Windows: Feishu CLI credentials work in PowerShell but are unavailable in Codex App sandbox

What version of the Codex App are you using (From “About Codex” dialog)?

Unknown — Windows desktop app; feedback ID: 01a066f0-729c-7623-82c4-c624c15d9f5d

What subscription do you have?

Plus

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

Feishu CLI (lark-cli) authentication works in normal PowerShell, but is unavailable when invoked by the Codex desktop app.

In normal PowerShell, lark-cli.cmd auth status --json --verify reports:

• identity: user
• tokenStatus: valid
• verified: true

Inside Codex, whoami reports a dedicated Windows account named codexsandboxoffline. The same CLI reports:

• identity: none
• user status: missing
• error: no token in keychain

Both environments use the same Feishu appId. Invoking the underlying CLI executable directly and using the same working directory did not resolve the issue. Fully restarting Codex also did not help.

This workflow previously worked, but stopped working approximately two days before this report. The triggering change is unknown.

Suspected cause: Windows sandbox account isolation prevents access to the normal user's OS credential store. This has not been conclusively confirmed.

Expected behavior: a supported way to use authenticated Feishu CLI operations while preserving sandbox protection and encrypted credential storage.

Feedback ID: 01a066f0-729c-7623-82c4-c624c15d9f5d

What steps can reproduce the bug?

1. On Windows, configure Feishu CLI (lark-cli) and complete user authorization in normal PowerShell.

2. In normal PowerShell, run:
   lark-cli.cmd auth status --json --verify

   Confirm that it reports identity=user, tokenStatus=valid, and verified=true.

3. In the Codex desktop app, ask the agent to run:
   whoami
   lark-cli.cmd auth status --json

4. Observe that whoami reports codexsandboxoffline, while Feishu CLI reports identity=none and user status=missing, with "no token in keychain".

5. Confirm that both environments report the same Feishu appId.

6. Fully restart Codex and repeat step 3. The problem persists.

Feedback/session ID:
01a066f0-729c-7623-82c4-c624c15d9f5d

What is the expected behavior?

Codex should provide a supported way to run authenticated Feishu CLI commands while preserving Windows sandbox protection and secure credential storage.

If the sandbox cannot access the required credentials, it should clearly explain the limitation and provide actionable setup guidance instead of repeatedly prompting for authorization.

Additional information

Possibly related to #24204, but this report concerns Windows and the codexsandboxoffline account rather than macOS Keychain.

Start by reproducing the Windows account difference with whoami and lark-cli.cmd auth status --json --verify in PowerShell and the Codex desktop app. Investigate how the codexsandboxoffline account reaches the encrypted credential store while preserving sandbox protection. Done means authenticated Feishu CLI operations work through a supported setup, or the limitation is clearly explained with actionable guidance.