{"record":{"id":"937c1f8640f59892","repo":"Yeachan-Heo/oh-my-codex","slug":"failed-to-launch-codex-login-executable-is-blocke","errorCode":null,"errorMessage":"failed to launch codex login: executable is blocked (${error.code || \"blocked\"})","messagePattern":"failed to launch codex login: executable is blocked \\((.+?)\\)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"critical","filePath":"src/cli/auth.ts","lineNumber":51,"sourceCode":"    if (!allowed.has(arg)) {\n      throw new Error(`unsupported codex login flag for omx auth add: ${arg}`);\n    }\n  }\n}\n\nfunction runCodexLogin(cwd: string, env: NodeJS.ProcessEnv, loginArgs: string[] = []): void {\n  validateCodexLoginArgs(loginArgs);\n  const { result } = spawnPlatformCommandSync(\"codex\", [\"login\", ...loginArgs], {\n    cwd,\n    env,\n    stdio: \"inherit\",\n    encoding: \"utf-8\",\n  });\n  if (result.error) {\n    const error = result.error as NodeJS.ErrnoException;\n    const kind = classifySpawnError(error);\n    if (kind === \"missing\") throw new Error(\"failed to launch codex login: executable not found in PATH\");\n    if (kind === \"blocked\") throw new Error(`failed to launch codex login: executable is blocked (${error.code || \"blocked\"})`);\n    throw error;\n  }\n  if (result.status !== 0) {\n    throw new Error(`codex login exited with code ${result.status ?? 1}`);\n  }\n}\nasync function fileExists(path: string): Promise<boolean> {\n  try {\n    await readFile(path);\n    return true;\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return false;\n    throw error;\n  }\n}\n\nasync function createIsolatedLoginCodexHome(home: string | undefined): Promise<string> {\n  const base = join(home || homedir(), \".omx\");","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/Yeachan-Heo/oh-my-codex/blob/3ad79a8a6fe6e95fdbb8c00e40716fffe4011ce2/src/cli/auth.ts#L33-L69","documentation":"The spawn of `codex login` failed with an error classified as 'blocked' (EACCES/EPERM-class), meaning the OS refused to execute the resolved codex binary. The specific errno code is included in the message.","triggerScenarios":"The codex executable lacks execute permission, resides on a noexec-mounted filesystem, is blocked by SELinux/AppArmor, or carries macOS quarantine attributes.","commonSituations":"Manually copied binaries without +x; macOS Gatekeeper quarantine on downloaded CLIs; corporate endpoint protection blocking unsigned executables; Docker noexec volumes.","solutions":["chmod +x $(which codex)","On macOS: `xattr -d com.apple.quarantine $(which codex)`","Move codex off noexec mounts and adjust SELinux/AppArmor/AV policies to allow it","Reinstall codex via the official installer, which sets correct permissions"],"exampleFix":"# before\nomx auth add work   # EACCES\n# after\nchmod +x \"$(command -v codex)\"\nomx auth add work","handlingStrategy":"validation","validationCode":"import { execFileSync } from 'node:child_process';\nexecFileSync('chmod', ['+x', codexPath]); // or check X_OK via fs.accessSync","typeGuard":null,"tryCatchPattern":"catch (e) { if (/executable is blocked/.test(String(e))) { execSync(`xattr -d com.apple.quarantine ${codexPath} || true; chmod +x ${codexPath}`); retry(); } else throw e; }","preventionTips":["Install codex via official installers that set +x","Avoid noexec mounts for global bin dirs","Whitelist codex in endpoint protection policies"],"tags":["auth","spawn","eacces","permissions","codex"],"backgroundTag":"spawn-eacces-blocked","analyzedSha":"3ad79a8a6fe6e95fdbb8c00e40716fffe4011ce2","analyzedAt":"2026-08-27T22:18:39.783Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}