1+ /**
2+ * Reads and refreshes credentials stored by external CLI runtimes such as
3+ * Claude Code, Codex, Gemini, and MiniMax.
4+ */
15import { execFileSync , execSync } from "node:child_process" ;
26import { createHash } from "node:crypto" ;
37import fs from "node:fs" ;
@@ -36,13 +40,15 @@ let codexCliCache: CachedValue<CodexCliCredential> | null = null;
3640let minimaxCliCache : CachedValue < MiniMaxCliCredential > | null = null ;
3741let geminiCliCache : CachedValue < GeminiCliCredential > | null = null ;
3842
43+ /** Clears in-memory CLI credential caches for isolated tests. */
3944export function resetCliCredentialCachesForTest ( ) : void {
4045 claudeCliCache = null ;
4146 codexCliCache = null ;
4247 minimaxCliCache = null ;
4348 geminiCliCache = null ;
4449}
4550
51+ /** Credential shape parsed from Claude Code CLI storage. */
4652export type ClaudeCliCredential =
4753 | {
4854 type : "oauth" ;
@@ -58,6 +64,7 @@ export type ClaudeCliCredential =
5864 expires : number ;
5965 } ;
6066
67+ /** Credential shape parsed from Codex CLI storage. */
6168export type CodexCliCredential = {
6269 type : "oauth" ;
6370 provider : OAuthProvider ;
@@ -68,6 +75,7 @@ export type CodexCliCredential = {
6875 idToken ?: string ;
6976} ;
7077
78+ /** Credential shape parsed from MiniMax portal CLI storage. */
7179export type MiniMaxCliCredential = {
7280 type : "oauth" ;
7381 provider : "minimax-portal" ;
@@ -76,6 +84,7 @@ export type MiniMaxCliCredential = {
7684 expires : number ;
7785} ;
7886
87+ /** Credential shape parsed from Gemini CLI storage. */
7988export type GeminiCliCredential = {
8089 type : "oauth" ;
8190 provider : "google-gemini-cli" ;
@@ -437,6 +446,7 @@ function readClaudeCliKeychainCredentials(
437446 }
438447}
439448
449+ /** Reads Claude CLI credentials from macOS Keychain or the CLI credential file. */
440450export function readClaudeCliCredentials ( options ?: {
441451 allowKeychainPrompt ?: boolean ;
442452 platform ?: NodeJS . Platform ;
@@ -494,6 +504,7 @@ export function readClaudeCliCredentialsCached(options?: {
494504 } ) ;
495505}
496506
507+ /** Writes refreshed Claude OAuth tokens back to the Claude CLI macOS Keychain item. */
497508export function writeClaudeCliKeychainCredentials (
498509 newCredentials : OAuthCredentials ,
499510 options ?: { execFileSync ?: ExecFileSyncFn } ,
@@ -550,6 +561,7 @@ export function writeClaudeCliKeychainCredentials(
550561 }
551562}
552563
564+ /** Writes refreshed Claude OAuth tokens back to the Claude CLI credential file. */
553565export function writeClaudeCliFileCredentials (
554566 newCredentials : OAuthCredentials ,
555567 options ?: ClaudeCliFileOptions ,
@@ -592,6 +604,7 @@ export function writeClaudeCliFileCredentials(
592604 }
593605}
594606
607+ /** Writes refreshed Claude OAuth tokens to the preferred Claude CLI credential store. */
595608export function writeClaudeCliCredentials (
596609 newCredentials : OAuthCredentials ,
597610 options ?: ClaudeCliWriteOptions ,
@@ -612,6 +625,7 @@ export function writeClaudeCliCredentials(
612625 return writeFile ( newCredentials , { homeDir : options ?. homeDir } ) ;
613626}
614627
628+ /** Reads Codex CLI OAuth credentials from Keychain or CODEX_HOME auth.json. */
615629export function readCodexCliCredentials ( options ?: {
616630 codexHome ?: string ;
617631 allowKeychainPrompt ?: boolean ;
@@ -673,6 +687,7 @@ export function readCodexCliCredentials(options?: {
673687 } ;
674688}
675689
690+ /** Reads Codex CLI credentials with optional short-lived cache and file fingerprinting. */
676691export function readCodexCliCredentialsCached ( options ?: {
677692 codexHome ?: string ;
678693 allowKeychainPrompt ?: boolean ;
@@ -703,6 +718,7 @@ export function readCodexCliCredentialsCached(options?: {
703718 } ) ;
704719}
705720
721+ /** Reads MiniMax CLI credentials with optional short-lived cache. */
706722export function readMiniMaxCliCredentialsCached ( options ?: {
707723 ttlMs ?: number ;
708724 homeDir ?: string ;
@@ -720,6 +736,7 @@ export function readMiniMaxCliCredentialsCached(options?: {
720736 } ) ;
721737}
722738
739+ /** Reads Gemini CLI credentials with optional short-lived cache. */
723740export function readGeminiCliCredentialsCached ( options ?: {
724741 ttlMs ?: number ;
725742 homeDir ?: string ;
0 commit comments