browser@openai-bundled plugin sends tool schema with top-level anyOf/oneOf, rejected by API (400 invalid_function_parameters)

Summary

The bundled browser@openai-bundled plugin (0.1.0-alpha2) causes every request that loads its browser tools to fail with HTTP 400 invalid_function_parameters. The session then hangs with no auto-recovery. Even the background "remote compact task" fails because it carries the same toolset.

Environment

• codex-cli 0.139.0
• Plugin browser@openai-bundled 0.1.0-alpha2
• Model gpt-5.5, reasoning effort xhigh
• macOS (Darwin)

Error

{
  "type": "error",
  "error": {
    "type": "invalid_request_error",
    "code": "invalid_function_parameters",
    "message": "Invalid schema for function 'browser_click': schema must have type 'object' and not have 'oneOf'/'anyOf'/'allOf'/'enum'/'const'/'not' at the top level.",
    "param": "input[0].tools[0].tools[0].parameters"
  },
  "status": 400
}

It also reproduces during background compaction, where the param index is just deeper into the conversation:

"param": "input[116].tools[0].tools[2].parameters"

Root cause (best guess)

The bundled browser plugin launches a browser-use backend at runtime and forwards its tool schemas verbatim (confirmed: scripts/browser-client.mjs contains no static tool schemas; the plugin manifest describes it as the "browser / browser-use plugin"). The browser_click tool's parameters schema has a top-level union (anyOf/oneOf) — a classic "click by element index OR by coordinates" shape.

Under strict function-calling (enforced by gpt-5.5), the API requires the top-level parameters schema to be type: "object" with no combinators, so it rejects the whole request with 400. The plugin should normalize these schemas before sending them to the model.

Impact

• Any turn that loads the browser tool 400s.
• The session hangs and does not recover on its own.
• Auto-compaction of the affected session also fails, so the session can't even shrink its own context.

Workaround

Disable the plugin:

[plugins."browser@openai-bundled"]
enabled = false

(Already-running sessions must be killed and restarted; the config is only read at startup.)

Expected

The plugin normalizes tool schemas to be strict-mode compatible — e.g. collapse a top-level anyOf/oneOf into a single type: "object" schema with optional fields — so browser_click (and any other unioned tool) is accepted by the API.