fix(settings): report external Codex ownership

[luvs01]

Motivation

• The injector previously returned success: true when an external model_provider owned config.toml, which caused apply to be reported as applied and led the CLI to claim the file was rewritten and to show an incorrect auth-source consequence.
• The goal is to distinguish a deliberate preserve/no-op (externally owned config) from an actual write so the operator is not misled about which provider controls sign-in and routing.

Description

• Return an explicit marker from the injector by adding configApplied?: false to CodexInjectResult when injection preserves an externally owned config.toml rather than writing it (src/codex/inject.ts).
• Map that preservation outcome to a non-retryable external_provider apply reason in applyCodexDesktopSwitches, and report applied: false with the injector message as detail (src/codex/desktop-switches.ts).
• Represent externally-controlled effective state by allowing effective to be null and by reporting authSource.presentsCodexAccount as null with a descriptive summary, so the UI/CLI shows the external ownership rather than claiming a rewrite (src/codex/desktop-switches.ts).
• Update CLI formatting so it states when the effective state is controlled by an external provider, avoids claiming ~/.codex/config.toml was rewritten, and does not suggest ocx sync for the non-retryable external-ownership case (src/cli/system-command.ts).
• Add regression tests and an integration assertion to cover the externally-owned path and the reporting surface (tests/config/settings-desktop-switch-apply.test.ts, tests/cli/cli-headless-parity.test.ts, and tests/codex-integration/codex-inject-integration.test.ts).
• Document the behavior in structure/config.md to state that external model_provider ownership is preserved and reported as externally controlled rather than claiming a rewrite.

Testing

• Ran focused tests: ./node_modules/.bin/bun test tests/config/settings-desktop-switch-apply.test.ts and ./node_modules/.bin/bun test tests/cli/cli-headless-parity.test.ts, and both passed (new external-provider cases included).
• Ran bun run typecheck and bun run structure:check, both succeeded.
• Ran the full test suite (bun run test) for observation: the modified subsystem tests pass; the full suite completed but included unrelated environment-sensitive failures in some integration lanes (existing JSON parse and process-group assertions) that are not caused by these changes.

---

Codex Task

---

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: luvs01/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: f738d4c3-b6ca-416f-9b7e-f4ce13e7b3c0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-21T02:30:36.680536Z	0fe44e4	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[devin-ai-integration]

Fixed in 6321d1e — the read path now consults currentExternalCodexModelProvider via a new observedCodexDesktopSwitchApply() helper, so GET /api/settings (and switch-free PUTs) report effective: null and apply.reason: "external_provider" while config.toml is externally owned. A GET regression test covers an externally owned config.toml.

[devin-ai-integration]

Fixed in 6321d1e — docs-site/src/content/docs/guides/codex-integration.md now documents that GET /api/settings / ocx system settings report externally owned switches as externally controlled (effective: null) while config.toml selects another model_provider.

[devin-ai-integration]

Fixed in 6321d1e — read reports now derive external ownership from currentExternalCodexModelProvider through observedCodexDesktopSwitchApply(), independently of the one-request apply outcome, so a refreshed GET /api/settings stays accurate while config.toml remains externally owned.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[devin-ai-integration]

🟡 Unreadable Codex configuration breaks all settings requests

When config.toml exists but cannot be read or disappears during detection, ownership detection throws. Every settings GET and unrelated PUT then fails instead of returning its normal report.

Learn more

This new read runs outside the error handling used by applyCodexDesktopSwitches. currentExternalCodexModelProvider performs an existsSync followed by readFileSync, so permission errors and deletion between those calls propagate through the management route. The route-level handler only converts specific known errors, leaving this ordinary filesystem failure to escape the settings request.

Example: An external provider manager temporarily replaces ~/.codex/config.toml while the dashboard refreshes settings. The existence check succeeds, the subsequent read receives ENOENT, and /api/settings fails instead of returning the remaining settings.

Recommended fix: Catch import/read failures inside observedCodexDesktopSwitchApply and return a non-applied diagnostic state with the error in detail. Add a focused regression test that injects a failing ownership read or creates an existence/read race.

---

Was this helpful? React with 👍 or 👎 to provide feedback.