v1.16.0

v1.16.0

Features

• Model Config (inspired by CCursor):
  a new "Models" view manages the model domain of ~/.codex/config.toml
  visually. config.toml stays the single source of truth — no second
  providers.json:
  • Active model: edit and apply the top-level model / model_provider /
    model_reasoning_effort keys in one click. A unified "empty clears the
    key" rule falls back to Codex defaults; openai is treated as the
    built-in provider.
  • Providers: CRUD for [model_providers.<id>] tables — name, base URL, and
    auth chosen between an environment variable name (env_key) or a direct
    API key (experimental_bearer_token); no-auth local endpoints are
    supported. Deleting the active provider removes model_provider so the
    built-in OpenAI takes over; openai itself cannot be occupied as a
    custom provider id.
  • Presets: save the current (model, provider, effort) combination under a
    label and re-apply it in one click. Presets live in the launcher config,
    are validated against defined providers on save, and are never clobbered
    by settings-page saves (same protection as guard state).
  • Every write is backed up to ~/.codex/dashi-backups/ (same mechanism as
    the config guard); the model-config key set is disjoint from guarded
    keys, so the two domains never fight over config.toml.
• Shared file kernel extracted: codex_home resolution, pre-write backups,
  and TOML path editing moved out of the guard module into a crate-level
  codex_fs module, now reused by both the config guard and the new model
  config domain (pure move, guard behavior unchanged).

Verification

• cargo test: 50 passed — 9 new model_config tests plus a
  merge_settings preset-preservation regression.
• cargo clippy -- -D warnings clean; pnpm exec tsc --noEmit clean.
• vitest: 21 passed, including 9 new ModelView interaction tests
  (apply, preset save/apply/delete, provider save/delete with confirm flow).
• pnpm run build and pnpm run check:release -- --tag v1.16.0 pass.