Windows: Browser RPC fails with “Trusted RPC dependency must resolve within a configured trusted code path” despite matching configured root

Summary

Codex Desktop's bundled Browser plugin fails during setupBrowserRuntime(), before browser discovery, page binding, or navigation.

The resolved service file exists beneath the configured trusted code root. A separate read-only test using the same installed Node executable successfully resolves both paths and passes the containment check used by the trusted worker.

The root cause is not established. In particular, we could not verify the actual environment received by the running trusted worker.

Environment

Latest reproduction: 2026-09-02.

• Windows, native x64 desktop installation

• Desktop package: OpenAI.Codex_26.831.2377.0_x64

• Bundled Codex CLI: 0.152.1

• Browser plugin: 26.831.21537

• CUA Node runtime directory identifier: 2c6075088d3180ec

• Workspace: E:\$codex

• CODEX_HOME: E:\$codex\.codex-local

CODEX_HOME is configured persistently at Windows user level and is also present in the inspected shell process. It is not a process-only override. No machine-level CODEX_HOME is set.

A legacy C:\Users\<user>\.codex installation remains on disk. The active configuration and current operational writes are under the E: home.

Reproduction

In the Browser plugin's Node REPL session, run the documented bootstrap:

const { setupBrowserRuntime } = await import(
  "E:/$codex/.codex-local/plugins/cache/openai-bundled/browser/26.831.21537/scripts/browser-client.mjs"
);
const agent = await setupBrowserRuntime();
const iab = await agent.browsers.get("iab");
nodeRepl.write(await iab.documentation());

The call fails during setupBrowserRuntime():

Trusted RPC dependency must resolve within a configured trusted code path: file:///E:/$codex/.codex-local/plugins/cache/openai-bundled/browser/26.831.21537/scripts/browser-service.mjs

Earlier attempts intended to access public pages and localhost failed at the same startup stage, before accessing any target page.

Expected behavior

The bundled Browser service should initialize when its canonical path is beneath an explicitly configured trusted root.

If a configured root cannot be resolved or accessed, diagnostics should identify that failure rather than silently discard the root and report only the later containment failure.

Relevant configuration

Sanitized excerpt; <user> replaces the Windows account directory:

[mcp_servers.node_repl]
command = 'C:\Users\<user>\AppData\Local\OpenAI\Codex\runtimes\cua_node\2c6075088d3180ec\bin\node_repl.exe'
args = []
startup_timeout_sec = 120
[mcp_servers.node_repl.env]

CODEX_HOME = 'E:$codex.codex-local'

NODE_REPL_NODE_PATH = 'C:\Users&lt;user>\AppData\Local\OpenAI\Codex\runtimes\cua_node\2c6075088d3180ec\bin\node.exe'

NODE_REPL_NODE_MODULE_DIRS = 'C:\Users&lt;user>\AppData\Local\OpenAI\Codex\runtimes\cua_node\2c6075088d3180ec\bin\node_modules'

NODE_REPL_TRUSTED_CODE_PATHS = 'E:$codex.codex-local;C:\Users&lt;user>\AppData\Local\OpenAI\Codex\runtimes\cua_node\2c6075088d3180ec\bin\node_modules'

NODE_REPL_TRUSTED_SERVICES = '{"browser":"E:/$codex/.codex-local/plugins/cache/openai-bundled/browser/26.831.21537/scripts/browser-service.mjs","sky":"@oai/sky/service"}'

BROWSER_USE_AVAILABLE_BACKENDS = "chrome,iab"

BROWSER_USE_CODEX_APP_VERSION = "26.831.21537"
[shell_environment_policy.set]

NODE_REPL_TRUSTED_BROWSER_CLIENT_SHA256S = "8676faca28eddb6424d4b54116fe8305e2da6a0ca4e5271e8758fc3c55c3b8fc"

This is the observed configuration, not a proposed workaround. Values in the configuration file do not prove what the trusted worker actually inherited.

Investigation findings

1. Exact error-producing code located

Read-only inspection found the error in the installed runtime's embedded code and in a running trusted worker's trusted-worker.js.

The worker constructs its trusted roots as follows:

const trustedCodeRoots = (process.env.NODE_REPL_TRUSTED_CODE_PATHS ?? "")

.split(path.delimiter)

.filter((entry) => path.isAbsolute(entry))

.flatMap((root) => {

try {

return [realpathSync.native(root)];

} catch {

return [];

}

});

It then resolves imported file URLs using fileURLToPath() and realpathSync.native(), and checks containment using path.relative().

Consequently, a missing/empty environment value or a root-resolution failure can leave no matching trusted root. Root-resolution exceptions are silently discarded. This is a diagnostic blind spot, not proof that such an exception occurred in this case.

The specific error-producing branch does not check a browser-client hash.

2. Independent path check succeeds

A separate shell-launched process using the same installed node.exe tested the same root and service file with the worker's path-resolution and containment logic.

Observed results:

Root:

E:$codex.codex-local

Service:

E:$codex.codex-local\plugins\cache\openai-bundled\browser\26.831.21537\scripts\browser-service.mjs
path.delimiter:

;
path.relative(root, service):

plugins\cache\openai-bundled\browser\26.831.21537\scripts\browser-service.mjs
Containment check:

true

This confirms that these paths pass in that separate process. It does not establish identical environment, permissions, or sandbox behavior inside the trusted worker.

No junction/link was reported for the inspected workspace root, Codex home, or active Browser version directory.

3. Runtime environment remains unverified

The JavaScript kernel exposes a filtered environment snapshot. Targeted queries did not expose the trust variables there, but the kernel's source explicitly filters this snapshot.

Therefore, their absence from that interface is not evidence that they are absent from the separate trusted worker.

No supported diagnostic option for reading the trusted worker's effective root list was found in the inspected tool interface or runtime help. No memory dump, process injection, worker modification, or trust bypass was attempted.

4. Additional configuration inconsistency: client fingerprints

Full SHA-256 comparisons showed:

Neither retained client matches either configured fingerprint. This may be separate stale configuration; we have not established that it causes the reported path error. Fingerprints were not changed to force acceptance.

Regression history and previous attempts

• Browser control previously worked from this environment.

• The failure was first observed around the 26.820 Desktop/Browser update family.

• On 2026-08-26, two controlled configuration experiments were unsuccessful:

  1. Removing generated Node REPL/Browser trust sections and restarting did not regenerate them or resolve the error.

  2. Aligning the configuration with the then-current runtime and E:-backed Browser service still produced the error.

• The configuration involved in those experiments was restored byte-for-byte from a verified backup.

• On 2026-08-29, a full Windows restart and retest still failed with Desktop 26.825.5331.0, Browser 26.825.41651, and CLI 0.151.0-alpha.7.1.

• The error persists with the versions listed above on 2026-09-02.

The latest investigation was read-only. No cache deletion, CODEX_HOME relocation, security relaxation, or manual fingerprint override was used.

Requested investigation

Please help determine:

1. What NODE_REPL_TRUSTED_CODE_PATHS the trusted worker actually receives at startup.

2. Which configured roots survive canonicalization, and whether any are silently discarded.

3. Whether the supervisor/sandbox changes the worker's environment or filesystem access compared with the configuration and a separate Node process.

4. Whether the stale client-fingerprint setting is relevant in this runtime version or unrelated.

Please consider preserving the original root-resolution error in diagnostics, with appropriate path redaction.

Full configuration files, account data, session transcripts, and unrelated logs are intentionally omitted from this public report. The relevant sanitized evidence is included above.

Start with setupBrowserRuntime(), the bundled browser-service.mjs, and the trusted-worker.js code path that canonicalizes NODE_REPL_TRUSTED_CODE_PATHS. Reproduce the Windows failure and capture the trusted worker’s effective environment and discarded roots without bypassing trust checks. Done means identifying the cause, determining whether fingerprint mismatches matter, and preserving actionable redacted diagnostics for root-resolution failures.