fix: escape update-provider values and harden legacy provider recovery

cli.js

@@ -305,9 +305,25 @@ function looksLikeProviderConfig(value) {
     return Object.keys(value).some((key) => PROVIDER_CONFIG_KEYS.has(key));
 }
 
+function isRecoverableNestedProviderConfig(value) {
+    if (!isPlainObject(value)) return false;
+    const hasBaseUrl = typeof value.base_url === 'string' && value.base_url.trim() !== '';
+    if (!hasBaseUrl) return false;
+    const hasName = typeof value.name === 'string' && value.name.trim() !== '';
+    const hasProviderSignals = [
+        'wire_api',
+        'requires_openai_auth',
+        'preferred_auth_method',
+        'request_max_retries',
+        'stream_max_retries',
+        'stream_idle_timeout_ms'
+    ].some((key) => Object.prototype.hasOwnProperty.call(value, key));
+    return hasName || hasProviderSignals;
+}
+
 function collectNestedProviderConfigs(node, pathPrefix, collector) {
     if (!isPlainObject(node)) return;
-    if (looksLikeProviderConfig(node)) {
+    if (isRecoverableNestedProviderConfig(node)) {
         collector.push([pathPrefix, node]);
         return;
     }
@@ -5255,16 +5271,40 @@ function cmdUpdate(name, baseUrl, apiKey, silent = false, options = {}) {
         const providerBlock = newContent.slice(range.start, range.end);
         let updatedBlock = providerBlock;
         if (baseUrl) {
+            const safeBaseUrl = escapeTomlBasicString(baseUrl);
+            const baseUrlWithCommentRegex = /^(\s*base_url\s*=\s*)(?:"(?:\\.|[^"\\])*"|'[^'\n]*')(\s+#.*)?$/m;
+            let replacedBaseUrl = false;
             updatedBlock = updatedBlock.replace(
-                /^(base_url\s*=\s*)(["']).*?\2/m,
-                `$1$2${baseUrl}$2`
+                baseUrlWithCommentRegex,
+                (_, prefix, suffix = '') => {
+                    replacedBaseUrl = true;
+                    return `${prefix}"${safeBaseUrl}"${suffix}`;
+                }
             );
+            if (!replacedBaseUrl) {
+                updatedBlock = updatedBlock.replace(
+                    /^(\s*base_url\s*=\s*).*$/m,
+                    (_, prefix) => `${prefix}"${safeBaseUrl}"`
+                );
+            }
         }
         if (apiKey !== undefined) {
+            const safeApiKey = escapeTomlBasicString(apiKey);
+            const apiKeyWithCommentRegex = /^(\s*preferred_auth_method\s*=\s*)(?:"(?:\\.|[^"\\])*"|'[^'\n]*')(\s+#.*)?$/m;
+            let replacedApiKey = false;
             updatedBlock = updatedBlock.replace(
-                /^(preferred_auth_method\s*=\s*)(["']).*?\2/m,
-                `$1$2${apiKey}$2`
+                apiKeyWithCommentRegex,
+                (_, prefix, suffix = '') => {
+                    replacedApiKey = true;
+                    return `${prefix}"${safeApiKey}"${suffix}`;
+                }
             );
+            if (!replacedApiKey) {
+                updatedBlock = updatedBlock.replace(
+                    /^(\s*preferred_auth_method\s*=\s*).*$/m,
+                    (_, prefix) => `${prefix}"${safeApiKey}"`
+                );
+            }
         }
         newContent = newContent.slice(0, range.start) + updatedBlock + newContent.slice(range.end);
     }

tests/e2e/test-config.js

@@ -7,6 +7,7 @@ module.exports = async function testConfig(ctx) {
         env,
         node,
         cliPath,
+        tmpHome,
         mockProviderUrl,
         noModelsUrl,
         htmlModelsUrl,
@@ -417,6 +418,78 @@ module.exports = async function testConfig(ctx) {
         const commentDeleteSections = configAfterCommentDelete.match(providerSectionRegex) || [];
         assert(commentDeleteSections.length === 0, 'comment-marker delete should remove foo.bar section only');
 
+        const inlineCommentConfig = [
+            'model_provider = "foo.bar"',
+            'model = "gpt-5.3-codex"',
+            '',
+            '[model_providers."foo.bar"]',
+            'name = "foo.bar"',
+            'base_url = "https://api.example.com/v1" # keep-base-comment',
+            'wire_api = "responses"',
+            'requires_openai_auth = false',
+            'preferred_auth_method = "sk-old" # keep-key-comment',
+            'request_max_retries = 4',
+            'stream_max_retries = 10',
+            'stream_idle_timeout_ms = 300000',
+            '',
+            '[model_providers.openai]',
+            'name = "openai"',
+            'base_url = "https://api.openai.com/v1"',
+            'wire_api = "responses"',
+            'requires_openai_auth = false',
+            'preferred_auth_method = ""',
+            'request_max_retries = 4',
+            'stream_max_retries = 10',
+            'stream_idle_timeout_ms = 300000',
+            ''
+        ].join('\n');
+        fs.writeFileSync(legacyConfigPath, inlineCommentConfig, 'utf-8');
+        const updateWithInlineComment = await legacyApi('update-provider', {
+            name: 'foo.bar',
+            url: 'https://updated-inline.example.com/v1',
+            key: 'sk-inline-new'
+        });
+        assert(updateWithInlineComment.success === true, 'update-provider should keep inline comments');
+        const configAfterInlineCommentUpdate = fs.readFileSync(legacyConfigPath, 'utf-8');
+        assert(
+            configAfterInlineCommentUpdate.includes('base_url = "https://updated-inline.example.com/v1" # keep-base-comment'),
+            'update-provider should preserve base_url inline comment'
+        );
+        assert(
+            configAfterInlineCommentUpdate.includes('preferred_auth_method = "sk-inline-new" # keep-key-comment'),
+            'update-provider should preserve preferred_auth_method inline comment'
+        );
+
+        const nestedMetadataConfig = [
+            'model_provider = "foo"',
+            'model = "gpt-5.3-codex"',
+            '',
+            '[model_providers.foo]',
+            'name = "foo"',
+            'base_url = "https://api.example.com/v1"',
+            'wire_api = "responses"',
+            'requires_openai_auth = false',
+            'preferred_auth_method = "sk-foo"',
+            'request_max_retries = 4',
+            'stream_max_retries = 10',
+            'stream_idle_timeout_ms = 300000',
+            '',
+            '[model_providers.foo.metadata]',
+            'base_url = "https://metadata.example.com/v1"',
+            'owner = "team-a"',
+            ''
+        ].join('\n');
+        fs.writeFileSync(legacyConfigPath, nestedMetadataConfig, 'utf-8');
+        const nestedMetadataList = await legacyApi('list');
+        assert(
+            nestedMetadataList.providers.some((item) => item && item.name === 'foo'),
+            'nested metadata config should keep foo provider'
+        );
+        assert(
+            !nestedMetadataList.providers.some((item) => item && item.name === 'foo.metadata'),
+            'nested metadata should not be promoted to provider'
+        );
+
         const ipv6Config = [
             'model_provider = "foo"',
             'model = "gpt-5.3-codex"',
@@ -488,6 +561,28 @@ module.exports = async function testConfig(ctx) {
     assert(exportProviderNew.payload.baseUrl === updatedUrl, 'export-provider(e2e-api) baseUrl mismatch');
     assert(exportProviderNew.payload.apiKey === 'sk-e2e-api-upd', 'export-provider(e2e-api) apiKey mismatch');
 
+    const quotedApiKey = 'sk-e2e-"quoted"-\\\\path';
+    const updateProviderQuoted = await api('update-provider', { name: 'e2e-api', key: quotedApiKey });
+    assert(updateProviderQuoted.success === true, 'update-provider should handle quoted API key');
+    const exportProviderQuoted = await api('export-provider', { name: 'e2e-api' });
+    assert(exportProviderQuoted.payload, 'export-provider(e2e-api quoted) missing payload');
+    assert(exportProviderQuoted.payload.apiKey === quotedApiKey, 'quoted API key should round-trip');
+    const configPath = path.join(tmpHome, '.codex', 'config.toml');
+    const configAfterQuotedUpdate = fs.readFileSync(configPath, 'utf-8');
+    assert(
+        configAfterQuotedUpdate.includes('preferred_auth_method = "sk-e2e-\\"quoted\\"-\\\\\\\\path"'),
+        'quoted API key should be escaped in config.toml'
+    );
+    const cliListAfterQuoted = runSync(node, [cliPath, 'list'], { env });
+    assert(
+        cliListAfterQuoted.status === 0,
+        `quoted API key should keep config parseable: ${cliListAfterQuoted.stderr || cliListAfterQuoted.stdout}`
+    );
+    assert(
+        cliListAfterQuoted.stdout.includes('e2e-api'),
+        'quoted API key should keep provider readable in fresh process'
+    );
+
     const statusAfterAdd = await api('status');
     assert(statusAfterAdd.provider === 'e2e2', 'add-provider should not change current provider');