Exact error
Match the message before using the fix
privileged native pipe bridge is not available; browser-client is not trustedTrusted RPC dependency must resolve within a configured trusted code pathbrowser-service.mjs is not within a configured trusted code pathQuick answer
Start here
First separate page rendering from browser control: if the in-app browser opens sites but plugin initialization returns a trust or native-pipe error, the target website is not the cause. Restart on the current Codex build and use only the version-matched bundled client path supplied by the installed Browser skill. An older report found a bundled marketplace path worked when the cache path did not; direct Playwright also worked as a temporary testing fallback. Do not add arbitrary paths or hashes to the trusted list.
Diagnosis
Why it happens
- In one branch, the runtime advertised Chrome and in-app browser backends but did not inject the privileged native pipe bridge into the Node runtime.
- In the newer branch, the bundled `browser-service.mjs` resolved outside the runtime's configured trusted code paths.
- The same symptom can cross Windows/WSL boundaries where a Windows Node process receives a WSL-style plugin path; that is a related but distinct path-normalization branch.
Safest first
Fixes, in order
Confirm Browser control—not page rendering—is failing
Applies when: When the browser window opens but the agent cannot initialize a controllable session
The source reports confirmed the target page and normal browser rendering were healthy.
- Open a harmless public page in the in-app browser without automation.
- Record the complete plugin initialization error and bundled plugin version.
- Confirm whether the message names `browser-client`, `browser-service.mjs`, trusted code paths, or the native pipe bridge.
- Do not debug the target website if it renders normally.
Expected: Manual rendering works while automation fails before a browser session is created.
Reload the current bundled plugin path
Applies when: Native Windows Desktop where the error points into a stale cache or an untrusted bundled path
The older report was path-sensitive: an official bundled marketplace source path worked while its cache path failed.
- Update Codex through its normal official channel and fully restart the app.
- Start a new task so it receives the current Browser skill instructions and runtime metadata.
- Import only the exact versioned `browser-client.mjs` path supplied by that installed skill.
- Do not copy the client to a custom directory or manually invent trust hashes.
Expected: The runtime accepts the version-matched official path and returns an available Browser binding, or reproduces the still-open trust-path defect cleanly.
Use direct Playwright as a temporary test fallback
Applies when: Local web testing when Browser plugin initialization remains blocked and project policy allows standalone Playwright
Direct Playwright controlled the same target successfully in the original native-pipe report; it bypasses the plugin bridge rather than fixing it.
- Use an existing project Playwright setup when one is already available.
- Run only the bounded navigation or screenshot check needed for the task.
- Keep authentication and personal browser profiles out of the fallback session.
- Return to the bundled Browser plugin after an official fix.
Expected: The required local UI check completes without claiming the Browser trust path is repaired.
Verification
Prove the fix worked
- Initialize the bundled Browser runtime in a new Codex task.
- Acquire the advertised in-app or extension browser and read a harmless page title.
- Confirm the result uses the bundled Browser path, not the standalone Playwright fallback.
Escalation
If it still fails
- Record Codex app version, plugin version, exact client/service path, Windows versus WSL runtime, and whether backends are advertised.
- Do not weaken trusted-code configuration broadly or add hashes copied from another installation.
- Treat `native pipe bridge is not available` and `Trusted RPC dependency ... trusted code path` as related variants with potentially different sub-causes.
Scope
Environment and version notes
- The native-pipe report used Codex Desktop 26.506.2212.0; the trusted-RPC-path report used 26.814.41407 on Windows 11.
- Both source issues remained open on August 20, 2026, so the bundled-path and Playwright workarounds are partial rather than shipped fixes.
- Sources rechecked August 20, 2026.
Evidence
Sources
Source labels describe the evidence available on the checked date. A closed issue is not automatically a shipped fix.
First-hand native-pipe trust error, working page control, path-sensitive workaround, and Playwright fallback.
Newer Windows trusted-RPC code-path variant in the bundled Browser plugin.
Related WSL/Windows runtime path and trusted-hash mismatch branch.