ren worker folder adding orig, mv new one into root

worker-toolkit-potion-polyglot/scripts/lib/harness-credentials.sh

@@ -190,16 +190,39 @@ if [m for m in re.finditer(r"\$\{(\w+)\}", text) if not os.environ.get(m.group(1
     raise SystemExit(1)
 text = os.path.expandvars(text)
 
+# Root keys, plus keys inside a [model_providers.*] table: codex reserves its built-in
+# provider ids, so the proxy URL it must follow lives in a provider table, not at the
+# root. Every other table, [hooks] on the explore surface included, is left alone.
+REFRESHABLE_TABLE = re.compile(r"\[model_providers\.[^]]+\]$")
 wanted = []
+section = None
 for line in text.splitlines():
-    if line.lstrip().startswith("["):
-        break
-    m = re.match(r"\s*([A-Za-z0-9_-]+)\s*=", line)
+    stripped = line.strip()
+    if stripped.startswith("["):
+        section = stripped if REFRESHABLE_TABLE.match(stripped) else False
+        continue
+    if section is False:
+        continue
+    m = re.match(r"\s*\"?([A-Za-z0-9_.-]+)\"?\s*=", line)
     if m:
-        wanted.append((m.group(1), line.rstrip()))
+        wanted.append((section, m.group(1), line.rstrip()))
 if not wanted:
     raise SystemExit(0)
 
+
+def section_path(header):
+    """[model_providers.llm-proxy] -> ("model_providers", "llm-proxy")."""
+    return tuple(header.strip("[]").split("."))
+
+
+def lookup(doc, header, key):
+    """The value a parsed config holds for a wanted key, or KeyError."""
+    node = doc
+    if header:
+        for part in section_path(header):
+            node = node[part]
+    return node[key]
+
 mode = None
 if os.path.exists(target):
     try:
@@ -208,23 +231,52 @@ if os.path.exists(target):
         mode = os.stat(target).st_mode & 0o777
     except OSError:
         raise SystemExit(1)
-    # Everything from the first table header on belongs to a table. A key appended after
-    # one is reparented into it, so both the search and the insert stay above the line.
-    root_end = next((i for i, l in enumerate(lines) if l.lstrip().startswith("[")), len(lines))
-    changed = False
-    for key, line in wanted:
-        # The quoted spelling is the same key: replacing it beats adding a duplicate.
-        pat = re.compile(r"\s*\"?" + re.escape(key) + r"\"?\s*=")
-        at = next((i for i in range(root_end) if pat.match(lines[i])), None)
+    def span(header):
+        """The line range a section owns, or None when the file has no such section.
+
+        Root is everything above the first table header: a key appended below one
+        would be reparented into it, so searches and inserts stay inside the span.
+        """
+        heads = [i for i, l in enumerate(lines) if l.lstrip().startswith("[")]
+        if header is None:
+            return 0, (heads[0] if heads else len(lines))
+        at = next((i for i in heads if lines[i].strip() == header), None)
         if at is None:
-            if root_end < len(lines) and lines[root_end].strip():
-                lines.insert(root_end, "")
-            lines.insert(root_end, line)
-            root_end += 1
-            changed = True
-        elif lines[at] != line:
-            lines[at] = line
+            return None
+        after = next((i for i in heads if i > at), len(lines))
+        return at + 1, after
+
+    # Grouped, root first, so a section this file lacks can be written whole.
+    grouped = {}
+    for header, key, line in wanted:
+        grouped.setdefault(header, []).append((key, line))
+    ordered = sorted(grouped, key=lambda h: (h is not None, h or ""))
+
+    changed = False
+    for header in ordered:
+        if span(header) is None:
+            # A config written before this section existed. Write the whole table
+            # rather than leave a root key naming a provider that is not there.
+            if lines and lines[-1].strip():
+                lines.append("")
+            lines.append(header)
+            lines.extend(line for _, line in grouped[header])
             changed = True
+            continue
+        for key, line in grouped[header]:
+            # Re-read the span: an insert for an earlier key moved it.
+            start, end = span(header)
+            # The quoted spelling is the same key: replace rather than duplicate.
+            pat = re.compile(r"\s*\"?" + re.escape(key) + r"\"?\s*=")
+            at = next((i for i in range(start, end) if pat.match(lines[i])), None)
+            if at is None:
+                if end < len(lines) and lines[end].strip():
+                    lines.insert(end, "")
+                lines.insert(end, line)
+                changed = True
+            elif lines[at] != line:
+                lines[at] = line
+                changed = True
     if not changed:
         raise SystemExit(0)
     out = "\n".join(lines).rstrip("\n") + "\n"
@@ -238,9 +290,22 @@ try:
 except tomllib.TOMLDecodeError:
     raise SystemExit(1)
 # Parsing is not enough: a line edit can land inside a multi-line value, which still
-# parses while leaving the key unset. Require every key to have reached the root.
-if doc != {**doc, **tomllib.loads("\n".join(line for _, line in wanted))}:
-    raise SystemExit(1)
+# parses while leaving the key unset. Require every key to have landed on the value the
+# blob asks for, in its own section — skipping sections this file does not carry.
+blob_doc = tomllib.loads(text)
+for header, key, _ in wanted:
+    try:
+        expected = lookup(blob_doc, header, key)
+    except (KeyError, TypeError):
+        raise SystemExit(1)
+    try:
+        got = lookup(doc, header, key)
+    except (KeyError, TypeError):
+        if header is None:
+            raise SystemExit(1)
+        continue
+    if got != expected:
+        raise SystemExit(1)
 
 # Pid-suffixed: two launches at once must not write the same scratch path.
 tmp = target + ".raccoon-tmp." + str(os.getpid())