Repository navigation
Browser plugin fails because sandboxPolicy is missing from sandbox-state metadata #29258
Closed as duplicate
Description
What version of the Codex App are you using (From “About Codex” dialog)?
26.616.41845
What subscription do you have?
ChatGPT Plus
What platform is your computer?
Microsoft Windows NT 10.0.26200.0 x64
What issue are you seeing?
The Browser plugin fails before it can connect to the in-app browser.
When I ask Codex to test a local application using the Browser plugin, even the following minimal node_repl call fails:
nodeRepl.write("ok")
The complete error is:
Mcp error: -32602: js: codex/sandbox-state-meta: missing field `sandboxPolicy`
### What steps can reproduce the bug?
Steps to reproduce:
Open Codex Desktop on Windows.
Enable and invoke the Browser plugin.
Ask Codex to open or test a localhost URL.
Codex attempts to invoke node_repl/js.
The invocation fails immediately with the error above.
### What is the expected behavior?
Expected behavior:
The browser runtime should initialize and allow Codex to control the in-app browser.
Actual behavior:
The invocation is rejected before any user JavaScript or browser bootstrap code runs because sandboxPolicy is missing from the sandbox-state metadata.
### Additional information
Troubleshooting already performed:
Restarted Codex Desktop.
Restarted the computer.
Confirmed that the Browser plugin is enabled.
Confirmed that the browser client and node_repl runtime are installed.
Reproduced the problem with a minimal call that does not access the project.
Confirmed that the localhost application itself responds successfully over HTTP.
This appears to be an issue in the Codex Desktop tool invocation boundary rather than in the local application.
Activity
github-actions commentedon Jun 20, 2026
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
Powered by Codex Action
Necmttn commentedon Jun 21, 2026
For the Browser plugin path, the sandbox metadata contract should be tested at the managed runtime boundary. The app-server should send a versioned
codex/sandbox-state-metaobject with required fields such assandboxPolicy, permission profile, and trust state before any JS call reaches node_repl.Closeout test: minimal
nodeRepl.write("ok")succeeds on Windows and macOS for Browser/Chrome/Computer Use, and missing metadata produces a compatibility diagnostic naming client version, runtime version, and schema version.Generated with ax.
sandboxPolicy#29193