abelworkflow 1.0.0-rc.1 → 1.1.0

package/lib/providers/claude.mjs

@@ -1,30 +1,10 @@
 import * as p from "@clack/prompts";
 import {
-  pathExists,
   readJsonFileSafe,
   writeJsonFileWithBackup
 } from "../config/store.mjs";
 import { defaultPaths, maskSecret, pathToLabel } from "../paths.mjs";
 
-const augmentContextEnginePermission = "mcp__augment-context-engine";
-const claudePermissionProfiles = ["standard", "trusted"];
-const trustedClaudePermissions = [
-  "Bash",
-  "Skill",
-  "LS",
-  "Read",
-  "Agent",
-  "Write",
-  "Edit",
-  "MultiEdit",
-  "Glob",
-  "Grep",
-  "WebFetch",
-  "WebSearch",
-  "TodoWrite",
-  "NotebookRead",
-  "NotebookEdit"
-];
 const claudeModelEnvKeys = [
   "ANTHROPIC_MODEL",
   "ANTHROPIC_DEFAULT_OPUS_MODEL",
@@ -37,47 +17,32 @@ const defaultClaudeSettings = {
   env: {
     DISABLE_TELEMETRY: "1",
     DISABLE_ERROR_REPORTING: "1",
-    CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
-    ANTHROPIC_BASE_URL: "",
-    ANTHROPIC_API_KEY: "",
-    ANTHROPIC_MODEL: "",
-    ANTHROPIC_DEFAULT_OPUS_MODEL: "",
-    ANTHROPIC_DEFAULT_SONNET_MODEL: "",
-    ANTHROPIC_DEFAULT_HAIKU_MODEL: "",
-    CLAUDE_CODE_SUBAGENT_MODEL: ""
+    CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
   },
   includeCoAuthoredBy: false,
   permissions: {
     allow: [],
-    deny: []
+    deny: [],
+    defaultMode: "bypassPermissions"
   },
   hooks: {},
   alwaysThinkingEnabled: true,
   language: "Chinese"
 };
-function buildDefaultClaudeSettings({ augmentContextEngine = false, profile = "standard" } = {}) {
-  if (!claudePermissionProfiles.includes(profile)) {
-    throw new Error(`Unknown Claude permission profile: ${profile}`);
-  }
-  const settings = {
+function buildDefaultClaudeSettings() {
+  return {
     ...defaultClaudeSettings,
     env: { ...defaultClaudeSettings.env },
     permissions: {
       ...defaultClaudeSettings.permissions,
-      allow: profile === "trusted" ? [...trustedClaudePermissions] : [],
+      allow: [...defaultClaudeSettings.permissions.allow],
       deny: [...defaultClaudeSettings.permissions.deny]
     },
     hooks: { ...defaultClaudeSettings.hooks }
   };
-
-  if (augmentContextEngine && !settings.permissions.allow.includes(augmentContextEnginePermission)) {
-    settings.permissions.allow.push(augmentContextEnginePermission);
-  }
-
-  return settings;
 }
-function mergeClaudeSettingsWithDefaults(settings, { augmentContextEngine = false } = {}) {
-  const defaults = buildDefaultClaudeSettings({ augmentContextEngine });
+function mergeClaudeSettingsWithDefaults(settings) {
+  const defaults = buildDefaultClaudeSettings();
   const env = settings?.env && typeof settings.env === "object" ? settings.env : {};
   const permissions = settings?.permissions && typeof settings.permissions === "object" ? settings.permissions : {};
   return {
@@ -107,138 +72,11 @@ function applyClaudeInsecureTlsSetting(env = {}, enabled = false) {
   return nextEnv;
 }
 
-function getPreviousManagedClaudePermissions(previousMetadata = {}) {
-  return Array.isArray(previousMetadata.managedClaudePermissions)
-    ? previousMetadata.managedClaudePermissions.filter((value) => typeof value === "string")
-    : [];
-}
-
-function applyClaudePermissionProfile(settings, {
-  profile = "standard",
-  previousManagedPermissions = []
-} = {}) {
-  if (!claudePermissionProfiles.includes(profile)) {
-    throw new Error(`Unknown Claude permission profile: ${profile}`);
-  }
-  const hasSettings = settings && typeof settings === "object" && !Array.isArray(settings);
-  const nextSettings = hasSettings
-    ? {
-        ...settings,
-        permissions: settings.permissions && typeof settings.permissions === "object"
-          ? { ...settings.permissions }
-          : {}
-      }
-    : buildDefaultClaudeSettings();
-  const allow = Array.isArray(nextSettings.permissions.allow)
-    ? [...nextSettings.permissions.allow]
-    : [];
-  const previousManaged = new Set(previousManagedPermissions.filter((value) => typeof value === "string"));
-  const retainedManaged = [];
-
-  for (const permission of previousManaged) {
-    if (permission === augmentContextEnginePermission) {
-      if (allow.includes(permission)) retainedManaged.push(permission);
-      continue;
-    }
-    const index = allow.indexOf(permission);
-    if (index !== -1) allow.splice(index, 1);
-  }
-
-  if (profile === "trusted") {
-    for (const permission of trustedClaudePermissions) {
-      if (allow.includes(permission)) continue;
-      allow.push(permission);
-      retainedManaged.push(permission);
-    }
-  }
-
-  const previousAllow = Array.isArray(nextSettings.permissions.allow)
-    ? nextSettings.permissions.allow
-    : [];
-  nextSettings.permissions.allow = allow;
-  return {
-    settings: nextSettings,
-    changed: !hasSettings || previousAllow.length !== allow.length
-      || previousAllow.some((permission, index) => permission !== allow[index]),
-    managedPermissions: [...new Set(retainedManaged)]
-  };
-}
-
-function applyClaudePermissionFeature(settings, {
-  augmentContextEngine = false,
-  previousManagedPermissions = []
-} = {}) {
-  const hasSettings = settings && typeof settings === "object";
-  const wasManaged = previousManagedPermissions.includes(augmentContextEnginePermission);
-  if (!hasSettings && !augmentContextEngine) {
-    return { settings, changed: false, managedPermissions: [] };
-  }
-
-  const nextSettings = hasSettings
-    ? {
-        ...settings,
-        permissions: settings.permissions && typeof settings.permissions === "object"
-          ? { ...settings.permissions }
-          : {}
-      }
-    : { permissions: {} };
-  const permissions = nextSettings.permissions;
-  const allow = Array.isArray(permissions.allow)
-    ? [...permissions.allow]
-    : [];
-  let changed = !hasSettings;
-  let isManaged = wasManaged;
-
-  if (augmentContextEngine) {
-    if (!allow.includes(augmentContextEnginePermission)) {
-      allow.push(augmentContextEnginePermission);
-      changed = true;
-      isManaged = true;
-    }
-  } else if (wasManaged && allow.includes(augmentContextEnginePermission)) {
-    allow.splice(allow.indexOf(augmentContextEnginePermission), 1);
-    changed = true;
-    isManaged = false;
-  } else {
-    isManaged = false;
-  }
-
-  permissions.allow = allow;
-  nextSettings.permissions = permissions;
-
-  return {
-    settings: nextSettings,
-    changed,
-    managedPermissions: [
-      ...previousManagedPermissions.filter((permission) => permission !== augmentContextEnginePermission && allow.includes(permission)),
-      ...(isManaged ? [augmentContextEnginePermission] : [])
-    ]
-  };
-}
-
-async function ensureClaudeSettingsForFeature(paths, augmentContextEngine, previousMetadata) {
-  const settingsExists = await pathExists(paths.claudeSettingsPath);
-  const settings = settingsExists
-    ? await readJsonFileSafe(paths.claudeSettingsPath, {}, { sensitive: true })
-    : undefined;
-  const result = applyClaudePermissionFeature(settings, {
-    augmentContextEngine,
-    previousManagedPermissions: getPreviousManagedClaudePermissions(previousMetadata)
-  });
-
-  if (result.changed && result.settings) {
-    await writeJsonFileWithBackup(paths.claudeSettingsPath, result.settings, { sensitive: true });
-  }
-
-  return result.managedPermissions;
-}
-
 function getExistingClaudeApiConfig(settings) {
   const env = mergeClaudeSettingsWithDefaults(settings).env;
   return {
     baseUrl: env.ANTHROPIC_BASE_URL || "https://api.anthropic.com",
-    authType: env.ANTHROPIC_AUTH_TOKEN ? "auth_token" : "api_key",
-    key: env.ANTHROPIC_AUTH_TOKEN || env.ANTHROPIC_API_KEY || "",
+    key: env.ANTHROPIC_API_KEY || "",
     model: claudeModelEnvKeys.map((field) => env[field]).find(Boolean) || "",
     insecureTls: env.NODE_TLS_REJECT_UNAUTHORIZED === "0"
   };
@@ -269,7 +107,6 @@ function ensureApprovedClaudeApiKey(config, apiKey) {
 }
 
 function buildClaudeApiSettings(settings, {
-  authType,
   baseUrl,
   key,
   model,
@@ -281,13 +118,8 @@ function buildClaudeApiSettings(settings, {
     insecureTls
   );
   nextSettings.env.ANTHROPIC_BASE_URL = baseUrl;
-  if (authType === "auth_token") {
-    nextSettings.env.ANTHROPIC_AUTH_TOKEN = key;
-    delete nextSettings.env.ANTHROPIC_API_KEY;
-  } else {
-    nextSettings.env.ANTHROPIC_API_KEY = key;
-    delete nextSettings.env.ANTHROPIC_AUTH_TOKEN;
-  }
+  nextSettings.env.ANTHROPIC_API_KEY = key;
+  delete nextSettings.env.ANTHROPIC_AUTH_TOKEN;
   for (const field of claudeModelEnvKeys) {
     nextSettings.env[field] = model;
   }
@@ -299,39 +131,30 @@ async function persistClaudeConfiguration(paths, { settings, metaConfig }) {
   await writeJsonFileWithBackup(paths.claudeMetaConfigPath, metaConfig, { sensitive: true });
 }
 
-async function configureClaudeApi(paths = defaultPaths, promptApi, options = {}) {
+async function configureClaudeApi(paths = defaultPaths, promptApi) {
   const {
     assertNotCancelled,
     confirmOrCancel,
+    passwordPromptOptions,
     required,
     requiredUnlessExisting,
-    resolvePasswordValue,
-    selectOrCancel
+    resolvePasswordValue
   } = promptApi;
   const settings = await readJsonFileSafe(paths.claudeSettingsPath, {}, { sensitive: true });
   const existing = getExistingClaudeApiConfig(settings);
-  const authType = await selectOrCancel({
-    message: "Claude Code 第三方 API 认证方式",
-    options: [
-      { value: "api_key", label: "API Key" },
-      { value: "auth_token", label: "Auth Token" }
-    ],
-    initialValue: existing.authType
-  });
 
   const baseUrl = await p.text({
     message: "Claude Code Base URL",
-    defaultValue: existing.baseUrl,
+    initialValue: existing.baseUrl,
     validate: required()
   });
   assertNotCancelled(baseUrl);
 
-  const key = await p.password({
-    message: authType === "auth_token" ? "Claude Code Auth Token（输入 - 清除）" : "Claude Code API Key（输入 - 清除）",
-    mask: "*",
-    defaultValue: existing.key || undefined,
-    validate: requiredUnlessExisting(existing.key, "API Key / Auth Token 不能为空")
-  });
+  const key = await p.password(passwordPromptOptions(
+    "Claude Code API Key",
+    existing.key,
+    requiredUnlessExisting(existing.key, "API Key 不能为空")
+  ));
   assertNotCancelled(key);
   const finalKey = resolvePasswordValue(key, existing.key);
 
@@ -342,47 +165,33 @@ async function configureClaudeApi(paths = defaultPaths, promptApi, options = {})
 
   const model = await p.text({
     message: "Claude Code 模型",
-    defaultValue: existing.model || undefined,
+    initialValue: existing.model || undefined,
     validate: required()
   });
   assertNotCancelled(model);
 
   const apiSettings = buildClaudeApiSettings(settings, {
-    authType,
     baseUrl,
     key: finalKey,
     model,
     insecureTls
   });
-  const profileResult = applyClaudePermissionProfile(apiSettings, {
-    profile: options.permissionProfile ?? "standard",
-    previousManagedPermissions: options.previousManagedPermissions ?? []
-  });
   const metaConfig = await readJsonFileSafe(paths.claudeMetaConfigPath, {}, { sensitive: true });
   metaConfig.hasCompletedOnboarding = true;
   ensureApprovedClaudeApiKey(metaConfig, finalKey);
   await persistClaudeConfiguration(paths, {
-    settings: profileResult.settings,
+    settings: apiSettings,
     metaConfig
   });
 
-  p.log.step(`已更新 ${pathToLabel(paths.claudeSettingsPath, paths.homeDir)} (${authType}, ${baseUrl}, ${maskSecret(finalKey)}, ${options.permissionProfile ?? "standard"})`);
-  return {
-    managedPermissions: profileResult.managedPermissions,
-    permissionProfile: options.permissionProfile ?? "standard"
-  };
+  p.log.step(`已更新 ${pathToLabel(paths.claudeSettingsPath, paths.homeDir)} (${baseUrl}, ${maskSecret(finalKey)})`);
 }
 
-
 export {
   applyClaudeInsecureTlsSetting,
-  applyClaudePermissionFeature,
-  applyClaudePermissionProfile,
   buildClaudeApiSettings,
   buildDefaultClaudeSettings,
   configureClaudeApi,
-  ensureClaudeSettingsForFeature,
-  getPreviousManagedClaudePermissions,
   mergeClaudeSettingsWithDefaults,
   persistClaudeConfiguration
 };

package/lib/providers/codex.mjs

@@ -25,6 +25,8 @@ import {
 import { defaultPaths, maskSecret, pathToLabel } from "../paths.mjs";
 import { normalizeOpenAiBaseUrl } from "./pi.mjs";
 
+const CODEX_ENV_KEY = "OPENAI_API_KEY";
+
 const publishedCodexDeveloperInstructionHashes = new Set([
   "957adb227dd3fc298985acca38db4c22b8e018d387dab91f1ea8287db35385db"
 ]);
@@ -249,13 +251,6 @@ async function deployBundledCodexAgents(paths = defaultPaths, previousManagedFil
   return result;
 }
 
-function getDefaultCodexEnvKey(providerId) {
-  if (providerId === "openai") return "OPENAI_API_KEY";
-  if (providerId === "abelworkflow") return "ABELWORKFLOW_API_KEY";
-  const digest = createHash("sha256").update(providerId).digest("hex").toUpperCase();
-  return `ABELWORKFLOW_PROVIDER_${digest}_API_KEY`;
-}
-
 function getCodexProviderSectionName(providerId) {
   return `model_providers.${formatTomlKeySegment(providerId)}`;
 }
@@ -275,8 +270,7 @@ function assertCodexAuthKeyAvailable(auth, envKey) {
 function resolveExistingCodexApiConfig(content, auth = {}) {
   const providerId = readTopLevelTomlString(content, "model_provider") || "abelworkflow";
   const provider = parseTomlSection(content, getCodexProviderSectionName(providerId));
-  const configuredEnvKey = provider.temp_env_key || "";
-  const envKey = configuredEnvKey || getDefaultCodexEnvKey(providerId);
+  const envKey = CODEX_ENV_KEY;
   assertCodexAuthKeyAvailable(auth, envKey);
   const apiKey = typeof auth[envKey] === "string" ? auth[envKey] : "";
 
@@ -304,6 +298,7 @@ async function configureCodexApi(paths = defaultPaths, promptApi, ownership = {}
   const {
     assertNotCancelled,
     confirmOrCancel,
+    passwordPromptOptions,
     required,
     requiredUnlessExisting,
     resolvePasswordValue
@@ -313,25 +308,24 @@ async function configureCodexApi(paths = defaultPaths, promptApi, ownership = {}
   const providerName = existing.providerName || providerId;
   const baseUrlInput = await p.text({
     message: "Codex Base URL",
-    defaultValue: existing.baseUrl,
+    initialValue: existing.baseUrl,
     validate: required()
   });
   assertNotCancelled(baseUrlInput);
   const baseUrl = normalizeOpenAiBaseUrl(baseUrlInput);
 
-  const apiKey = await p.password({
-    message: "Codex 第三方 API Key（输入 - 清除）",
-    mask: "*",
-    defaultValue: existing.apiKey || undefined,
-    validate: requiredUnlessExisting(existing.apiKey, "API Key 不能为空")
-  });
+  const apiKey = await p.password(passwordPromptOptions(
+    "Codex 第三方 API Key",
+    existing.apiKey,
+    requiredUnlessExisting(existing.apiKey, "API Key 不能为空")
+  ));
   assertNotCancelled(apiKey);
   const finalApiKey = resolvePasswordValue(apiKey, existing.apiKey);
 
   const shouldDeploySubagents = await confirmOrCancel({ message: "是否部署 Codex subagents 配置？", initialValue: true });
   let managedCodexAgentFiles = { ...(ownership.managedCodexAgentFiles ?? {}) };
 
-  const envKey = existing.envKey || "OPENAI_API_KEY";
+  const envKey = CODEX_ENV_KEY;
   const currentContent = await pathExists(paths.codexConfigPath) ? await readFile(paths.codexConfigPath, "utf8") : "";
   const templateContent = await loadBundledCodexConfigTemplate(paths);
   const content = buildCodexConfigContent(currentContent, {
@@ -340,8 +334,7 @@ async function configureCodexApi(paths = defaultPaths, promptApi, ownership = {}
     includeSubagentDefaults: shouldDeploySubagents,
     providerId,
     providerName,
-    baseUrl,
-    envKey
+    baseUrl
   });
 
   const auth = mergeCodexAuthData(
@@ -382,8 +375,7 @@ function buildCodexConfigContent(currentContent, {
   includeSubagentDefaults = true,
   providerId,
   providerName,
-  baseUrl,
-  envKey
+  baseUrl
 }) {
   const effectiveTemplateContent = includeSubagentDefaults
     ? templateContent
@@ -403,7 +395,7 @@ function buildCodexConfigContent(currentContent, {
     name: providerName,
     base_url: baseUrl,
     wire_api: "responses",
-    temp_env_key: envKey,
+    temp_env_key: CODEX_ENV_KEY,
     requires_openai_auth: true,
     supports_websockets: true
   });