# Codex Router Use Anthropic, Kimi, DeepSeek, xAI, opencode Go, Command Code, and future external models inside the Codex App and CLI through one local, credential-isolating router. The integration speaks the Responses API and merges external entries into Codex's native model catalog, so routed models appear in the normal picker next to the native GPT models. Codex Router is an independent community project. It is not affiliated with or endorsed by OpenAI, Anthropic, Moonshot AI, DeepSeek, OpenRouter, opencode, or the referenced opencodex project. ## Give the link to your agent Paste this into a Codex task: ```text Install the router from this public repository: https://github.com/duolahypercho/codex-router Follow AGENTS.md. Preserve my existing Codex models, profiles, settings, and ChatGPT login. Use only the provider authentication I choose, safely migrate only recognized older versions, run the Codex doctor, and leave the final app restart to me. Never ask me to paste a token or API key into chat. ``` If compatible authentication already exists, an agent can finish everything except the final app restart. API keys are entered only through a hidden local terminal prompt. ## Guided install macOS or Linux: ```sh curl -fsSL https://raw.githubusercontent.com/duolahypercho/codex-router/main/install.sh \ | sh -s -- --target codex --guided ``` Windows PowerShell: ```powershell $installer = Join-Path $env:TEMP "codex-router-install.ps1" Invoke-WebRequest https://raw.githubusercontent.com/duolahypercho/codex-router/main/install.ps1 -OutFile $installer powershell.exe -NoProfile -ExecutionPolicy Bypass -File $installer -Target codex -Guided ``` The setup selects providers, detects existing authentication, can run the official `kimi login`, prompts invisibly for API keys, installs a per-user background service, and verifies every local layer. It never makes a paid test request unless `--smoke-test` is explicitly selected. Requirements: - The Codex App or CLI. - Node.js 22.19 or newer; Node.js 24 LTS is recommended. - `uv`, or Python 3.10+ with `venv`. - Git for the managed one-command checkout and rollback. Linux installations support the Codex CLI. ## Models and authentication | Picker label | Model ID | Authentication | | --- | --- | --- | | K2.7 Coding Highspeed (OAuth) | `kimi-oauth/kimi-for-coding-highspeed` | Existing Kimi Code CLI OAuth session | | K2.7 Coding (OAuth) | `kimi-oauth/kimi-for-coding` | Existing Kimi Code CLI OAuth session | | Kimi K3 (OAuth) | `kimi-oauth/k3` | Existing Kimi Code CLI OAuth session | | Kimi K3 (API) | `kimi-api/kimi-k3` | Separately billed Kimi Platform API key | | DeepSeek V4 Flash (API) | `deepseek/deepseek-v4-flash` | DeepSeek API key | | DeepSeek V4 Pro (API) | `deepseek/deepseek-v4-pro` | DeepSeek API key | | Grok 4.5 (OAuth) | `grok-oauth/grok-4.5` | Official Grok CLI OAuth session | | Grok 4.5 (API) | `grok-api/grok-4.5` | Separately billed xAI API key | | Claude Opus 4.8 (API) | `anthropic-api/claude-opus-4.8` | Separately billed Anthropic API key | | GLM-5.2 (Ollama Cloud) | `ollama-cloud/glm-5.2` | Ollama Cloud API key | | Kimi K2.7 Code (Ollama Cloud) | `ollama-cloud/kimi-k2.7-code` | Ollama Cloud API key | | MiniMax M3 (Ollama Cloud) | `ollama-cloud/minimax-m3` | Ollama Cloud API key | | DeepSeek V4 Pro (Ollama Cloud) | `ollama-cloud/deepseek-v4-pro` | Ollama Cloud API key | | MiniMax M3 | `minimax-token-plan/minimax-m3` | MiniMax Token Plan API key | | Qwen3.8 Max (Plan) | `qwen-plan/qwen3.8-max` | Alibaba Model Studio plan API key | | Qwen3.8 Max Preview (Plan) | `qwen-plan/qwen3.8-max-preview` | Alibaba Model Studio plan API key | | Qwen3.7 Max (Plan) | `qwen-plan/qwen3.7-max` | Alibaba Model Studio plan API key | | Qwen3.7 Plus (Plan) | `qwen-plan/qwen3.7-plus` | Alibaba Model Studio plan API key | | Qwen3.6 Flash (Plan) | `qwen-plan/qwen3.6-flash` | Alibaba Model Studio plan API key | | DeepSeek V4 Pro (Qwen Plan) | `qwen-plan/deepseek-v4-pro` | Alibaba Model Studio plan API key | | DeepSeek V4 Flash (Qwen Plan) | `qwen-plan/deepseek-v4-flash-0731` | Alibaba Model Studio plan API key | | GLM-5.2 (Qwen Plan) | `qwen-plan/glm-5.2` | Alibaba Model Studio plan API key | | GLM-5.2 (Coding Plan) | `zai-coding/glm-5.2` | Z.ai GLM Coding Plan API key | | GLM-5-Turbo (Coding Plan) | `zai-coding/glm-5-turbo` | Z.ai GLM Coding Plan API key | | Muse Spark 1.2 (Meta) | `meta/muse-spark-1.2` | Meta Model API key | | Muse Spark 1.2 Contributor (Meta) | `meta/muse-spark-1.2-contributor` | Meta Model API key | | Muse Spark 1.1 (Meta) | `meta/muse-spark-1.1` | Meta Model API key | The Codex catalog is credential-aware. It includes models only from enabled external providers with a stored API key or valid OAuth session. Native GPT models are included only when `codex login status` confirms an OpenAI login. Qwen is key-only. Alibaba discontinued the Qwen Code OAuth free tier on 2026-04-15, so the Model Studio plan key is the sole Qwen surface; `qwen-plan` points at the token-plan endpoint. Set `QWEN_PLAN_BASE_URL` to `https://dashscope-intl.aliyuncs.com/compatible-mode/v1` to bill a pay-as-you-go DashScope key through the same provider. Alibaba publishes no quota or balance API on either endpoint, so the tray shows router-observed traffic and links to the console for actual spend. Grok OAuth reuses the official CLI credential at `~/.grok/auth.json` and sends it only to xAI's documented Grok CLI inference proxy. On that path the router also attaches bare hosted `web_search` and `x_search` tools, the same agentic surface Grok Build uses. xAI's backend chooses when to search and how to filter results; the router does not take search env knobs or request-side filter config. Install the official CLI and authenticate before enabling the route: ```sh npm install -g @xai-official/grok grok login --oauth ``` Native GPT models continue to use Codex directly. There is no separate GPT or ChatGPT OAuth provider in the router. Kimi Code OAuth and Kimi Platform API access are separate authentication and billing systems. The two Kimi entries intentionally coexist. Older DeepSeek aliases remain hidden compatibility routes and are not advertised to new users. The Ollama Cloud entries bill through an ollama.com account and can host the same model families as other providers under a separate quota. Matching entries (for example DeepSeek V4 Pro) intentionally coexist with the vendor-direct providers because credentials and billing differ. The Qwen plan entries cover every chat model the Individual Plan serves, including the cross-vendor models it resells (DeepSeek V4 and GLM-5.2) under the same plan key and quota. The cross-vendor entries use DashScope's compatible-mode request profile because DashScope rejects each vendor's native thinking parameters. The Qwen entries default to the Alibaba Model Studio Token Plan endpoint in the Singapore region. Coding Plan subscribers or other regions can point `QWEN_PLAN_BASE_URL` at their dashboard-issued base URL. Plan keys use the `sk-sp-` prefix and are separate from pay-as-you-go Model Studio keys; Alibaba reserves plan endpoints for interactive coding tools. The Z.ai entries use the GLM Coding Plan's dedicated endpoint and its subscription API key. That key is not interchangeable with general Z.ai platform keys, and Z.ai reserves the coding endpoint for interactive coding tools. Beyond the built-in models, each API-key provider's live catalog can be curated interactively: `./bin/curate-models PROVIDER` lists the models the provider currently advertises that are not in the registry, lets you toggle the ones you want, and stores them as user models in protected state (surviving updates, editable in place, and removable by re-running the command and deselecting). Curation asks for each new model's context window, image support, and reasoning efforts — so curated models get the effort switcher in the picker — and everything defaults conservatively when unanswered (`--efforts minimal,low,medium,high,xhigh` sets the ladder in the non-interactive `--models` form; every value stays editable in `user-models.json`). The provider's own `/v1/models` endpoint always decides which models exist. Curated models are local to your machine and are not vetted by the repository's compatibility tests. ### opencode (Go subscription and Zen) The opencode provider family covers both of opencode's endpoints with one stored API key (`OPENCODE_API_KEY` or `OPENCODE_GO_API_KEY` in the environment): the flat-rate **Go** subscription at `https://opencode.ai/zen/go/v1`, whose tested models ship in the registry below, and the pay-per-use **Zen** endpoint at `https://opencode.ai/zen/v1`, whose larger catalog is available through local curation (`./bin/curate-models opencode-zen`). Everything appears as a single "opencode Go/Zen" provider; internally the catalog is split across provider IDs by endpoint and by the protocol each model speaks upstream. Set the key once and enable the family: ```sh ./bin/model-router codex provider-key opencode-go set ./bin/model-router codex providers enable opencode-go ./bin/model-router codex multi-agent on ``` The desktop panel and macOS tray Settings tab also provide per-model controls: which enabled models can run as subagents, and which models appear in the Codex picker. | Picker label | Model ID | | --- | --- | | Grok 4.5 (opencode Go) | `opencode-go/grok-4.5` | | GLM-5.2 (opencode Go) | `opencode-go/glm-5.2` | | GLM-5.1 (opencode Go) | `opencode-go/glm-5.1` | | Kimi K3 (opencode Go) | `opencode-go/kimi-k3` | | Kimi K2.7 Code (opencode Go) | `opencode-go/kimi-k2.7-code` | | Kimi K2.6 (opencode Go) | `opencode-go/kimi-k2.6` | | DeepSeek V4 Pro (opencode Go) | `opencode-go/deepseek-v4-pro` | | DeepSeek V4 Flash (opencode Go) | `opencode-go/deepseek-v4-flash` | | MiMo-V2.5 (opencode Go) | `opencode-go/mimo-v2.5` | | MiMo-V2.5-Pro (opencode Go) | `opencode-go/mimo-v2.5-pro` | | Hy3 (opencode Go) | `opencode-go/hy3` | | MiniMax M3 (opencode Go) | `opencode-go-messages/minimax-m3` | | MiniMax M2.7 (opencode Go) | `opencode-go-messages/minimax-m2.7` | | Qwen3.8 Max (opencode Go) | `opencode-go-messages/qwen3.8-max` | | Qwen3.7 Max (opencode Go) | `opencode-go-messages/qwen3.7-max` | | Qwen3.7 Plus (opencode Go) | `opencode-go-messages/qwen3.7-plus` | | Qwen3.6 Plus (opencode Go) | `opencode-go-messages/qwen3.6-plus` | | GPT 5.6 Luna (opencode Go) | `opencode-go-responses/gpt-5.6-luna` | `opencode-go` carries the Chat Completions models, `opencode-go-messages` the Anthropic Messages models, `opencode-go-responses` the Responses models, and `opencode-zen` the pay-per-use Zen endpoint (no preselected models — curate the ones you want). All four are one selectable family: they share a single stored key, and enabling or disabling any of them toggles all of them together. Entries that duplicate a vendor-direct provider (for example DeepSeek V4 Pro) intentionally coexist because the subscription bills separately. Point `OPENCODE_GO_BASE_URL` (or `OPENCODE_ZEN_BASE_URL`) elsewhere to override the endpoints. ### Command Code Provider API Command Code's official Provider API is an OpenAI-compatible chat completions surface plus an Anthropic Messages surface at `https://api.commandcode.ai/provider/v1` (`COMMAND_CODE_API_KEY` or `COMMANDCODE_API_KEY` in the environment, or store the key once, or reuse a `command-code login` session). It requires the Provider plan or higher and uses the same key that authenticates the Command Code CLI. Everything appears as one "Command Code" provider; internally the catalog is split between `commandcode` for Chat Completions models and `commandcode-messages` for models that require the Messages protocol (Claude). **The Provider plan is required, and signing in does not grant it.** A Go-plan account can run the Command Code CLI but is refused by `/provider/v1` with `Your Go plan doesn't include API access`. That is an entitlement, not a credential problem: no sign-in, key, or reinstall changes it. Check the plan at [commandcode.ai/billing](https://commandcode.ai/billing) before enabling this provider. Given the Provider plan, there are two ways to authenticate, and either one is enough. **Sign in through the browser (OAuth).** `command-code login` opens the Command Code authorization page, receives the callback on a temporary local server, and writes the key it mints to `~/.commandcode/auth.json`. The router reads that file, so a signed-in machine needs no key of its own: ```sh npm install -g command-code command-code login ./bin/model-router codex providers enable commandcode ./bin/model-router codex multi-agent on ``` The macOS tray offers the same flow: the Command Code row has an **Install & Sign In** button (**Sign In** once the CLI is present) next to **Add Key**. `command-code login` draws a full-screen terminal interface, so the tray opens a Terminal window to run it and waits for the credential rather than piping it. The router only reads that file — it never rewrites, copies, or deletes it — so `command-code logout` also revokes the router's access. **Store a key instead.** Create one in Command Code Studio and save it here: ```sh ./bin/model-router codex provider-key commandcode set ./bin/model-router codex providers enable commandcode ./bin/model-router codex multi-agent on ``` When both exist, the exported environment variable wins, then the key stored here, then the macOS Keychain, and the CLI sign-in last: a key you deliberately saved is never silently replaced by a session. `doctor` names whichever source is live. | Picker label | Model ID | | --- | --- | | DeepSeek V4 Flash (Command Code) | `commandcode/deepseek-v4-flash` | | DeepSeek V4 Pro (Command Code) | `commandcode/deepseek-v4-pro` | | GLM-5.2 (Command Code) | `commandcode/glm-5.2` | | Kimi K3 (Command Code) | `commandcode/kimi-k3` | | Kimi K2.7 Code (Command Code) | `commandcode/kimi-k2.7-code` | | Qwen3.8 Max (Command Code) | `commandcode/qwen3.8-max` | | Qwen3.7 Max (Command Code) | `commandcode/qwen3.7-max` | | Qwen3.7 Plus (Command Code) | `commandcode/qwen3.7-plus` | | MiniMax M3 (Command Code) | `commandcode/minimax-m3` | | MiniMax M2.7 (Command Code) | `commandcode/minimax-m2.7` | | MiMo-V2.5-Pro (Command Code) | `commandcode/mimo-v2.5-pro` | | Grok 4.5 (Command Code) | `commandcode/grok-4.5` | | GPT 5.6 Luna (Command Code) | `commandcode/gpt-5.6-luna` | | GPT 5.5 (Command Code) | `commandcode/gpt-5.5` | | Gemini 3.5 Flash (Command Code) | `commandcode/gemini-3.5-flash` | | Hy3 (Command Code) | `commandcode/hy3-paid` | | Step 3.7 Flash (Command Code) | `commandcode/step-3.7-flash` | | Claude Sonnet 5 (Command Code) | `commandcode-messages/claude-sonnet-5` | | Claude Opus 4.8 (Command Code) | `commandcode-messages/claude-opus-4.8` | | Claude Fable 5 (Command Code) | `commandcode-messages/claude-fable-5` | | Claude Haiku 4.5 (Command Code) | `commandcode-messages/claude-haiku-4.5` | Both entries are one selectable family that shares a single stored key; enabling or disabling either toggles the whole family together. The live catalog is available without authentication from `https://api.commandcode.ai/provider/v1/models`, and additional models can be added per machine with `./bin/curate-models commandcode`. Point `COMMANDCODE_BASE_URL` elsewhere to override the endpoint. Command Code does not document an account-balance API, so the tray links to Command Code Studio for credits and usage. ### Meta Model API Meta's Muse Spark models speak the Responses protocol at `https://api.meta.ai/v1` (`META_API_KEY` in the environment, or store the key once): ```sh ./bin/model-router codex provider-key meta set ./bin/model-router codex providers enable meta ``` Three Muse Spark models ship in the registry: 1.2 and its cheaper Contributor tier (whose inputs and outputs Meta may use for training) with a 1M context window, reasoning efforts from minimal to xhigh, and reasoning summaries enabled, plus the previous-generation 1.1. Additional Meta models can be added per machine with `./bin/curate-models meta`. Point `META_BASE_URL` elsewhere to override the endpoint. ### Catalog-only providers These OpenAI-compatible providers are registered for routing and credential isolation but ship no preselected models, because their catalogs change too often for the repository to pin and live-verify individual entries: | Provider | Provider ID | Base URL | | --- | --- | --- | | Groq | `groq` | `https://api.groq.com/openai/v1` | | OpenRouter | `openrouter` | `https://openrouter.ai/api/v1` | | Together AI | `together` | `https://api.together.xyz/v1` | | Fireworks AI | `fireworks` | `https://api.fireworks.ai/inference/v1` | | Cerebras | `cerebras` | `https://api.cerebras.ai/v1` | | Mistral AI | `mistral` | `https://api.mistral.ai/v1` | | NVIDIA NIM | `nvidia-nim` | `https://integrate.api.nvidia.com/v1` | | SiliconFlow | `siliconflow` | `https://api.siliconflow.cn/v1` | | Hugging Face Router | `huggingface` | `https://router.huggingface.co/v1` | | Google Gemini API | `gemini-api` | `https://generativelanguage.googleapis.com/v1beta/openai` | Add a key, then pick the models you want from the provider's live catalog: ```sh ./bin/model-router codex provider-key groq set ./bin/curate-models groq ``` Curated entries use the context window, image support, and reasoning efforts you provide during curation (conservative defaults otherwise) and are local to your machine. Verify a model before relying on it: ```sh ./bin/test-model 'groq/MODEL_ID' --live --yes ``` Each base URL is overridable through the provider's `baseUrlEnv` variable, so a regional endpoint or a self-hosted gateway can reuse the same provider entry. Quota cards work for these providers without any extra configuration. Most OpenAI-compatible services report the caller's remaining window on every response through `x-ratelimit-*` headers, and Anthropic reports the same facts under an `anthropic-ratelimit-*` prefix. The router reads those headers as traffic passes through, so a provider starts showing real request and token limits after its first request — no balance endpoint, no extra API call, and no separate credential. Providers that publish no such headers, including Google Gemini, keep showing router traffic only. Gemini is routed through Google's OpenAI-compatible surface rather than the native Gemini protocol, so it shares the existing forwarder and needs no separate adapter. Only enabled providers appear in the Codex picker: ```sh ./bin/model-router codex providers ./bin/model-router codex providers enable deepseek ./bin/model-router codex provider-key deepseek set ./bin/model-router codex provider-key anthropic-api set ``` On Windows, use `./model-router.ps1 codex` with the same commands. The API-key prompt disables terminal echo. Protected files use mode `600` on POSIX and an inheritance-disabled, current-user ACL on Windows. Diagnostics report credential presence and source, never the value. ## Make models appear in Codex After setup: 1. Run `./bin/model-router codex doctor` and resolve any `FAIL` line. 2. Confirm `providers` says `SHOW` and `ready` for the intended provider. 3. Fully quit Codex, reopen it, and create a new task. 4. Open the normal model picker. Codex loads `model_catalog_json` only at app startup. If models are still missing, run `./bin/refresh-catalog`, fully quit Codex, and reopen it. Large compressed Codex contexts use separate safety limits for bytes received on the loopback socket and bytes produced after decompression. The defaults are 64 MiB encoded and 256 MiB decoded. Override them with `MODEL_ROUTER_MAX_BODY_BYTES` and `MODEL_ROUTER_MAX_DECODED_BODY_BYTES` respectively when a deliberately larger local workload requires it. The integration preserves the built-in OpenAI provider, native GPT models, ChatGPT sign-in, profiles, MCP settings, project trust, and reasoning defaults. It adds one marked root block and one inert custom-provider table to the user's Codex config: ```toml # BEGIN codex-router-managed openai_base_url = "http://127.0.0.1:4102/_codex-router//v1" model_catalog_json = "/absolute/path/to/.codex/codex-router/merged-models.json" # END codex-router-managed # BEGIN codex-router-provider-managed [model_providers.codex-router] name = "Codex Router (external models)" base_url = "http://127.0.0.1:4102/_codex-router//v1" wire_api = "responses" # END codex-router-provider-managed ``` The generated path is local caller authentication. Do not paste the complete managed URL into an issue. ### Windows Codex Desktop running through WSL When Codex Desktop runs on Windows while commands are executed through WSL, there may be two different Codex home directories: ```text C:\Users\\.codex ``` and: ```text /home//.codex ``` Router commands use the Codex home selected by `CODEX_HOME`. Running them inside WSL without overriding that variable may update the Linux CLI configuration instead of the configuration used by Windows Codex Desktop. To target the Windows Desktop configuration from WSL: ```sh export CODEX_HOME=/mnt/c/Users//.codex export CODEX_ROUTER_STATE_DIR="$CODEX_HOME/codex-router" ``` Then run the router command normally. For example, to return to authenticated mode with native GPT models and enabled external providers in the merged catalog: ```sh ./bin/control auth-mode off ``` Verify that the Windows `config.toml` uses a path that the WSL runtime can read: ```toml model_catalog_json = "/mnt/c/Users//.codex/codex-router/merged-models.json" ``` When the Codex runtime is executing inside WSL, a Windows-style path such as `C:\Users\...` is not readable as a Linux filesystem path. Use the corresponding `/mnt/c/...` path instead. If setup appears successful but the Desktop model picker does not change, check which Codex home was modified before rerunning setup. ### Use Codex without an OpenAI login The tray's **Use without OpenAI login** switch selects the managed custom provider for new Codex sessions. In that mode, enabled external models use the OAuth session or API key configured for their provider and do not require a ChatGPT or OpenAI API login. Connect and enable at least one external provider before turning it on. On macOS, the tray gracefully quits and reopens the registered Codex desktop app after the mode changes; if that restart fails, the tray reports that Codex must be restarted manually. The switch keeps the current model when it already belongs to a connected external provider; otherwise it selects the first enabled model from one of those providers. While the switch is on, model selection happens in Codex's own picker: the catalog republishes external models with their real names, so switching models needs no extra tray UI. `./bin/control model-set ` switches the active model from the command line; it accepts canonical external slugs and writes the aliased native slug so pickers highlight the selection. Login-free catalogs republish external models under the native GPT slugs (with the external model's own name and reasoning levels), because some Codex surfaces — notably the ChatGPT desktop app's model menu — only display models whose slugs pass a server-delivered allowlist of native slugs. The router records the mapping in `native-aliases.json` and dispatches those slugs to the mapped external provider. Models beyond the available native slots stay listed under their own slugs, and signing back in restores the native catalog untouched. Turning the switch off restores the exact root `model` and `model_provider` values that were present before the mode was enabled. The router does not modify or delete ChatGPT credentials. Native GPT models, ChatGPT usage, cloud tasks, and other account-backed features still require OpenAI authentication and are not available while signed out. The equivalent local control command is `./bin/control auth-mode on` or `./bin/control auth-mode off`; when using the command directly, restart Codex yourself. ## macOS tray control panel On macOS, build and open the native menu-bar control panel with: ```sh ./bin/model-router-tray ``` It shows Codex health, detailed usage for the active provider, a seven-day overview of every configured or previously used provider, and auto-applied provider controls in a native glass macOS interface. On first launch the app registers itself as a login item, so it reopens automatically after a reboot; the Settings tab's **Start at login** toggle or System Settings › Login Items turns that off, and the choice is never re-applied behind your back. A **Show tray** setting can additionally tie every tray surface to the Codex and ChatGPT desktop apps, appearing when they launch and hiding when they quit. See the [macOS tray guide](docs/MACOS-TRAY.md) for behavior and rebuild notes. The app also places a Dynamic-Island-style overlay at the top center of the active display. It follows the provider handling the latest request, reveals usage on hover, and expands on click. The menu-bar panel remains available for the all-provider overview and configuration. ## Windows and Linux tray control panel Windows and Linux use the shared Tauri tray companion in `apps/desktop`. It provides the same connected-provider filtering, normalized quota cards, daily token graph, secure provider setup, and animated activity status as the macOS surface. ```sh # Linux ./bin/model-router-tray ``` ```powershell # Windows PowerShell .\scripts\build-desktop-tray.ps1 -BinaryOnly Start-Process .\apps\desktop\src-tauri\target\release\codex-router-desktop.exe ``` Windows and Linux on X11 receive the floating top-center activity pill. Linux on Wayland uses the tray panel without the pill because the compositor owns absolute window placement. See the [Windows and Linux tray guide](docs/DESKTOP-TRAY.md) for prerequisites, packaging, and the platform behavior matrix. ## Common commands ```sh ./bin/model-router codex setup --guided ./bin/model-router codex doctor ./bin/model-router codex status ./bin/model-router codex disable ./bin/model-router codex enable ./bin/model-router codex uninstall ``` The optional live check makes one small request per selected provider and may consume paid quota: ```sh ./bin/model-router codex smoke-test --yes ``` `disable` removes only the Codex integration and its current service. `uninstall` intentionally retains the checkout, logs, backups, internal keys, and provider credentials so routine removal cannot destroy authentication or recovery data. ## Updates and rollback For a managed Git checkout: ```sh ./bin/model-router codex update ./bin/model-router codex rollback ``` Updates require a clean `main` checkout and a recognized repository origin. The previous revision is retained as a local rollback ref, and a failed install restores the previous source revision. If you already ran `git pull` manually, run the update command anyway; it applies the pulled revision when the install manifest is older. Run `doctor --fix` after an update or rollback so the generated config and service match the source revision. Tagged releases contain `.tar.gz` and `.zip` source archives, SHA-256 checksums, and GitHub build-provenance attestations. ## How routing works ```mermaid flowchart LR C["Codex Responses :4102"] --> L1["LiteLLM :4100"] L1 --> K1["Kimi OAuth :4101"] L1 --> A1["API keys :4103"] K1 --> P["External providers"] A1 --> P ``` Codex sends the Responses API. LiteLLM translates that contract to each provider's native protocol, including OpenAI-compatible Chat Completions and Anthropic Messages, with streaming and tool-call shapes preserved. Every listener binds to `127.0.0.1`. The router authenticates the caller before reading model traffic and passes only a random internal key to LiteLLM. The final forwarder discards that key and injects only the selected provider credential. Browser-originated requests are rejected, secrets are never exposed by public health routes, and network-facing errors are sanitized. Codex still owns the agent loop, tools, permissions, files, plugins, skills, MCP servers, and conversation state. The router handles model inference and protocol translation; it cannot add a capability the selected model or provider does not implement. ## Add future providers and models The [`config/`](config/) registry tree is the validated registry for provider metadata, picker entries, upstream IDs, API protocols, context limits, request profiles, modalities, and credential sources. Tested OpenAI-compatible and Anthropic API providers share one credential-isolating forwarder and appear in the Codex picker after compatibility tests pass. Discovery does not publish every upstream model blindly: ```sh ./bin/discover-models deepseek ./bin/test-model 'deepseek/deepseek-v4-pro' --live --yes ``` New models should remain unlisted until official capabilities and live text, streaming, image-input, tool-call, and context behavior are verified. See [Development](docs/DEVELOPMENT.md) for the registry contract. ## Documentation - [Installation, migration, and upgrades](docs/INSTALL.md) - [Compatible apps](docs/COMPATIBLE-APPS.md) - [Troubleshooting](docs/TROUBLESHOOTING.md) - [Architecture and request flow](docs/HOW-IT-WORKS.md) - [Security and credential handling](SECURITY.md) - [Provider development and tests](docs/DEVELOPMENT.md) - [Changelog](CHANGELOG.md) References: [Kimi Code CLI OAuth](https://www.kimi.com/help/kimi-code/cli-getting-started), [Kimi K3 API](https://platform.kimi.com/docs/guide/kimi-k3-quickstart), [DeepSeek model API](https://api-docs.deepseek.com/api/list-models), [Anthropic models](https://platform.claude.com/docs/en/about-claude/models/overview), [Anthropic Messages API](https://platform.claude.com/docs/en/api/messages), [Codex advanced configuration](https://learn.chatgpt.com/docs/config-file/config-advanced), and [opencodex](https://github.com/lidge-jun/opencodex). MIT licensed. See [LICENSE](LICENSE) and [NOTICE.md](NOTICE.md).