code-abyss 1.7.6 → 1.7.7

package/README.md

@@ -214,7 +214,7 @@ multi_agent = true
 ### 兼容性说明
 
 - 模板已对齐新版 Codex 配置风格：`[tools].web_search` 与 `[features].multi_agent`
-- 若你本地已有旧配置，安装器不会强制覆盖；会自动做三件事：补齐缺失默认项、清理 removed feature、将 deprecated `web_search_*` 迁移为 `[tools].web_search`
+- 若你本地已有旧配置，安装器不会强制覆盖；会自动补齐 root 默认项（正确写入首段）、清理 removed feature、迁移 deprecated `web_search_*` 到 `[tools].web_search`，并在 `danger-full-access` 下清理 `projects.*.trust_level`
 - 建议在升级后执行一次 `codex --help` / 启动自检，确认无 deprecation warning
 
 ---

package/bin/adapters/codex.js

@@ -4,6 +4,7 @@ const fs = require('fs');
 const path = require('path');
 
 const CODEX_DEFAULTS = {
+  approvalPolicy: 'never',
   sandboxMode: 'danger-full-access',
   featureFlag: 'multi_agent',
 };
@@ -28,9 +29,50 @@ function escapeRegExp(input) {
   return input.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
 
-function hasTopLevelKey(content, key) {
-  const re = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`, 'm');
-  return re.test(content);
+function isTableHeader(line) {
+  return /^\s*\[[^\]]+\]\s*$/.test(line);
+}
+
+function isProjectTableHeader(line) {
+  return /^\s*\[projects\."[^"]+"\]\s*$/.test(line);
+}
+
+function isAssignmentForKey(line, key) {
+  const re = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`);
+  return re.test(line);
+}
+
+function hasRootKey(content, key) {
+  const lines = content.split(/\r?\n/);
+  let inRoot = true;
+
+  for (const line of lines) {
+    if (isTableHeader(line)) {
+      inRoot = false;
+      continue;
+    }
+    if (inRoot && isAssignmentForKey(line, key)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function readRootStringKey(content, key) {
+  const lines = content.split(/\r?\n/);
+  const re = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]*)"`);
+  let inRoot = true;
+
+  for (const line of lines) {
+    if (isTableHeader(line)) {
+      inRoot = false;
+      continue;
+    }
+    if (!inRoot) continue;
+    const m = line.match(re);
+    if (m) return m[1];
+  }
+  return null;
 }
 
 function hasSection(content, sectionName) {
@@ -66,6 +108,20 @@ function appendLine(content, line, eol) {
   return `${normalized}${line}${eol}`;
 }
 
+function insertRootLine(content, line, eol) {
+  if (!content) return `${line}${eol}`;
+  const lines = content.split(/\r?\n/);
+  const firstSection = lines.findIndex((l) => isTableHeader(l));
+  const idx = firstSection === -1 ? lines.length : firstSection;
+  lines.splice(idx, 0, line);
+  return lines.join(eol);
+}
+
+function ensureRootKey(content, key, valueLiteral, eol) {
+  if (hasRootKey(content, key)) return { merged: content, added: false };
+  return { merged: insertRootLine(content, `${key} = ${valueLiteral}`, eol), added: true };
+}
+
 function insertLineAfterSectionHeader(content, sectionName, line, eol) {
   const lines = content.split(/\r?\n/);
   const sectionRe = new RegExp(`^\\s*\\[${escapeRegExp(sectionName)}\\]\\s*$`);
@@ -97,6 +153,59 @@ function parseTomlBooleanAssignment(line) {
   return m[1].toLowerCase() === 'true';
 }
 
+function removeKeyAssignmentsInNonRootSections(content, key) {
+  const eol = content.includes('\r\n') ? '\r\n' : '\n';
+  const lines = content.split(/\r?\n/);
+  const kept = [];
+  let inRoot = true;
+  let removed = false;
+
+  for (const line of lines) {
+    if (isTableHeader(line)) {
+      inRoot = false;
+      kept.push(line);
+      continue;
+    }
+    if (!inRoot && isAssignmentForKey(line, key)) {
+      removed = true;
+      continue;
+    }
+    kept.push(line);
+  }
+
+  return { merged: kept.join(eol), removed };
+}
+
+function removeProjectTrustSectionsForFullAccess(content) {
+  const eol = content.includes('\r\n') ? '\r\n' : '\n';
+  const sandboxMode = readRootStringKey(content, 'sandbox_mode');
+  if (sandboxMode !== CODEX_DEFAULTS.sandboxMode) {
+    return { merged: content, removed: false };
+  }
+
+  const lines = content.split(/\r?\n/);
+  const kept = [];
+  let inProjectSection = false;
+  let removed = false;
+
+  for (const line of lines) {
+    if (isTableHeader(line)) {
+      if (isProjectTableHeader(line)) {
+        inProjectSection = true;
+        removed = true;
+        continue;
+      }
+      inProjectSection = false;
+      kept.push(line);
+      continue;
+    }
+    if (inProjectSection) continue;
+    kept.push(line);
+  }
+
+  return { merged: kept.join(eol), removed };
+}
+
 function removeFeatureFlagsFromFeaturesSection(content, featureNames) {
   const eol = content.includes('\r\n') ? '\r\n' : '\n';
   const lines = content.split(/\r?\n/);
@@ -167,8 +276,28 @@ function mergeCodexConfigDefaults(content) {
   let merged = content;
   const added = [];
 
-  if (!hasTopLevelKey(merged, 'sandbox_mode')) {
-    merged = appendLine(merged, `sandbox_mode = "${CODEX_DEFAULTS.sandboxMode}"`, eol);
+  const rootKeys = [
+    'approval_policy',
+    'sandbox_mode',
+    'model_reasoning_effort',
+    'disable_response_storage',
+    'personality',
+  ];
+
+  for (const key of rootKeys) {
+    const cleaned = removeKeyAssignmentsInNonRootSections(merged, key);
+    merged = cleaned.merged;
+  }
+
+  const approval = ensureRootKey(merged, 'approval_policy', `"${CODEX_DEFAULTS.approvalPolicy}"`, eol);
+  merged = approval.merged;
+  if (approval.added) {
+    added.push('approval_policy');
+  }
+
+  const sandbox = ensureRootKey(merged, 'sandbox_mode', `"${CODEX_DEFAULTS.sandboxMode}"`, eol);
+  merged = sandbox.merged;
+  if (sandbox.added) {
     added.push('sandbox_mode');
   }
 
@@ -187,9 +316,12 @@ function mergeCodexConfigDefaults(content) {
 function patchCodexConfig(cfgPath) {
   const raw = fs.readFileSync(cfgPath, 'utf8');
   const { merged: cleaned, removed, migrated } = cleanupLegacyCodexConfig(raw);
-  const { merged, added } = mergeCodexConfigDefaults(cleaned);
+  const { merged: mergedDefaults, added } = mergeCodexConfigDefaults(cleaned);
+  const { merged, removed: removedProjectTrust } = removeProjectTrustSectionsForFullAccess(mergedDefaults);
+  const removedAll = removedProjectTrust ? [...removed, 'projects.*.trust_level'] : removed;
+
   if (merged !== raw) fs.writeFileSync(cfgPath, merged);
-  return { added, removed, migrated };
+  return { added, removed: removedAll, migrated };
 }
 
 function patchCodexConfigDefaults(cfgPath) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-abyss",
-  "version": "1.7.6",
+  "version": "1.7.7",
   "description": "邪修红尘仙·宿命深渊 - 一键为 Claude Code / Codex CLI 注入邪修人格与安全工程知识体系",
   "keywords": [
     "claude",