[Windows][26.901] Browser and Chrome skill files omitted from plugin cache, breaking explicit @Browser routing

Summary

After updating Codex Desktop on Windows, the bundled Browser and Chrome plugins are installed and enabled, but their manifest-declared skill files are selectively omitted from the versioned local plugin cache.

An explicit @Browser mention is preserved in the user message, but browser:control-in-app-browser is absent from the model-visible skill catalog. The agent therefore improvises with adjacent capabilities (Computer Use, a user-installed Playwright skill, or an external Chrome DevTools MCP server), which can open a separate browser window instead of the requested in-app Browser.

This is a cache materialization defect, not a mention-parser failure and not a missing file in the bundled marketplace source.

Environment

• ChatGPT/Codex Desktop package: OpenAI.Codex_26.901.2854.0_x64
• Bundled Browser/Chrome/Computer Use plugin version: 26.901.22334
• OS: Windows 11 Pro, 10.0.26200, x64
• Browser and Chrome plugins enabled
• Reproduced in an existing project task and a new projectless task
• Reproduced with a public target (https://example.com/)
• Removing the separately installed Playwright skill did not remove the failure

Expected behavior

For an explicit @Browser request:

1. The Browser plugin's declared skills: "./skills/" content is present in the local plugin cache.
2. browser:control-in-app-browser is included in the task's skill catalog.
3. The request is routed exclusively to the ChatGPT in-app Browser.
4. No external browser or unrelated browser-control MCP server is used as a fallback.

Actual behavior

The bundled marketplace source is complete and current, but the corresponding cache payload omits the skill files:

%USERPROFILE%\.codex\.tmp\bundled-marketplaces\openai-bundled\plugins\browser
  total files: 382
  skills files: 2
  skills\control-in-app-browser\SKILL.md: present
  skills\control-in-app-browser\agents\openai.yaml: present

%USERPROFILE%\.codex\plugins\cache\openai-bundled\browser\26.901.22334
  total files: 380
  skills files: 0
  skills\control-in-app-browser\SKILL.md: missing

%USERPROFILE%\.codex\.tmp\bundled-marketplaces\openai-bundled\plugins\chrome
  skills\control-chrome\SKILL.md: present

%USERPROFILE%\.codex\plugins\cache\openai-bundled\chrome\26.901.22334
  skills files: 0
  skills\control-chrome\SKILL.md: missing

%USERPROFILE%\.codex\plugins\cache\openai-bundled\computer-use\26.901.22334
  skills\computer-use\SKILL.md: present

Both the source and cached Browser manifests are present, have version 26.901.22334, and declare:

"skills": "./skills/"

The Browser cache contains exactly two fewer files than the source, matching the two missing files under skills/control-in-app-browser/. The source files are ordinary files, not links.

Steps to reproduce

1. Install/update the Windows desktop app to package 26.901.2854.0.
2. Start a fresh Codex task.
3. Explicitly reference the bundled Browser plugin and ask: Open https://example.com/ in Browser.
4. Inspect the task's model-visible skill catalog and tool execution.
5. Observe that browser:control-in-app-browser is absent.
6. Observe fallback/improvisation through Computer Use or another available external browser-control capability.
7. Compare the bundled marketplace source with the versioned cache paths shown above.

Regression evidence

With earlier bundled Browser versions on the same machine:

• 26.820.60940: the explicit @Browser task loaded control-in-app-browser/SKILL.md; its instructions treated the mention as a hard constraint and prohibited fallback.
• 26.825.51511: an explicit @Browser task bootstrapped the Browser client and selected the in-app Browser directly.

The first recorded @Browser task after materializing 26.901.22334 instead loaded Computer Use and attempted an external Chrome-control path.

Impact

• Explicit user tool selection is violated.
• Unrequested external browser windows can interrupt work.
• The wrong browser profile/session may be used.
• Authenticated state in the in-app Browser is not available to the fallback.
• Behavior varies according to whichever adjacent skills/MCP servers happen to be installed, obscuring the deterministic root cause.

Related but distinct issues

• #30270: bundled plugins disappear because the configured marketplace path is stale. Here the current marketplace source is correct and contains all skill files.
• #41764: the Browser runtime service is missing from the cache. Here the plugin payload/runtime exists; only the skill layer is omitted.
• #34321: installed/enabled state is not reconciled with a missing skills subtree. That issue describes detection and repair of the invalid state; this report provides a desktop-update/materialization path that creates it selectively for bundled Browser and Chrome.

Requested fix

• Materialize every manifest-declared skill subtree atomically from the bundled marketplace source.
• Validate the cached payload against the source/manifest before exposing the plugin as installed and enabled.
• Automatically repair an incomplete current-version cache.
• Do not expose or route an explicit @Browser capability unless its routing skill is present.
• Add a Windows update regression test asserting that Browser and Chrome skill files survive/update together with the rest of each plugin payload.

No credentials, private page content, or session transcript is included.

Start by tracing Windows plugin-cache materialization and update handling for the bundled Browser and Chrome plugins, comparing the marketplace paths with the versioned cache paths described here. Inspect manifest-declared skills handling and the installed/enabled validation path. Done means skill files survive updates, incomplete caches are repaired or rejected, and a Windows regression test confirms both plugins retain their declared skills.