diff --git a/cn/lib/ai.sh b/cn/lib/ai.sh
index a02f585c..3aa62e28 100644
--- a/cn/lib/ai.sh
+++ b/cn/lib/ai.sh
@@ -108,16 +108,19 @@ cn_ai_render_codex_config() {
   touch "$cfg"
 
   # Strip our old blocks first, then check for an unmanaged provider table
-  awk '
-    /^# OmarchyCN ai (model|provider) begin$/ { skip = 1; next }
-    /^# OmarchyCN ai (model|provider) end$/ { skip = 0; next }
-    skip { next }
-    /^\[/ { in_section = 1 }
-    !in_section && /^(model|model_provider|model_catalog_json)[[:space:]]*=/ { next }
-    { print }
-  ' "$cfg" > "$cfg.omarchycn-tmp"
+  (
+    umask 077
+    awk '
+      /^# OmarchyCN ai (model|provider) begin$/ { skip = 1; next }
+      /^# OmarchyCN ai (model|provider) end$/ { skip = 0; next }
+      skip { next }
+      /^[[:space:]]*\[/ { in_section = 1 }
+      !in_section && /^[[:space:]]*(model|model_provider|model_catalog_json|preferred_auth_method|forced_login_method|model_reasoning_effort)[[:space:]]*=/ { next }
+      { print }
+    ' "$cfg" > "$cfg.omarchycn-tmp"
+  )
 
-  if grep -qE "^\[model_providers\.$provider\]" "$cfg.omarchycn-tmp"; then
+  if grep -qE "^[[:space:]]*\[[[:space:]]*model_providers[[:space:]]*\.[[:space:]]*\"?$provider\"?[[:space:]]*\]" "$cfg.omarchycn-tmp"; then
     rm -f "$cfg.omarchycn-tmp"
     echo "codex: $cfg 已有非托管的 [model_providers.$provider]，请手动清理后重试" >&2
     return 1
@@ -136,6 +139,9 @@ cn_ai_render_codex_config() {
       echo "model = \"$model\""
       echo "model_provider = \"$provider\""
       echo "model_catalog_json = \"~/.codex/models.json\""
+      echo "preferred_auth_method = \"apikey\""
+      echo "forced_login_method = \"api\""
+      echo "model_reasoning_effort = \"high\""
       echo "# OmarchyCN ai model end"
       cat "$cfg.omarchycn-tmp"
       echo "# OmarchyCN ai provider begin"