Node REPL broken: sandboxPolicy missing in MCP request meta (version mismatch)
Resolved 💬 2 comments Opened Jun 20, 2026 by memeshe069-beep Closed Aug 6, 2026
💡 Likely answer: A maintainer (github-actions[bot], contributor)
responded on this thread — see the highlighted reply below.
Bug Description
Node REPL MCP server rejects all js calls with error:
Mcp error: -32602: js: codex/sandbox-state-meta: missing field sandboxPolicy
Environment
- Codex App: 26.616.5445.0 (Windows Store)
- Codex CLI: 26.616.41845
- Node REPL runtime: a89897d3d9baa117
- OS: Windows 10 x64
- Node: v24.14.0
Root Cause
The node_repl.exe binary requires sandboxPolicy field in MCP request _meta.codex/sandbox-state-meta, but Codex CLI (26.616.41845) does not inject this field. This is a version mismatch between the App and CLI/runtime.
Attempted Fixes (all failed)
- Deleted and re-downloaded cua_node runtime (downloaded same broken version)
- Replaced entire runtime with App's bundled version (26.616.5445)
- Fixed @oai/sky package.json exports ("./dist/": "./dist/")
- Verified module imports work standalone, but MCP transport rejects before JS runs
Impact
- Computer Use completely unusable
- In-app Browser unusable
- Chrome extension unusable
- All Node REPL-dependent features broken
Workaround
WScript.Shell SendKeys works for basic Windows automation but lacks Computer Use capabilities.
2 Comments
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
Powered by Codex Action
The MCP request meta should be versioned or capability-negotiated. If the Node REPL runtime requires
codex/sandbox-state-meta.sandboxPolicy, the client should either always include that field or fail startup with "runtime requires meta schema X, client provides Y."A regression should pair old CLI/new runtime and new CLI/old runtime, then assert missing meta fields produce a compatibility diagnostic before user JS calls run. That beats surfacing a generic
-32602from inside the tool.---
_Generated with ax._