[Windows][Desktop] Chrome discovery succeeds but listTabs fails after ~21s, even after Doctor WebSocket recovery

Summary

On Windows, Codex discovers the running Chrome extension backend, but cua.listTabs({browser:"chrome"}) consistently fails after approximately 21 seconds with nodeRepl.fetch request failed. Chrome discovery, extension registration, and Native Messaging validation succeed. Restoring Codex Doctor's Responses WebSocket connectivity does not resolve the tab-listing failure.

Environment

• Windows 11 Pro 10.0.22621
• Codex Desktop 26.908.4834.0
• Codex CLI 0.154.0-alpha.6.2
• Google Chrome: running normally; exact Chrome version not recorded in this report
• Chrome profile: Profile 1 / profileName jun
• Chrome extension ID: hehggadaopoacecdllhhajmbjkdcmajg
• Subscription: not specified

Steps to reproduce

1. Run Google Chrome with the above profile and its installed, registered, enabled extension.
2. In Codex's browser-control runtime, call:

   await cua.listBrowsers()
   

   Chrome is returned with id=2, family=chrome, type=extension, profileName=jun.
3. Call:

   await cua.listTabs({browser:"chrome"})
   

4. After approximately 21 seconds, observe nodeRepl.fetch request failed. This was consistently reproducible during the diagnostic session.
5. Explicitly set HTTP_PROXY, HTTPS_PROXY, and ALL_PROXY to http://127.0.0.1:10808 in the diagnostic environment and rerun Codex Doctor. The previous Responses WebSocket handshake timeout becomes a successful HTTP 101 connection, but the tab-listing call still fails.

Expected behavior

Codex should enumerate tabs from the discovered Chrome profile so browser-control work can proceed.

Actual behavior and key diagnostic output

The following are selected results from the completed diagnostic session, not a fresh reproduction or an unabridged log:

installed-browsers: Chrome correctly detected
Chrome extension:
  installed=true
  registered=true
  enabled=true

Native Host validation:
  correct=true
  registryMatchesManifestPath=true
  missingExpectedOrigins=[]

open-chrome-window.js --browser chrome: succeeds

cua.listBrowsers(): succeeds
  id=2
  family=chrome
  type=extension
  profileName=jun

cua.listTabs({browser:"chrome"}): fails after ~21 seconds
nodeRepl.fetch request failed
Error: nodeRepl.fetch request failed
    at kernel.js:1595:16
[remaining stack omitted]

Codex Doctor before explicit proxy settings:
  Responses WebSocket handshake timeout

Codex Doctor after explicit proxy settings:
  websocket connected (HTTP 101 Switching Protocols)

Chrome listTabs after WebSocket recovery:
  nodeRepl.fetch request failed

Troubleshooting already completed

• Confirmed Chrome runs normally and installed-browsers discovers it.
• Verified the selected Chrome profile and extension installation, registration, and enabled state.
• Validated the Native Host manifest, matching registry path, and expected allowed origins.
• Successfully launched Chrome using the supplied open-chrome-window helper.
• Confirmed browser discovery succeeds independently of tab enumeration.
• Resolved the Doctor WebSocket handshake failure using explicit proxy variables; verified that this does not resolve listTabs.

These checks provide no evidence of a Chrome configuration error. Please investigate the Windows browser-control/tab RPC path; the exact root cause is not yet established. A successful Responses WebSocket handshake alone does not demonstrate that the browser-control transport is healthy.

Related symptom report: https://github.com/openai/codex/issues/44697. This report adds the environment above and the successful-Doctor/failed-listTabs diagnostic distinction.

Privacy

Only selected diagnostic facts are included. No authentication tokens, cookies, account identifiers, full private local paths, browsing URLs, or raw session/log attachments are provided.

Reproduce the Windows failure using cua.listBrowsers() followed by cua.listTabs({browser:"chrome"}), and compare it with the open-chrome-window helper and Codex Doctor diagnostics. Trace the nodeRepl.fetch request failure in the browser-control/tab RPC path; done means Chrome tabs enumerate successfully while discovery and the documented WebSocket distinction remain intact.