Codex desktop Browser Use retains inaccessible per-site denial after Approval change and restart

Summary

Codex desktop Browser Use reports that a saved user preference blocks https://accounts.clickbank.com, but the Windows desktop app does not expose an obvious per-site saved-decision manager where that denial can be removed. The site loads normally in the built-in browser and the user can sign in manually, but the first agent-controlled semantic page operation is rejected before any interaction.

The Browser documentation says allowed and blocked sites can be managed in Settings > Browser, but the current Windows UI only shows the global Approval setting and no discoverable per-site entry for this saved denial:
https://learn.chatgpt.com/docs/browser

Environment

• Product: Codex desktop app for Windows
• App version: 26.825.6671.0
• App-server version: 0.151.0-alpha.7.2
• OS: Windows 64-bit, build 26200
• Affected origin: https://accounts.clickbank.com

Steps to reproduce

1. Open accounts.clickbank.com manually in the Codex built-in browser.
2. Sign in and reach the account dashboard.
3. Ask Codex to open or inspect the page using Browser Use.
4. Observe the saved-permission rejection.
5. Open Settings > Browser > Permissions > Approval.
6. Change Approval from Always ask to an option that does not require approval before opening websites.
7. Fully exit and restart Codex.
8. Reopen the authenticated page and retry Browser Use.

Actual behavior

Browser Use continues to reject the action:

Browser Use rejected this action due to browser security policy. Reason: A saved user permission setting blocks this action. Browser use cannot access https://accounts.clickbank.com because the user has a saved preference that blocks it.

The rejection persists after changing the global Approval setting, fully restarting Codex, opening a fresh built-in browser session, and confirming the dashboard is accessible manually. Codex can discover/claim the tab and read its URL/title, but the first semantic page operation is rejected.

A non-sensitive log line confirms the authenticated dashboard tab was ready:

2026-08-31T18:43:31.960Z [browser-sidebar-manager] browser sidebar dom-ready url=https://accounts.clickbank.com/master/dashboard.html

Expected behavior

One of the following should happen:

• Browser Use presents a new approval prompt for the origin;
• the global Approval setting overrides or clears the saved denial; or
• Settings > Browser exposes the saved per-site decision so the user can change/remove it.

Impact

This blocks authorized, read-only Browser Use on an account page even though the user can access it manually. No credentials need to be entered by the agent, and no account mutation is requested.

Additional notes

This appears consistent with a stale per-origin deny decision overriding the global Approval setting while having no accessible management UI. Screenshots can be provided if useful. Full logs are intentionally not attached because they may contain sensitive data and should be reviewed before sharing.

Start at Settings > Browser > Permissions > Approval and reproduce the saved per-site denial on Windows with Browser Use. Trace the per-origin permission handling and verify that changing Approval, restarting, or using the settings UI results in an approval prompt, an override, or an editable saved decision.