Codex Desktop macOS crashed during Sparkle auto-update with SIGSEGV and failed app replacement

[rogierx]

What version of the Codex App are you using (From “About Codex” dialog)?

Current after relaunch/update: 26.513.31313 (CFBundleVersion 2867).

The crashed running process was from the previous app version, based on its crashpad annotation: 26.513.20950.

What subscription do you have?

ChatGPT Pro

What platform is your computer?

Darwin 24.5.0 arm64 arm

Additional platform detail: macOS 15.5 build 24F74, Apple Silicon (arm64).

What issue are you seeing?

Codex Desktop crashed while Sparkle was finalizing an auto-update on macOS. The visible desktop/Electron shell exited, while a background codex app-server process survived.

The key event was at 2026-05-21 02:07:39 +0200:

launchd[1]: [gui/501/application.com.openai.codex... [670]:] exited due to SIGSEGV | sent by exc handler[670], ran for 101005154ms
runningboardd: [app<application.com.openai.codex...>:670] termination reported by launchd (2, 11, 11)
loginwindow: App: Codex, quit, updating active tracking timer

At the same timestamp, Sparkle failed to finalize the replacement:

Autoupdate[892] [org.sparkle-project.Sparkle:Sparkle] Invoking fallback from failing to replace original item with error: Error Domain=NSPOSIXErrorDomain Code=2 "No such file or directory" UserInfo={NSLocalizedDescription=Failed to replace Codex.app with Codex.app.}
Autoupdate[892] [org.sparkle-project.Sparkle:Sparkle] Error: Failed to finalize installation
Autoupdate[892] [org.sparkle-project.Sparkle:Sparkle] Error: Failed to move new app at /Users/<user>/Library/Caches/com.openai.codex/org.sparkle-project.Sparkle/Installation/<redacted>/<redacted>/Codex.app to final destination /Applications/Codex.app
Autoupdate[892] [org.sparkle-project.Sparkle:Sparkle] Error: Source file to move (Codex.app) does not exist. The file doesn't exist.
Updater[893] [org.sparkle-project.Sparkle:Sparkle] Couldn't remove agent bundle: Error Domain=NSCocoaErrorDomain Code=4 "Updater.app couldn't be removed." ... NSUnderlyingError={Error Domain=NSPOSIXErrorDomain Code=2 "No such file or directory"}

Other nearby evidence:

kernel: AMFI: Denying core dump for pid 670 (Codex)
powerd: Process Codex.670 ClientDied NoIdleSleepAssertion "Electron" age:17:29:04
powerd: Process Codex.670 ClientDied NoDisplaySleepAssertion "Video Wake Lock" age:03:10:21

No reboot happened at that time. The machine stayed up, and Codex relaunched later. After relaunch, the app bundle on disk was 26.513.31313, and local verification passed:

/Applications/Codex.app: valid on disk
/Applications/Codex.app: satisfies its Designated Requirement
/Applications/Codex.app: accepted
source=Notarized Developer ID

All local usernames, machine names, cache subdirectory names, and network/IP details are redacted from the excerpts above.

What steps can reproduce the bug?

I do not have a minimal deterministic repro yet; this is an observed auto-update failure with timestamped macOS logs.

Observed sequence:

1. Run Codex Desktop 26.513.20950 on macOS for an extended period.
2. Leave the app open while Sparkle auto-update runs in the background.
3. During update finalization, the main Codex desktop process exits with SIGSEGV.
4. Sparkle logs a failed app replacement because the staged Codex.app source path no longer exists.
5. Relaunching later succeeds and the app ends up on 26.513.31313.

Session ID / token usage / context window usage: not applicable. This appears to be a local desktop app updater crash, not a model-session failure.

What is the expected behavior?

Codex Desktop should not crash during Sparkle auto-update finalization.

If the staged update is missing or cannot be moved into /Applications/Codex.app, the updater should fail gracefully, keep the existing app usable, and show/log a recoverable update failure. It should not take down the running desktop shell with SIGSEGV.

Additional information

I checked for likely duplicates before filing. These appear related but not exact duplicates:

• Recovery tool for Codex App 0.130→0.131 startup crash: SQLx checksum drift + 30s backfill timeout #23787: Windows auto-update/database migration/backfill crash after 0.130 -> 0.131.
• Codex Desktop 26.513.20950 (2816) crashes on launch on macOS 26.4 build 25E5218f with EXC_BREAKPOINT / SIGTRAP in Electron Framework / V8 / Node startup #22881: macOS launch crash with EXC_BREAKPOINT / SIGTRAP in Electron/V8 startup.
• macOS XProtect false positive: Sparkle Updater.app flagged as malware #23308: macOS XProtect/syspolicyd false positive around Sparkle Updater.

This report is specifically about a macOS SIGSEGV during Sparkle update finalization with simultaneous Failed to finalize installation / missing staged Codex.app errors.

[github-actions]

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• Codex desktop app keeps re-downloading update after restart #22688

Powered by Codex Action

[rogierx]

Additional occurrence on the same machine after the app had already updated successfully to 26.513.31313.

This second crash happened at 2026-05-21 12:35:57 +0200. Unlike the first report, there were no Sparkle/Autoupdate log lines in the crash window. The app was valid/notarized on disk before and after the crash.

Relevant sanitized log slice:

2026-05-21 12:35:57.461 Codex[97047] AppKit performClick:
2026-05-21 12:35:57.462 Codex[97047] AppKit window <ElectronNSPanel: ...> windowNumber=5927 windowShouldClose: prevented close
2026-05-21 12:35:57.466 Codex[97047] AppKit window <ElectronNSPanel: ...> windowNumber=5927 finishing close
2026-05-21 12:35:57.468 Codex[97047] AppKit context (... -> 0) for window 5927
2026-05-21 12:35:57.483 kernel AMFI: Denying core dump for pid 97047 (Codex)
2026-05-21 12:35:57.502 chrome_crashpad_handler[97052] WARNING: mach_vm_read(...): (os/kern) invalid address (1)
2026-05-21 12:35:57.889 launchd[1] [gui/501/application.com.openai.codex... [97047]:] exited due to SIGSEGV | sent by exc handler[97047], ran for 7579577ms
2026-05-21 12:35:57.889 launchd[1] service has crashed 1 times in a row (last was not dirty)

Immediately before the close sequence, Codex also removed a delivered notification:

2026-05-21 12:35:57.414 Codex[97047] [com.openai.codex] Removing 1 delivered notifications with identifiers ("FACE-E06A")

Observed process state after relaunch:

/Applications/Codex.app: valid on disk
/Applications/Codex.app: satisfies its Designated Requirement
/Applications/Codex.app: accepted
source=Notarized Developer ID
Current app version: 26.513.31313 (2867)

Notable local state: the machine had multiple Codex background generations still alive after the earlier crash/relaunch cycle, including an old 26.513.20950 crashpad handler and multiple codex app-server --analytics-default-enabled processes. I am not including local usernames, machine names, project paths, session IDs, or full environment dumps here.

This makes the original report less likely to be purely Sparkle-specific. There appear to be at least two native main-process SIGSEGV paths on macOS: one during Sparkle finalization, and one during Electron/AppKit panel close handling.