abelworkflow 1.1.1 → 1.1.3

package/README.md

@@ -63,7 +63,7 @@ node .\bin\abelworkflow.mjs install --agents-dir "$HOME\.agents"
 
 - Claude 配置默认写入 `bypassPermissions` 全权限模式（YOLO），第三方 API 仅使用 API Key 认证，不添加任何 MCP 权限。已有 permissions、deny、hooks 和 timeout 保持不变。
 - Codex 只更新 AbelWorkflow 管理的认证字段，保留未知字段、其他 Provider 和用户 token。
-- Pi 0.80.0 及以上版本按无会话启动时实际选中的当前有效 Provider 配置 API，并将其 API Key 保存在 `~/.pi/agent/auth.json`；`models.json` 只保留模型定义。旧 models-only key 会按先写 auth、后删除旧 key 的顺序迁移。
+- Pi 0.80.0 及以上版本按无会话启动时实际选中的当前有效 Provider 配置 API；首次使用且 Pi 明确没有可用模型时，引导创建 `gpt` 自定义 Provider。API Key 保存在 `~/.pi/agent/auth.json`，`models.json` 只保留模型定义；旧 models-only key 会按先写 auth、后删除旧 key 的顺序迁移。
 - Grok 默认模型统一为 `grok-4.20-non-reasoning`。
 - Context7 使用显式 CommonJS 入口 `context7-api.cjs`。
 - dev-browser 发布运行时使用 Node ESM 编译产物，入口为 `node dist/scripts/start.js`，不依赖 Bun 或运行时 `npx tsx`。

package/lib/cli/main.mjs

@@ -126,31 +126,32 @@ ${c.bold("Default behavior:")}
 `);
 }
 
-async function configureCodexForPaths(paths) {
+async function configureProviderWithMetadata(paths, configure) {
   const metadata = await readInstallMetadata(paths);
   const packageVersion = await packageVersionFor(paths, metadata);
-  const result = await configureCodexApi(paths, promptApi, {
-    managedAuthKeys: getPreviousManagedCodexAuthKeys(metadata),
-    managedCodexAgentFiles: getPreviousManagedCodexAgentFiles(metadata)
-  });
+  const overrides = await configure(metadata);
   await writeInstallMetadata(paths, finalizeProviderInstallMetadata({
     previousMetadata: metadata,
     packageVersion,
-    overrides: {
+    overrides
+  }));
+}
+
+async function configureCodexForPaths(paths) {
+  await configureProviderWithMetadata(paths, async (metadata) => {
+    const result = await configureCodexApi(paths, promptApi, {
+      managedAuthKeys: getPreviousManagedCodexAuthKeys(metadata),
+      managedCodexAgentFiles: getPreviousManagedCodexAgentFiles(metadata)
+    });
+    return {
       managedCodexAuthKeys: result.managedAuthKeys,
       managedCodexAgentFiles: result.managedCodexAgentFiles
-    }
-  }));
+    };
+  });
 }
 
 async function configureClaudeForPaths(paths) {
-  const metadata = await readInstallMetadata(paths);
-  const packageVersion = await packageVersionFor(paths, metadata);
-  await configureClaudeApi(paths, promptApi);
-  await writeInstallMetadata(paths, finalizeProviderInstallMetadata({
-    previousMetadata: metadata,
-    packageVersion
-  }));
+  await configureProviderWithMetadata(paths, () => configureClaudeApi(paths, promptApi));
 }
 
 async function runFullInit(options) {
@@ -176,13 +177,13 @@ async function runFullInit(options) {
     await installCliTool("pi", promptApi);
   }
   if (await confirmOrCancel({ message: "是否配置 Pi 当前有效 Provider API？", initialValue: commandExists("pi") })) {
-    await configurePiApi(options.paths, ensurePiResourcesLinked, promptApi);
+    await configurePiApi(options.paths, ensurePiResourcesLinkedWithReport, promptApi);
   }
   if (await confirmOrCancel({ message: "是否填写 grok-search 环境变量？", initialValue: false })) {
-    await configureGrokSearchEnv(options.paths, (paths) => ensureSkillPresent(paths, "grok-search"), promptApi);
+    await configureGrokSearchEnv(options.paths, (paths) => ensureSkillPresentWithReport(paths, "grok-search"), promptApi);
   }
   if (await confirmOrCancel({ message: "是否填写 context7-auto-research 环境变量？", initialValue: false })) {
-    await configureContext7Env(options.paths, (paths) => ensureSkillPresent(paths, "context7-auto-research"), promptApi);
+    await configureContext7Env(options.paths, (paths) => ensureSkillPresentWithReport(paths, "context7-auto-research"), promptApi);
   }
 
   const conflictCount = uniqueReportPaths(installReport.conflicts).length;
@@ -205,35 +206,31 @@ async function runInteractiveMenu(options) {
     return opt;
   };
   const cliToolMenus = {
-    "pi-cli": {
-      tool: "pi",
+    pi: {
       title: "Pi",
-      actions: {
-        "pi-install": async () => installCliTool("pi", promptApi),
-        "pi-api": async () => configurePiApi(options.paths, ensurePiResourcesLinkedWithReport, promptApi)
-      }
+      install: () => installCliTool("pi", promptApi),
+      configure: () => configurePiApi(options.paths, ensurePiResourcesLinkedWithReport, promptApi)
     },
-    "codex-cli": {
-      tool: "codex",
+    codex: {
       title: "Codex",
-      actions: {
-        "codex-install": async () => installCliTool("codex", promptApi),
-        "codex-api": async () => configureCodexForPaths(options.paths)
-      }
+      install: () => installCliTool("codex", promptApi),
+      configure: () => configureCodexForPaths(options.paths)
     },
-    "claude-cli": {
-      tool: "claude",
+    claude: {
       title: "Claude Code",
-      actions: {
-        "claude-install": async () => installCliTool("claude", promptApi),
-        "claude-api": async () => configureClaudeForPaths(options.paths)
-      }
+      install: () => installCliTool("claude", promptApi),
+      configure: () => configureClaudeForPaths(options.paths)
     }
   };
-  const runCliToolMenu = async ({ tool, title, actions }) => {
+  const runCliToolMenu = async (tool) => {
+    const menu = cliToolMenus[tool];
+    const actions = {
+      [`${tool}-api`]: menu.configure,
+      [`${tool}-install`]: menu.install
+    };
     while (true) {
       const choice = await p.select({
-        message: `请选择 ${title} 操作`,
+        message: `请选择 ${menu.title} 操作`,
         options: buildCliToolMenuDescriptors(tool).map(buildOption),
         initialValue: `${tool}-api`
       });
@@ -259,9 +256,9 @@ async function runInteractiveMenu(options) {
     }),
     "grok-search": async () => configureGrokSearchEnv(options.paths, (paths) => ensureSkillPresentWithReport(paths, "grok-search"), promptApi),
     context7: async () => configureContext7Env(options.paths, (paths) => ensureSkillPresentWithReport(paths, "context7-auto-research"), promptApi),
-    "pi-cli": async () => runCliToolMenu(cliToolMenus["pi-cli"]),
-    "codex-cli": async () => runCliToolMenu(cliToolMenus["codex-cli"]),
-    "claude-cli": async () => runCliToolMenu(cliToolMenus["claude-cli"])
+    "pi-cli": async () => runCliToolMenu("pi"),
+    "codex-cli": async () => runCliToolMenu("codex"),
+    "claude-cli": async () => runCliToolMenu("claude")
   };
 
   while (true) {
@@ -376,10 +373,4 @@ async function main(argv, runtime = {}) {
   }
 }
 
-export {
-  main,
-  presentInstallReport,
-  printHelp,
-  runFullInit,
-  runInteractiveMenu
-};
+export { main, presentInstallReport };

package/lib/cli/prompts.mjs

@@ -11,22 +11,10 @@ const interactiveMenuDescriptors = [
   { value: "exit", label: "退出", group: "exit" }
 ];
 const interactiveMenuDefaultValue = "full-init";
-const cliToolMenuDescriptorMap = {
-  pi: [
-    { value: "pi-api", label: "配置 Pi API" },
-    { value: "pi-install", label: "安装/更新 Pi" },
-    { value: "back", label: "返回上一级" }
-  ],
-  codex: [
-    { value: "codex-api", label: "配置 Codex API" },
-    { value: "codex-install", label: "安装/更新 Codex" },
-    { value: "back", label: "返回上一级" }
-  ],
-  claude: [
-    { value: "claude-api", label: "配置 Claude Code API" },
-    { value: "claude-install", label: "安装/更新 Claude Code" },
-    { value: "back", label: "返回上一级" }
-  ]
+const cliToolLabels = {
+  pi: "Pi",
+  codex: "Codex",
+  claude: "Claude Code"
 };
 class CancelledError extends Error {
   constructor(message = "用户取消") {
@@ -36,9 +24,13 @@ class CancelledError extends Error {
 }
 
 function buildCliToolMenuDescriptors(tool) {
-  const descriptors = cliToolMenuDescriptorMap[tool];
-  if (!descriptors) throw new Error(`Unknown CLI tool: ${tool}`);
-  return descriptors.map((descriptor) => ({ ...descriptor }));
+  const label = cliToolLabels[tool];
+  if (!label) throw new Error(`Unknown CLI tool: ${tool}`);
+  return [
+    { value: `${tool}-api`, label: `配置 ${label} API` },
+    { value: `${tool}-install`, label: `安装/更新 ${label}` },
+    { value: "back", label: "返回上一级" }
+  ];
 }
 
 function required(message = "此项不能为空") {
@@ -79,6 +71,16 @@ function assertNotCancelled(value) {
   if (p.isCancel(value)) throw new CancelledError();
 }
 
+async function passwordOrExisting({ message, existingValue, requiredMessage = "API Key 不能为空" }) {
+  const input = await p.password(passwordPromptOptions(
+    message,
+    existingValue,
+    requiredMessage ? requiredUnlessExisting(existingValue, requiredMessage) : undefined
+  ));
+  assertNotCancelled(input);
+  return resolvePasswordValue(input, existingValue);
+}
+
 async function confirmOrCancel({ message, initialValue = false }) {
   const value = await p.confirm({ message, initialValue, active: "是", inactive: "否" });
   assertNotCancelled(value);
@@ -98,6 +100,7 @@ export {
   confirmOrCancel,
   interactiveMenuDefaultValue,
   interactiveMenuDescriptors,
+  passwordOrExisting,
   passwordPromptOptions,
   required,
   requiredUnlessExisting,

package/lib/config/dotenv.mjs

@@ -34,14 +34,6 @@ function quoteEnvValue(value) {
   throw new Error("Environment value cannot be represented without changing its meaning");
 }
 
-function renderDotenv(values) {
-  const lines = Object.entries(values)
-    .filter(([, value]) => value !== undefined && value !== null && value !== "")
-    .sort(([left], [right]) => left.localeCompare(right))
-    .map(([key, value]) => `${key}=${quoteEnvValue(String(value))}`);
-  return lines.length ? `${lines.join("\n")}\n` : "";
-}
-
 function getDotenvLines(content) {
   const lines = [];
   for (let start = 0; start < content.length;) {
@@ -99,4 +91,4 @@ function updateDotenvContent(content, updates) {
   return next;
 }
 
-export { parseDotenv, quoteEnvValue, renderDotenv, updateDotenvContent };
+export { parseDotenv, quoteEnvValue, updateDotenvContent };

package/lib/config/store.mjs

@@ -6,7 +6,6 @@ import { stripJsonComments } from "./jsonc.mjs";
 
 const newBackupMarker = ".abelworkflow.bak.";
 const newBackupSuffixPattern = /^\d+-\d+-\d{10,}$/u;
-const chmod = fs.chmod;
 let uniqueFileIndex = 0;
 
 function nextUniqueSuffix() {
@@ -225,21 +224,6 @@ async function updateLockedJson(path, updater, options = {}) {
   }
 }
 
-async function backupExistingPath(targetPath, options = {}) {
-  return copyBackup(targetPath, options);
-}
-
-async function backupPrivateFile(targetPath, content, options = {}) {
-  if (!(await pathExists(targetPath))) return null;
-  const backupLimit = options.backupLimit ?? 3;
-  if (backupLimit === 0) return null;
-  const backupPath = await createBackupPath(targetPath);
-  await fs.writeFile(backupPath, content, { encoding: "utf8", flag: "wx", mode: 0o600 });
-  if (isPosix()) await fs.chmod(backupPath, 0o600);
-  await pruneNewBackups(targetPath, backupLimit);
-  return backupPath;
-}
-
 async function backupIfNeeded(targetPath, options = {}) {
   if (!(await pathExists(targetPath))) return null;
   const backupLimit = options.backupLimit ?? 3;
@@ -281,19 +265,8 @@ async function updateDotenvFile(path, updates, options = {}) {
   return writeText(path, updateDotenvContent(content, updates), options);
 }
 
-async function writeJsonFileSafe(path, data, options = {}) {
-  return writeJson(path, data, { ...options, backupLimit: options.backupLimit ?? 0 });
-}
-
-async function writeJsonFileWithBackup(path, data, options = {}) {
-  return writeJson(path, data, options);
-}
-
 export {
-  backupExistingPath,
   backupIfNeeded,
-  backupPrivateFile,
-  chmod,
   ensurePrivateJsonFile,
   pathExists,
   pathTargetExists,
@@ -304,7 +277,5 @@ export {
   updateDotenvFile,
   updateLockedJson,
   writeJson,
-  writeJsonFileSafe,
-  writeJsonFileWithBackup,
   writeText
 };

package/lib/config/toml.mjs

@@ -46,6 +46,15 @@ function removeTomlSection(content, sectionName) {
   return `${content.slice(0, section.start)}${content.slice(section.end)}`;
 }
 
+function removeTomlSectionField(content, sectionName, field) {
+  const document = parseTomlDocument(content);
+  const section = findTomlSection(document, sectionName);
+  const entry = section && findTomlAssignment(document.assignments, field, section);
+  return entry
+    ? `${content.slice(0, entry.start)}${content.slice(entry.lineEnd)}`
+    : content;
+}
+
 function buildTomlSection(sectionName, values, lineEnding = "\n") {
   const lines = [`[${sectionName}]`];
   for (const [key, value] of Object.entries(values)) {
@@ -399,14 +408,6 @@ function findTomlAssignment(assignments, field, section) {
   ));
 }
 
-function splitTopLevelTomlContent(content) {
-  const { topLevelEnd } = parseTomlDocument(content);
-  return {
-    topLevel: topLevelEnd === -1 ? content : content.slice(0, topLevelEnd),
-    rest: topLevelEnd === -1 ? "" : content.slice(topLevelEnd)
-  };
-}
-
 function extractTopLevelTomlEntries(content) {
   const document = parseTomlDocument(content);
   return document.assignments
@@ -631,8 +632,8 @@ export {
   parseTomlSection,
   readTopLevelTomlString,
   removeTomlSection,
+  removeTomlSectionField,
   removeTopLevelTomlField,
-  splitTopLevelTomlContent,
   updateTomlSectionFields,
   updateTopLevelTomlField
 };

package/lib/installer/assets.mjs

@@ -1,4 +1,3 @@
-import { createHash } from "node:crypto";
 import * as fs from "node:fs/promises";
 import { join, relative, resolve } from "node:path";
 import {
@@ -8,6 +7,7 @@ import {
   readJsonFileSafe,
   writeText
 } from "../config/store.mjs";
+import { hashBytes } from "../utils.mjs";
 import { createInstallReport, readInstallMetadata } from "./state.mjs";
 
 const ignoredSkillPathPatterns = [
@@ -69,10 +69,6 @@ function mapGitignoreTemplate(relativePath) {
   return relativePath.replace(/(^|\/)gitignore\.template$/u, "$1.gitignore");
 }
 
-function hashBytes(content) {
-  return createHash("sha256").update(content).digest("hex");
-}
-
 function shouldCopySkillPath(skillsRoot, sourcePath) {
   const relativePath = normalizeRelativePath(relative(skillsRoot, sourcePath));
   if (!relativePath) return true;
@@ -316,9 +312,9 @@ async function ensureManagedContainerDirectory(targetPath, sourcePath) {
 export {
   collectManagedAssets,
   ensureManagedContainerDirectory,
-  hashBytes,
   pathsReferToSameEntry,
   readManagedFiles,
+  readPackageVersion,
   shouldCopySkillPath,
   syncManagedFiles
 };

package/lib/installer/install.mjs

@@ -1,7 +1,6 @@
-import { join } from "node:path";
-import { pathExists, readJsonFileSafe } from "../config/store.mjs";
-import { createPaths, defaultPaths } from "../paths.mjs";
-import { readManagedFiles, syncManagedFiles } from "./assets.mjs";
+import { pathExists } from "../config/store.mjs";
+import { createPaths } from "../paths.mjs";
+import { readManagedFiles, readPackageVersion, syncManagedFiles } from "./assets.mjs";
 import { linkClaude, linkCodex, linkPi } from "./links.mjs";
 import {
   buildInstallMetadata,
@@ -27,15 +26,6 @@ function validatedPaths(paths) {
   });
 }
 
-function resolveInstallPaths(options = {}) {
-  if (options.paths) return validatedPaths(options.paths);
-  return createPaths({
-    homeDir: options.homeDir ?? defaultPaths.homeDir,
-    packageRoot: options.packageRoot ?? defaultPaths.packageRoot,
-    agentsDir: options.agentsDir ?? defaultPaths.agentsDir
-  });
-}
-
 function reportFromLinkResults(results) {
   const report = createInstallReport();
   for (const result of results) {
@@ -58,12 +48,17 @@ async function packageVersionFor(paths, previousMetadata) {
     && previousMetadata.packageVersion) {
     return previousMetadata.packageVersion;
   }
-  const packagePath = join(paths.packageRoot, "package.json");
-  const packageData = await readJsonFileSafe(packagePath);
-  if (typeof packageData.version !== "string" || !packageData.version) {
-    throw new Error(`Missing package version in ${packagePath}`);
-  }
-  return packageData.version;
+  return readPackageVersion(paths);
+}
+
+async function writeInstallState(paths, assetResult, linkedTargets) {
+  const metadata = buildInstallMetadata({
+    previousMetadata: assetResult.previousMetadata,
+    packageVersion: assetResult.packageVersion,
+    managedFiles: assetResult.managedFiles,
+    linkedTargets
+  });
+  await writeInstallMetadata(paths, metadata);
 }
 
 async function installWorkflow(options) {
@@ -94,20 +89,12 @@ async function installWorkflow(options) {
   const codexResults = await linkCodex(paths, previousLinkedTargets, linkOptions);
   const piResults = await linkPi(paths, previousLinkedTargets, linkOptions);
   const linkResults = [...claudeResults, ...codexResults, ...piResults];
-  const linkedTargets = mergeLinkedTargets(previousLinkedTargets, linkResults);
-
-  const metadata = buildInstallMetadata({
-    previousMetadata,
-    packageVersion: assetResult.packageVersion,
-    managedFiles: assetResult.managedFiles,
-    linkedTargets
-  });
-  await writeInstallMetadata(paths, metadata);
+  await writeInstallState(paths, assetResult, mergeLinkedTargets(previousLinkedTargets, linkResults));
   return mergeInstallReports(assetResult.report, reportFromLinkResults(linkResults));
 }
 
 async function installManagedWorkflow(options = {}) {
-  return installWorkflow({ ...options, paths: resolveInstallPaths(options) });
+  return installWorkflow({ ...options, paths: validatedPaths(options.paths) });
 }
 
 async function ensureSkillPresent(inputPaths, skillName) {
@@ -118,13 +105,7 @@ async function ensureSkillPresent(inputPaths, skillName) {
     force: false,
     pathPrefix: `skills/${skillName}/`
   });
-  const metadata = buildInstallMetadata({
-    previousMetadata,
-    packageVersion: assetResult.packageVersion,
-    managedFiles: assetResult.managedFiles,
-    linkedTargets: previousMetadata.linkedTargets ?? {}
-  });
-  await writeInstallMetadata(paths, metadata);
+  await writeInstallState(paths, assetResult, previousMetadata.linkedTargets ?? {});
   return assetResult.report;
 }
 
@@ -134,13 +115,7 @@ async function ensurePiResourcesLinked(inputPaths) {
   const assetResult = await syncManagedFiles({ paths, force: false });
   const previousLinkedTargets = previousMetadata.linkedTargets ?? {};
   const piResults = await linkPi(paths, previousLinkedTargets, { force: false });
-  const metadata = buildInstallMetadata({
-    previousMetadata,
-    packageVersion: assetResult.packageVersion,
-    managedFiles: assetResult.managedFiles,
-    linkedTargets: mergeLinkedTargets(previousLinkedTargets, piResults)
-  });
-  await writeInstallMetadata(paths, metadata);
+  await writeInstallState(paths, assetResult, mergeLinkedTargets(previousLinkedTargets, piResults));
   return mergeInstallReports(assetResult.report, reportFromLinkResults(piResults));
 }
 

package/lib/installer/links.mjs

@@ -1,12 +1,9 @@
 import * as fs from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { backupIfNeeded, pathExists, pathTargetExists } from "../config/store.mjs";
-import { isWindows } from "../paths.mjs";
-import { ensureManagedContainerDirectory, hashBytes } from "./assets.mjs";
-
-function shouldForceFileSymlinkFailure(kind) {
-  return process.env.ABELWORKFLOW_TEST_FORCE_FILE_SYMLINK_EPERM === "1" && isWindows() && kind === "file";
-}
+import { containsPath, isWindows } from "../paths.mjs";
+import { hashBytes } from "../utils.mjs";
+import { ensureManagedContainerDirectory } from "./assets.mjs";
 
 async function createManagedTargetState(targetPath, sourcePath, kind, mode, status) {
   let targetHash;
@@ -16,12 +13,7 @@ async function createManagedTargetState(targetPath, sourcePath, kind, mode, stat
   return { targetPath, sourcePath, kind, mode, status, ...(targetHash ? { targetHash } : {}) };
 }
 
-async function createSymlink(targetPath, sourcePath, linkType, kind) {
-  if (shouldForceFileSymlinkFailure(kind)) {
-    const error = new Error("simulated EPERM");
-    error.code = "EPERM";
-    throw error;
-  }
+async function createSymlink(targetPath, sourcePath, linkType) {
   await fs.symlink(sourcePath, targetPath, linkType);
 }
 
@@ -150,7 +142,7 @@ async function ensureManagedLink(targetPath, sourcePath, kind, previousLinkedTar
 
   const linkType = isWindows() ? (kind === "dir" ? "junction" : "file") : kind;
   try {
-    await createSymlink(targetPath, sourcePath, linkType, kind);
+    await createSymlink(targetPath, sourcePath, linkType);
     return createManagedTargetState(targetPath, sourcePath, kind, "symlink", "linked");
   } catch (error) {
     if (!shouldFallbackToManagedFile(error, kind)) throw error;
@@ -258,11 +250,8 @@ async function getPiExtensionNames(extensionsDir) {
 }
 
 function isWithinManagedRoot(targetPath, managedSourceRoot, pathOps = { isAbsolute, relative, sep }) {
-  const relativePath = pathOps.relative(managedSourceRoot, targetPath);
-  return relativePath !== ""
-    && !pathOps.isAbsolute(relativePath)
-    && relativePath !== ".."
-    && !relativePath.startsWith(`..${pathOps.sep}`);
+  return pathOps.relative(managedSourceRoot, targetPath) !== ""
+    && containsPath(managedSourceRoot, targetPath, pathOps);
 }
 
 async function pruneManagedTargets(targetDir, managedSourceRoot, expectedNames, previousLinkedTargets, options = {}) {

package/lib/installer/state.mjs

@@ -1,5 +1,6 @@
 import { join } from "node:path";
 import { readJsonFileSafe, writeJson } from "../config/store.mjs";
+import { isManagedCodexAgentFileEntry } from "../utils.mjs";
 
 function metadataPathFor(paths) {
   return join(paths.agentsDir, paths.installMetadataName);
@@ -30,11 +31,7 @@ function getPreviousManagedCodexAuthKeys(previousMetadata = {}) {
 function normalizeManagedCodexAgentFiles(value = {}) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return {};
   return sortObject(Object.fromEntries(Object.entries(value).filter(([name, hash]) => (
-    name.endsWith(".toml")
-    && !name.includes("/")
-    && !name.includes("\\")
-    && typeof hash === "string"
-    && /^[a-f0-9]{64}$/u.test(hash)
+    isManagedCodexAgentFileEntry(name, hash)
   ))));
 }
 
@@ -63,7 +60,7 @@ function buildInstallMetadata({
   managedCodexAgentFiles = getPreviousManagedCodexAgentFiles(previousMetadata),
   linkedTargets = {}
 }) {
-  const metadata = {
+  return {
     schemaVersion: 2,
     packageVersion,
     managedFiles: sortObject(managedFiles),
@@ -71,10 +68,6 @@ function buildInstallMetadata({
     managedCodexAgentFiles: normalizeManagedCodexAgentFiles(managedCodexAgentFiles),
     linkedTargets: sortObject(linkedTargets)
   };
-  if (typeof previousMetadata.installedAt === "string") {
-    metadata.installedAt = previousMetadata.installedAt;
-  }
-  return metadata;
 }
 
 function finalizeProviderInstallMetadata({
@@ -100,17 +93,6 @@ function finalizeProviderInstallMetadata({
   });
 }
 
-function linkedTargetsFromResults(results) {
-  return Object.fromEntries(results
-    .filter((result) => result.sourcePath)
-    .map((result) => [result.targetPath, {
-      sourcePath: result.sourcePath,
-      kind: result.kind,
-      mode: result.mode,
-      ...(result.targetHash ? { targetHash: result.targetHash } : {})
-    }]));
-}
-
 function mergeLinkedTargets(previousLinkedTargets = {}, results = []) {
   const nextLinkedTargets = { ...previousLinkedTargets };
   for (const result of results) {
@@ -154,7 +136,6 @@ export {
   finalizeProviderInstallMetadata,
   getPreviousManagedCodexAgentFiles,
   getPreviousManagedCodexAuthKeys,
-  linkedTargetsFromResults,
   mergeInstallReports,
   mergeLinkedTargets,
   metadataPathFor,

package/lib/providers/claude.mjs

@@ -1,8 +1,5 @@
 import * as p from "@clack/prompts";
-import {
-  readJsonFileSafe,
-  writeJsonFileWithBackup
-} from "../config/store.mjs";
+import { readJsonFileSafe, writeJson } from "../config/store.mjs";
 import { defaultPaths, maskSecret, pathToLabel } from "../paths.mjs";
 
 const claudeModelEnvKeys = [
@@ -111,18 +108,12 @@ function buildClaudeApiSettings(settings, {
 }
 
 async function persistClaudeConfiguration(paths, { settings, metaConfig }) {
-  await writeJsonFileWithBackup(paths.claudeSettingsPath, settings, { sensitive: true });
-  await writeJsonFileWithBackup(paths.claudeMetaConfigPath, metaConfig, { sensitive: true });
+  await writeJson(paths.claudeSettingsPath, settings, { sensitive: true });
+  await writeJson(paths.claudeMetaConfigPath, metaConfig, { sensitive: true });
 }
 
 async function configureClaudeApi(paths = defaultPaths, promptApi) {
-  const {
-    assertNotCancelled,
-    passwordPromptOptions,
-    required,
-    requiredUnlessExisting,
-    resolvePasswordValue
-  } = promptApi;
+  const { assertNotCancelled, passwordOrExisting, required } = promptApi;
   const settings = await readJsonFileSafe(paths.claudeSettingsPath, {}, { sensitive: true });
   const existing = getExistingClaudeApiConfig(settings);
 
@@ -133,13 +124,10 @@ async function configureClaudeApi(paths = defaultPaths, promptApi) {
   });
   assertNotCancelled(baseUrl);
 
-  const key = await p.password(passwordPromptOptions(
-    "Claude Code API Key",
-    existing.key,
-    requiredUnlessExisting(existing.key, "API Key 不能为空")
-  ));
-  assertNotCancelled(key);
-  const finalKey = resolvePasswordValue(key, existing.key);
+  const finalKey = await passwordOrExisting({
+    message: "Claude Code API Key",
+    existingValue: existing.key
+  });
 
   const model = await p.text({
     message: "Claude Code 模型",

package/lib/providers/codex.mjs

@@ -1,11 +1,10 @@
-import { createHash } from "node:crypto";
 import { lstat, mkdir, readFile, readdir, unlink } from "node:fs/promises";
 import { join } from "node:path";
 import * as p from "@clack/prompts";
 import {
   pathExists,
   readJsonFileSafe,
-  writeJsonFileWithBackup,
+  writeJson,
   writeText
 } from "../config/store.mjs";
 import {
@@ -18,11 +17,13 @@ import {
   parseTomlSection,
   readTopLevelTomlString,
   removeTomlSection,
+  removeTomlSectionField,
   removeTopLevelTomlField,
   updateTomlSectionFields,
   updateTopLevelTomlField
 } from "../config/toml.mjs";
 import { defaultPaths, maskSecret, pathToLabel } from "../paths.mjs";
+import { hashBytes, isManagedCodexAgentFileEntry } from "../utils.mjs";
 import { normalizeOpenAiBaseUrl } from "./pi.mjs";
 
 const CODEX_ENV_KEY = "OPENAI_API_KEY";
@@ -98,7 +99,7 @@ function mergeCodexTemplateDefaults(content, templateContent) {
   const currentDeveloperInstructions = readTopLevelTomlString(nextContent, "developer_instructions");
   const templateDeveloperInstructions = readTopLevelTomlString(templateContent, "developer_instructions");
   if (templateDeveloperInstructions && publishedCodexDeveloperInstructionHashes.has(
-    sha256(currentDeveloperInstructions)
+    hashBytes(currentDeveloperInstructions)
   )) {
     nextContent = updateTopLevelTomlField(
       nextContent,
@@ -125,10 +126,6 @@ async function loadBundledCodexConfigTemplate(paths = defaultPaths) {
   return readFile(paths.codexTemplateConfigPath, "utf8");
 }
 
-function sha256(content) {
-  return createHash("sha256").update(content).digest("hex");
-}
-
 async function readCodexAgentTarget(path) {
   try {
     const targetStat = await lstat(path);
@@ -175,14 +172,6 @@ async function ensureCodexAgentContainer(homeDir) {
   return targetDir;
 }
 
-function isCodexAgentOwnership(name, hash) {
-  return name.endsWith(".toml")
-    && !name.includes("/")
-    && !name.includes("\\")
-    && typeof hash === "string"
-    && /^[a-f0-9]{64}$/u.test(hash);
-}
-
 function isPublishedCodexAgent(name, hash) {
   return publishedCodexAgentHashes[name]?.has(hash) ?? false;
 }
@@ -205,9 +194,9 @@ async function deployBundledCodexAgents(paths = defaultPaths, previousManagedFil
     const source = join(paths.codexTemplateAgentsPath, name);
     const target = join(targetDir, name);
     const sourceContent = await readFile(source);
-    const sourceHash = sha256(sourceContent);
+    const sourceHash = hashBytes(sourceContent);
     const current = await readCodexAgentTarget(target);
-    const currentHash = current.content ? sha256(current.content) : "";
+    const currentHash = current.content ? hashBytes(current.content) : "";
 
     if (!current.exists) {
       await writeText(target, sourceContent, { backupLimit: 0 });
@@ -222,7 +211,7 @@ async function deployBundledCodexAgents(paths = defaultPaths, previousManagedFil
       result.updated.push(target);
     } else {
       result.conflicts.push(target);
-      if (isCodexAgentOwnership(name, previousManagedFiles?.[name])) {
+      if (isManagedCodexAgentFileEntry(name, previousManagedFiles?.[name])) {
         result.managedFiles[name] = previousManagedFiles[name];
       }
       continue;
@@ -237,11 +226,11 @@ async function deployBundledCodexAgents(paths = defaultPaths, previousManagedFil
     ? Object.entries(previousManagedFiles).sort(([left], [right]) => left.localeCompare(right))
     : [];
   for (const [name, previousHash] of previousEntries) {
-    if (bundledNames.has(name) || !isCodexAgentOwnership(name, previousHash)) continue;
+    if (bundledNames.has(name) || !isManagedCodexAgentFileEntry(name, previousHash)) continue;
     const target = join(targetDir, name);
     const current = await readCodexAgentTarget(target);
     if (!current.exists) continue;
-    if (current.content && sha256(current.content) === previousHash) {
+    if (current.content && hashBytes(current.content) === previousHash) {
       await unlink(target);
       continue;
     }
@@ -291,17 +280,15 @@ async function getExistingCodexApiConfig(paths = defaultPaths) {
 
 async function persistCodexConfiguration(paths, { content, auth }) {
   await writeText(paths.codexConfigPath, content);
-  await writeJsonFileWithBackup(paths.codexAuthPath, auth, { sensitive: true });
+  await writeJson(paths.codexAuthPath, auth, { sensitive: true });
 }
 
 async function configureCodexApi(paths = defaultPaths, promptApi, ownership = {}) {
   const {
     assertNotCancelled,
     confirmOrCancel,
-    passwordPromptOptions,
-    required,
-    requiredUnlessExisting,
-    resolvePasswordValue
+    passwordOrExisting,
+    required
   } = promptApi;
   const existing = await getExistingCodexApiConfig(paths);
   const providerId = existing.providerId || "abelworkflow";
@@ -314,13 +301,10 @@ async function configureCodexApi(paths = defaultPaths, promptApi, ownership = {}
   assertNotCancelled(baseUrlInput);
   const baseUrl = normalizeOpenAiBaseUrl(baseUrlInput);
 
-  const apiKey = await p.password(passwordPromptOptions(
-    "Codex 第三方 API Key",
-    existing.apiKey,
-    requiredUnlessExisting(existing.apiKey, "API Key 不能为空")
-  ));
-  assertNotCancelled(apiKey);
-  const finalApiKey = resolvePasswordValue(apiKey, existing.apiKey);
+  const finalApiKey = await passwordOrExisting({
+    message: "Codex 第三方 API Key",
+    existingValue: existing.apiKey
+  });
 
   const shouldDeploySubagents = await confirmOrCancel({ message: "是否部署 Codex subagents 配置？", initialValue: true });
   let managedCodexAgentFiles = { ...(ownership.managedCodexAgentFiles ?? {}) };
@@ -389,13 +373,16 @@ function buildCodexConfigContent(currentContent, {
   if (includeSubagentDefaults && readTopLevelTomlString(content, "approvals_reviewer") === "reviewer") {
     content = updateTopLevelTomlField(content, "approvals_reviewer", "guardian_subagent");
   }
+  const providerSectionName = getCodexProviderSectionName(providerId);
   content = updateTopLevelTomlField(content, "model_provider", providerId);
-  content = updateTopLevelTomlField(content, "preferred_auth_method", "apikey");
-  content = updateTomlSectionFields(content, getCodexProviderSectionName(providerId), {
+  content = removeTopLevelTomlField(content, "preferred_auth_method");
+  content = removeTopLevelTomlField(content, "temp_env_key");
+  content = removeTomlSectionField(content, providerSectionName, "temp_env_key");
+  content = removeTomlSectionField(content, providerSectionName, "env_key");
+  content = updateTomlSectionFields(content, providerSectionName, {
     name: providerName,
     base_url: baseUrl,
     wire_api: "responses",
-    temp_env_key: CODEX_ENV_KEY,
     requires_openai_auth: true,
     supports_websockets: true
   });
@@ -408,8 +395,13 @@ function mergeCodexAuthData(auth, envKey, apiKey, managedAuthKeys = []) {
   for (const managedAuthKey of managedAuthKeys) {
     delete nextAuth[managedAuthKey];
   }
-  if (apiKey) nextAuth[envKey] = apiKey;
-  else delete nextAuth[envKey];
+  if (apiKey) {
+    nextAuth.auth_mode = "apikey";
+    nextAuth[envKey] = apiKey;
+  } else {
+    delete nextAuth[envKey];
+    if (nextAuth.auth_mode === "apikey") delete nextAuth.auth_mode;
+  }
   return nextAuth;
 }
 

package/lib/providers/pi.mjs

@@ -5,12 +5,16 @@ import {
   readJsonFileSafe,
   readJsoncFileSafe,
   updateLockedJson,
-  writeJsonFileWithBackup,
+  writeJson,
   writeText
 } from "../config/store.mjs";
 import { defaultPaths, maskSecret, pathToLabel } from "../paths.mjs";
 
 const minimumPiVersion = [0, 80, 0];
+const piBootstrapProviderId = "gpt";
+const piBootstrapApi = "openai-completions";
+const piBootstrapBaseUrl = "https://api.openai.com/v1";
+const piBootstrapModelId = "gpt-5.5";
 const piRpcRequestId = "abelworkflow-provider";
 const piRpcArgs = [
   "--mode", "rpc",
@@ -68,15 +72,28 @@ function assertSupportedPiVersion(value) {
   return version;
 }
 
+function getPiProcessInvocation(args, {
+  platform = process.platform,
+  comspec = process.env.ComSpec || process.env.COMSPEC || "cmd.exe"
+} = {}) {
+  return platform === "win32"
+    ? { command: comspec, args: ["/d", "/c", "pi", ...args] }
+    : { command: "pi", args };
+}
+
 function detectPiVersion() {
-  const result = spawnSync("pi", ["--version"], {
+  const invocation = getPiProcessInvocation(["--version"]);
+  const result = spawnSync(invocation.command, invocation.args, {
     encoding: "utf8",
-    shell: process.platform === "win32",
     stdio: ["ignore", "pipe", "pipe"]
   });
   return result.status === 0 ? `${result.stdout || ""} ${result.stderr || ""}`.trim() : undefined;
 }
 
+function isPiUnknownModel(model) {
+  return model?.provider === "unknown" && model?.id === "unknown" && model?.api === "unknown";
+}
+
 function parsePiRpcEffectiveModel(value) {
   for (const line of String(value || "").split(/\r?\n/u)) {
     let payload;
@@ -85,27 +102,26 @@ function parsePiRpcEffectiveModel(value) {
     } catch {
       continue;
     }
-    const model = payload?.type === "response"
-      && payload.command === "get_state"
-      && payload.success === true
-      ? payload.data?.model
-      : undefined;
-    const provider = typeof model?.provider === "string" ? model.provider.trim() : "";
-    const id = typeof model?.id === "string" ? model.id.trim() : "";
-    if (!provider || !id) continue;
-    return {
-      provider,
-      id,
-      api: typeof model.api === "string" ? model.api.trim() : "",
-      baseUrl: typeof model.baseUrl === "string" ? model.baseUrl.trim() : ""
+    if (payload?.type !== "response"
+      || payload.command !== "get_state"
+      || payload.success !== true) continue;
+    const model = payload.data?.model;
+    if (model === null) return null;
+    const effectiveModel = {
+      provider: typeof model?.provider === "string" ? model.provider.trim() : "",
+      id: typeof model?.id === "string" ? model.id.trim() : "",
+      api: typeof model?.api === "string" ? model.api.trim() : "",
+      baseUrl: typeof model?.baseUrl === "string" ? model.baseUrl.trim() : ""
     };
+    if (isPiUnknownModel(effectiveModel)) return null;
+    if (effectiveModel.provider && effectiveModel.id) return effectiveModel;
   }
 }
 
 function runPiRpcCommand(command, args, {
   input = "",
   maxBuffer = 1024 * 1024,
-  shell = process.platform === "win32",
+  platform = process.platform,
   start = spawn,
   timeout = 20000
 } = {}) {
@@ -129,9 +145,11 @@ function runPiRpcCommand(command, args, {
     try {
       const env = { ...process.env };
       delete env.NODE_TEST_CONTEXT;
-      child = start(command, args, {
+      const invocation = command === "pi"
+        ? getPiProcessInvocation(args, { platform })
+        : { command, args };
+      child = start(invocation.command, invocation.args, {
         env,
-        shell,
         stdio: ["pipe", "pipe", "ignore"],
         windowsHide: true
       });
@@ -148,7 +166,7 @@ function runPiRpcCommand(command, args, {
       stdout += chunk;
       if (Buffer.byteLength(stdout, "utf8") > maxBuffer) {
         finish(null);
-      } else if (parsePiRpcEffectiveModel(stdout)) {
+      } else if (parsePiRpcEffectiveModel(stdout) !== undefined) {
         finish(0);
       }
     });
@@ -166,7 +184,7 @@ async function detectPiEffectiveModel(run = runPiRpcCommand) {
       encoding: "utf8",
       input: `${JSON.stringify({ id: piRpcRequestId, type: "get_state" })}\n`,
       maxBuffer: 1024 * 1024,
-      shell: process.platform === "win32",
+      platform: process.platform,
       timeout: 20000
     });
   } catch {
@@ -281,6 +299,37 @@ function resolveExistingPiApiConfig(modelsConfig = {}, settings = {}, auth = {},
   };
 }
 
+function resolvePiApiTarget(modelsConfig = {}, settings = {}, auth = {}, effectiveModel) {
+  const hasNoEffectiveModel = effectiveModel === null || isPiUnknownModel(effectiveModel);
+  const configuration = resolveExistingPiApiConfig(
+    modelsConfig,
+    settings,
+    auth,
+    hasNoEffectiveModel ? undefined : effectiveModel
+  );
+  if (configuration.providerId || !hasNoEffectiveModel) {
+    return { bootstrap: false, configuration };
+  }
+
+  const provider = modelsConfig.providers?.[piBootstrapProviderId];
+  const models = Array.isArray(provider?.models) ? provider.models.filter((model) => model?.id) : [];
+  const credential = auth[piBootstrapProviderId];
+  const apiKey = credential?.type === "api_key" && typeof credential.key === "string"
+    ? credential.key
+    : typeof provider?.apiKey === "string" ? provider.apiKey : "";
+  return {
+    bootstrap: true,
+    configuration: {
+      providerId: piBootstrapProviderId,
+      baseUrl: typeof provider?.baseUrl === "string" ? provider.baseUrl : piBootstrapBaseUrl,
+      api: typeof provider?.api === "string" ? provider.api : piBootstrapApi,
+      apiKey,
+      modelIds: models.map((model) => model.id),
+      defaultModel: models[0]?.id || piBootstrapModelId
+    }
+  };
+}
+
 function assertConfigurablePiProvider(modelsConfig = {}, configuration = {}) {
   const { providerId, defaultModel, api } = configuration;
   const provider = modelsConfig.providers?.[providerId];
@@ -412,26 +461,27 @@ async function persistPiConfiguration(paths, configuration, operations = {}) {
     `${JSON.stringify(value, null, 2)}\n`,
     { sensitive: true }
   ));
-  const writeSettings = operations.writeSettings ?? ((path, value) => writeJsonFileWithBackup(path, value));
+  const writeSettings = operations.writeSettings ?? ((path, value) => writeJson(path, value));
   await updateAuth(paths.piAuthPath, configuration.providerId, configuration.apiKey);
   await writeModels(paths.piModelsPath, configuration.models);
   await writeSettings(paths.piSettingsPath, configuration.settings);
 }
 
 async function configurePiApi(paths = defaultPaths, ensurePiResourcesLinked = async () => {}, promptApi, runtime = {}) {
+  const log = runtime.log ?? p.log;
+  const spinner = runtime.spinner ?? p.spinner;
+  const text = runtime.text ?? p.text;
   const piVersion = await (runtime.getPiVersion ?? detectPiVersion)();
   try {
     assertSupportedPiVersion(piVersion);
   } catch (error) {
-    (runtime.log ?? p.log).warn(error.message || String(error));
+    log.warn(error.message || String(error));
     return;
   }
   const {
     assertNotCancelled,
-    passwordPromptOptions,
+    passwordOrExisting,
     required,
-    requiredUnlessExisting,
-    resolvePasswordValue,
     selectOrCancel
   } = promptApi;
   const {
@@ -439,7 +489,7 @@ async function configurePiApi(paths = defaultPaths, ensurePiResourcesLinked = as
     models: modelsConfig,
     settings
   } = await readExistingPiConfiguration(paths);
-  const detectionSpinner = p.spinner();
+  const detectionSpinner = spinner();
   detectionSpinner.start("正在识别 Pi 当前有效模型");
   let effectiveModel;
   try {
@@ -449,16 +499,21 @@ async function configurePiApi(paths = defaultPaths, ensurePiResourcesLinked = as
       ? `已识别 ${effectiveModel.provider}/${effectiveModel.id}`
       : "未识别到 Pi 当前有效模型");
   }
-  const existing = resolveExistingPiApiConfig(modelsConfig, settings, auth, effectiveModel);
+  const target = resolvePiApiTarget(modelsConfig, settings, auth, effectiveModel);
+  const existing = target.configuration;
   const providerId = requirePiProviderId(existing.providerId);
-  assertConfigurablePiProvider(modelsConfig, existing);
+  if (target.bootstrap) {
+    log.info(`Pi 尚未配置可用模型，将创建自定义 Provider ${providerId}。`);
+  } else {
+    assertConfigurablePiProvider(modelsConfig, existing);
+  }
   if (effectiveModel
     && (settings.defaultProvider !== existing.providerId || settings.defaultModel !== existing.defaultModel)) {
-    p.log.warn(`Pi 保存的默认模型 ${settings.defaultProvider || "未知"}/${settings.defaultModel || "未知"} 与当前有效模型 ${existing.providerId}/${existing.defaultModel} 不同；将配置当前有效模型。`);
+    log.warn(`Pi 保存的默认模型 ${settings.defaultProvider || "未知"}/${settings.defaultModel || "未知"} 与当前有效模型 ${existing.providerId}/${existing.defaultModel} 不同；将配置当前有效模型。`);
   }
   const providerLabel = `Pi ${providerId}`;
 
-  const baseUrlInput = await p.text({
+  const baseUrlInput = await text({
     message: `${providerLabel} Base URL`,
     initialValue: existing.baseUrl,
     validate: required()
@@ -477,15 +532,12 @@ async function configurePiApi(paths = defaultPaths, ensurePiResourcesLinked = as
     ...(initialApi ? { initialValue: initialApi } : {})
   });
 
-  const apiKey = await p.password(passwordPromptOptions(
-    `${providerLabel} API Key`,
-    existing.apiKey,
-    requiredUnlessExisting(existing.apiKey, "API Key 不能为空")
-  ));
-  assertNotCancelled(apiKey);
-  const finalApiKey = resolvePasswordValue(apiKey, existing.apiKey);
+  const finalApiKey = await passwordOrExisting({
+    message: `${providerLabel} API Key`,
+    existingValue: existing.apiKey
+  });
 
-  const modelIdsText = await p.text({
+  const modelIdsText = await text({
     message: `${providerLabel} 模型 ID（多个用逗号分隔）`,
     initialValue: (existing.modelIds.length
       ? existing.modelIds
@@ -495,7 +547,7 @@ async function configurePiApi(paths = defaultPaths, ensurePiResourcesLinked = as
   assertNotCancelled(modelIdsText);
   const modelIds = parsePiModelIds(modelIdsText);
 
-  const defaultModel = await p.text({
+  const defaultModel = await text({
     message: "Pi 默认模型",
     initialValue: modelIds.includes(existing.defaultModel) ? existing.defaultModel : modelIds[0],
     validate: (value) => modelIds.includes(String(value || "").trim()) ? undefined : "默认模型必须在模型 ID 列表中"
@@ -514,10 +566,10 @@ async function configurePiApi(paths = defaultPaths, ensurePiResourcesLinked = as
   await ensurePiResourcesLinked(paths);
   await persistPiConfiguration(paths, configuration);
 
-  p.log.step(`已更新 ${pathToLabel(paths.piModelsPath, paths.homeDir)} (${providerId}, ${baseUrl})`);
-  p.log.step(`已更新 ${pathToLabel(paths.piSettingsPath, paths.homeDir)} (默认模型: ${finalDefaultModel})`);
-  p.log.step(`已更新 ${pathToLabel(paths.piAuthPath, paths.homeDir)} (${maskSecret(finalApiKey)})`);
-  p.log.step(`已链接 Pi 扩展到 ${pathToLabel(join(paths.piAgentDir, "extensions"), paths.homeDir)}`);
+  log.step(`已更新 ${pathToLabel(paths.piModelsPath, paths.homeDir)} (${providerId}, ${baseUrl})`);
+  log.step(`已更新 ${pathToLabel(paths.piSettingsPath, paths.homeDir)} (默认模型: ${finalDefaultModel})`);
+  log.step(`已更新 ${pathToLabel(paths.piAuthPath, paths.homeDir)} (${maskSecret(finalApiKey)})`);
+  log.step(`已链接 Pi 扩展到 ${pathToLabel(join(paths.piAgentDir, "extensions"), paths.homeDir)}`);
 }
 
 export {
@@ -530,6 +582,7 @@ export {
   configurePiApi,
   detectPiEffectiveModel,
   getPiApiPromptOptions,
+  getPiProcessInvocation,
   inferPiApiFromBaseUrl,
   normalizeOpenAiBaseUrl,
   parsePiRpcEffectiveModel,
@@ -537,6 +590,7 @@ export {
   persistPiConfiguration,
   readExistingPiConfiguration,
   resolveExistingPiApiConfig,
+  resolvePiApiTarget,
   runPiRpcCommand,
   updatePiAuthFile
 };

package/lib/providers/skills.mjs

@@ -21,10 +21,8 @@ async function configureGrokSearchEnv(paths, ensureSkillPresent = async () => {}
   const {
     assertNotCancelled,
     confirmOrCancel,
-    passwordPromptOptions,
-    required,
-    requiredUnlessExisting,
-    resolvePasswordValue
+    passwordOrExisting,
+    required
   } = promptApi;
   await ensureSkillPresent(paths);
   const envPath = join(paths.agentsDir, "skills", "grok-search", ".env");
@@ -36,13 +34,11 @@ async function configureGrokSearchEnv(paths, ensureSkillPresent = async () => {}
   });
   assertNotCancelled(baseUrl);
 
-  const apiKey = await p.password(passwordPromptOptions(
-    "Grok API Key",
-    existing.GROK_API_KEY,
-    requiredUnlessExisting(existing.GROK_API_KEY, "Grok API Key 不能为空")
-  ));
-  assertNotCancelled(apiKey);
-  const finalApiKey = resolvePasswordValue(apiKey, existing.GROK_API_KEY);
+  const finalApiKey = await passwordOrExisting({
+    message: "Grok API Key",
+    existingValue: existing.GROK_API_KEY,
+    requiredMessage: "Grok API Key 不能为空"
+  });
 
   const model = await p.text({
     message: "Grok 默认模型",
@@ -65,15 +61,13 @@ async function configureGrokSearchEnv(paths, ensureSkillPresent = async () => {}
     : null;
   if (useTavily) assertNotCancelled(tavilyUrl);
 
-  const tavilyKey = useTavily
-    ? await p.password(passwordPromptOptions(
-        "Tavily API Key",
-        existing.TAVILY_API_KEY,
-        requiredUnlessExisting(existing.TAVILY_API_KEY, "Tavily API Key 不能为空")
-      ))
-    : "";
-  if (useTavily) assertNotCancelled(tavilyKey);
-  const finalTavilyKey = useTavily ? resolvePasswordValue(tavilyKey, existing.TAVILY_API_KEY) : null;
+  const finalTavilyKey = useTavily
+    ? await passwordOrExisting({
+        message: "Tavily API Key",
+        existingValue: existing.TAVILY_API_KEY,
+        requiredMessage: "Tavily API Key 不能为空"
+      })
+    : null;
 
   await updateSkillEnvFile(envPath, {
     GROK_API_URL: baseUrl,
@@ -88,16 +82,15 @@ async function configureGrokSearchEnv(paths, ensureSkillPresent = async () => {}
 }
 
 async function configureContext7Env(paths, ensureSkillPresent = async () => {}, promptApi) {
-  const { assertNotCancelled, passwordPromptOptions, resolvePasswordValue } = promptApi;
+  const { passwordOrExisting } = promptApi;
   await ensureSkillPresent(paths);
   const envPath = join(paths.agentsDir, "skills", "context7-auto-research", ".env");
   const existing = await readSkillEnvFile(envPath);
-  const apiKey = await p.password(passwordPromptOptions(
-    "Context7 API Key（可选）",
-    existing.CONTEXT7_API_KEY
-  ));
-  assertNotCancelled(apiKey);
-  const finalApiKey = resolvePasswordValue(apiKey, existing.CONTEXT7_API_KEY);
+  const finalApiKey = await passwordOrExisting({
+    message: "Context7 API Key（可选）",
+    existingValue: existing.CONTEXT7_API_KEY,
+    requiredMessage: null
+  });
 
   await updateSkillEnvFile(envPath, {
     CONTEXT7_API_KEY: finalApiKey

package/lib/templates/codex/config-base.toml

@@ -1,10 +1,9 @@
 personality = "pragmatic"
 model_provider = "abelworkflow"
 disable_response_storage = true
-preferred_auth_method = "apikey"
 approvals_reviewer = "guardian_subagent"
 approval_policy = "on-request"
-sandbox_mode = "workspace-write"
+sandbox_mode = "danger-full-access"
 model = "gpt-5.6-sol"
 model_reasoning_effort = "high"
 network_access = true

package/lib/utils.mjs

@@ -0,0 +1,15 @@
+import { createHash } from "node:crypto";
+
+function hashBytes(content) {
+  return createHash("sha256").update(content).digest("hex");
+}
+
+function isManagedCodexAgentFileEntry(name, hash) {
+  return name.endsWith(".toml")
+    && !name.includes("/")
+    && !name.includes("\\")
+    && typeof hash === "string"
+    && /^[a-f0-9]{64}$/u.test(hash);
+}
+
+export { hashBytes, isManagedCodexAgentFileEntry };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "abelworkflow",
-  "version": "1.1.1",
+  "version": "1.1.3",
   "description": "Install AbelWorkflow into ~/.agents and create Claude/Codex symlinks.",
   "type": "module",
   "scripts": {