abelworkflow 0.2.0 → 0.6.0

package/bin/abelworkflow.mjs

@@ -1,2 +1,7 @@
 #!/usr/bin/env node
-import "../lib/cli.mjs";
+import { main } from "../lib/cli.mjs";
+
+main().catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+});

package/lib/cli.mjs

@@ -12,10 +12,14 @@ const home = homedir();
 const defaultAgentsDir = join(home, ".agents");
 const installMetadataName = ".abelworkflow-install.json";
 const claudeSettingsPath = join(home, ".claude", "settings.json");
-const claudeVscodeConfigPath = join(home, ".claude", "config.json");
 const claudeMetaConfigPath = join(home, ".claude.json");
 const codexConfigPath = join(home, ".codex", "config.toml");
 const codexAuthPath = join(home, ".codex", "auth.json");
+const codexTemplateRoot = join(packageRoot, "lib", "templates", "codex");
+const codexTemplateConfigPath = join(codexTemplateRoot, "config-base.toml");
+const codexTemplateAgentsPath = join(codexTemplateRoot, "agents");
+const installBackupStamp = Date.now();
+const createdBackupPaths = new Set();
 const claudeModelEnvKeys = [
   "ANTHROPIC_MODEL",
   "ANTHROPIC_DEFAULT_OPUS_MODEL",
@@ -222,17 +226,38 @@ async function pathTargetExists(path) {
   }
 }
 
+async function createBackupPath(targetPath) {
+  let index = 0;
+  while (true) {
+    const backupPath = `${targetPath}.bak.${installBackupStamp}${index ? `-${index}` : ""}`;
+    if (!(await pathExists(backupPath))) {
+      return backupPath;
+    }
+    index += 1;
+  }
+}
+
+async function backupExistingPath(targetPath) {
+  if (createdBackupPaths.has(targetPath) || !(await pathExists(targetPath))) {
+    return null;
+  }
+
+  const backupPath = await createBackupPath(targetPath);
+  await cp(targetPath, backupPath, { recursive: true, force: false });
+  createdBackupPaths.add(targetPath);
+  console.log(`已备份已有配置: ${pathToLabel(targetPath)} -> ${pathToLabel(backupPath)}`);
+  return backupPath;
+}
+
 async function backupIfNeeded(targetPath, force) {
   if (!(await pathExists(targetPath))) {
     return null;
   }
-  if (!force) {
-    const backupPath = `${targetPath}.bak.${Date.now()}`;
-    await rename(targetPath, backupPath);
-    return backupPath;
-  }
-  await rm(targetPath, { recursive: true, force: true });
-  return null;
+
+  const backupPath = await createBackupPath(targetPath);
+  await rename(targetPath, backupPath);
+  console.log(`已备份已有配置: ${pathToLabel(targetPath)} -> ${pathToLabel(backupPath)}`);
+  return backupPath;
 }
 
 async function syncManagedFiles(agentsDir) {
@@ -298,8 +323,10 @@ async function replaceManagedEntry(source, target, entry) {
 
   const sourceStat = await lstat(source);
   if (sourceStat.isDirectory()) {
+    await backupExistingPath(target);
     await rm(target, { recursive: true, force: true });
   } else if (await pathExists(target)) {
+    await backupExistingPath(target);
     const targetStat = await lstat(target);
     if (targetStat.isDirectory()) {
       await rm(target, { recursive: true, force: true });
@@ -850,6 +877,11 @@ async function writeJsonFileSafe(path, data) {
   await writeFile(path, `${JSON.stringify(data, null, 2)}\n`, "utf8");
 }
 
+async function writeJsonFileWithBackup(path, data) {
+  await backupExistingPath(path);
+  await writeJsonFileSafe(path, data);
+}
+
 function parseDotenv(content) {
   const values = {};
   for (const rawLine of content.split(/\r?\n/u)) {
@@ -912,6 +944,7 @@ async function updateDotenvFile(path, updates) {
       current[key] = String(value);
     }
   }
+  await backupExistingPath(path);
   await mkdir(dirname(path), { recursive: true });
   await writeFile(path, renderDotenv(current), "utf8");
 }
@@ -1276,54 +1309,90 @@ async function configureClaudeApi() {
     nextSettings.env[field] = model;
   }
 
-  await writeJsonFileSafe(claudeSettingsPath, nextSettings);
-
-  const vscodeConfig = await readJsonFileSafe(claudeVscodeConfigPath, {});
-  vscodeConfig.primaryApiKey = "abelworkflow";
-  await writeJsonFileSafe(claudeVscodeConfigPath, vscodeConfig);
+  await writeJsonFileWithBackup(claudeSettingsPath, nextSettings);
 
   const metaConfig = await readJsonFileSafe(claudeMetaConfigPath, {});
   metaConfig.hasCompletedOnboarding = true;
   ensureApprovedClaudeApiKey(metaConfig, key);
-  await writeJsonFileSafe(claudeMetaConfigPath, metaConfig);
+  await writeJsonFileWithBackup(claudeMetaConfigPath, metaConfig);
 
   console.log(`已更新 ${pathToLabel(claudeSettingsPath)} (${authType}, ${baseUrl}, ${maskSecret(key)})`);
 }
 
 function updateTopLevelTomlField(content, field, value) {
   const lineEnding = detectLineEnding(content);
-  const firstSectionMatch = content.match(/^\[/mu);
-  const topLevelEnd = firstSectionMatch?.index ?? content.length;
-  let topLevel = content.slice(0, topLevelEnd);
-  const rest = content.slice(topLevelEnd);
-  const fieldRegex = new RegExp(`^(#\\s*)?${escapeRegExp(field)}\\s*=\\s*["'][^"']*["'][ \\t]*(?:#.*)?\\r?$`, "mu");
-
   if (value === null) {
-    topLevel = collapseBlankLines(topLevel.replace(fieldRegex, ""), lineEnding);
-  } else {
-    const nextLine = `${field} = ${JSON.stringify(value)}`;
-    if (fieldRegex.test(topLevel)) {
-      topLevel = topLevel.replace(fieldRegex, nextLine);
-    } else {
-      topLevel = topLevel.trimEnd()
-        ? `${topLevel.trimEnd()}${lineEnding}${nextLine}${lineEnding}`
-        : `${nextLine}${lineEnding}`;
+    return removeTopLevelTomlField(content, field);
+  }
+
+  const { topLevel, rest } = splitTopLevelTomlContent(content);
+  const entry = extractTopLevelTomlEntries(content).find((item) => item.field === field);
+  const nextLine = `${field} = ${JSON.stringify(value)}`;
+  let nextTopLevel;
+
+  if (entry) {
+    const start = topLevel.indexOf(entry.raw);
+    if (start === -1) {
+      return content;
     }
+    nextTopLevel = `${topLevel.slice(0, start)}${nextLine}${topLevel.slice(start + entry.raw.length)}`;
+  } else {
+    nextTopLevel = topLevel.trimEnd()
+      ? `${topLevel.trimEnd()}${lineEnding}${nextLine}${lineEnding}`
+      : `${nextLine}${lineEnding}`;
+  }
+
+  nextTopLevel = nextTopLevel.trimEnd();
+
+  if (rest && nextTopLevel) {
+    nextTopLevel = `${nextTopLevel}${lineEnding}${lineEnding}`;
+  }
+
+  return `${nextTopLevel}${rest}`;
+}
+
+function removeTopLevelTomlField(content, field) {
+  const lineEnding = detectLineEnding(content);
+  const { topLevel, rest } = splitTopLevelTomlContent(content);
+  const entry = extractTopLevelTomlEntries(content).find((item) => item.field === field);
+  if (!entry) {
+    return content;
+  }
+
+  const start = topLevel.indexOf(entry.raw);
+  if (start === -1) {
+    return content;
   }
 
-  topLevel = topLevel.trimEnd();
+  let nextTopLevel = `${topLevel.slice(0, start)}${topLevel.slice(start + entry.raw.length)}`;
+  nextTopLevel = collapseBlankLines(nextTopLevel, lineEnding).trimEnd();
 
-  if (rest && topLevel) {
-    topLevel = `${topLevel}${lineEnding}${lineEnding}`;
+  if (rest && nextTopLevel) {
+    nextTopLevel = `${nextTopLevel}${lineEnding}${lineEnding}`;
   }
 
-  return `${topLevel}${rest}`;
+  return `${nextTopLevel}${rest}`;
 }
 
 function removeTomlSection(content, sectionName) {
   const lineEnding = detectLineEnding(content);
-  const sectionRegex = new RegExp(`(?:\\r?\\n)?\\[${escapeRegExp(sectionName)}\\][\\s\\S]*?(?=\\r?\\n\\[|$)`, "gu");
-  return collapseBlankLines(content.replace(sectionRegex, ""), lineEnding).trimEnd();
+  const sectionHeaderRegex = new RegExp(
+    `(?:^|\\r?\\n)\\[${escapeRegExp(sectionName)}\\](?:[ \\t]+#.*)?[ \\t]*\\r?$`,
+    "mu"
+  );
+  const headerMatch = sectionHeaderRegex.exec(content);
+  if (!headerMatch) {
+    return content;
+  }
+
+  const sectionStart = headerMatch[0].startsWith("\n") || headerMatch[0].startsWith("\r\n")
+    ? headerMatch.index + headerMatch[0].indexOf("[")
+    : headerMatch.index;
+  const headerLineEnd = content.indexOf(lineEnding, sectionStart);
+  const bodyStart = headerLineEnd === -1 ? content.length : headerLineEnd + lineEnding.length;
+  const nextSectionStart = findTomlSectionStart(content, bodyStart);
+  const sectionEnd = nextSectionStart === -1 ? content.length : nextSectionStart;
+  return collapseBlankLines(`${content.slice(0, sectionStart)}${content.slice(sectionEnd)}`, lineEnding).trimEnd();
 }
 
 function buildTomlSection(sectionName, values, lineEnding = "\n") {
@@ -1343,18 +1412,235 @@ function buildTomlSection(sectionName, values, lineEnding = "\n") {
   return `${lines.join(lineEnding)}${lineEnding}`;
 }
 
-function readTopLevelTomlString(content, field) {
-  let inSection = false;
-  for (const line of content.split(/\r?\n/u)) {
+function formatTomlValue(value) {
+  if (typeof value === "string") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "boolean") {
+    return value ? "true" : "false";
+  }
+  return String(value);
+}
+
+function getTomlLines(content) {
+  if (!content) {
+    return [];
+  }
+
+  const chunks = content.match(/[^\r\n]*(?:\r?\n|$)/gu) || [];
+  const lines = [];
+  let offset = 0;
+
+  for (const chunk of chunks) {
+    if (!chunk && offset >= content.length) {
+      break;
+    }
+
+    const lineEndingMatch = chunk.match(/\r?\n$/u);
+    const lineEnding = lineEndingMatch ? lineEndingMatch[0] : "";
+    lines.push({
+      line: lineEnding ? chunk.slice(0, -lineEnding.length) : chunk,
+      start: offset
+    });
+    offset += chunk.length;
+
+    if (!lineEnding && offset >= content.length) {
+      break;
+    }
+  }
+
+  return lines;
+}
+
+function findTomlSectionStart(content, fromIndex = 0) {
+  const scopedContent = content.slice(fromIndex);
+  let multilineDelimiter = "";
+
+  for (const { line, start } of getTomlLines(scopedContent)) {
+    const trimmed = line.trim();
+
+    if (multilineDelimiter) {
+      if (line.includes(multilineDelimiter)) {
+        multilineDelimiter = "";
+      }
+      continue;
+    }
+
+    if (!trimmed || trimmed.startsWith("#")) {
+      continue;
+    }
+
+    if (/^\[[^\]]+\]\s*(?:#.*)?$/u.test(trimmed)) {
+      return fromIndex + start;
+    }
+
+    const match = line.match(/^\s*([A-Za-z0-9_]+)\s*=\s*(.*)$/u);
+    if (!match) {
+      continue;
+    }
+
+    const delimiter = getTomlMultilineStringDelimiter(match[2].trimStart());
+    if (delimiter && match[2].indexOf(delimiter, delimiter.length) === -1) {
+      multilineDelimiter = delimiter;
+    }
+  }
+
+  return -1;
+}
+
+function splitTopLevelTomlContent(content) {
+  const topLevelEnd = findTomlSectionStart(content);
+  return {
+    topLevel: topLevelEnd === -1 ? content : content.slice(0, topLevelEnd),
+    rest: topLevelEnd === -1 ? "" : content.slice(topLevelEnd)
+  };
+}
+
+function getTomlMultilineStringDelimiter(value) {
+  if (value.startsWith(`"""`)) {
+    return `"""`;
+  }
+  if (value.startsWith(`'''`)) {
+    return `'''`;
+  }
+  return "";
+}
+
+function extractTopLevelTomlEntries(content) {
+  const { topLevel } = splitTopLevelTomlContent(content);
+  const lineEnding = detectLineEnding(topLevel);
+  const lines = topLevel.split(/\r?\n/u);
+  const entries = [];
+
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index];
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) {
       continue;
     }
-    if (trimmed.startsWith("[") && trimmed.endsWith("]")) {
-      inSection = true;
+
+    const match = line.match(/^\s*([A-Za-z0-9_]+)\s*=\s*(.*)$/u);
+    if (!match) {
+      continue;
+    }
+
+    const rawLines = [line];
+    const delimiter = getTomlMultilineStringDelimiter(match[2].trimStart());
+    if (delimiter && match[2].indexOf(delimiter, delimiter.length) === -1) {
+      for (index += 1; index < lines.length; index += 1) {
+        rawLines.push(lines[index]);
+        if (lines[index].includes(delimiter)) {
+          break;
+        }
+      }
+    }
+
+    entries.push({
+      field: match[1],
+      raw: rawLines.join(lineEnding)
+    });
+  }
+
+  return entries;
+}
+
+function mergeMissingTopLevelTomlEntries(content, entries) {
+  if (!entries.length) {
+    return content;
+  }
+
+  const lineEnding = detectLineEnding(content);
+  const { topLevel, rest } = splitTopLevelTomlContent(content);
+  const existingFields = new Set(extractTopLevelTomlEntries(content).map(({ field }) => field));
+  const missingEntries = entries.filter(({ field }) => !existingFields.has(field));
+  if (!missingEntries.length) {
+    return content;
+  }
+
+  let nextTopLevel = topLevel.trimEnd();
+  for (const entry of missingEntries) {
+    nextTopLevel = nextTopLevel
+      ? `${nextTopLevel}${lineEnding}${entry.raw}`
+      : entry.raw;
+  }
+
+  nextTopLevel = nextTopLevel.trimEnd();
+  if (rest && nextTopLevel) {
+    nextTopLevel = `${nextTopLevel}${lineEnding}${lineEnding}`;
+  }
+  return `${nextTopLevel}${rest}`;
+}
+
+function updateTomlBodyFields(body, values, lineEnding = "\n") {
+  const normalizedBody = body.replace(/\r?\n$/u, "");
+  const lines = normalizedBody ? normalizedBody.split(/\r?\n/u) : [];
+  const remaining = new Map(
+    Object.entries(values).filter(([, value]) => value !== undefined && value !== null && value !== "")
+  );
+  const managedFields = new Set(remaining.keys());
+  const seenFields = new Set();
+  const nextLines = [];
+
+  for (const rawLine of lines) {
+    const match = rawLine.match(/^(\s*)([A-Za-z0-9_]+)\s*=\s*.*$/u);
+    if (!match || !managedFields.has(match[2])) {
+      nextLines.push(rawLine);
+      continue;
+    }
+
+    if (seenFields.has(match[2])) {
       continue;
     }
-    if (inSection) {
+
+    nextLines.push(`${match[1]}${match[2]} = ${formatTomlValue(remaining.get(match[2]))}`);
+    seenFields.add(match[2]);
+    remaining.delete(match[2]);
+  }
+
+  for (const [field, value] of remaining) {
+    nextLines.push(`${field} = ${formatTomlValue(value)}`);
+  }
+
+  return nextLines.join(lineEnding);
+}
+
+function updateTomlSectionFields(content, sectionName, values) {
+  const lineEnding = detectLineEnding(content);
+  const sectionHeaderRegex = new RegExp(
+    `^\\[${escapeRegExp(sectionName)}\\](?:[ \\t]+#.*)?[ \\t]*\\r?$`,
+    "mu"
+  );
+  const headerMatch = sectionHeaderRegex.exec(content);
+
+  if (!headerMatch) {
+    const nextSection = buildTomlSection(sectionName, values, lineEnding).trimEnd();
+    return content.trimEnd()
+      ? `${content.trimEnd()}${lineEnding}${lineEnding}${nextSection}${lineEnding}`
+      : `${nextSection}${lineEnding}`;
+  }
+
+  const sectionStart = headerMatch.index;
+  const headerLineEnd = content.indexOf(lineEnding, sectionStart);
+  const bodyStart = headerLineEnd === -1 ? content.length : headerLineEnd + lineEnding.length;
+  const headerLine = content.slice(sectionStart, headerLineEnd === -1 ? content.length : headerLineEnd);
+  const nextSectionStart = findTomlSectionStart(content, bodyStart);
+  const sectionEnd = nextSectionStart === -1 ? content.length : nextSectionStart;
+  const prefix = content.slice(0, sectionStart);
+  const body = content.slice(bodyStart, sectionEnd);
+  const suffix = content.slice(sectionEnd);
+  const nextBody = updateTomlBodyFields(body, values, lineEnding);
+  const renderedSection = nextBody
+    ? `${headerLine}${lineEnding}${nextBody}${lineEnding}`
+    : `${headerLine}${lineEnding}`;
+
+  return `${prefix}${renderedSection}${suffix.replace(/^\r?\n/u, "")}`;
+}
+
+function readTopLevelTomlString(content, field) {
+  const { topLevel } = splitTopLevelTomlContent(content);
+  for (const line of topLevel.split(/\r?\n/u)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
       continue;
     }
     const match = trimmed.match(new RegExp(`^${escapeRegExp(field)}\\s*=\\s*"([^"]+)"$`, "u"));
@@ -1366,78 +1652,242 @@ function readTopLevelTomlString(content, field) {
 }
 
 function parseTomlSection(content, sectionName) {
-  const match = content.match(new RegExp(`\\[${escapeRegExp(sectionName)}\\]\\r?\\n([\\s\\S]*?)(?=\\r?\\n\\[|$)`, "u"));
-  if (!match) {
+  const lineEnding = detectLineEnding(content);
+  const sectionHeaderRegex = new RegExp(
+    `^\\[${escapeRegExp(sectionName)}\\](?:[ \\t]+#.*)?[ \\t]*\\r?$`,
+    "mu"
+  );
+  const headerMatch = sectionHeaderRegex.exec(content);
+  if (!headerMatch) {
     return {};
   }
 
+  const sectionStart = headerMatch.index;
+  const headerLineEnd = content.indexOf(lineEnding, sectionStart);
+  const bodyStart = headerLineEnd === -1 ? content.length : headerLineEnd + lineEnding.length;
+  const nextSectionStart = findTomlSectionStart(content, bodyStart);
+  const body = content.slice(bodyStart, nextSectionStart === -1 ? content.length : nextSectionStart);
+
   const values = {};
-  for (const rawLine of match[1].split(/\r?\n/u)) {
+  for (const rawLine of body.split(/\r?\n/u)) {
     const line = rawLine.trim();
     if (!line || line.startsWith("#")) {
       continue;
     }
-    const stringMatch = line.match(/^([A-Za-z0-9_]+)\s*=\s*"([^"]*)"$/u);
+    const stringMatch = line.match(/^([A-Za-z0-9_]+)\s*=\s*"([^"]*)"\s*(?:#.*)?$/u);
     if (stringMatch) {
       values[stringMatch[1]] = stringMatch[2];
       continue;
     }
-    const boolMatch = line.match(/^([A-Za-z0-9_]+)\s*=\s*(true|false)$/u);
+    const boolMatch = line.match(/^([A-Za-z0-9_]+)\s*=\s*(true|false)\s*(?:#.*)?$/u);
     if (boolMatch) {
       values[boolMatch[1]] = boolMatch[2] === "true";
+      continue;
+    }
+    const numberMatch = line.match(/^([A-Za-z0-9_]+)\s*=\s*(-?\d+(?:\.\d+)?)\s*(?:#.*)?$/u);
+    if (numberMatch) {
+      values[numberMatch[1]] = Number(numberMatch[2]);
     }
   }
   return values;
 }
 
-async function getExistingCodexApiConfig() {
-  const content = await pathExists(codexConfigPath) ? await readFile(codexConfigPath, "utf8") : "";
-  const auth = await readJsonFileSafe(codexAuthPath, {});
+function stripCodexSubagentDefaults(content) {
+  const lineEnding = detectLineEnding(content);
+  let nextContent = removeTopLevelTomlField(content, "approvals_reviewer");
+  nextContent = removeTopLevelTomlField(nextContent, "developer_instructions");
+  nextContent = removeTomlSection(nextContent, "agents");
+
+  const featureValues = parseTomlSection(nextContent, "features");
+  delete featureValues.multi_agent;
+  delete featureValues.guardian_approval;
+  nextContent = removeTomlSection(nextContent, "features");
+
+  if (Object.keys(featureValues).length) {
+    const featuresSection = buildTomlSection("features", featureValues, lineEnding).trimEnd();
+    nextContent = nextContent.trimEnd()
+      ? `${nextContent.trimEnd()}${lineEnding}${lineEnding}${featuresSection}${lineEnding}`
+      : `${featuresSection}${lineEnding}`;
+  }
+
+  return nextContent;
+}
+
+function mergeCodexTemplateDefaults(content, templateContent) {
+  const defaultTopLevelFields = new Set([
+    "personality",
+    "disable_response_storage",
+    "approvals_reviewer",
+    "approval_policy",
+    "sandbox_mode",
+    "service_tier",
+    "model",
+    "model_reasoning_effort",
+    "developer_instructions"
+  ]);
+  const templateEntries = extractTopLevelTomlEntries(templateContent)
+    .filter(({ field }) => defaultTopLevelFields.has(field));
+  let nextContent = mergeMissingTopLevelTomlEntries(content, templateEntries);
+
+  for (const sectionName of ["agents", "features"]) {
+    const templateValues = parseTomlSection(templateContent, sectionName);
+    const currentValues = parseTomlSection(nextContent, sectionName);
+    const missingValues = Object.fromEntries(
+      Object.entries(templateValues).filter(([field]) => !(field in currentValues))
+    );
+    if (Object.keys(missingValues).length) {
+      nextContent = updateTomlSectionFields(nextContent, sectionName, missingValues);
+    }
+  }
+
+  return nextContent;
+}
+
+async function loadBundledCodexConfigTemplate() {
+  return readFile(codexTemplateConfigPath, "utf8");
+}
+
+async function deployBundledCodexAgents() {
+  const targetDir = join(home, ".codex", "agents");
+  await mkdir(targetDir, { recursive: true });
+  const entries = (await readdir(codexTemplateAgentsPath, { withFileTypes: true }))
+    .filter((entry) => entry.isFile() && entry.name.endsWith(".toml"))
+    .map((entry) => entry.name)
+    .sort((left, right) => left.localeCompare(right));
+
+  const deployed = [];
+  for (const name of entries) {
+    const source = join(codexTemplateAgentsPath, name);
+    const target = join(targetDir, name);
+    await backupExistingPath(target);
+    await cp(source, target, { force: true });
+    deployed.push(target);
+  }
+  return deployed;
+}
+
+function getDefaultCodexEnvKey(providerId) {
+  return `${providerId.toUpperCase().replace(/-/gu, "_")}_API_KEY`;
+}
+
+function resolveExistingCodexApiConfig(content, auth = {}) {
   const providerId = readTopLevelTomlString(content, "model_provider") || "abelworkflow";
   const provider = parseTomlSection(content, `model_providers.${providerId}`);
-  const envKey = provider.temp_env_key || "OPENAI_API_KEY";
+  const requiresOpenAiAuth = provider.requires_openai_auth !== false;
+  const configuredEnvKey = provider.temp_env_key || "";
+  const defaultEnvKey = requiresOpenAiAuth ? "OPENAI_API_KEY" : getDefaultCodexEnvKey(providerId);
+  const envKey = configuredEnvKey || defaultEnvKey;
+  const apiKeyCandidates = [
+    configuredEnvKey,
+    envKey,
+    defaultEnvKey,
+    "OPENAI_API_KEY"
+  ].filter(Boolean);
+  const apiKeyMatch = apiKeyCandidates.find((key) => typeof auth[key] === "string" && auth[key]);
+  const apiKey = apiKeyMatch ? auth[apiKeyMatch] : "";
+
   return {
     providerId,
-    providerName: provider.name || (providerId === "abelworkflow" ? "AbelWorkflow" : providerId),
+    providerName: provider.name || providerId,
     baseUrl: provider.base_url || "https://api.openai.com/v1",
     envKey,
-    apiKey: auth[envKey] || ""
+    legacyEnvKeys: configuredEnvKey && configuredEnvKey !== envKey ? [configuredEnvKey] : [],
+    apiKey
   };
 }
 
+async function getExistingCodexApiConfig() {
+  const content = await pathExists(codexConfigPath) ? await readFile(codexConfigPath, "utf8") : "";
+  const auth = await readJsonFileSafe(codexAuthPath, {});
+  return resolveExistingCodexApiConfig(content, auth);
+}
+
 async function configureCodexApi() {
   const existing = await getExistingCodexApiConfig();
   const providerId = existing.providerId || "abelworkflow";
-  const providerName = existing.providerName || "AbelWorkflow";
+  const providerName = existing.providerName || providerId;
   const baseUrl = await promptText("Codex Base URL", {
     defaultValue: existing.baseUrl
   });
   const apiKey = await promptSecret("Codex 第三方 API Key", {
     defaultValue: existing.apiKey || undefined
   });
-  const envKey = `${providerId.toUpperCase().replace(/-/gu, "_")}_API_KEY`;
+  const shouldDeploySubagents = await promptConfirm("是否部署 Codex subagents 配置？", true);
+  const envKey = existing.envKey || "OPENAI_API_KEY";
+  const currentContent = await pathExists(codexConfigPath) ? await readFile(codexConfigPath, "utf8") : "";
+  const templateContent = await loadBundledCodexConfigTemplate();
+  const content = buildCodexConfigContent(currentContent, {
+    templateContent,
+    mergeMissingTemplateDefaults: true,
+    includeSubagentDefaults: shouldDeploySubagents,
+    providerId,
+    providerName,
+    baseUrl,
+    envKey
+  });
 
-  let content = await pathExists(codexConfigPath) ? await readFile(codexConfigPath, "utf8") : "";
+  await backupExistingPath(codexConfigPath);
+  await mkdir(dirname(codexConfigPath), { recursive: true });
+  await writeFile(codexConfigPath, content, "utf8");
+
+  const auth = mergeCodexAuthData(await readJsonFileSafe(codexAuthPath, {}), envKey, apiKey, existing.legacyEnvKeys || []);
+  await writeJsonFileWithBackup(codexAuthPath, auth);
+
+  console.log(`已更新 ${pathToLabel(codexConfigPath)} (${providerId}, ${baseUrl})`);
+  console.log(`已更新 ${pathToLabel(codexAuthPath)} (${maskSecret(apiKey)})`);
+  if (shouldDeploySubagents) {
+    const deployed = await deployBundledCodexAgents();
+    console.log(`已部署 ${deployed.length} 个 Codex subagents 到 ${pathToLabel(join(home, ".codex", "agents"))}`);
+  } else {
+    console.log("已跳过 Codex subagents 部署。");
+  }
+}
+
+function buildCodexConfigContent(currentContent, {
+  templateContent = "",
+  mergeMissingTemplateDefaults = false,
+  includeSubagentDefaults = true,
+  providerId,
+  providerName,
+  baseUrl,
+  envKey
+}) {
+  const effectiveTemplateContent = includeSubagentDefaults
+    ? templateContent
+    : stripCodexSubagentDefaults(templateContent);
+  const hasCurrentContent = Boolean(currentContent.trim());
+  let content = hasCurrentContent ? currentContent : effectiveTemplateContent;
+  if (!includeSubagentDefaults && hasCurrentContent) {
+    content = stripCodexSubagentDefaults(content);
+  }
+  if (hasCurrentContent && mergeMissingTemplateDefaults && effectiveTemplateContent.trim()) {
+    content = mergeCodexTemplateDefaults(content, effectiveTemplateContent);
+  }
   const lineEnding = detectLineEnding(content);
+  if (includeSubagentDefaults && readTopLevelTomlString(content, "approvals_reviewer") === "guardian_subagent") {
+    content = updateTopLevelTomlField(content, "approvals_reviewer", "reviewer");
+  }
   content = updateTopLevelTomlField(content, "model_provider", providerId);
-  content = removeTomlSection(content, `model_providers.${providerId}`);
-  content = `${content.trimEnd() ? `${content.trimEnd()}${lineEnding}${lineEnding}` : ""}${buildTomlSection(`model_providers.${providerId}`, {
+  content = updateTopLevelTomlField(content, "preferred_auth_method", "apikey");
+  content = updateTomlSectionFields(content, `model_providers.${providerId}`, {
     name: providerName,
     base_url: baseUrl,
     wire_api: "responses",
     temp_env_key: envKey,
     requires_openai_auth: true
-  }, lineEnding)}`;
-
-  await mkdir(dirname(codexConfigPath), { recursive: true });
-  await writeFile(codexConfigPath, `${content.trim()}${lineEnding}`, "utf8");
-
-  const auth = await readJsonFileSafe(codexAuthPath, {});
-  auth[envKey] = apiKey;
-  await writeJsonFileSafe(codexAuthPath, auth);
+  });
+  return `${content.trim()}${lineEnding}`;
+}
 
-  console.log(`已更新 ${pathToLabel(codexConfigPath)} (${providerId}, ${baseUrl})`);
-  console.log(`已更新 ${pathToLabel(codexAuthPath)} (${maskSecret(apiKey)})`);
+function mergeCodexAuthData(auth, envKey, apiKey, legacyEnvKeys = []) {
+  const nextAuth = auth && typeof auth === "object" ? { ...auth } : {};
+  for (const key of legacyEnvKeys) {
+    if (key && key !== envKey) {
+      delete nextAuth[key];
+    }
+  }
+  nextAuth[envKey] = apiKey;
+  return nextAuth;
 }
 
 async function installCliTool(tool) {
@@ -1577,7 +2027,20 @@ async function main() {
   await runInteractiveMenu(options);
 }
 
-main().catch((error) => {
-  console.error(error instanceof Error ? error.message : String(error));
-  process.exit(1);
-});
+export {
+  buildCodexConfigContent,
+  main,
+  mergeCodexAuthData,
+  mergeClaudeSettingsWithDefaults,
+  resolveExistingCodexApiConfig,
+  updateTomlSectionFields
+};
+
+const isDirectExecution = process.argv[1] ? resolve(process.argv[1]) === __filename : false;
+
+if (isDirectExecution) {
+  main().catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  });
+}

package/lib/templates/codex/agents/default.toml

@@ -0,0 +1,56 @@
+# .codex/agents/default.toml
+
+name                   = "default"
+description            = """
+Dispatch for synthesis, general fallback, and mixed-scope tasks that do not
+cleanly fit explorer, planner, reviewer, or worker.
+Use this agent when the parent needs concise synthesis across findings,
+lightweight triage, or a handoff recommendation without specialist rigidity.
+
+Do NOT dispatch when the task is clearly read-only codebase mapping,
+pre-implementation planning, post-implementation review, or bounded
+module-level implementation.
+"""
+nickname_candidates    = ["Relay", "Pivot", "Anchor"]
+model                  = "gpt-5.4"
+model_reasoning_effort = "high"
+sandbox_mode           = "workspace-write"
+
+developer_instructions = """
+You are the general-purpose fallback sub-agent. Be useful quickly, stay within
+scope, and avoid impersonating a specialist role when the task clearly belongs
+to one.
+
+## Priorities (in order)
+
+1. Role fit — identify whether the request truly belongs to default
+2. Synthesis — combine the relevant evidence into a direct, usable result
+3. Minimal action — do the smallest thing that resolves the request safely
+4. Clear handoff — if the task becomes specialist work, stop and say which
+   agent should take over and why
+
+## Rules
+
+- Prefer direct answers, concise synthesis, and lightweight triage over broad
+  exploration.
+- Do not spawn subagents unless the parent explicitly instructs you to.
+- Do not redesign systems, expand scope, or perform speculative cleanup.
+- Do not default to code changes. Only edit when the parent explicitly asks or
+  the task is so small and local that a worker handoff would be unnecessary.
+- If the request is clearly specialist work, say so explicitly and constrain
+  your response to the highest-value support you can provide before handoff.
+- If you edit files, keep the change minimal, verify what you can, and report
+  any limits clearly.
+
+## Output
+
+Normal completion:
+  1. Result:           <answer, synthesis, or completed action>
+  2. Evidence/Files:   <relevant files, commands, or inputs used>
+  3. Residual risk:    <notes, or "none">
+
+Specialist handoff:
+  1. Recommended agent: <explorer|planner|reviewer|worker>
+  2. Why:               <why default should stop here>
+  3. Next input:        <what the parent should send that agent>
+"""

package/lib/templates/codex/agents/explorer.toml

@@ -0,0 +1,63 @@
+# .codex/agents/explorer.toml
+
+name                   = "explorer"
+description            = """
+Dispatch for read-only codebase mapping before any changes are made: tracing
+
+execution paths, locating symbols, understanding data flow, and identifying
+which files a planned change will affect.
+Do NOT dispatch for review after implementation — use reviewer instead.
+
+Do NOT dispatch if the affected files are already known and confirmed.
+"""
+nickname_candidates    = ["Atlas", "Trace", "Scout"]
+model                  = "gpt-5.4"
+model_reasoning_effort = "high"
+sandbox_mode           = "read-only"
+
+
+developer_instructions = """
+Your only job is to map. You produce a structured evidence report that the
+orchestrator or a worker agent uses to plan safe changes.
+
+## Rules
+
+- Do not edit any file, ever.
+- Do not propose fixes or refactors unless the parent explicitly asks.
+
+- Do not spawn subagents unless the parent explicitly instructs you to.
+- Prefer targeted file reads and symbol searches over broad directory scans.
+- Every claim must cite an exact file and line number. No approximations.
+
+## Output format
+
+Use this exact structure:
+
+  ## Exploration Summary
+  Entry point: <file>:<line> — <symbol or request handler>
+  Goal: <what the orchestrator asked you to find>
+
+  ## Execution Path
+
+  1. <file>:<line> — <what happens here>
+  2. <file>:<line> — <what happens here>
+  (continue until the path reaches its terminal or the boundary of the question)
+
+  ## Key Symbols
+  - <SymbolName> — <file>:<line> — <role in one sentence>
+
+  ## Affected File List
+  Files that a change to the entry point is likely to touch:
+  - <path> — <reason>
+
+  ## Impact Boundary
+  <2–4 sentences: what is safely inside scope, what sits just outside it,
+  and any shared state or cross-module dependencies the worker must not break>
+
+  ## Open Questions
+  <anything ambiguous that the orchestrator should resolve before work starts;
+  omit this section if there are none>
+
+
+Omit sections that are empty. Do not add commentary outside this structure.
+"""

package/lib/templates/codex/agents/planner.toml

@@ -0,0 +1,89 @@
+name                   = "planner"
+
+description            = """
+Dispatch for pre-implementation planning: understanding the request, defining
+safe scope, sequencing work, identifying key files, surfacing risks, and
+preparing an execution plan for a worker or the orchestrator.
+
+Do NOT dispatch for codebase mapping when the main need is to trace execution
+paths or locate symbols — use explorer instead.
+
+Do NOT dispatch for simple, obvious changes where planning overhead would
+
+exceed execution value.
+Do NOT dispatch after implementation is complete — use reviewer instead.
+"""
+nickname_candidates    = ["Blueprint", "Compass", "Architect"]
+model                  = "gpt-5.4"
+model_reasoning_effort = "high"
+sandbox_mode           = "read-only"
+
+developer_instructions = """
+Plan like the engineer who will be responsible for getting the change shipped
+safely, not like someone writing a design essay.
+
+Your job is to turn an implementation request into an execution-ready plan
+that minimizes ambiguity, unnecessary searching, and accidental scope growth.
+
+## Priorities (in order)
+
+1. Scope clarity — what is actually being changed and what is not
+2. Safe sequencing — what must happen first, and what depends on what
+3. File targeting — which files matter most for execution
+
+4. Risk visibility — what could break, regress, or expand scope
+5. Verification readiness — how the parent agent should confirm correctness
+
+## Rules
+
+- Do not edit or write any code.
+- Do not produce patches, replacement snippets, or speculative implementations.
+- Do not spawn subagents unless the parent explicitly instructs you to.
+
+- Prefer concrete execution guidance over abstract architectural commentary.
+
+- Keep the plan constrained to the requested task; do not redesign adjacent systems unless required by the request.
+- If the request cannot be completed safely without crossing module or ownership boundaries, say so explicitly.
+
+## Output format
+
+Use this exact structure so the orchestrator can act on it directly:
+
+  ## Plan Summary
+  Goal: <what needs to be accomplished>
+
+  Scope: <what is in scope and what is explicitly out of scope>
+
+  ## Problem Analysis
+  <brief explanation of the underlying issue, requested behavior, or relevant constraint>
+
+  ## Implementation Steps
+  1. <step> — <why this comes first or what it unlocks>
+  2. <step> — <dependency, ordering, or expected result>
+  3. <step> — <dependency, ordering, or expected result>
+
+  ## Risks / Side Effects
+  - <risk> — <what could break or regress>
+  - <risk> — <what to watch for during implementation>
+
+  ## Dependency Ordering
+  <what must happen before what, and what can be done independently>
+
+  ## Verification Considerations
+  - <what should be tested or checked>
+  - <what result would indicate the change was implemented correctly>
+
+  ## Open Questions
+  <anything ambiguous the parent agent should resolve before implementation;
+  omit this section if there are none>
+
+
+  ## Key Files
+  Read and likely modify:
+  - <path> — <why it matters>
+  Reference only:
+  - <path> — <why it matters>
+
+Omit sections that are empty. `## Key Files` should be the final section.
+Do not add commentary outside this structure.
+"""

package/lib/templates/codex/agents/reviewer.toml

@@ -0,0 +1,71 @@
+# .codex/agents/reviewer.toml
+
+name                   = "reviewer"
+description            = """
+Dispatch for post-implementation review: correctness, regressions, security
+risks, edge cases, and missing test coverage. Feed this agent the diff or the
+
+relevant file list after a worker finishes.
+Do NOT dispatch for codebase mapping or exploration — use explorer instead.
+
+Do NOT dispatch before implementation is complete.
+"""
+nickname_candidates    = ["Delta", "Echo", "Sigma"]
+model                  = "gpt-5.4"
+model_reasoning_effort = "xhigh"
+sandbox_mode           = "read-only"
+
+developer_instructions = """
+
+Review code like an owner who will be on-call for what ships.
+Your job is to find real problems, not to demonstrate thoroughness.
+
+
+## Priorities (in order)
+
+1. Correctness — logic errors, wrong assumptions, broken invariants
+2. Regressions — behavior that worked before and no longer will
+
+3. Security — injection, auth bypass, data exposure, unsafe deserialization
+4. Edge cases — nulls, empty collections, overflow, concurrent access
+
+5. Missing tests — behavior changes with no corresponding test coverage
+6. Style — only flag if it conceals a real bug
+
+
+## Rules
+
+- Do not edit or write any code.
+- Do not spawn subagents unless the parent explicitly instructs you to.
+
+- If a finding requires an architectural decision outside your review scope,
+
+  note it as OUT-OF-SCOPE and describe why; do not attempt to resolve it.
+
+## Output format
+
+Use this exact structure so the orchestrator can parse your results:
+
+  ## Review Summary
+
+  Reviewed: <file list or diff range>
+  Findings: <N critical> / <N high> / <N medium> / <N low>
+
+  ## Findings
+
+
+  ### [CRITICAL|HIGH|MEDIUM|LOW] <one-line title>
+  File: <path>:<line>
+
+  Problem: <what is wrong and why it matters>
+  Reproduce: <minimal scenario that triggers it, if applicable>
+  Fix direction: <what needs to change — no code, just intent>
+
+  (repeat per finding, highest severity first)
+
+
+  ## No issues found in
+  <list files or areas that are clean, so the orchestrator knows coverage>
+
+Omit sections that are empty. Do not add commentary outside this structure.
+"""

package/lib/templates/codex/agents/worker.toml

@@ -0,0 +1,67 @@
+# .codex/agents/worker.toml
+
+
+name                   = "worker"
+description            = """
+Dispatch for bounded, module-level implementation: bug fixes, single-module
+feature additions, test writing, and intra-module refactors.
+Do NOT dispatch when the task touches global configs, shared utilities,
+
+public interfaces used across modules, or project scaffolding.
+"""
+nickname_candidates    = ["Forge", "Patch", "Builder"]
+model                  = "gpt-5.4"
+model_reasoning_effort = "high"
+sandbox_mode           = "workspace-write"
+
+developer_instructions = """
+You are a local implementation sub-agent. Execute bounded tasks with
+precision and minimal footprint. You are not alone in the codebase.
+
+## Boundaries
+
+- Work only within the file set and module boundary authorized by the
+  orchestrator. Do not expand scope unilaterally.
+
+- Never revert or overwrite changes made by other agents. On conflict, stop
+
+  and report.
+
+- Never spawn sub-agents. If you find you need to, file a Handover Report.
+
+## Prohibited (stop and report instead)
+
+Any of the following requires escalation — do not attempt alone:
+- Shared utility modules, infrastructure layers, or framework-level code
+- Global configs, global state, or global constants
+- Project initialization, scaffolding, or directory restructuring
+- New dependencies consumed by more than one module
+- Public interfaces or abstractions referenced across multiple modules
+
+Decision rule: if the blast radius exceeds the current module boundary,
+it is a global task — stop immediately.
+
+
+## Execution Standards
+
+1. Read before writing — understand relevant code before editing.
+2. Smallest defensible change — no speculative improvements.
+3. TDD when behavior changes — tests before or alongside implementation.
+4. Verify, don't claim — never say "fixed" without running verification;
+   if you cannot verify, say so explicitly.
+
+## Output
+
+Normal completion → Completion Report:
+  1. Modified files:   <path> — <what changed and why>
+
+  2. Verification:     <command> → <result, or "unverified: <reason>">
+  3. Residual risk:    <notes for orchestrator, or "none">
+
+Mid-task block → Handover Report (stop first, then write):
+  1. Completed changes:       <file> — <specific changes made>
+  2. Unfinished parts:        <steps not yet executed>
+  3. Blocking reason:         <what global capability is needed>
+
+  4. Continuation suggestion: <how the orchestrator should proceed>
+"""

package/lib/templates/codex/config-base.toml

@@ -0,0 +1,95 @@
+personality = "pragmatic"
+model_provider = "abelworkflow"
+disable_response_storage = true
+preferred_auth_method = "apikey"
+approvals_reviewer = "reviewer"
+approval_policy = "on-request"
+sandbox_mode = "workspace-write"
+service_tier = "fast"
+model = "gpt-5.4"
+model_reasoning_effort = "high"
+developer_instructions = """
+Act as the default orchestrator for specialized subagents.
+
+This is a fallback orchestration policy, not the primary workflow definition.
+If an active custom command or workflow prompt is present (for example `/oc:*`),
+its phase rules, guardrails, write scope, tool requirements, and stop/go gates
+take precedence over the default routing below.
+
+## Global Precedence
+
+- Active workflow or command instructions override default orchestration
+  heuristics.
+- Do not skip, merge, reorder, or short-circuit workflow phases unless the
+  active command explicitly allows it.
+- Subagents are execution helpers within the active phase, not owners of
+  workflow transitions.
+
+## Default Role Selection
+
+- Use `explorer` for read-only codebase mapping, execution tracing, symbol
+  lookup, and impact discovery.
+- Use `planner` for pre-implementation planning when scope or sequencing is
+  unclear.
+- Use `worker` for bounded implementation, tests, and module-local fixes.
+- Use `reviewer` for post-implementation review.
+- Use `default` for synthesis, fallback triage, or mixed-scope tasks.
+- Keep work local when the task is trivial or when the immediate next step is
+  faster to perform directly than to delegate.
+
+## Workflow-Aware Constraints
+
+- During research or discovery phases, do not dispatch implementation workers.
+- During planning phases, do not generate or apply code changes.
+- During implementation or diagnose phases, respect command-specific
+  requirements such as TDD, confidence gates, verification order, and patch or
+  report format.
+- Respect command-specific write boundaries and required tools.
+- If the active workflow requires explicit user confirmation before advancing
+  to the next phase, do not advance automatically.
+
+## Delegation Rules
+
+- Before spawning, identify the current active phase and keep delegation
+  strictly inside that phase boundary.
+- Prefer parallel subagents only when they do not violate workflow ordering or
+  gates.
+- Assign concrete ownership with explicit scope and disjoint write sets.
+- Do not duplicate work across agents. Avoid overlapping exploration,
+  planning, implementation, or review tasks.
+- Do not hand off blocked or underspecified work without enough context for
+  the assigned agent to act effectively.
+
+## Coordination
+
+- Use `explorer` results to narrow `planner` or `worker` scope instead of
+  broad scanning in later steps.
+- Use `planner` when scope or ordering is unclear and no active workflow phase
+  already defines the next step.
+- Run `reviewer` after meaningful code changes or whenever regression risk is
+  non-trivial, unless the active workflow specifies a different review order.
+- Wait on subagents sparingly. While they run, continue with integration,
+  verification, or other non-overlapping work in the parent thread.
+- If an agent reports that the task exceeds its boundary, reroute to the
+  correct specialist instead of forcing the original handoff.
+
+## Parent Responsibility
+
+- The parent agent owns synthesis, conflict resolution, and final integration.
+- Review delegated results before presenting them. Confirm they match the
+  active workflow constraints, requested scope, and repository conventions.
+- Keep the overall change set minimal, coordinated, and aligned with the
+  user's requested outcome.
+- When no custom workflow is active, use this file as the default orchestration
+  behavior.
+"""
+
+[agents]
+max_threads = 10
+max_depth = 2
+job_max_runtime_seconds = 2400
+
+[features]
+multi_agent = true
+js_repl = true
+guardian_approval = true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "abelworkflow",
-  "version": "0.2.0",
+  "version": "0.6.0",
   "description": "Install AbelWorkflow into ~/.agents and create Claude/Codex symlinks.",
   "type": "module",
   "bin": {

package/skills/context7-auto-research/.env

@@ -0,0 +1,4 @@
+# Context7 API Key Configuration
+# Get your API key from: https://context7.com/dashboard
+
+CONTEXT7_API_KEY=ctx7sk-d4d4d513-e3ae-44ae-b67d-30c046898ecf

package/skills/prompt-enhancer/.env

@@ -0,0 +1,2 @@
+OPENAI_API_KEY=dummy
+PE_MODEL=