Codex Desktop does not request or diagnose required macOS Local Network permission

What version of the Codex App are you using (From “About Codex” dialog)?

26.727.51351 (build 6119), bundled codex-cli 0.146.0-alpha.9.2

What subscription do you have?

Plus

What platform is your computer?

Darwin 25.6.0 arm64

What issue are you seeing?

Codex Desktop can fail to access LAN destinations when the parent ChatGPT application does not have macOS Local Network permission.

In this state, Codex reports only errors such as:

nc: connectx to 192.168.1.11 port 22 (tcp) failed: No route to host
curl: (7) Failed to connect to 192.168.1.11 port 8006

Codex does not request the required Local Network permission or explain that macOS privacy settings may be blocking the connection.

The task reports network access as enabled:

CODEX_SANDBOX=seatbelt
CODEX_PERMISSION_PROFILE=lab

Persisted task metadata also reports:

"network": "enabled"

Manually enabling ChatGPT under:

System Settings → Privacy & Security → Local Network

immediately restores connectivity from the same Codex Desktop task:

192.168.1.11: ICMP succeeds
192.168.1.11:22: TCP connection succeeds
192.168.1.11:8006: HTTP 401, confirming API connectivity

The actionable Desktop issue is the missing permission request and diagnostic guidance. Users can enable sandbox network access while LAN traffic remains blocked by a separate macOS permission that Codex does not surface.

What steps can reproduce the bug?

1. On macOS, ensure ChatGPT is disabled under:

System Settings → Privacy & Security → Local Network

1. Create a Codex Desktop task with sandbox network access enabled.

1. Attempt to connect to a reachable LAN host:

nc -vz -w 3 192.168.1.11 22

curl -kS --connect-timeout 3 --max-time 5 \
  -o /dev/null -w 'HTTPS status: %{http_code}\n' \
  https://192.168.1.11:8006/api2/json/version

1. Observe that the connection fails with No route to host or an equivalent generic connection error.

1. Observe that Codex does not display a Local Network permission request or guidance about the relevant macOS setting.

1. Enable ChatGPT under:

System Settings → Privacy & Security → Local Network

1. Repeat the commands. Connectivity now succeeds without changing the Codex sandbox permission profile.

What is the expected behavior?

When a user enables network access for a Codex Desktop sandbox, the application should handle the separate macOS Local Network permission when LAN access is required.

At the latest on the first LAN connection attempt, the application should:

1. Trigger the applicable macOS Local Network permission request if possible.
2. If permission is missing or denied, report a clear diagnostic instead of only No route to host.
3. Direct the user to:

System Settings → Privacy & Security → Local Network → ChatGPT

The task UI should also distinguish between Codex sandbox network access and the operating system's Local Network permission.

Additional information

This was identified while investigating #36891.

Relevant observations:

• Packet capture showed no packets leaving the Mac for the blocked destination, indicating local rejection.
• Running the Codex runtimes explicitly under codex sandbox from Terminal could reach the destination.
• Enabling the Local Network toggle for the parent ChatGPT application immediately fixed Codex Desktop connectivity.
• The ChatGPT application's Info.plist did not appear to contain NSLocalNetworkUsageDescription.
• While permission was disabled, some other hosts on the same subnet remained reachable. This may be macOS caching or state behavior and is not the main subject of this report.
• Feedback/session ID: 019f6017-1596-7370-bfac-e259a1514700