[Windows 26.814] Browser/Chrome repair flow does not rebuild trusted RPC configuration

Summary

On native Windows Codex Desktop, the documented Chrome repair flow does not recover Browser/Chrome control.

The Chrome plugin uninstall action reports Failed to uninstall plugin. After closing Chrome and Codex completely, removing/re-adding the Chrome plugin and extension, restarting the desktop app after reinstall, and testing from fresh tasks, both the built-in Browser and Chrome still fail before browser discovery with:

Trusted RPC dependency must resolve within a configured trusted code path:
.../openai-bundled/browser/26.814.41407/scripts/browser-service.mjs

This report is separate from #39173. That issue records the browser-control symptom. This issue focuses on the plugin uninstall/reinstall and trust-configuration lifecycle: the supported repair flow does not restore a trusted Browser RPC service.

Environment

• Windows x64
• Codex desktop package: OpenAI.Codex_26.814.5167.0_x64
• Browser plugin: 26.814.41407
• Chrome plugin: 26.814.41407
• Chrome extension/native host: installed; side panel loads

Reproduction

1. Install/enable the bundled Browser and Chrome plugins.
2. Install the ChatGPT Chrome extension.
3. Ask a fresh Codex task to access Chrome or the built-in browser.
4. Observe the trusted RPC dependency error above.
5. Attempt to remove the Chrome plugin in Codex.
6. Observe Failed to uninstall plugin.
7. Close the Chrome side panel and all Chrome processes.
8. Fully terminate Codex and its browser extension host.
9. Reopen Codex, remove/re-add the Chrome plugin, and reinstall the Chrome extension.
10. Fully terminate Codex again after reinstall.
11. Reopen Codex and test from a brand-new task.
12. The same trusted-path failure occurs immediately.

The error also reproduces after starting a fresh browser runtime session.

Diagnostics

• The Chrome native-messaging registration and manifest are present and valid.
• The native host executable exists and starts.
• Browser and Chrome plugin files exist and are version-matched.
• The Browser and Chrome copies of browser-client.mjs and browser-service.mjs are byte-identical.
• Failure occurs before tab discovery, so it is not caused by the Chrome profile, website permissions, authentication state, blocklist, or target page.
• The same shared browser-service.mjs rejection affects Chrome and the built-in browser.

Actual behavior

The supported uninstall/reinstall workflow either fails to uninstall or reinstalls without rebuilding a trust configuration that accepts the bundled Browser service. Fresh tasks and fresh runtime sessions continue rejecting Codex's own version-matched Browser service.

Expected behavior

• Removing the Chrome plugin should succeed when its active host is stopped, or explain which state prevents removal.
• Re-adding the Browser/Chrome plugins and restarting Codex should regenerate a valid trusted RPC service configuration.
• The version-matched bundled browser-service.mjs should resolve within an allowed trusted code path.
• Fresh tasks should connect to the built-in browser and Chrome without manual cache or registry modification.

Related issues

• #39173 — same browser-control symptom; this report does not add a comment there.
• #39212 — same desktop/plugin version and trusted RPC error for the built-in Browser.
• #39136 — broader trusted RPC browser initialization failure.

No plugin cache, registry, security settings, or filesystem permissions were manually modified.

Start with the Windows plugin uninstall/reinstall lifecycle and the trusted RPC configuration used by the bundled browser-service.mjs; compare it with browser-client.mjs and the native-messaging manifest mentioned in the report. Reproduce the failure using the listed restart and reinstall steps, then verify that removal succeeds and a fresh task can connect to both Browser and Chrome without trusted-path errors.