Browser plugin fails because sandboxPolicy is missing from sandbox-state metadata

Resolved 💬 2 comments Opened Jun 20, 2026 by BalamEduardo Closed Aug 6, 2026
💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of the Codex App are you using (From “About Codex” dialog)?

26.616.41845

What subscription do you have?

ChatGPT Plus

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

The Browser plugin fails before it can connect to the in-app browser.

When I ask Codex to test a local application using the Browser plugin, even the following minimal node_repl call fails:

nodeRepl.write("ok")

The complete error is:
Mcp error: -32602: js: codex/sandbox-state-meta: missing field `sandboxPolicy`

### What steps can reproduce the bug?

Steps to reproduce:
Open Codex Desktop on Windows.
Enable and invoke the Browser plugin.
Ask Codex to open or test a localhost URL.
Codex attempts to invoke node_repl/js.
The invocation fails immediately with the error above.

### What is the expected behavior?

Expected behavior:
The browser runtime should initialize and allow Codex to control the in-app browser.
Actual behavior:
The invocation is rejected before any user JavaScript or browser bootstrap code runs because sandboxPolicy is missing from the sandbox-state metadata.

### Additional information

Troubleshooting already performed:
Restarted Codex Desktop.
Restarted the computer.
Confirmed that the Browser plugin is enabled.
Confirmed that the browser client and node_repl runtime are installed.
Reproduced the problem with a minimal call that does not access the project.
Confirmed that the localhost application itself responds successfully over HTTP.
This appears to be an issue in the Codex Desktop tool invocation boundary rather than in the local application.

View original on GitHub ↗

2 Comments

github-actions[bot] contributor · 2 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

  • #29241
  • #29240
  • #29238
  • #29219
  • #29242

Powered by Codex Action

Necmttn · 2 months ago

For the Browser plugin path, the sandbox metadata contract should be tested at the managed runtime boundary. The app-server should send a versioned codex/sandbox-state-meta object with required fields such as sandboxPolicy, permission profile, and trust state before any JS call reaches node_repl.

Closeout test: minimal nodeRepl.write("ok") succeeds on Windows and macOS for Browser/Chrome/Computer Use, and missing metadata produces a compatibility diagnostic naming client version, runtime version, and schema version.

---

_Generated with ax._