The Browser plugin does not work in the Codex desktop app on Windows.

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #29193
• #29189

Powered by Codex Action

I am seeing the same failure on Windows with Codex Desktop / bundled browser runtime 26.616.41845.

Environment/details from this repro:

• Platform: Windows / PowerShell
• Browser plugin path/version: openai-bundled/browser/26.616.41845
• Node REPL runtime path class: %LOCALAPPDATA%\OpenAI\Codex\runtimes\cua_node\<hash>\bin\node_repl.exe
• Local config includes:

approval_policy = "never"
sandbox_mode = "danger-full-access"

[mcp_servers.node_repl]
args = []
command = 'C:\Users\<user>\AppData\Local\OpenAI\Codex\runtimes\cua_node\<hash>\bin\node_repl.exe'
startup_timeout_sec = 120

[windows]
sandbox = "unelevated"

Minimal failing call after exposing node_repl/js:

nodeRepl.write(JSON.stringify({ ok: true }))

Actual result:

tool call error: tool call failed for `node_repl/js`

Caused by:
    Mcp error: -32602: js: codex/sandbox-state-meta: missing field `sandboxPolicy`

Observed impact:

• The failure happens before any JavaScript executes, so the Browser client bootstrap never starts.
• The in-app Browser tool cannot be used at all from the agent.
• Each failed bridge attempt spawned node_repl.exe plus paired node.exe ./mcp/server.mjs --stdio / server.cjs --stdio helper processes; these had to be cleaned up manually.
• Local .codex-global-state.json permission records were checked and all existing heartbeat permission records had a sandboxPolicy, so the missing field appears to be in the live MCP tool-call metadata for this session rather than an obvious saved-state JSON omission.

This looks consistent with the Desktop/app-server path sending a codex/sandbox-state-meta shape that no longer matches what the bundled node_repl runtime expects.

I can reproduce this on Windows 10.

Version: 26.616.41845
Browser extension installed
New conversations also fail

Error:
MCP error: -32602: js: codex/sandbox-state-meta: missing field sandboxPolicy

Please treat this as user feedback on update stability and regression risk, not just a one-off bug.

After recent Codex Desktop updates, a previously working browser-control / Chrome-control setup broke again. I had spent several days diagnosing and fixing Codex browser control on Windows; after another update, the same class of workflow became unusable again.

For users who rely on Codex for local automation, this is very costly: stable workflows, local preflight rules, plugin configurations, and workarounds can become invalid overnight after an auto-update. The purpose of an update should be to improve reliability. When an update breaks core automation capabilities without a rollback path or compatibility guidance, it wastes user time and reduces trust.

Suggestions:

1. Add stronger regression tests for Browser plugin / Chrome extension / node_repl / MCP / Windows sandbox metadata before desktop releases.
2. Provide a stable compatibility contract for plugins and local tools, especially metadata fields such as sandboxPolicy.
3. Add an easy rollback path or “stay on current version” option when an update breaks local workflows.
4. Show release notes with known breaking changes and recovery steps before forced or automatic updates.
5. Add a built-in “Test Browser Tool” diagnostic that reports browser/plugin compatibility and exact failure reasons.
6. Preserve known working plugin settings and local configurations across updates, or warn clearly when migration is required.

This is a reliability/regression concern. Please prioritize update stability and recovery tooling for users who depend on Codex in production-like local workflows.