Allow disabling automatic SSH port forwarding or reusing an existing local forward

What variant of Codex are you using?

Codex App for macOS 26.903.61454 (build 8378), macOS 15.7.1, remote SSH session with the built-in Browser

What feature would you like to see?

When a remote SSH session uses the built-in Browser, Codex automatically starts its own OS-level SSH tunnel with a dynamically assigned local port, even when the same remote service is already explicitly forwarded by the user.

For example, the user may already manage this mapping:

127.0.0.1:8088 -> remote 127.0.0.1:8088

Opening that remote service in the built-in Browser causes Codex to start another process equivalent to:

ssh -N -L <dynamic-local-port>:127.0.0.1:8088 <remote-host>

There is currently no setting to disable this behavior or tell the Browser to reuse the existing local endpoint.

Please add:

1. A global and/or per-workspace setting to disable automatic SSH port forwarding.
2. A way to map a remote service to an existing user-managed local endpoint.
3. A prompt or notification before a new tunnel is created, showing the local and remote endpoints and allowing the user to cancel.

When an existing mapping is configured, opening http://localhost:8088 should use that mapping and should not spawn a second SSH process. When automatic forwarding is disabled and no mapping exists, Codex should prompt or report that the service is unavailable instead of silently creating a tunnel.

Additional information

This matters for users who manage tunnels through SSH ControlMaster, jump hosts, VPNs, or organization-specific network policies. Creating a second tunnel with a random local port can also change the browser origin and break cookies, OAuth callback URLs, CORS rules, and other origin-scoped state.

The unexpected long-lived SSH process also makes port ownership and network behavior difficult to understand from outside the app.

Related issues:

• #21294 requested automatic forwarding for remote dev servers.
• #36153 requests stable browser state when Codex assigns a new local port.

This request is specifically for an opt-out and for reuse of an already user-managed forward.

The payload names no files or tests; start by locating the built-in Browser's automatic SSH tunnel creation and any existing remote-forwarding settings. Review related issues #21294 and #36153, then verify that configured mappings are reused, automatic forwarding can be disabled, and users are informed when no mapping is available.