feat(codex): allow explicit custom provider routing consent

[xianlubird]

Summary

A custom Codex provider created only to disable WebSocket transport is currently treated as externally managed, so OpenCodex skips routing injection and users must edit its URL manually.

Add ocx codex-provider allow <id> with a default-No confirmation (or explicit per-ID --yes), plus status and revoke. Consent is scoped to the selected Codex home and provider ID. Start/sync manages only the approved provider's base_url; its ID, WebSocket setting, other fields and conversation history are preserved. Stop/restore and foreground signal/exit cleanup restore the original URL. Consent persists until revoked.

Private recovery metadata is published before URL changes, URL drift requires renewed consent, and concurrent writers use the existing locks. Startup diagnostics recognize only approved URLs recorded as managed by OpenCodex; service/shim availability still determines restart safety. The initial scope is loopback Responses routing with OpenAI authentication and no separate credentials/headers. Admission-token targets, authless Desktop mode and client compaction are explicitly refused.

The branch is based on the current dev baseline. Existing follow-up recovery/concurrency/foreground-exit work is retained, with original commit IDs and coauthor attribution preserved in the signed consolidation commit. CLI help, generated operating references and user/architecture docs are updated.

Verification

No local tests were run for this rewritten head, at the requester's explicit instruction to leave testing to CI. New and retained regressions cover consent and URL drift, restore/revocation, cross-home isolation, startup ownership classification, concurrent writers, process interruption and launcher teardown. CI validation of the current head remains pending; this PR stays a draft.

Historical results from earlier heads, not passing evidence for this rewritten head:

• Bun 1.4.3 focused provider-routing tests: 8 passed before the later startup/foreground-exit coverage.
• Focused routing/injection/sync tests: 117 passed during initial implementation.
• Focused CLI registry/capability/help, generated skill, test-layout, file-size and structure guards: 159 passed across 9 files.
• Typecheck, structure and privacy checks passed before the follow-ups.
• Documentation build passed before the follow-ups (577 pages).
• An earlier bun run test:changed selected 1,328 files, encountered sandbox loopback-listener errors and was stopped. A subsequent retry was stopped at the requester's instruction. Neither is claimed as passing.

The consolidated commit has a DCO sign-off and a GitHub-verified SSH signature. No provider consent, credential, user configuration or service was modified as part of the branch rewrite.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness

• Required local validation passed with its scope documented.
• Branch is on the latest dev commit.
• All correct Codex and CodeRabbit findings are fixed.
• Ready for review.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• Required local validation passed; commands, results, and any full-suite exception are documented.

• I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• review readiness checklist open (0/4 boxes ticked).

What to do

• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ Required local validation passed; commands, results, and any full-suite exception are documented.
• ⬜ I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This PR stays in draft until every box above is ticked.

[lidge-jun]

Being carried into #7222 with your authorship preserved; this PR will be closed when the bundle lands.

[lidge-jun]

Landed on dev in 4ed45e9 via #7222 (your change is its own commit in that bundle, and the squash keeps your authorship as Co-authored-by). Thank you!