Sites publishing from Codex blocked by credential handoff — supported route needed

[DriesDeSchepper]

The bundled Sites publishing workflow on macOS requires a short-lived write credential handoff that managed Auto-review rejects before the Git push starts. Hidden terminal input does not resolve the tool-argument exposure concern.

Existing technical report:
#52801 (comment)

OpenAI Help Center confirmed escalation to a human support specialist on 11 October. No supported resolution has yet been confirmed.

Is there an officially supported secure credential transport, or a way to route this compatibility issue to the responsible team? I am not seeking a security bypass or weaker approval checks.

[bomtobe-hgkim]

I can’t confirm an official route, so I wouldn’t want to imply one. As a product-design thought, could an OS-backed credential broker grant a short-lived handle scoped to one repo and action, while leaving the existing review gate intact? An audit message that distinguishes broker rejection from git-push rejection could also make the failure easier to diagnose. I work on orke at BOMTOBE; this isn’t an official Codex answer.