code-abyss 1.7.6 → 1.8.0

package/README.md

@@ -111,8 +111,8 @@ Code Abyss 是一套 **Claude Code / Codex CLI 个性化配置包**，一条命
 ```
 ~/.claude/（Claude Code）          ~/.codex/（Codex CLI）
 ├── CLAUDE.md          道典        ├── AGENTS.md      道典+风格
-├── output-styles/     输出风格    ├── settings.json
-│   └── abyss-cultivator.md       └── skills/        56 篇秘典
+├── output-styles/     输出风格    ├── config.toml    推荐配置
+│   └── abyss-cultivator.md       ├── prompts/       custom prompts
 ├── settings.json
 └── skills/            56 篇秘典
 
@@ -187,15 +187,19 @@ Code Abyss 是一套 **Claude Code / Codex CLI 个性化配置包**，一条命
 
 ### Codex `config.toml` 推荐模板
 
-安装 `--target codex`（尤其 `-y`）时会写入以下模板到 `~/.codex/config.toml`：
+安装 `--target codex`（尤其 `-y`）时会写入以下 **safe 默认档** 到 `~/.codex/config.toml`：
 
 ```toml
 model_provider = "custom"
 model = "gpt-5.2-codex"
 model_reasoning_effort = "high"
+approval_policy = "on-request"
+sandbox_mode = "workspace-write"
+disable_response_storage = true
+
+[profiles.full_access]
 approval_policy = "never"
 sandbox_mode = "danger-full-access"
-disable_response_storage = true
 
 [model_providers.custom]
 name = "custom"
@@ -210,12 +214,16 @@ web_search = true
 multi_agent = true
 ```
 
+- 日常交互默认使用 `on-request + workspace-write`，更贴近当前 Codex CLI 的低摩擦安全姿态
+- 需要高自动化时可显式切到 `full_access`：`codex -p full_access`
 
 ### 兼容性说明
 
-- 模板已对齐新版 Codex 配置风格：`[tools].web_search` 与 `[features].multi_agent`
-- 若你本地已有旧配置，安装器不会强制覆盖；会自动做三件事：补齐缺失默认项、清理 removed feature、将 deprecated `web_search_*` 迁移为 `[tools].web_search`
-- 建议在升级后执行一次 `codex --help` / 启动自检，确认无 deprecation warning
+- 模板已对齐新版 Codex 配置风格：root keys、`[profiles.*]`、`[tools].web_search` 与 `[features].multi_agent`
+- `Codex` 当前支持 `~/.codex/prompts/*.md` 作为 custom prompts；Code Abyss 会继续安装 `~/.codex/skills/`，并从 `user-invocable` skills 自动生成对应的 `prompts/`
+- 安装器不会再为 Codex 写入伪配置 `~/.codex/settings.json`；若检测到旧版遗留文件，会在安装时备份后移除，卸载时恢复
+- 若你本地已有旧配置，安装器不会强制覆盖；会自动补齐 safe root 默认项、清理 removed feature、迁移 deprecated `web_search_*` 到 `[tools].web_search`，并仅在 `danger-full-access` 下清理 `projects.*.trust_level`
+- 建议升级后执行一次 `codex --help`，或用 `codex -p full_access --help` 校验 profile 可见性
 
 ---
 
@@ -228,7 +236,7 @@ multi_agent = true
 - `bin/lib/ccline.js`：Claude 侧状态栏与 ccline 集成
 - `bin/adapters/codex.js`：Codex 侧认证检测、核心文件映射、config 模板流程
 
-当前 Claude/Codex 安装映射分别由 `getClaudeCoreFiles()` 与 `getCodexCoreFiles()` 提供，避免在主流程硬编码目标细节。
+当前 Claude/Codex 安装映射分别由 `getClaudeCoreFiles()` 与 `getCodexCoreFiles()` 提供；Claude 额外生成 `commands/`，Codex 保持 `skills/ + config.toml` 的官方主路径，避免在主流程硬编码目标细节。
 
 ---
 

package/bin/adapters/codex.js

@@ -4,7 +4,8 @@ const fs = require('fs');
 const path = require('path');
 
 const CODEX_DEFAULTS = {
-  sandboxMode: 'danger-full-access',
+  approvalPolicy: 'on-request',
+  sandboxMode: 'workspace-write',
   featureFlag: 'multi_agent',
 };
 
@@ -28,9 +29,50 @@ function escapeRegExp(input) {
   return input.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
 
-function hasTopLevelKey(content, key) {
-  const re = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`, 'm');
-  return re.test(content);
+function isTableHeader(line) {
+  return /^\s*\[[^\]]+\]\s*$/.test(line);
+}
+
+function isProjectTableHeader(line) {
+  return /^\s*\[projects\."[^"]+"\]\s*$/.test(line);
+}
+
+function isAssignmentForKey(line, key) {
+  const re = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`);
+  return re.test(line);
+}
+
+function hasRootKey(content, key) {
+  const lines = content.split(/\r?\n/);
+  let inRoot = true;
+
+  for (const line of lines) {
+    if (isTableHeader(line)) {
+      inRoot = false;
+      continue;
+    }
+    if (inRoot && isAssignmentForKey(line, key)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function readRootStringKey(content, key) {
+  const lines = content.split(/\r?\n/);
+  const re = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]*)"`);
+  let inRoot = true;
+
+  for (const line of lines) {
+    if (isTableHeader(line)) {
+      inRoot = false;
+      continue;
+    }
+    if (!inRoot) continue;
+    const m = line.match(re);
+    if (m) return m[1];
+  }
+  return null;
 }
 
 function hasSection(content, sectionName) {
@@ -66,6 +108,20 @@ function appendLine(content, line, eol) {
   return `${normalized}${line}${eol}`;
 }
 
+function insertRootLine(content, line, eol) {
+  if (!content) return `${line}${eol}`;
+  const lines = content.split(/\r?\n/);
+  const firstSection = lines.findIndex((l) => isTableHeader(l));
+  const idx = firstSection === -1 ? lines.length : firstSection;
+  lines.splice(idx, 0, line);
+  return lines.join(eol);
+}
+
+function ensureRootKey(content, key, valueLiteral, eol) {
+  if (hasRootKey(content, key)) return { merged: content, added: false };
+  return { merged: insertRootLine(content, `${key} = ${valueLiteral}`, eol), added: true };
+}
+
 function insertLineAfterSectionHeader(content, sectionName, line, eol) {
   const lines = content.split(/\r?\n/);
   const sectionRe = new RegExp(`^\\s*\\[${escapeRegExp(sectionName)}\\]\\s*$`);
@@ -97,6 +153,59 @@ function parseTomlBooleanAssignment(line) {
   return m[1].toLowerCase() === 'true';
 }
 
+function removeKeyAssignmentsInNonRootSections(content, key) {
+  const eol = content.includes('\r\n') ? '\r\n' : '\n';
+  const lines = content.split(/\r?\n/);
+  const kept = [];
+  let inRoot = true;
+  let removed = false;
+
+  for (const line of lines) {
+    if (isTableHeader(line)) {
+      inRoot = false;
+      kept.push(line);
+      continue;
+    }
+    if (!inRoot && isAssignmentForKey(line, key)) {
+      removed = true;
+      continue;
+    }
+    kept.push(line);
+  }
+
+  return { merged: kept.join(eol), removed };
+}
+
+function removeProjectTrustSectionsForFullAccess(content) {
+  const eol = content.includes('\r\n') ? '\r\n' : '\n';
+  const sandboxMode = readRootStringKey(content, 'sandbox_mode');
+  if (sandboxMode !== 'danger-full-access') {
+    return { merged: content, removed: false };
+  }
+
+  const lines = content.split(/\r?\n/);
+  const kept = [];
+  let inProjectSection = false;
+  let removed = false;
+
+  for (const line of lines) {
+    if (isTableHeader(line)) {
+      if (isProjectTableHeader(line)) {
+        inProjectSection = true;
+        removed = true;
+        continue;
+      }
+      inProjectSection = false;
+      kept.push(line);
+      continue;
+    }
+    if (inProjectSection) continue;
+    kept.push(line);
+  }
+
+  return { merged: kept.join(eol), removed };
+}
+
 function removeFeatureFlagsFromFeaturesSection(content, featureNames) {
   const eol = content.includes('\r\n') ? '\r\n' : '\n';
   const lines = content.split(/\r?\n/);
@@ -167,8 +276,28 @@ function mergeCodexConfigDefaults(content) {
   let merged = content;
   const added = [];
 
-  if (!hasTopLevelKey(merged, 'sandbox_mode')) {
-    merged = appendLine(merged, `sandbox_mode = "${CODEX_DEFAULTS.sandboxMode}"`, eol);
+  const rootKeys = [
+    'approval_policy',
+    'sandbox_mode',
+    'model_reasoning_effort',
+    'disable_response_storage',
+    'personality',
+  ];
+
+  for (const key of rootKeys) {
+    const cleaned = removeKeyAssignmentsInNonRootSections(merged, key);
+    merged = cleaned.merged;
+  }
+
+  const approval = ensureRootKey(merged, 'approval_policy', `"${CODEX_DEFAULTS.approvalPolicy}"`, eol);
+  merged = approval.merged;
+  if (approval.added) {
+    added.push('approval_policy');
+  }
+
+  const sandbox = ensureRootKey(merged, 'sandbox_mode', `"${CODEX_DEFAULTS.sandboxMode}"`, eol);
+  merged = sandbox.merged;
+  if (sandbox.added) {
     added.push('sandbox_mode');
   }
 
@@ -187,9 +316,12 @@ function mergeCodexConfigDefaults(content) {
 function patchCodexConfig(cfgPath) {
   const raw = fs.readFileSync(cfgPath, 'utf8');
   const { merged: cleaned, removed, migrated } = cleanupLegacyCodexConfig(raw);
-  const { merged, added } = mergeCodexConfigDefaults(cleaned);
+  const { merged: mergedDefaults, added } = mergeCodexConfigDefaults(cleaned);
+  const { merged, removed: removedProjectTrust } = removeProjectTrustSectionsForFullAccess(mergedDefaults);
+  const removedAll = removedProjectTrust ? [...removed, 'projects.*.trust_level'] : removed;
+
   if (merged !== raw) fs.writeFileSync(cfgPath, merged);
-  return { added, removed, migrated };
+  return { added, removed: removedAll, migrated };
 }
 
 function patchCodexConfigDefaults(cfgPath) {

package/bin/install.js

@@ -186,92 +186,154 @@ function scanInvocableSkills(skillsDir) {
   return results;
 }
 
-/**
- * 根据 SKILL.md 元数据生成 command .md 内容
- *
- * 设计原则：
- * - 读取 SKILL.md + 执行脚本合并为一气呵成的指令流
- * - 禁止「先…然后…」的分步模式，避免 Claude 在步骤间停顿
- * - 无脚本的 skill：仅读取 SKILL.md 作为知识库提供指导
- *
- * @param {Object} meta - parseFrontmatter 返回的元数据
- * @param {string} skillRelPath - 相对于 skills/ 的路径（如 'tools/gen-docs'）
- * @param {boolean} hasScripts - 是否有可执行脚本
- * @returns {string} command .md 文件内容
- */
-function generateCommandContent(meta, skillRelPath, hasScripts) {
-  const name = meta.name;
+const INVOCABLE_TARGETS = {
+  claude: {
+    dir: 'commands',
+    label: '斜杠命令',
+    skillRoot: '~/.claude/skills',
+  },
+  codex: {
+    dir: 'prompts',
+    label: 'custom prompts',
+    skillRoot: '~/.codex/skills',
+  },
+};
+
+function getInvocableTarget(targetName) {
+  const targetCfg = INVOCABLE_TARGETS[targetName];
+  if (!targetCfg) throw new Error(`不支持的 invocable target: ${targetName}`);
+  return targetCfg;
+}
+
+function getSkillPath(skillRoot, skillRelPath) {
+  return skillRelPath
+    ? `${skillRoot}/${skillRelPath}/SKILL.md`
+    : `${skillRoot}/SKILL.md`;
+}
+
+function buildCommandFrontmatter(meta) {
   const desc = (meta.description || '').replace(/"/g, '\\"');
   const argHint = meta['argument-hint'];
   const tools = meta['allowed-tools'] || 'Read';
-  const skillPath = skillRelPath
-    ? `~/.claude/skills/${skillRelPath}/SKILL.md`
-    : '~/.claude/skills/SKILL.md';
-
-  const lines = [
-    '---',
-    `name: ${name}`,
-    `description: "${desc}"`,
-  ];
+  const lines = ['---', `name: ${meta.name}`, `description: "${desc}"`];
+
   if (argHint) lines.push(`argument-hint: "${argHint}"`);
   lines.push(`allowed-tools: ${tools}`);
-  lines.push('---');
-  lines.push('');
+  lines.push('---', '');
+  return lines;
+}
 
+function buildClaudeBody(skillPath, meta, hasScripts) {
+  const lines = [];
   if (hasScripts) {
-    // ── 有脚本的 skill：读取规范 + 执行脚本，一气呵成 ──
-    lines.push('以下所有步骤一气呵成，不要在步骤间停顿等待用户输入：');
-    lines.push('');
+    lines.push('以下所有步骤一气呵成，不要在步骤间停顿等待用户输入：', '');
     lines.push(`1. 读取规范：${skillPath}`);
-    lines.push(`2. 执行命令：\`node ~/.claude/skills/run_skill.js ${name} $ARGUMENTS\``);
-    lines.push('3. 按规范分析输出，完成后续动作');
-    lines.push('');
+    lines.push(`2. 执行命令：\`node ~/.claude/skills/run_skill.js ${meta.name} $ARGUMENTS\``);
+    lines.push('3. 按规范分析输出，完成后续动作', '');
     lines.push('全程不要停顿，不要询问是否继续。');
-  } else {
-    // ── 无脚本的 skill：知识库模式 ──
-    lines.push('读取以下秘典，根据内容为用户提供专业指导：');
-    lines.push('');
-    lines.push('```');
-    lines.push(skillPath);
-    lines.push('```');
+    return lines;
   }
 
-  lines.push('');
-  return lines.join('\n');
+  lines.push('读取以下秘典，根据内容为用户提供专业指导：', '');
+  lines.push('```', skillPath, '```');
+  return lines;
 }
 
-/**
- * 扫描 skills 并为 user-invocable 的 skill 生成 command 包装，文件级合并安装
- */
-function installGeneratedCommands(skillsSrcDir, targetDir, backupDir, manifest) {
+function buildCodexPromptBody(skillPath, meta, hasScripts) {
+  const lines = [];
+  if (meta['argument-hint']) lines.push(`Arguments: ${meta['argument-hint']}`, '');
+  lines.push(`Read \`${skillPath}\` before acting.`, '');
+  if (hasScripts) {
+    lines.push(`Then run \`node ~/.codex/skills/run_skill.js ${meta.name} $ARGUMENTS\`.`);
+    lines.push('Do not stop between steps unless blocked by permissions or missing required inputs.');
+    lines.push('Use the skill guidance plus script output to complete the task end-to-end.');
+    return lines;
+  }
+
+  lines.push('Use that skill as the authoritative playbook for the task.');
+  lines.push('Respond with concrete actions instead of generic advice.');
+  return lines;
+}
+
+function generateInvocableContent(meta, skillRelPath, hasScripts, targetName) {
+  const targetCfg = getInvocableTarget(targetName);
+  const skillPath = getSkillPath(targetCfg.skillRoot, skillRelPath);
+  const lines = targetName === 'claude' ? buildCommandFrontmatter(meta) : [];
+  const body = targetName === 'claude'
+    ? buildClaudeBody(skillPath, meta, hasScripts)
+    : buildCodexPromptBody(skillPath, meta, hasScripts);
+  return [...lines, ...body, ''].join('\n');
+}
+
+function generateCommandContent(meta, skillRelPath, hasScripts) {
+  return generateInvocableContent(meta, skillRelPath, hasScripts, 'claude');
+}
+
+function generatePromptContent(meta, skillRelPath, hasScripts) {
+  return generateInvocableContent(meta, skillRelPath, hasScripts, 'codex');
+}
+
+function installGeneratedArtifacts(skillsSrcDir, targetDir, backupDir, manifest, targetName) {
   const skills = scanInvocableSkills(skillsSrcDir);
   if (skills.length === 0) return 0;
 
-  const cmdsDir = path.join(targetDir, 'commands');
-  fs.mkdirSync(cmdsDir, { recursive: true });
+  const targetCfg = getInvocableTarget(targetName);
+  const installDir = path.join(targetDir, targetCfg.dir);
+  fs.mkdirSync(installDir, { recursive: true });
 
   skills.forEach(({ meta, relPath, hasScripts }) => {
     const fileName = `${meta.name}.md`;
-    const destFile = path.join(cmdsDir, fileName);
-    const relFile = path.posix.join('commands', fileName);
+    const destFile = path.join(installDir, fileName);
+    const relFile = path.posix.join(targetCfg.dir, fileName);
 
     if (fs.existsSync(destFile)) {
-      const cmdsBackupDir = path.join(backupDir, 'commands');
-      fs.mkdirSync(cmdsBackupDir, { recursive: true });
-      fs.copyFileSync(destFile, path.join(cmdsBackupDir, fileName));
+      const backupSubdir = path.join(backupDir, targetCfg.dir);
+      fs.mkdirSync(backupSubdir, { recursive: true });
+      fs.copyFileSync(destFile, path.join(backupSubdir, fileName));
       manifest.backups.push(relFile);
       info(`备份: ${c.d(relFile)}`);
     }
 
-    const content = generateCommandContent(meta, relPath, hasScripts);
+    const content = generateInvocableContent(meta, relPath, hasScripts, targetName);
     fs.writeFileSync(destFile, content);
     manifest.installed.push(relFile);
   });
 
-  ok(`commands/ ${c.d(`(自动生成 ${skills.length} 个斜杠命令)`)}`);
+  ok(`${targetCfg.dir}/ ${c.d(`(自动生成 ${skills.length} 个 ${targetCfg.label})`)}`);
   return skills.length;
 }
 
+function installGeneratedCommands(skillsSrcDir, targetDir, backupDir, manifest) {
+  return installGeneratedArtifacts(skillsSrcDir, targetDir, backupDir, manifest, 'claude');
+}
+
+function installGeneratedPrompts(skillsSrcDir, targetDir, backupDir, manifest) {
+  return installGeneratedArtifacts(skillsSrcDir, targetDir, backupDir, manifest, 'codex');
+}
+
+function backupPathIfExists(targetDir, backupDir, relPath, manifest) {
+  const targetPath = path.join(targetDir, relPath);
+  if (!fs.existsSync(targetPath)) return false;
+
+  const backupPath = path.join(backupDir, relPath);
+  rmSafe(backupPath);
+  copyRecursive(targetPath, backupPath);
+  manifest.backups.push(relPath);
+  info(`备份: ${c.d(relPath)}`);
+  return true;
+}
+
+function pruneLegacyCodexSettings(targetDir, backupDir, manifest) {
+  const relPath = 'settings.json';
+  const settingsPath = path.join(targetDir, relPath);
+  if (!fs.existsSync(settingsPath)) return null;
+
+  backupPathIfExists(targetDir, backupDir, relPath, manifest);
+  rmSafe(settingsPath);
+  warn('移除 legacy settings.json（Codex 已改用 config.toml）');
+  return settingsPath;
+}
+
 function installCore(tgt) {
   const targetDir = path.join(HOME, `.${tgt}`);
   const backupDir = path.join(targetDir, '.sage-backup');
@@ -309,30 +371,37 @@ function installCore(tgt) {
     rmSafe(destPath); copyRecursive(srcPath, destPath); manifest.installed.push(dest);
   });
 
-  // 为 Claude 目标自动生成 user-invocable 斜杠命令
+  // 为目标 CLI 自动生成 user-invocable artifacts
   if (tgt === 'claude') {
     const skillsSrc = path.join(PKG_ROOT, 'skills');
     installGeneratedCommands(skillsSrc, targetDir, backupDir, manifest);
+  } else if (tgt === 'codex') {
+    const skillsSrc = path.join(PKG_ROOT, 'skills');
+    installGeneratedPrompts(skillsSrc, targetDir, backupDir, manifest);
   }
 
-  const settingsPath = path.join(targetDir, 'settings.json');
+  let settingsPath = null;
   let settings = {};
-  if (fs.existsSync(settingsPath)) {
-    try {
-      settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
-    } catch (e) {
-      warn(`settings.json 解析失败，将使用空配置`);
-      settings = {};
-    }
-    fs.copyFileSync(settingsPath, path.join(backupDir, 'settings.json'));
-    manifest.backups.push('settings.json');
-  }
   if (tgt === 'claude') {
+    settingsPath = path.join(targetDir, 'settings.json');
+    if (fs.existsSync(settingsPath)) {
+      try {
+        settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+      } catch (e) {
+        warn('settings.json 解析失败，将使用空配置');
+        settings = {};
+      }
+      fs.copyFileSync(settingsPath, path.join(backupDir, 'settings.json'));
+      manifest.backups.push('settings.json');
+    }
     settings.outputStyle = 'abyss-cultivator';
     ok(`outputStyle = ${c.mag('abyss-cultivator')}`);
+    fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n');
+    manifest.installed.push('settings.json');
+  } else {
+    pruneLegacyCodexSettings(targetDir, backupDir, manifest);
   }
-  fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n');
-  manifest.installed.push('settings.json');
+
   fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + '\n');
 
   const uSrc = path.join(PKG_ROOT, 'bin', 'uninstall.js');
@@ -438,5 +507,9 @@ if (require.main === module) {
 module.exports = {
   deepMergeNew, detectClaudeAuth, detectCodexAuth,
   detectCclineBin, copyRecursive, shouldSkip, SETTINGS_TEMPLATE,
-  scanInvocableSkills, generateCommandContent, installGeneratedCommands
+  scanInvocableSkills,
+  generateCommandContent,
+  generatePromptContent,
+  installGeneratedCommands,
+  installGeneratedPrompts,
 };

package/config/codex-config.example.toml

@@ -1,9 +1,13 @@
 model_provider = "custom"
 model = "gpt-5.2-codex"
 model_reasoning_effort = "high"
+approval_policy = "on-request"
+sandbox_mode = "workspace-write"
+disable_response_storage = true
+
+[profiles.full_access]
 approval_policy = "never"
 sandbox_mode = "danger-full-access"
-disable_response_storage = true
 
 [model_providers.custom]
 name = "custom"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-abyss",
-  "version": "1.7.6",
+  "version": "1.8.0",
   "description": "邪修红尘仙·宿命深渊 - 一键为 Claude Code / Codex CLI 注入邪修人格与安全工程知识体系",
   "keywords": [
     "claude",