mirror of
https://github.com/farion1231/cc-switch.git
synced 2026-08-30 17:04:49 +08:00
Jason
97a7425f7f
Four hardening fixes on top of the config-only unification: - Split write_codex_live_for_provider into a pure plan builder (normalization, safety gates, token injection, TOML parsing) and an executor, and preflight the plan in switch_normal BEFORE current is committed. Previously a write-layer refusal landed after local/DB current had moved, so the next switch would backfill the old live config into the refused provider's DB row. - Sink the legacy openai_base_url normalization into prepare_codex_provider_live_config, making it the single normalize→inject entry point. Takeover backup rebuilds and restore call prepare directly; without the migration a restored legacy backup left the key in a top-level field Codex ignores while auth.json credentials stayed live. - Stop update_codex_toml_field from creating [model_providers.openai]: Codex 0.149 rejects the whole config when a reserved built-in id is overridden (validate_reserved_model_provider_ids). The built-in openai provider is rerouted via the top-level openai_base_url knob instead, and wire_api writes become a no-op for it. - Never overwrite a user-authored [model_providers.cc-switch] table during normalization — nothing proves it is ours, and their headers or query params would be lost and backfilled into the DB. The shape falls through to the safety gates instead. The keyless-fallback rejection test now also locks that a refused switch leaves current on the previous provider.