abelworkflow 1.1.3 → 1.2.1

package/lib/providers/claude.mjs

@@ -1,161 +1,105 @@
 import * as p from "@clack/prompts";
-import { readJsonFileSafe, writeJson } from "../config/store.mjs";
-import { defaultPaths, maskSecret, pathToLabel } from "../paths.mjs";
-
-const claudeModelEnvKeys = [
-  "ANTHROPIC_MODEL",
-  "ANTHROPIC_DEFAULT_OPUS_MODEL",
-  "ANTHROPIC_DEFAULT_SONNET_MODEL",
-  "ANTHROPIC_DEFAULT_HAIKU_MODEL",
-  "CLAUDE_CODE_SUBAGENT_MODEL"
-];
-const defaultClaudeSettings = {
-  $schema: "https://json.schemastore.org/claude-code-settings.json",
-  env: {
-    DISABLE_TELEMETRY: "1",
-    DISABLE_ERROR_REPORTING: "1",
-    CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
-  },
-  includeCoAuthoredBy: false,
-  permissions: {
-    allow: [],
-    deny: [],
-    defaultMode: "bypassPermissions"
-  },
-  hooks: {},
-  alwaysThinkingEnabled: true,
-  language: "Chinese"
-};
-function buildDefaultClaudeSettings() {
-  return {
-    ...defaultClaudeSettings,
-    env: { ...defaultClaudeSettings.env },
-    permissions: {
-      ...defaultClaudeSettings.permissions,
-      allow: [...defaultClaudeSettings.permissions.allow],
-      deny: [...defaultClaudeSettings.permissions.deny]
-    },
-    hooks: { ...defaultClaudeSettings.hooks }
-  };
-}
-function mergeClaudeSettingsWithDefaults(settings) {
-  const defaults = buildDefaultClaudeSettings();
-  const env = settings?.env && typeof settings.env === "object" ? settings.env : {};
-  const permissions = settings?.permissions && typeof settings.permissions === "object" ? settings.permissions : {};
-  return {
-    ...defaults,
-    ...settings,
-    env: {
-      ...defaults.env,
-      ...env
-    },
-    permissions: {
-      ...defaults.permissions,
-      ...permissions,
-      allow: Array.isArray(permissions.allow) ? permissions.allow : defaults.permissions.allow,
-      deny: Array.isArray(permissions.deny) ? permissions.deny : defaults.permissions.deny
-    },
-    hooks: settings?.hooks && typeof settings.hooks === "object" ? settings.hooks : defaults.hooks
-  };
-}
+import {
+  assertPlainObject,
+  readJsonFileSafe,
+  withFileTransaction
+} from "../config/store.mjs";
+import { maskSecret, pathToLabel } from "../paths.mjs";
+import { normalizeHttpBaseUrl } from "./url.mjs";
 
 function getExistingClaudeApiConfig(settings) {
-  const env = mergeClaudeSettingsWithDefaults(settings).env;
+  assertPlainObject(settings, "Claude settings");
+  const env = settings.env === undefined ? {} : assertPlainObject(settings.env, "Claude settings env");
   return {
     baseUrl: env.ANTHROPIC_BASE_URL || "https://api.anthropic.com",
     key: env.ANTHROPIC_API_KEY || "",
-    model: claudeModelEnvKeys.map((field) => env[field]).find(Boolean) || ""
+    model: typeof env.ANTHROPIC_MODEL === "string" ? env.ANTHROPIC_MODEL : ""
   };
 }
 
-function ensureApprovedClaudeApiKey(config, apiKey) {
-  if (!apiKey) {
-    return config;
-  }
-
-  const truncated = apiKey.slice(0, 20);
-  if (!config.customApiKeyResponses || typeof config.customApiKeyResponses !== "object") {
-    config.customApiKeyResponses = { approved: [], rejected: [] };
-  }
-  if (!Array.isArray(config.customApiKeyResponses.approved)) {
-    config.customApiKeyResponses.approved = [];
-  }
-  if (!Array.isArray(config.customApiKeyResponses.rejected)) {
-    config.customApiKeyResponses.rejected = [];
-  }
-
-  config.customApiKeyResponses.rejected = config.customApiKeyResponses.rejected.filter((item) => item !== truncated);
-  if (!config.customApiKeyResponses.approved.includes(truncated)) {
-    config.customApiKeyResponses.approved.push(truncated);
-  }
-
-  return config;
-}
-
 function buildClaudeApiSettings(settings, {
   baseUrl,
   key,
   model
 }) {
-  const nextSettings = mergeClaudeSettingsWithDefaults(settings);
-  nextSettings.env.ANTHROPIC_BASE_URL = baseUrl;
-  nextSettings.env.ANTHROPIC_API_KEY = key;
+  assertPlainObject(settings, "Claude settings");
+  const env = settings.env === undefined ? {} : assertPlainObject(settings.env, "Claude settings env");
+  const nextSettings = {
+    ...settings,
+    env: {
+      ...env,
+      ANTHROPIC_BASE_URL: normalizeHttpBaseUrl(baseUrl),
+      ANTHROPIC_API_KEY: key,
+      ANTHROPIC_MODEL: String(model).trim()
+    }
+  };
   delete nextSettings.env.ANTHROPIC_AUTH_TOKEN;
-  for (const field of claudeModelEnvKeys) {
-    nextSettings.env[field] = model;
-  }
   return nextSettings;
 }
 
-async function persistClaudeConfiguration(paths, { settings, metaConfig }) {
-  await writeJson(paths.claudeSettingsPath, settings, { sensitive: true });
-  await writeJson(paths.claudeMetaConfigPath, metaConfig, { sensitive: true });
+async function persistClaudeConfiguration(paths, intent) {
+  return withFileTransaction([{
+    path: paths.claudeSettingsPath,
+    safeRoot: paths.homeDir,
+    sensitive: true
+  }], async (transaction) => {
+    const settings = transaction.readJson(paths.claudeSettingsPath, {});
+    assertPlainObject(settings, "Claude settings");
+    await transaction.writeJson(
+      paths.claudeSettingsPath,
+      buildClaudeApiSettings(settings, intent)
+    );
+  });
 }
 
-async function configureClaudeApi(paths = defaultPaths, promptApi) {
-  const { assertNotCancelled, passwordOrExisting, required } = promptApi;
-  const settings = await readJsonFileSafe(paths.claudeSettingsPath, {}, { sensitive: true });
+async function configureClaudeApi(paths, promptApi, runtime = {}) {
+  const text = runtime.text ?? p.text;
+  const log = runtime.log ?? p.log;
+  const { assertNotCancelled, passwordOrExisting } = promptApi;
+  const settings = await readJsonFileSafe(paths.claudeSettingsPath, {}, {
+    safeRoot: paths.homeDir,
+    sensitive: true
+  });
+  assertPlainObject(settings, "Claude settings");
   const existing = getExistingClaudeApiConfig(settings);
 
-  const baseUrl = await p.text({
+  const baseUrlInput = await text({
     message: "Claude Code Base URL",
     initialValue: existing.baseUrl,
-    validate: required()
+    validate: (value) => {
+      try {
+        normalizeHttpBaseUrl(value);
+      } catch (error) {
+        return error.message;
+      }
+    }
   });
-  assertNotCancelled(baseUrl);
+  assertNotCancelled(baseUrlInput);
+  const baseUrl = normalizeHttpBaseUrl(baseUrlInput);
 
   const finalKey = await passwordOrExisting({
     message: "Claude Code API Key",
     existingValue: existing.key
   });
 
-  const model = await p.text({
+  const model = await text({
     message: "Claude Code 模型",
     initialValue: existing.model || undefined,
-    validate: required()
+    validate: (value) => String(value || "").trim() ? undefined : "不能为空"
   });
   assertNotCancelled(model);
 
-  const apiSettings = buildClaudeApiSettings(settings, {
+  await persistClaudeConfiguration(paths, {
     baseUrl,
     key: finalKey,
-    model
-  });
-  const metaConfig = await readJsonFileSafe(paths.claudeMetaConfigPath, {}, { sensitive: true });
-  metaConfig.hasCompletedOnboarding = true;
-  ensureApprovedClaudeApiKey(metaConfig, finalKey);
-  await persistClaudeConfiguration(paths, {
-    settings: apiSettings,
-    metaConfig
+    model: String(model).trim()
   });
 
-  p.log.step(`已更新 ${pathToLabel(paths.claudeSettingsPath, paths.homeDir)} (${baseUrl}, ${maskSecret(finalKey)})`);
+  log.step(`已更新 ${pathToLabel(paths.claudeSettingsPath, paths.homeDir)} (${maskSecret(finalKey)})`);
 }
 
 export {
   buildClaudeApiSettings,
-  buildDefaultClaudeSettings,
   configureClaudeApi,
-  mergeClaudeSettingsWithDefaults,
   persistClaudeConfiguration
 };

package/lib/providers/codex.mjs

@@ -2,128 +2,38 @@ import { lstat, mkdir, readFile, readdir, unlink } from "node:fs/promises";
 import { join } from "node:path";
 import * as p from "@clack/prompts";
 import {
+  assertPlainObject,
+  assertSafeFilePath,
   pathExists,
   readJsonFileSafe,
-  writeJson,
+  withFileTransaction,
   writeText
 } from "../config/store.mjs";
 import {
-  buildTomlSection,
-  detectLineEnding,
-  extractTopLevelTomlEntries,
-  getTomlSectionFieldNames,
   formatTomlKeySegment,
-  mergeMissingTopLevelTomlEntries,
-  parseTomlSection,
-  readTopLevelTomlString,
-  removeTomlSection,
+  parseToml,
   removeTomlSectionField,
   removeTopLevelTomlField,
   updateTomlSectionFields,
   updateTopLevelTomlField
 } from "../config/toml.mjs";
-import { defaultPaths, maskSecret, pathToLabel } from "../paths.mjs";
+import { maskSecret, pathToLabel } from "../paths.mjs";
 import { hashBytes, isManagedCodexAgentFileEntry } from "../utils.mjs";
-import { normalizeOpenAiBaseUrl } from "./pi.mjs";
+import { normalizeOpenAiBaseUrl } from "./url.mjs";
 
 const CODEX_ENV_KEY = "OPENAI_API_KEY";
+const CODEX_PROVIDER_ID = "abelworkflow";
 
-const publishedCodexDeveloperInstructionHashes = new Set([
-  "957adb227dd3fc298985acca38db4c22b8e018d387dab91f1ea8287db35385db"
-]);
-
-const publishedCodexAgentHashes = {
-  "default.toml": new Set([
-    "7add720eb7ed030871088fe9f994a7e34a2b3cae1f898fe7f97c4e302f4a1844",
-    "72d3da0275f4add64ff05da94f391443e8e4b5c43b646e0f89f2d17fa4345cb4",
-    "7dc002559f5d78534e70c7c4683d51a48ffe94725c199855a35f61124aead876"
-  ]),
-  "explorer.toml": new Set([
-    "e4e9c4eed4c028dded095b4cf36cb0ac408abcd86b9ab7c139440e1c58355644",
-    "a236d7b586c4e312a62bb8b36115fe9780e28502c0af160ce5cd45b67c5b8479",
-    "4740f13e9a478528dcb097188997445efa7607b1b07ae64774b1dd26fcd6f853"
-  ]),
-  "planner.toml": new Set([
-    "2b16f821b14224cdfc9dab1fe14c41b9ff2b63642b0d9b340ef84b67a753a3b7",
-    "741c9dfce5085d6bdc49f6e5004475974d54c2bde95c0b589eda86a63e96e58f",
-    "7fde442a5ba5e996936b4ec853b036ebbb9f06ee9baef6540124d081c7107196"
-  ]),
-  "reviewer.toml": new Set([
-    "08dcf8f5fee281f3b6120b63559086b7c675a619be72f761de4add711543b353",
-    "9455d0189f324f7c606f7ae94ca338e9bd5c468f072188ac1f18e3749c918cd1",
-    "a7292a533c9146bf5a2eb292cbfe889ca47bf4808324cddc1732c3c1721d437c"
-  ]),
-  "worker.toml": new Set([
-    "13533715464b1f58a9c311e16dc3a29e92ecb95793fd8aff69a5ca731ae46ac8",
-    "ea12b5b6173eb8fcaa57a8b447b1f81b35a6ac59e75025b88198c3f85175922c",
-    "bfbc214e7b582774de759b118544c3f1fb61e1284d6ffd6a61ab772d28b6eaa0"
-  ])
-};
-
-function stripCodexSubagentDefaults(content) {
-  const lineEnding = detectLineEnding(content);
-  let nextContent = removeTopLevelTomlField(content, "approvals_reviewer");
-  nextContent = removeTopLevelTomlField(nextContent, "developer_instructions");
-  nextContent = removeTomlSection(nextContent, "agents");
-
-  const featureValues = parseTomlSection(nextContent, "features");
-  delete featureValues.multi_agent;
-  delete featureValues.guardian_approval;
-  nextContent = removeTomlSection(nextContent, "features");
-
-  if (Object.keys(featureValues).length) {
-    const featuresSection = buildTomlSection("features", featureValues, lineEnding).trimEnd();
-    nextContent = nextContent.trimEnd()
-      ? `${nextContent.trimEnd()}${lineEnding}${lineEnding}${featuresSection}${lineEnding}`
-      : `${featuresSection}${lineEnding}`;
+function assertTomlTable(value, name) {
+  if (value === undefined) return {};
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${name} must be a TOML table`);
   }
-
-  return nextContent;
-}
-
-function mergeCodexTemplateDefaults(content, templateContent) {
-  const defaultTopLevelFields = new Set([
-    "personality",
-    "disable_response_storage",
-    "approvals_reviewer",
-    "approval_policy",
-    "sandbox_mode",
-    "service_tier",
-    "model",
-    "model_reasoning_effort",
-    "developer_instructions"
-  ]);
-  const templateEntries = extractTopLevelTomlEntries(templateContent)
-    .filter(({ field }) => defaultTopLevelFields.has(field));
-  let nextContent = mergeMissingTopLevelTomlEntries(content, templateEntries);
-  const currentDeveloperInstructions = readTopLevelTomlString(nextContent, "developer_instructions");
-  const templateDeveloperInstructions = readTopLevelTomlString(templateContent, "developer_instructions");
-  if (templateDeveloperInstructions && publishedCodexDeveloperInstructionHashes.has(
-    hashBytes(currentDeveloperInstructions)
-  )) {
-    nextContent = updateTopLevelTomlField(
-      nextContent,
-      "developer_instructions",
-      templateDeveloperInstructions
-    );
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== null && prototype !== Object.prototype) {
+    throw new Error(`${name} must be a TOML table`);
   }
-
-  for (const sectionName of ["agents", "features"]) {
-    const templateValues = parseTomlSection(templateContent, sectionName);
-    const currentFields = new Set(getTomlSectionFieldNames(nextContent, sectionName));
-    const missingValues = Object.fromEntries(
-      Object.entries(templateValues).filter(([field]) => !currentFields.has(field))
-    );
-    if (Object.keys(missingValues).length) {
-      nextContent = updateTomlSectionFields(nextContent, sectionName, missingValues);
-    }
-  }
-
-  return nextContent;
-}
-
-async function loadBundledCodexConfigTemplate(paths = defaultPaths) {
-  return readFile(paths.codexTemplateConfigPath, "utf8");
+  return value;
 }
 
 async function readCodexAgentTarget(path) {
@@ -172,11 +82,7 @@ async function ensureCodexAgentContainer(homeDir) {
   return targetDir;
 }
 
-function isPublishedCodexAgent(name, hash) {
-  return publishedCodexAgentHashes[name]?.has(hash) ?? false;
-}
-
-async function deployBundledCodexAgents(paths = defaultPaths, previousManagedFiles = {}) {
+async function deployBundledCodexAgents(paths, previousManagedFiles = {}) {
   const targetDir = await ensureCodexAgentContainer(paths.homeDir);
   const entries = (await readdir(paths.codexTemplateAgentsPath, { withFileTypes: true }))
     .filter((entry) => entry.isFile() && entry.name.endsWith(".toml"))
@@ -203,10 +109,7 @@ async function deployBundledCodexAgents(paths = defaultPaths, previousManagedFil
       result.created.push(target);
     } else if (currentHash === sourceHash) {
       result.unchanged.push(target);
-    } else if (current.content && (
-      previousManagedFiles?.[name] === currentHash
-      || isPublishedCodexAgent(name, currentHash)
-    )) {
+    } else if (current.content && previousManagedFiles?.[name] === currentHash) {
       await writeText(target, sourceContent, { backupLimit: 0 });
       result.updated.push(target);
     } else {
@@ -240,10 +143,6 @@ async function deployBundledCodexAgents(paths = defaultPaths, previousManagedFil
   return result;
 }
 
-function getCodexProviderSectionName(providerId) {
-  return `model_providers.${formatTomlKeySegment(providerId)}`;
-}
-
 function assertCodexAuthKeyAvailable(auth, envKey) {
   if (
     auth
@@ -257,46 +156,80 @@ function assertCodexAuthKeyAvailable(auth, envKey) {
 }
 
 function resolveExistingCodexApiConfig(content, auth = {}) {
-  const providerId = readTopLevelTomlString(content, "model_provider") || "abelworkflow";
-  const provider = parseTomlSection(content, getCodexProviderSectionName(providerId));
+  const config = parseToml(content);
+  assertPlainObject(auth, "Codex auth");
+  const providers = assertTomlTable(config.model_providers, "model_providers");
+  const provider = assertTomlTable(
+    providers[CODEX_PROVIDER_ID],
+    `model_providers.${CODEX_PROVIDER_ID}`
+  );
   const envKey = CODEX_ENV_KEY;
   assertCodexAuthKeyAvailable(auth, envKey);
   const apiKey = typeof auth[envKey] === "string" ? auth[envKey] : "";
 
   return {
-    providerId,
-    providerName: provider.name || providerId,
-    baseUrl: provider.base_url || "https://api.openai.com/v1",
+    providerId: CODEX_PROVIDER_ID,
+    providerName: typeof provider.name === "string" && provider.name ? provider.name : CODEX_PROVIDER_ID,
+    baseUrl: typeof provider.base_url === "string" && provider.base_url
+      ? provider.base_url
+      : "https://api.openai.com/v1",
     envKey,
     apiKey
   };
 }
 
-async function getExistingCodexApiConfig(paths = defaultPaths) {
+async function getExistingCodexApiConfig(paths) {
+  await assertSafeFilePath(paths.codexConfigPath, paths.homeDir);
   const content = await pathExists(paths.codexConfigPath) ? await readFile(paths.codexConfigPath, "utf8") : "";
-  const auth = await readJsonFileSafe(paths.codexAuthPath, {}, { sensitive: true });
+  const auth = await readJsonFileSafe(paths.codexAuthPath, {}, {
+    safeRoot: paths.homeDir,
+    sensitive: true
+  });
   return resolveExistingCodexApiConfig(content, auth);
 }
 
-async function persistCodexConfiguration(paths, { content, auth }) {
-  await writeText(paths.codexConfigPath, content);
-  await writeJson(paths.codexAuthPath, auth, { sensitive: true });
+async function persistCodexConfiguration(paths, intent, operations = {}) {
+  return withFileTransaction([
+    { path: paths.codexConfigPath, safeRoot: paths.homeDir },
+    { path: paths.codexAuthPath, safeRoot: paths.homeDir, sensitive: true }
+  ], async (transaction) => {
+    const currentContent = transaction.readText(paths.codexConfigPath);
+    const currentAuth = transaction.readJson(paths.codexAuthPath, {});
+    assertPlainObject(currentAuth, "Codex auth");
+    const current = resolveExistingCodexApiConfig(currentContent, currentAuth);
+    const content = buildCodexConfigContent(currentContent, {
+      providerName: current.providerName,
+      baseUrl: intent.baseUrl
+    });
+    const auth = mergeCodexAuthData(currentAuth, intent.apiKey);
+    await transaction.writeText(paths.codexConfigPath, content, {
+      ...(operations.writeConfig ? { writer: operations.writeConfig } : {})
+    });
+    await transaction.writeJson(paths.codexAuthPath, auth, {
+      ...(operations.writeAuth ? { writer: operations.writeAuth } : {})
+    });
+  });
 }
 
-async function configureCodexApi(paths = defaultPaths, promptApi, ownership = {}) {
+async function configureCodexApi(paths, promptApi, ownership = {}, runtime = {}) {
+  const text = runtime.text ?? p.text;
+  const log = runtime.log ?? p.log;
   const {
     assertNotCancelled,
     confirmOrCancel,
-    passwordOrExisting,
-    required
+    passwordOrExisting
   } = promptApi;
   const existing = await getExistingCodexApiConfig(paths);
-  const providerId = existing.providerId || "abelworkflow";
-  const providerName = existing.providerName || providerId;
-  const baseUrlInput = await p.text({
+  const baseUrlInput = await text({
     message: "Codex Base URL",
     initialValue: existing.baseUrl,
-    validate: required()
+    validate: (value) => {
+      try {
+        normalizeOpenAiBaseUrl(value);
+      } catch (error) {
+        return error.message;
+      }
+    }
   });
   assertNotCancelled(baseUrlInput);
   const baseUrl = normalizeOpenAiBaseUrl(baseUrlInput);
@@ -309,97 +242,69 @@ async function configureCodexApi(paths = defaultPaths, promptApi, ownership = {}
   const shouldDeploySubagents = await confirmOrCancel({ message: "是否部署 Codex subagents 配置？", initialValue: true });
   let managedCodexAgentFiles = { ...(ownership.managedCodexAgentFiles ?? {}) };
 
-  const envKey = CODEX_ENV_KEY;
-  const currentContent = await pathExists(paths.codexConfigPath) ? await readFile(paths.codexConfigPath, "utf8") : "";
-  const templateContent = await loadBundledCodexConfigTemplate(paths);
-  const content = buildCodexConfigContent(currentContent, {
-    templateContent,
-    mergeMissingTemplateDefaults: true,
-    includeSubagentDefaults: shouldDeploySubagents,
-    providerId,
-    providerName,
-    baseUrl
-  });
-
-  const auth = mergeCodexAuthData(
-    await readJsonFileSafe(paths.codexAuthPath, {}, { sensitive: true }),
-    envKey,
-    finalApiKey,
-    ownership.managedAuthKeys ?? []
-  );
-  await persistCodexConfiguration(paths, { content, auth });
+  await ownership.guard?.();
+  await persistCodexConfiguration(paths, { baseUrl, apiKey: finalApiKey });
 
-  p.log.step(`已更新 ${pathToLabel(paths.codexConfigPath, paths.homeDir)} (${providerId}, ${baseUrl})`);
-  p.log.step(`已更新 ${pathToLabel(paths.codexAuthPath, paths.homeDir)} (${maskSecret(finalApiKey)})`);
+  log.step(`已更新 ${pathToLabel(paths.codexConfigPath, paths.homeDir)} (${CODEX_PROVIDER_ID})`);
+  log.step(`已更新 ${pathToLabel(paths.codexAuthPath, paths.homeDir)} (${maskSecret(finalApiKey)})`);
   if (String(baseUrl).startsWith("https://") && !process.env.CODEX_CA_CERTIFICATE && !process.env.SSL_CERT_FILE) {
-    p.log.message("自签名证书需在启动 Codex 前设置 CODEX_CA_CERTIFICATE=/absolute/path/relay-ca.pem。");
+    log.message("自签名证书需在启动 Codex 前设置 CODEX_CA_CERTIFICATE=/absolute/path/relay-ca.pem。");
   }
   if (shouldDeploySubagents) {
+    await ownership.guard?.();
     const deployment = await deployBundledCodexAgents(paths, managedCodexAgentFiles);
     managedCodexAgentFiles = deployment.managedFiles;
-    p.log.step(`Codex subagents 同步完成：新增 ${deployment.created.length}，更新 ${deployment.updated.length}，未变 ${deployment.unchanged.length}`);
+    log.step(`Codex subagents 同步完成：新增 ${deployment.created.length}，更新 ${deployment.updated.length}，未变 ${deployment.unchanged.length}`);
     if (deployment.conflicts.length) {
-      p.log.warn([
+      log.warn([
         `检测到 ${deployment.conflicts.length} 个 Codex subagent 冲突，已保留原文件：`,
         ...deployment.conflicts.map((path) => `- ${pathToLabel(path, paths.homeDir)}`)
       ].join("\n"));
     }
   } else {
-    p.log.message("已跳过 Codex subagents 部署。");
+    log.message("已跳过 Codex subagents 部署。");
   }
   return {
-    managedAuthKeys: finalApiKey ? [envKey] : [],
     managedCodexAgentFiles
   };
 }
 
 function buildCodexConfigContent(currentContent, {
-  templateContent = "",
-  mergeMissingTemplateDefaults = false,
-  includeSubagentDefaults = true,
-  providerId,
   providerName,
   baseUrl
 }) {
-  const effectiveTemplateContent = includeSubagentDefaults
-    ? templateContent
-    : stripCodexSubagentDefaults(templateContent);
-  const hasCurrentContent = Boolean(currentContent.trim());
-  let content = hasCurrentContent ? currentContent : effectiveTemplateContent;
-  if (hasCurrentContent && mergeMissingTemplateDefaults && effectiveTemplateContent.trim()) {
-    content = mergeCodexTemplateDefaults(content, effectiveTemplateContent);
-  }
-  const lineEnding = detectLineEnding(content);
-  if (includeSubagentDefaults && readTopLevelTomlString(content, "approvals_reviewer") === "reviewer") {
-    content = updateTopLevelTomlField(content, "approvals_reviewer", "guardian_subagent");
-  }
-  const providerSectionName = getCodexProviderSectionName(providerId);
-  content = updateTopLevelTomlField(content, "model_provider", providerId);
+  const config = parseToml(currentContent);
+  const providers = assertTomlTable(config.model_providers, "model_providers");
+  const provider = assertTomlTable(
+    providers[CODEX_PROVIDER_ID],
+    `model_providers.${CODEX_PROVIDER_ID}`
+  );
+  const providerSection = `model_providers.${formatTomlKeySegment(CODEX_PROVIDER_ID)}`;
+  let content = updateTopLevelTomlField(currentContent, "model_provider", CODEX_PROVIDER_ID);
   content = removeTopLevelTomlField(content, "preferred_auth_method");
   content = removeTopLevelTomlField(content, "temp_env_key");
-  content = removeTomlSectionField(content, providerSectionName, "temp_env_key");
-  content = removeTomlSectionField(content, providerSectionName, "env_key");
-  content = updateTomlSectionFields(content, providerSectionName, {
-    name: providerName,
-    base_url: baseUrl,
+  for (const field of ["env_key", "temp_env_key", "supports_websockets"]) {
+    content = removeTomlSectionField(content, providerSection, field);
+  }
+  content = updateTomlSectionFields(content, providerSection, {
+    name: providerName || CODEX_PROVIDER_ID,
+    base_url: normalizeOpenAiBaseUrl(baseUrl),
     wire_api: "responses",
-    requires_openai_auth: true,
-    supports_websockets: true
+    requires_openai_auth: true
   });
-  return `${content.trim()}${lineEnding}`;
+  parseToml(content);
+  return content;
 }
 
-function mergeCodexAuthData(auth, envKey, apiKey, managedAuthKeys = []) {
-  const nextAuth = auth && typeof auth === "object" && !Array.isArray(auth) ? { ...auth } : {};
-  assertCodexAuthKeyAvailable(nextAuth, envKey);
-  for (const managedAuthKey of managedAuthKeys) {
-    delete nextAuth[managedAuthKey];
-  }
+function mergeCodexAuthData(auth, apiKey) {
+  assertPlainObject(auth, "Codex auth");
+  const nextAuth = { ...auth };
+  assertCodexAuthKeyAvailable(nextAuth, CODEX_ENV_KEY);
   if (apiKey) {
     nextAuth.auth_mode = "apikey";
-    nextAuth[envKey] = apiKey;
+    nextAuth[CODEX_ENV_KEY] = apiKey;
   } else {
-    delete nextAuth[envKey];
+    delete nextAuth[CODEX_ENV_KEY];
     if (nextAuth.auth_mode === "apikey") delete nextAuth.auth_mode;
   }
   return nextAuth;
@@ -410,8 +315,6 @@ export {
   configureCodexApi,
   deployBundledCodexAgents,
   mergeCodexAuthData,
-  mergeCodexTemplateDefaults,
   persistCodexConfiguration,
-  resolveExistingCodexApiConfig,
-  stripCodexSubagentDefaults
+  resolveExistingCodexApiConfig
 };