[Windows] In-app browser denies local network access despite site permission set to Allow

What version of the Codex App are you using (From “About Codex” dialog)?

26.901.6511.0 (verified from the installed Windows OpenAI.Codex package)

What subscription do you have?

ChatGPT Pro

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

The Codex in-app browser denies requests from SharePoint to an HTTPS localhost development server even after the user explicitly allows Local network access for the SharePoint origin. No app crash occurred.

Both the site-specific permission screen and the Local network access allowlist inside the same Codex app show the SharePoint origin as allowed. However, the active SharePoint page reports denied through the Permissions API, and the local script request fails:

URL: https://localhost:4321/temp/build/manifests.js
Network.loadingFailed.errorText: net::ERR_FAILED
corsErrorStatus.corsError: LocalNetworkAccessPermissionDenied

Workbench displays a debug-manifest loading error with:

Error: Script error for "https://localhost:4321/temp/build/manifests.js"
https://requirejs.org/docs/errors.html#scripterror

Read-only permission query in the SharePoint page:

await navigator.permissions.query({name: "local-network-access"})
// state: "denied"
// location.origin matches the SharePoint origin in the allowlist

What steps can reproduce the bug?

These are the steps observed in our environment. Tenant and site names are redacted.

1. Run an SPFx HTTPS development server on localhost:4321 with a trusted development certificate.
2. Sign in to SharePoint and open the hosted Workbench in the Codex in-app browser:
   https://TENANT.sharepoint.com/sites/SITE/_layouts/15/workbench.aspx?debugManifestsFile=https%3A%2F%2Flocalhost%3A4321%2Ftemp%2Fbuild%2Fmanifests.js
3. Select Load debug scripts.
4. In the same Codex app, allow Local network access for https://TENANT.sharepoint.com. Confirm the origin is listed among allowed sites.
5. Reload Workbench. The local script request fails with LocalNetworkAccessPermissionDenied, and the Permissions API still reports denied.
6. Change the permission to Ask (default), then back to Allow, and reload. The failure persists.

Comparison checks:

• Manually opening the exact manifests.js URL in the same in-app browser displays the JavaScript successfully.
• PowerShell Invoke-WebRequest returns HTTP 200 with normal certificate validation.
• Opening the same Workbench in a separate browser launched by agent-browser and signing in with the same account successfully loads the local web part.

What is the expected behavior?

Explicitly allowing Local network access for the SharePoint origin should apply to the active page and allow its SPFx scripts to load from localhost.

If another app policy overrides this setting, the UI should clearly explain the effective restriction instead of showing Allow while the page receives a permission denial.

Additional information

Related report: https://github.com/openai/codex/issues/34990

That report describes macOS app crashes while changing permissions for Duo. This report tracks the Windows permission mismatch without any app crash. A shared root cause has not been established.

The current workaround is using a separate browser. We did not add flags to disable browser security or certificate verification for that successful test.

The user directly verified the in-app permission screens. The permission query and network failure were captured through Codex browser diagnostic tools. Corporate hostnames, account identifiers, and authentication tokens have been omitted.

No source files or tests are named. Start by reproducing the Windows in-app browser flow with the SharePoint Workbench and localhost:4321, then trace the local-network permission decision behind the displayed Allow state. Done means an allowed SharePoint origin can load the local script, or the UI clearly identifies the policy that still denies it.