gh auth returns invalid token in sandbox

What version of Codex CLI is running?

latest

What subscription do you have?

Pro

Which model were you using?

5.6 Terra

What platform is your computer?

Darwin 25.5.0 arm64 arm

What terminal emulator and version are you using (if applicable)?

_No response_

Codex doctor report

What issue are you seeing?

gh auth status reports the active GitHub token as invalid, then API calls fail with error connecting to api.github.com. This prevents repository creation and other GitHub CLI actions from within the sandbox.

Token is confirmed as valid.

What steps can reproduce the bug?

1. Open Codex Desktop with an existing gh login.
2. Run GitHub CLI commands through the sandboxed terminal:

gh auth status
gh api user --jq .login

1. Observe that gh reports the active token as invalid and cannot connect to api.github.com.

Observed output:

github.com
  X Failed to log in to github.com account lambegraham (default)
  - Active account: true
  - The token in default is invalid.

error connecting to api.github.com

What is the expected behavior?

Sandboxed gh commands should either:

• access the existing GitHub authentication and reach api.github.com; or
• clearly state that sandboxing blocks Keychain/network access, rather than reporting the token itself as invalid.

Additional information

• Codex CLI version: 0.142.5
• The error mixes an apparent authentication failure with a network-connection failure, so it is unclear whether the sandbox cannot access the GitHub token, cannot reach GitHub, or both.
• As a workaround, GitHub CLI commands must be run outside the sandbox.