Computer Use native pipe rejects signed in-app sender as unauthenticated on macOS 26.5.2

What happened?

Computer Use is installed and enabled in the official macOS desktop app, but even the read-only list_apps call fails after the native Computer Use service starts.

After a full app quit and relaunch, the tool reports:

Sky Computer Use native pipe startup failed
Caused by: Sky Computer Use native pipe is unavailable:
Sky Computer Use native pipe closed before response

The freshly started SkyComputerUseService process remains running, but its unified logs repeat:

[com.apple.securityd:security_exception] MacOS error: -67062
[inc.software.app:Computer Use] Sender process is not authenticated

macOS resolves -67062 as:

code object is not signed at all

However, the app, Computer Use helper, packaged Node runtime, and node_repl launcher all pass code-signature verification and are signed by OpenAI.

Environment

• macOS: 26.5.2 (25F84)
• Architecture: arm64 / Apple Silicon
• Desktop app path: /Applications/ChatGPT.app
• App bundle identifier: com.openai.codex
• App version: 26.721.31836
• App build: 5828
• Computer Use plugin: computer-use@openai-bundled version 1.0.1000502
• Managed helper: $HOME/.codex/computer-use/Codex Computer Use.app
• Helper bundle identifier: com.openai.sky.CUAService

Configuration state

codex features list reports:

apps          stable  true
computer_use  stable  true
plugins       stable  true

Relevant config:

[features]
apps = true

[plugins."computer-use@openai-bundled"]
enabled = true

The managed helper exists, is arm64, and is running. Its Unix socket also exists at:

$HOME/Library/Group Containers/2DC432GLL2.com.openai.sky.CUAService/IPC/computeruse.sock

Signature verification

The managed Computer Use app passes:

codesign --verify --deep --strict
spctl -a -vvv -t execute

Relevant result:

accepted
source=Notarized Developer ID
origin=Developer ID Application: OpenAI OpCo, LLC (2DC432GLL2)
TeamIdentifier=2DC432GLL2

The packaged runtime binaries also pass codesign --verify --strict:

/Applications/ChatGPT.app/Contents/Resources/cua_node/bin/node
/Applications/ChatGPT.app/Contents/Resources/cua_node/bin/node_repl

Both report:

Authority=Developer ID Application: OpenAI OpCo, LLC (2DC432GLL2)
TeamIdentifier=2DC432GLL2

No SkyComputerUseClient or SkyComputerUseService crash report is created.

Steps to reproduce

1. Open the official /Applications/ChatGPT.app and select Codex.
2. Ensure the bundled Computer Use plugin is installed and enabled.
3. Fully quit the desktop app with Cmd+Q.
4. Relaunch it.
5. In a Codex thread, ask Computer Use to run the read-only list_apps operation or inspect Finder.
6. Observe Sky Computer Use native pipe startup failed.
7. Inspect unified logs for SkyComputerUseService; observe MacOS error: -67062 and Sender process is not authenticated.

Expected behavior

The signed Computer Use client launched from the official signed desktop app should authenticate to SkyComputerUseService, complete the native-pipe handshake, and return the app list.

Installation/update source

The desktop app was originally installed declaratively through nix-darwin / nix-homebrew with the Homebrew cask:

homebrew.casks = [ "codex-app" ];

Current local package/application state:

brew list --cask --versions codex-app
codex-app 26.623.141536

brew list --cask --versions chatgpt
# not installed

/Applications/Codex.app
# absent

/Applications/ChatGPT.app
# present, version 26.721.31836

Homebrew now reports codex-app as deprecated/discontinued upstream and recommends the replacement cask chatgpt. The Homebrew receipt is therefore older than the active ChatGPT.app; the exact update/migration mechanism was not confirmed.

The Nix configuration also installs the codex CLI from nixpkgs, which resolves on the shell PATH outside the app. However, this reproduction occurs inside the official desktop app and uses its packaged runtime under /Applications/ChatGPT.app/Contents/Resources/, not the Nix CLI.

Additional context

This appears related to:

• #18507 — same Sender process is not authenticated symptom, but reported from the CLI.
• #19544 — Homebrew CLI fails while the app-bundled CLI succeeds.
• #21200 — launch-constraint/signature failure outside the app process tree.

This report is distinct because it reproduces from the current official desktop app process tree, not from Homebrew, an ACP adapter, or another third-party launcher. The app is now located at /Applications/ChatGPT.app, while its bundle identifier remains com.openai.codex.