Bundled Browser, Chrome, and Computer Use SKILL.md files contain mixed line endings in signed Windows AppX

Summary

The SKILL.md files bundled with Codex Desktop for Browser, Chrome, and Computer Use contain both CRLF and LF line endings.

The same bytes are present in the signed Windows AppX package and in the materialized user plugin cache. This rules out workspace changes, user-cache corruption, and post-install modification for the tested package.

Environment

• OS: Windows 10, build 26200, x64
• Codex Desktop AppX: OpenAI.Codex 26.825.6671.0
• Bundled plugin version: 26.825.51511
• Codex CLI: 0.149.0
• AppX package status: Ok
• AppxSignature.p7x: Valid

Affected files

• browser/skills/control-in-app-browser/SKILL.md
• chrome/skills/control-chrome/SKILL.md
• computer-use/skills/computer-use/SKILL.md

The package sources are under:

<AppX InstallLocation>/app/resources/plugins/openai-bundled/plugins/

Byte-identical copies are materialized under:

%USERPROFILE%/.codex/plugins/cache/openai-bundled/

Steps to reproduce

Run this in PowerShell on the affected Windows package:

$package = Get-AppxPackage -Name 'OpenAI.Codex'
$base = Join-Path $package.InstallLocation `
  'app\resources\plugins\openai-bundled\plugins'

$files = @(
  (Join-Path $base 'browser\skills\control-in-app-browser\SKILL.md'),
  (Join-Path $base 'chrome\skills\control-chrome\SKILL.md'),
  (Join-Path $base 'computer-use\skills\computer-use\SKILL.md')
)

foreach ($path in $files) {
  $text = [IO.File]::ReadAllText($path)
  $crlf = ([regex]::Matches($text, '\r\n')).Count
  $allLf = ([regex]::Matches($text, '\n')).Count

  [pscustomobject]@{
    File   = $path
    CRLF   = $crlf
    LFOnly = $allLf - $crlf
    SHA256 = (
      Get-FileHash -LiteralPath $path -Algorithm SHA256
    ).Hash.ToLowerInvariant()
  }
}

Actual result

For all three files:

• the file has a corresponding AppxBlockMap.xml entry;
• the whole-file SHA-256 matches its single AppX block hash;
• the package signature validates successfully;
• the cached copy has the same SHA-256 as the packaged source.

Expected result

Each authored SKILL.md file should use one consistent line-ending convention throughout the complete file.

Impact

• Deterministic integrity checks report mixed-eol.
• The files are less portable across tooling and platforms.
• Normalizing only the user cache is not durable because the cache is rematerialized from the bundled AppX source.
• No skill-loader or runtime failure has been observed; all three plugins are currently surfaced and usable.

Suggested fix

Normalize the affected SKILL.md files to one EOL convention during the bundled-plugin packaging process before the AppX package is signed and before user-cache materialization.

Please also consider adding a packaging regression check that rejects mixed line endings in authored Markdown and skill files.

Scope and provenance notes

• No provider-managed source or cache file was manually modified.
• The exact bundled files are not present in the public openai/plugins repository, and the manifest-linked openai/openai source paths are not publicly accessible, so this report does not claim a comparison with a public upstream working tree.
• The confirmed scope is the signed Windows x64 AppX package 26.825.6671.0; other platforms and package versions were not tested.

Start with the three affected SKILL.md files and reproduce the mixed-EOL counts and hashes using the PowerShell steps in the issue. Trace how these files enter the bundled AppX and user plugin cache; done means each file has consistent line endings before signing and packaging rejects future mixed-EOL authored Markdown or skill files.