Chrome plugin reinstall under umask 0002 breaks native host trust validation

What issue are you seeing?

On Linux, reinstalling the bundled Chrome plugin under an ambient umask 0002 creates group-writable runtime directories. The Chrome native host rejects those directories, and the ChatGPT side panel shows:

Unable to start ChatGPT
Codex app-server manifest entry is missing required path parent

All registered paths exist. The parent label comes from the native host trust check. In this case, directories under ~/.codex/plugins/cache/openai-bundled/chrome/ were recreated as 0775, while the native host rejects any group-writable parent in the canonical path chain.

The startup sequence makes the failure easy to see:

22:08:19 Chrome plugin cache synced from bundled resources
22:08:26 bundled_plugin_install_requested ... pluginName=chrome reason=outdated
22:08:26 plugin_install_succeeded ... pluginName=chrome

Immediately afterward, the Chrome cache root and version directory had mode 0775 and an mtime of 22:08:26. The pre-launch hardening had succeeded, but the later plugin/install replacement inherited the account's 0002 umask and reintroduced the unsafe permissions.

What steps can reproduce the bug?

1. Use a Linux account with umask 0002.

2. Launch ChatGPT with the bundled Chrome plugin installed.

3. Let bundled-plugin reconciliation reinstall the Chrome plugin, for example when its status is outdated.

4. Check the installed cache permissions:

   stat -c '%a %n' \
     ~/.codex/plugins/cache/openai-bundled/chrome \
     ~/.codex/plugins/cache/openai-bundled/chrome/*/extension-host
   

5. Open the ChatGPT Chrome side panel.

The cache directories are 775, and the side panel fails with the error above.

I have reproduced this failure twice on the same machine after bundled-plugin refreshes.

What is the expected behavior?

plugin/install should create and replace plugin cache and staging directories with permissions that satisfy the native host's own trust policy, independent of the caller's ambient umask. A cooperative 0002 umask should not make the installed Chrome integration unusable.

Additional information

Environment:

OS: Ubuntu 26.04 LTS
Kernel: Linux 7.0.0-29-generic x86_64
Chrome: 150.0.7871.186
Codex CLI: 0.151.0
ChatGPT / Chrome plugin / native host: 26.721.41059
Chrome extension ID: hehggadaopoacecdllhhajmbjkdcmajg

The app is running through the ChatGPT Community Linux wrapper built from the official package. That wrapper hardens the bundled cache before launch, but the app's post-launch plugin/install call replaces the hardened tree.

The immediate workaround is:

chmod -R u+rwX,go-w ~/.codex/plugins/cache/openai-bundled/chrome

Restarting the Chrome bridge after that restores the side panel. Launching the app under umask 022 also prevents the reinstall from recreating 0775 directories.

This is the same failure family previously diagnosed in ilysenko/codex-desktop-linux#1082, but today's sequence shows the post-launch plugin installer undoing the wrapper's pre-launch permission hardening.

Start at bundled-plugin reconciliation and the plugin/install path responsible for replacing the Chrome cache after launch. Reproduce with umask 0002, inspect the cache permissions using the provided stat command, and trace the post-launch replacement. Done means reinstall-created cache and staging directories are not group-writable and the Chrome side panel starts successfully.