@minniexcode/codex-switch 0.0.9 → 0.0.10

package/README.AI.md

@@ -54,7 +54,8 @@ Shared flags:
 Operational model:
 
 - `providers.json` is the management-state source of truth
-- `config.toml` and `auth.json` are runtime mirrors
+- `config.toml` is the managed runtime-routing file
+- `auth.json` is the active auth projection file for direct providers and is also inspected by status/doctor
 - `backups/latest.json` tracks the latest rollback state
 - mutating commands should back up first and run under a lightweight file lock
 
@@ -93,12 +94,13 @@ codexs status --json
 Current package version in this repository:
 
 ```text
-0.0.7
+0.0.10
 ```
 
 Recent version summary:
 
-- `0.0.7`: command-surface refactor, env_key/auth-mirror model corrections, and the `setup` split into `init` plus `migrate`
+- `0.0.10`: `init` / `migrate` command split finalized, `setup` deprecated, and the managed provider model reduced to static profile plus `base_url` configuration
+- `0.0.7`: command-surface refactor, env_key/auth-mirror model corrections, and the initial `setup` split toward `init` plus `migrate`
 - `0.0.4`: setup/show/edit/backups list/specific rollback/import merge and clearer CLI semantics
 - `0.0.3`: interactive TTY flows and improved help
 - `0.0.2`: mutation orchestration, backups, rollback, locks, drift detection improvements

package/README.CN.md

@@ -17,30 +17,43 @@
 
 ## 现在可以做什么
 
-当前 MVP 命令如下：
+当前命令面如下：
 
 ```bash
+codexs init
+codexs migrate
 codexs list
+codexs show <provider>
 codexs current
-codexs switch <provider>
 codexs status
+codexs edit <provider>
+codexs switch <provider>
 codexs import <file>
 codexs export <file>
 codexs add <provider>
 codexs remove <provider>
+codexs backups list
 codexs doctor
 codexs rollback
+codexs setup
 ```
 
 对应能力包括：
 
+- 初始化空的受管 `providers.json`
+- 从已有 `config.toml` adopt 可管理的 runtime profile
 - 查看本地已管理的 provider
+- 查看单个 provider 详情
 - 查看当前激活的 profile
+- 查看本地运行态摘要
+- 编辑已有 provider
 - 安全切换 provider
 - 导入和导出 provider 映射
 - 新增和删除 provider
+- 查看备份列表
 - 检查配置漂移和常见本地问题
 - 在变更前自动备份，并在失败时回滚
+- 保留 `setup` 作为弃用入口，并引导到 `init` / `migrate`
 
 ## 简单用法
 
@@ -65,6 +78,8 @@ codexs --help
 典型使用方式：
 
 ```bash
+codexs init
+codexs migrate
 codexs list
 codexs current
 codexs add my-provider --profile my-provider --api-key sk-xxx
@@ -111,7 +126,8 @@ codexs status --json
 存储模型：
 
 - `providers.json` 是管理态的单一事实来源
-- `config.toml` 和 `auth.json` 是运行态文件
+- `config.toml` 是受管的运行时路由文件
+- `auth.json` 是独立的 Codex 认证状态文件，`status` / `doctor` 只读检查它
 - `backups/latest.json` 记录最近一次可回滚窗口
 
 注意：`providers.json` 可能包含 API key，应视为本地敏感文件。
@@ -128,6 +144,12 @@ codexs status --json
 
 ## 最近 3 个版本更新
 
+### 0.0.10
+
+- 正式拆分 `setup`：新增 `init` 和 `migrate`，`setup` 变为弃用命令
+- 增加 `show`、`edit`、`backups list` 等对当前命令面的整理
+- 清理 provider/runtime 管理语义，CLI 只负责静态 profile 与 `base_url` 层配置
+
 ### 0.0.3
 
 - 为 `add`、`switch`、`remove`、`import`、`export`、`rollback` 增加了交互式 TTY 流程

package/README.md

@@ -18,7 +18,7 @@ What it does:
 - Run diagnostics and detect local drift
 - List backups and roll back to a previous managed state
 
-Current version: `0.0.8`
+Current version: `0.0.10`
 
 ## Install
 
@@ -117,7 +117,8 @@ Managed files:
 Notes:
 
 - `providers.json` is the managed provider registry
-- `config.toml` and `auth.json` represent runtime state
+- `config.toml` is the managed runtime-routing file
+- `auth.json` is the active auth projection file; direct-provider switches rewrite `OPENAI_API_KEY`, while `status` and `doctor` inspect its state
 - mutating commands back up before writing
 - rollback is available after failed or undesired changes
 

package/dist/app/add-provider.js

@@ -41,7 +41,6 @@ const errors_1 = require("../domain/errors");
 const config_repo_1 = require("../storage/config-repo");
 const fs_utils_1 = require("../storage/fs-utils");
 const providers_repo_1 = require("../storage/providers-repo");
-const auth_repo_1 = require("../storage/auth-repo");
 const copilot_installer_1 = require("../runtime/copilot-installer");
 const run_mutation_1 = require("./run-mutation");
 /**
@@ -102,14 +101,12 @@ function addProvider(args) {
         ? {
             [args.profile]: {
                 baseUrl: args.copilot ? (0, providers_1.buildCopilotBridgeBaseUrl)(runtime) : args.baseUrl ?? undefined,
-                envKey: (0, config_1.buildManagedProfileEnvKey)(args.profile),
             },
         }
         : undefined;
     if (existingProfile) {
         (0, config_repo_1.requireManagedProfileRuntime)(document, providers, args.profile);
     }
-    const envKey = existingModelProvider?.envKey ?? (0, config_1.buildManagedProfileEnvKey)(args.profile);
     const apiKey = args.copilot ? args.bridgeApiKey ?? crypto.randomBytes(24).toString("hex") : args.apiKey;
     const baseUrl = args.copilot ? (0, providers_1.buildCopilotBridgeBaseUrl)(runtime) : args.baseUrl ?? undefined;
     const next = {
@@ -118,7 +115,6 @@ function addProvider(args) {
             [args.providerName]: (0, providers_1.cleanProviderRecord)({
                 profile: args.profile,
                 apiKey,
-                envKey,
                 baseUrl,
                 note: args.note ?? undefined,
                 tags: args.tags,
@@ -134,7 +130,6 @@ function addProvider(args) {
         files: [
             { absolutePath: args.providersPath, relativePath: "providers.json" },
             { absolutePath: args.configPath, relativePath: "config.toml" },
-            { absolutePath: args.authPath, relativePath: "auth.json" },
         ],
         mutate: () => {
             const configPlan = (0, config_repo_1.createConfigMutationPlan)(document, {
@@ -144,15 +139,9 @@ function addProvider(args) {
             // Persist only the normalized provider payload so later reads are deterministic.
             (0, providers_repo_1.writeProvidersFile)(args.providersPath, next);
             (0, config_repo_1.applyConfigMutation)(args.configPath, document, configPlan);
-            if (document.activeProfile === args.profile) {
-                const activeProviderName = (0, config_repo_1.resolveActiveProviderName)(document, next);
-                const existingAuth = (0, auth_repo_1.readAuthFileIfExists)(args.authPath);
-                (0, auth_repo_1.writeAuthFile)(args.authPath, next.providers[activeProviderName], existingAuth ?? undefined);
-            }
             return {
                 provider: args.providerName,
                 profile: args.profile,
-                envKey,
                 runtimeKind: runtime?.kind ?? null,
                 createdProfileSections: configPlan.createdProfileSections,
                 createdModelProviderSections: configPlan.createdModelProviderSections,

package/dist/app/bridge.js

@@ -283,7 +283,6 @@ function persistRecoveredBridgePort(args) {
             upsertModelProviders: {
                 [args.provider.profile]: {
                     baseUrl: (0, providers_1.buildCopilotBridgeBaseUrl)(args.provider.runtime),
-                    envKey: (0, config_repo_1.requireRuntimeEnvKey)(document, args.provider.profile),
                 },
             },
         });

package/dist/app/edit-provider.js

@@ -7,7 +7,6 @@ const providers_1 = require("../domain/providers");
 const config_repo_1 = require("../storage/config-repo");
 const fs_utils_1 = require("../storage/fs-utils");
 const providers_repo_1 = require("../storage/providers-repo");
-const auth_repo_1 = require("../storage/auth-repo");
 const run_mutation_1 = require("./run-mutation");
 /**
  * Updates selected fields on a single managed provider.
@@ -63,23 +62,15 @@ function editProvider(args) {
         upsertModelProviders = {
             [newProfile]: {
                 baseUrl: args.baseUrl ?? undefined,
-                envKey: (0, config_1.buildManagedProfileEnvKey)(newProfile),
             },
         };
     }
     else {
         (0, config_repo_1.requireManagedProfileRuntime)(document, providers, newProfile);
     }
-    const nextEnvKey = args.profile !== undefined && args.profile !== current.profile
-        ? targetModelProviderSection?.envKey ?? (0, config_1.buildManagedProfileEnvKey)(newProfile)
-        : current.envKey;
-    if (nextEnvKey !== current.envKey) {
-        updatedFields.push("envKey");
-    }
     const nextRecord = (0, providers_1.cleanProviderRecord)({
         profile: newProfile,
         apiKey: args.apiKey ?? current.apiKey,
-        envKey: nextEnvKey,
         baseUrl: args.baseUrl === null ? undefined : args.baseUrl ?? current.baseUrl,
         note: args.note === null ? undefined : args.note ?? current.note,
         tags: args.tags ?? current.tags,
@@ -90,7 +81,7 @@ function editProvider(args) {
                 ...(args.model !== undefined && args.model !== null ? { model: args.model } : {}),
             },
         };
-        if (args.model !== undefined && (targetSection?.model !== args.model) && !updatedFields.includes("model")) {
+        if (args.model !== undefined && targetSection?.model !== args.model && !updatedFields.includes("model")) {
             updatedFields.push("model");
         }
     }
@@ -125,7 +116,6 @@ function editProvider(args) {
         files: [
             { absolutePath: args.providersPath, relativePath: "providers.json" },
             { absolutePath: args.configPath, relativePath: "config.toml" },
-            { absolutePath: args.authPath, relativePath: "auth.json" },
         ],
         mutate: () => {
             const configPlan = (0, config_repo_1.createConfigMutationPlan)(document, {
@@ -143,12 +133,6 @@ function editProvider(args) {
             // Write providers first so the registry and config move together inside the managed backup boundary.
             (0, providers_repo_1.writeProvidersFile)(args.providersPath, nextProviders);
             (0, config_repo_1.applyConfigMutation)(args.configPath, document, configPlan);
-            const updatedDocument = (0, config_repo_1.readStructuredConfig)(args.configPath);
-            if (updatedDocument.activeProfile) {
-                const activeProviderName = (0, config_repo_1.resolveActiveProviderName)(updatedDocument, nextProviders);
-                const existingAuth = (0, auth_repo_1.readAuthFileIfExists)(args.authPath);
-                (0, auth_repo_1.writeAuthFile)(args.authPath, nextProviders.providers[activeProviderName], existingAuth ?? undefined);
-            }
             return {
                 provider: args.providerName,
                 updatedFields,

package/dist/app/get-status.js

@@ -56,7 +56,7 @@ async function getStatus(codexDir, configPath, providersPath, authPath) {
     const providers = providersExists ? (0, providers_repo_1.readProvidersFile)(providersPath) : null;
     let configViews = [];
     let consistencyIssues = [];
-    const authState = (0, auth_repo_1.readManagedAuthState)(authPath);
+    const authState = (0, auth_repo_1.readAuthFileState)(authPath);
     if (configExists) {
         const document = (0, config_repo_1.readStructuredConfig)(configPath);
         currentProfile = document.activeProfile;
@@ -70,20 +70,32 @@ async function getStatus(codexDir, configPath, providersPath, authPath) {
     const activeProviderCandidates = currentProfile && providers ? (0, providers_1.findProvidersByProfile)(providers, currentProfile) : [];
     const activeProvider = activeProviderCandidates.length === 1 && providers ? providers.providers[activeProviderCandidates[0]] : null;
     const copilotInstall = (0, copilot_installer_1.probeCopilotSdkInstall)();
-    const runtimeState = (0, runtime_state_repo_1.readCopilotBridgeState)();
+    const runtimeStateInspection = (0, runtime_state_repo_1.inspectCopilotBridgeState)();
+    const runtimeState = runtimeStateInspection.state;
     const runtimeStateProvider = runtimeState && providers ? providers.providers[runtimeState.provider] ?? null : null;
     const bridgeProbeTarget = activeProvider && (0, providers_1.isCopilotBridgeProvider)(activeProvider)
         ? activeProvider
         : runtimeStateProvider && (0, providers_1.isCopilotBridgeProvider)(runtimeStateProvider)
             ? runtimeStateProvider
             : null;
-    const copilotBridge = bridgeProbeTarget ? await (0, copilot_bridge_1.probeCopilotBridgeRuntime)(bridgeProbeTarget) : runtimeState ? {
-        ok: false,
-        runtime: "copilot-bridge",
-        reason: "failed",
-        cause: "Copilot bridge runtime state exists but no matching managed Copilot provider is active.",
-        details: runtimeState,
-    } : null;
+    const copilotBridge = !runtimeStateInspection.valid && runtimeStateInspection.exists
+        ? {
+            ok: false,
+            runtime: "copilot-bridge",
+            reason: "failed",
+            cause: runtimeStateInspection.parseError ?? "Failed to parse Copilot bridge runtime state.",
+        }
+        : bridgeProbeTarget
+            ? await (0, copilot_bridge_1.probeCopilotBridgeRuntime)(bridgeProbeTarget, runtimeState)
+            : runtimeState
+                ? {
+                    ok: false,
+                    runtime: "copilot-bridge",
+                    reason: "failed",
+                    cause: "Copilot bridge runtime state exists but no matching managed Copilot provider is active.",
+                    details: runtimeState,
+                }
+                : null;
     const copilotAuth = activeProvider && (0, providers_1.isCopilotBridgeProvider)(activeProvider)
         ? await (0, copilot_adapter_1.readCopilotAuthState)().catch((error) => ({
             ready: false,
@@ -96,6 +108,9 @@ async function getStatus(codexDir, configPath, providersPath, authPath) {
         // Surface unmanaged live state without mutating anything during a read-only status call.
         warnings.push("Current config profile is not mapped in providers.json. Backfill would be required before treating live state as managed.");
     }
+    if (runtimeStateInspection.exists && !runtimeStateInspection.valid) {
+        warnings.push(`Copilot bridge runtime state is unreadable: ${runtimeStateInspection.parseError ?? "unknown parse failure"}`);
+    }
     return {
         warnings,
         data: {

package/dist/app/list-providers.js

@@ -11,7 +11,6 @@ function listProviders(providersPath) {
     const items = names.map((name) => ({
         name,
         profile: providers.providers[name].profile,
-        envKey: providers.providers[name].envKey,
         note: providers.providers[name].note ?? null,
         tags: providers.providers[name].tags ?? [],
     }));

package/dist/app/run-doctor.js

@@ -102,8 +102,9 @@ async function runDoctor(args) {
             });
         }
     }
-    const authState = (0, auth_repo_1.readManagedAuthState)(args.authPath);
-    const runtimeState = (0, runtime_state_repo_1.readCopilotBridgeState)();
+    const authState = (0, auth_repo_1.readAuthFileState)(args.authPath);
+    const runtimeStateInspection = (0, runtime_state_repo_1.inspectCopilotBridgeState)();
+    const runtimeState = runtimeStateInspection.state;
     if (authState.exists && !authState.valid) {
         issues.push({
             code: "AUTH_JSON_INVALID",
@@ -111,34 +112,16 @@ async function runDoctor(args) {
             file: args.authPath,
         });
     }
+    if (runtimeStateInspection.exists && !runtimeStateInspection.valid) {
+        issues.push({
+            code: "BRIDGE_STATE_STALE",
+            message: `Copilot bridge runtime state is unreadable: ${runtimeStateInspection.parseError ?? "unknown parse failure"}`,
+        });
+    }
     if (document?.activeProfile && providers) {
         const matches = (0, providers_1.findProvidersByProfile)(providers, document.activeProfile);
         if (matches.length === 1) {
             const activeProvider = providers.providers[matches[0]];
-            const payload = authState.payload ?? {};
-            const actualKeys = authState.managedSecretKeys;
-            if (authState.authMode !== null && authState.authMode !== "apikey") {
-                issues.push({
-                    code: "AUTH_JSON_INVALID",
-                    message: `auth.json auth_mode must be "apikey", found "${authState.authMode}".`,
-                });
-            }
-            if (!actualKeys.includes(activeProvider.envKey) || actualKeys.length !== 1) {
-                issues.push({
-                    code: "AUTH_JSON_ENV_KEY_MISMATCH",
-                    message: `auth.json managed env key does not match active provider "${matches[0]}".`,
-                    provider: matches[0],
-                    expectedEnvKey: activeProvider.envKey,
-                    actualEnvKeys: actualKeys,
-                });
-            }
-            if (payload[activeProvider.envKey] !== activeProvider.apiKey) {
-                issues.push({
-                    code: "AUTH_JSON_APIKEY_MISMATCH",
-                    message: `auth.json secret value does not match active provider "${matches[0]}".`,
-                    provider: matches[0],
-                });
-            }
             if ((0, providers_1.isCopilotBridgeProvider)(activeProvider)) {
                 const installStatus = (0, copilot_installer_1.probeCopilotSdkInstall)();
                 if (!installStatus.installed) {
@@ -160,7 +143,7 @@ async function runDoctor(args) {
                         ...(normalized.details ?? {}),
                     });
                 }
-                const bridge = await (0, copilot_bridge_1.probeCopilotBridgeRuntime)(activeProvider);
+                const bridge = await (0, copilot_bridge_1.probeCopilotBridgeRuntime)(activeProvider, runtimeState);
                 if (!bridge.ok) {
                     issues.push({
                         code: mapBridgeDiagnosticCode(bridge.cause),
@@ -255,18 +238,10 @@ function renderConfigIssueMessage(issue) {
             return `Model provider section "${issue.modelProvider}" for profile "${issue.profile}" is missing from config.toml.`;
         case "MODEL_PROVIDER_BASE_URL_MISSING":
             return `Model provider section "${issue.modelProvider}" for profile "${issue.profile}" is missing base_url.`;
-        case "MODEL_PROVIDER_ENV_KEY_MISSING":
-            return `Model provider section "${issue.modelProvider}" for profile "${issue.profile}" is missing env_key.`;
-        case "PROVIDER_ENV_KEY_MISMATCH":
-            return `Provider "${issue.provider}" envKey does not match runtime env_key for profile "${issue.profile}".`;
         case "ACTIVE_PROVIDER_UNRESOLVED":
-            return `Active profile "${issue.profile}" maps to multiple providers and cannot determine the current auth mirror owner.`;
+            return `Active profile "${issue.profile}" maps to multiple providers, so the active managed provider cannot be resolved uniquely.`;
         case "AUTH_JSON_INVALID":
             return String(issue.message ?? issue.reason ?? "auth.json is invalid.");
-        case "AUTH_JSON_ENV_KEY_MISMATCH":
-            return `auth.json managed env key does not match provider "${String(issue.provider ?? "")}".`;
-        case "AUTH_JSON_APIKEY_MISMATCH":
-            return `auth.json secret does not match provider "${String(issue.provider ?? "")}".`;
         case "DESTRUCTIVE_REMOVE_BLOCKED":
             return `Provider "${issue.provider}" cannot be removed while "${issue.activeProfile}" remains active.`;
         default:

package/dist/app/setup-codex.js

@@ -42,7 +42,6 @@ const codex_cli_1 = require("../runtime/codex-cli");
 const config_repo_1 = require("../storage/config-repo");
 const fs_utils_1 = require("../storage/fs-utils");
 const providers_repo_1 = require("../storage/providers-repo");
-const auth_repo_1 = require("../storage/auth-repo");
 const run_doctor_1 = require("./run-doctor");
 const run_mutation_1 = require("./run-mutation");
 const MIN_CODEX_VERSION = "0.0.1";
@@ -70,30 +69,46 @@ async function migrateCodex(args) {
         });
     }
     const document = (0, config_repo_1.readStructuredConfig)(args.configPath);
-    const profileViews = (0, config_1.buildManagedProfileViews)(document, null);
-    // Migrate can only adopt unmanaged profiles that already contain enough runtime data to become managed.
-    const adoptableProfiles = profileViews
-        .filter((view) => view.source === "unmanaged" && view.model && view.modelProvider === view.name && view.baseUrl && view.envKey)
-        .map((view) => view.name)
-        .sort();
+    const currentProviders = (0, providers_repo_1.readProvidersFileIfExists)(args.providersPath);
+    const profileViews = (0, config_1.buildManagedProfileViews)(document, currentProviders);
+    const adoptability = (0, setup_1.collectMigrateAdoptability)(document, currentProviders);
     if (profileViews.length === 0) {
         throw (0, errors_1.cliError)("PROFILE_NOT_FOUND", "No profiles were found in config.toml.", {
             file: args.configPath,
         });
     }
-    const invalidAdoptProfiles = args.adoptProfiles.filter((profile) => !adoptableProfiles.includes(profile));
+    if (adoptability.adoptableProfiles.length === 0) {
+        throw (0, errors_1.cliError)("MIGRATE_NO_ADOPTABLE_PROFILES", "No adoptable profiles were found for migrate.", {
+            availableProfiles: adoptability.availableProfiles,
+            adoptableProfiles: adoptability.adoptableProfiles,
+            blockingReasonsByProfile: adoptability.blockingReasonsByProfile,
+        });
+    }
+    const invalidAdoptProfiles = args.adoptProfiles.filter((profile) => !adoptability.adoptableProfiles.includes(profile));
     if (invalidAdoptProfiles.length > 0) {
-        throw (0, errors_1.cliError)("INVALID_ARGUMENT", "migrate only adopts unmanaged profiles that already contain model, model_provider, and matching model_providers base_url/env_key.", {
+        throw (0, errors_1.cliError)("INVALID_ARGUMENT", "migrate only adopts unmanaged profiles that already contain model, model_provider, and matching model_providers base_url.", {
             invalidProfiles: invalidAdoptProfiles.sort(),
-            adoptableProfiles,
+            availableProfiles: adoptability.availableProfiles,
+            adoptableProfiles: adoptability.adoptableProfiles,
+            blockingReasonsByProfile: adoptability.blockingReasonsByProfile,
         });
     }
     if (args.adoptProfiles.length === 0) {
         throw (0, errors_1.cliError)("INVALID_ARGUMENT", "migrate requires at least one explicit profile to adopt.", {
-            adoptableProfiles,
+            availableProfiles: adoptability.availableProfiles,
+            adoptableProfiles: adoptability.adoptableProfiles,
+            blockingReasonsByProfile: adoptability.blockingReasonsByProfile,
         });
     }
-    const drafts = (0, setup_1.buildSetupDrafts)(args.adoptProfiles, args.providerDetailsByProfile);
+    const runtimeByProfile = profileViews.reduce((accumulator, view) => {
+        if (view.source === "unmanaged") {
+            accumulator[view.name] = {
+                baseUrl: view.baseUrl ?? undefined,
+            };
+        }
+        return accumulator;
+    }, {});
+    const drafts = (0, setup_1.buildSetupDrafts)(args.adoptProfiles, args.providerDetailsByProfile, runtimeByProfile);
     const incompleteProfiles = (0, setup_1.findIncompleteSetupProfiles)(drafts);
     if (incompleteProfiles.length > 0) {
         throw (0, errors_1.cliError)("INVALID_ARGUMENT", "migrate requires complete provider data for every selected profile.", {
@@ -101,7 +116,6 @@ async function migrateCodex(args) {
         });
     }
     (0, fs_utils_1.ensureDir)(args.codexDir);
-    const currentProviders = (0, providers_repo_1.readProvidersFileIfExists)(args.providersPath);
     const providersExists = fs.existsSync(args.providersPath);
     if (providersExists && args.strategy !== "merge" && args.strategy !== "overwrite") {
         throw (0, errors_1.cliError)("PROVIDERS_ALREADY_EXISTS", "providers.json already exists.", {
@@ -123,16 +137,12 @@ async function migrateCodex(args) {
         files: [
             { absolutePath: args.providersPath, relativePath: "providers.json" },
             { absolutePath: args.configPath, relativePath: "config.toml" },
-            { absolutePath: args.authPath, relativePath: "auth.json" },
         ],
         mutate: () => {
             // migrate currently preserves config structure and only asserts that the file remains writable inside the mutation flow.
             const configPlan = (0, config_repo_1.createConfigMutationPlan)(document, {});
             (0, providers_repo_1.writeProvidersFile)(args.providersPath, finalProviders);
             (0, config_repo_1.applyConfigMutation)(args.configPath, document, configPlan);
-            const activeProviderName = (0, config_repo_1.resolveActiveProviderName)(document, finalProviders);
-            const existingAuth = (0, auth_repo_1.readAuthFileIfExists)(args.authPath);
-            (0, auth_repo_1.writeAuthFile)(args.authPath, finalProviders.providers[activeProviderName], existingAuth ?? undefined);
             return {
                 codexDir: args.codexDir,
                 strategy: args.strategy,

package/dist/app/show-config.js

@@ -31,11 +31,7 @@ function showConfig(args) {
             selectedProfile,
             profiles: profiles.map((profile) => ({
                 ...profile,
-                managedProviderEnvKeys: (0, providers_1.findProvidersByProfile)(providers, profile.name).map((providerName) => ({
-                    providerName,
-                    envKey: providers.providers[providerName].envKey,
-                    matchesRuntime: providers.providers[providerName].envKey === profile.envKey,
-                })),
+                linkedProviderNames: (0, providers_1.findProvidersByProfile)(providers, profile.name),
             })),
         },
     };

package/dist/app/switch-provider.js

@@ -4,14 +4,14 @@ exports.switchProvider = switchProvider;
 const errors_1 = require("../domain/errors");
 const providers_1 = require("../domain/providers");
 const config_repo_1 = require("../storage/config-repo");
-const providers_repo_1 = require("../storage/providers-repo");
 const auth_repo_1 = require("../storage/auth-repo");
+const providers_repo_1 = require("../storage/providers-repo");
 const copilot_bridge_1 = require("../runtime/copilot-bridge");
 const copilot_installer_1 = require("../runtime/copilot-installer");
 const copilot_adapter_1 = require("../runtime/copilot-adapter");
 const run_mutation_1 = require("./run-mutation");
 /**
- * Switches the active Codex profile and rewrites auth.json for the target provider.
+ * Switches the active Codex profile to the target provider.
  */
 async function switchProvider(args) {
     const providers = (0, providers_repo_1.readProvidersFile)(args.providersPath);
@@ -22,15 +22,6 @@ async function switchProvider(args) {
         });
     }
     const document = (0, config_repo_1.ensureProfileExists)(args.configPath, provider.profile, args.providerName);
-    const envKey = (0, config_repo_1.requireRuntimeEnvKey)(document, provider.profile);
-    if (provider.envKey !== envKey) {
-        throw (0, errors_1.cliError)("PROVIDER_ENV_KEY_MISMATCH", `Provider "${args.providerName}" envKey does not match runtime env_key.`, {
-            provider: args.providerName,
-            profile: provider.profile,
-            providerEnvKey: provider.envKey,
-            runtimeEnvKey: envKey,
-        });
-    }
     if ((0, providers_1.isCopilotBridgeProvider)(provider)) {
         const installStatus = (0, copilot_installer_1.probeCopilotSdkInstall)();
         if (!installStatus.installed) {
@@ -58,8 +49,8 @@ async function switchProvider(args) {
                 latestBackupPath: args.latestBackupPath,
                 operation: "switch",
                 files: [
+                    { absolutePath: args.providersPath, relativePath: "providers.json" },
                     { absolutePath: args.configPath, relativePath: "config.toml" },
-                    { absolutePath: args.authPath, relativePath: "auth.json" },
                 ],
                 mutate: () => {
                     const configPlan = (0, config_repo_1.createConfigMutationPlan)(document, {
@@ -68,7 +59,6 @@ async function switchProvider(args) {
                             ? {
                                 [provider.profile]: {
                                     baseUrl: (0, providers_1.buildCopilotBridgeBaseUrl)(nextProvider.runtime),
-                                    envKey,
                                 },
                             }
                             : undefined,
@@ -82,12 +72,9 @@ async function switchProvider(args) {
                         });
                     }
                     (0, config_repo_1.applyConfigMutation)(args.configPath, document, configPlan);
-                    const existingAuth = (0, auth_repo_1.readAuthFileIfExists)(args.authPath);
-                    (0, auth_repo_1.writeAuthFile)(args.authPath, nextProvider, existingAuth ?? undefined);
                     return {
                         provider: args.providerName,
                         profile: nextProvider.profile,
-                        envKey: nextProvider.envKey,
                         portChanged: bridge.portChanged,
                         bridgePort: bridge.port,
                     };
@@ -107,20 +94,18 @@ async function switchProvider(args) {
         latestBackupPath: args.latestBackupPath,
         operation: "switch",
         files: [
-            { absolutePath: args.configPath, relativePath: "config.toml" },
             { absolutePath: args.authPath, relativePath: "auth.json" },
+            { absolutePath: args.configPath, relativePath: "config.toml" },
         ],
         mutate: () => {
             const configPlan = (0, config_repo_1.createConfigMutationPlan)(document, {
                 setActiveProfile: provider.profile,
             });
             (0, config_repo_1.applyConfigMutation)(args.configPath, document, configPlan);
-            const existingAuth = (0, auth_repo_1.readAuthFileIfExists)(args.authPath);
-            (0, auth_repo_1.writeAuthFile)(args.authPath, provider, existingAuth ?? undefined);
+            (0, auth_repo_1.writeOpenAiApiKeyAuth)(args.authPath, provider.apiKey);
             return {
                 provider: args.providerName,
                 profile: provider.profile,
-                envKey: provider.envKey,
             };
         },
     });

package/dist/cli/output.js

@@ -90,8 +90,7 @@ function renderHumanSuccess(command, data, warnings) {
                         ? ` tags=${provider.tags.join(",")}`
                         : "";
                     const note = provider.note ? ` note=${provider.note}` : "";
-                    const envKey = provider.envKey ? ` envKey=${provider.envKey}` : "";
-                    lines.push(`${provider.name} -> ${provider.profile}${envKey}${tags}${note}`);
+                    lines.push(`${provider.name} -> ${provider.profile}${tags}${note}`);
                 }
             }
             break;
@@ -101,7 +100,6 @@ function renderHumanSuccess(command, data, warnings) {
             lines.push(`Provider: ${String(data?.providerName ?? "")}`);
             lines.push(`profile: ${String(provider.profile ?? "")}`);
             lines.push(`apiKey: ${String(provider.apiKey ?? "")}`);
-            lines.push(`envKey: ${String(provider.envKey ?? "")}`);
             if (provider.baseUrl) {
                 lines.push(`baseUrl: ${String(provider.baseUrl)}`);
             }
@@ -125,14 +123,15 @@ function renderHumanSuccess(command, data, warnings) {
             lines.push(`activeProviderResolvable: ${String(data?.activeProviderResolvable ?? false)}`);
             const auth = data?.auth ?? {};
             lines.push(`authExists: ${String(auth.exists ?? false)}`);
-            lines.push(`authManagedKeys: ${Array.isArray(auth.managedSecretKeys) ? auth.managedSecretKeys.join(",") : ""}`);
+            lines.push(`authValid: ${String(auth.valid ?? false)}`);
+            lines.push(`authMode: ${String(auth.authMode ?? "")}`);
             lines.push(`issues: ${Array.isArray(data?.issues) ? (data?.issues).length : 0}`);
             break;
         case "config-show": {
             lines.push(`activeProfile: ${String(data?.activeProfile ?? "")}`);
             const profiles = data?.profiles ?? [];
             for (const profile of profiles) {
-                lines.push(`${String(profile.name)} managed=${String(profile.managed)} active=${String(profile.isActive)} source=${String(profile.source)} model=${String(profile.model ?? "")} modelProvider=${String(profile.modelProvider ?? "")} baseUrl=${String(profile.baseUrl ?? "")} envKey=${String(profile.envKey ?? "")}`);
+                lines.push(`${String(profile.name)} managed=${String(profile.managed)} active=${String(profile.isActive)} source=${String(profile.source)} model=${String(profile.model ?? "")} modelProvider=${String(profile.modelProvider ?? "")} baseUrl=${String(profile.baseUrl ?? "")}`);
             }
             break;
         }
@@ -145,7 +144,6 @@ function renderHumanSuccess(command, data, warnings) {
         }
         case "switch":
             lines.push(`Switched to provider ${String(data?.provider ?? "")} using profile ${String(data?.profile ?? "")}.`);
-            lines.push(`envKey: ${String(data?.envKey ?? "")}`);
             lines.push(`Backup: ${String(data?.backupPath ?? "")}`);
             break;
         case "import":

package/dist/cli.js

@@ -9,7 +9,7 @@ const args_1 = require("./commands/args");
 const help_1 = require("./commands/help");
 const errors_1 = require("./domain/errors");
 const output_1 = require("./cli/output");
-const VERSION = "0.0.8";
+const VERSION = require("../package.json").version ?? "0.0.0";
 /**
  * Prints the command help text to stdout.
  */