feat(70): Windows/Linux use own OAuth storage, drop secret-tool detection

Make Claude Code auto-import macOS-only (Keychain). On Windows/Linux,
opencodex relies on its own OAuth flow (ocx login → ~/.opencodex/auth.json)
instead of platform credential managers. Platform-aware error messages.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: lidge-jun

src/oauth/anthropic.ts

@@ -135,7 +135,11 @@ export async function loginAnthropic(
         }
       }
     } else if (importLocal === "only") {
-      throw new Error("No Claude Code token found in the keychain. Run 'ocx login anthropic' for browser OAuth.");
+      throw new Error(
+        process.platform === "darwin"
+          ? "No Claude Code token found in the keychain. Run 'ocx login anthropic' for browser OAuth."
+          : "Claude Code auto-import is macOS-only. Run 'ocx login anthropic' for browser OAuth.",
+      );
     }
   }
   return new AnthropicOAuthFlow(ctrl).login();

src/oauth/local-token-detect.ts

@@ -38,20 +38,13 @@ export function detectGrokCliToken(): OAuthCredentials | null {
   }
 }
 
-/** Read the Claude Code OAuth credential from the OS secure store (macOS keychain / linux secret-tool). */
+/** Read the Claude Code OAuth credential from macOS Keychain. Windows/Linux: use `ocx login`. */
 function readClaudeSecureStorage(): string | null {
+  if (process.platform !== "darwin") return null;
   try {
-    if (process.platform === "darwin") {
-      return execSync(`security find-generic-password -s "${CLAUDE_KEYCHAIN_SERVICE}" -w`, {
-        encoding: "utf8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"],
-      }).trim();
-    }
-    if (process.platform === "linux") {
-      return execSync(`secret-tool lookup service "${CLAUDE_KEYCHAIN_SERVICE}"`, {
-        encoding: "utf8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"],
-      }).trim();
-    }
-    return null;
+    return execSync(`security find-generic-password -s "${CLAUDE_KEYCHAIN_SERVICE}" -w`, {
+      encoding: "utf8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"],
+    }).trim();
   } catch {
     return null;
   }