#!/usr/bin/env bash
# Invoked by Claude Code via the `apiKeyHelper` setting. Prints the API key for
# the active preset to stdout and nothing else.
#
# Only presets whose auth mode is "vault" have a secret to emit. In anthropic
# mode, or for a preset using an inline placeholder token (LM Studio), this exits
# silently so a token cannot leak into a context that must not have one.

set -u

CM_ROOT="${CM_ROOT:-$HOME/.claude-mode}"
# shellcheck source=/dev/null
. "$CM_ROOT/bin/cm-vault.sh"

PY="${CLAUDE_MODE_PYTHON:-python3}"
JSON="$CM_ROOT/bin/cm-json.py"

state="$CM_ROOT/state.json"
[ -f "$state" ] || exit 0

mode="$("$PY" "$JSON" get "$state" mode 2>/dev/null)"
[ "$mode" = "anthropic" ] && exit 0
[ -n "$mode" ] || exit 0

preset_name="$("$PY" "$JSON" get "$state" preset 2>/dev/null)"
[ -n "$preset_name" ] || exit 0

preset="$CM_ROOT/presets/$preset_name.json"
[ -f "$preset" ] || exit 1

auth_mode="$("$PY" "$JSON" get "$preset" auth.mode 2>/dev/null)"
[ -z "$auth_mode" ] && auth_mode="vault"
[ "$auth_mode" = "vault" ] || exit 0        # inline token: nothing for us to emit

key_ref="$("$PY" "$JSON" get "$preset" auth.keyRef 2>/dev/null)"
[ -n "$key_ref" ] || key_ref="openrouter"

cm_vault_get "$key_ref" || exit 1