[macOS][OpenAI Developers] expired Platform connection leaves API-key setup without a working reauth path

What version of the Codex App are you using (From “About Codex” dialog)?

ChatGPT/Codex desktop app 26.825.51511 (build 7377). The separately installed Homebrew Codex CLI was 0.136.0.

What subscription do you have?

Personal workspace; exact subscription tier omitted.

What platform is your computer?

Darwin 25.4.0 arm64 arm

What issue are you seeing?

Secure OpenAI Platform API-key setup through the OpenAI Developers plugin becomes a dead end when the connector authorization has expired:

1. The secure key picker initially returned without displaying any UI or error.
2. Retrying returned: This app connection requires reauthentication before other actions on this app can succeed. The structured reason was oauth_token_endpoint_unauthorized / Reauthentication required.
3. No actionable reconnect control appeared.
4. Recovery guidance referenced /apps and a $ app picker. In the current desktop UI, /apps is treated as ordinary composer text, and the shown composer has a + control rather than a $ app picker. There was no discoverable OpenAI Developers reconnect path.

This blocked a simple task: create a named development API key securely and configure a development environment. No key was created and no secret is included here.

What steps can reproduce the bug?

1. Open Codex Desktop on macOS with OpenAI Developers installed and an expired OpenAI Platform connector authorization.
2. Invoke the plugin's secure Codex API-key target-selection flow.
3. Observe that the first attempt may return with no visible picker or error.
4. Retry the flow.
5. Observe the reauthentication-required error without a working reauthentication action.
6. Try the documented/recommended /apps route in the desktop composer; it is treated as ordinary message text.
7. Look for the $ app picker; the current UI does not expose one.

What is the expected behavior?

The reauthentication error should surface a working Reconnect OpenAI Developers action. After successful authorization, Codex should automatically resume the interrupted key picker. App/connector management should have one consistent, discoverable path whose labels match the current desktop UI.

Additional information

The built-in /feedback flow recorded this report without diagnostic logs and returned thread ID 01a0609a-8383-7232-8af1-ecee1a793746, but still required manually opening a GitHub issue.

Related: #34787 reports a Windows-specific OpenAI Platform OAuth/key-setup loop. This report is macOS and focuses on the missing recovery control plus UI/documentation mismatch.

A separate follow-on occurred while trying an obvious terminal recovery: codex login does not repair plugin authorization, and macOS displayed “Malware Blocked and Moved to Trash” for the installed Codex CLI 0.136.0. Read-only inspection showed that Homebrew considered it outdated and that the remaining executable had a valid Developer ID signature from OpenAI OpCo, LLC (2DC432GLL2). No Gatekeeper/XProtect bypass was attempted. This may be unrelated, but it made the recovery experience materially worse and deserves triage.

Start by reproducing the expired OpenAI Developers connector flow in Codex Desktop on macOS, focusing on the secure API-key picker and the current /apps and $ entry points. Trace the reauthentication error path and compare it with the desktop UI labels; done means a visible reconnect action resumes the interrupted picker after authorization.