Windows: enabled=false still scans plugin cache; extension-host locks chrome; trusted cwd + catalog ingest (GPT Pro + Copilot Pro)

What version of the Codex App are you using (From “About Codex” dialog)?

codex-cli 0.149.0-alpha.4 ChatGPT Desktop / About Codex not opened: opening Desktop rehydrates plugins\cache and can rewrite node_repl. Also: access denied while cleaning stale temp dir and creating PATH aliases under %USERPROFILE%\.codex\tmp\arg0 (version command still succeeded).

What subscription do you have?

ChatGPT GPT Pro

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

Move-Item : file in use
...\openai-bundled\chrome\26.818.21641\extension-host\windows\x64

extension-host.exe
%USERPROFILE%\.codex\plugins\cache\openai-bundled\chrome\latest\extension-host\windows\x64\extension-host.exe
parent: C:\WINDOWS\system32\cmd.exe

codex --version also: access denied on %USERPROFILE%\.codex\tmp\arg0

Environment

• Windows Codex CLI + ChatGPT Desktop
• ChatGPT GPT Pro + GitHub Copilot Pro
• Official Sign in with ChatGPT only. Not sub2api. Not a wrapper reseller.
• New user (~1 month). First AI coding month. I was learning from zero, at the keyboard, trying to ship a framework.
• I only learned yesterday that I could attach my own API key. From day one the official path pushed me into Codex/ChatGPT plugins/skills, not a quiet API session.
• Intended setup: empty workspace, no skills, no MCP, no plugins.
• Actual flags: every plugin switch enabled=false, skills.config enabled=false, [mcp_servers.node_repl] enabled=false, approval_policy=on-request.

Impact

This was not a beginner month. It was a cleanup month.

• ~3 weeks disabling, deleting, and watching official files come back. GPT Pro time went to residue, not learning.
• Copilot Pro quota on the same PC was also burned chasing a quiet session. The inventory lives under %USERPROFILE%\.codex, so every client pays for it.
• Longest task 26h 15m was me at the keyboard, not an unattended loop.
• ChatGPT Pro /usage (heatmap empty until Jul–Aug, ~100 chats):
• Lifetime 4.49B tokens
• Peak 528M
• Streak 11d (best 17d)
• Recap: 96 skills used / 81 explored. Top plugins included product-design (9) and skill-creator (17). I never opted into product-design. It is openai-curated-remote and was still on disk after enabled=false.
• Official support: I went to the website to talk to a person. The AI reply vanished halfway. No human.

A beginner sitting at the keyboard for 26 hours, with ~100 chats, does not explain 4.49B lifetime tokens, 96 skills, or product-design uses I never chose.

What happens

enabled=false does not mean gone.

1. Cache still scanned

~\.codex\plugins\cache is still treated as installed inventory. While “clean”: 19 packs / 2818 files / ~87MB / 120 SKILL.md. Official remote_installed_plugin_sync refreshed 8 curated packs in the same second (2026-08-22 06:51:36). Config only denylisted superpowers@openai-curated-remote. The other 8 (including product-design) had no matching enabled=false.
Empty workspace still loaded superpowers:receiving-code-review and showed ~13.3K tokens used on a one-sentence turn.

1. Native host locks the cache (same family as #22114, #24296, #32706)

extension-host.exe kept running from the cache after every disable flag, so Windows Move-Item failed (file in use). 2026-08-22:

• child: extension-host.exe
• path: %USERPROFILE%\.codex\plugins\cache\openai-bundled\chrome\latest\extension-host\windows\x64\extension-host.exe
• parent: C:\WINDOWS\system32\cmd.exe

After Stop-Process on that PID, moving plugins\cache succeeded. I expect the next Desktop/CLI start to recreate it.

1. Launch cwd written as trusted

Opening from C:\WINDOWS\system32 then cd to a workspace appended both %USERPROFILE% and C:\Windows\system32 under [projects]. Deleting the list does not stick. Backups: 8 entries → 9 (user profile) → 10 (system32).

1. Remote catalog still fed to the model

~\.codex\cache\remote_plugin_catalog ~12.7MB / ~2735 plugin names, with skills off.

1. Desktop can rewrite node_repl

[mcp_servers.node_repl] enabled=false but the env block remains. I have not re-opened Desktop to re-test; prior evidence showed the official UI writes this section.

Also still on disk after “clean” (all enabled=false, files not removed): ~\.codex\skills\.system (skill-creator, …), .sandbox-bin ~299MB, plugins\.plugin-appserver. I am not asking to delete the sandbox. I am asking disable flags to actually disable scan/sync/launch/inject.

Expected

• enabled=false => do not scan, sync, launch, or inject that plugin/catalog/skill
• native host must not run from a mutable cache path
• do not silently trust cwd / system32
• Desktop must not resurrect node_repl when disabled
• a GPT Pro beginner should get an empty session, not 120 skills, a locked chrome host, and 4.49B tokens in the first weeks
• support chat should not disappear mid-reply when someone asks for a human

Not asking in this issue

Not sub2api. Not a public billing-dispute dump. Official Windows clients + this account’s /usage numbers only.

Related

• #22114 Windows Codex Desktop corrupts chrome@openai-bundled cache when extension-host.exe locks the tree
• #24296 Chrome native host locks plugin cache
• #32706 update leaves locked host

What steps can reproduce the bug?

1. Windows 11 x64, ChatGPT GPT Pro, official codex-cli 0.149.0-alpha.4 (Sign in with ChatGPT, not sub2api).
2. Set every plugin switch enabled=false, skills.config enabled=false, [mcp_servers.node_repl] enabled=false.
3. Do not install third-party plugins. Empty workspace.
4. Open PowerShell from C:\WINDOWS\system32, cd to an empty project, start Codex CLI.
5. Observe:

• one user sentence still uses ~13.3K tokens on a 258K window
• cache skill still listed (e.g. superpowers:receiving-code-review) despite disable flags
• config.toml [projects] gains trusted entries for %USERPROFILE% and C:\Windows\system32

1. ~\.codex\plugins\cache still has official packs. Curated remotes (including product-design) were timestamp-touched together (2026-08-22 06:51:36) by remote_installed_plugin_sync. Config only denylisted superpowers@openai-curated-remote.
2. Move-Item on plugins\cache fails: extension-host.exe is running from

~\.codex\plugins\cache\openai-bundled\chrome\latest\extension-host\windows\x64\extension-host.exe
parent: C:\WINDOWS\system32\cmd.exe.

1. Stop-Process on that PID, then the cache move succeeds.
2. codex --version also reports access denied on ~\.codex\tmp\arg0.
3. I am not reopening ChatGPT Desktop: it rehydrates this cache and can rewrite node_repl.

What is the expected behavior?

• enabled=false means do not scan, sync, launch, or inject that plugin/skill/catalog.
• extension-host.exe must not run from a mutable plugins\cache path, and must not hold the tree open so Windows cannot delete it (#22114 / #24296 / #32706).
• Launch cwd / system32 must not be silently written as trusted [projects].
• remote_plugin_catalog must not feed thousands of plugin names when plugins are disabled.
• Desktop must not resurrect node_repl when enabled=false.
• codex --version must not need write access to stale tmp\arg0 aliases.
• A GPT Pro beginner in an empty folder should get an empty session.

Additional information

Paid tools on this same Windows profile that were burned diagnosing Codex residue (not a refund ask): Super Grok, Gemini Pro, GitHub Pro, GitHub Copilot Pro+, OpenCode GO, DeepSeek, Hermes original API, DSH, Google Antigravity (org), and Google Cloud (org — the messiest to unwind). I only learned yesterday I could attach my own API; the official path pushed plugins/skills from day one.

~3 weeks as a new user deleting official files that come back. Longest task 26h 15m was me at the keyboard learning from zero, not an unattended loop.

/usage (heatmap empty until Jul–Aug, ~100 chats): lifetime 4.49B, peak 528M, streak 11d (best 17d). Recap: 96 skills used / 81 explored. Top plugins included product-design (9) and skill-creator (17). I never opted into product-design.

Official support chat on the website: AI reply vanished halfway; no human.

Related: #22114 #24296 #32706
I will not open Desktop to re-test until this is addressed.