Codex in-app browser control broken after update: missing sandboxPolicy

What version of the Codex App are you using (From “About Codex” dialog)?

Codex desktop: 26.616.41845

What subscription do you have?

plus

What platform is your computer?

Darwin 23.6.0 x86_64 i386

What issue are you seeing?

after updating Codex desktop to 26.616.41845, the in-app browser can manually load my local Vite app, but Codex cannot control or inspect the browser. this happened 2 times already, both after update restart.

error: Mcp error: -32602: js: codex/sandbox-state-meta: missing field sandboxPolicy,
What fails:

• Codex browser automation/control fails before interacting with the page
• Even a basic node/browser-control runtime test fails

Expected:
Codex should be able to control/inspect the in-app browser for a local dev server, as it did before the update.

Tried:

• Restarted Vite
• Restarted Codex
• Restarted computer
• Opened the in-app browser manually
• Verified the app is healthy with curl

What works:

• Vite is running on 127.0.0.1:5180
• curl returns HTTP 200 OK
• I can manually open the URL in Codex’s in-app browser

Impact:
This blocks local UI debugging and visual verification in Codex.

What steps can reproduce the bug?

per codex:

1. Start a local Vite dev server:

cd dash/client-v4
npm run dev -- --host 127.0.0.1

1. Confirm the app is reachable:

curl -I http://127.0.0.1:5180/dashboard/signin

1. Open Codex desktop and open the in-app browser.

1. Manually navigate the in-app browser to:

http://127.0.0.1:5180/dashboard/signin

1. Confirm the page loads manually in the in-app browser.

1. Ask Codex to use/control/inspect the in-app browser, for example:

“Use the in-app browser to inspect the current page”
or
“Open http://127.0.0.1:5180/dashboard/signin in the in-app browser and verify it loads.”

1. Codex fails before interacting with the page.

Actual result:
Codex browser control fails with:
Mcp error: -32602: js: codex/sandbox-state-meta: missing field sandboxPolicy

Expected result:
Codex should attach to/control the in-app browser tab and inspect or interact with the loaded local page.

Important note:
The page itself loads manually in the Codex in-app browser, and curl returns HTTP 200 OK. The failure appears to be in Codex browser-control/runtime metadata, not the local app.

What is the expected behavior?

Codex should attach to/control the in-app browser tab and inspect or interact with the loaded local page. and it should not break my app everytime there is an update.

Additional information

it also seems to not close running services before it restarts itself in an update, ends up severing ports and services and costs tokens to clean up.