@wu529778790/open-im 1.10.5 → 1.10.6-beta.0

package/README.md

@@ -75,16 +75,21 @@ Default: root **`aiCommand`**. Override with **`platforms.<name>.aiCommand`**:
 
 ### Claude (Agent SDK)
 
-No local `claude` binary required. Credentials: env → **`config.json`** `env` → **`~/.claude/settings.json`**.
+No local `claude` binary required. Credentials: env → **`config.json`** **`tools.claude.env`** → **`~/.claude/settings.json`** (dashboard saves API fields here).
 
 Third-party / compatible API example:
 
 ```json
 {
-  "env": {
-    "ANTHROPIC_AUTH_TOKEN": "your-token",
-    "ANTHROPIC_BASE_URL": "https://your-api-endpoint",
-    "ANTHROPIC_MODEL": "glm-4.7"
+  "tools": {
+    "claude": {
+      "workDir": "/path/to/project",
+      "env": {
+        "ANTHROPIC_AUTH_TOKEN": "your-token",
+        "ANTHROPIC_BASE_URL": "https://your-api-endpoint",
+        "ANTHROPIC_MODEL": "glm-4.7"
+      }
+    }
   }
 }
 ```
@@ -114,7 +119,7 @@ Add Feishu, QQ, WeCom, DingTalk, WorkBuddy under **`platforms`** as needed. Run
 
 ### Environment variables
 
-Use **`config.json`** or environment variables; the dashboard exposes common options. Typical keys: **`ANTHROPIC_*`**, **`TELEGRAM_BOT_TOKEN`**, **`OPEN_IM_WEB_PORT`**, **`OPEN_IM_WEB_HOST`**, plus platform-specific `*_APP_ID`, `*_SECRET`, `WORKBUDDY_*`, etc.
+Use **`config.json`** (platforms, `tools.*`, etc.) or environment variables; the dashboard exposes common options. Typical keys: **`ANTHROPIC_*`** (shell or **`tools.claude.env`**), **`TELEGRAM_BOT_TOKEN`**, **`OPEN_IM_WEB_PORT`**, **`OPEN_IM_WEB_HOST`**, plus platform-specific `*_APP_ID`, `*_SECRET`, `WORKBUDDY_*`, etc. The root-level **`config.json` `env`** field is no longer read.
 
 ### Privacy
 

package/README.zh-CN.md

@@ -75,16 +75,21 @@ npx @wu529778790/open-im start
 
 ### Claude（Agent SDK）
 
-无需本地 `claude` 可执行文件。凭证顺序：环境变量 → **`config.json`** 的 **`env`** → **`~/.claude/settings.json`**。
+无需本地 `claude` 可执行文件。凭证顺序：环境变量 → **`config.json`** 的 **`tools.claude.env`** → **`~/.claude/settings.json`**（控制台保存的 API 配置写入后者）。
 
 第三方兼容接口示例：
 
 ```json
 {
-  "env": {
-    "ANTHROPIC_AUTH_TOKEN": "your-token",
-    "ANTHROPIC_BASE_URL": "https://your-api-endpoint",
-    "ANTHROPIC_MODEL": "glm-4.7"
+  "tools": {
+    "claude": {
+      "workDir": "/path/to/project",
+      "env": {
+        "ANTHROPIC_AUTH_TOKEN": "your-token",
+        "ANTHROPIC_BASE_URL": "https://your-api-endpoint",
+        "ANTHROPIC_MODEL": "glm-4.7"
+      }
+    }
   }
 }
 ```
@@ -114,7 +119,7 @@ codebuddy login
 
 ### 环境变量
 
-可在 **`config.json`** 或环境变量中设置；控制台会展示常用项。常见：**`ANTHROPIC_*`**、**`TELEGRAM_BOT_TOKEN`**、**`OPEN_IM_WEB_PORT`**、**`OPEN_IM_WEB_HOST`**，以及各平台的 `*_APP_ID`、`*_SECRET`、`WORKBUDDY_*` 等。
+可在 **`config.json`**（平台与 `tools.*` 等）或环境变量中设置；控制台会展示常用项。常见：**`ANTHROPIC_*`**（shell 或 **`tools.claude.env`**）、**`TELEGRAM_BOT_TOKEN`**、**`OPEN_IM_WEB_PORT`**、**`OPEN_IM_WEB_HOST`**，以及各平台的 `*_APP_ID`、`*_SECRET`、`WORKBUDDY_*` 等。根级 **`config.json` `env`** 已不再使用。
 
 ### 隐私
 

package/dist/adapters/codex-adapter.js

@@ -37,7 +37,7 @@ export class CodexAdapter {
             onError: (err) => {
                 const msg = typeof err === "string" ? err : String(err);
                 const friendly = msg.includes("Authentication") || msg.includes("login")
-                    ? "Codex 需要先登录。请在终端运行 codex login，或在 ~/.open-im/config.json 的 env 中添加 OPENAI_API_KEY。"
+                    ? "Codex 需要先登录。请在终端运行 codex login，或在 shell 中 export OPENAI_API_KEY。"
                     : msg.includes("stream disconnected") ||
                         msg.includes("error sending request") ||
                         msg.includes("Connection refused") ||

package/dist/codebuddy/cli-runner.js

@@ -2,6 +2,7 @@ import { execFileSync, spawn } from 'node:child_process';
 import { accessSync, constants } from 'node:fs';
 import { isAbsolute, join } from 'node:path';
 import { createLogger } from '../logger.js';
+import { processEnvForNonClaudeCliChild } from '../config/file-io.js';
 const log = createLogger('CodeBuddyCli');
 export function buildCodeBuddyArgs(prompt, sessionId, options) {
     const args = ['--print', '--output-format', 'stream-json'];
@@ -164,11 +165,7 @@ export function runCodeBuddy(cliPath, prompt, sessionId, workDir, callbacks, opt
         ...options,
         permissionMode: normalizePermissionMode(options?.permissionMode),
     });
-    const env = {};
-    for (const [key, value] of Object.entries(process.env)) {
-        if (value !== undefined)
-            env[key] = value;
-    }
+    const env = processEnvForNonClaudeCliChild();
     if (process.platform === 'win32') {
         env.LANG = env.LANG || 'C.UTF-8';
         env.LC_ALL = env.LC_ALL || 'C.UTF-8';

package/dist/codex/cli-runner.js

@@ -6,6 +6,7 @@ import { existsSync, readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { createInterface } from 'node:readline';
 import { createLogger } from '../logger.js';
+import { processEnvForNonClaudeCliChild } from '../config/file-io.js';
 const log = createLogger('CodexCli');
 const windowsCodexLaunchCache = new Map();
 const SUPPORTED_IMAGE_EXTENSIONS = new Set([
@@ -161,11 +162,7 @@ function resolveWindowsCodexLaunch(cliPath, args) {
 }
 export function runCodex(cliPath, prompt, sessionId, workDir, callbacks, options) {
     const args = buildCodexArgs(prompt, sessionId, workDir, options);
-    const env = {};
-    for (const [k, v] of Object.entries(process.env)) {
-        if (v !== undefined)
-            env[k] = v;
-    }
+    const env = processEnvForNonClaudeCliChild();
     if (options?.chatId)
         env.CC_IM_CHAT_ID = options.chatId;
     if (options?.hookPort)

package/dist/config/file-io.d.ts

@@ -3,6 +3,10 @@ export declare const CONFIG_PATH: string;
 export declare const CODEX_AUTH_PATHS: string[];
 /** Claude 认证相关的环境变量 key 列表 */
 export declare const CLAUDE_AUTH_ENV_KEYS: readonly ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_BASE_URL", "ANTHROPIC_MODEL"];
+/**
+ * 供非 Claude CLI 子进程使用的环境：拷贝当前 process.env，并移除 Anthropic/Claude 专用项。
+ */
+export declare function processEnvForNonClaudeCliChild(): Record<string, string>;
 export declare function loadFileConfig(): FileConfig;
 export declare function saveFileConfig(raw: FileConfig): void;
 export declare function getClaudeConfigHome(): string;
@@ -13,7 +17,8 @@ export declare function hasCodexAuth(): boolean;
 export declare function parseCommaSeparated(value: string): string[];
 /**
  * 将最新的 Claude 认证环境变量按优先级合并到 process.env。
- * 优先级：shell 环境变量 > tools.claude.env（config.json） > ~/.claude/settings.json
- * 启动时调用一次；cc switch 后再次调用即可生效。
+ * 优先级：shell 环境变量 > ~/.open-im/config.json 的 tools.claude.env >
+ * 本机 Claude 配置（~/.claude/settings.json，与 Claude Code 共用）。
+ * 多数用户只维护本机 settings；每次创建 Claude SDK 会话前调用，本机文件变更后下次会话即生效。
  */
 export declare function refreshClaudeEnvToProcess(): void;

package/dist/config/file-io.js

@@ -24,6 +24,29 @@ export const CLAUDE_AUTH_ENV_KEYS = [
     'ANTHROPIC_BASE_URL',
     'ANTHROPIC_MODEL',
 ];
+/**
+ * 不应传入 Codex / CodeBuddy 等子进程的环境变量。
+ * Claude 适配器会通过 refreshClaudeEnvToProcess 把这些写入 process.env；
+ * 若原样拷贝给 CLI 子进程，可能导致错误使用 ANTHROPIC_BASE_URL 等「访问地址」。
+ */
+const NON_CLAUDE_CLI_STRIP_KEYS = new Set([
+    ...CLAUDE_AUTH_ENV_KEYS,
+    'ANTHROPIC_DEFAULT_HAIKU_MODEL',
+    'ANTHROPIC_DEFAULT_SONNET_MODEL',
+    'ANTHROPIC_DEFAULT_OPUS_MODEL',
+]);
+/**
+ * 供非 Claude CLI 子进程使用的环境：拷贝当前 process.env，并移除 Anthropic/Claude 专用项。
+ */
+export function processEnvForNonClaudeCliChild() {
+    const env = {};
+    for (const [k, v] of Object.entries(process.env)) {
+        if (v === undefined || NON_CLAUDE_CLI_STRIP_KEYS.has(k))
+            continue;
+        env[k] = v;
+    }
+    return env;
+}
 // Config cache with mtime tracking
 let cachedConfig = null;
 let cachedClaudeEnv = null;
@@ -109,39 +132,61 @@ export function saveFileConfig(raw) {
 export function getClaudeConfigHome() {
     return process.env.HOME || process.env.USERPROFILE || homedir();
 }
+function claudeSettingsJsonPath(home) {
+    return join(home, '.claude', 'settings.json');
+}
+/**
+ * 从单个 Claude settings JSON 根对象解析 env（与 Claude Code 行为对齐）。
+ * - `env` 对象内字段优先于根上同名认证键
+ * - 根上可存在 ANTHROPIC_* / CLAUDE_CODE_OAUTH_TOKEN（部分用户或旧版会写在顶层）
+ */
+function extractAuthEnvFromClaudeSettingsRoot(raw) {
+    const out = {};
+    for (const key of CLAUDE_AUTH_ENV_KEYS) {
+        const v = raw[key];
+        if (v != null && typeof v === 'string' && v.length > 0) {
+            out[key] = v;
+        }
+    }
+    const env = raw.env;
+    if (env && typeof env === 'object' && !Array.isArray(env)) {
+        for (const [k, v] of Object.entries(env)) {
+            if (v != null && typeof k === 'string') {
+                out[k] = String(v);
+            }
+        }
+    }
+    return out;
+}
 export function loadClaudeSettingsEnv() {
     const home = getClaudeConfigHome();
-    const paths = [
-        join(home, '.claude', 'settings.json'),
-        join(home, '.claude.json'),
-    ];
-    for (const p of paths) {
-        try {
-            if (existsSync(p)) {
-                const stats = statSync(p);
-                const currentMtime = stats.mtimeMs;
-                if (cachedClaudeEnv && cachedClaudeEnv.mtime === currentMtime && cachedClaudeEnv.env) {
-                    return cachedClaudeEnv.env;
-                }
-                const raw = JSON.parse(readFileSync(p, 'utf-8'));
-                const env = raw?.env;
-                if (env && typeof env === 'object') {
-                    const result = {};
-                    for (const [k, v] of Object.entries(env)) {
-                        if (v != null && typeof k === 'string') {
-                            result[k] = String(v);
-                        }
-                    }
-                    cachedClaudeEnv = { env: result, mtime: currentMtime };
-                    return result;
-                }
-            }
+    const p = claudeSettingsJsonPath(home);
+    let fingerprint = '';
+    try {
+        if (existsSync(p)) {
+            fingerprint = `${p}:${statSync(p).mtimeMs}`;
         }
-        catch {
-            /* file not found or parse error, try next path */
+    }
+    catch {
+        /* ignore */
+    }
+    if (cachedClaudeEnv && cachedClaudeEnv.fingerprint === fingerprint) {
+        return cachedClaudeEnv.env;
+    }
+    let merged = {};
+    try {
+        if (existsSync(p)) {
+            const raw = JSON.parse(readFileSync(p, 'utf-8'));
+            if (raw && typeof raw === 'object') {
+                merged = extractAuthEnvFromClaudeSettingsRoot(raw);
+            }
         }
     }
-    return {};
+    catch {
+        /* 文件损坏或不可读 */
+    }
+    cachedClaudeEnv = { env: merged, fingerprint };
+    return merged;
 }
 export function saveClaudeSettingsEnv(env) {
     const home = getClaudeConfigHome();
@@ -191,8 +236,9 @@ export function parseCommaSeparated(value) {
 }
 /**
  * 将最新的 Claude 认证环境变量按优先级合并到 process.env。
- * 优先级：shell 环境变量 > tools.claude.env（config.json） > ~/.claude/settings.json
- * 启动时调用一次；cc switch 后再次调用即可生效。
+ * 优先级：shell 环境变量 > ~/.open-im/config.json 的 tools.claude.env >
+ * 本机 Claude 配置（~/.claude/settings.json，与 Claude Code 共用）。
+ * 多数用户只维护本机 settings；每次创建 Claude SDK 会话前调用，本机文件变更后下次会话即生效。
  */
 export function refreshClaudeEnvToProcess() {
     const file = loadFileConfig();

package/dist/config/types.d.ts

@@ -182,7 +182,6 @@ export interface FileConfig {
         dingtalk?: FilePlatformDingtalk;
         workbuddy?: FilePlatformWorkBuddy;
     };
-    env?: Record<string, string>;
     aiCommand?: string;
     tools?: {
         claude?: FileToolClaude;

package/dist/config-web-page-i18n.d.ts

@@ -99,6 +99,8 @@ export declare const PAGE_TEXTS: {
         readonly codexCli: "Codex CLI path";
         readonly codebuddyCli: "CodeBuddy CLI path";
         readonly codexProxy: "Codex proxy";
+        readonly codexApiKey: "OPENAI_API_KEY";
+        readonly codexApiKeyTip: "Set the OpenAI API key used by Codex. You can also edit the auth file below.";
         readonly claudeConfigPath: "Config file location";
         readonly claudeAuthToken: "ANTHROPIC_AUTH_TOKEN";
         readonly claudeBaseUrl: "ANTHROPIC_BASE_URL";
@@ -129,8 +131,9 @@ export declare const PAGE_TEXTS: {
         readonly configEditorTitle: "Config Editor";
         readonly configEditorHint: "Edit ~/.open-im/config.json directly";
         readonly claudeSettingsLabel: "~/.claude/settings.json";
+        readonly codexSettingsLabel: "~/.codex/auth.json";
+        readonly codexSettingsCardHint: "Codex CLI auth (OPENAI_API_KEY etc.). Set API access here, or use the OPENAI_API_KEY field in the Codex tool tab.";
         readonly configJson: "~/.open-im/config.json";
-        readonly configJsonHint: "Edit the configuration JSON. Changes will be saved when you click \"Save Config\" in the Service section.";
         readonly formatJson: "Format";
         readonly resetJson: "Reset";
         readonly saveBtn: "Save";
@@ -248,6 +251,8 @@ export declare const PAGE_TEXTS: {
         readonly codexCli: "Codex CLI 路径";
         readonly codebuddyCli: "CodeBuddy CLI 路径";
         readonly codexProxy: "Codex 代理";
+        readonly codexApiKey: "OPENAI_API_KEY";
+        readonly codexApiKeyTip: "设置 Codex 使用的 OpenAI API Key。也可以在下方编辑 auth 文件。";
         readonly claudeConfigPath: "配置文件位置";
         readonly claudeProxy: "代理（可选）";
         readonly hookPort: "Hook 端口";
@@ -275,6 +280,8 @@ export declare const PAGE_TEXTS: {
         readonly configEditorTitle: "JSON 配置编辑器";
         readonly configEditorHint: "直接编辑 ~/.open-im/config.json";
         readonly claudeSettingsLabel: "~/.claude/settings.json";
+        readonly codexSettingsLabel: "~/.codex/auth.json";
+        readonly codexSettingsCardHint: "Codex CLI 认证信息（OPENAI_API_KEY 等）。在此配置 API 访问，或在 Codex 工具标签页填写 OPENAI_API_KEY。";
         readonly configJson: "~/.open-im/config.json";
         readonly configJsonHint: "编辑配置 JSON。点击服务区的“保存配置”按钮后侘存更改。";
         readonly formatJson: "格式化";

package/dist/config-web-page-i18n.js

@@ -99,6 +99,8 @@ export const PAGE_TEXTS = {
         codexCli: "Codex CLI path",
         codebuddyCli: "CodeBuddy CLI path",
         codexProxy: "Codex proxy",
+        codexApiKey: "OPENAI_API_KEY",
+        codexApiKeyTip: "Set the OpenAI API key used by Codex. You can also edit the auth file below.",
         claudeConfigPath: "Config file location",
         claudeAuthToken: "ANTHROPIC_AUTH_TOKEN",
         claudeBaseUrl: "ANTHROPIC_BASE_URL",
@@ -129,8 +131,9 @@ export const PAGE_TEXTS = {
         configEditorTitle: "Config Editor",
         configEditorHint: "Edit ~/.open-im/config.json directly",
         claudeSettingsLabel: "~/.claude/settings.json",
+        codexSettingsLabel: "~/.codex/auth.json",
+        codexSettingsCardHint: "Codex CLI auth (OPENAI_API_KEY etc.). Set API access here, or use the OPENAI_API_KEY field in the Codex tool tab.",
         configJson: "~/.open-im/config.json",
-        configJsonHint: "Edit the configuration JSON. Changes will be saved when you click \"Save Config\" in the Service section.",
         formatJson: "Format",
         resetJson: "Reset",
         saveBtn: "Save",
@@ -248,6 +251,8 @@ export const PAGE_TEXTS = {
         codexCli: "Codex CLI \u8def\u5f84",
         codebuddyCli: "CodeBuddy CLI \u8def\u5f84",
         codexProxy: "Codex \u4ee3\u7406",
+        codexApiKey: "OPENAI_API_KEY",
+        codexApiKeyTip: "\u8bbe\u7f6e Codex \u4f7f\u7528\u7684 OpenAI API Key\u3002\u4e5f\u53ef\u4ee5\u5728\u4e0b\u65b9\u7f16\u8f91 auth \u6587\u4ef6\u3002",
         claudeConfigPath: "\u914d\u7f6e\u6587\u4ef6\u4f4d\u7f6e",
         claudeProxy: "\u4ee3\u7406\uff08\u53ef\u9009\uff09",
         hookPort: "Hook \u7aef\u53e3",
@@ -275,6 +280,8 @@ export const PAGE_TEXTS = {
         configEditorTitle: "JSON \u914d\u7f6e\u7f16\u8f91\u5668",
         configEditorHint: "\u76f4\u63a5\u7f16\u8f91 ~/.open-im/config.json",
         claudeSettingsLabel: "~/.claude/settings.json",
+        codexSettingsLabel: "~/.codex/auth.json",
+        codexSettingsCardHint: "Codex CLI \u8ba4\u8bc1\u4fe1\u606f\uff08OPENAI_API_KEY \u7b49\uff09\u3002\u5728\u6b64\u914d\u7f6e API \u8bbf\u95ee\uff0c\u6216\u5728 Codex \u5de5\u5177\u6807\u7b7e\u9875\u586b\u5199 OPENAI_API_KEY\u3002",
         configJson: "~/.open-im/config.json",
         configJsonHint: "\u7f16\u8f91\u914d\u7f6e JSON\u3002\u70b9\u51fb\u670d\u52a1\u533a\u7684\u201c\u4fdd\u5b58\u914d\u7f6e\u201d\u6309\u94ae\u540e\u4f98\u5b58\u66f4\u6539\u3002",
         formatJson: "\u683c\u5f0f\u5316",

package/dist/config-web.js

@@ -6,7 +6,7 @@ import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { DWClient } from "dingtalk-stream";
 import { WEB_CONFIG_PORT, getPublicWebDashboardUrl } from "./constants.js";
-import { CONFIG_PATH, getClaudeConfigHome, loadClaudeSettingsEnv, saveClaudeSettingsEnv, loadConfig, loadFileConfig, saveFileConfig } from "./config.js";
+import { CONFIG_PATH, getClaudeConfigHome, loadClaudeSettingsEnv, saveClaudeSettingsEnv, loadConfig, loadFileConfig, saveFileConfig, CODEX_AUTH_PATHS } from "./config.js";
 import { getWebDistDir, tryServeDashboardStatic } from "./config-web-static.js";
 import { getServiceStatus, startBackgroundService, stopBackgroundService } from "./service-control.js";
 import { initWeWork, stopWeWork } from "./wework/client.js";
@@ -333,6 +333,22 @@ function buildInitialPayload(file) {
             codexCliPath: file.tools?.codex?.cliPath ?? "codex",
             codebuddyCliPath: file.tools?.codebuddy?.cliPath ?? "codebuddy",
             codexProxy: file.tools?.codex?.proxy ?? "",
+            codexApiKey: (() => {
+                if (process.env.OPENAI_API_KEY)
+                    return maskSecret(process.env.OPENAI_API_KEY);
+                for (const p of CODEX_AUTH_PATHS) {
+                    try {
+                        if (existsSync(p)) {
+                            const raw = JSON.parse(readFileSync(p, "utf-8"));
+                            const key = raw?.openai_api_key ?? raw?.apiKey;
+                            if (typeof key === "string" && key)
+                                return maskSecret(key);
+                        }
+                    }
+                    catch { /* ignore */ }
+                }
+                return "";
+            })(),
             logDir: file.logDir ?? "",
             logLevel: file.logLevel ?? "default",
         },
@@ -615,8 +631,9 @@ function toFileConfig(payload, existing) {
         saveClaudeSettingsEnv(claudeEnv);
     }
     // claudeConfigPath is informational only, not saved
+    const { env: _discardLegacyRootEnv, ...existingWithoutRootEnv } = existing;
     return {
-        ...existing,
+        ...existingWithoutRootEnv,
         aiCommand: payload.ai.aiCommand,
         logDir: payload.ai.logDir === undefined ? existing.logDir : clean(payload.ai.logDir),
         logLevel: payload.ai.logLevel === "default" ? undefined : payload.ai.logLevel,
@@ -883,6 +900,15 @@ export async function startWebConfigServer(options) {
                     return;
                 }
                 saveFileConfig(toFileConfig(body, loadFileConfig()));
+                // Save Codex OPENAI_API_KEY to ~/.codex/auth.json if provided
+                const codexApiKey = clean(body.ai.codexApiKey);
+                if (codexApiKey && !isMasked(codexApiKey)) {
+                    const codexAuthPath = CODEX_AUTH_PATHS[0];
+                    const codexDir = dirname(codexAuthPath);
+                    if (!existsSync(codexDir))
+                        mkdirSync(codexDir, { recursive: true });
+                    writeFileSync(codexAuthPath, JSON.stringify({ openai_api_key: codexApiKey }, null, 2), "utf-8");
+                }
                 loadConfig();
                 json(response, 200, { message: "Configuration saved." }, request);
                 if (!options.persistent && requestUrl.searchParams.get("final") === "1") {
@@ -949,6 +975,56 @@ export async function startWebConfigServer(options) {
             }
             return;
         }
+        // --- Codex settings (auth.json) ---
+        if (request.method === "GET" && requestUrl.pathname === "/api/codex/settings") {
+            try {
+                let foundPath = "";
+                let contents = "{}";
+                for (const p of CODEX_AUTH_PATHS) {
+                    if (existsSync(p)) {
+                        foundPath = p;
+                        contents = readFileSync(p, "utf-8");
+                        break;
+                    }
+                }
+                if (!foundPath && CODEX_AUTH_PATHS.length > 0) {
+                    foundPath = CODEX_AUTH_PATHS[0];
+                }
+                json(response, 200, { path: foundPath, contents }, request);
+            }
+            catch (error) {
+                json(response, 500, { error: error instanceof Error ? error.message : String(error) }, request);
+            }
+            return;
+        }
+        if (request.method === "POST" && requestUrl.pathname === "/api/codex/settings") {
+            try {
+                const body = await readJson(request);
+                const raw = body.contents ?? "";
+                if (!raw.trim()) {
+                    json(response, 400, { error: "contents is required" }, request);
+                    return;
+                }
+                try {
+                    JSON.parse(raw);
+                }
+                catch (err) {
+                    json(response, 400, { error: `Invalid JSON: ${err instanceof Error ? err.message : String(err)}` }, request);
+                    return;
+                }
+                const settingsPath = CODEX_AUTH_PATHS[0];
+                const dir = dirname(settingsPath);
+                if (!existsSync(dir)) {
+                    mkdirSync(dir, { recursive: true });
+                }
+                writeFileSync(settingsPath, raw, "utf-8");
+                json(response, 200, { message: "Codex settings saved.", path: settingsPath }, request);
+            }
+            catch (error) {
+                json(response, 500, { error: error instanceof Error ? error.message : String(error) }, request);
+            }
+            return;
+        }
         if (request.method === "GET" && requestUrl.pathname === "/api/health") {
             const file = loadFileConfig();
             const platforms = getHealthPlatformSnapshot(file);

package/dist/config.d.ts

@@ -1,6 +1,6 @@
 export type { Platform, AiCommand, Config, FilePlatformTelegram, FilePlatformFeishu, FilePlatformQQ, FilePlatformWechat, FilePlatformWework, FilePlatformDingtalk, FilePlatformWorkBuddy, FileToolClaude, FileToolCodex, FileToolCodeBuddy, FileConfig, } from './config/types.js';
 import type { Platform, AiCommand, Config } from './config/types.js';
-export { CONFIG_PATH, loadFileConfig, saveFileConfig, getClaudeConfigHome, loadClaudeSettingsEnv, saveClaudeSettingsEnv, normalizeAiCommand, hasCodexAuth, parseCommaSeparated, CLAUDE_AUTH_ENV_KEYS, refreshClaudeEnvToProcess, } from './config/file-io.js';
+export { CONFIG_PATH, loadFileConfig, saveFileConfig, getClaudeConfigHome, loadClaudeSettingsEnv, saveClaudeSettingsEnv, normalizeAiCommand, hasCodexAuth, parseCommaSeparated, CLAUDE_AUTH_ENV_KEYS, refreshClaudeEnvToProcess, processEnvForNonClaudeCliChild, CODEX_AUTH_PATHS, } from './config/file-io.js';
 /** 检测是否需要交互式配置（无 token 且无环境变量） */
 export declare function needsSetup(): boolean;
 export declare function loadConfig(): Config;

package/dist/config.js

@@ -11,7 +11,7 @@ import { createLogger } from './logger.js';
 import { APP_HOME, DEFAULT_TELEMETRY_INGEST_URL, DEFAULT_TELEMETRY_INGEST_TOKEN, } from './constants.js';
 const log = createLogger('config');
 // Re-export file I/O and credential helpers from sub-modules
-export { CONFIG_PATH, loadFileConfig, saveFileConfig, getClaudeConfigHome, loadClaudeSettingsEnv, saveClaudeSettingsEnv, normalizeAiCommand, hasCodexAuth, parseCommaSeparated, CLAUDE_AUTH_ENV_KEYS, refreshClaudeEnvToProcess, } from './config/file-io.js';
+export { CONFIG_PATH, loadFileConfig, saveFileConfig, getClaudeConfigHome, loadClaudeSettingsEnv, saveClaudeSettingsEnv, normalizeAiCommand, hasCodexAuth, parseCommaSeparated, CLAUDE_AUTH_ENV_KEYS, refreshClaudeEnvToProcess, processEnvForNonClaudeCliChild, CODEX_AUTH_PATHS, } from './config/file-io.js';
 import { loadFileConfig, normalizeAiCommand, hasCodexAuth, parseCommaSeparated, loadClaudeSettingsEnv, } from './config/file-io.js';
 /** 检测是否需要交互式配置（无 token 且无环境变量） */
 export function needsSetup() {
@@ -50,20 +50,8 @@ export function needsSetup() {
 }
 export function loadConfig() {
     const file = loadFileConfig();
-    // 将配置文件中的 env 设置到环境变量（优先级低于现有环境变量）
-    const mergeEnv = (env) => {
-        for (const [key, value] of Object.entries(env)) {
-            if (!(key in process.env) && value != null && typeof key === 'string') {
-                process.env[key] = String(value);
-            }
-        }
-    };
-    // 1. 全局 env（最低优先级之一）
-    if (file.env)
-        mergeEnv(file.env);
-    // 2. tools.claude.env 和 Claude Code 的 ~/.claude/settings.json 不在此处合并到 process.env，
-    //    改由 Claude adapter 在创建 session 前按需加载（refreshClaudeEnvToProcess），
-    //    避免 Claude 凭证泄漏到 Codex / CodeBuddy 等子进程。
+    // tools.claude.env 与 ~/.claude/settings.json 不在此处合并到 process.env，
+    // 由 Claude adapter 在创建 session 前 refreshClaudeEnvToProcess，避免污染 Codex/CodeBuddy 子进程。
     const fileTelegram = file.platforms?.telegram;
     const fileFeishu = file.platforms?.feishu;
     const fileQQ = file.platforms?.qq;
@@ -309,7 +297,7 @@ export function loadConfig() {
         }
         if (!hasCodexAuth()) {
             log.warn('Codex 模式：未检测到 OPENAI_API_KEY 或 Codex 登录态。首次使用请先运行 codex login，' +
-                '或在 ~/.open-im/config.json 的 env 中添加 "OPENAI_API_KEY": "你的 API Key"。');
+                '或在 shell 中 export OPENAI_API_KEY。');
         }
     }
     // 8. 校验 CodeBuddy CLI（使用 codebuddy 时）

package/dist/setup.js

@@ -709,23 +709,25 @@ export async function runInteractiveSetup() {
     // 如果选择 Claude，询问 API 配置
     let claudeApiConfig = {};
     if (commonResp.aiCommand === "claude") {
-        // 检查是否已配置 API 密钥（环境变量、open-im config、或 ~/.claude/settings.json）
+        const legacyRootEnv = existing?.env;
+        const claudeFileEnv = existing?.tools?.claude?.env ?? legacyRootEnv;
+        // 检查是否已配置 API 密钥（环境变量、tools.claude.env、旧版根 env、或 ~/.claude/settings.json）
         const hasExistingApiKey = !!(process.env.ANTHROPIC_API_KEY ||
             process.env.ANTHROPIC_AUTH_TOKEN ||
             process.env.CLAUDE_CODE_OAUTH_TOKEN ||
-            existing?.env?.ANTHROPIC_API_KEY ||
-            existing?.env?.ANTHROPIC_AUTH_TOKEN ||
+            claudeFileEnv?.ANTHROPIC_API_KEY ||
+            claudeFileEnv?.ANTHROPIC_AUTH_TOKEN ||
             hasClaudeCredsInSettings());
         if (hasExistingApiKey) {
             // 已经配置过，直接保留原有配置，跳过询问
-            if (existing?.env) {
+            if (claudeFileEnv && Object.keys(claudeFileEnv).length > 0) {
                 claudeApiConfig = {
-                    apiKey: existing.env.ANTHROPIC_API_KEY || existing.env.ANTHROPIC_AUTH_TOKEN,
-                    baseUrl: existing.env.ANTHROPIC_BASE_URL,
-                    model: existing.env.ANTHROPIC_MODEL,
-                    haikuModel: existing.env.ANTHROPIC_DEFAULT_HAIKU_MODEL,
-                    sonnetModel: existing.env.ANTHROPIC_DEFAULT_SONNET_MODEL,
-                    opusModel: existing.env.ANTHROPIC_DEFAULT_OPUS_MODEL,
+                    apiKey: claudeFileEnv.ANTHROPIC_API_KEY || claudeFileEnv.ANTHROPIC_AUTH_TOKEN,
+                    baseUrl: claudeFileEnv.ANTHROPIC_BASE_URL,
+                    model: claudeFileEnv.ANTHROPIC_MODEL,
+                    haikuModel: claudeFileEnv.ANTHROPIC_DEFAULT_HAIKU_MODEL,
+                    sonnetModel: claudeFileEnv.ANTHROPIC_DEFAULT_SONNET_MODEL,
+                    opusModel: claudeFileEnv.ANTHROPIC_DEFAULT_OPUS_MODEL,
                 };
             }
         }
@@ -805,18 +807,7 @@ export async function runInteractiveSetup() {
     const base = existing
         ? JSON.parse(JSON.stringify(existing))
         : null;
-    const { telegramBotToken: _, feishuAppId: __, feishuAppSecret: ___, claudeWorkDir: _cwd, claudeTimeoutMs: _ctm, claudeModel: _cm, ...baseRest } = (base ?? {});
-    // Claude API 凭证不存入 config.json，仅从 ~/.claude/settings.json 或环境变量读取
-    const ANTHROPIC_KEYS = [
-        "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_BASE_URL",
-        "ANTHROPIC_MODEL", "ANTHROPIC_DEFAULT_HAIKU_MODEL", "ANTHROPIC_DEFAULT_SONNET_MODEL", "ANTHROPIC_DEFAULT_OPUS_MODEL",
-    ];
-    const envConfig = {};
-    for (const [k, v] of Object.entries(base?.env ?? {})) {
-        if (v != null && typeof v === "string" && !ANTHROPIC_KEYS.includes(k)) {
-            envConfig[k] = v;
-        }
-    }
+    const { telegramBotToken: _, feishuAppId: __, feishuAppSecret: ___, claudeWorkDir: _cwd, claudeTimeoutMs: _ctm, claudeModel: _cm, env: _stripLegacyRootEnv, ...baseRest } = (base ?? {});
     // 若用户在向导中输入了 Claude 配置，写入 ~/.claude/settings.json（与 Claude Code 共用）
     if (claudeApiConfig.apiKey || claudeApiConfig.baseUrl || claudeApiConfig.model) {
         const claudeExisting = loadClaudeSettings();
@@ -854,7 +845,6 @@ export async function runInteractiveSetup() {
     const out = {
         ...baseRest,
         platforms: { ...(base?.platforms ?? {}) },
-        env: Object.keys(envConfig).length > 0 ? envConfig : undefined,
         aiCommand: aiCmd,
         tools: {
             claude: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wu529778790/open-im",
-  "version": "1.10.5",
+  "version": "1.10.6-beta.0",
   "description": "Multi-platform IM bridge for AI CLI tools (Claude, Codex, CodeBuddy)",
   "type": "module",
   "main": "dist/index.js",