Yeachan-Heo/oh-my-codex · critical · Error

failed to launch codex login: executable is blocked (${error

Error message

failed to launch codex login: executable is blocked (${error.code || "blocked"})

What it means

The spawn of `codex login` failed with an error classified as 'blocked' (EACCES/EPERM-class), meaning the OS refused to execute the resolved codex binary. The specific errno code is included in the message.

Source

Thrown at src/cli/auth.ts:51

    if (!allowed.has(arg)) {
      throw new Error(`unsupported codex login flag for omx auth add: ${arg}`);
    }
  }
}

function runCodexLogin(cwd: string, env: NodeJS.ProcessEnv, loginArgs: string[] = []): void {
  validateCodexLoginArgs(loginArgs);
  const { result } = spawnPlatformCommandSync("codex", ["login", ...loginArgs], {
    cwd,
    env,
    stdio: "inherit",
    encoding: "utf-8",
  });
  if (result.error) {
    const error = result.error as NodeJS.ErrnoException;
    const kind = classifySpawnError(error);
    if (kind === "missing") throw new Error("failed to launch codex login: executable not found in PATH");
    if (kind === "blocked") throw new Error(`failed to launch codex login: executable is blocked (${error.code || "blocked"})`);
    throw error;
  }
  if (result.status !== 0) {
    throw new Error(`codex login exited with code ${result.status ?? 1}`);
  }
}
async function fileExists(path: string): Promise<boolean> {
  try {
    await readFile(path);
    return true;
  } catch (error) {
    if ((error as NodeJS.ErrnoException).code === "ENOENT") return false;
    throw error;
  }
}

async function createIsolatedLoginCodexHome(home: string | undefined): Promise<string> {
  const base = join(home || homedir(), ".omx");

View on GitHub (pinned to 3ad79a8a6f)

Solutions

chmod +x $(which codex)
On macOS: `xattr -d com.apple.quarantine $(which codex)`
Move codex off noexec mounts and adjust SELinux/AppArmor/AV policies to allow it
Reinstall codex via the official installer, which sets correct permissions

Example fix

# before
omx auth add work   # EACCES
# after
chmod +x "$(command -v codex)"
omx auth add work

Defensive patterns

Strategy: validation

Validate before calling

import { execFileSync } from 'node:child_process';
execFileSync('chmod', ['+x', codexPath]); // or check X_OK via fs.accessSync

Try / catch

catch (e) { if (/executable is blocked/.test(String(e))) { execSync(`xattr -d com.apple.quarantine ${codexPath} || true; chmod +x ${codexPath}`); retry(); } else throw e; }

Prevention

Install codex via official installers that set +x
Avoid noexec mounts for global bin dirs
Whitelist codex in endpoint protection policies

When it happens

Trigger: The codex executable lacks execute permission, resides on a noexec-mounted filesystem, is blocked by SELinux/AppArmor, or carries macOS quarantine attributes.

Common situations: Manually copied binaries without +x; macOS Gatekeeper quarantine on downloaded CLIs; corporate endpoint protection blocking unsigned executables; Docker noexec volumes.

Related errors

AI-assisted analysis of Yeachan-Heo/oh-my-codex@3ad79a8a6f (2026-08-27). Data as JSON: /api/errors/937c1f8640f59892. Report an issue: GitHub.