Yeachan-Heo/oh-my-codex · critical · Error

[api] failed to launch native binary: executable is blocked

Error message

[api] failed to launch native binary: executable is blocked (${errno.code || 'blocked'})

What it means

Spawning the omx-api native binary failed with an error classified as 'blocked' — typically EACCES/EPERM, meaning the OS refused to execute the file. The message includes the errno code (or 'blocked') from the underlying Node spawn error.

Source

Thrown at src/cli/api.ts:222

function isHelpRequest(args: readonly string[]): boolean {
  if (args.length === 0) return true;
  return args.includes('--help') || args.includes('-h');
}

export async function apiCommand(args: string[]): Promise<void> {
  if (isHelpRequest(args)) {
    console.log(API_USAGE);
    return;
  }

  const binaryPath = await resolveApiBinaryPathWithHydration();

  const result = runApiBinary(binaryPath, args);
  if (result.error) {
    const errno = result.error as NodeJS.ErrnoException;
    const kind = classifySpawnError(errno);
    if (kind === 'missing') throw new Error(`[api] failed to launch native binary: executable not found (${binaryPath})`);
    if (kind === 'blocked') throw new Error(`[api] failed to launch native binary: executable is blocked (${errno.code || 'blocked'})`);
    throw new Error(`[api] failed to launch native binary: ${errno.message}`);
  }

  writeApiResultOutput(result);
  if (result.status !== 0) {
    process.exitCode = typeof result.status === 'number'
      ? result.status
      : resolveSignalExitCode(result.signal);
  }
}

View on GitHub (pinned to 3ad79a8a6f)

Solutions

1. chmod +x the binary path shown in the error
2. Remove macOS quarantine: `xattr -d com.apple.quarantine <binaryPath>`
3. Remount or relocate the binary off a noexec filesystem / adjust SELinux/AppArmor policy
4. Point OMX_API_BIN_ENV at a copy of the binary in an executable-permitted location

Example fix

# before
omx api status   # EACCES
# after
chmod +x $(omx api --print-binary-path)
omx api status

import { accessSync, constants } from 'node:fs';
try { accessSync(binPath, constants.X_OK); } catch { throw new Error(`binary not executable: ${binPath}`); }

catch (e) { if (/executable is blocked/.test(String(e))) { execSync(`chmod +x ${binPath}`); retry(); } else throw e; }

When it happens

Trigger: Running `omx api` when the binary lacks the execute bit, when macOS quarantine attributes flag an downloaded unsigned binary, or when AppArmor/SELinux/noexec mounts prevent execution.

Common situations: Binaries downloaded without +x; macOS Gatekeeper quarantine (xattr com.apple.quarantine); Docker volumes mounted with noexec; restrictive CI container policies.

Related errors

• failed to launch codex login: executable is blocked (${error
• [api] failed to launch native binary: executable not found (
• [sparkshell] raw fallback failed: executable is blocked (${e
• [sparkshell] failed to launch native binary: executable is b
• failed to run notify-hook: ${result.error.message}

AI-assisted analysis of Yeachan-Heo/oh-my-codex@3ad79a8a6f (2026-08-27). Data as JSON: /api/errors/377c201b6f3f548d. Report an issue: GitHub.