/**

* Reads and refreshes credentials stored by external CLI runtimes such as

* Claude Code, Codex, Gemini, and MiniMax.

*/

import { execFileSync, execSync } from "node:child_process";

import { createHash } from "node:crypto";

import fs from "node:fs";

let minimaxCliCache: CachedValue<MiniMaxCliCredential> | null = null;

let geminiCliCache: CachedValue<GeminiCliCredential> | null = null;

/** Clears in-memory CLI credential caches for isolated tests. */

export function resetCliCredentialCachesForTest(): void {

claudeCliCache = null;

codexCliCache = null;

minimaxCliCache = null;

geminiCliCache = null;

}

/** Credential shape parsed from Claude Code CLI storage. */

export type ClaudeCliCredential =

| {

type: "oauth";

expires: number;

};

/** Credential shape parsed from Codex CLI storage. */

export type CodexCliCredential = {

type: "oauth";

provider: OAuthProvider;

idToken?: string;

};

/** Credential shape parsed from MiniMax portal CLI storage. */

export type MiniMaxCliCredential = {

type: "oauth";

provider: "minimax-portal";

expires: number;

};

/** Credential shape parsed from Gemini CLI storage. */

export type GeminiCliCredential = {

type: "oauth";

provider: "google-gemini-cli";

}

}

/** Reads Claude CLI credentials from macOS Keychain or the CLI credential file. */

export function readClaudeCliCredentials(options?: {

allowKeychainPrompt?: boolean;

platform?: NodeJS.Platform;

});

}

/** Writes refreshed Claude OAuth tokens back to the Claude CLI macOS Keychain item. */

export function writeClaudeCliKeychainCredentials(

newCredentials: OAuthCredentials,

options?: { execFileSync?: ExecFileSyncFn },

}

}

/** Writes refreshed Claude OAuth tokens back to the Claude CLI credential file. */

export function writeClaudeCliFileCredentials(

newCredentials: OAuthCredentials,

options?: ClaudeCliFileOptions,

}

}

/** Writes refreshed Claude OAuth tokens to the preferred Claude CLI credential store. */

export function writeClaudeCliCredentials(

newCredentials: OAuthCredentials,

options?: ClaudeCliWriteOptions,

return writeFile(newCredentials, { homeDir: options?.homeDir });

}

/** Reads Codex CLI OAuth credentials from Keychain or CODEX_HOME auth.json. */

export function readCodexCliCredentials(options?: {

codexHome?: string;

allowKeychainPrompt?: boolean;

};

}

/** Reads Codex CLI credentials with optional short-lived cache and file fingerprinting. */

export function readCodexCliCredentialsCached(options?: {

codexHome?: string;

allowKeychainPrompt?: boolean;

});

}

/** Reads MiniMax CLI credentials with optional short-lived cache. */

export function readMiniMaxCliCredentialsCached(options?: {

ttlMs?: number;

homeDir?: string;

});

}

/** Reads Gemini CLI credentials with optional short-lived cache. */

export function readGeminiCliCredentialsCached(options?: {

ttlMs?: number;

homeDir?: string;