cabletidy 0.2.0 → 0.3.0-rc.3

package/src/codex-native-provider.mjs

@@ -1,311 +0,0 @@
-import fs from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { createHash } from "node:crypto";
-
-import {
-  backupFile,
-  normalizeConfig,
-  resolveUpstreamSecret,
-} from "./config.mjs";
-import { configurationId, providerIdForConfiguration, configurationBaseUrl } from "../web/config-identity.js";
-import { resolveModelProfile } from "./model-resolver.mjs";
-import { loadCodexCatalog, planCodexCatalog, validateCatalog } from "./codex-catalog.mjs";
-import { patchRootConfig, patchProviderConfig, readCodexConfig } from "./codex-config-file.mjs";
-
-export const CODEX_NATIVE_PROVIDER_INTEGRATION = "codex-native-provider";
-export const CODEX_TARGET_FORMAT = "codex.config.toml.v1";
-export const CODEX_NATIVE_REQUIRED_ENDPOINTS = Object.freeze([
-  Object.freeze({
-    method: "GET",
-    path: "/v1/models",
-    purpose: "model_discovery",
-  }),
-  Object.freeze({
-    method: "POST",
-    path: "/v1/responses",
-    purpose: "responses",
-    supportsStreaming: true,
-  }),
-]);
-
-const ROOT_BEGIN = "# >>> CABLETIDY MANAGED PROVIDER";
-const ROOT_END = "# <<< CABLETIDY MANAGED PROVIDER";
-const ACTIVE_BEGIN = "# >>> CABLETIDY MANAGED ACTIVE PROVIDER";
-const ACTIVE_END = "# <<< CABLETIDY MANAGED ACTIVE PROVIDER";
-
-function quote(value) {
-  return JSON.stringify(String(value ?? ""));
-}
-
-function providerForBinding(config, binding, virtualProvider) {
-  const route = config.routes?.[virtualProvider?.route];
-  if (route?.backends?.length !== 1) throw new Error("每份配置必须且只能连接一个 upstream");
-  return config.upstreams?.[route.backends[0]?.upstream];
-}
-
-function profilePolicy(profile) {
-  return {
-    contextWindow: Number(profile?.contextWindow || 0) || null,
-    compact: profile?.compact || null,
-  };
-}
-
-export function buildCodexArtifacts(config, options = {}, secrets = {}) {
-  // Collisions can block a chain of renames, so reject them before looking up a new ID.
-  const names = new Set();
-  for (const [id, binding] of Object.entries(config.bindings || {})) {
-    const nameId = configurationId(binding?.name, id);
-    if (names.has(nameId)) throw new Error(`配置名称规范化后重复: ${nameId}`);
-    names.add(nameId);
-  }
-  let bindingId = options.bindingId;
-  const requestedBinding = config.bindings?.[bindingId];
-  config = normalizeConfig(config);
-  if (requestedBinding) bindingId = configurationId(requestedBinding.name, bindingId);
-  if (!bindingId || !config.bindings?.[bindingId]) {
-    bindingId = Object.entries(config.bindings || {}).find(
-      ([id, item]) =>
-        item.target === "codex" &&
-        (!options.bindingId || id === options.bindingId || item.id === options.bindingId),
-    )?.[0];
-  }
-  const binding = bindingId ? config.bindings?.[bindingId] : null;
-  if (!binding) throw new Error("找不到 Codex binding");
-  const virtualProvider = config.virtualProviders?.[binding.virtualProvider];
-  if (!virtualProvider) throw new Error("Binding 引用的 Virtual Provider 不存在");
-  if (virtualProvider.id !== providerIdForConfiguration(bindingId) ||
-      Object.values(config.bindings).filter((item) => item?.virtualProvider === virtualProvider.id).length !== 1) {
-    throw new Error("配置与 Virtual Provider 必须一对一，Virtual Provider ID 必须为 cabletidy_<配置ID>");
-  }
-  if (binding.target !== "codex") {
-    throw new Error(`binding ${bindingId} 不是 Codex target`);
-  }
-  const defaultModel = binding.defaultModel || virtualProvider.defaultModel;
-  const modelResolution = defaultModel ? resolveModelProfile(config, virtualProvider, defaultModel) : null;
-
-  const upstream = providerForBinding(config, binding, virtualProvider);
-  if (!upstream) throw new Error("找不到 binding 对应的 upstream");
-  const providerId = virtualProvider.id;
-  const clientModel =
-    modelResolution?.profile?.clientModelId ||
-    modelResolution?.profile?.aliases?.[0] ||
-    modelResolution?.clientModelId || null;
-  const policy = profilePolicy(modelResolution?.profile);
-  const activeContents = [
-    `${ACTIVE_BEGIN} ${providerId} -->`,
-    `model_provider = ${quote(providerId)}`,
-    ...(clientModel ? [`model = ${quote(clientModel)}`] : []),
-    `${ACTIVE_END} ${providerId} <--`,
-    "",
-  ].join("\n");
-  const providerContents = [
-    `${ROOT_BEGIN} ${providerId} -->`,
-    `[model_providers.${providerId}]`,
-    `name = ${quote(`CableTidy / ${upstream.name || upstream.id}`)}`,
-    `base_url = ${quote(`${configurationBaseUrl(config, bindingId)}/v1`)}`,
-    `wire_api = "responses"`,
-    `requires_openai_auth = false`,
-    `${ROOT_END} ${providerId} <--`,
-    "",
-  ].join("\n");
-  const rootContents = `${activeContents}\n${providerContents}`;
-
-  return {
-    integration: CODEX_NATIVE_PROVIDER_INTEGRATION,
-    targetFormat: CODEX_TARGET_FORMAT,
-    format: CODEX_TARGET_FORMAT,
-    target: "codex",
-    mode: "managed_proxy",
-    bindingId,
-    virtualProviderId: virtualProvider.id,
-    providerId,
-    activeContents,
-    providerContents,
-    clientModelId: clientModel,
-    modelPolicy: policy,
-    files: [{ path: "config.toml", contents: rootContents }],
-    environment: { vars: {}, shell: "" },
-    upstream: {
-      id: upstream.id,
-      baseUrl: upstream.baseUrl,
-      secretConfigured: Boolean(resolveUpstreamSecret(upstream, secrets)),
-    },
-  };
-}
-
-export async function prepareCodexArtifacts(config, options = {}, secrets = {}) {
-  const artifacts = buildCodexArtifacts(config, options, secrets);
-  config = normalizeConfig(config);
-  const provider = config.virtualProviders[config.bindings[artifacts.bindingId].virtualProvider];
-  artifacts.catalogPlan = provider.allowedModels?.length
-    ? planCodexCatalog(config, provider, await (options.loadCatalog || loadCodexCatalog)())
-    : { catalog: null, models: [], overrides: [], warnings: [] };
-  return stageCodexArtifacts(artifacts, options);
-}
-
-const CATALOG_STATE_FILE = ".cabletidy-model-catalog.json";
-
-async function readOptional(file) {
-  try { return await fs.readFile(file, "utf8"); }
-  catch (error) { if (error.code === "ENOENT") return ""; throw error; }
-}
-
-function codexHomeFor(options) {
-  return path.resolve(options.codexHome || process.env.CODEX_HOME || path.join(os.homedir(), ".codex"));
-}
-
-async function stageCodexArtifacts(artifacts, options = {}) {
-  const codexHome = codexHomeFor(options);
-  const existing = await readOptional(path.join(codexHome, "config.toml"));
-  const current = readCodexConfig(existing);
-  const warnings = [...(artifacts.catalogPlan?.warnings || [])];
-  const stateText = await readOptional(path.join(codexHome, CATALOG_STATE_FILE));
-  const saved = stateText ? JSON.parse(stateText) : null;
-  const ownsCatalog = saved?.version === 1 && current.model_catalog_json === saved.managedPath;
-  const previousCatalog = ownsCatalog ? saved.previousCatalog : current.model_catalog_json;
-  const previousContext = ownsCatalog ? current.model_context_window ?? saved.previousContext : current.model_context_window;
-  const rootValues = {
-    model_provider: artifacts.providerId,
-    ...(artifacts.clientModelId ? { model: artifacts.clientModelId } : {}),
-  };
-  const files = [];
-  let catalogState;
-  if (artifacts.catalogPlan?.catalog) {
-    warnings.push("模型目录覆盖作用于当前 Codex 配置，不按 provider 隔离；切换到其他 provider 前需恢复官方定义或原目录。重新启动 Codex 后读取更新。");
-    let catalog = structuredClone(artifacts.catalogPlan.catalog);
-    if (previousCatalog) {
-      if (typeof previousCatalog !== "string") throw new Error("现有 model_catalog_json 必须为路径字符串");
-      const file = path.isAbsolute(previousCatalog) ? previousCatalog : path.resolve(codexHome, previousCatalog);
-      const previous = validateCatalog(JSON.parse(await fs.readFile(file, "utf8")));
-      const replacements = new Map(catalog.models.map((model) => [model.slug, model]));
-      // Preserve foreign entries. Active model entries must keep their
-      // official instructions rather than inheriting arbitrary user prompts.
-      catalog = { ...previous, models: previous.models.map((model) =>
-        artifacts.catalogPlan.models.includes(model.slug) ? replacements.get(model.slug) : model,
-      ) };
-      const present = new Set(catalog.models.map((model) => model.slug));
-      for (const model of replacements.values()) if (!present.has(model.slug)) catalog.models.push(model);
-      warnings.push("已保留原模型目录的其他条目；当前模型的覆盖在 Codex 配置中是全局的，不按 provider 隔离。");
-    }
-    const contents = `${JSON.stringify(catalog, null, 2)}\n`;
-    const digest = createHash("sha256").update(contents).digest("hex").slice(0,24);
-    const relative = `model-catalogs/cabletidy-${digest}.json`;
-    rootValues.model_catalog_json = path.join(codexHome, relative);
-    rootValues.model_context_window = undefined;
-    catalogState = {
-      version: 1,
-      sourceVersion: artifacts.catalogPlan.sourceVersion,
-      managedPath: rootValues.model_catalog_json,
-      previousCatalog,
-      previousContext,
-    };
-    files.push({ path: relative, contents, kind: "json" });
-    if (current.model_context_window !== undefined) warnings.push("将暂时移除根级 model_context_window，使逐模型窗口生效；返回官方默认模式时恢复。");
-  } else if (ownsCatalog) {
-    rootValues.model_catalog_json = previousCatalog;
-    // Do not discard a root override the user added after our last apply.
-    if (current.model_context_window === undefined) rootValues.model_context_window = previousContext;
-    catalogState = null;
-  }
-  for (const key of ["model_instructions_file", "model_auto_compact_token_limit", "model_supports_reasoning_summaries"]) {
-    if (current[key] !== undefined) warnings.push(`保留现有 ${key}，该用户配置仍会影响 Codex 行为。`);
-  }
-  if (!artifacts.catalogPlan?.catalog && previousCatalog) warnings.push("保留现有 model_catalog_json；Codex 将继续使用用户的模型目录。");
-  if (!artifacts.catalogPlan?.catalog && previousContext !== undefined) warnings.push("保留现有 model_context_window，它会覆盖模型目录中的上下文窗口。");
-  let root = patchRootConfig(existing, rootValues);
-  root = patchProviderConfig(root, artifacts.providerId, artifacts.providerContents);
-  return {
-    ...artifacts,
-    codexHome,
-    rootBefore: existing,
-    catalogState,
-    warnings: [...new Set(warnings)],
-    catalogSummary: artifacts.catalogPlan ? {
-      sourceVersion: artifacts.catalogPlan.sourceVersion,
-      mode: artifacts.catalogPlan.catalog ? "managed" : "official",
-      overrides: artifacts.catalogPlan.overrides,
-    } : undefined,
-    files: [{ path: "config.toml", contents: `${root.trimEnd()}\n` }, ...files],
-  };
-}
-
-function safeRelativePath(value) {
-  const normalized = String(value || "").replaceAll("\\", "/");
-  if (
-    !normalized ||
-    normalized === "." ||
-    normalized.startsWith("/") ||
-    /^[a-zA-Z]:\//.test(normalized) ||
-    normalized.includes("\0") ||
-    normalized.split("/").includes("..")
-  ) {
-    throw new Error(`Codex artifact 文件路径不安全: ${value}`);
-  }
-  return normalized;
-}
-
-async function writeArtifact(file, contents, paths, label) {
-  await fs.mkdir(path.dirname(file), { recursive: true });
-  await backupFile(file, paths.backups, label);
-  const temporary = `${file}.${process.pid}.tmp`;
-  await fs.writeFile(temporary, contents, { mode: 0o600 });
-  await fs.rename(temporary, file);
-}
-
-let applyOperation = Promise.resolve();
-
-export function applyCodexArtifacts(artifacts, options = {}) {
-  const operation = applyOperation.then(() => applyCodexArtifactsNow(artifacts, options));
-  applyOperation = operation.catch(() => {});
-  return operation;
-}
-
-async function applyCodexArtifactsNow(artifacts, options = {}) {
-  if (!artifacts?.activeContents || !artifacts.providerContents || !artifacts.providerId) {
-    throw new Error("Unsupported Codex artifacts: expected a generated provider configuration");
-  }
-  const staged = await stageCodexArtifacts(artifacts, options);
-  const paths = options.paths || { backups: path.join(os.homedir(), ".cabletidy", "backups") };
-  await fs.mkdir(paths.backups, { recursive: true, mode: 0o700 });
-  await fs.mkdir(staged.codexHome, { recursive: true, mode: 0o700 });
-  const rootFile = path.join(staged.codexHome, "config.toml");
-  const stateFile = path.join(staged.codexHome, CATALOG_STATE_FILE);
-  const previousState = await readOptional(stateFile);
-  const applied = [];
-  // Content-addressed catalogs are written first, so a failed config write
-  // never changes the catalog used by the previous configuration.
-  for (const file of staged.files.slice(1)) {
-    const target = path.join(staged.codexHome, safeRelativePath(file.path));
-    await writeArtifact(target, file.contents, paths, "codex-model-catalog.json");
-    applied.push(target);
-  }
-  if (await readOptional(rootFile) !== staged.rootBefore) {
-    throw new Error("Codex 配置在应用期间已改变，请重新预览并重试");
-  }
-  try {
-    if (staged.catalogState !== undefined) {
-      await writeArtifact(stateFile, `${JSON.stringify(staged.catalogState)}\n`, paths, "codex-catalog-state.json");
-    }
-    await writeArtifact(rootFile, staged.files[0].contents, paths, "codex-config.toml");
-  } catch (error) {
-    if (staged.catalogState !== undefined) {
-      if (previousState) await fs.writeFile(stateFile, previousState, { mode: 0o600 });
-      else await fs.unlink(stateFile).catch(() => {});
-    }
-    throw error;
-  }
-  applied.unshift(rootFile);
-  return { applied, environment: staged.environment, mode: staged.mode, warnings: staged.warnings, catalogSummary: staged.catalogSummary };
-}
-
-export function publicArtifacts(artifacts) {
-  const { catalogPlan, catalogState, rootBefore, codexHome, ...publicValues } = artifacts;
-  return {
-    ...publicValues,
-    environment: {
-      vars: artifacts.environment?.vars || {},
-      shell: artifacts.environment?.shell || "",
-    },
-  };
-}

package/src/config.mjs

@@ -1,341 +0,0 @@
-import crypto from "node:crypto";
-import fs from "node:fs/promises";
-import { setTimeout as delay } from "node:timers/promises";
-import os from "node:os";
-import path from "node:path";
-import { normalizeConfigurationIdentities } from "../web/config-identity.js";
-
-const DEFAULT_HOME = process.env.CABLETIDY_HOME || path.join(os.homedir(), ".cabletidy");
-const SECRET_FIELD_NAMES = new Set([
-  "secret",
-  "apiKey",
-  "api_key",
-  "token",
-  "accessToken",
-  "access_token",
-  "refreshToken",
-  "refresh_token",
-  "clientSecret",
-  "client_secret",
-  "password",
-  "privateKey",
-  "private_key",
-]);
-
-export function getPaths(home = DEFAULT_HOME) {
-  return {
-    home,
-    config: path.join(home, "config.json"),
-    secrets: path.join(home, "secrets.json"),
-    runtime: path.join(home, "runtime.json"),
-    lock: path.join(home, "daemon.lock"),
-    backups: path.join(home, "backups"),
-  };
-}
-
-export function defaultConfig() {
-  return {
-    version: 1,
-    revision: 0,
-    daemon: {},
-    web: {
-      listenHost: "127.0.0.1",
-      port: 43100,
-    },
-    upstreams: {},
-    models: {},
-    routes: {},
-    virtualProviders: {},
-    bindings: {},
-  };
-}
-
-function isRecord(value) {
-  return value && typeof value === "object" && !Array.isArray(value);
-}
-
-function mergeRecord(base, value) {
-  if (!isRecord(value)) return base;
-  for (const [key, item] of Object.entries(value)) {
-    if (isRecord(item) && isRecord(base[key])) {
-      mergeRecord(base[key], item);
-    } else {
-      base[key] = item;
-    }
-  }
-  return base;
-}
-
-export function normalizeConfig(input = {}) {
-  const config = mergeRecord(defaultConfig(), structuredClone(input));
-  config.version = Number(config.version) || 1;
-  config.revision = Number(config.revision) || 0;
-  for (const key of ["upstreams", "models", "routes", "virtualProviders", "bindings"]) {
-    if (!isRecord(config[key])) config[key] = {};
-  }
-  // The Web console is a loopback-only local control surface; old session
-  // lifetime settings are no longer part of the effective configuration.
-  delete config.web.sessionTtlSeconds;
-  if (isRecord(config.daemon)) delete config.daemon.proxyPortRange;
-  discardObsoleteCodexFields(config);
-  for (const provider of Object.values(config.virtualProviders)) {
-    if (isRecord(provider)) {
-      delete provider.localAuth;
-      delete provider.listenHost;
-      delete provider.listenPort;
-    }
-  }
-  for (const binding of Object.values(config.bindings)) {
-    if (isRecord(binding?.codex)) delete binding.codex.localEnvKey;
-    if (isRecord(binding?.claude)) delete binding.claude.authEnv;
-  }
-  normalizeConfigurationIdentities(config);
-  return config;
-}
-
-function discardObsoleteCodexFields(config) {
-  for (const upstream of Object.values(config.upstreams)) {
-    if (!isRecord(upstream)) continue;
-    // These policy placeholders never affected runtime behavior.
-    for (const field of ["requestMaxRetries", "streamMaxRetries", "streamIdleTimeoutMs", "requiresOpenaiAuth", "supportsWebsockets"]) {
-      delete upstream[field];
-    }
-    delete upstream.envKey;
-    delete upstream.codexNative;
-    delete upstream.providerFormat;
-    delete upstream.codexToml;
-  }
-
-  for (const model of Object.values(config.models)) {
-    if (!isRecord(model)) continue;
-    // Prototype metadata is discarded, never promoted into current fields.
-    delete model.legacyCodex;
-    if (isRecord(model.targetOverrides)) {
-      delete model.targetOverrides.codex;
-      if (Object.keys(model.targetOverrides).length === 0) delete model.targetOverrides;
-    }
-    // Reasoning effort is selected by the CLI request, not fixed on a model.
-    delete model.reasoning;
-  }
-
-  for (const binding of Object.values(config.bindings)) {
-    if (!isRecord(binding)) continue;
-    delete binding.providerFormat;
-    if (isRecord(binding.codex)) {
-      for (const key of ["profileFiles", "sourceUpstream", "sourceProviderId"]) {
-        delete binding.codex[key];
-      }
-      delete binding.codex.providerId;
-    }
-    delete binding.legacyCodex;
-  }
-}
-
-export function publicConfig(config) {
-  const copy = normalizeConfig(config);
-  redactSecretFields(copy);
-  return copy;
-}
-
-export function stripSecretFields(value) {
-  const copy = structuredClone(value);
-  redactSecretFields(copy);
-  return copy;
-}
-
-export async function ensureStore(paths = getPaths()) {
-  await fs.mkdir(paths.home, { recursive: true, mode: 0o700 });
-  await fs.mkdir(paths.backups, { recursive: true, mode: 0o700 });
-}
-
-export async function loadConfig(paths = getPaths()) {
-  try {
-    const raw = await fs.readFile(paths.config, "utf8");
-    return normalizeConfig(JSON.parse(raw));
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-}
-
-export async function loadSecrets(paths = getPaths()) {
-  try {
-    const raw = await fs.readFile(paths.secrets, "utf8");
-    const parsed = JSON.parse(raw);
-    return isRecord(parsed) ? parsed : {};
-  } catch (error) {
-    if (error.code === "ENOENT") return {};
-    throw error;
-  }
-}
-
-export async function writeJsonAtomic(file, value, mode = 0o600) {
-  const directory = path.dirname(file);
-  await fs.mkdir(directory, { recursive: true, mode: 0o700 });
-  const temporary = `${file}.${process.pid}.${crypto.randomBytes(6).toString("hex")}.tmp`;
-  try {
-    await fs.writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode });
-    await fs.chmod(temporary, mode);
-    const deadline = Date.now() + 1000;
-    while (true) {
-      try {
-        await fs.rename(temporary, file);
-        return;
-      } catch (error) {
-        // Windows readers and antivirus can briefly deny an atomic replacement.
-        if (!["EPERM", "EACCES", "EBUSY"].includes(error.code) || Date.now() >= deadline) throw error;
-        await delay(50);
-      }
-    }
-  } finally {
-    await fs.rm(temporary, { force: true }).catch(() => {});
-  }
-}
-
-export async function saveConfig(config, paths = getPaths()) {
-  await writeJsonAtomic(paths.config, normalizeConfig(config), 0o600);
-}
-
-export async function saveSecrets(secrets, paths = getPaths()) {
-  await writeJsonAtomic(paths.secrets, secrets, 0o600);
-}
-
-export async function backupFile(file, backupsDirectory, label) {
-  let contents;
-  try {
-    contents = await fs.readFile(file);
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-  const stamp = new Date().toISOString().replaceAll(":", "-").replaceAll(".", "-");
-  const backup = path.join(backupsDirectory, `${stamp}-${label}`);
-  await fs.writeFile(backup, contents, { mode: 0o600 });
-  return backup;
-}
-
-export function secretRefForUpstream(id) {
-  return `secret://upstreams/${id}`;
-}
-
-export function resolveSecret(reference, secrets = {}) {
-  if (typeof reference !== "string" || !reference) return "";
-  return secrets[reference] || "";
-}
-
-export function resolveUpstreamSecret(upstream, secrets = {}) {
-  return resolveSecret(upstream?.secretRef, secrets);
-}
-
-export function applySecretPayload(config, secrets, payload = {}) {
-  const nextSecrets = { ...secrets };
-  const upstreamSecrets = isRecord(payload.upstreamSecrets) ? payload.upstreamSecrets : {};
-  for (const [id, value] of Object.entries(upstreamSecrets)) {
-    if (typeof value !== "string" || !value.trim()) continue;
-    const upstream = config.upstreams[id];
-    if (!upstream) continue;
-    upstream.secretRef ||= secretRefForUpstream(id);
-    nextSecrets[upstream.secretRef] = value.trim();
-  }
-  return nextSecrets;
-}
-
-export async function writeRuntimeInfo(info, paths = getPaths()) {
-  await writeJsonAtomic(paths.runtime, info, 0o600);
-}
-
-export async function readRuntimeInfo(paths = getPaths()) {
-  try {
-    return JSON.parse(await fs.readFile(paths.runtime, "utf8"));
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-}
-
-/**
- * Return a redacted, path-oriented view of the effective configuration change.
- * Secrets are not part of config, and revision is metadata rather than behavior.
- */
-export function computeConfigDiff(beforeInput = {}, afterInput = {}) {
-  const before = normalizeConfig(beforeInput);
-  const after = normalizeConfig(afterInput);
-  const added = [];
-  const removed = [];
-  const changed = [];
-
-  diffValues(before, after, "", { added, removed, changed });
-
-  const roots = new Set(
-    [...added, ...removed, ...changed]
-      .map((item) => item.path.split(".")[0])
-      .filter(Boolean),
-  );
-  return {
-    added,
-    removed,
-    changed,
-    total: added.length + removed.length + changed.length,
-    affected: [...roots],
-  };
-}
-
-function diffValues(before, after, currentPath, output) {
-  if (currentPath === "revision") return;
-
-  if (before === undefined) {
-    output.added.push({ path: currentPath, value: after });
-    return;
-  }
-  if (after === undefined) {
-    output.removed.push({ path: currentPath, value: before });
-    return;
-  }
-
-  if (isRecord(before) && isRecord(after)) {
-    const keys = new Set([...Object.keys(before), ...Object.keys(after)]);
-    for (const key of [...keys].sort()) {
-      diffValues(
-        before[key],
-        after[key],
-        currentPath ? `${currentPath}.${key}` : key,
-        output,
-      );
-    }
-    return;
-  }
-
-  if (!sameValue(before, after)) {
-    output.changed.push({ path: currentPath, before, after });
-  }
-}
-
-function redactSecretFields(value) {
-  if (Array.isArray(value)) {
-    for (const item of value) redactSecretFields(item);
-    return;
-  }
-  if (!isRecord(value)) return;
-  for (const [key, item] of Object.entries(value)) {
-    if (SECRET_FIELD_NAMES.has(key)) {
-      delete value[key];
-      continue;
-    }
-    redactSecretFields(item);
-  }
-}
-
-function sameValue(left, right) {
-  if (Object.is(left, right)) return true;
-  if (Array.isArray(left) && Array.isArray(right)) {
-    if (left.length !== right.length) return false;
-    return left.every((value, index) => sameValue(value, right[index]));
-  }
-  if (isRecord(left) && isRecord(right)) {
-    const leftKeys = Object.keys(left);
-    const rightKeys = Object.keys(right);
-    if (leftKeys.length !== rightKeys.length) return false;
-    return leftKeys.every((key) => Object.hasOwn(right, key) && sameValue(left[key], right[key]));
-  }
-  return false;
-}