Codex adapter: full auth contract, robust TOML detection, 0600 temp files

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QKxGW1raAWaqeU8WdHsMsp

cn/lib/ai.sh

@@ -108,16 +108,19 @@ cn_ai_render_codex_config() {
   touch "$cfg"
 
   # Strip our old blocks first, then check for an unmanaged provider table
+  (
+    umask 077
     awk '
       /^# OmarchyCN ai (model|provider) begin$/ { skip = 1; next }
       /^# OmarchyCN ai (model|provider) end$/ { skip = 0; next }
       skip { next }
-    /^\[/ { in_section = 1 }
-    !in_section && /^(model|model_provider|model_catalog_json)[[:space:]]*=/ { next }
+      /^[[:space:]]*\[/ { in_section = 1 }
+      !in_section && /^[[:space:]]*(model|model_provider|model_catalog_json|preferred_auth_method|forced_login_method|model_reasoning_effort)[[:space:]]*=/ { next }
       { print }
     ' "$cfg" > "$cfg.omarchycn-tmp"
+  )
 
-  if grep -qE "^\[model_providers\.$provider\]" "$cfg.omarchycn-tmp"; then
+  if grep -qE "^[[:space:]]*\[[[:space:]]*model_providers[[:space:]]*\.[[:space:]]*\"?$provider\"?[[:space:]]*\]" "$cfg.omarchycn-tmp"; then
     rm -f "$cfg.omarchycn-tmp"
     echo "codex: $cfg 已有非托管的 [model_providers.$provider]，请手动清理后重试" >&2
     return 1
@@ -136,6 +139,9 @@ cn_ai_render_codex_config() {
       echo "model = \"$model\""
       echo "model_provider = \"$provider\""
       echo "model_catalog_json = \"~/.codex/models.json\""
+      echo "preferred_auth_method = \"apikey\""
+      echo "forced_login_method = \"api\""
+      echo "model_reasoning_effort = \"high\""
       echo "# OmarchyCN ai model end"
       cat "$cfg.omarchycn-tmp"
       echo "# OmarchyCN ai provider begin"