[macOS] In-app browser blocks Okta FastPass local-network verification

Environment

• Codex Desktop: 26.803.61601 (build 6396)
• Bundle ID: com.openai.codex
• macOS: 26.6.1 (25G76)
• Authentication provider: Okta FastPass / Okta Verify

Issue

An enterprise application opened in the Codex in-app browser redirects to Okta SSO. Okta FastPass then fails with:

Okta FastPass requires network permission The browser is blocking communication with Okta Verify.

The Okta page instructs the user to enable "Local network access" or "Apps on device" in browser site settings, but the Codex in-app browser exposes no corresponding setting. Trying the alternate verification methods available in the flow also does not complete sign-in, leaving the user at an authentication dead end.

Steps to reproduce

1. Open an enterprise web application requiring Okta SSO in the Codex in-app browser.
2. Continue through the SAML redirect to Okta.
3. Attempt Okta FastPass / Okta Verify.
4. Observe the local-network permission error.
5. Look for a local-network or apps-on-device permission in the in-app browser.
6. Try the alternate verification methods presented by Okta.

Actual behavior

• Okta Verify cannot communicate with the in-app browser.
• Codex does not prompt for macOS Local Network permission.
• Codex is not available as a configurable site/browser local-network permission.
• The alternate verification paths do not restore access.
• The authenticated application cannot be used or tested inside Codex.

Expected behavior

One of the following should happen:

• The Codex in-app browser supports the browser local-network permission required by Okta FastPass and prompts the user appropriately.
• Codex exposes a site setting for local-network/apps-on-device access.
• Codex hands enterprise SSO off to the system browser and returns the authenticated session to the in-app browser.
• A supported authentication fallback remains available when the embedded browser cannot provide the required capability.

Diagnostic observation

The installed app's Info.plist does not contain NSLocalNetworkUsageDescription:

Print: Entry, ":NSLocalNetworkUsageDescription", Does Not Exist

This appears related to #28024, which reports the same missing macOS local-network declaration for a different Codex feature. This report concerns enterprise SSO inside the in-app browser rather than remote-control enrollment.

Impact

Enterprise users whose organizations require Okta FastPass cannot authenticate to internal web applications inside the Codex browser, preventing end-to-end testing of authenticated applications and workflows.