Codex Desktop: declared owner-auth and secret-manager capabilities are absent at runtime

No repository files, tests, or entry points are named. Start by reproducing the plugin capability declaration and inspecting the active tool inventory before browser launch; done means unavailable capabilities are preflighted or advertised tools are enforced as live, while raw credentials remain protected.

Product / environment

• Codex Desktop on Windows
• External browser automation routed to a separately managed Linux browser host
• A custom runtime plugin declares owner-authentication assistance and host-local secret-manager policies

Issue

A task explicitly authorized use of host-local credential stores (Google Secret Manager / Google Password Manager) for a logged-in external website. The active Codex session exposed neither a scoped credential-consumption tool nor the declared owner_assistance_* tools. The live tool inventory also had no session-bound SMS authentication tool.

Because capability availability is discovered only after work begins, Codex repeatedly falls back to short owner-login windows. The windows expire, and the external task cannot progress even though the user selected approved host-local credential stores.

Reproduction

1. Start Codex Desktop with a plugin whose skill/policy declares owner-authentication assistance.
2. Ask Codex to complete a logged-in external web workflow using a host-local secret/password manager.
3. Inspect the active tool inventory.
4. Observe that owner_assistance_status/open/pause/resolve and any scoped password-manager credential consumer are absent.
5. Codex can launch a bounded login window but cannot consume the user-selected credential store or deliver the declared owner-assistance incident, causing repeated expiration loops.

Actual behavior

• Declared authentication-assistance tools are absent from the live session.
• No safe API exists for selecting a credential by opaque reference and consuming it directly into the approved browser session.
• The limitation is surfaced late, after browser work and repeated owner handoffs.
• The user cannot distinguish an intentional security boundary from missing runtime capabilities.

Expected behavior

At least one of the following should be guaranteed:

1. A scoped, auditable credential-consumption interface that accepts only an opaque secret reference, keeps the value host-local/in-memory, and binds use to one approved browser field/session without exposing the secret to the model, logs, chat, or tool arguments; or
2. A deterministic preflight that reports before browser launch that credential-store consumption is unavailable; and
3. Runtime enforcement that a skill cannot advertise owner_assistance_* tools unless those exact tools are live and callable in the current session.

The product should continue to prohibit raw passwords in chat and should not weaken CAPTCHA or account-security boundaries.

Privacy

No credentials, account identifiers, external case details, screenshots, cookies, or session data are included in this report.