Windows: Computer Use cannot control native desktop apps — cua_repl launches with a browser-only surface

What version of the Codex App are you using (From "About Codex" dialog)?

App: 26.908.9136.0 (MSIX package OpenAI.Codex_26.908.9136.0_x64__2p2nqsd0c76g0) Computer Use plugins: computer-use 26.908.70816, unified-computer-use 26.908.70816 Bundled CLI: codex-cli 0.154.0-alpha.6.2

What subscription do you have?

ChatGPT Plus (purchased via a mobile app store). Computer Use plugin is installed and "Control Windows apps" is enabled.

What platform is your computer?

Microsoft Windows 11 Home, version 10.0.26200, build 26200, x64. System locale zh-CN.

What issue are you seeing?

On Windows, Computer Use can never control native desktop applications in this build. The task loads the Computer Use plugin successfully, but the first call that needs the native surface returns the localized error 本地应用接口不可用 ("local app interface unavailable") — the machine-side equivalent of Trusted RPC service is not configured: sky.

Browser use (@Chrome / @Edge, the in-app browser) works normally. Only the native/computer surface is missing.

The bundled cua_repl server starts with the browser surface only, so the trusted sky service is never registered and native app enumeration is unavailable.

What steps can reproduce the bug?

1. Install and enable computer-use and unified-computer-use on a Windows machine.
2. Start any task with @Computer that targets a native app (e.g. "open Notepad and type a short test message").
3. Observe: the native app list is empty; native control reports the local app interface as unavailable, while browser control still works.
4. Fully restart the app, start a brand-new task without any project/workspace loaded — the same result.

What is the expected behavior?

With the Computer Use plugin enabled and "Control Windows apps" allowed, a @Computer task should enumerate and control native Windows applications (the "Any App" workflow). The native surface should be enabled for the bundled cua_repl server, not just the browser surface.

Additional information — local evidence

1. The bundled unified-computer-use server is configured browser-only

%USERPROFILE%\.codex\plugins\cache\openai-bundled\\\unified-computer-use\26.908.70816\.mcp.json contains a cua_repl server whose environment enables only the browser surface:

"env": {
  "CUA_REPL_ENABLED_SURFACES": "browser",
  "NODE_REPL_TRUSTED_SERVICES": "{\"browser\":\"@oai/browser-desktop/service\"}",
  "SKY_CUA_NATIVE_PIPE": "1",
  "SKY_CUA_NATIVE_PIPE_DIRECTORY": "\\\\.\\pipe\\codex-computer-use-e4e0d017-81ef-4ea1-b313-313e9b003ee5"
}

Note that the trusted-service map here lists only browser; sky is absent. The native pipe variables are present, which suggests the native runtime is expected but never wired to a surface.

By contrast, the plain node_repl entry in %USERPROFILE%\.codex\config.toml does trust sky:

[mcp_servers.node_repl.env]
NODE_REPL_TRUSTED_SERVICES = '{"browser":"C:/Users/<user>/.codex/plugins/cache/openai-bundled/browser/26.908.70816/scripts/browser-service.mjs","sky":"@oai/sky/service"}'
SKY_CUA_NATIVE_PIPE = "1"
SKY_CUA_NATIVE_PIPE_DIRECTORY = '\\.\pipe\codex-computer-use-<uuid>'

2. The Computer Use tool description shown to the model says native APIs are disabled

The js tool description for the bundled cua_repl server (as persisted in %USERPROFILE%\.codex\.codex-global-state.json) contains the line:

Native computer APIs are disabled.

3. The runtime itself is healthy — this is not a broken install

Desktop log (...\LocalCache\Local\Codex\Logs\<date>\codex-desktop-*.log):

2026-09-16T14:09:00.782Z info [computer-use-native-pipe] computer-use native pipe startup ready pipePath=\\.\pipe\codex-computer-use-<uuid> platform=win32
2026-09-16T14:09:03.509Z info [AppServerConnection] mcp_server_startup_status_updated error=null failureReason=null hostId=local server=node_repl status=ready
2026-09-16T14:11:41.756Z info [AppServerConnection] mcp_server_startup_status_updated error=null failureReason=null hostId=local server=cua_repl status=ready

The native pipe reaches startup ready, and both node_repl and cua_repl report status=ready with error=null. There is no native-app capability exposure or sky trusted-RPC registration event anywhere in the logs for these threads.

4. Things already tried (all ineffective)

• Repairing / reinstalling the Computer Use plugin
• Fully uninstalling and reinstalling the desktop app
• Toggling "Any App" / "Control Windows apps" permission on and off
• Full app restart; brand-new task with no project loaded
• %USERPROFILE%\.codex\config.toml: the workaround reported in #42745 ([features] js_repl = true, set while the app was fully closed, then restart) is no longer applicable in this build — codex features list reports js_repl as removed:

js_repl                                  removed            false
js_repl_tools_only                       removed            false

Question for the maintainers

1. What determines the value of CUA_REPL_ENABLED_SURFACES for the bundled cua_repl server, and is there any user-side setting (or server-side flag) that enables the computer surface on Windows?
2. Does enabling the native surface require a specific plan tier or region, beyond installing the plugin and allowing "Control Windows apps"?
3. Is there a supported way to force the model onto the trusted node_repl + @oai/sky path now that js_repl has been removed?

Related existing reports

#42745, #44078, #45221, #42214, #45328 — same symptom class (Windows native Computer Use unreachable while browser use keeps working), all still open at the time of writing.