Windows desktop: Browser Use blocks one public origin while browser plugin cache remains on an older build

Summary

On one Windows Codex Desktop installation, Browser Use consistently rejects navigation to a public WeChat developer documentation origin before any page content is loaded:

Browser Use rejected this action due to browser security policy.
Reason: Browser Use is not permitted on https://developers.weixin.qq.com/miniprogram/dev/ai/guide.html.

The same Codex installation can read other public sites, ChatGPT on the same machine can read the affected URL, and other users report that Codex Desktop on both Windows and macOS can read the same URL.

Local diagnostics show a partial bundled-plugin upgrade: Chrome and Computer Use are on build 26.608.12217, while Browser is still cached at 26.602.40724.

Environment

• OS: Windows
• Codex Desktop package: 26.608.1337.0
• Codex CLI: 0.138.0-alpha.7
• Browser runtime reports app version: 26.608.12217
• Cached bundled plugins:
• browser: 26.602.40724
• chrome: 26.608.12217
• computer-use: 26.608.12217

No user identifiers, installation IDs, or session logs are attached.

Steps to reproduce

1. Open Codex Desktop on Windows.
2. Ask Codex to read and summarize:

https://developers.weixin.qq.com/miniprogram/dev/ai/guide.html

1. Try the in-app Browser, Chrome plugin, or Computer Use route.
2. Navigation is rejected with Browser Use is not permitted... before page inspection.
3. Ask Codex to read another public page, for example a Sina Finance article; it succeeds.

Expected behavior

Codex should allow read-only navigation to this public documentation URL, as it does on other installations, or provide an actionable explanation if the origin is intentionally restricted.

Actual behavior

The origin is rejected by Browser Use security policy. Switching browser surfaces does not help because the same policy gate is applied.

Additional diagnostics

• A local origin allow entry was present in %USERPROFILE%/.codex/browser/config.toml, but the rejection was unchanged, suggesting the file is not loaded or cannot override this policy.
• The bundled marketplace temporary source contained Chrome but no current Browser package.
• The Browser cache had no latest entry and only contained 26.602.40724.
• Chrome extension registration and communication were independently verified as healthy.
• This looks like either:

1. an incomplete bundled-plugin update leaving Browser on an old build, or
2. an installation/account-specific remote origin-policy result.

Suggested investigation

• Verify bundled Browser plugin refresh/migration during Desktop updates.
• Log which policy source rejected an origin (local, bundled, account, or remote policy) without exposing sensitive policy details.
• Provide a supported command/UI action to repair or refresh bundled plugins.
• Detect and warn when Browser, Chrome, Computer Use, and the Desktop runtime are on inconsistent bundled build versions.