Codex provider: Chrome browser control fails under T3 (feature gates blocked by Cloudflare 403), works in the Codex app #19924

Summary

A Codex (GPT-6.1 Sol) child task started from T3 (delegate_task, provider codex) cannot control the user's real Google Chrome through the Codex Chrome plugin (ChatGPT browser extension). The same request works from the Codex desktop app on the same Mac, same network, same Chrome profile.

Area: apps/server / Codex provider

Environment

• T3 Code (Nightly): 0.0.46-nightly.20261015.3145 (CFBundleShortVersionString and CFBundleVersion are identical)
• Codex CLI that T3 starts (/opt/homebrew/bin/codex app-server): codex-cli 0.162.1
• ChatGPT/Codex desktop app: 26.1007.71326
• Codex CLI bundled in the desktop app: codex-cli 0.162.0-alpha.17.2
• macOS: 15.7.3

What works

• The Chrome plugin diagnostics pass: Chrome is running, the extension is installed and enabled in the selected profile, and the native-host manifest is correct.
• After a Chrome restart, await agent.browsers.list() from the T3-started Codex returns the Chrome extension browser (type "extension", family "chrome").

What fails

Exact errors, in the order of the attempts:

1. cua.getState() returns Error: Unable to load browser request-header policy. Retry the browser command. The logs showed Cloudflare 403 responses from ab.chatgpt.com.
2. cua.getBrowser({id:"chrome"}) returns Browser is not available: chrome (before the Chrome restart).
3. After the restart, await chrome.user.openTabs() returns Unable to load browser feature gates. Retry the browser command. The network log shows Non-retryable error: 403. The response is a Cloudflare page: "Sorry, you have been blocked" and "You are unable to access oaistatsig.com".

Observation

The Codex desktop app starts its bundled codex with -c features.code_mode_host=true app-server ... -c plugins.codex-app-tools@openai-bundled.mcp_servers.codex_app.enabled=true and with app context (IPC). T3 starts plain codex app-server from Homebrew.

The browser runtime under T3 appears to fetch feature gates directly and gets blocked by Cloudflare, while the desktop app path works.

Expected behavior

Codex browser control works for Codex tasks started from T3, or T3 documents the required setup.

Ask

Is there a supported way to give T3-started Codex the same browser feature-gate/policy source as the desktop app (for example, a binary-path setting or an environment variable)?

Related

#11579 is a different symptom in the same area (Codex bundled Computer Use browser path under T3). It is not the same failure.