Windows: Browser and Computer Use runtimes create kernel.js but node.exe gets ACCESS_DENIED, surfaced as MODULE_NOT_FOUND

What version of the Codex App are you using (From “About Codex” dialog)?

26.715.3651.0

What subscription do you have?

26.715.3651.0

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

The bundled Browser, Chrome control, and Computer Use plugins fail during initialization on Windows, before browser or tab discovery.

Prompt used for the minimal reproduction:

"Please perform exactly one Browser plugin test by opening about:blank. Stop immediately after success or failure and do not retry."

The Browser plugin returned:

Error: Cannot find module 'C:\WINDOWS\TEMP\.tmpJEK4Cc\kernel.js'
at Module._resolveFilename (node:internal/modules/cjs/loader:1456:15)
at defaultResolveImpl (node:internal/modules/cjs/loader:1066:19)
at resolveForCJSWithHooks (node:internal/modules/cjs/loader:1071:22)
at Module._load (node:internal/modules/cjs/loader:1242:25)
at wrapModuleLoad (node:internal/modules/cjs/loader:255:19)
at Module.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:154:5)
at node:internal/main/run_main_module:33:47 {
code: 'MODULE_NOT_FOUND',
requireStack: []
}

Node.js v24.14.0

Computer Use fails in the same initialization stage with another random temporary path, for example:

Error: Cannot find module 'C:\WINDOWS\TEMP\.tmpSlu4El\kernel.js'
code: 'MODULE_NOT_FOUND'
requireStack: []

Process Monitor shows that the file is not actually missing:

• At 11:22:47.4912363, node_repl.exe successfully wrote the complete kernel.js file.
• The resulting file length was 82,226 bytes and its handle was closed normally.
• No successful delete, rename, DeletePending, directory deletion, or reparse operation was captured.
• Other processes could successfully read the file.
• At 11:22:50.3284398, approximately 2.837 seconds after the successful write, node.exe accessed the exact same path and received ACCESS DENIED.
• The high-level MODULE_NOT_FOUND error therefore appears to mask an underlying ACCESS DENIED error.

The writer and loader are separate processes:

• Writer: node_repl.exe
• Loader: node.exe

This suggests a process-token, integrity-level, AppContainer/sandbox identity, or temporary-directory ACL propagation issue in the shared Windows Node tool runtime.

Troubleshooting already performed:

• Restarted Windows and Codex.
• Used Windows Settings > Apps > Codex > Repair.
• Confirmed that Microsoft Store reports no available Codex update.
• Verified that C:\Windows\Temp exists and is not a reparse point.
• Checked the Windows Temp ACL: no explicit deny rules; SYSTEM and Administrators have full access.
• Verified that kernel.js is successfully created and written.
• Tested a process-scoped TEMP/TMP override; the Browser tool host continued using C:\Windows\Temp.
• Checked Windows Defender events and threat history; no relevant detection was found.
• Checked available Tencent PC Manager and Kingsoft security logs; no evidence was found that either product deleted or quarantined kernel.js.
• Chrome itself was not reached during discovery, so this does not appear to be a Chrome installation or profile problem.

Other plugin paths remain functional. Default templates load correctly, and the GitHub connector responds. The failure appears limited to Browser, Chrome control, and Computer Use, which share the affected local Node runtime.

No system-wide ACL changes, Defender exclusions, Temp cleanup, or third-party kernel.js replacement were performed.

What steps can reproduce the bug?

1. Start Codex Desktop on Windows.

1. Confirm the app version is 26.715.3651.0.

1. Open a new task with the bundled Browser plugin enabled.

1. Send the following minimal prompt:

"Use the Browser tool to open about:blank. Make exactly one attempt and stop immediately after success or failure."

1. The Browser plugin fails before browser discovery with:

Error: Cannot find module 'C:\WINDOWS\TEMP\.tmp<random>\kernel.js'
code: 'MODULE_NOT_FOUND'
requireStack: []

1. Start another fresh task and invoke Computer Use with a similarly minimal prompt:

"Use Computer Use to open about:blank. Make exactly one attempt and stop immediately after success or failure."

1. Computer Use fails at the same initialization stage with another random temporary directory:

Error: Cannot find module 'C:\WINDOWS\TEMP\.tmp<random>\kernel.js'
code: 'MODULE_NOT_FOUND'
requireStack: []

1. Restarting Codex or Windows and using Windows Settings > Apps > Codex > Repair does not resolve the issue.

Minimal reproduction prompt:

Use the Browser tool to open about:blank. Make exactly one attempt and stop immediately after success or failure.

### What is the expected behavior?

The bundled Browser, Chrome control, and Computer Use plugins should initialize successfully.

For the minimal Browser reproduction, Codex should start the shared Node tool runtime, load kernel.js, discover the available browser environment, and open about:blank without an initialization error.

The node.exe loader should be able to read the kernel.js file created by node_repl.exe in the temporary runtime directory. The two processes should use compatible security tokens, sandbox identities, integrity levels, and file permissions.

If initialization cannot proceed, Codex should report the underlying Windows error accurately. An ACCESS DENIED error should not be surfaced as MODULE_NOT_FOUND when kernel.js was successfully created and still exists.

Expected result:

- Browser initializes and opens about:blank.
- Chrome control reaches browser/tab discovery.
- Computer Use initializes normally.
- No MODULE_NOT_FOUND or ACCESS DENIED error is produced.

### Additional information

_No response_