# How to Debug oh-my-codex Startup CPU Spikes on Intel Macs (syspolicyd/trustd)

> Debug oh-my-codex startup CPU spikes on Intel Macscaused by syspolicyd and trustd. Learn how to resolve Gatekeeper verification issues and optimize performance.

- Repository: [Bellman/oh-my-codex](https://github.com/Yeachan-Heo/oh-my-codex)
- Tags: how-to-guide
- Published: 2026-04-03

---

**Launching omx with the `--madmax` and `--high` flags on Intel-based Macs triggers macOS Gatekeeper to verify every subprocess, causing syspolicyd and trustd to consume near-100% CPU during startup.**

When using *oh-my-codex* (the open-source Codex CLI wrapper by Yeachan-Heo) on Intel hardware, aggressive concurrency settings can overwhelm system security daemons. This article explains the root cause in the source code and provides debugging steps to eliminate the CPU spikes while maintaining performance.

## Root Cause: Gatekeeper Verification Under High Concurrency

The CPU spike occurs when two specific flags combine to spawn dozens of worker processes simultaneously. On Intel Macs, each new executable triggers a Gatekeeper validation via `syspolicyd` and `trustd`, unlike Apple Silicon which uses a different verification path.

### The --madmax Flag (Sandbox Bypass)

In [`src/cli/constants.ts`](https://github.com/Yeachan-Heo/oh-my-codex/blob/main/src/cli/constants.ts), the `--madmax` flag is defined as a constant that enables **dangerous sandbox-less execution**:

```typescript
// src/cli/constants.ts (lines 1-6)
export const MADMAX_FLAG = '--madmax';
export const HIGH_FLAG = '--high';
export const XHIGH_FLAG = '--xhigh';

```

When present, this flag bypasses Codex approvals entirely. The `normalizeCodexLaunchArgs` function (tested in [`src/cli/__tests__/index.test.ts`](https://github.com/Yeachan-Heo/oh-my-codex/blob/main/src/cli/__tests__/index.test.ts)) transforms this CLI argument into an internal bypass flag.

### The --high and --xhigh Concurrency Flags

As defined in the same constants file, `--high` and `--xhigh` control the tmux-based worker pool concurrency. The root cause emerges in [`src/cli/index.ts`](https://github.com/Yeachan-Heo/oh-my-codex/blob/main/src/cli/index.ts) (lines 152-158), where the leader process expands `--madmax` into the bypass mode, then immediately spawns a large number of parallel workers.

### Intel Mac Specific Behavior

According to the repository's [`README.md`](https://github.com/Yeachan-Heo/oh-my-codex/blob/main/README.md) (lines 195-202), this combination "can spike `syspolicyd` / `trustd` CPU usage while Gatekeeper validates many concurrent process launches." Apple Silicon Macs do not exhibit this behavior because Gatekeeper's verification architecture differs on ARM64 hardware.

## Reproducing the CPU Spike

To confirm your system exhibits this issue:

1. Open Activity Monitor and search for "syspolicyd" and "trustd"
2. Launch oh-my-codex with the problematic flag combination:

```bash
omx --madmax --high

```

3. Observe the CPU usage of `syspolicyd` and `trustd` climbing to 80-100% within seconds
4. Note the delay in worker process initialization while macOS security daemons process the verification queue

## Debugging Steps

### Verify Flag-Related Behavior

Test the same launch without one or both flags to isolate the trigger:

```bash

# Test with bypass but lower concurrency (should reduce spike)

omx --madmax

# Test with high concurrency but normal approval flow (should eliminate spike)

omx --high

```

If the CPU usage drops dramatically when omitting either flag, you have confirmed the root cause.

### Inspect Launch Logic

Review the argument parsing in [`src/cli/index.ts`](https://github.com/Yeachan-Heo/oh-my-codex/blob/main/src/cli/index.ts) (lines 152-158) to understand how `--madmax` propagates to the worker manager. The flag consumption logic creates tmux windows equal to the concurrency level, with each window spawning a separate Node.js process that Gatekeeper must verify on Intel systems.

### Monitor Process Spawning

Use this terminal command to watch Gatekeeper activity in real-time:

```bash
log stream --predicate 'process == "syspolicyd" OR process == "trustd"' --info --debug

```

You will see a burst of validation requests coinciding with the omx worker initialization.

## Mitigation Strategies

Based on the source code implementation recommended in [`README.md`](https://github.com/Yeachan-Heo/oh-my-codex/blob/main/README.md), apply these solutions:

### Avoid the Forbidden Combination

**Never use `--madmax --high` together on Intel Macs.** Choose one optimization path:
- Use `--madmax` alone for sandbox bypass with default concurrency
- Use `--high` alone for high concurrency with normal Codex approvals

### Use --xhigh Instead of --high

The `--xhigh` flag (also defined in [`src/cli/constants.ts`](https://github.com/Yeachan-Heo/oh-my-codex/blob/main/src/cli/constants.ts)) implements a capped worker pool that limits the number of simultaneous Gatekeeper checks:

```bash

# Recommended for Intel Macs requiring bypass mode

omx --madmax --xhigh

```

### Staged Execution Pattern

If you require both maximum bypass and high concurrency, split the workload:

```bash

# Phase 1: Initialize with bypass and limited concurrency

omx --madmax --xhigh

# Phase 2: Once stable, relaunch with high concurrency and normal approvals

omx --high

```

### Validation

After implementing mitigation, verify system health:

```bash

# Check CPU usage remains below 20% for security daemons

ps -eo %cpu,command | grep -E "(syspolicyd|trustd)"

```

## Summary

- **Root cause**: The `--madmax` flag combined with `--high` spawns numerous subprocesses, triggering Gatekeeper verification storms on Intel Macs via `syspolicyd` and `trustd`.
- **Key files**: [`src/cli/constants.ts`](https://github.com/Yeachan-Heo/oh-my-codex/blob/main/src/cli/constants.ts) defines the flags, [`src/cli/index.ts`](https://github.com/Yeachan-Heo/oh-my-codex/blob/main/src/cli/index.ts) handles the launch logic, and [`README.md`](https://github.com/Yeachan-Heo/oh-my-codex/blob/main/README.md) documents the Intel-specific warning (lines 195-202).
- **Debug method**: Reproduce with `omx --madmax --high`, then test flag isolation to confirm the trigger.
- **Solution**: Use `--madmax --xhigh` instead of `--madmax --high`, or avoid the bypass flag entirely when running high-concurrency workloads on Intel hardware.

## Frequently Asked Questions

### Why does this issue only affect Intel Macs?

Apple Silicon uses a different Gatekeeper verification architecture that caches and validates code signatures asynchronously, whereas Intel Macs perform synchronous validation for each new executable launch. When `omx` spawns dozens of tmux workers simultaneously, the Intel path creates a bottleneck in `syspolicyd` and `trustd`.

### What is the difference between --high and --xhigh in oh-my-codex?

**`--high`** enables unconstrained concurrency in the tmux worker pool, while **`--xhigh`** (defined in [`src/cli/constants.ts`](https://github.com/Yeachan-Heo/oh-my-codex/blob/main/src/cli/constants.ts)) implements a capped limit that reduces the number of simultaneous subprocesses. On Intel Macs, `--xhigh` prevents the Gatekeeper verification queue from overwhelming system resources.

### Can I use --madmax safely on Intel Macs?

Yes, but only without the `--high` flag. According to the source code in [`src/cli/index.ts`](https://github.com/Yeachan-Heo/oh-my-codex/blob/main/src/cli/index.ts) and the README warning, using `--madmax` with default or `--xhigh` concurrency levels avoids the CPU spike while still bypassing Codex approvals. The dangerous combination specifically requires both the bypass flag and maximum concurrency.

### How do I verify the fix is working?

Launch oh-my-codex with your adjusted flags and monitor Activity Monitor for 30 seconds. Validated fixes show `syspolicyd` and `trustd` CPU usage remaining below 20%, with worker processes initializing without delay. You can also run `log show --last 1m --predicate 'process == "syspolicyd"'` to confirm the rate of validation requests has decreased.