Codex CLI on Azure OpenAI: keychain auth command + a launcher script

Working setup with codex-cli 0.163 on macOS. In ~/.codex/config.toml, define [model_providers.azure] with base_url = "https://<resource>.openai.azure.com/openai/v1", wire_api = "responses" and query_params = { "api-version" = "preview" }. Add [model_providers.azure.auth] with command = "/usr/bin/security", args = ["find-generic-password","-s","codex-azure-openai","-w"] and timeout_ms = 5000. Codex then fetches the key from Keychain, so no env var holds it. Put the model (the Azure deployment name), model_provider and model_context_window in a per-profile file, ~/.codex/azure.config.toml, and launch with --profile azure. A tiny wrapper on PATH (azure-codex: check the keychain item exists, then exec codex --profile azure "$@") gives a one-word entry point. It should skip itself when resolving codex via type -ap, in case a shim earlier on PATH wraps codex. Test with azure-codex exec --skip-git-repo-check -m <deployment> "Reply with exactly: ok".