From 914bb8e55e444476955ff193d59ffd95dad39dea Mon Sep 17 00:00:00 2001
From: Merge Sim <sim@local>
Date: Tue, 1 Sep 2026 13:54:11 -0700
Subject: [PATCH] test: pin Claude scoped keychain path hashing

---
 src/main/claude-accounts/keychain.test.ts | 7 +++++++
 src/main/claude-accounts/keychain.ts      | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/main/claude-accounts/keychain.test.ts b/src/main/claude-accounts/keychain.test.ts
index a5243f56b68..a2898d17d6e 100644
--- a/src/main/claude-accounts/keychain.test.ts
+++ b/src/main/claude-accounts/keychain.test.ts
@@ -3,6 +3,7 @@ import { execFile } from 'node:child_process'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   deleteActiveClaudeKeychainCredentials,
+  getActiveClaudeService,
   readActiveClaudeKeychainCredentials,
   readActiveClaudeKeychainCredentialsStrict,
   writeActiveClaudeKeychainCredentials,
@@ -121,6 +122,12 @@ describe('Claude Keychain credentials', () => {
     ])
   })
 
+  it('derives the scoped service from the exact absolute config path', () => {
+    const configDir = '/private/var/folders/orca/claude-accounts/account-a/auth'
+
+    expect(getActiveClaudeService(configDir)).toBe(serviceForConfigDir(configDir))
+  })
+
   it('writes runtime credentials to scoped and legacy services for pre-2.1 CLIs', async () => {
     const configDir = '/tmp/orca-claude-login-test'
     const scopedService = serviceForConfigDir(configDir)
diff --git a/src/main/claude-accounts/keychain.ts b/src/main/claude-accounts/keychain.ts
index 20184571291..6584efd5e42 100644
--- a/src/main/claude-accounts/keychain.ts
+++ b/src/main/claude-accounts/keychain.ts
@@ -100,7 +100,7 @@ function getKeychainUser(): string {
   return process.env.USER || process.env.USERNAME || 'user'
 }
 
-function getActiveClaudeService(configDir?: string): string {
+export function getActiveClaudeService(configDir?: string): string {
   if (!configDir) {
     return ACTIVE_CLAUDE_SERVICE
   }