feat(diagnostics): warn when project .codex/config.toml bypasses OpenCodex (cherry-pick PR #70)

Cherry-pick of 98d227d + b19384c from feat/project-codex-config-warnings.
All 5 review feedback items addressed by contributor. Additional fix:
- Test isolation: set CODEX_HOME in project-config-warnings.test.ts to prevent
  reading real user config during tests
- Fix cache test to use collectProjectCodexConfigWarnings with explicit cwd

Co-authored-by: Wibias <37517432+Wibias@users.noreply.github.com>

Author: lidge-jun

gui/src/i18n/en.ts

@@ -59,6 +59,8 @@ export const en = {
   "dash.syncOk": "Sync complete. {count} model(s) appended.",
   "dash.syncStaleHint": "If Codex App still shows an older list, restart its long-lived app-server process.",
   "dash.syncFailed": "Sync failed: {error}",
+  "dash.projectConfigTitle": "Project Codex config bypasses OpenCodex",
+  "dash.projectConfigHint": "These repo-local settings override the OpenCodex proxy (e.g. route to OpenCode Go directly). Remove them so ~/.codex/config.toml routing applies in that project.",
   "dash.checkUpdate": "Check update",
   "dash.updateTitle": "Update opencodex",
   "dash.updateDesc": "Check npm for the selected channel, then choose whether to restart the proxy after installation.",

gui/src/i18n/ko.ts

@@ -59,6 +59,8 @@ export const ko: Record<TKey, string> = {
   "dash.syncOk": "동기화 완료. {count}개 모델이 추가됐습니다.",
   "dash.syncStaleHint": "Codex App에 여전히 예전 목록이 보이면 오래 실행 중인 app-server 프로세스를 재시작하세요.",
   "dash.syncFailed": "동기화 실패: {error}",
+  "dash.projectConfigTitle": "프로젝트 Codex 설정이 OpenCodex를 우회합니다",
+  "dash.projectConfigHint": "저장소 로컬 설정이 OpenCodex 프록시를 덮어씁니다(예: OpenCode Go로 직접 라우팅). 해당 프로젝트에서 ~/.codex/config.toml 프록시를 쓰려면 제거하세요.",
   "dash.checkUpdate": "업데이트 확인",
   "dash.updateTitle": "opencodex 업데이트",
   "dash.updateDesc": "선택한 채널의 npm 최신 버전을 확인한 뒤, 설치 후 프록시를 재시작할지 선택합니다.",

gui/src/i18n/zh.ts

@@ -59,6 +59,8 @@ export const zh: Record<TKey, string> = {
   "dash.syncOk": "同步完成。已追加 {count} 个模型。",
   "dash.syncStaleHint": "如果 Codex App 仍显示旧列表，请重启长期运行的 app-server 进程。",
   "dash.syncFailed": "同步失败：{error}",
+  "dash.projectConfigTitle": "项目 Codex 配置绕过了 OpenCodex",
+  "dash.projectConfigHint": "这些仓库级设置会覆盖 OpenCodex 代理（例如直接走 OpenCode Go）。请移除它们，以便该项目使用 ~/.codex/config.toml 的代理路由。",
   "dash.checkUpdate": "检查更新",
   "dash.updateTitle": "更新 opencodex",
   "dash.updateDesc": "检查所选 npm 频道的最新版本，然后选择安装后是否重启代理。",

gui/src/pages/Dashboard.tsx

@@ -23,6 +23,18 @@ interface SyncResult {
   message: string;
   warning?: string;
   staleAppServerHint?: string;
+  projectConfigWarnings?: ProjectCodexConfigWarning[];
+}
+interface ProjectCodexConfigWarning {
+  path: string;
+  code: string;
+  detail: string;
+  message: string;
+}
+interface ProjectCodexConfigGroup {
+  path: string;
+  issues: string[];
+  bypass: string;
 }
 interface UpdateCheckData {
   currentVersion: string;
@@ -76,6 +88,7 @@ export default function Dashboard({ apiBase }: { apiBase: string }) {
   const [maHelpOpen, setMaHelpOpen] = useState(false);
   const [syncResult, setSyncResult] = useState<SyncResult | null>(null);
   const [syncError, setSyncError] = useState<string | null>(null);
+  const [projectConfigWarnings, setProjectConfigWarnings] = useState<ProjectCodexConfigGroup[]>([]);
   const [updateOpen, setUpdateOpen] = useState(false);
   const [updateChannel, setUpdateChannel] = useState<UpdateChannel>("latest");
   const [updateRestart, setUpdateRestart] = useState(true);
@@ -120,6 +133,21 @@ export default function Dashboard({ apiBase }: { apiBase: string }) {
     return () => clearInterval(interval);
   }, [apiBase]);
 
+  useEffect(() => {
+    const fetchDiagnostics = async () => {
+      try {
+        const pcRes = await fetch(`${apiBase}/api/diagnostics/project-config`);
+        const pcData = pcRes.ok ? await pcRes.json() as { grouped?: ProjectCodexConfigGroup[] } : null;
+        setProjectConfigWarnings(pcData?.grouped ?? []);
+      } catch {
+        setProjectConfigWarnings([]);
+      }
+    };
+    void fetchDiagnostics();
+    const interval = setInterval(() => void fetchDiagnostics(), 30_000);
+    return () => clearInterval(interval);
+  }, [apiBase]);
+
   useEffect(() => {
     if (error) return;
     setModelsLoading(true);
@@ -256,6 +284,8 @@ export default function Dashboard({ apiBase }: { apiBase: string }) {
       const data = await res.json() as SyncResult | { error?: string };
       if (!res.ok) throw new Error("error" in data && data.error ? data.error : "sync failed");
       setSyncResult(data as SyncResult);
+      const grouped = (data as SyncResult & { projectConfigGrouped?: ProjectCodexConfigGroup[] }).projectConfigGrouped;
+      if (grouped) setProjectConfigWarnings(grouped);
     } catch (err) {
       setSyncError(err instanceof Error ? err.message : String(err));
     } finally {
@@ -374,6 +404,24 @@ export default function Dashboard({ apiBase }: { apiBase: string }) {
         </div>
       </div>
 
+      {projectConfigWarnings.length > 0 && (
+        <div className="notice notice-err maintenance-notice" style={{ marginBottom: 24 }} role="alert">
+          <IconAlert />
+          <div>
+            <div style={{ fontWeight: 650 }}>{t("dash.projectConfigTitle")}</div>
+            <div className="muted" style={{ fontSize: 13, marginTop: 4 }}>{t("dash.projectConfigHint")}</div>
+            <ul style={{ margin: "10px 0 0", paddingLeft: 18, fontSize: 13 }}>
+              {projectConfigWarnings.map(g => (
+                <li key={g.path} style={{ marginBottom: 8 }}>
+                  <code>{g.path}</code> — {g.issues.join(", ")}
+                  <div className="muted" style={{ marginTop: 2 }}>{g.bypass}</div>
+                </li>
+              ))}
+            </ul>
+          </div>
+        </div>
+      )}
+
       <div className="panel maintenance-panel" style={{ marginBottom: 24 }}>
         <div className="spread maintenance-head">
           <div>

src/cli/doctor.ts

@@ -15,6 +15,7 @@ import { readCodexTokens } from "../codex/auth-collision";
 import { resolveCodexHomeDir as resolveCodexHomeDirImpl, isWslRuntime, listWslWindowsCodexHomes, wslAutomountRoot, type CodexHomeDeps } from "../codex/home";
 import { findCodexOnPath, isWindowsInteropDir } from "../codex/shim";
 import { countPendingOpencodexHistory } from "../codex/history-provider";
+import { collectProjectCodexConfigWarnings, formatProjectCodexConfigWarningsForDoctor } from "../codex/project-config-warnings";
 export { resolveCodexHomeDir } from "../codex/home";
 
 const WHAM_USAGE_URL = "https://chatgpt.com/backend-api/wham/usage";
@@ -373,6 +374,16 @@ export async function runDoctor(): Promise<void> {
     console.log(`  --     ${pending.pendingRows} thread(s) still tagged opencodex, ${pending.backupEntries} backup manifest entr${pending.backupEntries === 1 ? "y" : "ies"}`);
   }
 
+  console.log("\nProject Codex configs");
+  const projectWarnings = collectProjectCodexConfigWarnings();
+  if (projectWarnings.length === 0) {
+    console.log("  ok     no project-local provider bypass detected");
+  } else {
+    for (const line of formatProjectCodexConfigWarningsForDoctor(projectWarnings)) {
+      console.log(line);
+    }
+  }
+
   const dual = collectWslDualInstall();
   if (dual.wsl) {
     console.log("\nWSL Codex installs");