macOS CLI: bundled Computer Use helper requests microphone permission without audio-input entitlement, then fails with "Apple event error -10000: Sender process is not authenticated"

[Jorjon]

What version of Codex CLI is running?

codex-cli 0.121.0

What subscription do you have?

ChatGPT Plus

Which model were you using?

gpt-5.4

What platform is your computer?

Darwin 24.6.0 arm64 arm

What terminal emulator and version are you using (if applicable)?

kitty 0.46.0

What issue are you seeing?

The bundled computer-use@openai-bundled plugin loads and the helper launches, but real Computer Use calls fail at runtime with:

Apple event error -10000: Sender process is not authenticated

This does not appear to be a normal missing Accessibility / Screen Recording setup issue.

I verified locally that:

• features.apps = true is enabled
• plugins."computer-use@openai-bundled".enabled = true
• stale local computer-use@local overrides were removed
• the helper app was installed/launched from the bundled plugin into ~/Applications/Codex Computer Use.app
• Accessibility and Screen Recording are already granted to com.openai.sky.CUAService
• the helper bundle has Apple Events automation entitlement
• but the helper does not have com.apple.security.device.audio-input

During a fresh failing list_apps call, macOS TCC logs show the helper requesting microphone/audio permission and being denied immediately because the entitlement is missing.

Representative local TCC evidence:

• service: kTCCServiceMicrophone
• identifier: com.openai.sky.CUAService
• error:
  Prompting policy for hardened runtime; service: kTCCServiceMicrophone requires entitlement com.apple.security.device.audio-input but it is missing

After that, Codex still surfaces only:

Apple event error -10000: Sender process is not authenticated

So the user-facing error appears misleading. The helper seems to hit a denied audio/microphone TCC path first.

What steps can reproduce the bug?

1. On macOS Apple Silicon, run codex from the terminal.
2. Enable the bundled plugin in ~/.codex/config.toml:

[features]
apps = true

[plugins."computer-use@openai-bundled"]
enabled = true

3. Install/launch the bundled helper once so com.openai.sky.CUAService is registered.
4. Grant Accessibility and Screen Recording permissions to Codex Computer Use.
5. Start a fresh Codex CLI session.
6. Ask Codex to use Computer Use, for example: use computer use to list apps
7. Observe failure:
   • tool returns Apple event error -10000: Sender process is not authenticated
8. Check macOS unified logs / TCC logs around the failing call and observe a microphone/audio TCC denial for com.openai.sky.CUAService because com.apple.security.device.audio-input is missing.

What is the expected behavior?

If the helper does not require microphone/audio input for list_apps, it should not request it.

If it does require audio input, the bundled helper should ship with the correct entitlement and usage strings so TCC can grant it normally.

Either way, the failure should not surface only as Apple event error -10000 when the underlying blocked path is a TCC audio/microphone entitlement problem.

Additional information

This seems distinct from the current Computer Use issues:

• Codex app on macOS shows 'Computer Use plugin unavailable' while bundled plugin files exist #18258
• [Bug] Computer Use plugin remains "unavailable" on macOS Intel (x86_64) despite MCP server showing as enabled and latest Intel build #18404

In this case, the plugin is present and launches correctly; the failure happens after launch during runtime permission handling.

Additional local observations:

• Public openai/codex appears to contain plugin discovery/plumbing for computer-use, but not the source for the proprietary helper bundle itself.
• The bundled helper inspected here was:
  ~/.codex/plugins/cache/openai-bundled/computer-use/1.0.750/Codex Computer Use.app
• The helper entitlements include Apple Events automation, but not audio-input entitlement.

[joeykrug]

Same issue

[samuelkahessay]

I’m seeing the same user-visible failure, with some extra TCC evidence that may help narrow it down.

Repro still fails at runtime with:

computer-use list_apps -> Apple event error -10000: Sender process is not authenticated

What I verified locally:

• bundled helper: computer-use@openai-bundled 1.0.750
• com.openai.sky.CUAService already has system TCC grants for:
  • kTCCServiceAccessibility
  • kTCCServiceScreenCapture
• I forced fresh AppleEvents prompts by launching the Codex app-server from both Ghostty and Terminal.app
• macOS created allow rows for both:
  • kTCCServiceAppleEvents | com.mitchellh.ghostty | com.openai.sky.CUAService | auth=2
  • kTCCServiceAppleEvents | com.apple.Terminal | com.openai.sky.CUAService | auth=2

Even after accepting those prompts, list_apps still returns the same Apple event error -10000.

Most relevant tccd line from the failing Terminal-hosted attempt:

TCCDProcess: identifier=com.openai.sky.CUAService ... attempted to call TCCAccessRequest for kTCCServiceAccessibility without the recommended com.apple.private.tcc.manager.check-by-audit-token entitlement

I also saw the earlier AppleEvents attribution failure when Codex.app was treated as the responsible app:

service: kTCCServiceAppleEvents requires entitlement com.apple.security.automation.apple-events but it is missing for responsible={identifier=com.openai.codex ...}

So this looks consistent with the same -10000 surface error masking multiple underlying macOS permission/attribution failures, not just a missing user grant.

[2001Y]

Reproduced on macOS with Codex CLI 0.121.0 after explicitly granting permissions to the exact bundled helper app Codex is actually launching.

What I verified locally:

• Codex is launching the cache-side helper, not the app-bundled copy:
  • ~/.codex/plugins/cache/openai-bundled/computer-use/1.0.750/Codex Computer Use.app
• The launched executable is:
  • ~/.codex/plugins/cache/openai-bundled/computer-use/1.0.750/Codex Computer Use.app/Contents/SharedSupport/SkyComputerUseClient.app/Contents/MacOS/SkyComputerUseClient mcp
• Bundle identifiers / signing observed on that helper:
  • com.openai.sky.CUAService
  • com.openai.sky.CUAService.cli
  • TeamIdentifier: 2DC432GLL2

After adding the cache-side "Codex Computer Use.app" in System Settings and re-testing, a simple:

• computer-use.list_apps({})

still fails with:

• Apple event error -10000: Sender process is not authenticated

So in my case this is not resolved just by granting permissions to the actual helper app Codex is using.

[jshaw]

seeing this too :/

[joeykrug]

Also running into this on the UI side now too via the codex app. It says it thinks computer use is not approved via accessibility and automation but it is

[figelwump]

I'm seeing this error as well when invoking Computer Use via the app server from a standalone client. Computer Use via Codex.app works fine on the same machine with the same prompts.

The bit of data I'll add to the conversation is that TCC is showing allowed indirect requests, so this might be a sender/session attribution problem (rather than a permission denial).

[manikv12]

Having issues on codex app as well.