Codex Windows Chrome Extension / Computer Use not connected field repair

A developer documented a field repair for a Codex Desktop update on Windows that broke browser extension connectivity and Computer Use. The fix involved patching the node_repl shim to handle missing sandbox metadata and modifying the Computer Use bootstrap to fall back to stdio when the native pipe is absent. The repair is designed to be idempotent and version-aware.

Tested on Windows on 2026-06-20 after a Codex Desktop update. This is not an official OpenAI fix. It is a field repair for a specific post-update failure where the bundled plugins are installed, but Codex reports that the browser extension is not connected and Computer Use cannot connect. - Chrome or Edge has the Codex extension installed, but Codex says the browser extension is not connected. browser , chrome , and computer-use plugins exist in the local bundled plugin cache.- Reinstalling the browser extension does not fix it. - Browser/Chrome control fails before normal page automation begins. - Computer Use fails with a native pipe error similar to: Computer Use native pipe is unavailable: Error: failed to connect native pipe: The system cannot find the file specified. os error 2 On the repaired machine, plugin version 26.616.41845 was installed, and the desktop package was: OpenAI.Codex 26.616.5445.0 x64 2p2nqsd0c76g0 There were two separate failures after the update. - node repl broke because Codex Desktop sent newer sandbox metadata, but the bundled node repl.exe still expected the legacy sandboxPolicy field.Failure signature: codex/sandbox-state-meta: missing field sandboxPolicy - Computer Use was taking a Windows native-pipe-only path, but the expected codex-computer-use- named pipe was not present. The bundled helper executable was still healthy over stdio: codex-computer-use.exe So the working repair was: - Insert a stable node repl shim that rewrites missing sandbox metadata into the older shape before forwarding to the original runtime. - Patch the bundled Computer Use bootstrap so it first tries the native pipe, then falls back to the shipped stdio helper when the pipe is missing. - Make the repair idempotent so a restart can reapply it after Codex rewrites plugin/runtime files. Paste this into Codex on the affected Windows desktop. You are fixing my local Windows Codex Desktop install. The browser/chrome/computer-use plugins are installed, but the Chrome/Edge Codex extension says it is not connected after a recent Codex update. Reinstalling the extension did not fix it. Goal: fix this without rolling back Codex. Do the whole repair end to end, including backups, an idempotent repair script, restart support if needed, and verification. Known failure signatures to look for: - browser/chrome automation fails before page interaction starts - node repl or MCP reports: codex/sandbox-state-meta: missing field sandboxPolicy - Computer Use reports: Computer Use native pipe is unavailable - native pipe path under \\.\pipe\codex-computer-use- is missing - codex-computer-use.exe itself works when run over stdio Important: - Do not use any hard-coded paths from another machine. - Discover this machine's actual CODEX HOME, plugin cache root, runtime hash, plugin versions, Codex CLI path, and browser profile. - Back up every file before writing it. - Do not downgrade Codex unless I explicitly ask. - Use apply patch for manual edits when possible. - Do not import node:process inside node repl code. It may be blocked. - Keep the fix version-aware. If a future plugin version already contains a proper upstream fix, do not overwrite it blindly. Step 1: Inspect and record state. - Locate CODEX HOME. Check $env:CODEX HOME, then ~/.codex-work, then ~/.codex. - Locate bundled plugin cache: CODEX HOME/plugins/cache/openai-bundled. - Locate installed browser/chrome/computer-use plugin version directories by reading each .codex-plugin/plugin.json. - Locate current cua node runtime under %LOCALAPPDATA%/OpenAI/Codex/runtimes/cua node/ /bin containing node.exe, node repl.exe, and node modules/@oai/sky. - Locate Codex CLI under %LOCALAPPDATA%/OpenAI/Codex/bin/ /codex.exe. - Check Chrome and Edge native messaging host registration for com.openai.codexextension. - Check named pipes for codex-browser-use and codex-computer-use . - Save findings to a local Markdown log. Step 2: Repair the Node REPL sandbox metadata mismatch. - Create CODEX HOME/fixes/node-repl-meta-shim.mjs. - The shim must spawn the original node repl.real.exe, rewrite incoming JSON-RPC messages, and if params. meta "codex/sandbox-state-meta" exists without sandboxPolicy, replace it with: { sandboxPolicy: { type: "danger-full-access" }, codexLinuxSandboxExe: incoming.codexLinuxSandboxExe ?? null, sandboxCwd: incoming.sandboxCwd if string else process.cwd , useLegacyLandlock: Boolean incoming.useLegacyLandlock ?? false } - Preserve both line-delimited JSON and Content-Length framed messages. - Rename the original runtime bin/node repl.exe to bin/node repl.real.exe if node repl.real.exe does not already exist. - Compile or create a tiny Windows wrapper at CODEX HOME/fixes/node repl.wrapper.exe that launches runtime bin/node.exe with CODEX HOME/fixes/node-repl-meta-shim.mjs and forwards stdio. - Copy the wrapper over runtime bin/node repl.exe. - If node repl.exe is already the wrapper and node repl.real.exe is missing, stop and report that the original executable cannot be recovered safely. Step 3: Refresh browser/chrome MCP and native-host config. - Update the active browser plugin .mcp.json so node repl uses the repaired runtime bin/node repl.exe. - Include env values for: NODE REPL NATIVE PIPE CONNECT TIMEOUT MS=1000 NODE REPL NODE MODULE DIRS=<runtime bin/node modules NODE REPL NODE PATH=<runtime bin/node.exe NODE REPL TRUSTED CODE PATHS=<CODEX HOME CODEX HOME=<CODEX HOME BROWSER USE AVAILABLE BACKENDS=chrome,iab SKY CUA NATIVE PIPE=1 SKY CUA NATIVE PIPE DIRECTORY=<existing or generated \\.\pipe\codex-computer-use-guid path CODEX CLI PATH=<current codex.exe - Update the Chrome plugin extension-host/windows/x64/extension-host-config.json so codexCliPath, nodePath, and nodeReplPath point to the discovered current files. - If Edge is being used, ensure HKCU:\Software\Microsoft\Edge\NativeMessagingHosts\com.openai.codexextension exists and points to %LOCALAPPDATA%\OpenAI\extension\com.openai.codexextension.json. - Also check the Chrome equivalent key. Step 4: Repair Computer Use fallback. - Inspect computer-use/<version /scripts/computer-use-client.mjs. - If it is Windows native-pipe-only and fails when the pipe is absent, patch it so setupComputerUseRuntime does this on Windows: 1. close any previous active client 2. try NativePipeComputerUseTransport.create 3. if that throws, instantiate a Windows client using a stdio transport that spawns: <runtime bin /node modules/@oai/sky/bin/windows/codex-computer-use.exe - Reuse the bundled WindowsComputerUseClientBase from: <runtime bin /node modules/@oai/sky/dist/project/cua/sky js/src/targets/windows/internal/computer use client base.js - Implement the stdio transport using JSON lines: { id, method, params, meta } - Include request timeout metadata: x-oai-cua-request-budget-ms - Preserve app approval behavior. If helper output includes an approvalRequest, call nodeRepl.createElicitation when available, then retry with: x-oai-cua-approved-app - Install globals.sky through the same proxy/instrumentation pattern the bundled file uses. - Copy the patched file to CODEX HOME/fixes/computer-use-client.<version .patched.mjs. Step 5: Create an idempotent repair script. - Create CODEX HOME/fixes/repair-codex-browser-runtime.ps1. - It must rediscover paths dynamically where possible. - It must restore: - node repl wrapper - browser plugin .mcp.json - tmp browser .mcp.json if present - chrome extension host config - computer-use patched client only for the version it was built for - It must print either: Browser runtime repair: already current. or: Browser runtime repair: updated <changed items . - Run it twice. The second run should say already current. Step 6: If restarting Codex is needed, create a watchdog first. - Create a small PowerShell watchdog that can restart Codex and keep trying every 30 seconds until the top-level Codex process and app-server child are running. - If this machine has a custom Work profile launcher, use it. - Otherwise discover the Codex Start Menu AppID with Get-StartApps and launch via shell:AppsFolder. - Start the watchdog in a hidden PowerShell process before killing Codex so the repair can survive the restart. Step 7: Verify. - Test Chrome/Edge extension control using the Chrome/browser node repl runtime: - import the bundled browser-client.mjs - setupBrowserRuntime { globals: globalThis } - get the extension browser backend - open https://example.com/ - wait for domcontentloaded - read the title - expected title: Example Domain - finalize test tabs - Test Computer Use using the bundled computer-use-client.mjs: - setupComputerUseRuntime { globals: globalThis } - run sky.list apps - expected: list of running Windows apps, including Codex/ChatGPT/browser if open - call sky.close - Check that no orphan codex-computer-use.exe process remains. Deliverables: - A short root-cause summary. - Files changed, with backups. - The repair script path. - Restart watchdog path if created. - Exact verification results. If the receiving Codex does not already have a restart helper, it can create this as codex-restart-watchdog.ps1 . This is intentionally generic. A receiving Codex should specialize -LaunchCommand or -ProfileMatch for Work/Personal profiles if needed. php CmdletBinding param string $LaunchCommand = "", string $ProfileMatch = "", int $StartupDelaySeconds = 5, int $RetrySeconds = 30, int $MaxMinutes = 10, switch $NoKill, switch $StatusOnly $ErrorActionPreference = "Stop" $LogDir = Join-Path $PSScriptRoot "logs" $LogPath = Join-Path $LogDir "codex-restart-watchdog-{0}.log" -f Get-Date -Format "yyyyMMdd-HHmmss" function Write-Log { param string $Message $line = "{0} {1}" -f Get-Date -Format "yyyy-MM-dd HH:mm:ss" , $Message Write-Output $line if -not Test-Path -LiteralPath $LogDir { New-Item -ItemType Directory -Path $LogDir -Force | Out-Null } Add-Content -LiteralPath $LogPath -Value $line } function Get-CodexProcesses { Get-CimInstance Win32 Process | Where-Object { $ .Name -ieq "Codex.exe" -or $ .Name -ieq "codex.exe" -and $ .ExecutablePath -like " \OpenAI.Codex \app " } } function Get-TopLevelCodexProcesses { $tops = Get-CodexProcesses | Where-Object { $ .Name -ieq "Codex.exe" -and $ .ExecutablePath -like " \app\Codex.exe" -and $ .CommandLine -notmatch "\s--type=" } if string ::IsNullOrWhiteSpace $ProfileMatch { return @ $tops } return @ $tops | Where-Object { $ .CommandLine -like " $ProfileMatch " } } function Get-AppServerForTopLevel { param uint32 $TopLevelPid Get-CodexProcesses | Where-Object { $ .Name -ieq "codex.exe" -and $ .ParentProcessId -eq $TopLevelPid -and $ .CommandLine -like " app-server " } } function Get-ChildProcessIds { param uint32 $RootPid $all = @ Get-CimInstance Win32 Process | Select-Object ProcessId, ParentProcessId $result = New-Object System.Collections.Generic.List uint32 $queue = New-Object System.Collections.Generic.Queue uint32 $queue.Enqueue $RootPid while $queue.Count -gt 0 { $currentPid = $queue.Dequeue foreach $child in @ $all | Where-Object { $ .ParentProcessId -eq $currentPid } { uint32 $childPid = $child.ProcessId $result.Add $childPid $queue.Enqueue $childPid } } return @ $result.ToArray } function Get-CodexStatus { $tops = @ Get-TopLevelCodexProcesses foreach $top in $tops { $servers = @ Get-AppServerForTopLevel -TopLevelPid $top.ProcessId if $servers.Count -gt 0 { return PSCustomObject @{ Running = $true TopLevelPid = $top.ProcessId AppServerPid = $servers 0 .ProcessId Detail = "top-level and app-server are running" } } } return PSCustomObject @{ Running = $false TopLevelPid = if $tops.Count -gt 0 { $tops 0 .ProcessId } else { $null } AppServerPid = $null Detail = if $tops.Count -gt 0 { "top-level exists but app-server is missing" } else { "not running" } } } function Stop-CodexTree { $tops = @ Get-TopLevelCodexProcesses if $tops.Count -eq 0 { Write-Log "No matching Codex process to stop." return } foreach $top in $tops { $watchdogPid = uint32 $PID $ids = @ Get-ChildProcessIds -RootPid $top.ProcessId + $top.ProcessId | Where-Object { $ -ne $watchdogPid } | Sort-Object -Descending -Unique Write-Log "Stopping Codex process tree rooted at PID $ $top.ProcessId , excluding watchdog PID ${watchdogPid}: $ $ids -join ', ' " foreach $id in $ids { try { Stop-Process -Id $id -Force -ErrorAction Stop } catch { Write-Log "Process $id stop skipped or failed: $ $ .Exception.Message " } } } } function Start-CodexApp { if -not string ::IsNullOrWhiteSpace $LaunchCommand { Write-Log "Launching via custom command: $LaunchCommand" Start-Process -FilePath "powershell.exe" -ArgumentList @ "-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", $LaunchCommand -WindowStyle Hidden | Out-Null return } $app = Get-StartApps | Where-Object { $ .AppID -like "OpenAI.Codex " -or $ .Name -match "Codex" } | Select-Object -First 1 if -not $app { throw "Could not find Codex Start Menu AppID. Rerun with -LaunchCommand." } Write-Log "Launching shell:AppsFolder\$ $app.AppID " Start-Process -FilePath "explorer.exe" -ArgumentList "shell:AppsFolder\$ $app.AppID " | Out-Null } Write-Log "Codex restart watchdog starting. RetrySeconds=$RetrySeconds; MaxMinutes=$MaxMinutes; NoKill=$NoKill; StatusOnly=$StatusOnly" Write-Log "Log: $LogPath" $status = Get-CodexStatus Write-Log "Initial status: running={0}; topPid={1}; appServerPid={2}; {3}" -f $status.Running, $status.TopLevelPid, $status.AppServerPid, $status.Detail if $StatusOnly { Write-Log "StatusOnly requested; exiting without changes." exit 0 } if $StartupDelaySeconds -gt 0 { Start-Sleep -Seconds $StartupDelaySeconds } if -not $NoKill { Stop-CodexTree Start-Sleep -Seconds 3 } $deadline = Get-Date .AddMinutes $MaxMinutes while Get-Date -lt $deadline { $status = Get-CodexStatus if $status.Running { Write-Log "Codex is healthy. topPid={0}; appServerPid={1}" -f $status.TopLevelPid, $status.AppServerPid exit 0 } Write-Log "Codex is not healthy yet $ $status.Detail ; launching." Start-CodexApp Start-Sleep -Seconds $RetrySeconds } Write-Log "Timed out after $MaxMinutes minutes before Codex was healthy." exit 1 To start it hidden before restarting Codex: php $watchdog = "C:\path\to\codex-restart-watchdog.ps1" $command = "& '$watchdog' -RetrySeconds 30 -MaxMinutes 10" $encoded = Convert ::ToBase64String Text.Encoding ::Unicode.GetBytes $command Start-Process -FilePath "powershell.exe" -ArgumentList @ "-NoProfile", "-ExecutionPolicy", "Bypass", "-EncodedCommand", $encoded -WindowStyle Hidden For a custom Work profile, pass a launch command: & .\codex-restart-watchdog.ps1 -LaunchCommand "'C:\path\to\Launch-Codex-Work.cmd'" -ProfileMatch "CodexWork\UserData" On the repaired desktop: { "chrome extension test": { "ok": true, "title": "Example Domain", "url": "https://example.com/" }, "computer use test": { "ok": true, "appCount": 40, "hasEdge": true, "hasChatGPT": true }, "repair script": "Browser runtime repair: already current." } Computer Use cleanup was also verified: Get-Process codex-computer-use -ErrorAction SilentlyContinue Expected result after sky.close : no leftover helper process. - This should be treated as a local repair for a Windows Codex update regression, not as an official patch. - The receiving Codex should inspect the installed bundle before editing. Future plugin versions may already fix this upstream. - The Computer Use approval path should still be tested with a real app action if the user depends on click/type automation. The lightweight verified test was sky.list apps . - If the plugins are missing entirely, this repair will not install them. Fix plugin installation/cache first. - If the browser extension is installed only in Edge, Edge still needs its own native messaging host registry key.