How to Debug oh-my-codex Startup CPU Spikes on Intel Macs (syspolicyd/trustd)

Launching omx with the --madmax and --high flags on Intel-based Macs triggers macOS Gatekeeper to verify every subprocess, causing syspolicyd and trustd to consume near-100% CPU during startup.

When using oh-my-codex (the open-source Codex CLI wrapper by Yeachan-Heo) on Intel hardware, aggressive concurrency settings can overwhelm system security daemons. This article explains the root cause in the source code and provides debugging steps to eliminate the CPU spikes while maintaining performance.

Root Cause: Gatekeeper Verification Under High Concurrency

The CPU spike occurs when two specific flags combine to spawn dozens of worker processes simultaneously. On Intel Macs, each new executable triggers a Gatekeeper validation via syspolicyd and trustd, unlike Apple Silicon which uses a different verification path.

The --madmax Flag (Sandbox Bypass)

In src/cli/constants.ts, the --madmax flag is defined as a constant that enables dangerous sandbox-less execution:

// src/cli/constants.ts (lines 1-6)
export const MADMAX_FLAG = '--madmax';
export const HIGH_FLAG = '--high';
export const XHIGH_FLAG = '--xhigh';

When present, this flag bypasses Codex approvals entirely. The normalizeCodexLaunchArgs function (tested in src/cli/__tests__/index.test.ts) transforms this CLI argument into an internal bypass flag.

The --high and --xhigh Concurrency Flags

As defined in the same constants file, --high and --xhigh control the tmux-based worker pool concurrency. The root cause emerges in src/cli/index.ts (lines 152-158), where the leader process expands --madmax into the bypass mode, then immediately spawns a large number of parallel workers.

Intel Mac Specific Behavior

According to the repository's README.md (lines 195-202), this combination "can spike syspolicyd / trustd CPU usage while Gatekeeper validates many concurrent process launches." Apple Silicon Macs do not exhibit this behavior because Gatekeeper's verification architecture differs on ARM64 hardware.

Reproducing the CPU Spike

To confirm your system exhibits this issue:

1. Open Activity Monitor and search for "syspolicyd" and "trustd"
2. Launch oh-my-codex with the problematic flag combination:

omx --madmax --high

3. Observe the CPU usage of syspolicyd and trustd climbing to 80-100% within seconds
4. Note the delay in worker process initialization while macOS security daemons process the verification queue

Debugging Steps

Verify Flag-Related Behavior

Test the same launch without one or both flags to isolate the trigger:

# Test with bypass but lower concurrency (should reduce spike)

omx --madmax

# Test with high concurrency but normal approval flow (should eliminate spike)

omx --high

If the CPU usage drops dramatically when omitting either flag, you have confirmed the root cause.

Inspect Launch Logic

Review the argument parsing in src/cli/index.ts (lines 152-158) to understand how --madmax propagates to the worker manager. The flag consumption logic creates tmux windows equal to the concurrency level, with each window spawning a separate Node.js process that Gatekeeper must verify on Intel systems.

Monitor Process Spawning

Use this terminal command to watch Gatekeeper activity in real-time:

log stream --predicate 'process == "syspolicyd" OR process == "trustd"' --info --debug

You will see a burst of validation requests coinciding with the omx worker initialization.

Mitigation Strategies

Based on the source code implementation recommended in README.md, apply these solutions:

Avoid the Forbidden Combination

Never use --madmax --high together on Intel Macs. Choose one optimization path:

• Use --madmax alone for sandbox bypass with default concurrency
• Use --high alone for high concurrency with normal Codex approvals

Use --xhigh Instead of --high

The --xhigh flag (also defined in src/cli/constants.ts) implements a capped worker pool that limits the number of simultaneous Gatekeeper checks:

# Recommended for Intel Macs requiring bypass mode

omx --madmax --xhigh

Staged Execution Pattern

If you require both maximum bypass and high concurrency, split the workload:

# Phase 1: Initialize with bypass and limited concurrency

omx --madmax --xhigh

# Phase 2: Once stable, relaunch with high concurrency and normal approvals

omx --high

Validation

After implementing mitigation, verify system health:

# Check CPU usage remains below 20% for security daemons

ps -eo %cpu,command | grep -E "(syspolicyd|trustd)"

Summary

• Root cause: The --madmax flag combined with --high spawns numerous subprocesses, triggering Gatekeeper verification storms on Intel Macs via syspolicyd and trustd.
• Key files: src/cli/constants.ts defines the flags, src/cli/index.ts handles the launch logic, and README.md documents the Intel-specific warning (lines 195-202).
• Debug method: Reproduce with omx --madmax --high, then test flag isolation to confirm the trigger.
• Solution: Use --madmax --xhigh instead of --madmax --high, or avoid the bypass flag entirely when running high-concurrency workloads on Intel hardware.

Frequently Asked Questions

Why does this issue only affect Intel Macs?

Apple Silicon uses a different Gatekeeper verification architecture that caches and validates code signatures asynchronously, whereas Intel Macs perform synchronous validation for each new executable launch. When omx spawns dozens of tmux workers simultaneously, the Intel path creates a bottleneck in syspolicyd and trustd.

What is the difference between --high and --xhigh in oh-my-codex?

--high enables unconstrained concurrency in the tmux worker pool, while --xhigh (defined in src/cli/constants.ts) implements a capped limit that reduces the number of simultaneous subprocesses. On Intel Macs, --xhigh prevents the Gatekeeper verification queue from overwhelming system resources.

Can I use --madmax safely on Intel Macs?

Yes, but only without the --high flag. According to the source code in src/cli/index.ts and the README warning, using --madmax with default or --xhigh concurrency levels avoids the CPU spike while still bypassing Codex approvals. The dangerous combination specifically requires both the bypass flag and maximum concurrency.

How do I verify the fix is working?

Launch oh-my-codex with your adjusted flags and monitor Activity Monitor for 30 seconds. Validated fixes show syspolicyd and trustd CPU usage remaining below 20%, with worker processes initializing without delay. You can also run log show --last 1m --predicate 'process == "syspolicyd"' to confirm the rate of validation requests has decreased.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}