[Bug] macOS tool shell cannot access gh Keychain credential

Description

Description

On macOS, the same user and /opt/homebrew/bin/gh behave differently depending on whether the command runs in an interactive terminal or inside the OpenCode tool/agent shell.

The interactive terminal can complete gh auth login --web and reports:

Logged in to github.com account ... (keyring)
Token scopes: gist, read:org, repo, workflow

Inside the OpenCode tool shell, without GH_TOKEN, GITHUB_TOKEN, or GH_CONFIG_DIR overrides:

gh auth status → The token in default is invalid
gh auth token → empty
gh api user → HTTP 401 Requires authentication

The Keychain item gh:github.com exists for the same macOS user, but the OpenCode tool shell cannot read its secret. This makes GitHub CLI operations fail from OpenCode even after successful interactive re-authentication.

No token value or secret was exposed.

Expected behavior

Either:

1. OpenCode tool subprocesses inherit the credential access context required by gh/macOS Keychain; or
2. OpenCode documents the isolation and exposes a clear diagnostic explaining that host Keychain-backed CLI credentials are unavailable.

A tool shell should not report a stale/invalid token when the user has just successfully authenticated interactively, unless the shell is intentionally isolated.

Additional context

This is not a GitHub repository permission issue. The failure occurs before repository access: gh api user returns 401 from the OpenCode tool shell, while interactive gh auth status reports a valid keyring login.

Plugins

Default tools only; no third-party plugin involved

OpenCode version

OpenCode version not captured; current macOS installation

Steps to reproduce

1. On macOS, authenticate GitHub CLI interactively: gh auth login -h github.com --git-protocol https --web.
2. Confirm interactive gh auth status reports a keyring login.
3. From an OpenCode tool/agent shell running as the same user, execute /opt/homebrew/bin/gh auth status --hostname github.com.
4. Execute /opt/homebrew/bin/gh auth token --hostname github.com and /opt/homebrew/bin/gh api user.
5. Observe that the tool shell reports an invalid token, returns an empty token, and receives HTTP 401, despite the interactive terminal login.

Environment checks showed no GH_TOKEN, GITHUB_TOKEN, GH_HOST, or GH_CONFIG_DIR overrides.

Screenshot and/or share link

No response

Operating System

macOS (Apple Silicon; exact macOS version not captured)

Terminal

zsh / OpenCode tool shell