@@ -243,7 +243,7 @@ describe("external cli oauth resolution", () => {
243243expect(credential).toBeNull();
244244});
245245246-it("bootstraps the default codex profile from Codex CLI credentials when missing locally", () => {
246+it("bootstraps the default codex profile from Codex CLI credentials when in scope", () => {
247247mocks.readCodexCliCredentialsCached.mockReturnValue(
248248makeOAuthCredential({
249249provider: "openai-codex",
@@ -254,7 +254,9 @@ describe("external cli oauth resolution", () => {
254254}),
255255);
256256257-const profiles = resolveExternalCliAuthProfiles(makeStore());
257+const profiles = resolveExternalCliAuthProfiles(makeStore(), {
258+providerIds: ["openai-codex"],
259+});
258260259261expect(profiles).toEqual([
260262{
@@ -318,7 +320,9 @@ describe("external cli oauth resolution", () => {
318320expires: Date.now() + 5 * 24 * 60 * 60_000,
319321});
320322321-const profiles = resolveExternalCliAuthProfiles(makeStore());
323+const profiles = resolveExternalCliAuthProfiles(makeStore(), {
324+providerIds: ["claude-cli"],
325+});
322326323327expect(profiles).toEqual([
324328{
@@ -344,6 +348,51 @@ describe("external cli oauth resolution", () => {
344348expect(mocks.readMiniMaxCliCredentialsCached).not.toHaveBeenCalled();
345349});
346350351+it("does not scan missing external CLI profiles without an explicit scope", () => {
352+mocks.readClaudeCliCredentialsCached.mockReturnValue({
353+type: "oauth",
354+provider: "anthropic",
355+access: "claude-cli-access",
356+refresh: "claude-cli-refresh",
357+expires: Date.now() + 5 * 24 * 60 * 60_000,
358+});
359+360+const profiles = resolveExternalCliAuthProfiles(makeStore());
361+362+expect(profiles).toEqual([]);
363+expect(mocks.readClaudeCliCredentialsCached).not.toHaveBeenCalled();
364+});
365+366+it("refreshes a stored external CLI profile without an explicit scope", () => {
367+mocks.readClaudeCliCredentialsCached.mockReturnValue({
368+type: "oauth",
369+provider: "anthropic",
370+access: "claude-cli-fresh-access",
371+refresh: "claude-cli-fresh-refresh",
372+expires: Date.now() + 5 * 24 * 60 * 60_000,
373+});
374+375+const profiles = resolveExternalCliAuthProfiles(
376+makeStore(CLAUDE_CLI_PROFILE_ID, {
377+type: "oauth",
378+provider: "claude-cli",
379+access: "claude-cli-stale-access",
380+refresh: "claude-cli-stale-refresh",
381+expires: Date.now() - 5_000,
382+}),
383+);
384+385+expect(profiles).toEqual([
386+{
387+profileId: CLAUDE_CLI_PROFILE_ID,
388+credential: expect.objectContaining({
389+provider: "claude-cli",
390+access: "claude-cli-fresh-access",
391+}),
392+},
393+]);
394+});
395+347396it("passes non-prompting keychain policy to scoped Claude CLI credential reads", () => {
348397mocks.readClaudeCliCredentialsCached.mockReturnValue({
349398type: "oauth",
@@ -412,7 +461,9 @@ describe("external cli oauth resolution", () => {
412461expires: Date.now() + 5 * 24 * 60 * 60_000,
413462});
414463415-const profiles = resolveExternalCliAuthProfiles(makeStore());
464+const profiles = resolveExternalCliAuthProfiles(makeStore(), {
465+providerIds: ["claude-cli"],
466+});
416467417468expect(profiles).toEqual([]);
418469});
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。