Explain macOS permissions for Codex plugins

[RhysSullivan]

A Codex plugin blocked by macOS failed with Internal tool error [93fa7e87]. The plugin's own message is "Unknown error" — only a numeric code says what happened — and that gets scrubbed to an opaque id at the MCP boundary, so neither the user nor the model could tell that macOS was the blocker or what to do.

What I found, by probing a live install rather than from docs:

• The grants do not all attach to the same identity. Reading Messages works from a host with no Full Disk Access, because the Codex Computer Use service (com.openai.sky.CUAService) holds that grant and does the reading. But an Apple Event is attributed to the responsible process — the app that launched the chain — so Automation is per host. The same call succeeds from a terminal whose app is approved and fails from a desktop app that is not. That is the -1743 (errAEEventNotPermitted).
• Codex's own docs confirm the split from the other side: Screen Recording and Accessibility are granted to the entry named "Codex Computer Use", not to ChatGPT — so granting those once covers every host.
• A denial is permanent until the user acts. macOS asks once; afterwards the code comes back forever and no prompt appears again. "Try again" is not a recovery.

What this adds:

• Classification in the bridge, on the numeric code rather than wording, translated while the plugin identity is still known: "macOS blocked this: Automation access has not been allowed. Open System Settings → Privacy & Security → Automation, find "Executor → Messages", and turn it on… macOS only asks once."
• A per-plugin permission descriptor — what is needed, which entry to look for, why, and a deep link to the exact Privacy pane.
• A "macOS access" section on each plugin's add screen, stating the requirements before anything runs, each row linking to its pane.

Verified: the happy path still returns real chats from a host that holds the grant, and the refusal path produces the actionable message on the real code path (fixture reproduces the exact -1743 string).

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	e3c3714	Commit Preview URL Branch Preview URL	Aug 30 2026, 04:15 AM

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	e3c3714	Aug 30 2026, 04:17 AM

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@1869

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@1869

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@1869

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@1869

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@1869

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@1869

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@1869

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@1869

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@1869

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@1869

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@1869

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@1869

executor

npm i https://pkg.pr.new/executor@1869

commit: e3c3714