Support scoped credential-store writes for OAuth refresh by sandboxed CLIs

What variant of Codex are you using?

Codex App for macOS (codex-cli 0.153.4).

What feature would you like to see?

Support explicit, narrowly scoped OS credential-store writes for OAuth refresh by sandboxed CLI tools.

The sandbox can read an existing macOS Keychain credential but cannot update it. For CLIs using rotating OAuth refresh tokens, this can destroy an otherwise valid session:

1. The CLI reads the stored refresh token.
2. The OAuth server exchanges it and invalidates the old token.
3. Keychain persistence fails inside the Codex sandbox (exit status 161).
4. Subsequent commands fail with invalid_grant because only the invalidated token remains stored.

The same refresh and persistence operation succeeds outside the sandbox.

I would not want blanket Keychain write access. A safer capability could be host-mediated access scoped to an explicitly approved executable and Keychain service, or an approval flow that reruns the command outside the sandbox before it exchanges the token.

Additional information

This occurred with the Buildkite CLI running from the Codex agent harness. A direct /usr/bin/security add-generic-password probe inside the sandbox failed with UNIX[Operation not permitted]; the same harmless probe succeeded outside it.

Buildkite tracking and defensive CLI fix:

• https://github.com/buildkite/cli/issues/981
• https://github.com/buildkite/cli/pull/982

Related: https://github.com/openai/codex/issues/24204. That report concerns sandbox escalation timing out and preventing Keychain access entirely. In this case Keychain reads succeed, writes are denied, and explicit escalated execution succeeds.

Start by tracing how the Codex sandbox handles credential-store permissions and compare the behavior of /usr/bin/security inside and outside the sandbox. Review related issue #24204 alongside the Buildkite issue and pull request to understand existing escalation behavior. Done should provide narrowly scoped, approved Keychain writes for OAuth refresh without blanket access or session invalidation.