fix(codex): profile auth files

Treat Codex auth.json as opaque provider state. Save and restore whole-file auth profiles while keeping config.toml on minimal toml_edit patches.

Refs #2

Author: cagedbird043

AGENTS.md

@@ -28,10 +28,11 @@ ux.rs      — prompt / diff / 简单表格输出
 |------|------|
 | `~/.config/cxf/base.toml` | 默认 model/review_model 设置（XDG_CONFIG_HOME） |
 | `~/.config/cxf/providers/` | 每个 Codex provider 一个 `.toml` 文件 |
+| `~/.config/cxf/auth/codex/` | 每个 Codex provider 的完整 `auth.json` profile |
 | `~/.config/cxf/claude/providers/` | 每个 Claude provider 一个 `.toml` 文件 |
-| `~/.local/state/cxf/snapshots/` | 切换前自动备份（XDG_STATE_HOME） |
+| `~/.local/state/cxf/snapshots/` | 切换前事故备份（XDG_STATE_HOME） |
 | `~/.codex/config.toml` | Codex 主配置（cxf 注入 `# cxf: provider = <name>` 标记） |
-| `~/.codex/auth.json` | Codex API key 存储 |
+| `~/.codex/auth.json` | Codex 认证状态；cxf 按 provider 做 whole-file profile 保存/恢复 |
 | `~/.claude/settings.json` | Claude Code 配置（cxf 只改 managed env + 顶层 model） |
 
 ## 硬规则
@@ -52,7 +53,7 @@ ux.rs      — prompt / diff / 简单表格输出
   - `model_context_window`, `model_auto_compact_token_limit`
   - `[model_providers.<name>]`
   - `[features].responses_websockets_v2`
-  - `auth.json` 的 `OPENAI_API_KEY`
+  - `auth.json` whole-file provider profile（不解析 OAuth 字段；API-key provider 可由 `api_key` 生成最小 auth）
 - 其他 Codex 配置必须保留。
 - 用户当前倾向：`model_providers` 一般保持 `"OpenAI"`，避免 Codex 历史按 provider key 分裂；如要改，必须明确知道风险。
 

README.md

@@ -132,13 +132,17 @@ cxf claude status
 ├── providers/                     # 每个 provider 一个 .toml 文件
 │   ├── openai.toml
 │   └── ...
+├── auth/
+│   └── codex/                    # 每个 Codex provider 的完整 auth.json profile
+│       ├── official.json
+│       └── ...
 └── claude/
     └── providers/                 # Claude provider 定义
         ├── deepseek.toml
         └── ...
 
 ~/.local/state/cxf/                # XDG_STATE_HOME → cxf 运行状态
-└── snapshots/                     # 切换前自动备份
+└── snapshots/                     # 切换前事故备份
     └── ...
 ```
 
@@ -148,7 +152,7 @@ cxf 只操作以下 Codex 配置字段：
 - `model_context_window`, `model_auto_compact_token_limit`
 - `[model_providers.<name>]` 块
 - `[features].responses_websockets_v2`
-- `auth.json` 中的 `OPENAI_API_KEY`
+- `auth.json` 作为不透明状态文件按 provider 完整保存/恢复；API-key provider 首次使用时从 `api_key` 生成最小 auth profile
 
 其他所有 Codex 配置保持不动。
 

src/codex.rs

@@ -7,8 +7,8 @@ use toml_edit::{DocumentMut, Item, table, value};
 use crate::{
     config::{
         BASE_KEYS, auth_path, base_path, codex_config_path, ensure_layout, load_base,
-        providers_dir, read_auth, read_text, read_toml, take_snapshot, write_auth,
-        write_default_base, write_secret, write_toml,
+        providers_dir, read_auth, read_text, read_toml, restore_auth_profile, save_auth_profile,
+        take_snapshot, write_auth, write_default_base, write_secret, write_toml,
     },
     models::{
         PROBE_PREFIX, Provider, ensure_provider_id, get_bool, get_i64, get_str,
@@ -313,9 +313,30 @@ pub fn extract_all_providers(current_name: Option<&str>) -> Result<Vec<Provider>
 pub fn cmd_init(name: Option<&str>) -> Result<()> {
     ensure_layout()?;
     write_default_base()?;
+    let config_path = codex_config_path();
+    let before_config = read_text(&config_path)?;
+    let current_model_provider = get_str(&read_toml(&config_path)?, "model_provider")
+        .unwrap_or_else(|| "OpenAI".to_string());
     let providers = extract_all_providers(name)?;
+    let mut current_provider_id = None;
     for provider in &providers {
         write_provider(provider)?;
+        if provider.model_providers == current_model_provider {
+            save_auth_profile(&provider.provider_id)?;
+            current_provider_id = Some(provider.provider_id.as_str());
+        }
+    }
+    if let Some(provider_id) = current_provider_id {
+        take_snapshot(
+            &config_path,
+            "codex-config",
+            &read_provider_probe(&before_config),
+            "toml",
+        )?;
+        write_secret(
+            &config_path,
+            set_provider_probe(&before_config, provider_id).as_bytes(),
+        )?;
     }
     println!("initialized: {}", providers_dir().display());
     for provider in providers {
@@ -350,24 +371,28 @@ pub fn cmd_use(provider_id: &str) -> Result<()> {
     } else {
         String::new()
     };
-    take_snapshot(
-        &config_path,
-        "codex-config",
-        &read_provider_probe(&before_config),
-        "toml",
-    )?;
+    let previous_provider = read_provider_probe(&before_config);
+    save_auth_profile(&previous_provider)?;
+    take_snapshot(&config_path, "codex-config", &previous_provider, "toml")?;
     let config = read_toml(&config_path)?;
     let after_doc = apply_provider(config, &base, &provider)?;
     let after_config = set_provider_probe(&after_doc.to_string(), &provider.provider_id);
     write_secret(&config_path, after_config.as_bytes())?;
-    if !provider.api_key.is_empty() {
-        take_snapshot(
-            &auth_path,
-            "codex-auth",
-            &read_provider_probe(&before_config),
-            "json",
-        )?;
-        write_auth(&provider.api_key)?;
+    let restored = restore_auth_profile(&provider.provider_id)?;
+    if provider.api_key.is_empty() {
+        if !restored {
+            eprintln!(
+                "{} warning: no Codex auth profile for {}, leaving auth.json unchanged",
+                yellow("!"),
+                provider.provider_id
+            );
+        }
+    } else {
+        let auth = read_auth()?;
+        if auth.get("OPENAI_API_KEY").and_then(Value::as_str) != Some(provider.api_key.as_str()) {
+            write_auth(&provider.api_key)?;
+            save_auth_profile(&provider.provider_id)?;
+        }
     }
     let after_auth = if auth_path.exists() {
         read_text(&auth_path)?

src/config.rs

@@ -48,6 +48,9 @@ pub fn claude_providers_dir() -> PathBuf {
 pub fn snapshots_dir() -> PathBuf {
     state_home().join("cxf/snapshots")
 }
+pub fn auth_profiles_dir() -> PathBuf {
+    cxf_home().join("auth/codex")
+}
 pub fn codex_config_path() -> PathBuf {
     home_dir().join(".codex/config.toml")
 }
@@ -60,6 +63,7 @@ pub fn claude_settings_path() -> PathBuf {
 
 pub fn ensure_layout() -> Result<()> {
     fs::create_dir_all(providers_dir()).context("create providers dir")?;
+    fs::create_dir_all(auth_profiles_dir()).context("create codex auth profiles dir")?;
     fs::create_dir_all(snapshots_dir()).context("create snapshots dir")?;
     Ok(())
 }
@@ -137,6 +141,7 @@ pub fn write_secret(path: &Path, data: &[u8]) -> Result<()> {
             .with_context(|| format!("create {}", path.display()))?;
         f.write_all(data)
             .with_context(|| format!("write {}", path.display()))?;
+        chmod_600(path)?;
     }
     #[cfg(not(unix))]
     {
@@ -213,14 +218,57 @@ pub fn write_default_base() -> Result<()> {
     write_toml(&path, &doc)
 }
 
+fn safe_provider_file(provider: &str) -> String {
+    provider.replace(['/', '\\'], "_")
+}
+
+fn snapshot_path(prefix: &str, provider: &str, ext: &str) -> PathBuf {
+    snapshots_dir().join(format!("{prefix}-{}.{ext}", safe_provider_file(provider)))
+}
+
+fn auth_profile_path(provider: &str) -> PathBuf {
+    auth_profiles_dir().join(format!("{}.json", safe_provider_file(provider)))
+}
+
 pub fn take_snapshot(source: &Path, prefix: &str, provider: &str, ext: &str) -> Result<()> {
     if !source.exists() {
         return Ok(());
     }
     fs::create_dir_all(snapshots_dir()).context("create snapshots dir")?;
-    let safe = provider.replace(['/', '\\'], "_");
-    let target = snapshots_dir().join(format!("{prefix}-{safe}.{ext}"));
+    let target = snapshot_path(prefix, provider, ext);
     fs::copy(source, &target).context("write snapshot")?;
     chmod_600(&target)?;
     Ok(())
 }
+
+pub fn save_auth_profile(provider: &str) -> Result<bool> {
+    if provider.trim().is_empty() || !auth_path().exists() {
+        return Ok(false);
+    }
+    read_auth()?;
+    fs::create_dir_all(auth_profiles_dir()).context("create codex auth profiles dir")?;
+    let text = read_text(&auth_path())?;
+    write_secret(&auth_profile_path(provider), text.as_bytes())?;
+    Ok(true)
+}
+
+pub fn restore_auth_profile(provider: &str) -> Result<bool> {
+    if provider.trim().is_empty() {
+        return Ok(false);
+    }
+    let profile = auth_profile_path(provider);
+    if !profile.exists() {
+        let legacy_snapshot = snapshot_path("codex-auth", provider, "json");
+        if !legacy_snapshot.exists() {
+            return Ok(false);
+        }
+        read_json(&legacy_snapshot)?;
+        fs::create_dir_all(auth_profiles_dir()).context("create codex auth profiles dir")?;
+        fs::copy(&legacy_snapshot, &profile).context("import legacy auth snapshot")?;
+        chmod_600(&profile)?;
+    }
+    read_json(&profile)?;
+    let text = read_text(&profile)?;
+    write_secret(&auth_path(), text.as_bytes())?;
+    Ok(true)
+}