Regression in 26.908: Chrome extension commands blocked by ChatGPT identity check with Azure-only auth

What version of the Codex App are you using (From “About Codex” dialog)?

26.908.40834 (Linux package version). Relevant update: 26.901.51231 → 26.908.31748 on September 11, 2026.

What subscription do you have?

None. Azure OpenAI API provider only; no ChatGPT sign-in. Azure model requests work.

What platform is your computer?

Ubuntu 24.04.4 LTS; uname -mprs: Linux 6.17.0-1022-azure x86_64 x86_64.

What issue are you seeing?

Chrome extension discovery succeeds, but listing/opening tabs fails with:

Codex auth token is unavailable

This previously worked: a September 10 task records model_provider: azure, selects Chrome with type: extension, and successfully opens, navigates, and reads a tab. The regression appeared September 11. This report adds a package-level regression comparison to related issue #21710.

What steps can reproduce the bug?

1. Run Codex App with a working Azure Responses provider (model_provider = "azure", env_key = "AZURE_OPENAI_API_KEY", requires_openai_auth omitted/default false), without a separate ChatGPT login.
2. Install/enable the official Chrome extension in regular Chrome.
3. Ask: “Use regular Chrome through the extension to open https://example.com/ and read its heading.”
4. The desktop-provided browser tool discovers Chrome, but this call fails:

await cua.createBrowserTab("chrome", "https://example.com/", {
  sessionName: "Chrome regression test"
});
// Codex auth token is unavailable

What is the expected behavior?

Previously working Azure-only Chrome extension control should continue working, with browser permissions and agent-identification protections preserved.

Additional information

• Package history records the first September 11 update at 07:17 UTC, from 26.901.51231 to 26.908.31748.
• Static comparison of official packages: the old CUA browser-service.mjs dispatches session commands without awaiting readRequestHeaderEnabled. The new service awaits ChatGPT identity for codex_browser_use_agent_request_header before extension command dispatch. getInfo is exempt, consistent with discovery succeeding.
• The first September 11 build's CUA service is byte-for-byte identical to the current build's. CUA runtime changed from 0.0.9/20260829001140-68931e022688 to 0.0.11/20260910215225-5451279f30a0-pr-1459319.
• September 10 desktop logs already show hadToken=false for ChatGPT service requests, so missing ChatGPT authentication predates the regression.
• Reinstalling Chrome/extension and restarting did not help. Current Chrome: 153.0.8010.36; extension: 1.26.901.11451. Chrome was unchanged at the initial breakpoint.
• Caveat: this is static source evidence, not a full network trace. The older app's separate Chrome-plugin service already had a related gate; a whole-app downgrade is not a verified fix. No browser-policy code was modified.

Could maintainers investigate the newly blocking identity dependency in the bundled CUA runtime for custom-provider sessions?

Reproduce the Azure-only flow described in the issue, then compare the older and newer bundled CUA browser-service.mjs and the cited CUA runtime versions. Trace the readRequestHeaderEnabled identity check before extension command dispatch, while preserving the getInfo behavior and browser protections. Done means Chrome extension discovery and tab commands work without ChatGPT authentication for custom-provider sessions.