abelworkflow 0.9.1 → 0.9.2

package/README.md

@@ -82,7 +82,7 @@ npx abelworkflow@latest
 >   - 一键安装或更新 `Claude Code`、`Codex`、`Pi`
 >   - 配置 `Claude Code` 的第三方 API 到 `~/.claude/settings.json`
 >   - 配置 `Codex` 的第三方 API 到 `~/.codex/config.toml` 和 `~/.codex/auth.json`
->   - 配置 `Pi` 的自定义 API 到 `~/.pi/agent/models.json` 中的 `gpt` provider，并设置 `~/.pi/agent/settings.json` 默认模型，同时携带 Pi 扩展
+>   - 配置 `Pi` 的自定义 API 到 `~/.pi/agent/models.json` 和 `~/.pi/agent/auth.json` 中的 `gpt` provider，并设置 `~/.pi/agent/settings.json` 默认模型，同时携带 Pi 扩展
 > - 非交互场景请显式使用 `npx abelworkflow install`，不再保留旧的默认自动同步逻辑。
 
 ### 交互式初始化能力
@@ -108,6 +108,23 @@ npx abelworkflow --help
 8. 可选配置 Pi `gpt` provider 自定义 API，并链接 Pi 扩展
 9. 可选填写三个技能的环境变量
 
+### 自签名 HTTPS 中转
+
+默认不会关闭 TLS 证书校验。自签名中转应优先取得其 CA PEM，并在启动客户端前设置：
+
+```bash
+export NODE_EXTRA_CA_CERTS=/absolute/path/relay-ca.pem
+export CODEX_CA_CERTIFICATE=/absolute/path/relay-ca.pem
+```
+
+- `NODE_EXTRA_CA_CERTS` 供 Claude Code 和 Pi 使用，必须在启动进程前设置。
+- `CODEX_CA_CERTIFICATE` 供 Codex 原生客户端使用；也可使用 `SSL_CERT_FILE`。
+- Claude Code 的配置向导提供显式“不安全 TLS”选项，但它会影响该 Claude Code 进程内的全部 HTTPS 请求。
+- Pi 的配置向导可仅为配置的 `gpt` 请求启用不安全 TLS；扩展会移除内部标记，不影响其他请求。
+- Codex 没有已验证的跳过证书校验配置。无法提供可信 PEM 时，只能使用中转明确提供的 `http://` 地址或受控的本地反向代理。
+
+证书过期或主机名不匹配时应重新签发证书，不能用附加 CA 安全修复。不要在 shell 配置中全局设置 `NODE_TLS_REJECT_UNAUTHORIZED=0`。
+
 ### 技能环境写入位置
 
 交互式配置会把技能密钥写到 `~/.agents` 下对应 skill 目录的 `.env` 中：
@@ -183,7 +200,7 @@ node .\bin\abelworkflow.mjs install
 | `AGENTS.md` | `~/.claude/CLAUDE.md` | `~/.codex/AGENTS.md` | `~/.pi/agent/AGENTS.md` | 全局系统提示词/规则 |
 | `skills/<skill>/` | `~/.claude/skills/<skill>/` | `~/.codex/skills/<skill>/` | `~/.pi/agent/skills/<skill>/` | Skills（每个目录一个技能） |
 | `commands/abel-*.md` | `~/.claude/commands/abel-*.md` | `~/.codex/prompts/abel-*.md` | `~/.pi/agent/prompts/abel-*.md` | 扁平化部署，避免命名冲突 |
-| `extensions/*.ts` | - | - | `~/.pi/agent/extensions/*.ts` | Pi 扩展 |
+| `extensions/*` | - | - | `~/.pi/agent/extensions/*` | Pi 扩展文件或目录 |
 
 ### 验证（可选）
 

package/extensions/{pi-gpt-responses-compat.ts → pi-gpt-responses-compat/index.ts}

@@ -1,6 +1,23 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { createNodeInsecureDispatcher, installProviderTlsFetch } from "./tls-fetch.mjs";
+
+let nodeInsecureDispatcher: unknown;
+
+function getNodeInsecureDispatcher() {
+  if (nodeInsecureDispatcher) return nodeInsecureDispatcher;
+  nodeInsecureDispatcher = createNodeInsecureDispatcher();
+  return nodeInsecureDispatcher;
+}
 
 export default function (pi: ExtensionAPI) {
+  if (typeof globalThis.fetch === "function") {
+    const runtime = typeof (globalThis as any).Bun === "undefined" ? "node" : "bun";
+    installProviderTlsFetch({
+      runtime,
+      insecureDispatcher: runtime === "node" ? getNodeInsecureDispatcher : undefined
+    });
+  }
+
   pi.on("before_provider_request", (event, ctx) => {
     const payload = event.payload as any;
     if (!payload || typeof payload !== "object" || Array.isArray(payload)) return;

package/extensions/pi-gpt-responses-compat/tls-fetch.mjs

@@ -0,0 +1,188 @@
+export const piInsecureTlsHeader = "x-abelworkflow-insecure-tls";
+
+const installedFetchMarker = Symbol.for("abelworkflow.pi-provider-tls-fetch");
+const undiciGlobalDispatchers = [
+  Symbol.for("undici.globalDispatcher.2"),
+  Symbol.for("undici.globalDispatcher.1")
+];
+const redirectStatuses = new Set([301, 302, 303, 307, 308]);
+const maxRedirects = 5;
+
+function getMarkedHeaders(input, init) {
+  const source = init?.headers !== undefined
+    ? init.headers
+    : typeof Request !== "undefined" && input instanceof Request
+      ? input.headers
+      : undefined;
+  if (source === undefined) return null;
+
+  const headers = new Headers(source);
+  if (!headers.has(piInsecureTlsHeader)) return null;
+  const allowedOrigin = headers.get(piInsecureTlsHeader);
+  headers.delete(piInsecureTlsHeader);
+  return { allowedOrigin, headers };
+}
+
+function getRequestUrl(input) {
+  return typeof Request !== "undefined" && input instanceof Request
+    ? input.url
+    : input instanceof URL
+      ? input.href
+      : input;
+}
+
+function getRequestOrigin(input) {
+  try {
+    return new URL(getRequestUrl(input)).origin;
+  } catch {
+    return null;
+  }
+}
+
+function redirectRequestInit(input, init, status) {
+  const method = String(init.method ?? (
+    typeof Request !== "undefined" && input instanceof Request ? input.method : "GET"
+  )).toUpperCase();
+  const switchToGet = status === 303 && method !== "HEAD"
+    || (status === 301 || status === 302) && method === "POST";
+  if (!switchToGet) {
+    if (typeof Request !== "undefined" && input instanceof Request && method !== "GET" && method !== "HEAD") {
+      throw new Error("Pi insecure TLS cannot safely replay a redirected Request body");
+    }
+    return init;
+  }
+
+  const headers = new Headers(init.headers);
+  for (const name of ["content-encoding", "content-language", "content-length", "content-location", "content-type"]) {
+    headers.delete(name);
+  }
+  const nextInit = { ...init, method: "GET", headers };
+  delete nextInit.body;
+  return nextInit;
+}
+
+async function fetchWithSameOriginRedirects({ fetchOnce, input, init, allowedOrigin }) {
+  let nextInput = input;
+  let nextInit = init;
+
+  for (let redirectCount = 0; redirectCount <= maxRedirects; redirectCount += 1) {
+    const response = await fetchOnce(nextInput, nextInit);
+    const location = redirectStatuses.has(response?.status) ? response.headers?.get?.("location") : null;
+    if (!location) return response;
+    if (redirectCount === maxRedirects) {
+      await response.body?.cancel?.();
+      throw new Error(`Pi insecure TLS exceeded ${maxRedirects} same-origin redirects`);
+    }
+
+    const target = new URL(location, getRequestUrl(nextInput));
+    if (target.origin !== allowedOrigin) {
+      await response.body?.cancel?.();
+      throw new Error(`Pi insecure TLS blocked cross-origin redirect to ${target.origin}`);
+    }
+    await response.body?.cancel?.();
+    nextInit = redirectRequestInit(nextInput, nextInit, response.status);
+    nextInput = target.href;
+  }
+}
+
+function applyNodeDispatcher(fetchImpl, input, init, dispatcherSource) {
+  let dispatcher;
+  try {
+    dispatcher = typeof dispatcherSource === "function" ? dispatcherSource() : dispatcherSource;
+  } catch (error) {
+    return Promise.reject(error);
+  }
+
+  if (dispatcher && typeof dispatcher.then === "function") {
+    return dispatcher.then((resolved) => applyNodeDispatcher(fetchImpl, input, init, resolved));
+  }
+  if (!dispatcher || typeof dispatcher.dispatch !== "function") {
+    return Promise.reject(new Error("Pi insecure TLS requires an injected Undici dispatcher"));
+  }
+  return fetchImpl(input, { ...init, dispatcher });
+}
+
+function getUndiciDispatcherConstructor(target) {
+  return undiciGlobalDispatchers
+    .map((symbol) => target[symbol]?.constructor)
+    .find((constructor) => typeof constructor === "function");
+}
+
+function initializeUndiciGlobalDispatcher(target) {
+  if (typeof target.fetch !== "function") return;
+  try {
+    void Promise.resolve(target.fetch("data:,")).catch(() => {});
+  } catch {
+  }
+}
+
+export function createNodeInsecureDispatcher(target = globalThis) {
+  let Dispatcher = getUndiciDispatcherConstructor(target);
+  if (typeof Dispatcher !== "function") {
+    initializeUndiciGlobalDispatcher(target);
+    Dispatcher = getUndiciDispatcherConstructor(target);
+  }
+  if (typeof Dispatcher !== "function") {
+    throw new Error("Pi insecure TLS requires the active Undici dispatcher");
+  }
+  return new Dispatcher({
+    allowH2: false,
+    connect: { rejectUnauthorized: false },
+    requestTls: { rejectUnauthorized: false }
+  });
+}
+
+export function createProviderTlsFetch({
+  fetchImpl = globalThis.fetch,
+  runtime = typeof globalThis.Bun === "undefined" ? "node" : "bun",
+  insecureDispatcher
+} = {}) {
+  if (typeof fetchImpl !== "function") {
+    throw new TypeError("A fetch implementation is required");
+  }
+
+  return function providerTlsFetch(input, init) {
+    const marked = getMarkedHeaders(input, init);
+    if (!marked) return fetchImpl(input, init);
+
+    const nextInit = { ...(init ?? {}), headers: marked.headers };
+    if (!marked.allowedOrigin || getRequestOrigin(input) !== marked.allowedOrigin) {
+      return fetchImpl(input, nextInit);
+    }
+
+    nextInit.redirect = "manual";
+    const fetchOnce = runtime === "bun"
+      ? (nextInput, redirectInit) => {
+          const tls = redirectInit.tls && typeof redirectInit.tls === "object" ? redirectInit.tls : {};
+          return fetchImpl(nextInput, {
+            ...redirectInit,
+            tls: { ...tls, rejectUnauthorized: false }
+          });
+        }
+      : (nextInput, redirectInit) => applyNodeDispatcher(
+          fetchImpl,
+          nextInput,
+          redirectInit,
+          insecureDispatcher
+        );
+
+    return fetchWithSameOriginRedirects({
+      fetchOnce,
+      input,
+      init: nextInit,
+      allowedOrigin: marked.allowedOrigin
+    });
+  };
+}
+
+export function installProviderTlsFetch({ target = globalThis, ...options } = {}) {
+  if (target.fetch?.[installedFetchMarker]) return target.fetch;
+
+  const wrapped = createProviderTlsFetch({
+    ...options,
+    fetchImpl: target.fetch.bind(target)
+  });
+  Object.defineProperty(wrapped, installedFetchMarker, { value: true });
+  target.fetch = wrapped;
+  return wrapped;
+}

package/lib/cli.mjs

@@ -1,11 +1,13 @@
 import { spawn, spawnSync } from "node:child_process";
-import { cp, link, lstat, mkdir, readFile, readdir, readlink, realpath, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
+import { chmod, cp, link, lstat, mkdir, readFile, readdir, readlink, realpath, rename, rm, stat, symlink, unlink, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join, relative, resolve } from "node:path";
 import { stdin as input, stdout as output } from "node:process";
 import { fileURLToPath } from "node:url";
 import * as p from "@clack/prompts";
 import c from "picocolors";
+import lockfile from "proper-lockfile";
+import { piInsecureTlsHeader } from "../extensions/pi-gpt-responses-compat/tls-fetch.mjs";
 import {
   assertInteractiveMenuSupported,
   assertNotCancelled,
@@ -35,12 +37,23 @@ const codexTemplateRoot = join(packageRoot, "lib", "templates", "codex");
 const codexTemplateConfigPath = join(codexTemplateRoot, "config-base.toml");
 const codexTemplateAgentsPath = join(codexTemplateRoot, "agents");
 const piAgentDir = join(home, ".pi", "agent");
+const piAuthPath = join(piAgentDir, "auth.json");
 const piModelsPath = join(piAgentDir, "models.json");
 const piSettingsPath = join(piAgentDir, "settings.json");
 const piProviderId = "gpt";
-const piDefaultApi = "openai-responses";
+const piDefaultApi = "openai-completions";
 const piDefaultBaseUrl = "https://api.openai.com/v1";
 const piDefaultModel = "gpt-5.5";
+const piAuthLockOptions = {
+  stale: 30000,
+  retries: {
+    retries: 10,
+    factor: 2,
+    minTimeout: 100,
+    maxTimeout: 10000,
+    randomize: true
+  }
+};
 const installBackupStamp = Date.now();
 const createdBackupPaths = new Set();
 const augmentContextEnginePermission = "mcp__augment-context-engine";
@@ -268,6 +281,18 @@ async function backupExistingPath(targetPath) {
   return backupPath;
 }
 
+async function backupPrivateFile(targetPath, content) {
+  if (createdBackupPaths.has(targetPath) || !(await pathExists(targetPath))) {
+    return null;
+  }
+
+  const backupPath = await createBackupPath(targetPath);
+  await writeFile(backupPath, content, { encoding: "utf8", flag: "wx", mode: 0o600 });
+  createdBackupPaths.add(targetPath);
+  p.log.message(`已备份已有配置: ${pathToLabel(targetPath)} -> ${pathToLabel(backupPath)}`);
+  return backupPath;
+}
+
 async function backupIfNeeded(targetPath) {
   if (!(await pathExists(targetPath))) {
     return null;
@@ -335,6 +360,18 @@ async function removeIfNotDirectory(path) {
   await rm(path, { recursive: true, force: true });
 }
 
+async function ensureManagedContainerDirectory(targetPath, sourcePath) {
+  if (await pathExists(targetPath)) {
+    const targetStat = await lstat(targetPath);
+    if (targetStat.isSymbolicLink() && await pathsReferToSameEntry(targetPath, sourcePath)) {
+      await unlink(targetPath);
+    }
+  }
+
+  await removeIfNotDirectory(targetPath);
+  await mkdir(targetPath, { recursive: true });
+}
+
 async function replaceManagedEntry(source, target, entry) {
   if (await pathsReferToSameEntry(source, target)) {
     return;
@@ -510,7 +547,9 @@ async function syncManagedSubtree(sourcePath, targetPath, managedRoot, filter) {
   if (!sourceStat.isDirectory()) {
     if (await pathExists(targetPath)) {
       const targetStat = await lstat(targetPath);
-      if (targetStat.isDirectory()) {
+      if (targetStat.isSymbolicLink()) {
+        await unlink(targetPath);
+      } else if (targetStat.isDirectory()) {
         await rm(targetPath, { recursive: true, force: true });
       }
     }
@@ -836,10 +875,8 @@ function isWithinManagedRoot(targetPath, managedSourceRoot) {
 async function linkClaude(agentsDir, previousLinkedTargets) {
   const claudeDir = join(home, ".claude");
   await mkdir(claudeDir, { recursive: true });
-  await removeIfNotDirectory(join(claudeDir, "commands"));
-  await removeIfNotDirectory(join(claudeDir, "skills"));
-  await mkdir(join(claudeDir, "commands"), { recursive: true });
-  await mkdir(join(claudeDir, "skills"), { recursive: true });
+  await ensureManagedContainerDirectory(join(claudeDir, "commands"), join(agentsDir, "commands"));
+  await ensureManagedContainerDirectory(join(claudeDir, "skills"), join(agentsDir, "skills"));
 
   return [
     await ensureManagedLink(
@@ -877,10 +914,8 @@ async function linkCodex(agentsDir, previousLinkedTargets) {
   const results = [];
   const codexDir = join(home, ".codex");
   await mkdir(codexDir, { recursive: true });
-  await removeIfNotDirectory(join(codexDir, "skills"));
-  await removeIfNotDirectory(join(codexDir, "prompts"));
-  await mkdir(join(codexDir, "skills"), { recursive: true });
-  await mkdir(join(codexDir, "prompts"), { recursive: true });
+  await ensureManagedContainerDirectory(join(codexDir, "skills"), join(agentsDir, "skills"));
+  await ensureManagedContainerDirectory(join(codexDir, "prompts"), join(agentsDir, "commands"));
 
   results.push(
     await ensureManagedLink(
@@ -918,12 +953,9 @@ async function linkCodex(agentsDir, previousLinkedTargets) {
 async function linkPi(agentsDir, previousLinkedTargets) {
   const results = [];
   await mkdir(piAgentDir, { recursive: true });
-  await removeIfNotDirectory(join(piAgentDir, "skills"));
-  await removeIfNotDirectory(join(piAgentDir, "prompts"));
-  await removeIfNotDirectory(join(piAgentDir, "extensions"));
-  await mkdir(join(piAgentDir, "skills"), { recursive: true });
-  await mkdir(join(piAgentDir, "prompts"), { recursive: true });
-  await mkdir(join(piAgentDir, "extensions"), { recursive: true });
+  await ensureManagedContainerDirectory(join(piAgentDir, "skills"), join(agentsDir, "skills"));
+  await ensureManagedContainerDirectory(join(piAgentDir, "prompts"), join(agentsDir, "commands"));
+  await ensureManagedContainerDirectory(join(piAgentDir, "extensions"), join(agentsDir, "extensions"));
 
   results.push(
     await ensureManagedLink(
@@ -1070,6 +1102,42 @@ async function writeJsonFileWithBackup(path, data) {
   await writeJsonFileSafe(path, data);
 }
 
+async function ensurePrivateJsonFile(path) {
+  await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+  try {
+    await writeFile(path, "{}\n", { encoding: "utf8", flag: "wx", mode: 0o600 });
+    return true;
+  } catch (error) {
+    if (error?.code !== "EEXIST") {
+      throw error;
+    }
+    return false;
+  }
+}
+
+async function updatePiAuthFile(path, apiKey) {
+  const created = await ensurePrivateJsonFile(path);
+  const release = await lockfile.lock(path, piAuthLockOptions);
+  try {
+    await chmod(path, 0o600);
+    const content = await readFile(path, "utf8");
+    const auth = JSON.parse(content);
+    if (!auth || typeof auth !== "object" || Array.isArray(auth)) {
+      throw new TypeError("Pi auth.json must contain a JSON object");
+    }
+    if (!created) {
+      await backupPrivateFile(path, content);
+    }
+    await writeFile(path, `${JSON.stringify(buildPiAuthConfig(auth, apiKey), null, 2)}\n`, {
+      encoding: "utf8",
+      mode: 0o600
+    });
+    await chmod(path, 0o600);
+  } finally {
+    await release();
+  }
+}
+
 function stripJsonComments(content) {
   let output = "";
   let inString = false;
@@ -1186,15 +1254,66 @@ function parsePiModelIds(value) {
     .filter(Boolean))];
 }
 
-function resolveExistingPiApiConfig(modelsConfig = {}, settings = {}) {
+function getOpenAiUrlPathname(value) {
+  const input = String(value || "").trim();
+  try {
+    return new URL(input).pathname.replace(/\/+$/u, "");
+  } catch {
+    return input.split(/[?#]/u)[0].replace(/\/+$/u, "");
+  }
+}
+
+function inferPiApiFromBaseUrl(value) {
+  const pathname = getOpenAiUrlPathname(value);
+  if (pathname.endsWith("/v1/chat/completions")) {
+    return "openai-completions";
+  }
+  if (pathname.endsWith("/v1/responses")) {
+    return "openai-responses";
+  }
+  return null;
+}
+
+function normalizeOpenAiBaseUrl(value) {
+  const input = String(value || "").trim();
+  try {
+    const url = new URL(input);
+    let pathname = url.pathname.replace(/\/+$/u, "")
+      .replace(/\/v1\/(?:chat\/completions|responses)$/u, "/v1");
+    if (!pathname.endsWith("/v1")) {
+      pathname = `${pathname}/v1`;
+    }
+    url.pathname = pathname;
+    return url.toString();
+  } catch {
+    const baseUrl = input.replace(/\/+$/u, "")
+      .replace(/\/v1\/(?:chat\/completions|responses)$/u, "/v1");
+    return baseUrl.endsWith("/v1") ? baseUrl : `${baseUrl}/v1`;
+  }
+}
+
+function getPiApiPromptOptions() {
+  return [
+    { value: "openai-completions", label: "OpenAI Chat Completions（推荐）" },
+    { value: "openai-responses", label: "OpenAI Responses API" }
+  ];
+}
+
+function resolveExistingPiApiConfig(modelsConfig = {}, settings = {}, auth = {}) {
   const provider = modelsConfig.providers?.[piProviderId] && typeof modelsConfig.providers[piProviderId] === "object"
     ? modelsConfig.providers[piProviderId]
     : {};
+  const credential = auth[piProviderId] && typeof auth[piProviderId] === "object"
+    ? auth[piProviderId]
+    : {};
+  const authApiKey = credential.type === "api_key" && typeof credential.key === "string"
+    ? credential.key
+    : "";
   const models = Array.isArray(provider.models) ? provider.models.filter((model) => model?.id) : [];
   return {
     baseUrl: provider.baseUrl || piDefaultBaseUrl,
     api: provider.api || piDefaultApi,
-    apiKey: provider.apiKey || "",
+    apiKey: authApiKey || provider.apiKey || "",
     modelIds: models.map((model) => model.id),
     defaultModel: settings.defaultProvider === piProviderId && settings.defaultModel
       ? settings.defaultModel
@@ -1214,30 +1333,67 @@ function buildPiModelConfig(modelId, existingModel = {}) {
   };
 }
 
-function buildPiModelsConfig(modelsConfig = {}, { baseUrl, api, apiKey, modelIds }) {
+function hasPiInsecureTlsSetting(modelsConfig = {}) {
+  const headers = modelsConfig.providers?.[piProviderId]?.headers;
+  return headers && typeof headers === "object"
+    ? Object.keys(headers).some((key) => key.toLowerCase() === piInsecureTlsHeader)
+    : false;
+}
+
+function buildPiModelsConfig(modelsConfig = {}, { baseUrl, api, apiKey, modelIds, insecureTls = false }) {
   const providers = modelsConfig.providers && typeof modelsConfig.providers === "object" ? modelsConfig.providers : {};
   const currentProvider = providers[piProviderId] && typeof providers[piProviderId] === "object" ? providers[piProviderId] : {};
+  const headers = currentProvider.headers && typeof currentProvider.headers === "object"
+    ? { ...currentProvider.headers }
+    : {};
+  for (const key of Object.keys(headers)) {
+    if (key.toLowerCase() === piInsecureTlsHeader) {
+      delete headers[key];
+    }
+  }
+  if (insecureTls) {
+    headers[piInsecureTlsHeader] = new URL(baseUrl).origin;
+  }
   const existingModels = new Map(
     (Array.isArray(currentProvider.models) ? currentProvider.models : [])
       .filter((model) => model?.id)
       .map((model) => [model.id, model])
   );
 
+  const provider = {
+    ...currentProvider,
+    baseUrl,
+    api,
+    apiKey,
+    compat: {
+      ...(currentProvider.compat && typeof currentProvider.compat === "object" ? currentProvider.compat : {}),
+      supportsDeveloperRole: false
+    },
+    models: modelIds.map((modelId) => buildPiModelConfig(modelId, existingModels.get(modelId)))
+  };
+  if (Object.keys(headers).length) {
+    provider.headers = headers;
+  } else {
+    delete provider.headers;
+  }
+
   return {
     ...modelsConfig,
     providers: {
       ...providers,
-      [piProviderId]: {
-        ...currentProvider,
-        baseUrl,
-        api,
-        apiKey,
-        compat: {
-          ...(currentProvider.compat && typeof currentProvider.compat === "object" ? currentProvider.compat : {}),
-          supportsDeveloperRole: false
-        },
-        models: modelIds.map((modelId) => buildPiModelConfig(modelId, existingModels.get(modelId)))
-      }
+      [piProviderId]: provider
+    }
+  };
+}
+
+function buildPiAuthConfig(auth = {}, apiKey) {
+  const credential = auth[piProviderId] && typeof auth[piProviderId] === "object" ? auth[piProviderId] : {};
+  return {
+    ...auth,
+    [piProviderId]: {
+      ...credential,
+      type: "api_key",
+      key: apiKey
     }
   };
 }
@@ -1535,6 +1691,16 @@ function mergeClaudeSettingsWithDefaults(settings, { augmentContextEngine = fals
   };
 }
 
+function applyClaudeInsecureTlsSetting(env = {}, enabled = false) {
+  const nextEnv = { ...env };
+  if (enabled) {
+    nextEnv.NODE_TLS_REJECT_UNAUTHORIZED = "0";
+  } else if (nextEnv.NODE_TLS_REJECT_UNAUTHORIZED === "0") {
+    delete nextEnv.NODE_TLS_REJECT_UNAUTHORIZED;
+  }
+  return nextEnv;
+}
+
 function getPreviousManagedClaudePermissions(previousMetadata = {}) {
   return Array.isArray(previousMetadata.managedClaudePermissions)
     ? previousMetadata.managedClaudePermissions.filter((value) => typeof value === "string")
@@ -1618,7 +1784,8 @@ function getExistingClaudeApiConfig(settings) {
     baseUrl: env.ANTHROPIC_BASE_URL || "https://api.anthropic.com",
     authType: env.ANTHROPIC_AUTH_TOKEN ? "auth_token" : "api_key",
     key: env.ANTHROPIC_AUTH_TOKEN || env.ANTHROPIC_API_KEY || "",
-    model: claudeModelEnvKeys.map((field) => env[field]).find(Boolean) || ""
+    model: claudeModelEnvKeys.map((field) => env[field]).find(Boolean) || "",
+    insecureTls: env.NODE_TLS_REJECT_UNAUTHORIZED === "0"
   };
 }
 
@@ -1674,6 +1841,11 @@ async function configureClaudeApi() {
   assertNotCancelled(key);
   const finalKey = resolvePasswordValue(key, existing.key);
 
+  const insecureTls = await confirmOrCancel({
+    message: "是否跳过 Claude Code TLS 证书校验？仅证书无法修复时启用（会放宽该进程全部 HTTPS 请求）",
+    initialValue: existing.insecureTls
+  });
+
   const model = await p.text({
     message: "Claude Code 模型",
     defaultValue: existing.model || undefined,
@@ -1682,6 +1854,7 @@ async function configureClaudeApi() {
   assertNotCancelled(model);
 
   const nextSettings = mergeClaudeSettingsWithDefaults(settings);
+  nextSettings.env = applyClaudeInsecureTlsSetting(nextSettings.env, insecureTls);
   nextSettings.env.ANTHROPIC_BASE_URL = baseUrl;
 
   if (authType === "auth_token") {
@@ -2211,25 +2384,30 @@ async function ensurePiResourcesLinked(agentsDir) {
 }
 
 async function configurePiApi(agentsDir) {
+  const auth = await readJsonFileSafe(piAuthPath, {});
   const modelsConfig = await readJsoncFileSafe(piModelsPath, {});
   const settings = await readJsonFileSafe(piSettingsPath, {});
-  const existing = resolveExistingPiApiConfig(modelsConfig, settings);
+  const existing = resolveExistingPiApiConfig(modelsConfig, settings, auth);
 
-  const baseUrl = await p.text({
+  const baseUrlInput = await p.text({
     message: "Pi gpt Base URL",
     defaultValue: existing.baseUrl,
     validate: required()
   });
-  assertNotCancelled(baseUrl);
+  assertNotCancelled(baseUrlInput);
+  const inferredApi = inferPiApiFromBaseUrl(baseUrlInput);
+  const baseUrl = normalizeOpenAiBaseUrl(baseUrlInput);
+
+  const insecureTls = await confirmOrCancel({
+    message: "是否仅为 Pi gpt 中转请求跳过 TLS 证书校验？仅证书无法修复时启用",
+    initialValue: hasPiInsecureTlsSetting(modelsConfig)
+  });
 
-  const piApiOptions = ["openai-responses", "openai-completions"];
-  const api = await selectOrCancel({
+  const piApiOptions = getPiApiPromptOptions();
+  const api = inferredApi || await selectOrCancel({
     message: "Pi gpt API 类型",
-    options: [
-      { value: "openai-responses", label: "OpenAI Responses API" },
-      { value: "openai-completions", label: "OpenAI Chat Completions" }
-    ],
-    initialValue: piApiOptions.includes(existing.api) ? existing.api : piDefaultApi
+    options: piApiOptions,
+    initialValue: piApiOptions.some((option) => option.value === existing.api) ? existing.api : piDefaultApi
   });
 
   const apiKey = await p.password({
@@ -2258,16 +2436,19 @@ async function configurePiApi(agentsDir) {
 
   const finalDefaultModel = String(defaultModel).trim();
   await ensurePiResourcesLinked(agentsDir);
+  await updatePiAuthFile(piAuthPath, finalApiKey);
   await writeJsonFileWithBackup(piModelsPath, buildPiModelsConfig(modelsConfig, {
     baseUrl,
     api,
     apiKey: finalApiKey,
-    modelIds
+    modelIds,
+    insecureTls
   }));
   await writeJsonFileWithBackup(piSettingsPath, buildPiSettingsConfig(settings, finalDefaultModel));
 
   p.log.step(`已更新 ${pathToLabel(piModelsPath)} (${piProviderId}, ${baseUrl})`);
   p.log.step(`已更新 ${pathToLabel(piSettingsPath)} (默认模型: ${finalDefaultModel})`);
+  p.log.step(`已更新 ${pathToLabel(piAuthPath)} (${maskSecret(finalApiKey)})`);
   p.log.step(`已链接 Pi 扩展到 ${pathToLabel(join(piAgentDir, "extensions"))}`);
 }
 
@@ -2275,12 +2456,13 @@ async function configureCodexApi() {
   const existing = await getExistingCodexApiConfig();
   const providerId = existing.providerId || "abelworkflow";
   const providerName = existing.providerName || providerId;
-  const baseUrl = await p.text({
+  const baseUrlInput = await p.text({
     message: "Codex Base URL",
     defaultValue: existing.baseUrl,
     validate: required()
   });
-  assertNotCancelled(baseUrl);
+  assertNotCancelled(baseUrlInput);
+  const baseUrl = normalizeOpenAiBaseUrl(baseUrlInput);
 
   const apiKey = await p.password({
     message: "Codex 第三方 API Key（输入 - 清除）",
@@ -2315,6 +2497,9 @@ async function configureCodexApi() {
 
   p.log.step(`已更新 ${pathToLabel(codexConfigPath)} (${providerId}, ${baseUrl})`);
   p.log.step(`已更新 ${pathToLabel(codexAuthPath)} (${maskSecret(finalApiKey)})`);
+  if (String(baseUrl).startsWith("https://") && !process.env.CODEX_CA_CERTIFICATE && !process.env.SSL_CERT_FILE) {
+    p.log.message("自签名证书需在启动 Codex 前设置 CODEX_CA_CERTIFICATE=/absolute/path/relay-ca.pem。");
+  }
   if (shouldDeploySubagents) {
     const deployed = await deployBundledCodexAgents();
     p.log.step(`已部署 ${deployed.length} 个 Codex subagents 到 ${pathToLabel(join(home, ".codex", "agents"))}`);
@@ -2799,10 +2984,12 @@ async function main() {
 }
 
 export {
+  applyClaudeInsecureTlsSetting,
   applyClaudePermissionFeature,
   buildCliToolInstallCommand,
   buildDefaultClaudeSettings,
   buildCodexConfigContent,
+  buildPiAuthConfig,
   buildPiModelsConfig,
   buildPiSettingsConfig,
   chooseCliInstallPackageManager,
@@ -2811,9 +2998,12 @@ export {
   getRunCommandSpawnOptions,
   hasPromptEnhancerApiConfig,
   inferPackageManagerFromCommandPath,
+  getPiApiPromptOptions,
+  inferPiApiFromBaseUrl,
   main,
   mergeCodexAuthData,
   mergeClaudeSettingsWithDefaults,
+  normalizeOpenAiBaseUrl,
   renderManagedWorkflowContent,
   resolveAugmentContextEngineFeature,
   resolvePromptEnhancerMode,
@@ -2821,5 +3011,6 @@ export {
   parsePiModelIds,
   resolveExistingPiApiConfig,
   stripJsonComments,
+  updatePiAuthFile,
   updateTomlSectionFields
 };

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "abelworkflow",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "description": "Install AbelWorkflow into ~/.agents and create Claude/Codex symlinks.",
   "type": "module",
   "scripts": {
-    "test": "node --test test/runtime-doc-contracts.test.mjs test/cli-contracts.test.mjs test/codex-config.test.mjs",
+    "test": "node --test test/runtime-doc-contracts.test.mjs test/cli-contracts.test.mjs test/codex-config.test.mjs test/pi-auth-precedence.test.mjs test/pi-auth-write.test.mjs test/pi-provider-tls.test.mjs",
     "test:contracts": "node --test test/runtime-doc-contracts.test.mjs test/cli-contracts.test.mjs"
   },
   "bin": {
@@ -27,6 +27,7 @@
   "license": "MIT",
   "dependencies": {
     "@clack/prompts": "^1.2.0",
-    "picocolors": "^1.1.1"
+    "picocolors": "^1.1.1",
+    "proper-lockfile": "4.1.2"
   }
 }