[Windows] Bundled Browser service rejected because trusted code paths are not synchronized

What version of the Codex App are you using?

26.814.41407

What platform is your computer?

Windows 10 x64

What issue are you seeing?

The bundled in-app Browser plugin cannot initialize from a Codex Desktop thread. The Browser pane and IAB backend are available, but the trusted worker rejects the plugin's own bundled service module:

Trusted RPC dependency must resolve within a configured trusted code path: file:///C:/Users/Administrator/.codex/plugins/cache/openai-bundled/browser/26.814.41407/scripts/browser-service.mjs

Steps to reproduce

1. Open Codex Desktop on Windows.
2. Open an in-app Browser tab.
3. In a Codex task with the bundled Browser skill, initialize the documented runtime using the absolute bundled path.
4. Initialization fails before browser discovery with the error above.

Diagnostics already performed

• The in-app Browser pane is visible and its backend reaches browser_use_iab_backend_startup_ready.
• The bundled client and service files exist and their hashes match the bundled marketplace source.
• A full Desktop restart, a fresh same-directory fork, and a JavaScript kernel reset do not fix it.
• The Browser scripts directory is granted read access to the trusted-worker sandbox, but the worker still rejects its own service in isTrustedCodePath(). The filesystem allowlist and NODE_REPL_TRUSTED_CODE_PATHS appear not to be synchronized.

Expected behavior

Codex Desktop should register the active bundled Browser plugin's scripts directory as a trusted code root and provide a supported repair action if registration fails.

Additional notes

No third-party plugin or manually modified Browser file is involved.

Start by reproducing on Windows 10 x64 with the bundled Browser skill and the absolute browser-service.mjs path. Trace the trusted-worker entry point isTrustedCodePath(), the filesystem allowlist, and NODE_REPL_TRUSTED_CODE_PATHS; the issue mentions no source file or test. Done means the active bundled Browser scripts directory is accepted as a trusted root and a supported repair action is available when registration fails.