Codex Desktop freezes when pasting a specific string into the input box

Summary
Codex Desktop becomes unresponsive immediately after a specific JSON string is pasted into the chat input box.

The reproduction string below is sanitized. Sensitive business data, including merchant identifiers, numeric identifiers, long tokens, and all Chinese text in the JSON, has been replaced with symbols. The redaction preserves the rough shape of the original input but does not include the original sensitive values.

Environment
Product: Codex Desktop app
Platform: Windows desktop
Date observed: 2026-06-09
Steps to reproduce
Open Codex Desktop.
Copy the entire sanitized reproduction string below.
Paste it directly into the Codex Desktop input box.
Expected behavior
The text should be pasted normally, or the app should handle/reject the input gracefully without blocking the UI.

Actual behavior
Codex Desktop freezes/becomes unresponsive immediately after the string is pasted into the input box.

Sanitized reproduction string
[\n {\n \"hospitalCode\": \"\",\n \"hospitalName\": \"院\",\n \"description\": \"HIS对账映射，配置来源于pay_merchant真实数据\",\n \"rules\": [\n {\n \"uid\": \"1780464790722c14e357cc5adf8\",\n \"mode\": \"qlexpress\",\n \"name\": \"脚本推导规则rePayChannel\",\n \"mappingOut\": [\n \"rePayChannel\"\n ],\n \"script\": {\n \"language\": \"qlexpress\",\n \"timeoutMillis\": 100,\n \"source\": \"if (startsWith(tradeMainNo, 'M') || channelCode =='微信') {\\n return map('rePayChannel', '序');\\n} else if (channelCode == '窗口' && contains(cashier, '平台')) {\\n return map('rePayChannel', '机');\\n} else {\\n return map('rePayChannel', defaultIfBlank(rePayChannel, '窗口'));\\n}\"\n }\n },\n {\n \"uid\": \"1780464790722fae6c64b009b18\",\n \"mode\": \"qlexpress\",\n \"name\": \"脚本推导规则mecNum\",\n \"mappingOut\": [\n \"mecNum\"\n ],\n \"script\": {\n \"language\": \"qlexpress\",\n \"timeoutMillis\": 100,\n \"source\": \"if (substring(tradeMainNo, 0, 4) == '2000' && successTime >= '2026-06-02 14:00:00') {\\n return map('mecNum', '801615','ifCode','rcb');\\n} else if (startsWith(tradeMainNo, 'M')) {\\n return map('mecNum', '141281','ifCode','wxmei');\\n} else if (substring(tradeMainNo, 0, 4) == '2000' && successTime < '2026-06-02 14:00:00') {\\n return map('mecNum', 'Q207PV','ifCode','union');\\n} else if (substring(tradeMainNo, 0, 4) == '2001' && successTime >= '2026-05-11 00:00:00') {\\n return map('mecNum', '8615','ifCode','rcb');\\n} else if (substring(tradeMainNo, 0, 4) == '2001' && successTime < '2026-05-11 00:00:00') {\\n return map('mecNum', '6207PV','ifCode','union');\\n} else if ((substring(tradeMainNo, 0, 4) == '2009' || substring(tradeMainNo, 0, 4) == '2800') && !startsWith(tradeMainNo, 'M')) {\\n return map('mecNum', '1681','ifCode','wxpay');\\n}\"\n }\n },\n {\n \"uid\": \"1780554460983667a3614d74c68\",\n \"mode\": \"qlexpress\",\n \"name\": \"脚本推导规则orderType\",\n \"mappingOut\": [\n \"orderType\"\n ],\n \"script\": {\n \"language\": \"qlexpress\",\n \"timeoutMillis\": 100,\n \"source\": \"if (orderType == \\\"2\\\") {\\n return map('orderType', \\\"0\\\");\\n} else if (orderType == \\\"1\\\") {\\n return map('orderType', \\\"1\\\");\\n}\\nreturn null;\"\n }\n }\n ]\n },\n {\n \"hospitalCode\": \"1721257\",\n \"hospitalName\": \"信息\",\n \"description\": \"\",\n \"rules\": [\n {\n \"uid\": \"1780972387248cf20efb5ffd44\",\n \"mode\": \"qlexpress\",\n \"name\": \"脚本推导规则\",\n \"mappingOut\": [\n \"rePayChannel\"\n ],\n \"script\": {\n \"language\": \"qlexpress\",\n \"timeoutMillis\": 100,\n \"source\": \"if (startsWith(tradeMainNo, 'M')) {\\n return map('rePayChannel', '序');\\n} else if (channelCode == '口' && contains(cashier, '平台')) {\\n return map('rePayChannel', '机');\\n} else {\\n return map('rePayChannel', defaultIfBlank(rePayChannel, '窗口'));\\n}\"\n }\n }\n ]\n }\n]
Notes
The original string contains sensitive business data and is not included verbatim.
All Chinese Han characters in the JSON have been replaced with ※.
Numeric data has been replaced with #, and long tokens/IDs have been replaced with ◇.
The original input SHA-256 hash is 1a5154810cacecf647121d08cf312d8dcd980a9a654bd60c3ac6e23302566670, which can be used to correlate the exact private reproduction input if needed.