›_ Codex Issues
Codex Issues / #37324

macOS: Chrome plugin cannot start — classic-level.node in chrome@openai-bundled 0.1.7 ships with an invalid code signature

Open 💬 0 comments Opened Aug 6, 2026 by Zar187

What version of the Codex App are you using (From “About Codex” dialog)?

26.730.61639 (build 6234)

What subscription do you have?

Pro

What platform is your computer?

Darwin 24.6.0 arm64 arm

What issue are you seeing?

Summary

The Chrome plugin for the Codex/ChatGPT macOS app never connects. The native messaging host fails to start because a bundled prebuilt Node native module, classic-level.node, fails dlopen with a macOS code-signature error.

The file fails codesign --verify immediately after a clean re-download, so this is not local corruption. Uninstalling and reinstalling the plugin cannot fix it, and 0.1.7 is the only version offered by the marketplace.

Impact

The Chrome plugin is completely unusable. From the UI the failure surfaces only as "the plugin connection failed due to a local runtime error", which sends users into an uninstall/reinstall loop that can never succeed.

Environment

  • Plugin: chrome@openai-bundled version 0.1.7 (only version available)
  • App location: ~/Applications/ChatGPT.app, bundle ID com.openai.codex
  • Chrome extension hehggadaopoacecdllhhajmbjkdcmajg, installed and enabled in the Default profile
  • Codex App: 26.730.61639 (build 6234)
  • macOS: Darwin 24.6.0, Apple Silicon (arm64)
  • Home directory volume: /dev/disk7s1 on /Volumes/Ext_4TB (apfs, local, journaled, noowners)

Steps to reproduce

  1. Install the Chrome plugin in the Codex app; install the ChatGPT Chrome extension.
  2. Ask Codex to do anything requiring the Chrome plugin (e.g. "list my open browser tabs").
  3. The connection fails.

What the plugin reports internally

dlopen(~/.codex/plugins/cache/openai-bundled/chrome/0.1.7/scripts/node_modules/classic-level/prebuilds/darwin-x64+arm64/classic-level.node, 0x0001): tried:
'.../classic-level.node' (code signature invalid in <1393D06E-7171-3F7D-9256-1BD69E096BCE>
'.../classic-level.node' (errno=1) sliceOffset=0x00060000, codeBlobOffset=0x00055470, codeBlobSize=0x00004D00)

Verification

codesign --verify --verbose=4 on the affected file:

.../classic-level/prebuilds/darwin-x64+arm64/classic-level.node
In architecture: arm64
invalid signature (code or signature have been modified)

codesign -dvvv on the same file:

Identifier=classic-level
Format=Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=889 flags=0x10000(runtime) hashes=22+2 location=embedded
Hash type=sha256 size=32
CDHash=790fc607bdff0a3ec68689758fc1de8fb8148e8a
Signature size=9134
Authority=(unavailable)
Info.plist=not bound
TeamIdentifier=2DC432GLL2
Runtime Version=14.5.0
Sealed Resources=none
Internal requirements count=1 size=176

TeamIdentifier=2DC432GLL2 matches the Team ID on ChatGPT.app itself, so the module is intended to be signed by you. The signature is simply not valid for the bytes shipped.

lipo -detailed_info on the same file:

fat_magic 0xcafebabe
nfat_arch 2
architecture x86_64
    offset 16384
    size 364080
    align 2^14 (16384)
architecture arm64
    offset 393216    (matches sliceOffset=0x00060000 in the dlopen error)

Possible lead: the CodeDirectory reports hashes=22+2. At the 4 KB code-signing page size that seals roughly 90 KB, while each architecture slice is on the order of 364 KB. That is consistent with the Mach-O being modified or re-laid-out (e.g. a lipo, strip, or install-name rewrite step) after codesign ran in the build pipeline.

What was already ruled out

  • Chrome extension present, enabled, correct extension ID, in the Default profile.
  • Native messaging manifest present and correct at ~/Library/Application Support/Google/Chrome/NativeMessagingHosts/com.openai.codexextension.json, with valid allowed_origins, type: "stdio", and a path that exists.
  • The ChatGPT for Chrome host binary exists inside the app bundle.
  • Quarantine cleared with xattr -dr com.apple.quarantine ~/.codex/plugins/cache/openai-bundled — no change.
  • Full cache wipe and clean reinstall via codex plugin add chrome@openai-bundled (all four bundled plugins reinstalled: chrome 0.1.7, browser-use 0.1.0-alpha2, computer-use 1.0.780, latex-tectonic 0.1.1). The newly downloaded classic-level.node fails identically.
  • Ad-hoc re-signing with codesign --force --sign - clears the invalid-signature error, but the load then fails with a Team ID mismatch, because the loading process enforces library validation. There is no viable local workaround.

Related issues

This looks like the Chrome-plugin instance of a wider signing problem already reported against other bundled macOS payloads. All of these fail with the identical invalid signature (code or signature have been modified) string, all under Team ID 2DC432GLL2:

  • #21846 — Computer Use helper fails codesign --verify. Later comments there report /Applications/ChatGPT.app itself failing verification the same way, on multiple macOS versions and desktop builds.
  • #21200 — SkyComputerUseClient SIGKILL'd with CODESIGNING / Launch Constraint Violation.
  • #21399 — Codex Desktop invalid signature / entitlements, renderer sandbox fails on macOS arm64.

If those share a root cause with this report, the fix is likely one change in the signing stage of the macOS release pipeline rather than four separate fixes.

Requested fix

Re-sign classic-level.node (and any other .node prebuilds in the plugin payload) as the final step of the build, after all binary post-processing, and publish a new chrome@openai-bundled release.

Secondary request

Surface the underlying dlopen / code-signature error in the plugin UI. The current message ("local runtime error", "try reinstalling the plugin") points users at a remedy that cannot possibly work for this class of failure.

What steps can reproduce the bug?

100% reproducible on this machine.

  1. Install the bundled Chrome plugin in the Codex app (chrome@openai-bundled 0.1.7) and install the ChatGPT Chrome extension (hehggadaopoacecdllhhajmbjkdcmajg).
  2. Ask Codex anything that requires the Chrome plugin, e.g. "Use the Chrome plugin to list my open browser tabs."
  3. Codex reports: "Chrome and the extension are running, but the plugin connection failed due to a local runtime error."

The underlying error is only visible by expanding the "Retry Chrome connection" tool-call output:

dlopen(~/.codex/plugins/cache/openai-bundled/chrome/0.1.7/scripts/node_modules/classic-level/prebuilds/darwin-x64+arm64/classic-level.node, 0x0001):
code signature invalid (errno=1) sliceOffset=0x00060000, codeBlobOffset=0x00055470, codeBlobSize=0x00004D00

Confirm the cause directly:

codesign --verify --verbose=4 ~/.codex/plugins/cache/openai-bundled/chrome/0.1.7/scripts/node_modules/classic-level/prebuilds/darwin-x64+arm64/classic-level.node

In architecture: arm64
invalid signature (code or signature have been modified)

Reinstalling does not help. I deleted ~/.codex/plugins/cache/openai-bundled entirely and reinstalled with codex plugin add chrome@openai-bundled; the freshly downloaded file fails identically. 0.1.7 is the only version available.

What is the expected behavior?

classic-level.node should pass codesign --verify, load via dlopen, and the Chrome native messaging host should start, so the Chrome plugin can read tabs and drive the browser.

Concretely: re-sign classic-level.node (and any other .node prebuilds in the plugin payload) as the final step of the build, after all binary post-processing, and publish a new chrome@openai-bundled release.

Secondary: surface the underlying dlopen / code-signature error in the plugin UI. The current message ("local runtime error", "try reinstalling the plugin") points users at a remedy that cannot possibly work for this class of failure — I spent a long time reinstalling before finding the real error.

Additional information

Happy to run any further diagnostics on this machine if useful — I still have the failing install in place.

No credentials, tokens, private file contents, or user data are included in this report.

View original on GitHub ↗