macOS 26.803.61601: Chrome extension shown as not installed after bundled plugin uninstall; detection fails with TCC/EPERM

Summary

ChatGPT/Codex Desktop on macOS reports that the ChatGPT Chrome extension is not installed even though the extension is installed, enabled, and its side panel opens. The side panel simultaneously says “Install the app to use ChatGPT in Chrome” although /Applications/ChatGPT.app is installed and running.

The desktop Chrome integration is stuck in a circular install flow. Re-downloading the app or extension is incorrectly suggested.

Environment

• ChatGPT/Codex Desktop: 26.803.61601 (build 6396)
• Embedded Codex CLI: 0.147.0-alpha.6.5
• macOS: 27.0 (26A5388g), Apple Silicon
• Google Chrome: 151.0.7922.138
• ChatGPT Chrome extension: installed and able to open its side panel

Steps to reproduce

1. Install and open the ChatGPT Chrome extension.
2. Open ChatGPT Desktop → Settings → Computer use.
3. Observe Google Chrome reports Browser extension not installed and offers Install.
4. Follow the setup flow.
5. Observe the Chrome side panel says Install the app to use ChatGPT in Chrome, although ChatGPT is already installed and running.
6. The setup page loops back to downloading/opening the app.

Expected behavior

ChatGPT Desktop should detect the installed extension, install or repair the bundled chrome plugin and native messaging host, and show Chrome as connected.

Actual behavior

• The extension UI opens, proving the extension is installed.
• Desktop Settings reports it is not installed.
• The extension reports the desktop app is not installed.
• The supported install flow loops without repairing the bridge.

Diagnostic evidence

Desktop logs repeatedly show:

bundled_plugins_chrome_extension_sync_state_read_failed
errorMessage="Chromium extension detection failed"
marketplacePluginNames=["chrome"]

The bundled extension checker fails before it can determine extension state:

EPERM: operation not permitted, open '~/Library/Application Support/Google/Chrome/Local State'

macOS TCC logs attribute the request to com.openai.codex and report:

kTCCServiceSystemPolicyAppDataDetailed
Code=9
access requires indirect object have an associated app bundle

The supported native-host checker reports:

{
  "browserFamily": "chrome",
  "expectedHostName": "com.openai.codexextension",
  "exists": false,
  "correct": false,
  "problem": "Native host manifest does not exist"
}

The expected manifest location is:

~/Library/Application Support/Google/Chrome/NativeMessagingHosts/com.openai.codexextension.json

The same app session's bundled-plugin lifecycle shows:

• chrome@openai-bundled was automatically uninstalled because it was temporarily absent from the bundled marketplace.
• The Chrome native-host manifest was removed.
• The marketplace was later regenerated with chrome, but the Chrome plugin and native host were not restored.
• Computer Use was restored and works; the failure is specific to Chrome extension detection/bridge installation.

Why this appears to be an app defect

The extension and desktop app are both present. The desktop detector fails with EPERM/TCC code 9, and the native host was removed by bundled-plugin reconciliation. Because extension detection fails, the UI cannot reach the plugin/native-host repair step and instead sends the user into a circular app/extension download flow.

Suggested fixes

1. Make Chrome plugin/native-host repair independent from reading Chrome Local State.
2. Handle SystemPolicyAppDataDetailed failures with a precise permission/error state rather than extension not installed.
3. Ensure a bundled marketplace refresh that temporarily omits chrome does not uninstall a working integration, or atomically restores it afterward.
4. Make the “open the app if already installed” handoff idempotently reinstall the Chrome plugin/native host.
5. Distinguish these states in Settings:

• extension missing or disabled
• Chrome profile inaccessible
• Chrome plugin missing
• native host missing
• desktop app not installed

Related

• #23831
• #31904

Privacy

No authentication token, cookie, account ID, Chrome profile contents, browsing history, or private local project path is included.