codex doctor omits spctl --assess and reports a false desktop security warning on macOS

Codex version

• Homebrew cask: codex-cli 0.154.0
• ChatGPT desktop embedded CLI: 0.154.0-alpha.6.2
• codex update reports that 0.154.0 is current

Platform

• macOS 15.7.9 (24G830)
• Intel (x86_64)
• ChatGPT app at /Applications/ChatGPT.app

Reproduction

1. Run codex doctor --summary.
2. Observe:

desktop  the desktop security assessment was unavailable
check access to macos gatekeeper diagnostics

Doctor reports 21 checks OK, 0 failed, and this one warning.

Diagnosis

The Codex binary contains this Gatekeeper invocation:

/usr/sbin/spctl --type execute --verbose=2

Running that command against the app exits 2 and prints the spctl usage text because assessment mode was not selected:

/usr/sbin/spctl --type execute --verbose=2 /Applications/ChatGPT.app
# exit 2

Adding the required --assess argument succeeds:

/usr/sbin/spctl --assess --type execute --verbose=4 /Applications/ChatGPT.app
# /Applications/ChatGPT.app: accepted
# source=Notarized Developer ID
# exit 0

The app's deep signature also verifies:

codesign --verify --deep --strict --verbose=4 /Applications/ChatGPT.app
# valid on disk
# satisfies its Designated Requirement
# exit 0

The embedded desktop CLI reports the same Doctor warning.

Expected behavior

On macOS, Doctor should invoke spctl --assess --type execute .... A signed, notarized app accepted by Gatekeeper should produce the passing desktop-security result rather than an unavailable-assessment warning.

No logs or session transcripts are attached.

Locate the macOS desktop security check and its Gatekeeper invocation, then run codex doctor --summary on macOS to reproduce the warning. Update the assessment invocation to match the issue's expected arguments and verify that an accepted signed app reports a passing desktop-security result.