Windows desktop upgrade can leave Browser, Chrome, and Computer Use globally unavailable due to mixed plugin/runtime state

Summary

After a Codex Windows desktop app update, Browser, Chrome, and Computer Use could all become globally unavailable in Settings. Restarting the app did not repair the state. The failure was caused by several pieces of old and new state being mixed across the bundled marketplace snapshot, version cache, Chrome native host, and cua_node runtime.

This should be handled atomically by the desktop app updater. A periodic self-heal process is not an appropriate solution because it adds more mutable state and can conceal upgrade defects.

Environment

• Windows desktop app package: OpenAI.Codex_26.609.4994.0_x64
• Bundled Browser/Chrome/Computer Use plugin version: 26.609.41114
• cua_node runtime archive: cua-node-0.0.1-20260609000952-8714bea94049-win32-x64.zip
• @oai/sky: 0.4.10
• Codex Doctor: 0.140.0-alpha.2

User-specific names and paths have been removed from this report.

Observed failures

1. The reconstructed bundled marketplace snapshot under .codex/.tmp/bundled-marketplaces/openai-bundled was incomplete/stale and at one point contained only the Chrome plugin without a valid marketplace index.
2. plugins/cache/openai-bundled/chrome/latest pointed to the temporary marketplace source instead of the immutable versioned cache directory.
3. A stale extension-host.exe from the previous version retained a lock on plugins/chrome/extension-host/windows/x64, causing repeated marketplace reconciliation failures (EBUSY).
4. The Windows sandbox failed to start the runtime with CreateProcessAsUserW failed: 5 until the runtime path had read/execute traversal permissions for CodexSandboxUsers.
5. The bundled Computer Use plugin imports:

@oai/sky/dist/project/cua/sky_js/src/targets/windows/internal/computer_use_client_base.js

The file exists in the bundled @oai/sky package, but @oai/sky@0.4.10 only exports:

{
  ".": "./dist/project/cua/sky_js/src/index.js"
}

This produces:

ERR_PACKAGE_PATH_NOT_EXPORTED: Package subpath './dist/project/cua/sky_js/src/targets/windows/internal/computer_use_client_base.js' is not defined by "exports"

The app package copy and the extracted local runtime copy of @oai/sky/package.json had identical SHA-256 hashes, so this was a bundled plugin/runtime compatibility mismatch rather than stale local runtime content.

Expected upgrade behavior

The updater should treat the bundled marketplace, plugin cache, runtime, native host configuration, and active version pointers as one versioned transaction:

1. Stop or retire previous-version native host processes before replacing/reconciling their files.
2. Stage the complete bundled marketplace and verify its index/manifests before switching the active pointer.
3. Keep latest links pointed only at immutable versioned cache directories, never at a temporary reconciliation source.
4. Validate plugin imports against the exact bundled runtime package exports before release.
5. Apply required sandbox read/execute/traversal ACLs when extracting a new runtime.
6. Switch active state only after all checks pass; retain the previous complete version for rollback.
7. Remove or ignore incompatible old cache entries rather than merging them into the new version.

Validation after manual repair

After rebuilding the marketplace from the installed AppX resources, repointing Chrome latest to the versioned cache, reinstalling the native host manifest, applying minimal runtime traversal permissions, and adding the missing exact package export:

• browser, chrome, and computer-use all reported installed, enabled.
• Computer Use successfully performed a real list_apps call and returned 40 applications, including Google Chrome.
• codex doctor --summary reported 16 ok, 0 fail.

Please fix this in the desktop update/install migration path rather than adding a periodic repair task.