›_ Codex Issues
Codex Issues / #32382

Homebrew Cask installation may execute bundled codex-path/rg, triggering Gatekeeper instead of using system rg

Open 💬 0 comments Opened Jul 11, 2026 by letatas

What version of Codex CLI is running?

codex-cli 0.144.1

What subscription do you have?

Plus

Which model were you using?

Auto

What platform is your computer?

Darwin 25.5.0 arm64 arm

What terminal emulator and version are you using (if applicable)?

Terminal.app

Codex doctor report

{
  "schemaVersion": 1,
  "generatedAt": "1783763337s since unix epoch",
  "overallStatus": "ok",
  "codexVersion": "0.144.1",
  "checks": {
    "app_server.status": {
      "id": "app_server.status",
      "category": "app-server",
      "status": "ok",
      "summary": "background server is not running",
      "details": {
        "control socket": "/Users/***/.codex/app-server-control/app-server-control.sock",
        "daemon state dir": "/Users/***/.codex/app-server-daemon",
        "mode": "ephemeral",
        "pid file": "/Users/***/.codex/app-server-daemon/app-server.pid (missing)",
        "settings": "/Users/***/.codex/app-server-daemon/settings.json (missing)",
        "status": "not running",
        "update-loop pid file": "/Users/***/.codex/app-server-daemon/app-server-updater.pid (missing)"
      },
      "remediation": null,
      "durationMs": 0
    },
    "auth.credentials": {
      "id": "auth.credentials",
      "category": "auth",
      "status": "ok",
      "summary": "auth is configured",
      "details": {
        "auth file": "/Users/***/.codex/auth.json",
        "auth storage mode": "File",
        "stored API key": "false",
        "stored ChatGPT tokens": "true",
        "stored agent identity": "false",
        "stored auth mode": "chatgpt"
      },
      "remediation": null,
      "durationMs": 0
    },
    "config.load": {
      "id": "config.load",
      "category": "config",
      "status": "ok",
      "summary": "config loaded",
      "details": {
        "CODEX_HOME": "/Users/***/.codex",
        "config.toml": "/Users/***/.codex/config.toml",
        "config.toml parse": "ok",
        "cwd": "/Users/***/shared/***",
        "enabled feature flags": "shell_tool, unified_exec, shell_snapshot, code_mode_host, terminal_resize_reflow, sqlite, hooks, enable_request_compression, multi_agent, apps, tool_search_always_defer_mcp_tools, tool_suggest, plugins, in_app_browser, browser_use, browser_use_full_cdp_access, browser_use_external, computer_use, remote_plugin, plugin_sharing, image_generation, resize_all_images, skill_mcp_dependency_install, mentions_v2, steer, guardian_approval, goals, collaboration_modes, tool_call_mcp_elicitation, auth_elicitation, personality, fast_mode, tui_app_server, remote_compaction_v2, workspace_dependencies",
        "feature flag overrides": "none",
        "feature flags enabled": "35",
        "log dir": "/Users/***/.codex/log",
        "mcp servers": "0",
        "model": "<default>",
        "model provider": "openai",
        "sqlite home": "/Users/***/.codex"
      },
      "remediation": null,
      "durationMs": 0
    },
    "git.environment": {
      "id": "git.environment",
      "category": "git",
      "status": "ok",
      "summary": "git version 2.50.1 (Apple Git-155)",
      "details": {
        ".git entry": "directory",
        "PATH git #1": "/usr/bin/git",
        "PATH git entries": "1",
        "git branch": "develop",
        "git build options": "git version 2.50.1 (Apple Git-155); cpu: arm64; no commit associated with this build; sizeof-long: 8; sizeof-size_t: 8; shell-path: /bin/sh; feature: fsmonitor--daemon; libcurl: 8.7.1; zlib: 1.2.12; SHA-1: SHA1_DC; SHA-256: SHA256_BLK",
        "git exec path": "/Applications/Xcode.app/Contents/Developer/usr/libexec/git-core",
        "git version": "git version 2.50.1 (Apple Git-155)",
        "repo detected": "true",
        "repo root": "/Users/***/shared/***",
        "selected git": "/usr/bin/git"
      },
      "remediation": null,
      "durationMs": 196
    },
    "installation": {
      "id": "installation",
      "category": "install",
      "status": "ok",
      "summary": "installation looks consistent",
      "details": {
        "PATH codex #1": "/opt/homebrew/bin/codex",
        "PATH codex #2": "/opt/homebrew/bin/codex",
        "PATH codex entries": "2",
        "current executable": "/opt/homebrew/bin/codex",
        "install context": "brew",
        "managed by bun": "false",
        "managed by npm": "false",
        "managed by pnpm": "false",
        "managed package root": "not set"
      },
      "remediation": null,
      "durationMs": 13
    },
    "mcp.config": {
      "id": "mcp.config",
      "category": "mcp",
      "status": "ok",
      "summary": "no MCP servers configured",
      "details": {},
      "remediation": null,
      "durationMs": 0
    },
    "network.env": {
      "id": "network.env",
      "category": "network",
      "status": "ok",
      "summary": "network-related environment looks readable",
      "details": {
        "proxy env vars": "none"
      },
      "remediation": null,
      "durationMs": 0
    },
    "network.provider_reachability": {
      "id": "network.provider_reachability",
      "category": "reachability",
      "status": "ok",
      "summary": "active provider endpoints are reachable over HTTP",
      "details": {
        "ChatGPT base URL": "https://chatgpt.com/backend-api/ reachable (HTTP 404)",
        "reachability mode": "ChatGPT auth"
      },
      "remediation": null,
      "durationMs": 350
    },
    "network.websocket_reachability": {
      "id": "network.websocket_reachability",
      "category": "websocket",
      "status": "ok",
      "summary": "Responses WebSocket handshake succeeded",
      "details": {
        "DNS": "2 IPv4, 0 IPv6, first IPv4",
        "auth mode": "chatgpt",
        "connect timeout": "15000 ms",
        "endpoint": "wss://chatgpt.com/backend-api/<redacted>",
        "handshake result": "HTTP 101 Switching Protocols",
        "model provider": "openai",
        "models etag present": "true",
        "provider name": "OpenAI",
        "proxy env vars": "none",
        "reasoning header": "false",
        "server model present": "false",
        "supports websockets": "true",
        "wire API": "responses"
      },
      "remediation": null,
      "durationMs": 879
    },
    "runtime.provenance": {
      "id": "runtime.provenance",
      "category": "runtime",
      "status": "ok",
      "summary": "running brew on macos-aarch64",
      "details": {
        "commit": "unknown",
        "current executable": "/opt/homebrew/bin/codex",
        "install method": "brew",
        "platform": "macos-aarch64",
        "version": "0.144.1"
      },
      "remediation": null,
      "durationMs": 0
    },
    "runtime.search": {
      "id": "runtime.search",
      "category": "search",
      "status": "ok",
      "summary": "search is OK (system)",
      "details": {
        "search command": "rg",
        "search command readiness": "ripgrep 15.1.0",
        "search provider": "system"
      },
      "remediation": null,
      "durationMs": 13
    },
    "sandbox.helpers": {
      "id": "sandbox.helpers",
      "category": "sandbox",
      "status": "ok",
      "summary": "sandbox configuration is readable",
      "details": {
        "approval policy": "OnRequest",
        "codex-linux-sandbox helper": "none",
        "execve wrapper helper": "/Users/***/.codex/tmp/arg0/codex-arg0zxViBb/codex-execve-wrapper",
        "filesystem sandbox": "restricted",
        "network sandbox": "restricted"
      },
      "remediation": null,
      "durationMs": 0
    },
    "state.paths": {
      "id": "state.paths",
      "category": "state",
      "status": "ok",
      "summary": "state paths and databases are inspectable",
      "details": {
        "CODEX_HOME": "/Users/***/.codex (dir)",
        "active rollout files": "8 files, 1607166 total bytes, 200895 average bytes",
        "archived rollout files": "0 files, 0 total bytes, 0 average bytes",
        "goals DB": "/Users/***/.codex/goals_1.sqlite (file)",
        "goals DB integrity": "ok",
        "log DB": "/Users/***/.codex/logs_2.sqlite (file)",
        "log DB integrity": "ok",
        "log dir": "/Users/***/.codex/log (dir)",
        "memories DB": "/Users/***/.codex/memories_1.sqlite (file)",
        "memories DB integrity": "ok",
        "sqlite home": "/Users/***/.codex (dir)",
        "state DB": "/Users/***/.codex/state_5.sqlite (file)",
        "state DB integrity": "ok"
      },
      "remediation": null,
      "durationMs": 212
    },
    "state.rollout_db_parity": {
      "id": "state.rollout_db_parity",
      "category": "threads",
      "status": "ok",
      "summary": "rollout files and state DB thread inventory agree",
      "details": {
        "default model provider": "openai",
        "rollout DB active files": "8",
        "rollout DB active rows": "8",
        "rollout DB archive mismatches": "0",
        "rollout DB archived files": "0",
        "rollout DB archived rows": "0",
        "rollout DB duplicate DB paths": "0",
        "rollout DB duplicate rollout thread ids": "0",
        "rollout DB malformed file names": "0",
        "rollout DB missing active rows": "0",
        "rollout DB missing archived rows": "0",
        "rollout DB model providers": "openai=8",
        "rollout DB rows": "8",
        "rollout DB scan cap reached": "false",
        "rollout DB scan errors": "0",
        "rollout DB sources": "cli=3, exec=3, subagent:thread_spawn=2",
        "rollout DB stale rows": "0"
      },
      "remediation": null,
      "durationMs": 256
    },
    "system.environment": {
      "id": "system.environment",
      "category": "system",
      "status": "ok",
      "summary": "OS language fr-FR",
      "details": {
        "EDITOR": "not set",
        "LANG": "fr_FR.UTF-8",
        "LESS": "set",
        "PAGER": "set",
        "VISUAL": "not set",
        "os": "Mac OS 26.5.2 [64-bit]",
        "os language": "fr-FR",
        "os type": "Mac OS",
        "os version": "26.5.2"
      },
      "remediation": null,
      "durationMs": 7
    },
    "terminal.env": {
      "id": "terminal.env",
      "category": "terminal",
      "status": "ok",
      "summary": "terminal metadata was detected",
      "details": {
        "COLORTERM": "truecolor",
        "TERM_PROGRAM": "Apple_Terminal",
        "color output": "disabled (stdout is not a terminal)",
        "effective locale": "fr_FR.UTF-8",
        "stderr is terminal": "true",
        "stdin is terminal": "true",
        "stdout is terminal": "false",
        "terminal": "Apple Terminal",
        "terminal size": "244x53",
        "terminal version": "470.2"
      },
      "remediation": null,
      "durationMs": 0
    },
    "terminal.title": {
      "id": "terminal.title",
      "category": "title",
      "status": "ok",
      "summary": "terminal title default",
      "details": {
        "terminal title activity": "true",
        "terminal title items": "activity, project-name",
        "terminal title project source": "git repo root",
        "terminal title project value": "***",
        "terminal title source": "default"
      },
      "remediation": null,
      "durationMs": 0
    },
    "updates.status": {
      "id": "updates.status",
      "category": "updates",
      "status": "ok",
      "summary": "update configuration is locally consistent",
      "details": {
        "cached latest version": "0.144.1",
        "check for update on startup": "true",
        "last checked at": "2026-07-11T08:58:33.710823Z",
        "latest version": "0.144.1",
        "latest version status": "current version is not older",
        "update action": "brew upgrade --cask codex",
        "version cache": "/Users/***/.codex/version.json"
      },
      "remediation": null,
      "durationMs": 2571
    }
  }
}

What issue are you seeing?

Environment

  • macOS Tahoe 26.5.2
  • Apple Silicon
  • Codex CLI installed via Homebrew Cask
  • Codex version: 0.144.1

Problem

While using Codex CLI, macOS repeatedly displayed a Gatekeeper dialog saying that rg could not be verified.

The dialog appeared many times during normal Codex execution.

Initially I assumed it was using my system rg, but after investigation this was not the case.

Investigation

My shell was using:

which rg
/opt/homebrew/bin/rg

The Homebrew rg:

  • executed correctly
  • had no com.apple.quarantine attribute
xattr -l /opt/homebrew/bin/rg
# no output

Using eslogger, I found that Codex was actually executing:

/opt/homebrew/Caskroom/codex/0.144.1/codex-path/rg

This bundled executable had:

  • team_id = null
  • no usable code signature

Gatekeeper rejected it, producing repeated dialogs.

Resolution

Running

brew reinstall --cask codex

removed the bundled codex-path/rg.

After reinstall:

  • find /opt/homebrew/Caskroom/codex -name rg returns nothing
  • Codex now uses /opt/homebrew/bin/rg
  • Gatekeeper dialogs completely disappeared

What steps can reproduce the bug?

  1. Install Codex CLI using the Homebrew cask.
  2. Launch Codex and execute any task that performs repository-wide text searches (for example, asking Codex to analyze or refactor a project).
  3. During execution, macOS repeatedly displays a Gatekeeper dialog stating that rg cannot be verified.

Using eslogger, I observed that Codex was executing:

/opt/homebrew/Caskroom/codex/0.144.1/codex-path/rg

instead of the system-installed rg.

Unfortunately I cannot provide a deterministic reproduction sequence because the issue only occurred on an existing installation.

Running:

brew reinstall --cask codex

removed the bundled codex-path/rg, after which Codex started using:

/opt/homebrew/bin/rg

and the issue disappeared completely.

What is the expected behavior?

Expected behavior

Codex should either:

  • use the system rg from PATH, or
  • ship a properly signed/notarized bundled rg.

Actual behavior

A bundled codex-path/rg was executed instead of the system version and triggered Gatekeeper repeatedly.

The issue disappeared after reinstalling the Homebrew cask.

This suggests the cask may sometimes leave behind an outdated bundled executable or install it incorrectly.

Additional information

brew info codex

==> codex (Codex): 0.144.1
OpenAI's coding agent that runs in your terminal
https://github.com/openai/codex
Installed (on request)
/opt/homebrew/Caskroom/codex/0.144.1 (260.4MB)
  Installed using the internal formulae.brew.sh API on 2026-07-11 at 11:37:40
From: https://github.com/Homebrew/homebrew-cask/blob/HEAD/Casks/c/codex.rb
==> Dependencies
Required (1): ripgrep
Recursive Runtime (2): all installed ✔
==> Artifacts
codex-aarch64-apple-darwin -> codex (Binary)
codex-aarch64-apple-darwin completion (base_name: codex, shells: bash, zsh, fish) (Generated Completion)
==> Analytics
install: 72,882 (30 days), 242,437 (90 days), 562,803 (365 days)

---

brew list --cask codex

/opt/homebrew/Caskroom/codex/0.144.1/codex-aarch64-apple-darwin
/opt/homebrew/Caskroom/codex/.metadata/0.144.1/20260711093736.752/Casks/codex.json
/opt/homebrew/Caskroom/codex/.metadata/INSTALL_RECEIPT.json
/opt/homebrew/Caskroom/codex/.metadata/config.json

---

I suspect this may be related to an upgrade path rather than a fresh installation, since a reinstall fixed the issue without any other system changes.

PS: Path names and project names have been anonymized

View original on GitHub ↗