readMiniMaxCliCredentialsCached: vi.fn<(options?: unknown) => OAuthCredential | null>(() => null),

}));

let readManagedExternalCliCredential: typeof import("./auth-profiles/external-cli-sync.js").readManagedExternalCliCredential;

let readExternalCliBootstrapCredential: typeof import("./auth-profiles/external-cli-sync.js").readExternalCliBootstrapCredential;

let resolveExternalCliAuthProfiles: typeof import("./auth-profiles/external-cli-sync.js").resolveExternalCliAuthProfiles;

let hasUsableOAuthCredential: typeof import("./auth-profiles/external-cli-sync.js").hasUsableOAuthCredential;

let isSafeToUseExternalCliCredential: typeof import("./auth-profiles/external-cli-sync.js").isSafeToUseExternalCliCredential;

({

hasUsableOAuthCredential,

isSafeToUseExternalCliCredential,

readManagedExternalCliCredential,

readExternalCliBootstrapCredential,

resolveExternalCliAuthProfiles,

shouldBootstrapFromExternalCliCredential,

shouldReplaceStoredOAuthCredential,

}),

);

const credential = readManagedExternalCliCredential({

const credential = readExternalCliBootstrapCredential({

profileId: OPENAI_CODEX_DEFAULT_PROFILE_ID,

credential: makeOAuthCredential({ provider: "openai" }),

});

makeOAuthCredential({ provider: "openai" }),

);

const credential = readManagedExternalCliCredential({

const credential = readExternalCliBootstrapCredential({

profileId: OPENAI_CODEX_DEFAULT_PROFILE_ID,

credential: makeOAuthCredential({ provider: "anthropic" }),

});

import type { OAuthCredential } from "./types.js";

const mocks = vi.hoisted(() => ({

readManagedExternalCliCredential: vi.fn<() => OAuthCredential | null>(() => null),

readExternalCliBootstrapCredential: vi.fn<() => OAuthCredential | null>(() => null),

}));

vi.mock("./external-cli-sync.js", () => ({

readManagedExternalCliCredential: mocks.readManagedExternalCliCredential,

readExternalCliBootstrapCredential: mocks.readExternalCliBootstrapCredential,

}));

function makeCredential(overrides: Partial<OAuthCredential> = {}): OAuthCredential {

describe("resolveEffectiveOAuthCredential", () => {

beforeEach(() => {

mocks.readManagedExternalCliCredential.mockReset().mockReturnValue(null);

mocks.readExternalCliBootstrapCredential.mockReset().mockReturnValue(null);

});

it("uses external cli oauth only when local credentials are unusable and safe to bootstrap", () => {

refresh: "fresh-cli-refresh-token",

expires: Date.now() + 30 * 60_000,

});

mocks.readManagedExternalCliCredential.mockReturnValue(imported);

mocks.readExternalCliBootstrapCredential.mockReturnValue(imported);

expect(

resolveEffectiveOAuthCredential({

refresh: "healthy-local-refresh-token",

expires: Date.now() + 30 * 60_000,

});

mocks.readManagedExternalCliCredential.mockReturnValue(imported);

mocks.readExternalCliBootstrapCredential.mockReturnValue(imported);

expect(

resolveEffectiveOAuthCredential({

expires: Date.now() + 30 * 60_000,

accountId: "acct-external",

});

mocks.readManagedExternalCliCredential.mockReturnValue(imported);

mocks.readExternalCliBootstrapCredential.mockReturnValue(imported);

expect(

resolveEffectiveOAuthCredential({

* Delegates to the managed OAuth selector while allowing external CLI

* bootstrap credentials to fill unusable local profile state.

*/

import { readManagedExternalCliCredential } from "./external-cli-sync.js";

import { readExternalCliBootstrapCredential } from "./external-cli-sync.js";

import { resolveEffectiveOAuthCredential as resolveManagedOAuthCredential } from "./oauth-manager.js";

import type { OAuthCredential } from "./types.js";

profileId: params.profileId,

credential: params.credential,

readBootstrapCredential: ({ profileId, credential }) =>

readManagedExternalCliCredential({

readExternalCliBootstrapCredential({

profileId,

credential,

allowKeychainPrompt: params.allowKeychainPrompt ?? false,

);

}

export const readManagedExternalCliCredential = readExternalCliBootstrapCredential;

/** Read a CLI credential as a fallback for refresh/runtime auth recovery. */

export function readExternalCliFallbackCredential(params: {

profileId: string;

/**

* Tests runtime external OAuth overlays.

* Covers provider plugin profiles, external CLI scoped discovery, persistence

* rules, and compatibility aliases.

* rules, and external CLI bootstrap policy.

*/

import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";

import type { ProviderExternalAuthProfile } from "../../plugins/types.js";

import { testing, overlayExternalAuthProfiles } from "./external-auth.js";

import { readManagedExternalCliCredential } from "./external-cli-sync.js";

import { readExternalCliBootstrapCredential } from "./external-cli-sync.js";

import type { AuthProfileStore, OAuthCredential } from "./types.js";

const resolveExternalAuthProfilesWithPluginsMock = vi.fn<

expect(overlaidProfile.access).toBe("fresh-cli-access-token");

expect(overlaidProfile.refresh).toBe("fresh-cli-refresh-token");

expect(overlaidProfile.accountId).toBe("acct-cli");

const managedCredential = readManagedExternalCliCredential({

const managedCredential = readExternalCliBootstrapCredential({

profileId: "openai:default",

credential: tokenlessCredential,

});

credential.expires - now > 5 * 60 * 1000,

isSafeToUseExternalCliCredential: () => true,

readExternalCliBootstrapCredential: () => null,

readManagedExternalCliCredential: () => null,

resolveExternalCliAuthProfiles: () => [],

shouldBootstrapFromExternalCliCredential: () => false,

shouldReplaceStoredOAuthCredential: (existing: unknown, incoming: unknown) =>

import { resolveTokenExpiryState } from "./credential-state.js";

import { formatAuthDoctorHint } from "./doctor.js";

import {

readExternalCliBootstrapCredential,

readExternalCliFallbackCredential,

readManagedExternalCliCredential,

} from "./external-cli-sync.js";

import { createOAuthManager, OAuthManagerRefreshError } from "./oauth-manager.js";

import { OAuthRefreshFailureError } from "./oauth-refresh-failure.js";

buildApiKey: buildOAuthApiKey,

refreshCredential: refreshOAuthCredential,

readBootstrapCredential: ({ profileId, credential }) =>

readManagedExternalCliCredential({

readExternalCliBootstrapCredential({

profileId,

credential,

}),

executePreparedCliRun,

setCliRunnerExecuteTestDeps,

} from "./cli-runner/execute.js";

import { buildSystemPrompt, writeCliSystemPromptFile } from "./cli-runner/helpers.js";

import { buildCliAgentSystemPrompt, writeCliSystemPromptFile } from "./cli-runner/helpers.js";

import { cliBackendLog, formatCliBackendOutputDigest } from "./cli-runner/log.js";

import { setCliRunnerPrepareTestDeps } from "./cli-runner/prepare.js";

import type { PreparedCliRunContext } from "./cli-runner/types.js";

});

it("includes the OpenClaw skills prompt in CLI system prompts", () => {

const systemPrompt = buildSystemPrompt({

const systemPrompt = buildCliAgentSystemPrompt({

workspaceDir: "/tmp",

modelDisplay: "claude-cli/sonnet",

tools: [],

const { contextFiles } = await realResolveBootstrapContextForRun({

workspaceDir,

});

const allArgs = buildSystemPrompt({

const allArgs = buildCliAgentSystemPrompt({

workspaceDir,

modelDisplay: "claude-cli/sonnet",

contextFiles,

});

}

/** Alternate export name for the CLI system prompt builder. */

export const buildSystemPrompt = buildCliAgentSystemPrompt;

/** Applies backend model aliases to a requested CLI model id. */

export function normalizeCliModel(modelId: string, backend: CliBackendConfig): string {

const trimmed = modelId.trim();

}));

vi.mock("./migrate/skill-selection-prompt.js", () => ({

promptMigrationSelectionValues: mocks.multiselect,

promptMigrationSkillSelectionValues: mocks.multiselect,

}));