The native host binary is signed by OpenAI.

Codex should list the Chrome extension backend and allow Chrome-backed browser tasks.

Additional information

Local checks performed:

• Chrome is running.
• Codex Chrome Extension is installed and enabled in the Chrome Default profile and Profile 1.
• Native host manifest is correct:

{
  "name": "com.openai.codexextension",
  "type": "stdio",
  "allowed_origins": [
    "chrome-extension://hehggadaopoacecdllhhajmbjkdcmajg/"
  ],
  "path": "~/.codex/plugins/cache/openai-bundled/chrome/26.623.101652/extension-host/macos/arm64/Codex for Chrome"
}

• Native host process is running:

~/.codex/plugins/cache/openai-bundled/chrome/26.623.101652/extension-host/macos/arm64/Codex for Chrome chrome-extension://hehggadaopoacecdllhhajmbjkdcmajg/

• Codex app opens browser-use native pipe sockets under /tmp/codex-browser-use/*.sock.
• The native host binary verifies successfully with codesign --verify --deep --strict.
• The native host binary signing details:

Identifier=extension-host
Authority=Developer ID Application: OpenAI OpCo, LLC (2DC432GLL2)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
TeamIdentifier=2DC432GLL2
Runtime Version=26.5.0

Recent log excerpt after restarting both Codex and Chrome:

2026-07-06T11:42:06.130Z warning [browser-use-native-pipe-server] browser-use native pipe rejected socket peer reason=untrusted-code-signing-identity
2026-07-06T11:42:06.139Z warning [browser-use-native-pipe-server] browser-use native pipe rejected socket peer reason=untrusted-code-signing-identity
2026-07-06T11:42:06.148Z warning [browser-use-native-pipe-server] browser-use native pipe rejected socket peer reason=untrusted-code-signing-identity
2026-07-06T11:42:06.156Z warning [browser-use-native-pipe-server] browser-use native pipe rejected socket peer reason=untrusted-code-signing-identity
2026-07-06T11:42:06.165Z warning [browser-use-native-pipe-server] browser-use native pipe rejected socket peer reason=untrusted-code-signing-identity

This looks like a Codex Desktop macOS native pipe peer authorization issue rather than a missing extension, disabled extension, missing manifest, or unsigned native host.