[macOS] Computer Use helper repeatedly asks for first-open approval after ChatGPT updates

What version of the Codex App are you using (From “About Codex” dialog)?

Affected desktop release observed: ChatGPT 26.915.31945, build 9922 (com.openai.codex).

What subscription do you have?

Not included in this public report.

What platform is your computer?

macOS 27.0, build 26A428, Apple Silicon.

Computer Use helper: 26.916.1001103 (com.openai.sky.CUAService). Homebrew: 7.0.4-17-g2f1c682, official chatgpt cask. Both Homebrew and the app's Sparkle updater have been used.

What issue are you seeing?

After ChatGPT updates, macOS repeatedly asks for first-open approval of Codex Computer Use.app:

“Codex Computer Use.app” is an app downloaded from the Internet. Are you sure you want to open it?

The dialog also says that Apple checked the app for malicious software and none was detected. Clicking Open allows the helper to run, but the confirmation returns after a later update.

This is a repeated download-confirmation prompt. It is not a damaged-app error or an Accessibility / Screen Recording permission request.

What steps can reproduce the bug?

Observed sequence:

1. Install ChatGPT through the official Homebrew cask.
2. Launch Computer Use and approve the helper with Open.
3. Update ChatGPT. Both Homebrew and in-app updates have been used; the latest observed recurrence followed a Homebrew update.
4. Launch ChatGPT / Computer Use again.
5. macOS asks for the same first-open confirmation.

The exact Homebrew invocation was not captured, and the full update sequence has not been replayed under instrumentation.

What is the expected behavior?

Normal updates should preserve the user's existing opening approval for the valid, signed Computer Use helper while retaining macOS security checks.

Additional information

Local checks before a targeted metadata repair showed:

• The bundled helper had quarantine flags 0181 and no approved paths.
• The installed helper under $CODEX_HOME/computer-use/Codex Computer Use.app had root flags 01c1 and 71 approved paths, including its root. The difference is the user-approved bit 0x0040.
• The bundled and installed helper copies had identical contents. Both passed codesign --verify --deep --strict; Gatekeeper accepted the helper.
• The current desktop app's startup code replaces the installed helper using /usr/bin/ditto --noqtn from the bundled helper.
• On this macOS build, a disposable copy probe using that command retained the source quarantine flags, including whether the approval bit was present.

A local repair copied existing approval bits from the installed helper to matching paths in the identical bundled helper. Contents and download provenance were preserved. Signature, Gatekeeper, copy-retention, and Homebrew approval-scanner checks passed. The prompt nevertheless returned after subsequent updates.

The update history includes an intervening Sparkle update: logs show a completed download from build 9647, then a running build 9771, before the later Homebrew installation of build 9922. Thus the repair was not followed directly by a single Homebrew update.

An isolated test of Homebrew's installed approval-inheritance routine passed using copies of the old approved and new helpers: the signing identity matched, and none of the 71 expected approval paths were missing afterward. This does not establish which updater lost approval in the full sequence.

Please investigate the helper replacement path and quarantine/approval handling across Sparkle and Homebrew updates.

Current workaround: brew pin --cask chatgpt, leaving ChatGPT's own automatic updater enabled. The current helper approval was also repaired. UNVERIFIED: whether the next in-app update avoids the prompt; this is not a confirmed permanent fix.

Related: #29584 reports a damaged helper after updating. Its symptom differs; a common cause has not been established.

Trace the desktop app's helper replacement path, including /usr/bin/ditto --noqtn, and compare approval handling across Sparkle and Homebrew updates. Reproduce the update sequence with the bundled and installed Codex Computer Use.app copies, then identify which updater loses approval and verify that normal updates preserve it while codesign, Gatekeeper, and approval-scanner checks continue to pass.