[macOS Intel] Unable to enable “Locked use”: managed Computer Use service fails to spawn

What version of the Codex App are you using (From “About Codex” dialog)?

26.814.41957 (6744)

What subscription do you have?

ChatGPT Plus

What platform is your computer?

Darwin 23.6.0 x86_64 i386

What issue are you seeing?

Summary

Enabling Settings → Computer use → Locked use immediately turns the setting back off and displays the following error:

Unable to update “Locked use” setting.

The regular Google Chrome and Microsoft Excel controls can be enabled successfully.

Environment

• Codex App: 26.814.41957 (6744)
• macOS: 14.8.5
• Kernel/architecture: Darwin 23.6.0, Intel x86_64
• MDM enrollment: No

Steps to reproduce

1. Open the Codex/ChatGPT desktop app.
2. Go to Settings → Computer use.
3. Enable Locked use.
4. Observe that the toggle returns to the disabled state and an error message appears.

Expected behavior

Locked use should be enabled, and the required macOS authorization component should be installed and started.

Actual behavior

The setting is not saved, and no managed Computer Use service is started.

Diagnostics

The Codex desktop log reports:

Failed to reconcile managed Computer Use service: Failed to spawn managed Computer Use service

The macOS unified log reports:

AMFI: constraint violation: sky.node has entitlements but is not a main binary

It also reports that the following application-group entitlement is ignored:

2DC432GLL2.com.openai.sky.CUAService

An XPC bootstrap lookup subsequently fails with:

No such process

The main application and sky.node both pass code-signature verification, and the application is notarized. No corresponding managed Computer Use service process is running.

Additional context

This appears to be a packaging or compatibility issue affecting the native Computer Use component on Intel macOS Sonoma. The failure happens while spawning the managed Computer Use service, before the Locked use setting can be enabled.

What steps can reproduce the bug?

see up

What is the expected behavior?

No response

Additional information

No response

Reproduce from Settings → Computer use → Locked use on Intel macOS Sonoma, then inspect the managed Computer Use service reconciliation and spawn path. Start with the Codex desktop log and macOS unified log entries for the AMFI entitlement violation and failed XPC bootstrap lookup. Done means the service starts successfully and Locked use remains enabled.