abelworkflow 1.1.0 → 1.1.2

package/lib/providers/claude.mjs

@@ -1,8 +1,5 @@
 import * as p from "@clack/prompts";
-import {
-  readJsonFileSafe,
-  writeJsonFileWithBackup
-} from "../config/store.mjs";
+import { readJsonFileSafe, writeJson } from "../config/store.mjs";
 import { defaultPaths, maskSecret, pathToLabel } from "../paths.mjs";
 
 const claudeModelEnvKeys = [
@@ -62,23 +59,12 @@ function mergeClaudeSettingsWithDefaults(settings) {
   };
 }
 
-function applyClaudeInsecureTlsSetting(env = {}, enabled = false) {
-  const nextEnv = { ...env };
-  if (enabled) {
-    nextEnv.NODE_TLS_REJECT_UNAUTHORIZED = "0";
-  } else if (nextEnv.NODE_TLS_REJECT_UNAUTHORIZED === "0") {
-    delete nextEnv.NODE_TLS_REJECT_UNAUTHORIZED;
-  }
-  return nextEnv;
-}
-
 function getExistingClaudeApiConfig(settings) {
   const env = mergeClaudeSettingsWithDefaults(settings).env;
   return {
     baseUrl: env.ANTHROPIC_BASE_URL || "https://api.anthropic.com",
     key: env.ANTHROPIC_API_KEY || "",
-    model: claudeModelEnvKeys.map((field) => env[field]).find(Boolean) || "",
-    insecureTls: env.NODE_TLS_REJECT_UNAUTHORIZED === "0"
+    model: claudeModelEnvKeys.map((field) => env[field]).find(Boolean) || ""
   };
 }
 
@@ -109,14 +95,9 @@ function ensureApprovedClaudeApiKey(config, apiKey) {
 function buildClaudeApiSettings(settings, {
   baseUrl,
   key,
-  model,
-  insecureTls = false
+  model
 }) {
   const nextSettings = mergeClaudeSettingsWithDefaults(settings);
-  nextSettings.env = applyClaudeInsecureTlsSetting(
-    nextSettings.env && typeof nextSettings.env === "object" ? nextSettings.env : {},
-    insecureTls
-  );
   nextSettings.env.ANTHROPIC_BASE_URL = baseUrl;
   nextSettings.env.ANTHROPIC_API_KEY = key;
   delete nextSettings.env.ANTHROPIC_AUTH_TOKEN;
@@ -127,19 +108,12 @@ function buildClaudeApiSettings(settings, {
 }
 
 async function persistClaudeConfiguration(paths, { settings, metaConfig }) {
-  await writeJsonFileWithBackup(paths.claudeSettingsPath, settings, { sensitive: true });
-  await writeJsonFileWithBackup(paths.claudeMetaConfigPath, metaConfig, { sensitive: true });
+  await writeJson(paths.claudeSettingsPath, settings, { sensitive: true });
+  await writeJson(paths.claudeMetaConfigPath, metaConfig, { sensitive: true });
 }
 
 async function configureClaudeApi(paths = defaultPaths, promptApi) {
-  const {
-    assertNotCancelled,
-    confirmOrCancel,
-    passwordPromptOptions,
-    required,
-    requiredUnlessExisting,
-    resolvePasswordValue
-  } = promptApi;
+  const { assertNotCancelled, passwordOrExisting, required } = promptApi;
   const settings = await readJsonFileSafe(paths.claudeSettingsPath, {}, { sensitive: true });
   const existing = getExistingClaudeApiConfig(settings);
 
@@ -150,17 +124,9 @@ async function configureClaudeApi(paths = defaultPaths, promptApi) {
   });
   assertNotCancelled(baseUrl);
 
-  const key = await p.password(passwordPromptOptions(
-    "Claude Code API Key",
-    existing.key,
-    requiredUnlessExisting(existing.key, "API Key 不能为空")
-  ));
-  assertNotCancelled(key);
-  const finalKey = resolvePasswordValue(key, existing.key);
-
-  const insecureTls = await confirmOrCancel({
-    message: "是否跳过 Claude Code TLS 证书校验？仅证书无法修复时启用（会放宽该进程全部 HTTPS 请求）",
-    initialValue: existing.insecureTls
+  const finalKey = await passwordOrExisting({
+    message: "Claude Code API Key",
+    existingValue: existing.key
   });
 
   const model = await p.text({
@@ -173,8 +139,7 @@ async function configureClaudeApi(paths = defaultPaths, promptApi) {
   const apiSettings = buildClaudeApiSettings(settings, {
     baseUrl,
     key: finalKey,
-    model,
-    insecureTls
+    model
   });
   const metaConfig = await readJsonFileSafe(paths.claudeMetaConfigPath, {}, { sensitive: true });
   metaConfig.hasCompletedOnboarding = true;
@@ -188,7 +153,6 @@ async function configureClaudeApi(paths = defaultPaths, promptApi) {
 }
 
 export {
-  applyClaudeInsecureTlsSetting,
   buildClaudeApiSettings,
   buildDefaultClaudeSettings,
   configureClaudeApi,

package/lib/providers/codex.mjs

@@ -1,11 +1,10 @@
-import { createHash } from "node:crypto";
 import { lstat, mkdir, readFile, readdir, unlink } from "node:fs/promises";
 import { join } from "node:path";
 import * as p from "@clack/prompts";
 import {
   pathExists,
   readJsonFileSafe,
-  writeJsonFileWithBackup,
+  writeJson,
   writeText
 } from "../config/store.mjs";
 import {
@@ -18,11 +17,13 @@ import {
   parseTomlSection,
   readTopLevelTomlString,
   removeTomlSection,
+  removeTomlSectionField,
   removeTopLevelTomlField,
   updateTomlSectionFields,
   updateTopLevelTomlField
 } from "../config/toml.mjs";
 import { defaultPaths, maskSecret, pathToLabel } from "../paths.mjs";
+import { hashBytes, isManagedCodexAgentFileEntry } from "../utils.mjs";
 import { normalizeOpenAiBaseUrl } from "./pi.mjs";
 
 const CODEX_ENV_KEY = "OPENAI_API_KEY";
@@ -98,7 +99,7 @@ function mergeCodexTemplateDefaults(content, templateContent) {
   const currentDeveloperInstructions = readTopLevelTomlString(nextContent, "developer_instructions");
   const templateDeveloperInstructions = readTopLevelTomlString(templateContent, "developer_instructions");
   if (templateDeveloperInstructions && publishedCodexDeveloperInstructionHashes.has(
-    sha256(currentDeveloperInstructions)
+    hashBytes(currentDeveloperInstructions)
   )) {
     nextContent = updateTopLevelTomlField(
       nextContent,
@@ -125,10 +126,6 @@ async function loadBundledCodexConfigTemplate(paths = defaultPaths) {
   return readFile(paths.codexTemplateConfigPath, "utf8");
 }
 
-function sha256(content) {
-  return createHash("sha256").update(content).digest("hex");
-}
-
 async function readCodexAgentTarget(path) {
   try {
     const targetStat = await lstat(path);
@@ -175,14 +172,6 @@ async function ensureCodexAgentContainer(homeDir) {
   return targetDir;
 }
 
-function isCodexAgentOwnership(name, hash) {
-  return name.endsWith(".toml")
-    && !name.includes("/")
-    && !name.includes("\\")
-    && typeof hash === "string"
-    && /^[a-f0-9]{64}$/u.test(hash);
-}
-
 function isPublishedCodexAgent(name, hash) {
   return publishedCodexAgentHashes[name]?.has(hash) ?? false;
 }
@@ -205,9 +194,9 @@ async function deployBundledCodexAgents(paths = defaultPaths, previousManagedFil
     const source = join(paths.codexTemplateAgentsPath, name);
     const target = join(targetDir, name);
     const sourceContent = await readFile(source);
-    const sourceHash = sha256(sourceContent);
+    const sourceHash = hashBytes(sourceContent);
     const current = await readCodexAgentTarget(target);
-    const currentHash = current.content ? sha256(current.content) : "";
+    const currentHash = current.content ? hashBytes(current.content) : "";
 
     if (!current.exists) {
       await writeText(target, sourceContent, { backupLimit: 0 });
@@ -222,7 +211,7 @@ async function deployBundledCodexAgents(paths = defaultPaths, previousManagedFil
       result.updated.push(target);
     } else {
       result.conflicts.push(target);
-      if (isCodexAgentOwnership(name, previousManagedFiles?.[name])) {
+      if (isManagedCodexAgentFileEntry(name, previousManagedFiles?.[name])) {
         result.managedFiles[name] = previousManagedFiles[name];
       }
       continue;
@@ -237,11 +226,11 @@ async function deployBundledCodexAgents(paths = defaultPaths, previousManagedFil
     ? Object.entries(previousManagedFiles).sort(([left], [right]) => left.localeCompare(right))
     : [];
   for (const [name, previousHash] of previousEntries) {
-    if (bundledNames.has(name) || !isCodexAgentOwnership(name, previousHash)) continue;
+    if (bundledNames.has(name) || !isManagedCodexAgentFileEntry(name, previousHash)) continue;
     const target = join(targetDir, name);
     const current = await readCodexAgentTarget(target);
     if (!current.exists) continue;
-    if (current.content && sha256(current.content) === previousHash) {
+    if (current.content && hashBytes(current.content) === previousHash) {
       await unlink(target);
       continue;
     }
@@ -291,17 +280,15 @@ async function getExistingCodexApiConfig(paths = defaultPaths) {
 
 async function persistCodexConfiguration(paths, { content, auth }) {
   await writeText(paths.codexConfigPath, content);
-  await writeJsonFileWithBackup(paths.codexAuthPath, auth, { sensitive: true });
+  await writeJson(paths.codexAuthPath, auth, { sensitive: true });
 }
 
 async function configureCodexApi(paths = defaultPaths, promptApi, ownership = {}) {
   const {
     assertNotCancelled,
     confirmOrCancel,
-    passwordPromptOptions,
-    required,
-    requiredUnlessExisting,
-    resolvePasswordValue
+    passwordOrExisting,
+    required
   } = promptApi;
   const existing = await getExistingCodexApiConfig(paths);
   const providerId = existing.providerId || "abelworkflow";
@@ -314,13 +301,10 @@ async function configureCodexApi(paths = defaultPaths, promptApi, ownership = {}
   assertNotCancelled(baseUrlInput);
   const baseUrl = normalizeOpenAiBaseUrl(baseUrlInput);
 
-  const apiKey = await p.password(passwordPromptOptions(
-    "Codex 第三方 API Key",
-    existing.apiKey,
-    requiredUnlessExisting(existing.apiKey, "API Key 不能为空")
-  ));
-  assertNotCancelled(apiKey);
-  const finalApiKey = resolvePasswordValue(apiKey, existing.apiKey);
+  const finalApiKey = await passwordOrExisting({
+    message: "Codex 第三方 API Key",
+    existingValue: existing.apiKey
+  });
 
   const shouldDeploySubagents = await confirmOrCancel({ message: "是否部署 Codex subagents 配置？", initialValue: true });
   let managedCodexAgentFiles = { ...(ownership.managedCodexAgentFiles ?? {}) };
@@ -389,13 +373,16 @@ function buildCodexConfigContent(currentContent, {
   if (includeSubagentDefaults && readTopLevelTomlString(content, "approvals_reviewer") === "reviewer") {
     content = updateTopLevelTomlField(content, "approvals_reviewer", "guardian_subagent");
   }
+  const providerSectionName = getCodexProviderSectionName(providerId);
   content = updateTopLevelTomlField(content, "model_provider", providerId);
-  content = updateTopLevelTomlField(content, "preferred_auth_method", "apikey");
-  content = updateTomlSectionFields(content, getCodexProviderSectionName(providerId), {
+  content = removeTopLevelTomlField(content, "preferred_auth_method");
+  content = removeTopLevelTomlField(content, "temp_env_key");
+  content = removeTomlSectionField(content, providerSectionName, "temp_env_key");
+  content = removeTomlSectionField(content, providerSectionName, "env_key");
+  content = updateTomlSectionFields(content, providerSectionName, {
     name: providerName,
     base_url: baseUrl,
     wire_api: "responses",
-    temp_env_key: CODEX_ENV_KEY,
     requires_openai_auth: true,
     supports_websockets: true
   });
@@ -408,8 +395,13 @@ function mergeCodexAuthData(auth, envKey, apiKey, managedAuthKeys = []) {
   for (const managedAuthKey of managedAuthKeys) {
     delete nextAuth[managedAuthKey];
   }
-  if (apiKey) nextAuth[envKey] = apiKey;
-  else delete nextAuth[envKey];
+  if (apiKey) {
+    nextAuth.auth_mode = "apikey";
+    nextAuth[envKey] = apiKey;
+  } else {
+    delete nextAuth[envKey];
+    if (nextAuth.auth_mode === "apikey") delete nextAuth.auth_mode;
+  }
   return nextAuth;
 }
 

package/lib/providers/pi.mjs

@@ -1,12 +1,11 @@
 import { spawn, spawnSync } from "node:child_process";
 import { join } from "node:path";
 import * as p from "@clack/prompts";
-import { piInsecureTlsHeader } from "../../extensions/pi-gpt-responses-compat/tls-fetch.mjs";
 import {
   readJsonFileSafe,
   readJsoncFileSafe,
   updateLockedJson,
-  writeJsonFileWithBackup,
+  writeJson,
   writeText
 } from "../config/store.mjs";
 import { defaultPaths, maskSecret, pathToLabel } from "../paths.mjs";
@@ -310,36 +309,17 @@ function buildPiModelConfig(modelId, existingModel = {}) {
   };
 }
 
-function hasPiInsecureTlsSetting(modelsConfig = {}, providerId) {
-  const headers = modelsConfig.providers?.[requirePiProviderId(providerId)]?.headers;
-  return headers && typeof headers === "object"
-    ? Object.keys(headers).some((key) => key.toLowerCase() === piInsecureTlsHeader)
-    : false;
-}
-
 function buildPiModelsConfig(modelsConfig = {}, {
   providerId,
   baseUrl,
   api,
-  modelIds,
-  insecureTls = false
+  modelIds
 }) {
   const targetProviderId = requirePiProviderId(providerId);
   const providers = modelsConfig.providers && typeof modelsConfig.providers === "object" ? modelsConfig.providers : {};
   const currentProvider = providers[targetProviderId] && typeof providers[targetProviderId] === "object"
     ? providers[targetProviderId]
     : {};
-  const headers = currentProvider.headers && typeof currentProvider.headers === "object"
-    ? { ...currentProvider.headers }
-    : {};
-  for (const key of Object.keys(headers)) {
-    if (key.toLowerCase() === piInsecureTlsHeader) {
-      delete headers[key];
-    }
-  }
-  if (insecureTls) {
-    headers[piInsecureTlsHeader] = new URL(baseUrl).origin;
-  }
   const existingModels = new Map(
     (Array.isArray(currentProvider.models) ? currentProvider.models : [])
       .filter((model) => model?.id)
@@ -357,11 +337,6 @@ function buildPiModelsConfig(modelsConfig = {}, {
     models: modelIds.map((modelId) => buildPiModelConfig(modelId, existingModels.get(modelId)))
   };
   delete provider.apiKey;
-  if (Object.keys(headers).length) {
-    provider.headers = headers;
-  } else {
-    delete provider.headers;
-  }
 
   return {
     ...modelsConfig,
@@ -413,7 +388,6 @@ function buildPiConfiguration({ auth, models, settings }, {
   baseUrl,
   api,
   modelIds,
-  insecureTls,
   defaultModel
 }) {
   const targetProviderId = requirePiProviderId(providerId);
@@ -425,8 +399,7 @@ function buildPiConfiguration({ auth, models, settings }, {
       providerId: targetProviderId,
       baseUrl,
       api,
-      modelIds,
-      insecureTls
+      modelIds
     }),
     settings: buildPiSettingsConfig(settings, targetProviderId, defaultModel)
   };
@@ -439,7 +412,7 @@ async function persistPiConfiguration(paths, configuration, operations = {}) {
     `${JSON.stringify(value, null, 2)}\n`,
     { sensitive: true }
   ));
-  const writeSettings = operations.writeSettings ?? ((path, value) => writeJsonFileWithBackup(path, value));
+  const writeSettings = operations.writeSettings ?? ((path, value) => writeJson(path, value));
   await updateAuth(paths.piAuthPath, configuration.providerId, configuration.apiKey);
   await writeModels(paths.piModelsPath, configuration.models);
   await writeSettings(paths.piSettingsPath, configuration.settings);
@@ -455,11 +428,8 @@ async function configurePiApi(paths = defaultPaths, ensurePiResourcesLinked = as
   }
   const {
     assertNotCancelled,
-    confirmOrCancel,
-    passwordPromptOptions,
+    passwordOrExisting,
     required,
-    requiredUnlessExisting,
-    resolvePasswordValue,
     selectOrCancel
   } = promptApi;
   const {
@@ -495,11 +465,6 @@ async function configurePiApi(paths = defaultPaths, ensurePiResourcesLinked = as
   const inferredApi = inferPiApiFromBaseUrl(baseUrlInput);
   const baseUrl = normalizeOpenAiBaseUrl(baseUrlInput);
 
-  const insecureTls = await confirmOrCancel({
-    message: `是否仅为 ${providerLabel} 中转请求跳过 TLS 证书校验？仅证书无法修复时启用`,
-    initialValue: hasPiInsecureTlsSetting(modelsConfig, providerId)
-  });
-
   const piApiOptions = getPiApiPromptOptions();
   const initialApi = piApiOptions.some((option) => option.value === existing.api)
     ? existing.api
@@ -510,13 +475,10 @@ async function configurePiApi(paths = defaultPaths, ensurePiResourcesLinked = as
     ...(initialApi ? { initialValue: initialApi } : {})
   });
 
-  const apiKey = await p.password(passwordPromptOptions(
-    `${providerLabel} API Key`,
-    existing.apiKey,
-    requiredUnlessExisting(existing.apiKey, "API Key 不能为空")
-  ));
-  assertNotCancelled(apiKey);
-  const finalApiKey = resolvePasswordValue(apiKey, existing.apiKey);
+  const finalApiKey = await passwordOrExisting({
+    message: `${providerLabel} API Key`,
+    existingValue: existing.apiKey
+  });
 
   const modelIdsText = await p.text({
     message: `${providerLabel} 模型 ID（多个用逗号分隔）`,
@@ -542,7 +504,6 @@ async function configurePiApi(paths = defaultPaths, ensurePiResourcesLinked = as
     baseUrl,
     api,
     modelIds,
-    insecureTls,
     defaultModel: finalDefaultModel
   });
   await ensurePiResourcesLinked(paths);
@@ -564,7 +525,6 @@ export {
   configurePiApi,
   detectPiEffectiveModel,
   getPiApiPromptOptions,
-  hasPiInsecureTlsSetting,
   inferPiApiFromBaseUrl,
   normalizeOpenAiBaseUrl,
   parsePiRpcEffectiveModel,

package/lib/providers/skills.mjs

@@ -21,10 +21,8 @@ async function configureGrokSearchEnv(paths, ensureSkillPresent = async () => {}
   const {
     assertNotCancelled,
     confirmOrCancel,
-    passwordPromptOptions,
-    required,
-    requiredUnlessExisting,
-    resolvePasswordValue
+    passwordOrExisting,
+    required
   } = promptApi;
   await ensureSkillPresent(paths);
   const envPath = join(paths.agentsDir, "skills", "grok-search", ".env");
@@ -36,13 +34,11 @@ async function configureGrokSearchEnv(paths, ensureSkillPresent = async () => {}
   });
   assertNotCancelled(baseUrl);
 
-  const apiKey = await p.password(passwordPromptOptions(
-    "Grok API Key",
-    existing.GROK_API_KEY,
-    requiredUnlessExisting(existing.GROK_API_KEY, "Grok API Key 不能为空")
-  ));
-  assertNotCancelled(apiKey);
-  const finalApiKey = resolvePasswordValue(apiKey, existing.GROK_API_KEY);
+  const finalApiKey = await passwordOrExisting({
+    message: "Grok API Key",
+    existingValue: existing.GROK_API_KEY,
+    requiredMessage: "Grok API Key 不能为空"
+  });
 
   const model = await p.text({
     message: "Grok 默认模型",
@@ -65,15 +61,13 @@ async function configureGrokSearchEnv(paths, ensureSkillPresent = async () => {}
     : null;
   if (useTavily) assertNotCancelled(tavilyUrl);
 
-  const tavilyKey = useTavily
-    ? await p.password(passwordPromptOptions(
-        "Tavily API Key",
-        existing.TAVILY_API_KEY,
-        requiredUnlessExisting(existing.TAVILY_API_KEY, "Tavily API Key 不能为空")
-      ))
-    : "";
-  if (useTavily) assertNotCancelled(tavilyKey);
-  const finalTavilyKey = useTavily ? resolvePasswordValue(tavilyKey, existing.TAVILY_API_KEY) : null;
+  const finalTavilyKey = useTavily
+    ? await passwordOrExisting({
+        message: "Tavily API Key",
+        existingValue: existing.TAVILY_API_KEY,
+        requiredMessage: "Tavily API Key 不能为空"
+      })
+    : null;
 
   await updateSkillEnvFile(envPath, {
     GROK_API_URL: baseUrl,
@@ -88,16 +82,15 @@ async function configureGrokSearchEnv(paths, ensureSkillPresent = async () => {}
 }
 
 async function configureContext7Env(paths, ensureSkillPresent = async () => {}, promptApi) {
-  const { assertNotCancelled, passwordPromptOptions, resolvePasswordValue } = promptApi;
+  const { passwordOrExisting } = promptApi;
   await ensureSkillPresent(paths);
   const envPath = join(paths.agentsDir, "skills", "context7-auto-research", ".env");
   const existing = await readSkillEnvFile(envPath);
-  const apiKey = await p.password(passwordPromptOptions(
-    "Context7 API Key（可选）",
-    existing.CONTEXT7_API_KEY
-  ));
-  assertNotCancelled(apiKey);
-  const finalApiKey = resolvePasswordValue(apiKey, existing.CONTEXT7_API_KEY);
+  const finalApiKey = await passwordOrExisting({
+    message: "Context7 API Key（可选）",
+    existingValue: existing.CONTEXT7_API_KEY,
+    requiredMessage: null
+  });
 
   await updateSkillEnvFile(envPath, {
     CONTEXT7_API_KEY: finalApiKey

package/lib/templates/codex/config-base.toml

@@ -1,10 +1,9 @@
 personality = "pragmatic"
 model_provider = "abelworkflow"
 disable_response_storage = true
-preferred_auth_method = "apikey"
 approvals_reviewer = "guardian_subagent"
 approval_policy = "on-request"
-sandbox_mode = "workspace-write"
+sandbox_mode = "danger-full-access"
 model = "gpt-5.6-sol"
 model_reasoning_effort = "high"
 network_access = true

package/lib/utils.mjs

@@ -0,0 +1,15 @@
+import { createHash } from "node:crypto";
+
+function hashBytes(content) {
+  return createHash("sha256").update(content).digest("hex");
+}
+
+function isManagedCodexAgentFileEntry(name, hash) {
+  return name.endsWith(".toml")
+    && !name.includes("/")
+    && !name.includes("\\")
+    && typeof hash === "string"
+    && /^[a-f0-9]{64}$/u.test(hash);
+}
+
+export { hashBytes, isManagedCodexAgentFileEntry };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "abelworkflow",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "Install AbelWorkflow into ~/.agents and create Claude/Codex symlinks.",
   "type": "module",
   "scripts": {