Fix Codex node_repl “missing field sandboxPolicy” in Browser / Computer Use¶

Audience: Browser or Computer Use fails with this exact error

This error is not a normal network denial:

Mcp error: -32602: js: codex/sandbox-state-meta:
missing field `sandboxPolicy`

Multiple reports in the official Codex repository identify it as a metadata compatibility problem between Codex and the bundled node_repl. Update the desktop app and its bundled runtime as one unit. If it still reproduces, do not weaken permissions; wait for a compatible build or add sanitized diagnostics to the official issue.

Key Points¶

Separate missing field sandboxPolicy from an ordinary network denial
Update Desktop and its bundled runtime as one compatible unit
Do not disable the sandbox or delete .codex as the first response

Identify it in 30 seconds¶

This failure usually has four signals:

It appears when Browser, Chrome control, or Computer Use starts
node_repl/js fails before the JavaScript body runs
The MCP error is -32602 and names a missing sandboxPolicy field
Normal shell commands or curl may still work

If those signals match, adding network_access=true is the wrong branch. Issue #29338 reports that the active Codex turn already has a valid sandbox policy, but the MCP metadata handed to node_repl does not match the schema expected by that runtime.¹

Safe recovery steps¶

1. Fully quit Codex Desktop¶

Close the app and make sure no Codex-related processes remain before relaunching. A stale app-server or runtime process can keep the old combination alive after an update.

2. Update the desktop app itself¶

Use the Codex Desktop updater or the store that installed the app. Running codex update in a terminal does not necessarily replace the app's embedded app-server or node_repl runtime.

The goal is not to update these pieces independently. The desktop package must use a compatible set:

Codex Desktop
Its embedded Codex/app-server
Browser / Computer Use plugins
The bundled node_repl runtime

3. Retest once in a new thread¶

After updating and fully restarting, try one Browser action in a new thread. If the exact same message returns, the runtime boundary is a stronger explanation than the prompt or target website.

Fixes to avoid¶

Do not disable the sandbox¶

Issue #29338 reports that launching node_repl with --disable-sandbox did not bypass the failure. Metadata validation happens before the JavaScript kernel starts.¹

These changes therefore reduce protection without repairing the schema mismatch:

Switching to danger-full-access
Changing approval policy to never
Using --dangerously-bypass-approvals-and-sandbox
Marking the project trusted without another reason

Do not delete `.codex`¶

The message does not indicate SQLite corruption or failed authentication. Deleting an entire .codex directory can remove configuration, session state, or credentials and still reproduce the error when the same incompatible runtime is installed again.

Do not keep toggling network access¶

The visible result looks like a browser connection failure, but the actual failure occurs before a network request. Troubleshoot normal network sandbox denials separately.

What to collect if it still reproduces¶

For a public issue, collect only the minimum safe details:

The full error message
The Codex Desktop build from About
OS and version
Whether Browser or Computer Use triggered it
Whether a full restart and new thread reproduced it
If useful, reviewed and redacted codex doctor --json output

Do not attach usernames, workspace names, conversation contents, tokens, or a complete .codex directory.

Workarounds while waiting for a compatible build¶

Avoid the node_repl-dependent UI path without weakening the sandbox:

Open the page manually and provide the relevant HTML or error text to Codex
Use a documented API or normal curl workflow when one exists
Continue shell and file-editing tasks without Browser / Computer Use

These alternatives do not replace Computer Use, but they let work continue without turning off safeguards.

Root cause in plain language¶

The codex/sandbox-state-meta object sent by Codex and the schema required by node_repl are from incompatible generations. Issue #29338 describes current Codex metadata fields such as permissionProfile and sandboxCwd, while the bundled runtime requires a different sandboxPolicy field.¹

Similar reports include macOS as well as Windows, so do not assume the website or prompt caused it.²

Summary¶

The exact missing field sandboxPolicy text points to MCP schema compatibility, not ordinary network access
Update Codex Desktop and its bundled runtime together, then fully restart
Do not use dangerous mode, disable the sandbox, or delete .codex as the first response
If it persists, add minimal sanitized diagnostics to the official issue and use non-Browser paths temporarily