Prevent unexpected Claude Keychain prompts

[mstallone]

TL;DR

Keep Claude credential discovery and background refreshes prompt-free, with Keychain approval limited to manual refreshes.

What was happening

• Automatic credential reads and token updates could trigger password dialogs or select a lower-priority login.
• Denying one approval could lead to repeated or unrelated prompts.

What this changes

• Uses interaction-forbidden Security.framework access for automatic reads and updates, and fails closed when Claude Code Keychain state is unresolved.
• Validates first-run credentials and stops prompt handling after a denial.

Tests

• swift test
• ./script/build_and_run.sh verify

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 385899cefa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".