macOS: Annotation mode does not activate on localhost pages

What version of the Codex App are you using?

ChatGPT/Codex Desktop 26.810.52044 (build 6662).

What subscription do you have?

ChatGPT-authenticated desktop session. Plan omitted from this public report.

What platform is your computer?

macOS 26.2 (build 25C56), Apple Silicon (arm64).

What issue are you seeing?

On an ordinary server-rendered local development page, clicking Annotate changes the desktop control to Annotating, but the page never enters a usable annotation state. Clicking or dragging over visible headings and content does not select an element or region, place a marker, or open the comment editor.

Annotation works normally on a public HTTPS page in the same in-app browser session, so the feature itself is available. The local page remains browsable and interactive outside Annotation mode.

This conflicts with the documented workflow, which explicitly supports opening and annotating a local development route:

https://help.openai.com/en/articles/20001277-using-the-built-in-browser-in-the-chatgpt-desktop-app

What steps can reproduce the bug?

1. Start a basic local Flask or static HTTP server.
2. Open an ordinary DOM page at http://localhost:<port>/ in the ChatGPT/Codex built-in browser.
3. Click Annotate.
4. Click a visible heading or drag over a visible content area.
5. Observe that no selection, marker, or comment editor appears.
6. In the same browser session, open an ordinary public HTTPS page and repeat the flow.
7. Observe that annotation works on the public page.

The same local failure was reproduced with both localhost and 127.0.0.1.

Expected behavior

After Annotation mode is enabled, the local page should expose the element/region targeting layer, allow the user to place a marker, and open the comment editor.

Actual behavior

The desktop control says Annotating, but clicks and drags on the page produce no annotation UI and no comment.

Diagnostics and controls

Read-only inspection of the failing page showed:

• #codex-browser-sidebar-comments-root is injected and has an open shadow root.
• In the failed state, the shadow root contains neither an annotation interaction layer nor an interaction blocker.
• The injected root remains pointer-events: none.
• The page has no iframe, full-page pointer overlay, selectstart prevention, or user-select: none rule.
• Text selection is normal outside Annotation mode.
• The page console has no errors.
• The local route returns HTTP 200 and remains healthy.
• Temporarily relaxing the page's CSP and changing Cross-Origin-Resource-Policy did not change the behavior; those changes were reverted.
• Switching from 127.0.0.1 to localhost did not change the behavior.
• Testing on a clean origin with normal device-pixel ratio/zoom did not change the behavior.
• The same app/browser session successfully annotated a public HTTPS site.

The failing local page is ordinary semantic HTML generated by Flask/Jinja; it is not a canvas application and does not replace the document root.

Additional information

Possibly related but not a duplicate:

• #36222 reports an invisible replacement cursor on a localhost canvas app. In this case, the annotation interaction layer itself does not appear on a normal DOM page, and no marker/editor can be created.

No application data, credentials, private logs, or screenshots are attached.