agentsw 0.7.1 → 0.7.2

package/dist/rename.js

@@ -10,6 +10,8 @@ import { commitFileChanges } from "./config-transaction.js";
 import { endpointKey } from "./import.js";
 import { classifyApi, entryApi } from "./targets/wire.js";
 import { envAssignments } from "./envfile.js";
+import { isManagedCredentialRef, legacyManagedCredentialRef, managedCredentialRef } from "./provider-identity.js";
+import { workbuddyBaseUrl } from "./targets/workbuddy.js";
 function readExisting(file) {
     try {
         return fs.readFileSync(file, "utf8");
@@ -206,7 +208,6 @@ function tomlEditor(file, before) {
         },
     };
 }
-const managedKey = (id) => `AGENTSW_${id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_API_KEY`;
 /** Explicit provider ID migration; never recreates providers or edits session history. */
 export async function renameProvider(oldId, newId, opts = {}) {
     if (!/^[a-z0-9][a-z0-9_-]*$/.test(newId))
@@ -225,9 +226,9 @@ export async function renameProvider(oldId, newId, opts = {}) {
     const provider = object(providers[oldId], configFile);
     const changes = [];
     const visited = new Set();
-    const oldKey = managedKey(oldId);
-    const newKey = managedKey(newId);
-    const assertConnection = (editor, entry) => {
+    const oldKeys = [managedCredentialRef(oldId), legacyManagedCredentialRef(oldId)];
+    const newKey = managedCredentialRef(newId);
+    const assertConnection = (editor, entry, envLookup = false) => {
         const options = isJsonObject(entry.options) ? entry.options : {};
         const endpoint = entry.baseUrl ?? entry.baseURL ?? entry.base_url ?? options.baseURL ?? (entry.transport ? entry.api : undefined);
         if (typeof endpoint === "string" && /^https?:\/\//i.test(endpoint) && typeof provider.baseUrl === "string" && endpointKey(endpoint) !== endpointKey(provider.baseUrl)) {
@@ -241,10 +242,10 @@ export async function renameProvider(oldId, newId, opts = {}) {
         if (protocol && provider.protocol && protocol !== provider.protocol)
             throw new Error(`${editor.file}: source provider protocol conflicts with the store`);
         const rawKey = entry.apiKey ?? options.apiKey;
-        if (typeof rawKey === "string" && rawKey) {
+        if (typeof rawKey === "string") {
             const ref = rawKey.match(/^\$([A-Za-z_][A-Za-z0-9_]*)$/)?.[1] ?? rawKey.match(/^\{env:([A-Za-z_][A-Za-z0-9_]*)\}$/)?.[1];
             // Command/file references remain unresolved; no shell execution or secret-file reads.
-            const key = ref ? process.env[ref] : /^(?:!|\{file:)/.test(rawKey) ? undefined : /^[A-Z][A-Z0-9_]*$/.test(rawKey) ? process.env[rawKey] : rawKey;
+            const key = ref ? process.env[ref] : /^(?:!|\{file:)/.test(rawKey) ? undefined : envLookup ? process.env[rawKey] ?? rawKey : rawKey;
             if (key !== undefined && typeof provider.apiKey === "string" && key !== provider.apiKey)
                 throw new Error(`${editor.file}: source provider credentials conflict with the store`);
         }
@@ -262,7 +263,7 @@ export async function renameProvider(oldId, newId, opts = {}) {
         const value = get(editor.value, at);
         return value === undefined ? [] : Object.entries(object(value, editor.file));
     };
-    const renameMap = (editor, at, names = ["id", "name"]) => {
+    const renameMap = (editor, at, names = ["id", "name"], envLookup = false) => {
         const map = get(editor.value, at);
         if (map === undefined)
             return;
@@ -271,7 +272,13 @@ export async function renameProvider(oldId, newId, opts = {}) {
             throw new Error(`${editor.file}: destination provider ID already exists`);
         if (!Object.hasOwn(entries, oldId))
             return;
-        assertConnection(editor, object(entries[oldId], editor.file));
+        const entry = object(entries[oldId], editor.file);
+        assertConnection(editor, entry, envLookup);
+        if (Array.isArray(entry.models))
+            for (const model of entry.models) {
+                if (isJsonObject(model))
+                    assertConnection(editor, model, envLookup);
+            }
         for (const key of names)
             exact(editor, [...at, oldId, key]);
         editor.move(at, oldId, newId);
@@ -323,7 +330,7 @@ export async function renameProvider(oldId, newId, opts = {}) {
     });
     const ompDir = path.join(home, ".omp", "agent");
     for (const name of ["models.yml", "models.yaml"])
-        visit(path.join(ompDir, name), "yaml", (editor) => renameMap(editor, ["providers"]));
+        visit(path.join(ompDir, name), "yaml", (editor) => renameMap(editor, ["providers"], undefined, true));
     for (const name of ["config.yml", "config.yaml"])
         visit(path.join(ompDir, name), "yaml", (editor) => {
             compound(editor, ["model"]);
@@ -332,7 +339,7 @@ export async function renameProvider(oldId, newId, opts = {}) {
         });
     for (const [env, fallback] of [["PI_CODING_AGENT_DIR", ".pi/agent"], ["PRIME_AGENT_CODING_AGENT_DIR", ".prime/agent"]]) {
         const dir = process.env[env] ? expandHome(process.env[env]) : path.join(home, fallback);
-        visit(path.join(dir, "models.json"), "json", (editor) => renameMap(editor, ["providers"]));
+        visit(path.join(dir, "models.json"), "json", (editor) => renameMap(editor, ["providers"], undefined, env === "PRIME_AGENT_CODING_AGENT_DIR"));
         visit(path.join(dir, "settings.json"), "json", (editor) => {
             exact(editor, ["defaultProvider"]);
             const recent = get(editor.value, ["recentModels"]);
@@ -370,71 +377,87 @@ export async function renameProvider(oldId, newId, opts = {}) {
                     list.forEach((_value, index) => exact(editor, [key, index]));
             }
         });
+    const migrationKey = (file, local, maps, field) => {
+        const sourceRefs = maps.flatMap((map) => map.filter(([id]) => id === oldId).map(([, entry]) => get(entry, [field])));
+        const eligible = oldKeys.filter((key) => local.has(key) &&
+            (sourceRefs.includes(key) || sourceRefs.every((ref) => ref === undefined)) &&
+            !Object.keys(providers).some((id) => id !== oldId && isManagedCredentialRef(key, id)) &&
+            !maps.some((map) => map.some(([id, entry]) => id !== oldId &&
+                (get(entry, [field]) === key || isManagedCredentialRef(key, id)))));
+        if (eligible.length > 1)
+            throw new Error(`${file}: ambiguous managed credential references`);
+        const key = eligible[0];
+        if (!key)
+            return undefined;
+        if (local.has(newKey) || process.env[newKey] !== undefined ||
+            maps.some((map) => map.some(([, entry]) => get(entry, [field]) === newKey))) {
+            throw new Error(`${file}: destination credential reference already exists`);
+        }
+        if (process.env[key] !== undefined && process.env[key] !== local.get(key))
+            throw new Error(`${file}: inherited credential overrides the local definition`);
+        if (typeof provider.apiKey === "string" && local.get(key) !== provider.apiKey)
+            throw new Error(`${file}: source provider credentials conflict with the store`);
+        return key;
+    };
     const hermesDir = process.env.HERMES_HOME?.trim() ? expandHome(process.env.HERMES_HOME.trim()) : localAppDataDir("hermes");
     const envFile = path.join(hermesDir, ".env");
     const envBefore = readExisting(envFile);
     const assignments = envBefore === undefined ? [] : envAssignments(envFile, envBefore);
     const envValues = new Map(assignments.map((assignment) => [assignment.name, assignment.value]));
-    const migrateEnv = oldKey !== newKey && assignments.some((assignment) => assignment.name === oldKey);
-    if (migrateEnv) {
-        if (assignments.some((assignment) => assignment.name === newKey) || process.env[newKey] !== undefined)
-            throw new Error(`${envFile}: destination credential reference already exists`);
-        if (process.env[oldKey] !== undefined && process.env[oldKey] !== envValues.get(oldKey))
-            throw new Error(`${envFile}: inherited credential overrides the local definition`);
-        const after = applyEdits(envBefore, assignments.filter((assignment) => assignment.name === oldKey).map((assignment) => ({ offset: assignment.offset, length: oldKey.length, content: newKey })));
-        changes.push({ file: envFile, before: envBefore, after, mode: 0o600 });
-    }
-    if (!migrateEnv)
-        changes.push({ file: envFile, before: envBefore, after: envBefore });
+    let envKey;
+    let hermesPresent = false;
     visit(path.join(hermesDir, "config.yaml"), "yaml", (editor) => {
+        hermesPresent = true;
         const keyRef = get(editor.value, ["providers", oldId, "key_env"]);
         const key = typeof keyRef === "string" ? process.env[keyRef] ?? envValues.get(keyRef) : undefined;
         if (key !== undefined && provider.apiKey !== undefined && key !== provider.apiKey)
             throw new Error(`${editor.file}: source provider credentials conflict with the store`);
-        if (migrateEnv)
-            for (const [id, entry] of entries(editor, ["providers"])) {
-                if (get(entry, ["key_env"]) === newKey)
-                    throw new Error(`${editor.file}: destination credential reference already exists`);
-                exact(editor, ["providers", id, "key_env"], oldKey, newKey);
-            }
+        envKey = migrationKey(envFile, envValues, [entries(editor, ["providers"])], "key_env");
+        if (envKey)
+            exact(editor, ["providers", oldId, "key_env"], envKey, newKey);
         renameMap(editor, ["providers"]);
         exact(editor, ["model", "provider"]);
     });
+    if (!hermesPresent)
+        envKey = migrationKey(envFile, envValues, [], "key_env");
+    const envAfter = envKey ? applyEdits(envBefore, assignments.filter((assignment) => assignment.name === envKey)
+        .map((assignment) => ({ offset: assignment.offset, length: envKey.length, content: newKey }))) : envBefore;
+    changes.push({ file: envFile, before: envBefore, after: envAfter, mode: 0o600 });
     const dshDir = process.env.DSH_HOME?.trim() ? expandHome(process.env.DSH_HOME.trim()) : localAppDataDir("dsh");
+    const settings = [];
+    for (const name of ["settings.yaml", "settings.yml", "settings.json"]) {
+        const file = path.join(dshDir, name);
+        const before = readExisting(file);
+        if (before === undefined)
+            changes.push({ file, before, after: before });
+        else
+            settings.push({ editor: name.endsWith("json") ? jsonEditor(file, before) : yamlEditor(file, before), before });
+    }
+    const dshMaps = settings.map(({ editor }) => entries(editor, ["llm-pi-ai", "providers"]));
     const credentialFile = path.join(dshDir, ".credentials.yaml");
-    let migrateCredential = false;
+    let credentialKey;
     let credentialRefs = {};
     visit(credentialFile, "yaml", (editor) => {
         const version = get(editor.value, ["version"]);
         if (version !== undefined && version !== 1)
             throw new Error(`${credentialFile}: unsupported credential layout version`);
         const at = version === undefined && get(editor.value, ["refs"]) === undefined ? [] : ["refs"];
-        const refs = object(get(editor.value, at), credentialFile);
-        credentialRefs = refs;
-        if (oldKey === newKey || !Object.hasOwn(refs, oldKey))
-            return;
-        if (Object.hasOwn(refs, newKey) || process.env[newKey] !== undefined)
-            throw new Error(`${credentialFile}: destination credential reference already exists`);
-        if (process.env[oldKey] !== undefined && process.env[oldKey] !== refs[oldKey])
-            throw new Error(`${credentialFile}: inherited credential overrides the local definition`);
-        editor.move(at, oldKey, newKey);
-        migrateCredential = true;
+        credentialRefs = object(get(editor.value, at), credentialFile);
+        credentialKey = migrationKey(credentialFile, new Map(Object.entries(credentialRefs)), dshMaps, "apiKeyEnv");
+        if (credentialKey)
+            editor.move(at, credentialKey, newKey);
     }, 0o600);
-    for (const name of ["settings.yaml", "settings.yml", "settings.json"])
-        visit(path.join(dshDir, name), name.endsWith("json") ? "json" : "yaml", (editor) => {
-            const keyRef = get(editor.value, ["llm-pi-ai", "providers", oldId, "apiKeyEnv"]);
-            const key = typeof keyRef === "string" ? process.env[keyRef] ?? credentialRefs[keyRef] : undefined;
-            if (key !== undefined && provider.apiKey !== undefined && key !== provider.apiKey)
-                throw new Error(`${editor.file}: source provider credentials conflict with the store`);
-            if (migrateCredential)
-                for (const [id, entry] of entries(editor, ["llm-pi-ai", "providers"])) {
-                    if (get(entry, ["apiKeyEnv"]) === newKey)
-                        throw new Error(`${editor.file}: destination credential reference already exists`);
-                    exact(editor, ["llm-pi-ai", "providers", id, "apiKeyEnv"], oldKey, newKey);
-                }
-            renameMap(editor, ["llm-pi-ai", "providers"], ["id", "displayName"]);
-            exact(editor, ["agent-default-model", "provider"]);
-        });
+    for (const { editor, before } of settings) {
+        const keyRef = get(editor.value, ["llm-pi-ai", "providers", oldId, "apiKeyEnv"]);
+        const key = typeof keyRef === "string" ? process.env[keyRef] ?? credentialRefs[keyRef] : undefined;
+        if (key !== undefined && provider.apiKey !== undefined && key !== provider.apiKey)
+            throw new Error(`${editor.file}: source provider credentials conflict with the store`);
+        if (credentialKey)
+            exact(editor, ["llm-pi-ai", "providers", oldId, "apiKeyEnv"], credentialKey, newKey);
+        renameMap(editor, ["llm-pi-ai", "providers"], ["id", "displayName"]);
+        exact(editor, ["agent-default-model", "provider"]);
+        finish(editor, before);
+    }
     const workbuddyEnv = process.env.WORKBUDDY_CONFIG_DIR?.trim() ?? process.env.CODEBUDDY_CONFIG_DIR?.trim();
     const workbuddyDir = workbuddyEnv ? expandHome(workbuddyEnv) : process.platform === "win32" ? appDataDir("workbuddy") : path.join(home, ".workbuddy");
     visit(path.join(workbuddyDir, "models.json"), "json", (editor) => {
@@ -444,12 +467,22 @@ export async function renameProvider(oldId, newId, opts = {}) {
             return;
         if (!Array.isArray(rows))
             throw new Error(`${editor.file}: expected WorkBuddy models array`);
-        const base = typeof provider.baseUrl === "string" ? provider.baseUrl.replace(/\/+$/, "") : "";
-        const url = /\/v\d+$/.test(base) ? `${base}/chat/completions` : `${base}/v1/chat/completions`;
-        if (provider.name !== oldId)
-            return;
         rows.forEach((row, index) => {
-            if (isJsonObject(row) && row.url === url && row.apiKey === provider.apiKey)
+            if (!isJsonObject(row))
+                return;
+            if (row.agentswProviderId === newId)
+                throw new Error(`${editor.file}: destination provider ID already exists`);
+            const owned = row.agentswProviderId === oldId;
+            const endpoint = typeof row.url === "string" ? workbuddyBaseUrl(row.url) : undefined;
+            const matches = typeof endpoint === "string" && typeof provider.baseUrl === "string" &&
+                endpointKey(endpoint) === endpointKey(provider.baseUrl) && row.apiKey === provider.apiKey;
+            if (owned && !matches)
+                throw new Error(`${editor.file}: source provider connection conflicts with the store`);
+            if (!matches || (row.agentswProviderId !== undefined && !owned))
+                return;
+            if (owned)
+                exact(editor, [...at, index, "agentswProviderId"]);
+            if (provider.name === oldId)
                 exact(editor, [...at, index, "vendor"]);
         });
     }, undefined, true);

package/dist/store.js

@@ -1,17 +1,48 @@
 import path from "node:path";
-import { appDataDir, readJsonIfExists, writeFileAtomic } from "./fsutil.js";
+import { appDataDir, isDryRun, readFileSnapshot, recordPendingWrites } from "./fsutil.js";
+import { commitFileChanges } from "./config-transaction.js";
 export const configDir = appDataDir("agentsw");
 export const configFile = path.join(configDir, "config.json");
+const loadedSnapshots = new WeakMap();
 export function loadStore() {
-    const store = readJsonIfExists(configFile);
-    if (!store)
-        return { version: 1, providers: {} };
-    if (!store.providers)
-        store.providers = {};
+    const snapshot = readFileSnapshot(configFile);
+    let store;
+    if (snapshot.text === undefined)
+        store = { version: 1, providers: {} };
+    else {
+        try {
+            store = JSON.parse(snapshot.text);
+        }
+        catch {
+            throw new Error(`${configFile}: invalid provider store JSON`);
+        }
+        if (!store || typeof store !== "object" || Array.isArray(store)) {
+            throw new Error(`${configFile}: expected a provider store object`);
+        }
+        if (store.providers === undefined)
+            store.providers = {};
+        if (!store.providers || typeof store.providers !== "object" || Array.isArray(store.providers)) {
+            throw new Error(`${configFile}: expected a providers object`);
+        }
+    }
+    loadedSnapshots.set(store, snapshot);
     return store;
 }
 export function saveStore(store) {
-    writeFileAtomic(configFile, JSON.stringify(store, null, 2) + "\n", 0o600);
+    // A snapshot stays associated with this object across asynchronous discovery and repeated saves.
+    const expected = loadedSnapshots.get(store) ?? readFileSnapshot(configFile);
+    const after = JSON.stringify(store, null, 2) + "\n";
+    const changes = [{ file: configFile, before: expected.text, after, mode: 0o600, expected }];
+    const dryRun = isDryRun();
+    commitFileChanges(changes, { dryRun });
+    if (dryRun) {
+        recordPendingWrites(changes);
+        return;
+    }
+    const saved = readFileSnapshot(configFile);
+    if (saved.text !== after)
+        throw new Error(`${configFile}: configuration changed during store save`);
+    loadedSnapshots.set(store, saved);
 }
 export function getProvider(store, id) {
     const p = store.providers[id];

package/dist/target-transaction.js

@@ -0,0 +1,25 @@
+import { commitFileChanges } from "./config-transaction.js";
+import { recordPendingWrites, stageFileWrites } from "./fsutil.js";
+const wrappedTargets = new WeakSet();
+/** Validate every adapter input before committing any of its configuration writes. */
+export function transactionalTarget(target) {
+    if (wrappedTargets.has(target))
+        return target;
+    const wrapped = Object.create(Object.getPrototypeOf(target), Object.getOwnPropertyDescriptors(target));
+    for (const method of ["apply", "prune"]) {
+        const operation = target[method];
+        wrapped[method] = async function (provider) {
+            const staged = await stageFileWrites(() => operation.call(this, provider));
+            const committed = commitFileChanges(staged.changes, { dryRun: staged.dryRun, reads: staged.reads });
+            if (staged.dryRun)
+                recordPendingWrites(staged.changes);
+            return {
+                ...staged.result,
+                changed: committed.files,
+                notes: committed.backupDir ? [...staged.result.notes, `backup: ${committed.backupDir}`] : staged.result.notes,
+            };
+        };
+    }
+    wrappedTargets.add(wrapped);
+    return wrapped;
+}

package/dist/targets/claudecode.js

@@ -1,6 +1,8 @@
 import fs from "node:fs";
 import path from "node:path";
 import { backupFile, home, readJsonIfExists, writeFileAtomic } from "../fsutil.js";
+import { isJsonObject } from "../jsonc.js";
+import { transactionalTarget } from "../target-transaction.js";
 import { providerIdFromBaseUrl, providerNameFromBaseUrl } from "../slug.js";
 import { stripApiVersion } from "./wire.js";
 const dir = path.join(home, ".claude");
@@ -9,7 +11,7 @@ const settingsFile = path.join(dir, "settings.json");
  * Claude Code reads Anthropic-protocol endpoints via env vars in ~/.claude/settings.json.
  * We merge the "env" block and leave every other setting untouched.
  */
-export const claudecode = {
+export const claudecode = transactionalTarget({
     id: "claude",
     name: "Claude Code",
     protocols: ["anthropic"],
@@ -17,7 +19,11 @@ export const claudecode = {
     detect: () => fs.existsSync(dir),
     async apply(provider) {
         const notes = [];
-        const settings = readJsonIfExists(settingsFile) ?? {};
+        const settingsValue = readJsonIfExists(settingsFile);
+        const settings = settingsValue === undefined ? {} : settingsValue;
+        if (!isJsonObject(settings) || (settings.env !== undefined && !isJsonObject(settings.env))) {
+            throw new Error(`${settingsFile}: expected settings and env to be JSON objects`);
+        }
         const env = { ...settings.env };
         env.ANTHROPIC_BASE_URL = stripApiVersion(provider.baseUrl);
         env.ANTHROPIC_AUTH_TOKEN = provider.apiKey;
@@ -38,6 +44,9 @@ export const claudecode = {
     },
     async prune(provider) {
         const settings = readJsonIfExists(settingsFile);
+        if (settings !== undefined && (!isJsonObject(settings) || (settings.env !== undefined && !isJsonObject(settings.env)))) {
+            throw new Error(`${settingsFile}: expected settings and env to be JSON objects`);
+        }
         const env = settings?.env;
         if (!settings || !env || env.ANTHROPIC_BASE_URL !== stripApiVersion(provider.baseUrl)) {
             return { app: this.id, changed: [], notes: [], skipped: "claude env does not point at this provider" };
@@ -95,4 +104,4 @@ export const claudecode = {
             },
         ];
     },
-};
+});

package/dist/targets/codex.js

@@ -2,6 +2,8 @@ import fs from "node:fs";
 import path from "node:path";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
 import { backupFile, home, readJsonIfExists, readTextIfExists, writeFileAtomic } from "../fsutil.js";
+import { isJsonObject } from "../jsonc.js";
+import { transactionalTarget } from "../target-transaction.js";
 const dir = path.join(home, ".codex");
 const configFile = path.join(dir, "config.toml");
 const authFile = path.join(dir, "auth.json");
@@ -10,7 +12,7 @@ const authFile = path.join(dir, "auth.json");
  * OpenAI-protocol endpoint; the key ships via ~/.codex/auth.json OPENAI_API_KEY.
  * TOML round-trip via smol-toml preserves data but not comments (backed up first).
  */
-export const codex = {
+export const codex = transactionalTarget({
     id: "codex",
     name: "Codex CLI",
     protocols: ["openai"],
@@ -20,6 +22,13 @@ export const codex = {
         const notes = [];
         const text = readTextIfExists(configFile);
         const config = (text ? parseToml(text) : {});
+        const authValue = readJsonIfExists(authFile);
+        const auth = authValue === undefined ? {} : authValue;
+        if (!isJsonObject(auth))
+            throw new Error(`${authFile}: expected a JSON object`);
+        if (config.model_providers !== undefined && !isJsonObject(config.model_providers)) {
+            throw new Error(`${configFile}: expected model_providers to be a table`);
+        }
         config.model_provider = provider.id;
         config.model = provider.defaultModel;
         const model = provider.models.find((m) => m.id === provider.defaultModel);
@@ -29,7 +38,27 @@ export const codex = {
         // Codex only speaks the OpenAI Responses API (wire_api = "chat" was removed Feb 2026).
         // requires_openai_auth = true makes Codex take the key from auth.json instead of an env var.
         const providers = (config.model_providers ?? {});
+        const previous = providers[provider.id];
+        if (previous !== undefined && !isJsonObject(previous)) {
+            throw new Error(`${configFile}: expected the selected model provider to be a table`);
+        }
+        const kept = { ...previous };
+        for (const key of ["env_key", "env_key_instructions", "experimental_bearer_token"])
+            delete kept[key];
+        for (const key of ["http_headers", "env_http_headers"]) {
+            if (kept[key] === undefined)
+                continue;
+            if (!isJsonObject(kept[key]))
+                throw new Error(`${configFile}: expected ${key} to be a table`);
+            const headers = { ...kept[key] };
+            for (const name of Object.keys(headers)) {
+                if (["authorization", "x-api-key", "api-key"].includes(name.toLowerCase()))
+                    delete headers[name];
+            }
+            kept[key] = headers;
+        }
         providers[provider.id] = {
+            ...kept,
             name: provider.name,
             base_url: provider.baseUrl.replace(/\/$/, ""),
             wire_api: "responses",
@@ -43,7 +72,6 @@ export const codex = {
         if (text?.includes("#"))
             notes.push("config.toml comments are not preserved by TOML round-trip");
         writeFileAtomic(configFile, stringifyToml(config) + "\n");
-        const auth = readJsonIfExists(authFile) ?? {};
         auth.auth_mode = "apikey";
         auth.OPENAI_API_KEY = provider.apiKey;
         const authBackup = backupFile(authFile);
@@ -57,6 +85,9 @@ export const codex = {
         if (!text)
             return { app: this.id, changed: [], notes: [], skipped: "no config.toml" };
         const config = parseToml(text);
+        if (config.model_providers !== undefined && !isJsonObject(config.model_providers)) {
+            throw new Error(`${configFile}: expected model_providers to be a table`);
+        }
         const providers = config.model_providers;
         if (!providers?.[provider.id]) {
             return { app: this.id, changed: [], notes: [], skipped: `no model_providers.${provider.id} entry` };
@@ -133,4 +164,4 @@ export const codex = {
             ];
         });
     },
-};
+});