›_ Codex Issues
Codex Issues / #33738

Managed bundled marketplace snapshot remains stale after app update, causing Browser reinstall to select the old plugin version

Open 💬 7 comments Opened Jul 17, 2026 by Tqsh
💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

Summary

After Codex Desktop updated, the application package contained a newer fixed Browser plugin, but the managed per-user bundled marketplace snapshot remained on the old Browser version.

Uninstalling and reinstalling Browser from Settings, deleting the plugin cache, and restarting Codex repeatedly installed the old version because the installer selected the version exposed by the stale managed marketplace.

This case is different from a persisted marketplace source pointing to an old WindowsApps package. Here, config.toml already pointed to the expected managed .tmp marketplace path; the contents of that managed snapshot were stale.

Environment

  • Platform: Windows x64
  • Install type: Microsoft Store / WindowsApps packaged app
  • Codex Desktop package: OpenAI.Codex_26.715.2236.0_x64
  • Browser plugin included in the current app package: 26.715.21316
  • Browser plugin in the managed runtime marketplace: 26.707.31428
  • Browser plugin installed in the user cache before repair: 26.707.31428

Configuration

The relevant ~/.codex/config.toml entry was already pointing to the managed marketplace:

[marketplaces.openai-bundled]
last_updated = "2026-07-10T02:24:29Z"
source_type = "local"
source = '\\?\C:\Users\<user>\.codex\.tmp\bundled-marketplaces\openai-bundled'

[plugins."browser@openai-bundled"]
enabled = true

The three Browser manifests reported:

| Location | Version |
|---|---:|
| Current Codex application package | 26.715.21316 |
| Managed bundled marketplace under .codex\.tmp | 26.707.31428 |
| Installed plugin cache | 26.707.31428 |

The current application package already contained the fixed Browser plugin at a path equivalent to:

C:\Program Files\WindowsApps\OpenAI.Codex_26.715.2236.0_x64__...\app\resources\plugins\openai-bundled\plugins\browser

But the runtime marketplace still exposed:

C:\Users\<user>\.codex\.tmp\bundled-marketplaces\openai-bundled\plugins\browser
Browser version: 26.707.31428

Observed behavior

  1. The older Browser plugin failed during runtime initialization with:

``text
TypeError: Cannot redefine property: process
``

  1. The issue was reported in #32935 and later marked fixed/completed.
  2. Updating Codex Desktop installed an application package that included Browser 26.715.21316.
  3. Browser in the managed bundled marketplace remained at 26.707.31428.
  4. Removing the Browser cache and reinstalling the plugin from Settings installed 26.707.31428 again.
  5. The old error therefore continued even though the fixed plugin was already present inside the current app package.

The apparent version decision was effectively:

managed marketplace version 26.707.31428
== installed cache version 26.707.31428
=> plugin considered current

The newer application-bundled version was not materialized into the managed runtime marketplace before the version comparison and reinstall.

Reproduction pattern

  1. Start with Codex Desktop and an older bundled Browser plugin installed.
  2. Update Codex Desktop to a package containing a newer Browser plugin.
  3. Confirm that [marketplaces.openai-bundled].source points to .codex\.tmp\bundled-marketplaces\openai-bundled.
  4. Compare the Browser manifest in the current app package with the manifest in the managed .tmp marketplace.
  5. Observe that the app package manifest is newer while the managed marketplace remains old.
  6. Uninstall Browser from Settings and reinstall it.
  7. Observe that Codex recreates the cache using the old managed-marketplace version.

Expected behavior

When the Codex Desktop package changes, the app should compare the bundled plugin manifests in the running application package with the managed per-user marketplace snapshot.

If any bundled plugin version differs, Codex should atomically refresh the managed marketplace before plugin reconciliation, version validation, or reinstall.

Actual behavior

The managed .tmp bundled marketplace remained stale across the app update and restart. Plugin reinstall trusted the stale marketplace, so the old Browser version was installed again.

Temporary workaround

The following manual workaround restored Browser functionality:

  1. Uninstall Browser from Codex Settings.
  2. Copy the newer browser directory from the current Codex application package.
  3. Replace the stale Browser directory under:

``text
%USERPROFILE%\.codex\.tmp\bundled-marketplaces\openai-bundled\plugins\browser
``

  1. Reopen Codex and reinstall Browser from Settings.
  2. Confirm that Codex creates the cache directory for 26.715.21316.

This is only a temporary workaround because .codex\.tmp\bundled-marketplaces is generated state and may be overwritten.

Verification after the workaround

With Browser 26.715.21316, I successfully:

  • initialized setupBrowserRuntime({ globals: globalThis });
  • connected to the Codex in-app Browser;
  • navigated to https://example.com/;
  • read the page title and DOM;
  • clicked the Learn more link and navigated to the IANA page;
  • completed the test with no Browser console errors.

The Cannot redefine property: process error no longer occurred.

Relationship to existing issues

  • Related to #30270, but this reproduction does not have config.toml pointing to an old versioned WindowsApps source. The configured source already points to the managed .tmp marketplace; the managed snapshot itself was not refreshed.
  • Follow-up evidence for the Browser runtime incompatibility originally reported in #32935.
  • Detailed version evidence and workaround were also posted at https://github.com/openai/codex/issues/32935#issuecomment-4998873649.

Requested fix

Please refresh or rematerialize the managed bundled marketplace from the currently running Codex application package whenever:

  • the application package version changes;
  • a bundled plugin manifest version changes;
  • a bundled plugin is reinstalled; or
  • the managed marketplace and application-bundled manifest versions differ.

The refresh should happen before the installed-cache version is considered current. If refresh fails, Settings should display an actionable marketplace synchronization error instead of reinstalling an older bundled plugin.

View original on GitHub ↗

7 Comments

github-actions[bot] contributor · 1 month ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

  • #33248

Powered by Codex Action

Tqsh · 1 month ago

I reviewed #33248. The two issues appear to share the same underlying bundled-marketplace refresh problem, but this report provides a distinct Windows/Browser reproduction.

In #33248, the stale macOS marketplace installs obsolete Chrome and Computer Use helpers, resulting in code-signing and native-host registration failures.

In this issue:

  • the platform is Windows;
  • the affected plugin is the in-app Browser;
  • config.toml already points to the expected managed .tmp marketplace;
  • the current Codex application package contains Browser 26.715.21316;
  • the managed marketplace and reinstall cache remain on 26.707.31428;
  • reinstalling from Settings repeatedly selects the stale version;
  • replacing the managed marketplace copy with the version from the current app package resolves the Cannot redefine property: process failure.

This appears to be the Windows/Browser counterpart of #33248 and confirms that the managed bundled-marketplace refresh problem is cross-platform and still reproduces with a newer Codex package.

I am keeping this issue open for the platform-specific version-selection evidence, but I am happy for maintainers to consolidate it into #33248 if they prefer tracking the shared root cause in one place.

fafowayne · 1 month ago

macOS reproduction of the stale bundled-marketplace issue.

Feedback ID: 019f7d34-d938-7f01-b3e4-20c7b8c8d9b0

Environment:

  • Codex/ChatGPT app: 26.715.31925 (build 5551)
  • macOS: 26.5.2 (build 25F84)
  • Browser bundled inside the current app: 26.715.31925
  • Browser in the managed marketplace: 26.707.51957
  • Browser installed in the user cache: 26.707.51957

The configured marketplace source is the managed path under ~/.codex/.tmp/bundled-marketplaces/openai-bundled.

The active managed marketplace and cache both remain on 26.707.51957, even though the installed app contains 26.715.31925. Browser initialization consequently fails at browser-client.mjs:33:22 with:

TypeError: Cannot redefine property: process

The visible in-app browser works manually, including loading https://example.com, but automation fails before tab attachment.

Please associate the feedback diagnostics with this issue and note that the stale-marketplace behavior also reproduces on macOS.

fschwiet · 28 days ago

I hit a similar issue running codex exec. Codex reported from the log:

The log confirms the ordering: the codex exec session began at 20:38:35; the marketplace refreshed to revision a833… at 20:38:38 and left only 0.0.20; then the session’s injected skill catalog (20:38:39) still named 0.0.19. That is an internal consistency race, not a missing skill in the plugin itself.****
The log shows:

  - codex exec started at 20:38:35.
  - The honist-v marketplace refreshed at 20:38:38, replacing 0.0.19 with 0.0.20.
  - At 20:38:39, the session’s skill catalog still advertised paths under 0.0.19.
  So the session received a stale skill-path snapshot while the on-disk plugin cache had already advanced. It isn’t a
  problem with your plugin or the skill
gqhzzz · 25 days ago

I can confirm this still reproduces on a newer Windows Store build.

Environment

  • Windows x64 build: 10.0.26200.8875
  • Codex Desktop: OpenAI.Codex_26.727.6591.0_x64
  • Package signature: Microsoft Store (SignatureKind=Store)
  • AppX deployment history confirms an update from 26.727.4816.0 to 26.727.6591.0 on 2026-08-01
  • Bundled plugin versions inside the current app package:
  • Computer Use: 26.727.51351
  • Browser: 26.727.51351
  • Chrome: 26.727.51351
  • Versions still present in the managed %USERPROFILE%\.codex\.tmp\bundled-marketplaces\openai-bundled snapshot and each latest cache before repair:
  • Computer Use: 26.721.31836
  • Browser: 26.721.31836
  • Chrome: 26.721.31836

The config already pointed to the expected managed .tmp marketplace, and all three plugins were enabled. This was therefore the same stale managed-snapshot case described in this issue, not a stale versioned WindowsApps path.

Additional Computer Use impact

The current app package required CUA runtime fingerprint fb8898c05a62885e, but that runtime had not been provisioned under %LOCALAPPDATA%\OpenAI\Codex\runtimes\cua_node. Only the older f8d2abcb7481383b runtime was present.

Observed initialization failure:

Windows Computer Use Sky runtime is unavailable

Before repair, the current thread also had no usable Computer Use/Browser node_repl/js control entry.

Recovery verification

A local repair that:

  1. refreshed the managed marketplace from the current Store package;
  2. rebuilt the versioned Computer Use/Browser/Chrome caches and latest junctions;
  3. provisioned the current CUA runtime using byte-copy plus identity-hash validation; and
  4. updated the Chrome native-messaging host to the current stable cache path

restored the local verification path.

Post-repair results:

client import ok
helper transport ok (2560x1440; screenshot data returned)
verification ok

codex plugin list now reports Computer Use, Browser, and Chrome at 26.727.51351 (and Sites at 0.1.33).

This suggests the update-time refresh should cover both the managed bundled marketplace/plugin caches and the derived CUA runtime. A startup/package-version fingerprint check with atomic refresh would prevent the stale state from surviving Store updates.

zemeng5208 · 16 days ago

Disclosure: I’m the author of WinBridge Recovery, an independent/non-official Windows recovery launcher for Codex Desktop.

The stale managed-marketplace scenario described here is one of the failure classes the project is designed to diagnose. It is version-aware: it identifies the currently installed Codex package, compares the bundled source with the managed marketplace/plugin cache and active pointers, and can rebuild/reconcile user-side state when those versions drift. Repairs are conditional and backed up so the previous state can be restored.

I’m mentioning it as a temporary user-side recovery option, not as an upstream solution and not as an official OpenAI tool. It does not redistribute or patch OpenAI’s packaged files, does not take ownership of WindowsApps, and does not bypass sandbox or enterprise/browser policy. If someone’s Browser failure is specifically caused by the managed snapshot staying on the old bundled version after an app update, this may save the manual copy/reinstall sequence described in the issue.

sixsmithgames-RPGCombatSimulator · 7 days ago

Fresh Windows recurrence on 2026-08-20, after the same machine had previously been repaired successfully.

Environment

  • Codex Desktop (Microsoft Store, Windows x64): OpenAI.Codex_26.814.5517.0_x64
  • Browser/Chrome/Computer Use bundled in the current app: 26.814.41957
  • Managed bundled-marketplace snapshot still active before repair: 26.803.81509
  • Chrome latest cache pointer before repair: 26.803.81509
  • Runtime configuration expected Browser version: 26.814.41957

Reproduction

Chrome automation failed before tab discovery with:

Importing module "node:process" is not allowed in node_repl

Uninstalling/reinstalling both the Codex Chrome plugin and the Chrome browser extension, followed by a full app restart, did not make the repair durable. A temporary cache-only repair allowed one session to connect, but later tasks again selected the old managed snapshot.

The old 26.803.81509 Browser client contains the forbidden node:process import; the current 26.814.41957 client does not.

Additional evidence

A still-running extension-host.exe was launched through the stale Chrome latest pointer and respawned while Codex Desktop remained open. Two newer, incomplete managed-marketplace staging directories were also present (26.810.52044 and 26.814.41407) while the active snapshot remained 26.803.81509.

This suggests the extension host may be racing or preventing the atomic marketplace reconciliation, leaving the old active directory in place despite newer app updates.

Verified local recovery

A rollback-safe repair:

  1. stopped only the stale Chrome extension host;
  2. replaced the active managed snapshot with the current app-bundled 26.814.41957 Browser/Chrome/Computer Use files;
  3. updated the materialization metadata to the current app bundle; and
  4. repointed Browser, Chrome, and Computer Use latest junctions to 26.814.41957.

After repair, the current Browser client and cache matched the app bundle byte-for-byte, Chrome reconnected successfully through the Browser client, and the forbidden-module error did not recur during the live connection test.

No browser tab contents, browsing history, usernames, or local paths are included in this report.