In-app browser DOM snapshot omits values from input[type=email] fields

What version of the Codex App are you using (From “About Codex” dialog)?

26.519.31651 (build 3017)

What subscription do you have?

Plus

What platform is your computer?

Darwin 24.5.0 arm64 arm

What issue are you seeing?

In ChatGPT Work in the ChatGPT desktop app, the in-app browser DOM snapshot omits live values from email inputs while exposing the value of a normal text input.

The page contains three populated controls:

• input[type="text"]: Control value
• input[type="email"]: alice@example.com
• input[type="email"][multiple]: alice@example.com,bob@example.net

Chrome DevTools confirms the live values:

[...document.querySelectorAll('input')].map(i => i.value)
// ['Control value', 'alice@example.com', 'alice@example.com,bob@example.net']

However, tab.playwright.domSnapshot() includes text: Control value for the text field but only placeholders for both email fields. A read-only playwright.evaluate through the browser-control layer also incorrectly returned empty strings for the email inputs, despite DevTools showing populated values.

What steps can reproduce the bug?

1. Serve this minimal page locally:

<label for="normal-text">Normal text</label>
<input id="normal-text" type="text" placeholder="Example text">

<label for="single-email">Single email</label>
<input id="single-email" type="email" placeholder="one@example.com">

<label for="multiple-emails">Multiple emails</label>
<input id="multiple-emails" type="email" multiple placeholder="one@example.com, two@example.com">

2. Open it using the in-app browser available from ChatGPT Work.
3. Fill the fields with Control value, alice@example.com, and alice@example.com,bob@example.net.
4. Verify the values in DevTools with:

[...document.querySelectorAll('input')].map(i => i.value)

5. Request tab.playwright.domSnapshot().
6. Observe that only the normal text input value appears; both email values are absent.

What is the expected behavior?

The DOM snapshot should expose current values consistently for text and email inputs. If email values are intentionally redacted, the behavior should be documented and the read-only evaluation API should still reflect the real live DOM state consistently.

Additional information

OpenAI Support reviewed this reproduction and explicitly directed us to file it in https://github.com/openai/codex/issues.

Important product-surface clarification: this was reproduced in ChatGPT Work, not Codex mode. The containing product is the ChatGPT desktop app, and the affected capability is Work's in-app browser/browser-control DOM snapshot.

We searched the tracker before filing. The closest result, #23208, concerns a state-dependent locator.fill failure with a virtual-clipboard error. This report is different: filling succeeds, DevTools confirms the values, and only the DOM snapshot/readback omits the email values.

Surface: ChatGPT desktop app, ChatGPT Work, in-app browser (IAB), macOS.

Start by locating the implementation of tab.playwright.domSnapshot() and the browser-control read-only evaluate path. Reproduce the minimal HTML page with populated text and email inputs, then trace how their live values are read. Done means the snapshot and readback handle email values consistently with text inputs, or the redaction behavior is documented and consistent.