Codex desktop IAB blocks local file preview: clarification needed for supported localhost preview

Feedback ID: 01a08e27-f461-7082-9265-52cfe217b7b0

Environment

• Windows; Codex desktop app 26.901.6511.0.
• Codex In-app Browser (IAB).
• Local HTML design prototype with synthetic data, without production accounts or backend connections.

Observed behavior
Browser Use rejected the local file URL with:
“Browser Use rejected this action due to browser security policy. Reason: The browser URL policy blocks this action.”

The accompanying tool instructions also prohibited using another protocol or browser surface to circumvent the rejection. After changing website permissions in Settings > Browser, the file URL remained blocked.

A read-only investigation found no explicit browser_use.default_origin_policy or browser_use.origins entries in the user configuration. The checked local managed configuration files were absent. The effective cloud/runtime policy remains unknown. A saved approval for an unrelated website was present, but we do not assume it is an exclusive allowlist.

Requested clarification

1. Is blocking file URLs expected in this version?
2. How can we identify the effective browser policy through a supported diagnostic?
3. What is the officially supported way to preview this local HTML prototype while respecting the restriction on alternative access methods?
4. If loopback HTTP preview is supported, how should we obtain approval for the exact origin http://127.0.0.1:19876/ without relaxing global security settings?

The proposed HTTP server has not been started, configured or tested. No security policy has been changed.

We need genuine browser interaction and screenshots at 1366×768 and 1920×1080. These checks remain NOT_RUN until a supported access path is available.

No source file, test, or implementation entry point is identified. Start by reproducing the local file rejection in Codex desktop IAB and checking the supported browser-policy diagnostic path; done means documenting whether file URLs and loopback HTTP previews are supported and how exact-origin approval works without weakening global security settings.