GitHub CLI authentication

A failed gh auth status inside a restricted sandbox is not proof that the GitHub login is invalid. The sandbox can lack macOS Keychain access or network access while the host login remains valid.

Use the authoritative check

When a sandboxed command reports a missing token, invalid token, or connection failure, rerun these read-only commands with approved elevated access:

gh auth status -h github.com
gh api user --jq .login

Request a new login only when the elevated command returns an actual authentication error.

Do not create a token workaround

Never copy the GitHub token into GH_TOKEN, GITHUB_TOKEN, a file, repository secret, or command log to bypass Keychain access. For normal GitHub work, request narrowly scoped elevated execution for the required gh api, gh pr, or gh run command when sandbox access fails.

Keep this machine-specific rule in the user's global Codex AGENTS.md. Do not duplicate it across project repositories.