Built-in Browser fails to commit Slate editor text or submit in Google Flow

Start with the uploaded thread 019f8f32-6ae1-7360-a813-cf574ab8f849 and reproduce the Slate editor failure using the listed steps. Trace browser automation's text-entry and activation behavior, then verify that the editor retains the full prompt, submits once, and reports success only after a result card or download appears.

What version of Codex CLI is running?

codex-cli 0.145.0-alpha.30 (bundled with app 26.715.72359, build 5718)

What subscription do you have?

Paid ChatGPT plan (exact tier is not exposed in the Codex session)

Which model were you using?

gpt-5.6-sol, reasoning effort ultra

What platform is your computer?

Darwin 25.5.0 arm64 arm

What terminal emulator and version are you using (if applicable)?

Codex desktop app 26.715.72359 (build 5718), built-in Browser plugin 26.715.72359

Codex doctor report

Diagnostic logs, codex-doctor-report.json, and the rollout were uploaded through /feedback. Uploaded thread: 019f8f32-6ae1-7360-a813-cf574ab8f849. The doctor report is not duplicated publicly here.

What issue are you seeing?

Summary

When Codex controls an authenticated Google Flow project in the built-in Browser, a long ASCII prompt appears fully rendered in Flow's Slate-controlled contenteditable, but the editor's internal state does not retain it. After a rerender or submit attempt, only the first 2–4 characters remain (for example, HE or GENE). The Generate arrow can receive focus without submitting, and no result card appears.

The agent also incorrectly inferred and reported success from DOM/focus state before any result card or download existed.

Observed errors

• Error: Cannot resolve a DOM point from Slate point: {"path":[0,0],"offset":2}
• TRPCClientError: Failed to fetch

What steps can reproduce the bug?

Uploaded thread: 019f8f32-6ae1-7360-a813-cf574ab8f849

1. Open an authenticated Google Flow project in the Codex app's built-in Browser.
2. Select direct image generation, attach a reference image, and choose Nano Banana Pro, 16:9, x2.
3. Ask Browser automation to enter an approximately 1,074-character ASCII prompt into Flow's Slate-controlled editor.
4. Observe that the full prompt is visibly rendered and the Generate arrow appears enabled.
5. Trigger a rerender or attempt to submit.
6. Observe that only the first 2–4 characters persist, the arrow may only gain focus, and no generation/result card is created.

The full prompt and Google Flow project ID are intentionally omitted. The screenshot and diagnostics were uploaded with the thread.

What is the expected behavior?

Browser automation should enter text through events that keep Flow's controlled editor state synchronized with the rendered DOM. When Generate is enabled, activating it should submit exactly once. Codex should only report success after verifying an authoritative result signal such as a new result card or download.

Additional information

Environment:

• ChatGPT/Codex app 26.715.72359 (build 5718)
• Built-in Browser plugin 26.715.72359
• Codex CLI 0.145.0-alpha.30
• Model: gpt-5.6-sol, reasoning effort ultra
• macOS / Apple Silicon

A separate Chrome session intermittently showed Google Flow's membership/project index stuck at “Loading…” and redirected to the Flow home page, while the same project and at least 10 existing assets remained accessible in the Codex in-app Browser. No assets were deleted. That separate Flow session/API instability may be a contributing factor, but the deterministic 2–4-character reversion occurred after Codex Browser automation interacted with the controlled editor.

User impact: a paid browser workflow was blocked, repeated retries consumed significant time, and the false success report reduced trust. No Google account, project ID, full prompt, or local asset path is included in this public issue.