Codex Desktop in-app browser closes on malformed URL

Bug report: Codex Desktop in-app browser closes on malformed Markdown URL

Summary

Codex Desktop's in-app browser/sidebar browser can close unexpectedly when a malformed Markdown-style URL is pasted into the address bar.

Environment

• App: Codex Desktop
• Version observed from process path: OpenAI.Codex_26.616.5445.0_x64__2p2nqsd0c76g0
• Browser runtime observed in logs: release=26.616.41845
• OS: Windows
• Date observed: 2026-06-20

Reproduction steps

1. Open Codex Desktop.
2. Open the in-app browser/sidebar browser.
3. Focus the browser address bar.
4. Paste this string:

``text
http://[excalidraw.com](https://t.co/zXwLpIOqLi)
``

1. Press Enter.

Actual result

The in-app browser/sidebar browser closes unexpectedly.

Expected result

The browser should not close. It should either:

• reject the value with an "invalid URL" style message, or
• extract/open a valid URL from the pasted Markdown link, or
• treat the input as a search query.

Notes

The pasted value is not a valid browser URL. It appears to be a Markdown link fragment with an extra http:// prefix. The valid targets are:

https://excalidraw.com

or:

https://t.co/zXwLpIOqLi

Even though the input is malformed, closing the in-app browser is still a product bug.

Additional observation

After the user retested, the in-app browser still closed unexpectedly. The assistant also attempted to control the in-app browser directly through Codex's browser automation bridge to open:

https://excalidraw.com

That automation bridge failed before navigation with:

Mcp error: -32602: js: codex/sandbox-state-meta: missing field `sandboxPolicy`

This suggests there may be a second issue in the Codex Desktop browser-control session metadata, separate from the malformed URL handling.

Related local log signals

Local logs show the in-app browser lifecycle starting and rebinding around the same session:

IAB_LIFECYCLE received browser sidebar owner sync
browser_use_iab_backend_startup_started
browser_use_iab_backend_startup_ready
IAB_LIFECYCLE webview captured browser use session route

No local source-level fix was applied because the Codex app is installed as a signed packaged application under C:\Program Files\WindowsApps, and patching that package would be unsafe and overwritten by updates.

Suggested fix

Before navigating from the in-app browser address bar:

1. Validate the raw address bar input.
2. If invalid, keep the browser pane open.
3. Show an inline validation state or route the input to search.
4. Add a regression test for malformed pasted values, including Markdown links and malformed scheme prefixes.

Also verify that the in-app browser automation bridge receives complete sandbox metadata, including sandboxPolicy, before initializing browser-control sessions.