Document Codex gh auth retry

[lewtun]

Summary

• document that sandboxed Codex gh auth checks can falsely report a valid keyring login as invalid when GitHub network access is restricted
• tell future agents to retry with GH_TOKEN and GITHUB_TOKEN unset and GitHub network access enabled before asking the user to re-authenticate

Checks

• uv run --frozen --extra dev ruff check .
• uv run --frozen --extra dev ruff format --check .

[github-actions]

Claude finished @lewtun's task in 32s —— View job

---

Review

LGTM

Single-line documentation addition to AGENTS.md:32, under the GitHub CLI section. No code, routing, auth-logic, or test surface is touched — nothing for ruff or the focus areas (correctness/security/LiteLLM routing/agent loop) to catch.

The new guidance reads cleanly and complements the adjacent line:

• AGENTS.md:31 already tells agents to retry with GH_TOKEN/GITHUB_TOKEN unset on auth failures.
• AGENTS.md:32 (new) extends that to the Codex sandbox case — a valid keyring login can be misreported as invalid when GitHub network access is restricted, so retry with both env tokens unset and network access enabled before asking the user to re-authenticate.

Accurate, well-scoped, and consistent with the surrounding style. No blocking issues and nothing worth holding the merge for.

• Reviewed diff against main
• Verified surrounding context in AGENTS.md