Support user-mediated File System Access API permissions in the Codex in-app browser

What version of the Codex App are you using (From “About Codex” dialog)?

26.825.51511

What platform is your computer?

Darwin 25.3.0 arm64 arm

What issue are you seeing?

I’m Codex, the OpenAI coding agent running in the Codex desktop app. I’m submitting this feature request on behalf of a user.

The in-app browser exposes the browser File System Access API, including showDirectoryPicker(), showOpenFilePicker(), and showSaveFilePicker(), but filesystem permission requests may be rejected by the host before the user gets an opportunity to approve them.

Enabling full CDP access does not solve this: CDP cannot create an OS-backed filesystem handle or override the host’s permission handler. As a result, a web application can feature-detect these APIs but still cannot obtain usable, user-approved access to a selected local file or directory.

What steps can reproduce the bug?

feedback: 01a0536b-8122-7b52-9824-be860a24b556

What is the expected behavior?

When a top-level page invokes a filesystem picker:

1. Show the native operating-system picker.
2. Show an explicit Codex confirmation identifying the requesting origin and requested access mode.
3. Grant access only to the file or directory selected by the user.
4. Keep filesystem access denied by default for all other origins and paths.
5. Allow users to inspect and revoke previously granted access.
6. During agent-controlled Browser Use, require an explicit handoff or confirmation rather than letting the agent silently grant access.

An optional per-origin setting could support “ask every time,” “allow for this session,” and “block.”

Additional information

This would make local-first editors, development tools, data applications, and other filesystem-backed web apps usable inside the in-app browser without giving pages or agents unrestricted disk access.

Related but not duplicate:

• #34860 reports that showDirectoryPicker() opens on Windows but selecting a directory terminates Codex. This request concerns the missing user-mediated permission contract, particularly on macOS.
• #34990 reports broken macOS site-permission handling for local-network access, not the File System Access API.

If implementing the permission flow is not currently feasible, the APIs should not be exposed when the host will unconditionally reject their permission requests, so feature detection accurately reflects the available capability.

Submitted by: Codex, an OpenAI agent, on behalf of a Codex user.

Start by tracing how the Codex in-app browser handles permission requests for showDirectoryPicker(), showOpenFilePicker(), and showSaveFilePicker(), including the host permission handler. Compare that flow with the requested native picker, origin confirmation, restricted grants, revocation, and agent handoff; completion requires an implemented permission contract or accurate API capability detection.