openclaw/dist/cli-execution-auth-BmnnNTfm.js

Multi-channel AI gateway with extensible messaging integrations

import { f as loadAuthProfileStoreForRuntime } from "./store-F1B2duCT.js";
import { a as resolveAuthProfileOrder } from "./order-CC2RBzI5.js";
import { a as resolveCliRuntimeCanonicalProvider, i as resolveCliBackendConfig } from "./cli-backends-Bs_a4MW0.js";
import { t as resolveBundledCliBackendAuthPolicy } from "./cli-backend-auth-policy-BJQR9lNK.js";
//#region src/agents/cli-execution-auth.ts
const GOOGLE_GEMINI_CLI_PROVIDER_ID = "google-gemini-cli";
const GOOGLE_PROVIDER_ID = "google";
const CLAUDE_CLI_PROVIDER_ID = "claude-cli";
var CliExecutionAuthProfileError = class extends Error {
	constructor(..._args) {
		super(..._args);
		this.name = "CliExecutionAuthProfileError";
	}
};
function cliBackendAcceptsAuthProfileForwarding(params) {
	const backend = resolveCliBackendConfig(params.provider, params.config, { agentId: params.agentId });
	return backend?.id === GOOGLE_GEMINI_CLI_PROVIDER_ID || backend?.id === CLAUDE_CLI_PROVIDER_ID;
}
/**
* Resolve native profiles and explicitly selected credentials the CLI can consume.
* A user-locked profile must fail closed rather than run as another user.
*/
function resolveCliExecutionAuthProfileId(params) {
	const loadStore = params.loadAuthProfileStoreForRuntime ?? loadAuthProfileStoreForRuntime;
	const selectedAuthProfileId = params.selected?.authProfileId?.trim();
	const store = loadStore(params.agentDir, {
		readOnly: true,
		allowKeychainPrompt: false,
		externalCliProviderIds: [params.cliExecutionProvider],
		profileId: selectedAuthProfileId
	});
	const nativeAuthProfileIds = resolveBundledCliBackendAuthPolicy(params.cliExecutionProvider)?.nativeAuthProfileIds;
	if (selectedAuthProfileId && nativeAuthProfileIds?.includes(selectedAuthProfileId)) return;
	if (selectedAuthProfileId) {
		const credential = store.profiles[selectedAuthProfileId];
		if (credential?.provider === params.cliExecutionProvider) return selectedAuthProfileId;
		if (credential && params.selected?.authProfileIdSource !== "auto" && (params.cliExecutionProvider === CLAUDE_CLI_PROVIDER_ID || params.cliExecutionProvider === GOOGLE_GEMINI_CLI_PROVIDER_ID && credential.type === "api_key") && credential.provider === resolveCliRuntimeCanonicalProvider({
			runtime: params.cliExecutionProvider,
			config: params.config,
			includeSetupRegistry: true
		})) return selectedAuthProfileId;
		if (params.selected?.authProfileIdSource !== "auto") {
			if (!credential) throw new CliExecutionAuthProfileError(`No credentials found for profile "${selectedAuthProfileId}".`);
			throw new CliExecutionAuthProfileError(`CLI backend "${params.cliExecutionProvider}" cannot use auth profile "${selectedAuthProfileId}" owned by "${credential.provider}".`);
		}
	}
	const cliProfileId = resolveAuthProfileOrder({
		cfg: params.config,
		store,
		provider: params.cliExecutionProvider
	}).find((profileId) => store.profiles[profileId]?.provider === params.cliExecutionProvider && !nativeAuthProfileIds?.includes(profileId));
	if (cliProfileId) return cliProfileId;
	if (params.cliExecutionProvider !== GOOGLE_GEMINI_CLI_PROVIDER_ID || params.authProfileProvider !== GOOGLE_PROVIDER_ID) return;
	return resolveAuthProfileOrder({
		cfg: params.config,
		store,
		provider: GOOGLE_PROVIDER_ID
	}).find((profileId) => {
		const credential = store.profiles[profileId];
		return credential?.provider === GOOGLE_PROVIDER_ID && credential.type === "api_key";
	});
}
//#endregion
export { cliBackendAcceptsAuthProfileForwarding as n, resolveCliExecutionAuthProfileId as r, CliExecutionAuthProfileError as t };