Feature request: optional Touch ID authentication gate for Codex CLI on macOS

Summary

Please add an optional macOS authentication gate for Codex CLI so the app can require Touch ID (or the system password fallback) before a user can open or resume an interactive Codex session.

Problem

Today, if someone gets access to an already unlocked Mac, they can typically open and use Codex CLI immediately as long as the local login state is still available.

For users who want stronger local protection, the current choice is mostly:

• add more friction to the whole machine/session, or
• accept that Codex is immediately usable once the Mac is unlocked

There is currently no Codex-specific, low-friction protection layer that uses the native macOS biometric flow.

Proposed behavior

Add an optional setting for macOS such as:

• Require Touch ID before starting Codex CLI
• Require Touch ID before resuming a saved session
• fallback to system password when Touch ID is unavailable

This should be:

• off by default
• local-only
• implemented with native macOS auth APIs

Why this matters

• It protects the Codex session without requiring users to change their whole machine workflow.
• It is a good fit for users who want stronger protection but do not want extra complexity every time they unlock the Mac itself.
• It reduces the risk of someone using Codex opportunistically on an already unlocked machine.

Scope suggestions

• macOS first is fine
• CLI first is enough
• even a best-effort lock on app start / session resume would already help

Nice-to-have

• auto-lock Codex again after some idle time
• lock before executing privileged or networked actions
• a config flag in ~/.codex/config.toml

Thanks.