From 739e906080a0dafee82f3f131eefc387667292d9 Mon Sep 17 00:00:00 2001 From: Anton Volnuhin Date: Thu, 6 Aug 2026 01:23:07 +0300 Subject: [PATCH] fish: only read the keychain PAT on systems that have `security` MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The bare command substitution ran on every shell start regardless of platform, so Linux/WSL printed "fish: Unknown command: security" at login — the 2>/dev/null only redirects the command's own stderr, not fish's command-not-found diagnostic. Guard with `type -q security`, matching conf.d/codex-github-mcp.fish, and skip the export when the lookup returns nothing so a missing keychain item no longer exports an empty GITHUB_PERSONAL_ACCESS_TOKEN. --- private_dot_config/private_fish/config.fish | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/private_dot_config/private_fish/config.fish b/private_dot_config/private_fish/config.fish index d0f5a51..8779760 100644 --- a/private_dot_config/private_fish/config.fish +++ b/private_dot_config/private_fish/config.fish @@ -275,7 +275,11 @@ fish_add_path $HOME/.antigravity/antigravity/bin source ~/.orbstack/shell/init2.fish 2>/dev/null || : # GitHub MCP plugin auth — pull PAT from keychain (avoids plaintext in config files) -set -gx GITHUB_PERSONAL_ACCESS_TOKEN (security find-generic-password -s codex-github-mcp-pat -w 2>/dev/null) +if type -q security + set -l github_pat (security find-generic-password -s codex-github-mcp-pat -w 2>/dev/null) + test -n "$github_pat" + and set -gx GITHUB_PERSONAL_ACCESS_TOKEN "$github_pat" +end # >>> grok installer >>>