From 720b9dd11699c1a101db5a43c07e01fa62e26f2a Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Mon, 12 Jan 2026 00:32:40 +0000
Subject: [PATCH] fix: make codex keychain platform-aware

---
 src/agents/cli-credentials.test.ts |  2 +-
 src/agents/cli-credentials.ts      | 20 ++++++++++++++------
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/src/agents/cli-credentials.test.ts b/src/agents/cli-credentials.test.ts
index a52c74d29..2ad424ba2 100644
--- a/src/agents/cli-credentials.test.ts
+++ b/src/agents/cli-credentials.test.ts
@@ -206,7 +206,7 @@ describe("cli credentials", () => {
     });
 
     const { readCodexCliCredentials } = await import("./cli-credentials.js");
-    const creds = readCodexCliCredentials();
+    const creds = readCodexCliCredentials({ platform: "darwin" });
 
     expect(creds).toMatchObject({
       access: "keychain-access",
diff --git a/src/agents/cli-credentials.ts b/src/agents/cli-credentials.ts
index 8d8584817..2178d6b0a 100644
--- a/src/agents/cli-credentials.ts
+++ b/src/agents/cli-credentials.ts
@@ -88,8 +88,11 @@ function computeCodexKeychainAccount(codexHome: string) {
   return `cli|${hash.slice(0, 16)}`;
 }
 
-function readCodexKeychainCredentials(): CodexCliCredential | null {
-  if (process.platform !== "darwin") return null;
+function readCodexKeychainCredentials(options?: {
+  platform?: NodeJS.Platform;
+}): CodexCliCredential | null {
+  const platform = options?.platform ?? process.platform;
+  if (platform !== "darwin") return null;
 
   const codexHome = resolveCodexHomePath();
   const account = computeCodexKeychainAccount(codexHome);
@@ -353,8 +356,12 @@ export function writeClaudeCliCredentials(
   return writeFile(newCredentials, { homeDir: options?.homeDir });
 }
 
-export function readCodexCliCredentials(): CodexCliCredential | null {
-  const keychain = readCodexKeychainCredentials();
+export function readCodexCliCredentials(options?: {
+  platform?: NodeJS.Platform;
+}): CodexCliCredential | null {
+  const keychain = readCodexKeychainCredentials({
+    platform: options?.platform,
+  });
   if (keychain) return keychain;
 
   const authPath = resolveCodexCliAuthPath();
@@ -390,10 +397,11 @@ export function readCodexCliCredentials(): CodexCliCredential | null {
 
 export function readCodexCliCredentialsCached(options?: {
   ttlMs?: number;
+  platform?: NodeJS.Platform;
 }): CodexCliCredential | null {
   const ttlMs = options?.ttlMs ?? 0;
   const now = Date.now();
-  const cacheKey = resolveCodexCliAuthPath();
+  const cacheKey = `${options?.platform ?? process.platform}|${resolveCodexCliAuthPath()}`;
   if (
     ttlMs > 0 &&
     codexCliCache &&
@@ -402,7 +410,7 @@ export function readCodexCliCredentialsCached(options?: {
   ) {
     return codexCliCache.value;
   }
-  const value = readCodexCliCredentials();
+  const value = readCodexCliCredentials({ platform: options?.platform });
   if (ttlMs > 0) {
     codexCliCache = { value, readAt: now, cacheKey };
   }