Persist provider config file modes (codex)

[numnx]

🧩 Task: Persist provider config file modes

Automated task PR opened by Code UX for T02.

📋 Summary

Sprint: Sprint 153 · Settings Page Docs, New Codex Models, CLI Config File · Task: T02

Implement settings documentation/help affordances for every settings subcategory, add the new Codex model IDs, support per-provider Docker config file mode selection, and fix Tasks page project selection so navbar and in-page selectors do not fight each other.

📝 Full Task Prompt

## Objective
Add a provider-instance config file contract that lets Docker-backed CLI providers use no copied config, the normal host config file, or a user-selected config file while preserving existing auth-copy behavior.

## Scope
- `src/contracts/app-types.ts`
- `src/contracts/settings-scope-types.ts`
- `src/repositories/settings-defaults.ts`
- `src/repositories/settings-sanitizer.ts`
- `src/infrastructure/providers/cli/docker-credential-mount-builder.ts`
- `src/infrastructure/providers/cli/docker-bootstrap-builder.ts`
- `src/infrastructure/providers/cli/docker-runner.ts`
- `src/services/provider-settings-override.ts`
- `tests/backend/domain/settings/settings-sanitizers/ai-provider-sanitizer.test.ts`
- `tests/backend/infrastructure/providers/cli/docker-bootstrap-builder.test.ts`
- `tests/backend/services/provider-settings-override.test.ts`
- `docs/settings/configuration-and-storage.md`

## Implementation Requirements
1. Add typed provider config fields to system provider credential settings, for example `providerConfigMode: "none" | "copyHost" | "file"` and `providerConfigPath: string`, with defaults that preserve current behavior for existing saved settings.
2. Sanitize the new fields so non-CLI providers ignore them, `none` clears the custom file path, `copyHost` uses the provider's standard config file path, and `file` requires a non-empty user path but does not alter API-key/local-auth mode.
3. Extend provider runtime override plumbing so selected provider instances pass their config mode/path into Docker execution alongside `providerMountAuth` and `providerAuthPath`.
4. Update Docker mount/bootstrap behavior so config files are mounted separately from auth directories and copied to each provider's expected destination: Codex `~/.codex/config.toml`, Gemini `~/.gemini/settings.json`, Claude Code `~/.claude.json`, Qwen `~/.qwen/settings.json`, OpenCode `~/.config/opencode/opencode.json`, and Antigravity `~/.gemini/antigravity-cli/mcp_config.json`.
5. Preserve generated Code UX MCP config injection after the selected config file is materialized so managed MCP servers still override stripped local MCP declarations.
6. Add regression tests for sanitization, provider override pass-through, missing custom config file activity messages, and successful file-mode Docker mounts.
7. Document the persisted fields and Docker runtime behavior in `docs/settings/configuration-and-storage.md`.

## Constraints
- Do not treat provider config files as secrets in logs; activity messages may include resolved paths but must not print file contents.
- Do not change provider auth-copy modes: API key, local auth, and dashboard auth must keep their current mutual-exclusion behavior.
- Do not break host execution; config file copying is only a Docker runtime preparation concern unless an existing host materialization path already handles provider config files.
- Do not remove the existing generated MCP fragment mounts under `/opt/provider-config/*`.

## Verification
- `pnpm run test:backend -- tests/backend/domain/settings/settings-sanitizers/ai-provider-sanitizer.test.ts tests/backend/infrastructure/providers/cli/docker-bootstrap-builder.test.ts tests/backend/services/provider-settings-override.test.ts`
- `pnpm run lint`
- Success means existing settings load with copy-host-compatible behavior, `none` prevents config file copying, and `file` mounts only the selected config file to the provider's expected in-container destination.

✅ QA Review

⏳ QA review runs after this PR is opened. Check the task card in the dashboard for the outcome once it lands.

🤖 Model & Provider

Provider	Codex CLI
Model	gpt-5.5

⏱️ Timing

Started	2026-07-07 01:58:33 UTC
Finished	2026-07-07 02:10:48 UTC
Duration	12m 15s

📊 Token Usage

Metric	Value
Input tokens	339,184
Cached input tokens	8,550,528
Output tokens	23,833
Total tokens	8,913,545
Invocations	1
Tool calls	107
Active time	11m 28s

Included usage estimate (subscription/local login): $6.69

🌿 Branch Info

Base: feature/CODUX-153-settings-page-docs-new-codex-models-cli-config-file
Head: task/feature-codux-153-settings-page-docs-new-codex-m-t02-codex-mra02lyl

---

🤖 Generated by Code UX