[Codex] Proxy takeover overwrites entire config.toml, silently destroying all user settings (UI preferences, MCP servers, memories, etc.)

[penguin-liu]

Self Checks / 自检

• I have read the FAQ section in README.
  我已阅读 README 中的常见问题。

• I have searched for existing issues, including closed ones.
  我已搜索过已有的 Issue，包括已关闭的。

CC Switch Version / 版本号

3.11.1

Operating System / 操作系统

macOS

Related App / 涉及应用

Codex

Steps to Reproduce / 重现步骤

Environment

• CC Switch v3.11.1, macOS (Apple Silicon)
• Codex Desktop app (latest, v26.x)
• Provider: custom (Zhipu GLM via local proxy at 127.0.0.1:15721)
• Proxy takeover mode: enabled (enableLocalProxy: true)

Background

Codex Desktop persists many user settings into ~/.codex/config.toml. These include:

Setting	config.toml key	Example
Prevent sleep while running	preventSleepWhileRunning (top-level)	true
Context window usage indicator	[desktop] show-context-window-usage	true
Projectless default window	[desktop] hotkey-window-projectless-default-enabled	true
Reasoning summary detail	model_reasoning_summary	"detailed"
Memory feature	[memories] use_memories / generate_memories	true
Custom MCP servers	[mcp_servers.exa], [mcp_servers.zotero], etc.	full server configs
Git branch prefix	[git] branchPrefix	etc.

Steps to Reproduce

1. Start CC Switch with proxy takeover enabled for Codex (local proxy mode).
2. Open Codex Desktop, go to Settings, and toggle on e.g. "Prevent sleep while running" and "Show context window usage in the composer".
3. Observe that Codex writes preventSleepWhileRunning = true and [desktop] show-context-window-usage = true into ~/.codex/config.toml.
4. Also manually add custom MCP server configs (e.g. [mcp_servers.exa], [mcp_servers.zotero]) to config.toml — these are the Codex-native way to register MCP servers.
5. Quit Codex Desktop entirely.
6. Restart CC Switch (or reboot the machine). CC Switch starts up and re-asserts proxy takeover.

What happens on CC Switch startup

From ~/.cc-switch/logs/cc-switch.log:

[WARN] 检测到上次异常退出（存在接管残留），正在恢复 Live 配置...
[INFO] codex Live 配置已从备份恢复
[WARN] codex 标记为已接管，但 backup=false live_matches_current_proxy=false，正在重新接管并补齐 Live
[INFO] 已备份 codex Live 配置
[INFO] Codex Live 配置已接管，代理地址: http://127.0.0.1:15721/v1

CC Switch writes config.toml from the provider template stored in the database (providers.settings_config.config for the active Codex provider), plus the proxy base_url and bearer token. This template is a snapshot captured when the provider was first added — it does not include any settings that Codex wrote afterwards.

Result

The entire config.toml is overwritten with the provider template + proxy fields. Everything Codex persisted is gone:

- preventSleepWhileRunning = true          # LOST
- [desktop]                                # LOST
- show-context-window-usage = true         # LOST
- hotkey-window-projectless-default-enabled = true  # LOST
- model_reasoning_summary = "detailed"     # LOST
- [memories]                               # LOST
- use_memories = true                      # LOST
- generate_memories = true                 # LOST
- [mcp_servers.exa]                        # LOST (entire MCP server + env)
- [mcp_servers.zotero]                     # LOST (entire MCP server + env)
- [mcp_servers.scansci_pdf]               # LOST (entire MCP server + env)
- [projects.<path>]                        # LOST (Codex re-creates this at runtime)

When Codex restarts, it reads config.toml, finds none of these keys, and falls back to defaults. The user sees all their settings reverted to "off" / default every single time CC Switch restarts.

Why this is hard to notice

• [desktop] and [projects.*] segments are re-created by Codex at runtime, so they "come back" — making it look like the overwrite is partial. But preventSleepWhileRunning, model_reasoning_summary, [memories], and all [mcp_servers.*] entries are only written by explicit user action and are permanently destroyed on each CC Switch restart.
• Users who only use the default OpenAI provider may never see this because the default template is re-applied identically. It primarily hits users with custom providers (which is the main use case for CC Switch).

Expected Behavior / 期望行为

When CC Switch re-asserts proxy takeover and rewrites config.toml, it should merge its proxy/provider fields into the existing file rather than replacing it entirely. Keys that CC Switch does not manage (UI preferences, MCP servers, memories, project trust levels, etc.) should be preserved.

Alternatively, CC Switch could store only the fields it needs to manage (model_provider, base_url, auth token, proxy settings) and inject/patch just those, leaving the rest of config.toml untouched.

Actual Behavior / 实际行为

CC Switch overwrites the entire config.toml with a stale provider template snapshot on every startup / takeover. All user-configured settings are silently destroyed. The user must re-configure everything after each restart.

Workaround I am currently using: manually editing each provider's settings_config.config template in the CC Switch SQLite database to include all my Codex settings. This is fragile and does not scale — any new setting added in Codex UI will be lost again until I manually sync it into the CC Switch template.

Additional Context / 补充信息

No response

[Jack-F0]

这确实是个缺陷，每次电脑重启后都要设置一次

[muyuanjin]

因为cc-switch接管配置经常导致配置项丢失，所以需要经常手动复制粘贴config.toml，然后cc-switch没有识别复制过去的路由地址，把路由地址当上游地址，然后路由也没有防自引用或者识别自己路由过的请求，导致路由每次打到自己就倍增请求，然后路由风暴卡死电脑

最近遇到这个问题了...

[BigStrongSun]

This looks like two related but separable failure modes:

1. The config overwrite / stale template restore part is the same root class tracked by fix(codex): preserve user config on route switch #4192 and the narrower restore follow-up in fix(codex): preserve live settings on backup restore #4381. The intended fix path is to preserve user-owned Codex settings ([desktop], [memories], [mcp_servers.*], etc.) while only replacing the provider/proxy-owned table when takeover/restore runs.
2. The "route points back to itself" / request amplification part is a separate safety boundary: the provider upstream should not be the local takeover proxy URL (127.0.0.1:15721), and CC Switch should ideally reject or normalize that self-reference instead of routing back into itself.

For now, avoid copying the live proxy URL from ~/.codex/config.toml back into a provider's upstream/base URL. That live URL is the CC Switch local proxy endpoint, not the real upstream provider endpoint.