The Codex Error Encyclopedia

Strip the quarantine flag: `xattr -d com.apple.quarantine /opt/homebrew/Caskroom/codex/<version>/codex-path/rg`, or delete that bundled binary so Codex falls back to a ripgrep on your PATH. For the durable fix, run `brew reinstall --cask codex` — the cask reverted to OpenAI's signed standalone tarball on July 10, 2026, after the unsigned bundled rg briefly returned in 0.144.1.

This error is not user-fixable: it means your ChatGPT workspace (Business, Enterprise, or Edu) has Codex switched off for local use. A workspace admin must enable the "Allow members to use Codex Local" control in workspace settings, which gates the CLI, IDE extension, and desktop app together. For headless or SSH logins, the admin must also enable device code authentication at chatgpt.com/admin/permissions. If it persists after enabling, contact OpenAI's help center with the request ID from the error.

Upgrade past 0.144.0 — the 0.144.1 hotfix repairs helper-binary resolution. Standalone installs: rerun `curl -fsSL https://chatgpt.com/codex/install.sh | sh`. Homebrew: upgrade the cask, which moved to 0.144.1 on July 10. Stuck on 0.144.0? Symlink the helper from `~/.codex/packages` into `~/.local/bin`, run `codex -c features.code_mode_host=false`, or download `codex-code-mode-host` from the GitHub release and place it next to the `codex` binary.

Your running session filled the context window. Recover it with `/compact` to summarize the transcript and free tokens, or `/new` (fresh task, same CLI session) or `/clear` to start clean. If it fires seconds into a new session, check your config; bad `model_context_window` or `model_auto_compact_token_limit` overrides on a built-in model break auto-compaction. This is the mid-session message, not the single-input limit.

Run the Codex CLI in the same project first — reporters consistently find it still works while the extension or app fails, and it often prints the real error the app swallows, typically a malformed config or skill file under ~/.codex. Then start a fresh thread instead of resuming an old one (the timeout variant clusters in old threads), restart or reinstall the extension, and check status.openai.com. Both tracking issues remain open; no confirmed upstream fix.

No complete upstream fix exists. Restart the session — close the failing instance and reopen with `codex resume`; files that repeatedly failed to patch usually apply cleanly after, per reports on the open GitHub issue. Never run in read-only sandbox mode, which blocks all file writes by design. On Windows or with CJK text, reports point to an encoding bug — force the console to UTF-8 (`chcp 65001`) and keep files UTF-8. Otherwise the model retries its way through at token cost.

Start a fresh session — exit and relaunch, or run `codex resume --last` if you need the previous thread back. `/compact` can free space mid-session, but reporters describe it as unreliable on the largest threads, and auto-compaction can hit the same wall. Prevent repeats by muting giant tool output: quiet test reporters, tail long logs, or pipe output to a file and have Codex read it back selectively.

Windows itself is blocking the port, not another app. In an admin terminal, run `net stop winnat`, then `codex login`, then `net start winnat` — this reshuffles the reserved port ranges that swallow 1455. For a permanent fix, run `netsh int ipv4 set dynamicport tcp start=49152 num=16384` (repeat for ipv6) and reboot. Or skip the local server: `codex login --device-auth` uses the device-code flow and never binds a port.

Run the server command by itself in a terminal first — if it fails there, Codex is not the problem. On Windows, update Codex (a November 2025 fix resolved npx/pnpm .cmd scripts) or point `command` at an absolute executable such as node.exe plus the script path. Then pin Node 20 or 22, raise `startup_timeout_sec` past the 10-second default, keep server logs on stderr, and use `/mcp` streamable-HTTP endpoints rather than `/sse`.

Community-confirmed cause: a stale `CODEX_CLI_PATH` override or cached old `codex.exe` makes the desktop app launch an outdated app-server that rejects the new build's dynamic tools. Delete the registry value (`reg delete HKCU\Environment /v CODEX_CLI_PATH /f`), remove any `CODEX_CLI_PATH` line from `~/.codex/config.toml`, clear stale binaries under `%LOCALAPPDATA%\OpenAI\Codex`, and relaunch. Until then, create the thread from the CLI and resume it in the app.

Both error strings trace to the same Responses-Lite header hitting a provider that can't honor it. On Desktop, remove the model_provider = "openai_http" or custom-provider block from config.toml — flipping use_responses_lite in model_cache.json does nothing, because the app rewrites it on startup. On CLI with Azure or a proxy, export the catalog with codex debug models, set use_responses_lite to false on the GPT-5.6 entries, and point model_catalog_json at your copy.

Two local causes cover most reports. First, a stale ~/.codex/auth.json: quit your IDE or CLI session, run `mv ~/.codex/auth.json ~/.codex/auth.json.bak`, relaunch, and sign back in with ChatGPT. Second, an OPENAI_API_KEY environment variable silently overriding your OAuth token: unset it. If you authenticate with a business access token, the 401 is a known server-side problem with no user-side fix — watch the open GitHub tracker.

No confirmed fix and no public maintainer response — issue #28879 is assigned to an OpenAI engineer, but neither tracking thread has an official answer. Community-reported mitigations: update Codex (some reporters say the drain stabilized after updating), disable memory and prompt-recommendation features (one traced idle-drain case stopped there), keep per-turn context lean, and add your session logs to openai/codex #14593 or #28879 so the reports keep clustering.

Empty the "proxy_ports" array in .codex\.sandbox\setup_marker.json, then stop it re-poisoning: add a [shell_environment_policy] exclude for proxy env vars in config.toml, or disable the experimental features.network_proxy flag. If that fails, set sandbox = "unelevated" under [windows], or roll the CLI back to 0.139.0. All community-reported — the fix users expected in 0.143.0 didn't fully land.

Community-reported mitigations, in order: sign out and back in so the CLI refreshes its entitlement state; redo the math against the official rate card, remembering that the rolling 5-hour window appears to have stopped being enforced around July 12, 2026, so an exhausted window is now a less likely explanation than it was; and if you're genuinely out, buy top-up credits where your plan offers them. There's no official fix for the dashboard/CLI mismatch itself — it's tracked as openai/codex issue #30041.

Update the CLI first — bubblewrap sandbox fixes land in the near-daily release cadence. On Windows, use the native Windows sandbox (elevated or unelevated PowerShell modes); the official docs now recommend it by default, with WSL reserved for Linux-native tooling. If you do need WSL, it must be WSL2 — WSL1 support ended when the Linux sandbox moved to bubblewrap in Codex 0.115, having worked through 0.114.

There is no single confirmed fix. Community-reported mitigations, roughly in order of payoff: retry the task (disconnects are often transient), split long-running jobs into shorter tasks so less work is lost mid-stream, check OpenAI's status page for an active incident before debugging your own setup, and update the CLI — releases ship near-daily, and stream-handling fixes land without much fanfare.