abelworkflow 1.2.1 → 1.2.3

package/README.md

@@ -68,14 +68,24 @@ python -m pip install -r skills/grok-search/requirements.txt
 
 ## 配置行为
 
-- Claude 配置管理 `ANTHROPIC_BASE_URL`、`ANTHROPIC_API_KEY` 与 `ANTHROPIC_MODEL`；冲突的 `ANTHROPIC_AUTH_TOKEN` 会被删除，其他模型路由保持不变。
-- Codex 配置管理 AbelWorkflow Provider 路由、`OPENAI_API_KEY` 与 `auth_mode`，清理冲突的 `preferred_auth_method`、`temp_env_key` 及目标 Provider 旧路由字段，保留其他认证字段。
+- Claude API 配置会合并个人默认模板（`$schema`、`attribution`、`hooks`、`alwaysThinkingEnabled`、`language` 与全局权限白名单），删除已弃用的 `includeCoAuthoredBy`；白名单使用当前任务工具 `TaskCreate`、`TaskGet`、`TaskUpdate`、`TaskList`，缺失项补入默认模板但保留已有权限数组。
+- Claude API 使用 `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` 统一关闭非必要流量并保留 `API_TIMEOUT_MS`，清理重叠的 `DISABLE_TELEMETRY` 与 `DISABLE_ERROR_REPORTING`。
+- Claude API 管理 `ANTHROPIC_BASE_URL`、`ANTHROPIC_API_KEY`，并将所选模型同步到 `ANTHROPIC_MODEL`、Opus/Sonnet/Haiku 默认模型与 `CLAUDE_CODE_SUBAGENT_MODEL`；冲突的 `ANTHROPIC_AUTH_TOKEN` 会被删除，其他用户配置保持不变。
+- Codex 配置以 Codex 最新稳定版为基线，不保留旧版本兼容配置；配置会合并个人默认模板，使用 `approval_policy = "never"` 与 `sandbox_mode = "danger-full-access"` 赋予 Agent 完全权限，同时管理 AbelWorkflow Provider 路由、`OPENAI_API_KEY` 与 `auth_mode`，清理冲突的 `preferred_auth_method`、`temp_env_key` 及目标 Provider 旧路由字段，保留其他认证字段。
 - Pi 配置更新 `abelworkflow` Provider、对应凭据及全局 `defaultProvider`、`defaultModel`，保留其他 Provider 与无关设置。
-- API 配置不注入全局权限；配置结构或路径无法安全合并时直接失败。
+- 所有 Provider 在配置结构或路径无法安全合并时直接失败。
 - Skill 密钥写入 `~/.agents/skills/<skill>/.env`，属于用户私密配置。
 - `.skill-lock.json` 完全属于用户：安装器不读取、不修改、不备份、不删除，也不会将其放入发布包。
 - 自定义 CA 应通过标准证书环境变量显式配置，不关闭 TLS 校验。
 
+### Codex WebSocket 中转
+
+AbelWorkflow 为目标 Provider 设置 `wire_api = "responses"` 与 `supports_websockets = true`，使 Codex 最新稳定版优先使用 Responses API WebSocket。旧版 `[features]` 配置 `responses_websockets` 与 `responses_websockets_v2` 会被清理，不作为兼容开关保留。
+
+Codex 根据 Provider Base URL 推导 WebSocket 地址。例如，`https://relay.example/v1` 对应 `wss://relay.example/v1/responses`；使用 HTTP Base URL 时则对应 `ws://`。中转必须在该路径支持 WebSocket Upgrade，并实现 Codex 使用的 Responses API WebSocket 协议、认证头和事件格式；只支持 HTTP/SSE Responses API 不满足此要求。
+
+`supports_websockets = true` 是 Provider 能力声明，AbelWorkflow 不会在写入配置时探测中转能力。如果握手或协议不兼容，请修复中转并查看 Codex 日志；是否回退 HTTP 由当前 Codex 运行时决定，AbelWorkflow 只保证默认优先尝试 WebSocket，不保证 WebSocket-only。
+
 ## 部署映射
 
 | 托管内容 | Claude Code | Codex | Pi |

package/lib/config/toml.mjs

@@ -237,10 +237,206 @@ function findAssignment(assignments, field, section) {
   return assignments.find((entry) => entry.section === section && entry.path.length === 1 && entry.path[0] === field);
 }
 
+function assignmentPath(entry) {
+  return entry.section ? [...entry.section.path, ...entry.path] : entry.path;
+}
+
+function pathStartsWith(path, prefix) {
+  return prefix.length <= path.length && prefix.every((part, index) => path[index] === part);
+}
+
+function skipTomlTrivia(text, index) {
+  while (index < text.length) {
+    if (/\s/u.test(text[index])) {
+      index += 1;
+    } else if (text[index] === "#") {
+      const newline = text.indexOf("\n", index + 1);
+      index = newline === -1 ? text.length : newline + 1;
+    } else {
+      break;
+    }
+  }
+  return index;
+}
+
+function scanInlineTomlValue(text, index) {
+  const state = { arrayDepth: 0, inlineDepth: 0, mode: "normal" };
+  for (; index < text.length;) {
+    if (state.mode === "multiline-basic") {
+      if (text[index] === "\\") index += 2;
+      else if (text.startsWith('"""', index)) index = closeMultilineString(text, state, index, '"');
+      else index += 1;
+      continue;
+    }
+    if (state.mode === "multiline-literal") {
+      if (text.startsWith("'''", index)) index = closeMultilineString(text, state, index, "'");
+      else index += 1;
+      continue;
+    }
+    if (state.mode === "basic") {
+      if (text[index] === "\\") index += 2;
+      else if (text[index] === '"') {
+        state.mode = "normal";
+        index += 1;
+      } else index += 1;
+      continue;
+    }
+    if (state.mode === "literal") {
+      if (text[index] === "'") state.mode = "normal";
+      index += 1;
+      continue;
+    }
+
+    if (text[index] === "#") {
+      const newline = text.indexOf("\n", index + 1);
+      index = newline === -1 ? text.length : newline + 1;
+    } else if (text.startsWith('"""', index)) {
+      state.mode = "multiline-basic";
+      index += 3;
+    } else if (text.startsWith("'''", index)) {
+      state.mode = "multiline-literal";
+      index += 3;
+    } else if (text[index] === '"') {
+      state.mode = "basic";
+      index += 1;
+    } else if (text[index] === "'") {
+      state.mode = "literal";
+      index += 1;
+    } else if (text[index] === "[") {
+      state.arrayDepth += 1;
+      index += 1;
+    } else if (text[index] === "]" && state.arrayDepth) {
+      state.arrayDepth -= 1;
+      index += 1;
+    } else if (text[index] === "{") {
+      state.inlineDepth += 1;
+      index += 1;
+    } else if (text[index] === "}" && state.inlineDepth) {
+      state.inlineDepth -= 1;
+      index += 1;
+    } else if (!state.arrayDepth && !state.inlineDepth && (text[index] === "," || text[index] === "}")) {
+      break;
+    } else {
+      index += 1;
+    }
+  }
+  return index;
+}
+
+function parseInlineTomlTable(text, open, path, tables = []) {
+  if (text[open] !== "{") return null;
+  const table = { close: -1, entries: [], open, path };
+  tables.push(table);
+  let index = skipTomlTrivia(text, open + 1);
+
+  while (index < text.length && text[index] !== "}") {
+    const start = index;
+    const key = parseKeyPath(text, index);
+    if (!key) return null;
+    index = skipWhitespace(text, key.index);
+    if (text[index] !== "=") return null;
+    const valueStart = skipTomlTrivia(text, index + 1);
+    const entryPath = [...path, ...key.path];
+    const nested = text[valueStart] === "{"
+      ? parseInlineTomlTable(text, valueStart, entryPath, tables)
+      : null;
+    index = nested ? nested.close + 1 : scanInlineTomlValue(text, valueStart);
+    let valueEnd = index;
+    while (valueEnd > valueStart && /[ \t\r\n]/u.test(text[valueEnd - 1])) valueEnd -= 1;
+    index = skipTomlTrivia(text, index);
+    const comma = text[index] === "," ? index : -1;
+    table.entries.push({ comma, path: entryPath, start, valueEnd, valueStart });
+    if (comma === -1) break;
+    index = skipTomlTrivia(text, comma + 1);
+  }
+
+  if (text[index] !== "}") return null;
+  table.close = index;
+  return { close: index, table, tables };
+}
+
+function findInlineTomlTable(document, content, targetPath) {
+  const candidates = document.assignments
+    .filter((entry) => pathStartsWith(targetPath, assignmentPath(entry)))
+    .filter((entry) => content[entry.valueStart] === "{")
+    .sort((left, right) => assignmentPath(right).length - assignmentPath(left).length);
+
+  for (const entry of candidates) {
+    const syntax = parseInlineTomlTable(content, entry.valueStart, assignmentPath(entry));
+    const table = syntax?.tables
+      .filter((candidate) => pathStartsWith(targetPath, candidate.path))
+      .sort((left, right) => right.path.length - left.path.length)[0];
+    if (table) return { entry, syntax, table };
+  }
+  return null;
+}
+
+function updateInlineTomlTable(content, inline, targetPath, values) {
+  const remaining = new Map(Object.entries(values));
+  const edits = [];
+  for (const entry of inline.table.entries) {
+    if (!pathStartsWith(entry.path, targetPath) || entry.path.length !== targetPath.length + 1) continue;
+    const field = entry.path.at(-1);
+    if (!remaining.has(field)) continue;
+    edits.push({ start: entry.valueStart, end: entry.valueEnd, text: formatValue(remaining.get(field)) });
+    remaining.delete(field);
+  }
+  if (remaining.size) {
+    let insertAt = inline.table.close;
+    while (insertAt > inline.table.open + 1 && /\s/u.test(content[insertAt - 1])) insertAt -= 1;
+    const trailingComma = content[insertAt - 1] === ",";
+    const prefix = inline.table.entries.length ? trailingComma ? " " : ", " : "";
+    const pathPrefix = targetPath.slice(inline.table.path.length);
+    const fields = [...remaining].map(([field, value]) => (
+      `${formatDottedTomlPath([...pathPrefix, field])} = ${formatValue(value)}`
+    ));
+    edits.push({ start: insertAt, end: insertAt, text: `${prefix}${fields.join(", ")}` });
+  }
+  return applyEdits(content, edits);
+}
+
+function removeInlineTomlTableField(content, inline, targetPath) {
+  const entryIndex = inline.table.entries.findIndex((entry) => samePath(entry.path, targetPath));
+  if (entryIndex === -1) return content;
+  const entry = inline.table.entries[entryIndex];
+  const previous = inline.table.entries[entryIndex - 1];
+  const next = inline.table.entries[entryIndex + 1];
+  if (next) return `${content.slice(0, entry.start)}${content.slice(next.start)}`;
+  const start = previous?.comma === undefined || previous.comma === -1 ? entry.start : previous.comma;
+  return `${content.slice(0, start)}${content.slice(inline.table.close)}`;
+}
+
+function formatDottedTomlPath(path) {
+  return path.map(formatTomlKeySegment).join(".");
+}
+
+function insertTomlAssignments(content, section, pathPrefix, values) {
+  const lineEnding = detectLineEnding(content);
+  const lines = Object.entries(values).map(([field, value]) => (
+    `${formatDottedTomlPath([...pathPrefix, field])} = ${formatValue(value)}`
+  ));
+  if (!lines.length) return content;
+
+  if (!section) {
+    const document = parseDocument(content);
+    const top = content.slice(0, document.topLevelEnd).trimEnd();
+    const rest = content.slice(document.topLevelEnd);
+    const nextTop = top ? `${top}${lineEnding}${lines.join(lineEnding)}` : lines.join(lineEnding);
+    return `${nextTop}${rest ? `${lineEnding}${lineEnding}${rest}` : lineEnding}`;
+  }
+
+  const leading = section.end && content[section.end - 1] !== "\n" ? lineEnding : "";
+  return `${content.slice(0, section.end)}${leading}${lines.join(lineEnding)}${lineEnding}${content.slice(section.end)}`;
+}
+
 function formatValue(value) {
   if (typeof value === "string") return JSON.stringify(value);
   if (typeof value === "boolean") return value ? "true" : "false";
-  throw new TypeError("Managed TOML values must be strings or booleans");
+  if (Number.isSafeInteger(value)) return String(value);
+  if (typeof value === "bigint"
+    && value >= BigInt(Number.MIN_SAFE_INTEGER)
+    && value <= BigInt(Number.MAX_SAFE_INTEGER)) return String(value);
+  throw new TypeError("Managed TOML values must be strings, booleans, or safe integers");
 }
 
 function formatTomlKeySegment(value) {
@@ -248,6 +444,39 @@ function formatTomlKeySegment(value) {
   return /^[A-Za-z0-9_-]+$/u.test(segment) ? segment : JSON.stringify(segment);
 }
 
+function extractTopLevelTomlEntries(content) {
+  const document = parseDocument(content);
+  return document.assignments
+    .filter(({ path, section }) => section === null && path.length === 1)
+    .map((entry) => ({
+      field: entry.path[0],
+      raw: content.slice(entry.start, entry.end)
+    }));
+}
+
+function mergeMissingTopLevelTomlEntries(content, entries) {
+  if (!entries.length) return content;
+  const lineEnding = detectLineEnding(content);
+  const document = parseDocument(content);
+  const top = content.slice(0, document.topLevelEnd);
+  const rest = content.slice(document.topLevelEnd);
+  const existingFields = new Set(
+    document.assignments
+      .filter(({ path, section }) => section === null && path.length === 1)
+      .map(({ path }) => path[0])
+  );
+  const missing = entries.filter(({ field }) => !existingFields.has(field));
+  if (!missing.length) return content;
+
+  let nextTop = top.trimEnd();
+  for (const entry of missing) {
+    nextTop = nextTop ? `${nextTop}${lineEnding}${entry.raw}` : entry.raw;
+  }
+  nextTop = nextTop.trimEnd();
+  if (rest && nextTop) nextTop += `${lineEnding}${lineEnding}`;
+  return `${nextTop}${rest}`;
+}
+
 function updateTopLevelTomlField(content, field, value) {
   if (value === null) return removeTopLevelTomlField(content, field);
   const document = parseDocument(content);
@@ -273,9 +502,20 @@ function removeTopLevelTomlField(content, field) {
 
 function removeTomlSectionField(content, sectionName, field) {
   const document = parseDocument(content);
+  const sectionPath = requestedPath(sectionName);
   const section = findSection(document, sectionName);
   const entry = section && findAssignment(document.assignments, field, section);
-  return entry ? `${content.slice(0, entry.start)}${content.slice(entry.lineEnd)}` : content;
+  if (entry) return `${content.slice(0, entry.start)}${content.slice(entry.lineEnd)}`;
+  if (!sectionPath) return content;
+
+  const fieldPath = [...sectionPath, field];
+  const dottedEntry = document.assignments.find((candidate) => samePath(assignmentPath(candidate), fieldPath));
+  if (dottedEntry) {
+    return `${content.slice(0, dottedEntry.start)}${content.slice(dottedEntry.lineEnd)}`;
+  }
+
+  const inline = findInlineTomlTable(document, content, sectionPath);
+  return inline ? removeInlineTomlTableField(content, inline, fieldPath) : content;
 }
 
 function applyEdits(content, edits) {
@@ -289,8 +529,50 @@ function applyEdits(content, edits) {
 function updateTomlSectionFields(content, sectionName, values) {
   const lineEnding = detectLineEnding(content);
   const document = parseDocument(content);
+  const sectionPath = requestedPath(sectionName);
   const section = findSection(document, sectionName);
   const entries = Object.entries(values).filter(([, value]) => value !== undefined && value !== null && value !== "");
+  if (!section && sectionPath) {
+    const inline = findInlineTomlTable(document, content, sectionPath);
+    if (inline) return updateInlineTomlTable(content, inline, sectionPath, Object.fromEntries(entries));
+
+    const descendantEntries = document.assignments.filter((entry) => (
+      assignmentPath(entry).length > sectionPath.length
+      && pathStartsWith(assignmentPath(entry), sectionPath)
+    ));
+    if (descendantEntries.length) {
+      const directEntries = descendantEntries.filter((entry) => (
+        assignmentPath(entry).length === sectionPath.length + 1
+      ));
+      const remaining = new Map(entries);
+      const edits = [];
+      for (const entry of directEntries) {
+        const field = assignmentPath(entry).at(-1);
+        if (!remaining.has(field)) continue;
+        edits.push({
+          start: entry.valueStart,
+          end: entry.valueEnd,
+          text: formatValue(remaining.get(field))
+        });
+        remaining.delete(field);
+      }
+      let nextContent = applyEdits(content, edits);
+      if (remaining.size) {
+        const candidate = descendantEntries[0].section;
+        const container = candidate
+          && candidate.path.length < sectionPath.length
+          && pathStartsWith(sectionPath, candidate.path)
+          ? candidate
+          : null;
+        const prefix = container ? sectionPath.slice(container.path.length) : sectionPath;
+        const nextDocument = parseDocument(nextContent);
+        const nextContainer = container && findSection(nextDocument, formatDottedTomlPath(container.path));
+        nextContent = insertTomlAssignments(nextContent, nextContainer, prefix, Object.fromEntries(remaining));
+      }
+      return nextContent;
+    }
+  }
+
   if (!section) {
     const lines = [`[${sectionName}]`, ...entries.map(([field, value]) => `${field} = ${formatValue(value)}`)];
     const block = lines.join(lineEnding);
@@ -324,7 +606,9 @@ function updateTomlSectionFields(content, sectionName, values) {
 
 export {
   detectLineEnding,
+  extractTopLevelTomlEntries,
   formatTomlKeySegment,
+  mergeMissingTopLevelTomlEntries,
   parseToml,
   removeTomlSectionField,
   removeTopLevelTomlField,

package/lib/installer/state.mjs

@@ -14,6 +14,11 @@ function isMetadataV2(previousMetadata) {
   return previousMetadata?.schemaVersion === 2;
 }
 
+function isPublishedLegacyMetadata(previousMetadata) {
+  return previousMetadata?.package === "abelworkflow"
+    && (previousMetadata.schemaVersion === undefined || previousMetadata.schemaVersion === 1);
+}
+
 function objectField(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
@@ -36,6 +41,7 @@ async function readInstallMetadata(paths) {
     throw new TypeError(`Install metadata in ${metadataPathFor(paths)} must contain a JSON object`);
   }
   if (Object.keys(metadata).length > 0 && !isMetadataV2(metadata)) {
+    if (isPublishedLegacyMetadata(metadata)) return {};
     throw new Error(`Unsupported install metadata schema in ${metadataPathFor(paths)}`);
   }
   return metadata;

package/lib/paths.mjs

@@ -27,6 +27,7 @@ function createPaths({
     claudeSettingsPath: join(absoluteHomeDir, ".claude", "settings.json"),
     codexConfigPath: join(absoluteHomeDir, ".codex", "config.toml"),
     codexAuthPath: join(absoluteHomeDir, ".codex", "auth.json"),
+    codexTemplateConfigPath: join(codexTemplateRoot, "config-base.toml"),
     codexTemplateAgentsPath: join(codexTemplateRoot, "agents"),
     piAgentDir,
     piAuthPath: join(piAgentDir, "auth.json"),

package/lib/providers/claude.mjs

@@ -7,13 +7,55 @@ import {
 import { maskSecret, pathToLabel } from "../paths.mjs";
 import { normalizeHttpBaseUrl } from "./url.mjs";
 
+const claudeModelEnvKeys = [
+  "ANTHROPIC_MODEL",
+  "ANTHROPIC_DEFAULT_OPUS_MODEL",
+  "ANTHROPIC_DEFAULT_SONNET_MODEL",
+  "ANTHROPIC_DEFAULT_HAIKU_MODEL",
+  "CLAUDE_CODE_SUBAGENT_MODEL"
+];
+const defaultClaudeSettings = {
+  $schema: "https://json.schemastore.org/claude-code-settings.json",
+  attribution: {
+    commit: "",
+    pr: "",
+    sessionUrl: false
+  },
+  env: {
+    CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
+    API_TIMEOUT_MS: "1000000"
+  },
+  permissions: {
+    allow: [
+      "Bash",
+      "Skill",
+      "Read",
+      "Agent",
+      "Write",
+      "Edit",
+      "Glob",
+      "Grep",
+      "WebFetch",
+      "WebSearch",
+      "NotebookEdit",
+      "TaskCreate",
+      "TaskGet",
+      "TaskUpdate",
+      "TaskList"
+    ],
+    deny: []
+  },
+  hooks: {},
+  alwaysThinkingEnabled: true,
+  language: "Chinese"
+};
+
 function getExistingClaudeApiConfig(settings) {
-  assertPlainObject(settings, "Claude settings");
   const env = settings.env === undefined ? {} : assertPlainObject(settings.env, "Claude settings env");
   return {
     baseUrl: env.ANTHROPIC_BASE_URL || "https://api.anthropic.com",
     key: env.ANTHROPIC_API_KEY || "",
-    model: typeof env.ANTHROPIC_MODEL === "string" ? env.ANTHROPIC_MODEL : ""
+    model: claudeModelEnvKeys.map((field) => env[field]).find((value) => typeof value === "string" && value) || ""
   };
 }
 
@@ -24,16 +66,39 @@ function buildClaudeApiSettings(settings, {
 }) {
   assertPlainObject(settings, "Claude settings");
   const env = settings.env === undefined ? {} : assertPlainObject(settings.env, "Claude settings env");
+  const permissions = settings.permissions === undefined
+    ? {}
+    : assertPlainObject(settings.permissions, "Claude settings permissions");
+  const attribution = settings.attribution === undefined
+    ? {}
+    : assertPlainObject(settings.attribution, "Claude settings attribution");
   const nextSettings = {
+    ...defaultClaudeSettings,
     ...settings,
+    attribution: {
+      ...defaultClaudeSettings.attribution,
+      ...attribution
+    },
     env: {
+      ...defaultClaudeSettings.env,
       ...env,
       ANTHROPIC_BASE_URL: normalizeHttpBaseUrl(baseUrl),
-      ANTHROPIC_API_KEY: key,
-      ANTHROPIC_MODEL: String(model).trim()
+      ANTHROPIC_API_KEY: key
+    },
+    permissions: {
+      ...defaultClaudeSettings.permissions,
+      ...permissions,
+      allow: Array.isArray(permissions.allow) ? permissions.allow : [...defaultClaudeSettings.permissions.allow],
+      deny: Array.isArray(permissions.deny) ? permissions.deny : [...defaultClaudeSettings.permissions.deny]
     }
   };
+  delete nextSettings.includeCoAuthoredBy;
   delete nextSettings.env.ANTHROPIC_AUTH_TOKEN;
+  delete nextSettings.env.DISABLE_TELEMETRY;
+  delete nextSettings.env.DISABLE_ERROR_REPORTING;
+  for (const field of claudeModelEnvKeys) {
+    nextSettings.env[field] = String(model).trim();
+  }
   return nextSettings;
 }
 

package/lib/providers/codex.mjs

@@ -10,7 +10,9 @@ import {
   writeText
 } from "../config/store.mjs";
 import {
+  extractTopLevelTomlEntries,
   formatTomlKeySegment,
+  mergeMissingTopLevelTomlEntries,
   parseToml,
   removeTomlSectionField,
   removeTopLevelTomlField,
@@ -23,6 +25,21 @@ import { normalizeOpenAiBaseUrl } from "./url.mjs";
 
 const CODEX_ENV_KEY = "OPENAI_API_KEY";
 const CODEX_PROVIDER_ID = "abelworkflow";
+const publishedCodexDeveloperInstructionHashes = new Set([
+  "9a70e45a6f4a201f617b657207f32b61901ecc70071dfb4f9d905cc23a6f35a7",
+  "81aa8aaf309ed374dbc2d8ae55ca793ad39a4befc75aba6cac32736da368e2fd"
+]);
+const obsoleteCodexTopLevelFields = [
+  "disable_response_storage",
+  "network_access",
+  "supports_websockets",
+  "requires_openai_auth"
+];
+const obsoleteCodexFeatureFields = [
+  "js_repl",
+  "responses_websockets",
+  "responses_websockets_v2"
+];
 
 function assertTomlTable(value, name) {
   if (value === undefined) return {};
@@ -36,6 +53,59 @@ function assertTomlTable(value, name) {
   return value;
 }
 
+function mergeCodexTemplateDefaults(content, templateContent) {
+  const template = parseToml(templateContent);
+  const current = parseToml(content);
+  const templateEntries = extractTopLevelTomlEntries(templateContent);
+  let nextContent = mergeMissingTopLevelTomlEntries(content, templateEntries);
+  const currentInstructions = typeof current.developer_instructions === "string"
+    ? current.developer_instructions
+    : "";
+
+  if (publishedCodexDeveloperInstructionHashes.has(hashBytes(currentInstructions))) {
+    const legacyDefaults = {
+      approvals_reviewer: "guardian_subagent",
+      approval_policy: "on-request",
+      sandbox_mode: "workspace-write",
+      model: "gpt-5.5"
+    };
+    const replacementFields = new Set(["developer_instructions"]);
+    for (const [field, value] of Object.entries(legacyDefaults)) {
+      if (current[field] === value) replacementFields.add(field);
+    }
+    for (const field of replacementFields) {
+      nextContent = removeTopLevelTomlField(nextContent, field);
+    }
+    nextContent = mergeMissingTopLevelTomlEntries(
+      nextContent,
+      templateEntries.filter(({ field }) => replacementFields.has(field))
+    );
+  }
+
+  for (const field of obsoleteCodexTopLevelFields) {
+    nextContent = removeTopLevelTomlField(nextContent, field);
+  }
+  for (const field of obsoleteCodexFeatureFields) {
+    nextContent = removeTomlSectionField(nextContent, "features", field);
+  }
+
+  for (const sectionName of ["agents", "features"]) {
+    const templateSection = assertTomlTable(template[sectionName], `template ${sectionName}`);
+    const currentSection = assertTomlTable(current[sectionName], sectionName);
+    const missingValues = Object.fromEntries(
+      Object.entries(templateSection).filter(([field]) => !Object.hasOwn(currentSection, field))
+    );
+    if (Object.keys(missingValues).length) {
+      nextContent = updateTomlSectionFields(nextContent, sectionName, missingValues);
+    }
+  }
+  return nextContent;
+}
+
+async function loadBundledCodexConfigTemplate(paths) {
+  return readFile(paths.codexTemplateConfigPath, "utf8");
+}
+
 async function readCodexAgentTarget(path) {
   try {
     const targetStat = await lstat(path);
@@ -189,6 +259,7 @@ async function getExistingCodexApiConfig(paths) {
 }
 
 async function persistCodexConfiguration(paths, intent, operations = {}) {
+  const templateContent = await loadBundledCodexConfigTemplate(paths);
   return withFileTransaction([
     { path: paths.codexConfigPath, safeRoot: paths.homeDir },
     { path: paths.codexAuthPath, safeRoot: paths.homeDir, sensitive: true }
@@ -198,6 +269,7 @@ async function persistCodexConfiguration(paths, intent, operations = {}) {
     assertPlainObject(currentAuth, "Codex auth");
     const current = resolveExistingCodexApiConfig(currentContent, currentAuth);
     const content = buildCodexConfigContent(currentContent, {
+      templateContent,
       providerName: current.providerName,
       baseUrl: intent.baseUrl
     });
@@ -270,6 +342,7 @@ async function configureCodexApi(paths, promptApi, ownership = {}, runtime = {})
 }
 
 function buildCodexConfigContent(currentContent, {
+  templateContent = "",
   providerName,
   baseUrl
 }) {
@@ -280,17 +353,21 @@ function buildCodexConfigContent(currentContent, {
     `model_providers.${CODEX_PROVIDER_ID}`
   );
   const providerSection = `model_providers.${formatTomlKeySegment(CODEX_PROVIDER_ID)}`;
-  let content = updateTopLevelTomlField(currentContent, "model_provider", CODEX_PROVIDER_ID);
+  let content = currentContent.trim()
+    ? mergeCodexTemplateDefaults(currentContent, templateContent)
+    : templateContent;
+  content = updateTopLevelTomlField(content, "model_provider", CODEX_PROVIDER_ID);
   content = removeTopLevelTomlField(content, "preferred_auth_method");
   content = removeTopLevelTomlField(content, "temp_env_key");
-  for (const field of ["env_key", "temp_env_key", "supports_websockets"]) {
+  for (const field of ["env_key", "temp_env_key"]) {
     content = removeTomlSectionField(content, providerSection, field);
   }
   content = updateTomlSectionFields(content, providerSection, {
     name: providerName || CODEX_PROVIDER_ID,
     base_url: normalizeOpenAiBaseUrl(baseUrl),
     wire_api: "responses",
-    requires_openai_auth: true
+    requires_openai_auth: true,
+    supports_websockets: true
   });
   parseToml(content);
   return content;
@@ -315,6 +392,7 @@ export {
   configureCodexApi,
   deployBundledCodexAgents,
   mergeCodexAuthData,
+  mergeCodexTemplateDefaults,
   persistCodexConfiguration,
   resolveExistingCodexApiConfig
 };

package/lib/providers/pi.mjs

@@ -84,17 +84,18 @@ function buildPiModelsConfig(modelsConfig = {}, { baseUrl, api, apiKey, modelIds
   const provider = {
     baseUrl: normalizeOpenAiBaseUrl(baseUrl),
     api,
-    ...(responses ? {
-      apiKey,
-      compat: { supportsDeveloperRole: false }
-    } : {}),
+    ...(responses ? { apiKey } : {}),
+    compat: { supportsDeveloperRole: false },
     models: modelIds.map((modelId) => {
       const name = existingModels.get(modelId)?.name;
-      const model = { id: modelId, name: typeof name === "string" && name ? name : modelId };
+      const model = {
+        id: modelId,
+        name: typeof name === "string" && name ? name : modelId,
+        reasoning: true,
+        input: ["text", "image"]
+      };
       return responses ? {
         ...model,
-        reasoning: true,
-        input: ["text", "image"],
         thinkingLevelMap: {
           off: null,
           minimal: "low",
@@ -106,7 +107,11 @@ function buildPiModelsConfig(modelsConfig = {}, { baseUrl, api, apiKey, modelIds
         },
         contextWindow: 262144,
         maxTokens: 131072
-      } : model;
+      } : {
+        ...model,
+        contextWindow: 262144,
+        maxTokens: 64000
+      };
     })
   };
 

package/lib/templates/codex/agents/explorer.toml

@@ -11,7 +11,7 @@ Do NOT dispatch for review after implementation — use reviewer instead.
 Do NOT dispatch if the affected files are already known and confirmed.
 """
 nickname_candidates    = ["Atlas", "Trace", "Scout"]
-model                  = "gpt-5.6-sol"
+model                  = "gpt-5.6-luna"
 model_reasoning_effort = "high"
 sandbox_mode           = "read-only"