›_ Codex Issues
Codex Issues / #38095

Unable to enable Remote Control on Mac

Open 💬 2 comments Opened Aug 12, 2026 by kawehthomas-commits
💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of the Codex App are you using (From “About Codex” dialog)?

26.803.41515 (Build 6321)

What subscription do you have?

ChatGPT Plus

What platform is your computer?

Darwin 25.5.0 arm64 arm (macOS 26.5.2)

What issue are you seeing?

Remote Control cannot be enabled in the Codex desktop app. The setup fails before displaying a QR code, and the UI shows: “Unable to enable Remote Control. Please try again.”

The desktop diagnostic log showed:

connection-failed: ignoring invalid experimental feature enablement keys: apps_mcp_path_override

What steps can reproduce the bug?

  1. Open Codex Settings.
  2. Go to Connections > Control this Mac.
  3. Select Allow/Enable Remote Control.
  4. Observe that setup fails before a QR code appears.

Troubleshooting already completed:

  • Completely quit Codex with Command-Q.
  • Reopened the application.
  • Tried enabling Remote Control again.
  • The same error still occurs.

What is the expected behavior?

Remote Control should be enabled and a QR code should appear so the ChatGPT mobile app can connect to this Mac.

Additional information

Feedback ID: 019fe967-cac6-72c0-b5ff-73a1013097b5

I could not find apps_mcp_path_override in my user configuration files, so this may be an internal desktop feature configuration or compatibility issue.

View original on GitHub ↗

2 Comments

github-actions[bot] contributor · 16 days ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

  • #36946

Powered by Codex Action

xinzhangseu · 1 day ago

Same Problem:

Summary

Remote Control cannot be enabled in Codex/ChatGPT Desktop on macOS.

Clicking Settings → Connections → Control this Mac → Allow results in:

Couldn't enable remote control. Try again.

The app itself and the downloaded Codex Computer Use.app helper both pass codesign --verify, but macOS trustd explicitly reports that the com.apple.security.application-groups entitlement is being ignored because of an invalid application signature or incorrect provisioning profile.

Inspection of the signed entitlements and embedded provisioning profiles shows a mismatch involving the CUA application group.

Environment

  • macOS 26.5.1 (25F80)
  • Apple Silicon Mac Studio
  • Native architecture: arm64
  • ChatGPT/Codex Desktop version: 26.820.71523
  • Main app bundle identifier: com.openai.codex
  • OpenAI Team ID: 2DC432GLL2
  • Computer Use helper: ~/.codex/computer-use/Codex Computer Use.app
  • CUA helper identifier: com.openai.sky.CUAService

Steps to reproduce

  1. Install the current native Apple Silicon ChatGPT/Codex Desktop app.
  2. Open ChatGPT.
  3. Go to Settings → Connections.
  4. Under Control this Mac, click Allow.
  5. Remote Control fails to enable.
  6. The UI displays:
Couldn't enable remote control.
Try again.

Main application is native ARM64

uname -m

Output:

arm64
file /Applications/ChatGPT.app/Contents/MacOS/ChatGPT

Output:

/Applications/ChatGPT.app/Contents/MacOS/ChatGPT: Mach-O 64-bit executable arm64
lipo -archs /Applications/ChatGPT.app/Contents/MacOS/ChatGPT

Output:

arm64

Therefore this issue is reproducible with the native Apple Silicon build and is not caused by running the Intel build through Rosetta.

Main app signature is valid

codesign --verify --deep --strict --verbose=2 /Applications/ChatGPT.app

Output ends with:

/Applications/ChatGPT.app: valid on disk
/Applications/ChatGPT.app: satisfies its Designated Requirement

Signature information:

codesign -dv --verbose=4 /Applications/ChatGPT.app 2>&1 \
  | grep -E 'Identifier|TeamIdentifier|Authority'

Output:

Identifier=com.openai.codex
Authority=Developer ID Application: OpenAI OpCo, LLC (2DC432GLL2)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
TeamIdentifier=2DC432GLL2

Main app signed entitlements

Running:

codesign -d --entitlements :- /Applications/ChatGPT.app

shows, among other entitlements:

com.apple.application-identifier
    2DC432GLL2.com.openai.codex

com.apple.developer.team-identifier
    2DC432GLL2

com.apple.security.application-groups
    2DC432GLL2.com.openai.codex.notifications
    2DC432GLL2.com.openai.sky.CUAService

com.apple.security.automation.apple-events
    true

The main application therefore requests the CUA application group:

2DC432GLL2.com.openai.sky.CUAService

Main app provisioning profile does not contain application-groups

Inspecting:

security cms -D -i \
  /Applications/ChatGPT.app/Contents/embedded.provisionprofile \
  2>/dev/null | plutil -p -

shows these profile entitlements:

"Entitlements" => {
    "com.apple.application-identifier" => "2DC432GLL2.com.openai.codex"
    "com.apple.developer.aps-environment" => "production"
    "com.apple.developer.team-identifier" => "2DC432GLL2"

    "keychain-access-groups" => [
        0 => "2DC432GLL2.*"
    ]
}

There is no:

com.apple.security.application-groups

entry in the main application's embedded provisioning profile, despite the signed application requesting:

2DC432GLL2.com.openai.codex.notifications
2DC432GLL2.com.openai.sky.CUAService

Codex Computer Use helper

The helper is installed at:

~/.codex/computer-use/Codex Computer Use.app

Its signed entitlements include:

com.apple.application-identifier
    2DC432GLL2.com.openai.sky.CUAService

com.apple.developer.team-identifier
    2DC432GLL2

com.apple.security.application-groups
    2DC432GLL2.com.openai.sky.CUAService

com.apple.security.automation.apple-events
    true

CUA helper signature is valid

codesign --verify --deep --strict --verbose=4 \
  "$HOME/.codex/computer-use/Codex Computer Use.app"

Output:

/Users/<user>/.codex/computer-use/Codex Computer Use.app: valid on disk
/Users/<user>/.codex/computer-use/Codex Computer Use.app: satisfies its Designated Requirement

CUA helper provisioning profile

The helper contains:

~/.codex/computer-use/Codex Computer Use.app/Contents/embedded.provisionprofile

Decoding it shows:

ApplicationIdentifierPrefix:
    2DC432GLL2

Entitlements:
    com.apple.application-identifier:
        2DC432GLL2.com.openai.sky.CUAService

    com.apple.developer.team-identifier:
        2DC432GLL2

    com.apple.security.application-groups:
        group.com.openai.sky.CUAService
        2DC432GLL2.*

    keychain-access-groups:
        2DC432GLL2.*

The helper's signed application-group entitlement is therefore:

2DC432GLL2.com.openai.sky.CUAService

while its provisioning profile explicitly contains:

group.com.openai.sky.CUAService
2DC432GLL2.*

macOS trustd explicitly rejects the application-group entitlement

Immediately after attempting to enable Remote Control, macOS logs:

trustd [...] [com.apple.securityd:SecWarning]
Entitlement com.apple.security.application-groups=(
    "2DC432GLL2.com.openai.codex.notifications",
    "2DC432GLL2.com.openai.sky.CUAService"
) is ignored because of invalid application signature or incorrect provisioning profile

This happens even though codesign --verify --deep --strict succeeds for both the main app and the Computer Use helper.

CUAService initialization failure

The ChatGPT process initially reaches the CUA service:

RemoteHostedPIPContent started private endpoint host
RemoteHostedPIPContent connected to CUAService

but later fails with:

RemoteHostedPIPContent CUAService bootstrap failed:
Error Domain=NSOSStatusErrorDomain Code=-1712

The Remote Control UI then remains disabled.

Expected behavior

Clicking:

Settings → Connections → Control this Mac → Allow

should successfully initialize the Computer Use service and enable Remote Control.

Actual behavior

Remote Control cannot be enabled.

The UI reports:

Couldn't enable remote control.
Try again.

trustd rejects the application-group entitlement, and CUA initialization eventually fails with NSOSStatusErrorDomain Code=-1712.

Suspected cause

This appears to be a signing/provisioning/capability mismatch in the distributed macOS build rather than a corrupted local installation.

In particular:

  1. The main ChatGPT.app signed entitlements request:
2DC432GLL2.com.openai.sky.CUAService

but its embedded provisioning profile contains no com.apple.security.application-groups entitlement.

  1. Codex Computer Use.app requests:
2DC432GLL2.com.openai.sky.CUAService

while its embedded provisioning profile explicitly lists:

group.com.openai.sky.CUAService
2DC432GLL2.*
  1. macOS trustd explicitly reports that the application-group entitlement is being ignored due to an invalid application signature or incorrect provisioning profile.
  1. Both applications nevertheless pass normal codesign --verify validation.

This suggests the distributed binaries are cryptographically signed correctly, but the requested protected application-group capability is not being accepted by macOS under the embedded provisioning configuration.

Additional note

An Intel/x86_64 build had initially been installed on this Apple Silicon Mac. That installation produced an earlier CUA bootstrap failure (Code=-600).

It was completely replaced with the current native ARM64 build.

The native ARM64 build now successfully reaches:

RemoteHostedPIPContent connected to CUAService

but still fails to enable Remote Control, eventually producing Code=-1712 and the trustd application-group warning described above.

Therefore the current issue is reproducible using the native ARM64 build independently of Rosetta.