On macOS 26.6.2 (build 25G83), arm64, I am using the Security framework through JXA, executed by a static /usr/bin/osascript helper launched from the Codex desktop application's local command environment.
A dummy-only test attempts to add one generic-password item to the local file-based login keychain. SecItemAdd returns OSStatus 100001. The system's "security error 100001" command describes this as "UNIX[Operation not permitted]".
The helper explicitly opens the login keychain and selects it using kSecUseKeychain for the add operation. Synchronizable and Data Protection Keychain options are false. It supplies an access object created by SecAccessCreate with an empty trusted-application array.
What I have confirmed:
- Keychain open/status calls succeed and report unlocked, readable, and writable. I understand these flags do not establish permission for this individual operation.
- Attribute-only exact lookups report the dummy item as not found before and after each failed add.
- Granting narrowly scoped filesystem write permission for the login keychain file through the launching tool did not resolve the failure.
- I have not performed a comparison outside that restricted execution environment. I have not established whether the cause is the environment, API/ACL configuration, or an OS issue.
Is this JXA/Security usage supported for a file-based keychain? Which documented diagnostics can distinguish process/sandbox restrictions from item ACL or authentication requirements? Are there relevant constraints on this query/access-object construction?
I am seeking a supported implementation, not a way to disable or bypass security protections. I can provide a dummy-only reproducer without credentials or personal paths.