Codex Computer Use Apple Event error -10000: Sender process is not authenticated; hundreds of SkyComputerUseService processes; userspace watchdog timeout: no successful checkins from WindowServer

Why you are stuck

Codex checks for updates roughly 54 minutes after launch (primary-runtime-update-jitter-ms in ~/.codex/.codex-global-state.json). On 26.810–26.820 the helper swarm exhausts memory well before that, WindowServer hangs, and you force-quit or the kernel panics. The app never reaches its own updater, so the fix never arrives.

Steps (about 5 minutes, no sudo)

1. Kill the swarm so the machine is usable:

   pkill -9 -f SkyComputerUseService

2. Quit Codex (Cmd+Q, or pkill -9 -x ChatGPT; the Codex.app binary is named ChatGPT).

3. Download the current official installer (about 640 MB):

   curl -fSL --retry 5 -C - -o /tmp/Codex.dmg https://persistent.oaistatic.com/codex-app-prod/Codex.dmg

4. Verify it is signed by OpenAI before installing:

   hdiutil attach -nobrowse -readonly -mountpoint /tmp/codexdmg /tmp/Codex.dmg
   codesign -dv /tmp/codexdmg/*.app 2>&1 | grep TeamIdentifier   # expect TeamIdentifier=2DC432GLL2
   plutil -extract CFBundleShortVersionString raw /tmp/codexdmg/*.app/Contents/Info.plist   # expect 26.901.x or newer

5. Replace the app (keep a backup) and remove the stale helper so the new build installs the one it wants:

   mv /Applications/Codex.app ~/Codex-old.app
   cp -R /tmp/codexdmg/*.app /Applications/Codex.app
   xattr -dr com.apple.quarantine /Applications/Codex.app
   hdiutil detach /tmp/codexdmg
   rm -rf "$HOME/.codex/computer-use/Codex Computer Use.app"

6. Launch Codex. Wait 60 seconds. Run the check below.

Check

pgrep -f SkyComputerUseService | wc -l

Expect 1 (or 0 before Computer Use initialises). If it climbs past 10, the build did not take: confirm /Applications/Codex.app/Contents/Info.plist says 26.901+ and that ~/.codex (or $CODEX_HOME) is the directory Codex actually uses (it is a symlink on some machines).

If you cannot update (managed Mac, offline)

Lock the helper so Codex can neither run nor replace it; Computer Use stays off, everything else works:

B="$HOME/.codex/computer-use/Codex Computer Use.app/Contents/MacOS/SkyComputerUseService"
pkill -9 -f SkyComputerUseService; chmod 000 "$B"; chflags uchg "$B"

Undo with chflags nouchg "$B"; chmod 755 "$B". Codex replaces the bundle on every update, so re-apply after updates (or use codex-guard, which does this on a 60-second timer).

Steps

1. Open System Settings → Privacy & Security → scroll to Developer Tools.
2. Click + and add /Applications/Codex.app.
3. Click + again. The helper lives in a hidden folder, so in the file dialog press Cmd+Shift+G and paste:

   ~/.codex/computer-use/Codex Computer Use.app

(If ~/.codex is a symlink, paste the real path, e.g. /Users/<you>/.ai/codex/computer-use/Codex Computer Use.app.) If the dialog will not show it, reveal it in Finder with open -R "$HOME/.codex/computer-use/Codex Computer Use.app" and drag the app onto the list.

4. Make sure both toggles are on. Quit and relaunch Codex.

Check

ps -axo %cpu,comm | grep -E "syspolicyd|trustd"

During a Codex launch, expect syspolicyd near 0% (trustd may briefly show ~10%). Before the exemption it sits at 100%+ and its RSS grows for minutes.

Scope

This addresses Gatekeeper's per-launch validation cost. On Codex 26.810–26.820 the helper is still spawned in a loop; the exemption makes each spawn cheaper but the count still climbs into the hundreds. Apply the "Update to 26.901" solution for that.

Credit: suggested by nmggithub in openai/codex #25719; measured and written up by Avasis.

Install

brew install celesticlabs/tap/codex-guard

or without Homebrew:

curl -fsSL https://raw.githubusercontent.com/celesticlabs/codex-guard/main/codex-guard.sh -o /tmp/codex-guard.sh
alias codex-guard='bash /tmp/codex-guard.sh'

Use

codex-guard diagnose     # read-only. Prints Codex version, helper version, live helper count, swap, free memory,
                         # WindowServer crash reports, kernel panics on disk, and the verdict: update or lock.
codex-guard update       # kills the swarm, downloads https://persistent.oaistatic.com/codex-app-prod/Codex.dmg,
                         # verifies TeamIdentifier=2DC432GLL2 with `codesign --verify --deep --strict`,
                         # moves the old app to ~/.codex-guard/Codex-<version>-backup.app, installs, removes the
                         # stale helper bundle, relaunches, prints the helper count (expect 1).
codex-guard status       # helper count, whether the lock is active, last relock-agent log lines.

If the machine cannot update:

codex-guard install      # kills the swarm, chmod 000 + chflags uchg on SkyComputerUseService and SkyComputerUseClient,
                         # installs ~/Library/LaunchAgents/ai.avasis.codex-guard.plist (StartInterval 60):
                         # each tick = one pgrep + one ls; kills a swarm above 12 helpers; relocks if Codex replaced the bundle.
codex-guard unlock       # removes the agent, restores execute bits, Computer Use returns after a Codex restart.

What it touches

• /Applications/Codex.app (update only; backup kept), $CODEX_HOME/computer-use/Codex Computer Use.app (lock/unlock), ~/Library/LaunchAgents/ai.avasis.codex-guard.plist, ~/.codex-guard/ (copy of the script, log, app backups). Never kills Codex during normal operation, never uses sudo, never contacts anything except OpenAI's DMG host during update.

Check

pgrep -f SkyComputerUseService | wc -l     # expect 1 after update, 0 after lock

Support

Reply to your Polar receipt or email abhay@avasis.ai with the output of codex-guard diagnose. Same-day answers.