Windows: enabled=false still scans plugin cache; extension-host locks chrome; trusted cwd + catalog ingest (GPT Pro + Copilot Pro)

What version of the Codex App are you using (From “About Codex” dialog)?

codex-cli 0.149.0-alpha.4 ChatGPT Desktop / About Codex not opened: opening Desktop rehydrates plugins\cache and can rewrite node_repl. Also: access denied while cleaning stale temp dir and creating PATH aliases under %USERPROFILE%.codex\tmp\arg0 (version command still succeeded).

What subscription do you have?

ChatGPT GPT Pro

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

Move-Item : file in use
...\openai-bundled\chrome\26.818.21641\extension-host\windows\x64

extension-host.exe
%USERPROFILE%.codex\plugins\cache\openai-bundled\chrome\latest\extension-host\windows\x64\extension-host.exe
parent: C:\WINDOWS\system32\cmd.exe

codex --version also: access denied on %USERPROFILE%.codex\tmp\arg0

Environment

• Windows Codex CLI + ChatGPT Desktop
• ChatGPT GPT Pro + GitHub Copilot Pro
• Official Sign in with ChatGPT only. Not sub2api. Not a wrapper reseller.
• New user (~1 month). First AI coding month. I was learning from zero, at the keyboard, trying to ship a framework.
• I only learned yesterday that I could attach my own API key. From day one the official path pushed me into Codex/ChatGPT plugins/skills, not a quiet API session.
• Intended setup: empty workspace, no skills, no MCP, no plugins.
• Actual flags: every plugin switch enabled=false, skills.config enabled=false, [mcp_servers.node_repl] enabled=false, approval_policy=on-request.

Impact

This was not a beginner month. It was a cleanup month.

• ~3 weeks disabling, deleting, and watching official files come back. GPT Pro time went to residue, not learning.
• Copilot Pro quota on the same PC was also burned chasing a quiet session. The inventory lives under %USERPROFILE%\.codex, so every client pays for it.
• Longest task 26h 15m was me at the keyboard, not an unattended loop.
• ChatGPT Pro /usage (heatmap empty until Jul–Aug, ~100 chats):
  • Lifetime 4.49B tokens
  • Peak 528M
  • Streak 11d (best 17d)
• Recap: 96 skills used / 81 explored. Top plugins included product-design (9) and skill-creator (17). I never opted into product-design. It is openai-curated-remote and was still on disk after enabled=false.
• Official support: I went to the website to talk to a person. The AI reply vanished halfway. No human.

A beginner sitting at the keyboard for 26 hours, with ~100 chats, does not explain 4.49B lifetime tokens, 96 skills, or product-design uses I never chose.

What happens

enabled=false does not mean gone.

1. Cache still scanned
   ~\.codex\plugins\cache is still treated as installed inventory. While “clean”: 19 packs / 2818 files / ~87MB / 120 SKILL.md. Official remote_installed_plugin_sync refreshed 8 curated packs in the same second (2026-08-22 06:51:36). Config only denylisted superpowers@openai-curated-remote. The other 8 (including product-design) had no matching enabled=false.
   Empty workspace still loaded superpowers:receiving-code-review and showed ~13.3K tokens used on a one-sentence turn.

2. Native host locks the cache (same family as #22114, #24296, #32706)
   extension-host.exe kept running from the cache after every disable flag, so Windows Move-Item failed (file in use). 2026-08-22:

   • child: extension-host.exe
   • path: %USERPROFILE%\.codex\plugins\cache\openai-bundled\chrome\latest\extension-host\windows\x64\extension-host.exe
   • parent: C:\WINDOWS\system32\cmd.exe
     After Stop-Process on that PID, moving plugins\cache succeeded. I expect the next Desktop/CLI start to recreate it.

3. Launch cwd written as trusted
   Opening from C:\WINDOWS\system32 then cd to a workspace appended both %USERPROFILE% and C:\Windows\system32 under [projects]. Deleting the list does not stick. Backups: 8 entries → 9 (user profile) → 10 (system32).

4. Remote catalog still fed to the model
   ~\.codex\cache\remote_plugin_catalog ~12.7MB / ~2735 plugin names, with skills off.

5. Desktop can rewrite node_repl
[mcp_servers.node_repl] enabled=false but the env block remains. I have not re-opened Desktop to re-test; prior evidence showed the official UI writes this section.

Also still on disk after “clean” (all enabled=false, files not removed): ~\.codex\skills\.system (skill-creator, …), .sandbox-bin ~299MB, plugins\.plugin-appserver. I am not asking to delete the sandbox. I am asking disable flags to actually disable scan/sync/launch/inject.

Expected

• enabled=false => do not scan, sync, launch, or inject that plugin/catalog/skill
• native host must not run from a mutable cache path
• do not silently trust cwd / system32
• Desktop must not resurrect node_repl when disabled
• a GPT Pro beginner should get an empty session, not 120 skills, a locked chrome host, and 4.49B tokens in the first weeks
• support chat should not disappear mid-reply when someone asks for a human

Not asking in this issue

Not sub2api. Not a public billing-dispute dump. Official Windows clients + this account’s /usage numbers only.

Related

• #22114 Windows Codex Desktop corrupts chrome@openai-bundled cache when extension-host.exe locks the tree
• #24296 Chrome native host locks plugin cache
• #32706 update leaves locked host

What steps can reproduce the bug?

1. Windows 11 x64, ChatGPT GPT Pro, official codex-cli 0.149.0-alpha.4 (Sign in with ChatGPT, not sub2api).
2. Set every plugin switch enabled=false, skills.config enabled=false, [mcp_servers.node_repl] enabled=false.
3. Do not install third-party plugins. Empty workspace.
4. Open PowerShell from C:\WINDOWS\system32, cd to an empty project, start Codex CLI.
5. Observe:
   • one user sentence still uses ~13.3K tokens on a 258K window
   • cache skill still listed (e.g. superpowers:receiving-code-review) despite disable flags
   • config.toml [projects] gains trusted entries for %USERPROFILE% and C:\Windows\system32
6. ~\.codex\plugins\cache still has official packs. Curated remotes (including product-design) were timestamp-touched together (2026-08-22 06:51:36) by remote_installed_plugin_sync. Config only denylisted superpowers@openai-curated-remote.
7. Move-Item on plugins\cache fails: extension-host.exe is running from
   ~\.codex\plugins\cache\openai-bundled\chrome\latest\extension-host\windows\x64\extension-host.exe
   parent: C:\WINDOWS\system32\cmd.exe.
8. Stop-Process on that PID, then the cache move succeeds.
9. codex --version also reports access denied on ~\.codex\tmp\arg0.
10. I am not reopening ChatGPT Desktop: it rehydrates this cache and can rewrite node_repl.

What is the expected behavior?

• enabled=false means do not scan, sync, launch, or inject that plugin/skill/catalog.
• extension-host.exe must not run from a mutable plugins\cache path, and must not hold the tree open so Windows cannot delete it (#22114 / #24296 / #32706).
• Launch cwd / system32 must not be silently written as trusted [projects].
• remote_plugin_catalog must not feed thousands of plugin names when plugins are disabled.
• Desktop must not resurrect node_repl when enabled=false.
• codex --version must not need write access to stale tmp\arg0 aliases.
• A GPT Pro beginner in an empty folder should get an empty session.

Additional information

Paid tools on this same Windows profile that were burned diagnosing Codex residue (not a refund ask): Super Grok, Gemini Pro, GitHub Pro, GitHub Copilot Pro+, OpenCode GO, DeepSeek, Hermes original API, DSH, Google Antigravity (org), and Google Cloud (org — the messiest to unwind). I only learned yesterday I could attach my own API; the official path pushed plugins/skills from day one.

~3 weeks as a new user deleting official files that come back. Longest task 26h 15m was me at the keyboard learning from zero, not an unattended loop.

/usage (heatmap empty until Jul–Aug, ~100 chats): lifetime 4.49B, peak 528M, streak 11d (best 17d). Recap: 96 skills used / 81 explored. Top plugins included product-design (9) and skill-creator (17). I never opted into product-design.

Official support chat on the website: AI reply vanished halfway; no human.

Related: #22114 #24296 #32706
I will not open Desktop to re-test until this is addressed.

Start by reproducing the Windows CLI behavior with the listed disabled plugin, skill, and MCP settings, then inspect the config.toml entries, plugins\cache, remote_plugin_catalog, and the remote_installed_plugin_sync activity described in the report. The issue is done only when each reported disabled component is shown not to scan, sync, launch, inject, or rewrite state, without the cache lock or tmp\arg0 access error.