macOS: opt-in to store OAuth (subscription) credentials in the file store to stop repeated Keychain permission dialogs on token refresh

What's the problem?

On macOS, Claude Code (subscription / OAuth login) stores its credentials in the login Keychain as a generic-password item labeled Claude Code-credentials. Every time the OAuth token is refreshed, the Keychain item is rewritten, which resets the item's ACL (the "Always Allow" list). The next access then triggers the macOS permission dialog ("… wants to use the confidential information stored in Claude Code-credentials in your keychain"). Clicking "Always Allow" does not persist, because the next refresh rewrites the item and clears the ACL again.

Net effect: subscription users on macOS desktop are interrupted by a Keychain permission dialog on every token refresh, indefinitely.

Environment

• Claude Code 2.1.278
• macOS (Darwin 25.3.0)
• Auth: Claude subscription via OAuth login (not API key)

What I found looking for a fix

• There is no setting / env var / flag that makes Claude Code store the OAuth token in the file store (~/.claude/.credentials.json) while the Keychain is available. CLAUDE_CONFIG_DIR only changes where files live, not whether the Keychain is used.
• The file-store fallback exists but only triggers automatically when the Keychain rejects the write (e.g. headless / SSH). There is no documented, supported way to opt into it on a normal desktop.
• The only documented dialog-free routes — ANTHROPIC_API_KEY and apiKeyHelper — change the billing model to per-token API usage, which is not acceptable for subscription users.
• /logout (the only path that rewrites credential storage) is destructive: it clears the Keychain item, the plaintext file, saved MCP logins and plugin secrets.
• Persisting the Keychain "Always Allow" ACL across rewrites is a macOS limitation and not achievable from Claude Code.

Feature request

Please provide one of the following for subscription / OAuth users on macOS:

1. A documented opt-in setting (a settings.json key or env var, e.g. CLAUDE_CODE_USE_KEYCHAIN=false or "credentialStore": "file") to store the OAuth token in ~/.claude/.credentials.json (mode 0600) even when the Keychain is available.
2. A supported migration path from Keychain to file store that keeps the user logged in (no destructive /logout).
3. Any mechanism that survives token refresh without re-prompting (e.g. re-applying the ACL non-interactively after a rewrite).

Why it matters

For macOS desktop users on a subscription, the current behavior is a recurring, unavoidable permission dialog on every token refresh — and the only workarounds force a switch to API billing. An opt-in file store (already used as the SSH / headless fallback) would resolve this without any billing change.