💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: be9847074a

Thanks for this contribution — this is one of the most complete external PRs this repo has received. I reproduced all five verification claims locally (fmt / clippy / 1992 lib tests + integration suites / tsc / 451 vitest, all green) and cross-checked the config schema, MCP layout, AGENTS.md, and --resume against x.ai's docs. The transactional hot-switch is a genuine improvement, and I found no regressions to existing apps: Codex/Claude forwarding stays byte-identical, and failover/circuit-breaker state is fully namespaced per app.

That said, please address the following before merge:

Required

1. Deleted MCP servers resurrect on switch-back. services/provider/live.rs:836 — restore_live_settings_for_provider_backfill early-returns for non-Codex apps, so the projected [mcp_servers.*] gets baked verbatim into the outgoing Grok provider snapshot. Since project_servers_to_app only reconciles servers still in the DB, a server deleted in cc-switch resurrects in ~/.grok/config.toml (possibly with stale credentials) on the next switch back. Grok needs the same strip Codex has (strip_codex_mcp_servers_from_settings; see the regression test codex_switch_backfill_strips_synced_mcp_servers as a template). The live-import path (live.rs:1450) needs the same strip.

2. Inline api_key is hard-required, rejecting documented config styles. grok_config.rs:104 — per x.ai's settings reference, api_key is discouraged; env_key / session token / XAI_API_KEY are canonical (resolution order api_key > env_key > session token > XAI_API_KEY). A valid env_key-style config fails "import from live" with an error, and the startup auto-import silently no-ops. Suggest accepting api_key OR env_key on import/validation.

3. Grok route doesn't survive an app restart. lib.rs:1746 — restore_proxy_state_on_startup iterates the hardcoded ["claude", "codex", "gemini"]. With only the Grok route enabled, the proxy never starts after a restart and the route silently drops to direct upstream while proxy_config.enabled stays true in the UI. (The live config itself is fine — restore_live_configs and detect_takeover_in_live_configs both cover Grok — only the re-takeover loop is missing.) Please add "grokbuild" plus a restart regression test.

4. Preset apiFormat isn't mapped into TOML api_backend. GrokBuildProviderForm.tsx — handlePresetChange sets meta.apiFormat but never updates apiBackend, so the generated TOML always says api_backend = "responses". Under proxy takeover this happens to work (the conversion gate reads meta.api_format), but in direct mode Grok CLI will speak Responses to a Chat-only gateway. x.ai documents api_backend = chat_completions | responses | messages, so please map openai_chat → chat_completions / anthropic → messages when generating the TOML.

5. First-launch MCP import misses Grok. The empty-table import block at lib.rs:761 calls the per-app importers for claude/codex/gemini/opencode/hermes but not the already-implemented import_from_grokbuild (the adjacent prompts loop does include GrokBuild). Existing ~/.grok/config.toml MCP servers won't be picked up on first launch.

Recommended (fine as a follow-up)

6. Cached tokens double-counted for GrokBuild. GrokBuild flows through Responses semantics where input_tokens includes cache, but grokbuild is missing from all four cache-inclusive lists: proxy/usage/calculator.rs:62, proxy/usage/logger.rs:74 (rows should be TOTAL, not FRESH), services/sql_helpers.rs:19, and the frontend mirror types/usage.ts:198. Result: cache portion billed at both input and cache rates, and cache-hit rate badly understated.
7. Deeplink coverage is partial. The prompt whitelist (deeplink/parser.rs:193) and MCP apps whitelist (parser.rs:265) still reject grokbuild; the existing-server apps merge (deeplink/mcp.rs:104) only merges claude/codex/gemini — this also predates the PR for opencode/hermes, so consider looping over the flags instead of per-field merging; and the provider inline-config dispatch (deeplink/provider.rs:642) has no Grok branch, so config/configUrl deeplinks fail with "Invalid app type".
8. No GrokBuild entry in usage UI. types/usage.ts:175 KNOWN_APP_TYPES (dashboard filter) and PricingConfigPanel.tsx PRICING_APPS omit grokbuild even though it records real proxy usage.
9. custom_endpoints conflation in the form. GrokBuildProviderForm.tsx:186-197, 329-356 persists the union of baseUrl + preset endpoints + prior custom_endpoints back into meta.custom_endpoints, so an endpoint removed in the speed-test modal resurrects on save. The Codex form persists only user-added endpoints.
10. Rollback gap for the Codex direct-write branch. rollback_hot_switch_preparation (services/proxy.rs:433) never restores the has_backup && !live_taken_over Codex direct write (proxy.rs:~2465) on commit failure — the PR moved that write ahead of the commit, so a commit failure now leaves ~/.codex on the new provider until the next proxy stop self-heals it.

Nits

README app lists (4 locales) still say 7 apps; the inline rawConfigError renders hardcoded English (should go through t()); five grokBuild.* i18n keys are unused; test gaps worth closing: delete_session (destructive remove_dir_all guards untested), validateGrokBuildConfig error branches / profile-rename, and the form's validation-error + edit-mode paths.

Thank you for your contribution!