[mac] "VSCodium is trying to add a new helper tool" appears since a week or two

[KevinGimbel]

Describe the bug

Since a week or two, I randomly see this dialog pop up when VSCodium is open

The first time I accepted it / entered TouchID because this is not unusual. But it keeps popping up and I cannot figure out what the helper tool is supposed to be.

Please confirm that this problem is VSCodium-specific

• This bug doesn't happen if I use Microsoft's Visual Studio Code. It only happens in VSCodium.

Please confirm that the issue/resolution isn't already documented

• I checked the Docs page and the Troubleshooting page and my issue is not mentioned there.

To Reproduce
Steps to reproduce the behavior:

1. Download VScodium on MacOS
2. ???
3. Dialog keeps popping up

Expected behavior
A clear and concise description of what you expected to happen.

Desktop (please complete the following information):

• OS: Mac OS
• Architecture arm64
• Version 1.109.31074
• App Manager Nix
• Sandboxed no

Additional context

I've really no idea what is happening or how to provide better info. If I can attach any more logs or whatever please don't hesitate to reach out!

[daiyam]

Which macOS version?
Can you try the .dmg at https://github.com/VSCodium/vscodium/releases/tag/1.109.51242?

[KevinGimbel]

MacOS 26.3, I'll try the dmg

[daiyam]

I've found this:

• VS Code asks me to allow a "Helper Tool" on every update microsoft/vscode#105518

where a solution is given at:

• Code won't update on macOS microsoft/vscode#7426 (comment)

[KevinGimbel]

@daiyam interesting, thank you! I've tried the xattr command and could do an update of the Nix-installed version of Codium.

Curiously, this never happened with VSCode itself which I have installed as well and am using alongside VSCodium.

---

I think part of the problem may be nix, too.

My nix flake always installed an older version (1.109.31074), which means I always reset the update when I ran a rebuild of my nix config (which I do regularly).

After doing an upgrade in the UI, I saw the following version information:

Version: 1.109.51242
Commit: 2a5b258b5b38d3d4c830bdaaa6e5c610eaacbd15
Date: 2026-02-20T18:42:00.860Z
Electron: 39.3.0
ElectronBuildId: undefined
Chromium: 142.0.7444.265
Node.js: 22.21.1
V8: 14.2.231.22-electron.0
OS: Darwin arm64 25.3.0

After running a nix rebuild of my system, I saw this:

Version: 1.109.31074
Commit: 22dfe516eda675a2ce9ce2f2e78eabe4e7d9fece
Date: 2026-02-13T18:54:51.887Z
Electron: 39.3.0
ElectronBuildId: undefined
Chromium: 142.0.7444.265
Node.js: 22.21.1
V8: 14.2.231.22-electron.0
OS: Darwin arm64 25.3.0

So nix downgrades the application on rebuild (as is expected I guess).

I upgraded my flake in the meantime to use the latest nixpkgs version, and now I get the up-to-date version: 1.109.51242 from nix as well.

---

Sorry for the false bug report, and thanks a lot for your assistance!

[daiyam]

@KevinGimbel With the newest version, I've got new report of security issue with Tahoe (#2734 and #2735) even if the app is signed and notarized..

Can you run the commands on the newest version of the .app:

• codesign -vvv --deep --strict /path/to/binary/or/bundle
• spctl -vvv --assess --type exec /path/to/application
• codesign -dvv /path/to/binary/or/bundle

(from https://developer.apple.com/documentation/security/resolving-common-notarization-issues)

[daiyam]

The issue seems to be due to Gatekeeper. Have you installed the 26.3.1 on the 4th?

[KevinGimbel]

I'm still on 26.3 due to some issues colleagues had with 26.3.1

Are you still interested in the output of the commands?

[daiyam]

If you still have the issue, the command gktool scan VSCodium.app will be more useful. It test Gatekeeper. (the quarantine flag is for Gatekeeper to check the app)
I did install Tahoe in a VM and I didn't get the issue so something going on...

[KevinGimbel]

I still get the pop-up occasionally. Here's the result of gktool:

gktool scan /Applications/Nix\ Apps/VSCodium.app
Progress: 744416000/744416000
Scan completed and software is allowed by system policy.

I'll keep an eye on it. I feel like this is somehow related to installing via nix, and then updating via the UI.

I just now got a prompt to update and did the update, so now I'm on 1.110.11631

[KevinGimbel]

I don't know how, but it seems I have two version of Codium installed now?? 😓

The window on the left was opened with the codium . command in the terminal, the one on the right via Raycast.

[KevinGimbel]

Running this:

which codium
/run/current-system/sw/bin/codium

reveals codium to point to the version from nix.

ls -ahl $(which codium)
lrwxr-xr-x@ 1 root  wheel    75B Jan  1  1970 /run/current-system/sw/bin/codium -> /nix/store/acw6c91ffsvaxhbvvv4yc7km4v6f128p-vscodium-1.109.51242/bin/codium

This seems to be the older, un-updated version of Codium. The one in Applications/Nix Apps is updated and a newer version.

So when I open Codium from the terminal I get the older version, which wants to do an update and the update then applies to the version in Applications/Nix Apps leaving the read-only version in the nix store alone.

---

So... this is a nix problem, and I shouldn't update through the UI but only through nix itself.