Guide Codex through sandboxed Keychain auth

[robzolkos]

What changed

• teach the HEY skill to distinguish a macOS Codex sandbox from a missing login
• require a user-approved, read-only authentication probe before any command retry
• limit the retry to the exact HEY command the user requested
• forbid direct Keychain reads, credential copying, file fallback, and global sandbox disablement
• test the security boundaries in the embedded skill

Validation

• make test
• make lint
• make build

Closes #433

---

Summary by cubic

Guides the HEY skill through macOS Codex Keychain sandbox issues so auth failures no longer get misreported as blocked tasks when the sandbox hides stored credentials.

• Retries hey auth status --json once with user-approved elevated sandbox permission before reporting a task blocked; if it confirms credentials are available, reruns only the exact hey command the user requested.
• Escalation is limited to that read-only probe; it never reads Keychain contents directly, copies or moves credentials, disables the sandbox globally, or sets HEY_NO_KEYRING=1.
• Added embedded skill tests enforcing these security boundaries.

Closes #433.

^{Written for commit bd93cff. Summary will update on new commits.}

[Copilot]

Copilot review overview

🟡 Changes recommended

The guidance mishandles the successful authenticated: false response, and some credential boundaries are not independently regression-tested.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Handle unauthenticated auth status explicitly · New
• Test credential-handling security clauses independently · New

What changed in this PR

Updates the embedded HEY skill to recover safely from macOS Codex sandbox restrictions on Keychain access.

Changes:

• Adds an approved, narrowly scoped authentication probe and command retry.
• Documents prohibited credential and sandbox workarounds.
• Adds regression checks for the new guidance.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
skills/​hey/​SKILL.md	Documents sandbox-aware authentication recovery.
skills/​embed_test.go	Verifies embedded security guidance.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[cursor]

Approved. Cursor Security Agent completed successfully with no findings requiring human review; Cursor Bugbot was not running so that signal was skipped. No reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Approver}

[Copilot]

Copilot review overview

🟢 Approved

The guidance addresses the reported sandbox behavior while preserving explicit least-privilege boundaries and regression coverage.

Review effort: Balanced
Findings: None

Resolved since last review (2)

• Handle unauthenticated auth status explicitly
• Test credential-handling security clauses independently