From 8bca6c7c850b165ddafde73754e1c89ca1232a44 Mon Sep 17 00:00:00 2001
From: 121103qwq <121103qwq@users.noreply.github.com>
Date: Fri, 24 Jul 2026 22:59:05 +0800
Subject: [PATCH 1/6] =?UTF-8?q?feat:=20=E6=94=AF=E6=8C=81=E6=8C=89?=
 =?UTF-8?q?=E6=A8=A1=E5=9E=8B=E8=87=AA=E5=8A=A8=E8=B7=AF=E7=94=B1=E4=BE=9B?=
 =?UTF-8?q?=E5=BA=94=E5=95=86?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 apps/codex-plus-manager/src/App.tsx          |  19 ++
 crates/codex-plus-core/src/launcher.rs       |  36 ++-
 crates/codex-plus-core/src/model_catalog.rs  | 123 ++++++++-
 crates/codex-plus-core/src/protocol_proxy.rs | 261 ++++++++++++++++++-
 crates/codex-plus-core/src/relay_config.rs   | 126 ++++++++-
 crates/codex-plus-core/src/settings.rs       | 139 +++++++++-
 crates/codex-plus-core/tests/launcher.rs     |  38 +++
 crates/codex-plus-core/tests/relay_config.rs |  62 ++++-
 8 files changed, 779 insertions(+), 25 deletions(-)

diff --git a/apps/codex-plus-manager/src/App.tsx b/apps/codex-plus-manager/src/App.tsx
index 7030161b7..9c9533011 100644
--- a/apps/codex-plus-manager/src/App.tsx
+++ b/apps/codex-plus-manager/src/App.tsx
@@ -179,6 +179,7 @@ type BackendSettings = {
   providerSyncManualProviders: string[];
   providerSyncLastSelectedProvider: string;
   relayProfilesEnabled: boolean;
+  modelRoutingEnabled: boolean;
   enhancementsEnabled: boolean;
   computerUseGuardEnabled: boolean;
   codexAppPluginMarketplaceUnlock: boolean;
@@ -760,6 +761,7 @@ const defaultSettings: BackendSettings = {
   providerSyncManualProviders: [],
   providerSyncLastSelectedProvider: "",
   relayProfilesEnabled: true,
+  modelRoutingEnabled: false,
   enhancementsEnabled: true,
   computerUseGuardEnabled: false,
   codexAppPluginMarketplaceUnlock: true,
@@ -3260,6 +3262,22 @@ function RelayScreen({
             </span>
             <ToggleVisual />
           </label>
+          <label className="switch-row relay-master-switch">
+            <input
+              checked={normalized.modelRoutingEnabled}
+              disabled={!normalized.relayProfilesEnabled}
+              onChange={(event) => {
+                const next = { ...normalized, modelRoutingEnabled: event.currentTarget.checked };
+                void saveRelaySettings(next);
+              }}
+              type="checkbox"
+            />
+            <span>
+              <strong>{t("按模型自动路由供应商")}</strong>
+              <small>{t("开启后，模型列表中的模型自动走所属第三方供应商；未匹配模型走 ChatGPT 官方登录。重启 Codex++ 后生效。")}</small>
+            </span>
+            <ToggleVisual />
+          </label>
           <div className="relay-add-row">
             <Button
               variant="secondary"
@@ -7626,6 +7644,7 @@ function normalizeSettings(settings: BackendSettings): BackendSettings {
     ...defaultSettings,
     ...settings,
     relayProfilesEnabled: settings.relayProfilesEnabled !== false,
+    modelRoutingEnabled: settings.modelRoutingEnabled === true,
     computerUseGuardEnabled: settings.computerUseGuardEnabled === true,
     codexAppImageOverlayOpacity: clampNumber(settings.codexAppImageOverlayOpacity || 35, 1, 100),
     codexAppImageOverlayFitMode: normalizeImageOverlayFitMode(settings.codexAppImageOverlayFitMode),
diff --git a/crates/codex-plus-core/src/launcher.rs b/crates/codex-plus-core/src/launcher.rs
index c1256532e..23dc0ac88 100644
--- a/crates/codex-plus-core/src/launcher.rs
+++ b/crates/codex-plus-core/src/launcher.rs
@@ -304,6 +304,9 @@ where
                 );
             }
         }
+        if settings.model_routing_enabled {
+            hooks.apply_active_relay_profile(&settings).await?;
+        }
         let protocol_proxy_enabled = relay_protocol_proxy_enabled(&settings);
         if protocol_proxy_enabled {
             helper_port = crate::protocol_proxy::DEFAULT_PROTOCOL_PROXY_PORT;
@@ -536,6 +539,16 @@ impl LaunchHooks for DefaultLaunchHooks {
             .collect::<Vec<_>>()
             .join("\n\n"),
         );
+        if settings.model_routing_enabled {
+            let router = crate::relay_config::model_router_profile(settings, &home);
+            crate::relay_config::apply_relay_profile_to_home_with_switch_rules_and_computer_use_guard(
+                &home,
+                &router,
+                &common_config,
+                settings.computer_use_guard_enabled,
+            )?;
+            return Ok(());
+        }
         if profile.relay_mode == crate::settings::RelayMode::Official
             && !profile.official_mix_api_key
         {
@@ -1004,6 +1017,7 @@ async fn handle_helper_connection(
     let path = raw_path.split('?').next().unwrap_or(raw_path);
     let request_user_agent = header_value_from_headers(&request_headers, "user-agent");
     let request_content_type = header_value_from_headers(&request_headers, "content-type");
+    let request_proxy_headers = header_pairs_from_headers(&request_headers);
     let remote_addr_text = remote_addr.map(|addr| addr.to_string());
 
     let _ = crate::diagnostic_log::append_diagnostic_log(
@@ -1035,6 +1049,7 @@ async fn handle_helper_connection(
             &mut stream,
             &request_body,
             request_user_agent.as_deref(),
+            &request_proxy_headers,
             method,
             path,
             remote_addr_text,
@@ -1346,14 +1361,17 @@ async fn handle_protocol_proxy_connection(
     stream: &mut tokio::net::TcpStream,
     request_body: &str,
     request_user_agent: Option<&str>,
+    request_headers: &[(String, String)],
     method: &str,
     path: &str,
     remote_addr_text: Option<String>,
 ) -> anyhow::Result<()> {
     let request_json = serde_json::from_str::<serde_json::Value>(request_body).ok();
-    let upstream = match crate::protocol_proxy::open_responses_proxy_request(
+    let upstream = match crate::protocol_proxy::open_responses_proxy_request_with_client_context(
         request_body,
         request_user_agent,
+        path,
+        request_headers,
     )
     .await
     {
@@ -2074,6 +2092,22 @@ fn scan_chunked_body(encoded: &[u8]) -> Result<ChunkedBodyScan, HttpRequestReadE
     ChunkedScanState::default().advance(encoded)
 }
 
+fn header_pairs_from_headers(headers: &str) -> Vec<(String, String)> {
+    headers
+        .lines()
+        .skip(1)
+        .filter_map(|line| {
+            let (name, value) = line.split_once(':')?;
+            let name = name.trim();
+            let value = value.trim();
+            if name.is_empty() || value.is_empty() {
+                return None;
+            }
+            Some((name.to_string(), value.to_string()))
+        })
+        .collect()
+}
+
 fn header_value_from_headers(headers: &str, header_name: &str) -> Option<String> {
     headers
         .lines()
diff --git a/crates/codex-plus-core/src/model_catalog.rs b/crates/codex-plus-core/src/model_catalog.rs
index 10e8f9e60..f40da5b65 100644
--- a/crates/codex-plus-core/src/model_catalog.rs
+++ b/crates/codex-plus-core/src/model_catalog.rs
@@ -1,7 +1,7 @@
 use std::collections::{HashMap, HashSet};
 use std::path::{Path, PathBuf};
 
-use crate::settings::{RelayProfile, SettingsStore};
+use crate::settings::{BackendSettings, RelayMode, RelayProfile, SettingsStore};
 use serde_json::{Map, Value, json};
 
 const BASE_URL_ENV_KEYS: &[&str] = &[
@@ -39,8 +39,12 @@ pub async fn read_codex_model_catalog() -> Value {
     let settings_path = crate::paths::default_settings_path();
     if settings_path.exists() {
         if let Ok(settings) = SettingsStore::new(settings_path).load() {
-            let profile = settings.active_relay_profile();
-            let catalog = relay_profile_model_catalog_value(&home, &profile);
+            let catalog = if settings.model_routing_enabled {
+                model_routing_catalog_value(&home, &settings)
+            } else {
+                let profile = settings.active_relay_profile();
+                relay_profile_model_catalog_value(&home, &profile)
+            };
             if catalog
                 .get("models")
                 .and_then(Value::as_array)
@@ -72,6 +76,72 @@ pub async fn read_codex_model_catalog() -> Value {
     read_codex_model_catalog_from_home(&home, &env, client).await
 }
 
+fn model_routing_catalog_value(home: &Path, settings: &BackendSettings) -> Value {
+    let routed_profiles = settings
+        .relay_profiles
+        .iter()
+        .filter(|profile| {
+            profile.relay_mode != RelayMode::Aggregate
+                && (profile.relay_mode != RelayMode::Official || profile.official_mix_api_key)
+        })
+        .collect::<Vec<_>>();
+
+    let models = unique_strings(
+        routed_profiles
+            .iter()
+            .flat_map(|profile| relay_profile_model_ids(profile))
+            .collect(),
+    );
+    let (_, effective, _) = load_codex_config(&home.join("config.toml"));
+    let active_model = {
+        let live_model = string_value(effective.get("model"));
+        if live_model.is_empty() {
+            settings.active_relay_profile().model.trim().to_string()
+        } else {
+            live_model
+        }
+    };
+    let default_model = if models.iter().any(|model| model == &active_model) {
+        active_model.clone()
+    } else {
+        String::new()
+    };
+    let model_metadata = model_ui_metadata_map(&models);
+    let sources = routed_profiles
+        .iter()
+        .map(|profile| {
+            let provider_name = if profile.name.trim().is_empty() {
+                profile.id.trim()
+            } else {
+                profile.name.trim()
+            };
+            let count = relay_profile_model_ids(profile).len();
+            json!({
+                "id": format!("relay-profile:{}", profile.id),
+                "type": "model_route",
+                "name": provider_name,
+                "base_url": profile.base_url.trim(),
+                "status": "ok",
+                "models": count,
+                "responses_api": responses_api_status("unknown", "", "")
+            })
+        })
+        .collect::<Vec<_>>();
+
+    json!({
+        "status": if models.is_empty() { "not_configured" } else { "ok" },
+        "path": home.join("config.toml").to_string_lossy(),
+        "model": active_model,
+        "model_provider": "codex-plus-router",
+        "provider_name": "Codex++ Model Router",
+        "default_model": default_model,
+        "models": models,
+        "modelMetadata": model_metadata,
+        "sources": sources,
+        "responses_api": responses_api_status("unknown", "", "")
+    })
+}
+
 fn relay_profile_model_catalog_value(home: &Path, profile: &RelayProfile) -> Value {
     let models = relay_profile_model_ids(profile);
     let model = profile.model.trim().to_string();
@@ -805,3 +875,50 @@ fn unquote_toml_string(value: &str) -> String {
         .unwrap_or(value)
         .to_string()
 }
+
+#[cfg(test)]
+mod model_routing_catalog_tests {
+    use super::*;
+    use crate::settings::{BackendSettings, RelayMode, RelayProfile};
+
+    #[test]
+    fn routing_catalog_is_union_of_third_party_model_lists_only() {
+        let settings = BackendSettings {
+            model_routing_enabled: true,
+            relay_profiles: vec![
+                RelayProfile {
+                    id: "official".to_string(),
+                    name: "OpenAI Official".to_string(),
+                    relay_mode: RelayMode::Official,
+                    model_list: "gpt-5.6".to_string(),
+                    ..RelayProfile::default()
+                },
+                RelayProfile {
+                    id: "claude".to_string(),
+                    name: "Claude API".to_string(),
+                    relay_mode: RelayMode::PureApi,
+                    model_list: "claude-sonnet-4-6\nshared".to_string(),
+                    ..RelayProfile::default()
+                },
+                RelayProfile {
+                    id: "gemini".to_string(),
+                    name: "Gemini API".to_string(),
+                    relay_mode: RelayMode::PureApi,
+                    model_list: "gemini-3-pro\nshared".to_string(),
+                    ..RelayProfile::default()
+                },
+            ],
+            ..BackendSettings::default()
+        };
+
+        let catalog = model_routing_catalog_value(Path::new("/tmp/codex"), &settings);
+        let models = catalog["models"].as_array().unwrap();
+        let values = models.iter().filter_map(Value::as_str).collect::<Vec<_>>();
+
+        assert!(values.contains(&"claude-sonnet-4-6"));
+        assert!(values.contains(&"gemini-3-pro"));
+        assert!(values.contains(&"shared"));
+        assert!(!values.contains(&"gpt-5.6"));
+        assert_eq!(values.iter().filter(|value| **value == "shared").count(), 1);
+    }
+}
diff --git a/crates/codex-plus-core/src/protocol_proxy.rs b/crates/codex-plus-core/src/protocol_proxy.rs
index ada6885c7..bb33106d2 100644
--- a/crates/codex-plus-core/src/protocol_proxy.rs
+++ b/crates/codex-plus-core/src/protocol_proxy.rs
@@ -1,7 +1,6 @@
 //! Codex Responses API 与 OpenAI Chat Completions 的本地协议转换。
 //!
 //! Codex Chat 与 Responses 协议之间的转换实现。
-
 use std::collections::BTreeMap;
 use std::collections::BTreeSet;
 use std::time::Duration;
@@ -317,6 +316,7 @@ pub fn upstream_stream_header_timeout() -> Duration {
 
 pub fn upstream_http_client() -> anyhow::Result<reqwest::Client> {
     reqwest::Client::builder()
+        .no_proxy()
         .connect_timeout(UPSTREAM_CONNECT_TIMEOUT)
         .user_agent("CodexPlusPlus/ProtocolProxy")
         .build()
@@ -488,40 +488,98 @@ pub fn is_audio_transcriptions_proxy_path(path: &str) -> bool {
     )
 }
 
+const CHATGPT_CODEX_BASE_URL: &str = "https://chatgpt.com/backend-api/codex";
+const PROXY_AUTH_PLACEHOLDER: &str = "PROXY_MANAGED";
+
 pub async fn open_responses_proxy_request(
     body: &str,
     original_user_agent: Option<&str>,
 ) -> anyhow::Result<UpstreamProxyResponse> {
     let settings = SettingsStore::default().load().unwrap_or_default();
-    open_responses_proxy_request_with_settings_and_user_agent(body, settings, original_user_agent)
-        .await
+    open_responses_proxy_request_with_settings_and_client_context(
+        body,
+        settings,
+        original_user_agent,
+        "/v1/responses",
+        &[],
+    )
+    .await
 }
 
 pub async fn open_responses_proxy_request_with_settings(
     body: &str,
     settings: crate::settings::BackendSettings,
 ) -> anyhow::Result<UpstreamProxyResponse> {
-    open_responses_proxy_request_with_settings_and_user_agent(body, settings, None).await
+    open_responses_proxy_request_with_settings_and_client_context(
+        body,
+        settings,
+        None,
+        "/v1/responses",
+        &[],
+    )
+    .await
+}
+
+pub async fn open_responses_proxy_request_with_client_context(
+    body: &str,
+    original_user_agent: Option<&str>,
+    request_path: &str,
+    incoming_headers: &[(String, String)],
+) -> anyhow::Result<UpstreamProxyResponse> {
+    let settings = SettingsStore::default().load().unwrap_or_default();
+    open_responses_proxy_request_with_settings_and_client_context(
+        body,
+        settings,
+        original_user_agent,
+        request_path,
+        incoming_headers,
+    )
+    .await
 }
 
-async fn open_responses_proxy_request_with_settings_and_user_agent(
+async fn open_responses_proxy_request_with_settings_and_client_context(
     body: &str,
     settings: crate::settings::BackendSettings,
     original_user_agent: Option<&str>,
+    request_path: &str,
+    incoming_headers: &[(String, String)],
 ) -> anyhow::Result<UpstreamProxyResponse> {
     let request_json: Value = serde_json::from_str(body)?;
     let is_stream = request_json
         .get("stream")
         .and_then(Value::as_bool)
         .unwrap_or(false);
-    let context = RotationContext {
-        conversation_id: conversation_id_from_responses_request(&request_json),
+
+    let relays = if settings.model_routing_enabled {
+        let model = request_json
+            .get("model")
+            .and_then(Value::as_str)
+            .unwrap_or_default();
+        match settings.relay_profile_for_model(model)? {
+            Some(relay) => vec![relay],
+            None => {
+                return open_official_responses_proxy_request(
+                    &request_json,
+                    is_stream,
+                    request_path,
+                    incoming_headers,
+                    original_user_agent,
+                )
+                .await;
+            }
+        }
+    } else {
+        let context = RotationContext {
+            conversation_id: conversation_id_from_responses_request(&request_json),
+        };
+        let relay = crate::relay_rotation::select_relay_for_request(&settings, context)?;
+        let mut relays = vec![relay.clone()];
+        relays.extend(crate::relay_rotation::fallback_relays_after(
+            &settings, &relay.id,
+        )?);
+        relays
     };
-    let relay = crate::relay_rotation::select_relay_for_request(&settings, context)?;
-    let mut relays = vec![relay.clone()];
-    relays.extend(crate::relay_rotation::fallback_relays_after(
-        &settings, &relay.id,
-    )?);
+
     let relay_count = relays.len();
     for (attempt, relay) in relays.into_iter().enumerate() {
         validate_upstream(&relay)?;
@@ -643,6 +701,158 @@ async fn open_responses_proxy_request_with_settings_and_user_agent(
     anyhow::bail!("未找到可用的聚合供应商成员")
 }
 
+async fn open_official_responses_proxy_request(
+    request_json: &Value,
+    is_stream: bool,
+    request_path: &str,
+    incoming_headers: &[(String, String)],
+    original_user_agent: Option<&str>,
+) -> anyhow::Result<UpstreamProxyResponse> {
+    let authorization = incoming_header(incoming_headers, "authorization")
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .ok_or_else(|| anyhow::anyhow!("Codex 官方登录不可用，请先在 Codex 中完成 ChatGPT 登录"))?;
+    if authorization.contains(PROXY_AUTH_PLACEHOLDER) {
+        anyhow::bail!("Codex 官方登录不可用，请重启 Codex++ 或新建会话以重新加载官方登录认证");
+    }
+
+    let endpoint = official_responses_url(request_path);
+    let client =
+        crate::http_client::proxied_client(original_user_agent.map(str::trim).unwrap_or_default())?;
+    let mut builder = client
+        .post(&endpoint)
+        .header(reqwest::header::CONTENT_TYPE, "application/json")
+        .header(reqwest::header::ACCEPT_ENCODING, "identity");
+    if is_stream {
+        builder = builder
+            .header(reqwest::header::ACCEPT, "text/event-stream")
+            .header(reqwest::header::CACHE_CONTROL, "no-cache");
+    } else {
+        builder = builder.header(reqwest::header::ACCEPT, "application/json");
+    }
+
+    for (name, value) in incoming_headers {
+        let lower = name.trim().to_ascii_lowercase();
+        if !official_passthrough_header_allowed(&lower) {
+            continue;
+        }
+        if lower == "authorization" {
+            builder = builder.header(reqwest::header::AUTHORIZATION, authorization);
+            continue;
+        }
+        let Ok(header_name) = reqwest::header::HeaderName::from_bytes(lower.as_bytes()) else {
+            continue;
+        };
+        let Ok(header_value) = reqwest::header::HeaderValue::from_str(value.trim()) else {
+            continue;
+        };
+        builder = builder.header(header_name, header_value);
+    }
+
+    let model = request_json
+        .get("model")
+        .and_then(Value::as_str)
+        .unwrap_or_default();
+    let _ = crate::diagnostic_log::append_diagnostic_log(
+        "protocol_proxy.official_request",
+        json!({
+            "model": model,
+            "endpoint": endpoint,
+            "stream": is_stream
+        }),
+    );
+
+    let upstream =
+        send_upstream_request_for_responses(builder.json(request_json), is_stream).await?;
+    let status_code = upstream.status().as_u16();
+    let content_type = upstream
+        .headers()
+        .get(reqwest::header::CONTENT_TYPE)
+        .and_then(|value| value.to_str().ok())
+        .unwrap_or("")
+        .to_string();
+    let _ = crate::diagnostic_log::append_diagnostic_log(
+        "protocol_proxy.official_response",
+        json!({
+            "model": model,
+            "endpoint": endpoint,
+            "stream": is_stream,
+            "statusCode": status_code
+        }),
+    );
+
+    Ok(UpstreamProxyResponse {
+        status_code,
+        content_type: content_type.clone(),
+        is_stream: is_stream || content_type.contains("text/event-stream"),
+        wire_api: UpstreamWireApi::Responses,
+        response: upstream,
+    })
+}
+
+fn incoming_header<'a>(headers: &'a [(String, String)], name: &str) -> Option<&'a str> {
+    headers
+        .iter()
+        .find(|(header_name, _)| header_name.eq_ignore_ascii_case(name))
+        .map(|(_, value)| value.as_str())
+}
+
+fn official_responses_url(request_path: &str) -> String {
+    let path = request_path
+        .split_once('?')
+        .map_or(request_path, |(path, _)| path);
+    if path.trim_end_matches('/').ends_with("/responses/compact") {
+        format!("{CHATGPT_CODEX_BASE_URL}/responses/compact")
+    } else {
+        format!("{CHATGPT_CODEX_BASE_URL}/responses")
+    }
+}
+
+fn official_passthrough_header_allowed(name: &str) -> bool {
+    !matches!(
+        name,
+        "host"
+            | "content-length"
+            | "content-type"
+            | "transfer-encoding"
+            | "connection"
+            | "proxy-connection"
+            | "keep-alive"
+            | "upgrade"
+            | "accept"
+            | "accept-encoding"
+            | "cache-control"
+            | "user-agent"
+            | "x-api-key"
+            | "x-goog-api-key"
+            | "x-forwarded-host"
+            | "x-forwarded-port"
+            | "x-forwarded-proto"
+            | "forwarded"
+            | "cf-connecting-ip"
+            | "cf-ipcountry"
+            | "cf-ray"
+            | "cf-visitor"
+            | "true-client-ip"
+            | "fastly-client-ip"
+            | "x-azure-clientip"
+            | "x-azure-fdid"
+            | "x-azure-ref"
+            | "akamai-origin-hop"
+            | "x-akamai-config-log-detail"
+            | "x-request-id"
+            | "x-correlation-id"
+            | "x-trace-id"
+            | "x-amzn-trace-id"
+            | "x-b3-traceid"
+            | "x-b3-spanid"
+            | "x-b3-parentspanid"
+            | "x-b3-sampled"
+            | "traceparent"
+            | "tracestate"
+    )
+}
+
 pub async fn open_models_proxy_request(
     original_user_agent: Option<&str>,
 ) -> anyhow::Result<UpstreamProxyResponse> {
@@ -4087,3 +4297,30 @@ fn is_openai_o_series(model: &str) -> bool {
             .get(1)
             .is_some_and(|byte| byte.is_ascii_digit())
 }
+
+#[cfg(test)]
+mod model_routing_tests {
+    use super::*;
+
+    #[test]
+    fn official_route_preserves_responses_and_compact_paths() {
+        assert_eq!(
+            official_responses_url("/v1/responses"),
+            "https://chatgpt.com/backend-api/codex/responses"
+        );
+        assert_eq!(
+            official_responses_url("/v1/responses/compact"),
+            "https://chatgpt.com/backend-api/codex/responses/compact"
+        );
+    }
+
+    #[test]
+    fn official_route_filters_third_party_and_hop_by_hop_headers() {
+        assert!(official_passthrough_header_allowed("authorization"));
+        assert!(official_passthrough_header_allowed("chatgpt-account-id"));
+        assert!(official_passthrough_header_allowed("originator"));
+        assert!(!official_passthrough_header_allowed("x-api-key"));
+        assert!(!official_passthrough_header_allowed("host"));
+        assert!(!official_passthrough_header_allowed("content-length"));
+    }
+}
diff --git a/crates/codex-plus-core/src/relay_config.rs b/crates/codex-plus-core/src/relay_config.rs
index 2463a6d9c..8ade0cd7b 100644
--- a/crates/codex-plus-core/src/relay_config.rs
+++ b/crates/codex-plus-core/src/relay_config.rs
@@ -6,7 +6,9 @@ use std::path::{Path, PathBuf};
 use std::time::{SystemTime, UNIX_EPOCH};
 use toml_edit::{DocumentMut, Item, Table, TableLike};
 
-use crate::settings::{RelayContextSelection, RelayProfile, RelayProtocol};
+use crate::settings::{
+    BackendSettings, RelayContextSelection, RelayMode, RelayProfile, RelayProtocol,
+};
 
 const RELAY_PROVIDER: &str = "custom";
 const LEGACY_RELAY_PROVIDERS: &[&str] = &["CodexPlusPlus", "CodexPP"];
@@ -215,10 +217,20 @@ pub fn relay_config_status_from_home(home: &Path) -> RelayConfigStatus {
         .and_then(|values| values.get("base_url"))
         .map(|value| !unquote_toml_string(value).trim().is_empty())
         .unwrap_or(false);
+    let is_model_router = root_provider.as_deref() == Some("codex-plus-router")
+        && provider_string_from_config(&contents, "base_url").as_deref()
+            == Some(
+                crate::protocol_proxy::local_responses_proxy_base_url(
+                    crate::protocol_proxy::DEFAULT_PROTOCOL_PROXY_PORT,
+                )
+                .as_str(),
+            );
     RelayConfigStatus {
         configured: root_provider.is_some()
             && requires_openai_auth
-            && (has_bearer_token || codex_auth_api_key(&auth_contents).is_some())
+            && (has_bearer_token
+                || codex_auth_api_key(&auth_contents).is_some()
+                || is_model_router)
             && has_base_url,
         requires_openai_auth,
         has_bearer_token,
@@ -608,6 +620,77 @@ fn codex_base_url_for_protocol(base_url: &str, protocol: RelayProtocol, proxy_po
     }
 }
 
+/// Build the fixed local provider used by per-model routing.
+///
+/// The router itself has no API key. `requires_openai_auth = true` makes Codex
+/// attach its native ChatGPT authorization to localhost; the protocol proxy only
+/// forwards that credential for unmatched (official) models. Third-party routes
+/// replace it with the selected RelayProfile API key.
+pub fn model_router_profile(settings: &BackendSettings, home: &Path) -> RelayProfile {
+    let active = settings.active_relay_profile();
+    let live_model = std::fs::read_to_string(home.join("config.toml"))
+        .ok()
+        .and_then(|contents| root_key_string(&contents, "model"))
+        .filter(|value| !value.trim().is_empty());
+    let model = live_model.unwrap_or_else(|| relay_profile_model(&active));
+    let base_url = crate::protocol_proxy::local_responses_proxy_base_url(
+        crate::protocol_proxy::DEFAULT_PROTOCOL_PROXY_PORT,
+    );
+    let config_contents = format!(
+        "model_provider = \"codex-plus-router\"\n\n[model_providers.codex-plus-router]\nname = \"Codex++ Model Router\"\nwire_api = \"responses\"\nrequires_openai_auth = true\nbase_url = \"{base_url}\"\n"
+    );
+    let mut routed_models = Vec::new();
+    let mut seen_models = HashSet::new();
+    let mut routed_windows = std::collections::HashMap::<String, String>::new();
+    for profile in settings.relay_profiles.iter().filter(|profile| {
+        profile.relay_mode != RelayMode::Aggregate
+            && (profile.relay_mode != RelayMode::Official || profile.official_mix_api_key)
+    }) {
+        let (model_list, model_windows) =
+            if profile.model_windows.trim().is_empty() && profile.model_list.contains('[') {
+                crate::model_suffix::migrate_model_list_with_suffixes(&profile.model_list)
+            } else {
+                (
+                    profile.model_list.clone(),
+                    serde_json::from_str(&profile.model_windows).unwrap_or_default(),
+                )
+            };
+        for model in model_list
+            .split(['\r', '\n', ','])
+            .map(str::trim)
+            .filter(|model| !model.is_empty())
+        {
+            if seen_models.insert(model.to_string()) {
+                routed_models.push(model.to_string());
+            }
+            if let Some(window) = model_windows.get(model) {
+                routed_windows.insert(model.to_string(), window.clone());
+            }
+        }
+    }
+
+    RelayProfile {
+        id: "codex-plus-router".to_string(),
+        name: "Codex++ Model Router".to_string(),
+        model,
+        base_url: base_url.clone(),
+        upstream_base_url: base_url,
+        api_key: String::new(),
+        protocol: RelayProtocol::Responses,
+        relay_mode: RelayMode::Official,
+        // Keep the provider table instead of clearing back to vanilla official config.
+        official_mix_api_key: true,
+        config_contents,
+        auth_contents: String::new(),
+        use_common_config: active.use_common_config,
+        context_selection: active.context_selection,
+        context_selection_initialized: active.context_selection_initialized,
+        model_list: routed_models.join("\n"),
+        model_windows: serde_json::to_string(&routed_windows).unwrap_or_default(),
+        ..RelayProfile::default()
+    }
+}
+
 pub fn clear_relay_config_to_home(home: &Path) -> anyhow::Result<RelayApplyResult> {
     clear_relay_config_to_home_with_auth(home, None)
 }
@@ -1549,13 +1632,50 @@ fn apply_model_catalog_to_config(
     if let Some(parent) = catalog_path.parent() {
         std::fs::create_dir_all(parent)?;
     }
-    let catalog_json = crate::model_suffix::build_model_catalog_json(&entries, fallback);
+    let catalog_json = if profile.id == "codex-plus-router" {
+        build_model_router_catalog_json(home, &catalog_path, &entries, fallback)
+    } else {
+        crate::model_suffix::build_model_catalog_json(&entries, fallback)
+    };
     std::fs::write(&catalog_path, catalog_json)?;
     let mut doc = parse_toml_document(config_text)?;
     doc["model_catalog_json"] = toml_edit::value(catalog_relative);
     Ok(normalize_optional_toml(doc))
 }
 
+fn build_model_router_catalog_json(
+    home: &Path,
+    current_catalog_path: &Path,
+    entries: &[crate::model_suffix::ModelCatalogEntry],
+    fallback: Option<u64>,
+) -> String {
+    let generated = crate::model_suffix::build_model_catalog_json(entries, fallback);
+    let routed_models = serde_json::from_str::<Value>(&generated)
+        .ok()
+        .and_then(|value| value.get("models").and_then(Value::as_array).cloned())
+        .unwrap_or_default();
+    let mut models = catalog_models_from_file(&home.join("models_cache.json"))
+        .or_else(|| catalog_models_from_file(current_catalog_path))
+        .unwrap_or_default();
+    let routed_slugs = routed_models
+        .iter()
+        .filter_map(|model| model.get("slug").and_then(Value::as_str))
+        .collect::<HashSet<_>>();
+    models.retain(|model| {
+        model
+            .get("slug")
+            .and_then(Value::as_str)
+            .is_none_or(|slug| !routed_slugs.contains(slug))
+    });
+    models.extend(routed_models);
+    serde_json::to_string_pretty(&json!({ "models": models })).unwrap_or(generated)
+}
+
+fn catalog_models_from_file(path: &Path) -> Option<Vec<Value>> {
+    let value = serde_json::from_str::<Value>(&std::fs::read_to_string(path).ok()?).ok()?;
+    value.get("models")?.as_array().cloned()
+}
+
 fn live_external_model_catalog(home: &Path) -> Option<String> {
     let live_text = read_optional_text(&home.join("config.toml")).ok()?;
     let live = parse_toml_document(&live_text).ok()?;
diff --git a/crates/codex-plus-core/src/settings.rs b/crates/codex-plus-core/src/settings.rs
index bb322b1c5..6c9d5298f 100644
--- a/crates/codex-plus-core/src/settings.rs
+++ b/crates/codex-plus-core/src/settings.rs
@@ -332,6 +332,8 @@ pub struct BackendSettings {
     pub provider_sync_last_selected_provider: String,
     #[serde(rename = "relayProfilesEnabled", default = "default_true")]
     pub relay_profiles_enabled: bool,
+    #[serde(rename = "modelRoutingEnabled", default)]
+    pub model_routing_enabled: bool,
     #[serde(rename = "enhancementsEnabled", default = "default_true")]
     pub enhancements_enabled: bool,
     #[serde(rename = "computerUseGuardEnabled", default)]
@@ -482,6 +484,7 @@ impl Default for BackendSettings {
             provider_sync_manual_providers: Vec::new(),
             provider_sync_last_selected_provider: String::new(),
             relay_profiles_enabled: true,
+            model_routing_enabled: false,
             enhancements_enabled: true,
             computer_use_guard_enabled: false,
             codex_app_plugin_marketplace_unlock: true,
@@ -657,8 +660,62 @@ impl BackendSettings {
             .cloned()
     }
 
+    /// Resolve a model to exactly one ordinary third-party relay profile.
+    ///
+    /// `model_list` is the routing declaration: one model slug per line. Plain
+    /// official profiles are intentionally excluded so an unmatched model can
+    /// fall back to the native ChatGPT/Codex login route. Aggregate profiles are
+    /// also excluded here to avoid proxy recursion through the same local port.
+    pub fn relay_profile_for_model(&self, model: &str) -> anyhow::Result<Option<RelayProfile>> {
+        let (model, _) = crate::model_suffix::parse_model_suffix(model);
+        let model = model.trim();
+        if model.is_empty() {
+            return Ok(None);
+        }
+
+        let mut matches = self
+            .relay_profiles
+            .iter()
+            .filter(|profile| {
+                profile.relay_mode != RelayMode::Aggregate
+                    && (profile.relay_mode != RelayMode::Official || profile.official_mix_api_key)
+            })
+            .filter(|profile| {
+                profile
+                    .model_list
+                    .split(['\r', '\n', ','])
+                    .chain(std::iter::once(profile.model.as_str()))
+                    .map(str::trim)
+                    .filter(|value| !value.is_empty())
+                    .map(crate::model_suffix::parse_model_suffix)
+                    .any(|(slug, _)| slug == model)
+            })
+            .cloned()
+            .collect::<Vec<_>>();
+
+        match matches.len() {
+            0 => Ok(None),
+            1 => Ok(matches.pop()),
+            _ => {
+                let names = matches
+                    .iter()
+                    .map(|profile| {
+                        if profile.name.trim().is_empty() {
+                            profile.id.as_str()
+                        } else {
+                            profile.name.as_str()
+                        }
+                    })
+                    .collect::<Vec<_>>()
+                    .join("、");
+                anyhow::bail!("模型 {model} 同时存在于多个供应商中：{names}")
+            }
+        }
+    }
+
     pub fn active_relay_uses_protocol_proxy(&self) -> bool {
-        self.active_aggregate_relay_profile().is_some()
+        self.model_routing_enabled
+            || self.active_aggregate_relay_profile().is_some()
             || self.active_relay_profile().protocol == RelayProtocol::ChatCompletions
     }
 }
@@ -1041,6 +1098,7 @@ fn merge_known_setting_fields(target: &mut Map<String, Value>, source: &Map<Stri
     if let Some(value) = source.get("relayProfilesEnabled").and_then(Value::as_bool) {
         target.insert("relayProfilesEnabled".to_string(), Value::Bool(value));
     }
+    merge_bool_setting(target, source, "modelRoutingEnabled");
     if let Some(value) = source.get("enhancementsEnabled").and_then(Value::as_bool) {
         target.insert("enhancementsEnabled".to_string(), Value::Bool(value));
     }
@@ -2475,6 +2533,85 @@ experimental_bearer_token = "sk-existing""#
         assert!(updated.active_relay_uses_protocol_proxy());
     }
 
+    #[test]
+    fn model_routing_selects_the_profile_that_declares_the_model() {
+        let settings = BackendSettings {
+            model_routing_enabled: true,
+            relay_profiles: vec![
+                RelayProfile {
+                    id: "claude".to_string(),
+                    name: "Claude API".to_string(),
+                    relay_mode: RelayMode::PureApi,
+                    model_list: "claude-sonnet-4-6\nclaude-opus-4-6".to_string(),
+                    ..RelayProfile::default()
+                },
+                RelayProfile {
+                    id: "gemini".to_string(),
+                    name: "Gemini API".to_string(),
+                    relay_mode: RelayMode::PureApi,
+                    model_list: "gemini-3-pro".to_string(),
+                    ..RelayProfile::default()
+                },
+            ],
+            ..BackendSettings::default()
+        };
+
+        let relay = settings
+            .relay_profile_for_model("claude-sonnet-4-6")
+            .unwrap()
+            .unwrap();
+        assert_eq!(relay.id, "claude");
+        assert!(
+            settings
+                .relay_profile_for_model("gpt-5.6")
+                .unwrap()
+                .is_none()
+        );
+        assert!(settings.active_relay_uses_protocol_proxy());
+    }
+
+    #[test]
+    fn model_routing_ignores_plain_official_profile_and_rejects_duplicates() {
+        let settings = BackendSettings {
+            model_routing_enabled: true,
+            relay_profiles: vec![
+                RelayProfile {
+                    id: "official".to_string(),
+                    name: "OpenAI Official".to_string(),
+                    relay_mode: RelayMode::Official,
+                    official_mix_api_key: false,
+                    model_list: "gpt-5.6".to_string(),
+                    ..RelayProfile::default()
+                },
+                RelayProfile {
+                    id: "a".to_string(),
+                    name: "Provider A".to_string(),
+                    relay_mode: RelayMode::PureApi,
+                    model_list: "same-model".to_string(),
+                    ..RelayProfile::default()
+                },
+                RelayProfile {
+                    id: "b".to_string(),
+                    name: "Provider B".to_string(),
+                    relay_mode: RelayMode::PureApi,
+                    model_list: "same-model".to_string(),
+                    ..RelayProfile::default()
+                },
+            ],
+            ..BackendSettings::default()
+        };
+
+        assert!(
+            settings
+                .relay_profile_for_model("gpt-5.6")
+                .unwrap()
+                .is_none()
+        );
+        let error = settings.relay_profile_for_model("same-model").unwrap_err();
+        assert!(error.to_string().contains("Provider A"));
+        assert!(error.to_string().contains("Provider B"));
+    }
+
     #[test]
     fn active_relay_profile_uses_legacy_single_relay_when_profiles_are_default() {
         let settings = BackendSettings {
diff --git a/crates/codex-plus-core/tests/launcher.rs b/crates/codex-plus-core/tests/launcher.rs
index b7d06dc58..f4b3a66a4 100644
--- a/crates/codex-plus-core/tests/launcher.rs
+++ b/crates/codex-plus-core/tests/launcher.rs
@@ -1165,6 +1165,44 @@ async fn launch_lifecycle_does_not_apply_relay_profile_before_launching_codex()
     assert!(events.contains(&"launch:9229".to_string()));
 }
 
+#[tokio::test]
+async fn launch_lifecycle_applies_model_router_before_starting_helper() {
+    let temp = tempfile::tempdir().unwrap();
+    let app_dir = temp.path().join("Codex.app");
+    std::fs::create_dir_all(&app_dir).unwrap();
+    let status_store = StatusStore::new(temp.path().join("latest-status.json"));
+    let events = Arc::new(Mutex::new(Vec::<String>::new()));
+    let hooks = FakeHooks::new(events.clone()).with_settings(BackendSettings {
+        relay_profiles_enabled: true,
+        model_routing_enabled: true,
+        ..BackendSettings::default()
+    });
+
+    let handle = launch_and_inject_with_hooks(
+        LaunchOptions {
+            app_dir: Some(app_dir),
+            debug_port: 9229,
+            helper_port: 57321,
+            status_store,
+        },
+        &hooks,
+    )
+    .await
+    .unwrap();
+    handle.wait_for_codex_exit().await.unwrap();
+
+    let events = events.lock().unwrap().clone();
+    let apply = events
+        .iter()
+        .position(|event| event == "apply-relay")
+        .unwrap();
+    let helper = events
+        .iter()
+        .position(|event| event == "start-helper:57321")
+        .unwrap();
+    assert!(apply < helper);
+}
+
 #[tokio::test]
 async fn launch_lifecycle_skips_active_relay_profile_when_supplier_config_disabled() {
     let temp = tempfile::tempdir().unwrap();
diff --git a/crates/codex-plus-core/tests/relay_config.rs b/crates/codex-plus-core/tests/relay_config.rs
index 845d6f505..2426a3d73 100644
--- a/crates/codex-plus-core/tests/relay_config.rs
+++ b/crates/codex-plus-core/tests/relay_config.rs
@@ -8,12 +8,15 @@ use codex_plus_core::relay_config::{
     chatgpt_auth_status_from_home, clear_relay_config_to_home,
     clear_relay_config_to_home_with_auth, delete_context_entry_from_common_config,
     extract_common_config_from_config, filter_common_config_for_selection,
-    list_context_entries_from_common_config, normalize_relay_profile_for_storage,
-    relay_config_status_from_home, sanitize_common_config_contents,
-    set_codex_goals_feature_in_home, strip_common_config_from_config,
-    sync_live_config_context_entries, upsert_context_entry_in_common_config,
+    list_context_entries_from_common_config, model_router_profile,
+    normalize_relay_profile_for_storage, relay_config_status_from_home,
+    sanitize_common_config_contents, set_codex_goals_feature_in_home,
+    strip_common_config_from_config, sync_live_config_context_entries,
+    upsert_context_entry_in_common_config,
+};
+use codex_plus_core::settings::{
+    BackendSettings, RelayContextSelection, RelayMode, RelayProfile, RelayProtocol,
 };
-use codex_plus_core::settings::{RelayContextSelection, RelayMode, RelayProfile, RelayProtocol};
 
 fn write_remote_plugin_marketplace_snapshot(home: &std::path::Path) {
     let root = home.join(".tmp").join("plugins-remote");
@@ -3573,3 +3576,52 @@ experimental_bearer_token = "sk-new"
     );
     assert!(!windows.contains_key("deepseek-v4-pro"));
 }
+
+#[test]
+fn model_router_catalog_merges_official_models_and_routed_windows() {
+    let temp = tempfile::tempdir().unwrap();
+    let home = temp.path();
+    std::fs::write(
+        home.join("models_cache.json"),
+        r#"{"models":[{"slug":"gpt-official","context_window":272000}]}"#,
+    )
+    .unwrap();
+    let settings = BackendSettings {
+        model_routing_enabled: true,
+        active_relay_id: "default".to_string(),
+        relay_profiles: vec![
+            RelayProfile {
+                id: "default".to_string(),
+                name: "Official".to_string(),
+                relay_mode: RelayMode::Official,
+                ..RelayProfile::default()
+            },
+            RelayProfile {
+                id: "mimo".to_string(),
+                name: "MiMo".to_string(),
+                relay_mode: RelayMode::PureApi,
+                model_list: "mimo-v2.5-pro".to_string(),
+                model_windows: r#"{"mimo-v2.5-pro":"1M"}"#.to_string(),
+                ..RelayProfile::default()
+            },
+        ],
+        ..BackendSettings::default()
+    };
+
+    let router = model_router_profile(&settings, home);
+    assert_eq!(router.model_list, "mimo-v2.5-pro");
+    apply_relay_profile_to_home_with_switch_rules(home, &router, "").unwrap();
+
+    let catalog: serde_json::Value = serde_json::from_str(
+        &std::fs::read_to_string(home.join("model-catalogs/codex-plus-router.json")).unwrap(),
+    )
+    .unwrap();
+    let models = catalog["models"].as_array().unwrap();
+    assert!(models.iter().any(|model| model["slug"] == "gpt-official"));
+    let mimo = models
+        .iter()
+        .find(|model| model["slug"] == "mimo-v2.5-pro")
+        .unwrap();
+    assert_eq!(mimo["context_window"], 1_000_000);
+    assert_eq!(mimo["max_context_window"], 1_000_000);
+}

From ade7d2a48e80ca36c3282eea3db465dbb0aebfa5 Mon Sep 17 00:00:00 2001
From: 121103qwq <121103qwq@users.noreply.github.com>
Date: Sun, 26 Jul 2026 23:37:53 +0800
Subject: [PATCH 2/6] test(routing): cover per-model provider routing end to
 end

Addresses the review on #1641.

- model_catalog: the routing catalog only listed third-party models, so
  /models hid the official ones even though Codex's generated
  model_catalog_json had both. Merge the official slugs back in from
  model-catalogs/codex-plus-router.json (falling back to
  models_cache.json before the first launch writes it) and expose them as
  their own source entry.
- relay_switch: switching or editing a provider while routing is on wrote
  that profile over the router provider, and backfilled the router's live
  config.toml onto the profile it replaced. Apply the router profile
  instead and skip the backfill.
- protocol_proxy: make the official base URL overridable via
  CODEX_PLUS_OFFICIAL_BASE_URL and expose the settings+headers entry point
  so the routing decision can be driven end to end from tests.

New coverage: tests/model_routing.rs drives /v1/responses against
loopback upstreams for matched third-party models (correct API key),
suffixed model ids, unmatched models (official Authorization forwarded,
x-api-key withheld), /responses and /responses/compact, duplicate model
bindings, missing/placeholder ChatGPT login, and routing turned off.
tests/model_catalog.rs asserts the /models payload with routing on and
off; tests/relay_switch.rs asserts the switch flow in both states.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/codex-plus-core/src/model_catalog.rs   | 171 ++++++-
 crates/codex-plus-core/src/protocol_proxy.rs  |  42 +-
 crates/codex-plus-core/src/relay_switch.rs    |  27 +-
 crates/codex-plus-core/tests/model_catalog.rs | 177 ++++++-
 crates/codex-plus-core/tests/model_routing.rs | 474 ++++++++++++++++++
 crates/codex-plus-core/tests/relay_switch.rs  | 100 ++++
 6 files changed, 962 insertions(+), 29 deletions(-)
 create mode 100644 crates/codex-plus-core/tests/model_routing.rs

diff --git a/crates/codex-plus-core/src/model_catalog.rs b/crates/codex-plus-core/src/model_catalog.rs
index f40da5b65..64b108c13 100644
--- a/crates/codex-plus-core/src/model_catalog.rs
+++ b/crates/codex-plus-core/src/model_catalog.rs
@@ -17,6 +17,9 @@ const API_KEY_ENV_KEYS: &[&str] = &[
     "CODEX_PLUS_API_KEY",
     "OPENAI_API_KEY",
 ];
+/// Catalog the launcher generates for the per-model router; mirrors
+/// `relay_config::model_router_profile`'s profile id.
+const MODEL_ROUTER_CATALOG_RELATIVE: &str = "model-catalogs/codex-plus-router.json";
 
 #[derive(Debug, Clone)]
 struct ModelSource {
@@ -86,12 +89,29 @@ fn model_routing_catalog_value(home: &Path, settings: &BackendSettings) -> Value
         })
         .collect::<Vec<_>>();
 
-    let models = unique_strings(
+    let routed_models = unique_strings(
         routed_profiles
             .iter()
             .flat_map(|profile| relay_profile_model_ids(profile))
             .collect(),
     );
+    // Official models keep their own entry so the model picker shows both routes;
+    // a slug a third-party profile also declares stays owned by that profile.
+    let routed_slugs = routed_models
+        .iter()
+        .map(|model| crate::model_suffix::parse_model_suffix(model).0)
+        .collect::<HashSet<_>>();
+    let official_models = official_catalog_model_ids(home)
+        .into_iter()
+        .filter(|slug| !routed_slugs.contains(slug))
+        .collect::<Vec<_>>();
+    let models = unique_strings(
+        official_models
+            .iter()
+            .cloned()
+            .chain(routed_models.iter().cloned())
+            .collect(),
+    );
     let (_, effective, _) = load_codex_config(&home.join("config.toml"));
     let active_model = {
         let live_model = string_value(effective.get("model"));
@@ -107,26 +127,35 @@ fn model_routing_catalog_value(home: &Path, settings: &BackendSettings) -> Value
         String::new()
     };
     let model_metadata = model_ui_metadata_map(&models);
-    let sources = routed_profiles
-        .iter()
-        .map(|profile| {
-            let provider_name = if profile.name.trim().is_empty() {
-                profile.id.trim()
-            } else {
-                profile.name.trim()
-            };
-            let count = relay_profile_model_ids(profile).len();
-            json!({
-                "id": format!("relay-profile:{}", profile.id),
-                "type": "model_route",
-                "name": provider_name,
-                "base_url": profile.base_url.trim(),
-                "status": "ok",
-                "models": count,
-                "responses_api": responses_api_status("unknown", "", "")
-            })
+    let mut sources = Vec::new();
+    if !official_models.is_empty() {
+        sources.push(json!({
+            "id": "codex-official",
+            "type": "official_model_catalog",
+            "name": "ChatGPT 官方",
+            "base_url": "",
+            "status": "ok",
+            "models": official_models.len(),
+            "responses_api": responses_api_status("unknown", "", "")
+        }));
+    }
+    sources.extend(routed_profiles.iter().map(|profile| {
+        let provider_name = if profile.name.trim().is_empty() {
+            profile.id.trim()
+        } else {
+            profile.name.trim()
+        };
+        let count = relay_profile_model_ids(profile).len();
+        json!({
+            "id": format!("relay-profile:{}", profile.id),
+            "type": "model_route",
+            "name": provider_name,
+            "base_url": profile.base_url.trim(),
+            "status": "ok",
+            "models": count,
+            "responses_api": responses_api_status("unknown", "", "")
         })
-        .collect::<Vec<_>>();
+    }));
 
     json!({
         "status": if models.is_empty() { "not_configured" } else { "ok" },
@@ -177,6 +206,33 @@ fn relay_profile_model_catalog_value(home: &Path, profile: &RelayProfile) -> Val
     })
 }
 
+/// Official model slugs Codex itself offers while per-model routing is on.
+///
+/// The launcher writes `model-catalogs/codex-plus-router.json` with Codex's own
+/// catalog merged with every routed model, so reading it back yields exactly the
+/// set Codex's model picker sees. `models_cache.json` is the upstream cache used
+/// before that file has been generated (first launch after enabling routing).
+fn official_catalog_model_ids(home: &Path) -> Vec<String> {
+    catalog_slugs_from_file(&home.join(MODEL_ROUTER_CATALOG_RELATIVE))
+        .or_else(|| catalog_slugs_from_file(&home.join("models_cache.json")))
+        .unwrap_or_default()
+}
+
+fn catalog_slugs_from_file(path: &Path) -> Option<Vec<String>> {
+    let value = serde_json::from_str::<Value>(&std::fs::read_to_string(path).ok()?).ok()?;
+    Some(unique_strings(
+        value
+            .get("models")?
+            .as_array()?
+            .iter()
+            .filter_map(|model| model.get("slug").and_then(Value::as_str))
+            .map(str::trim)
+            .filter(|slug| !slug.is_empty())
+            .map(ToString::to_string)
+            .collect(),
+    ))
+}
+
 fn relay_profile_model_ids(profile: &RelayProfile) -> Vec<String> {
     unique_strings(
         profile
@@ -911,7 +967,8 @@ mod model_routing_catalog_tests {
             ..BackendSettings::default()
         };
 
-        let catalog = model_routing_catalog_value(Path::new("/tmp/codex"), &settings);
+        let home = tempfile::tempdir().unwrap();
+        let catalog = model_routing_catalog_value(home.path(), &settings);
         let models = catalog["models"].as_array().unwrap();
         let values = models.iter().filter_map(Value::as_str).collect::<Vec<_>>();
 
@@ -921,4 +978,76 @@ mod model_routing_catalog_tests {
         assert!(!values.contains(&"gpt-5.6"));
         assert_eq!(values.iter().filter(|value| **value == "shared").count(), 1);
     }
+
+    #[test]
+    fn routing_catalog_merges_official_models_from_generated_router_catalog() {
+        let home = tempfile::tempdir().unwrap();
+        std::fs::create_dir_all(home.path().join("model-catalogs")).unwrap();
+        // What the launcher generates: official models plus every routed model.
+        std::fs::write(
+            home.path().join(MODEL_ROUTER_CATALOG_RELATIVE),
+            r#"{"models":[
+                {"slug":"gpt-5.6-codex","context_window":272000},
+                {"slug":"gpt-5.6","context_window":272000},
+                {"slug":"mimo-v2.5-pro","context_window":1000000}
+            ]}"#,
+        )
+        .unwrap();
+        let settings = BackendSettings {
+            model_routing_enabled: true,
+            relay_profiles: vec![RelayProfile {
+                id: "mimo".to_string(),
+                name: "MiMo".to_string(),
+                relay_mode: RelayMode::PureApi,
+                model_list: "mimo-v2.5-pro[1M]".to_string(),
+                ..RelayProfile::default()
+            }],
+            ..BackendSettings::default()
+        };
+
+        let catalog = model_routing_catalog_value(home.path(), &settings);
+        let values = catalog["models"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .filter_map(Value::as_str)
+            .collect::<Vec<_>>();
+
+        assert_eq!(values, ["gpt-5.6-codex", "gpt-5.6", "mimo-v2.5-pro[1M]"]);
+        assert_eq!(catalog["status"], "ok");
+        assert_eq!(catalog["sources"][0]["type"], "official_model_catalog");
+        assert_eq!(catalog["sources"][0]["models"], 2);
+        assert_eq!(catalog["sources"][1]["type"], "model_route");
+    }
+
+    #[test]
+    fn routing_catalog_falls_back_to_models_cache_before_first_router_catalog() {
+        let home = tempfile::tempdir().unwrap();
+        std::fs::write(
+            home.path().join("models_cache.json"),
+            r#"{"models":[{"slug":"gpt-5.6-codex"}]}"#,
+        )
+        .unwrap();
+        let settings = BackendSettings {
+            model_routing_enabled: true,
+            relay_profiles: vec![RelayProfile {
+                id: "claude".to_string(),
+                name: "Claude API".to_string(),
+                relay_mode: RelayMode::PureApi,
+                model_list: "claude-sonnet-4-6".to_string(),
+                ..RelayProfile::default()
+            }],
+            ..BackendSettings::default()
+        };
+
+        let catalog = model_routing_catalog_value(home.path(), &settings);
+        let values = catalog["models"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .filter_map(Value::as_str)
+            .collect::<Vec<_>>();
+
+        assert_eq!(values, ["gpt-5.6-codex", "claude-sonnet-4-6"]);
+    }
 }
diff --git a/crates/codex-plus-core/src/protocol_proxy.rs b/crates/codex-plus-core/src/protocol_proxy.rs
index bb33106d2..13f53b847 100644
--- a/crates/codex-plus-core/src/protocol_proxy.rs
+++ b/crates/codex-plus-core/src/protocol_proxy.rs
@@ -489,8 +489,20 @@ pub fn is_audio_transcriptions_proxy_path(path: &str) -> bool {
 }
 
 const CHATGPT_CODEX_BASE_URL: &str = "https://chatgpt.com/backend-api/codex";
+/// Redirects the official (unmatched-model) route away from chatgpt.com. Used by
+/// the routing tests and by anyone pointing Codex++ at a ChatGPT-compatible
+/// gateway; unset means the real backend.
+const OFFICIAL_BASE_URL_ENV: &str = "CODEX_PLUS_OFFICIAL_BASE_URL";
 const PROXY_AUTH_PLACEHOLDER: &str = "PROXY_MANAGED";
 
+fn official_codex_base_url() -> String {
+    std::env::var(OFFICIAL_BASE_URL_ENV)
+        .ok()
+        .map(|value| value.trim().trim_end_matches('/').to_string())
+        .filter(|value| !value.is_empty())
+        .unwrap_or_else(|| CHATGPT_CODEX_BASE_URL.to_string())
+}
+
 pub async fn open_responses_proxy_request(
     body: &str,
     original_user_agent: Option<&str>,
@@ -537,7 +549,11 @@ pub async fn open_responses_proxy_request_with_client_context(
     .await
 }
 
-async fn open_responses_proxy_request_with_settings_and_client_context(
+/// Full `/v1/responses` entry point: picks the route (third-party relay vs. the
+/// native ChatGPT login) from `settings` and the request's `model`, and carries
+/// the caller's headers through so the official route can reuse Codex's own
+/// authorization.
+pub async fn open_responses_proxy_request_with_settings_and_client_context(
     body: &str,
     settings: crate::settings::BackendSettings,
     original_user_agent: Option<&str>,
@@ -801,10 +817,11 @@ fn official_responses_url(request_path: &str) -> String {
     let path = request_path
         .split_once('?')
         .map_or(request_path, |(path, _)| path);
+    let base_url = official_codex_base_url();
     if path.trim_end_matches('/').ends_with("/responses/compact") {
-        format!("{CHATGPT_CODEX_BASE_URL}/responses/compact")
+        format!("{base_url}/responses/compact")
     } else {
-        format!("{CHATGPT_CODEX_BASE_URL}/responses")
+        format!("{base_url}/responses")
     }
 }
 
@@ -4302,15 +4319,30 @@ fn is_openai_o_series(model: &str) -> bool {
 mod model_routing_tests {
     use super::*;
 
+    #[test]
+    fn official_route_defaults_to_the_chatgpt_codex_backend() {
+        assert_eq!(
+            CHATGPT_CODEX_BASE_URL,
+            "https://chatgpt.com/backend-api/codex"
+        );
+    }
+
     #[test]
     fn official_route_preserves_responses_and_compact_paths() {
+        // Resolved rather than hardcoded so a CODEX_PLUS_OFFICIAL_BASE_URL in the
+        // environment cannot turn this into a false failure.
+        let base_url = official_codex_base_url();
         assert_eq!(
             official_responses_url("/v1/responses"),
-            "https://chatgpt.com/backend-api/codex/responses"
+            format!("{base_url}/responses")
         );
         assert_eq!(
             official_responses_url("/v1/responses/compact"),
-            "https://chatgpt.com/backend-api/codex/responses/compact"
+            format!("{base_url}/responses/compact")
+        );
+        assert_eq!(
+            official_responses_url("/v1/responses/compact?stream=true"),
+            format!("{base_url}/responses/compact")
         );
     }
 
diff --git a/crates/codex-plus-core/src/relay_switch.rs b/crates/codex-plus-core/src/relay_switch.rs
index e366bf2b6..d5888b09a 100644
--- a/crates/codex-plus-core/src/relay_switch.rs
+++ b/crates/codex-plus-core/src/relay_switch.rs
@@ -29,7 +29,11 @@ pub fn switch_relay_profile_in_home(
 
     let original_settings = store.load().unwrap_or_default();
     let live_snapshot = LiveFilesSnapshot::capture(home).context("读取当前 Codex 实时配置失败")?;
-    if !previous_active_relay_id.trim().is_empty()
+    // Under per-model routing the live config.toml belongs to the router, not to
+    // the previously active profile — backfilling it would overwrite that
+    // profile's stored provider config with the router's.
+    if !selected_settings.model_routing_enabled
+        && !previous_active_relay_id.trim().is_empty()
         && previous_active_relay_id != selected_settings.active_relay_id
     {
         backfill_profile_before_switch(home, &mut selected_settings, previous_active_relay_id)?;
@@ -132,8 +136,27 @@ fn apply_selected_relay_profile(
     home: &Path,
     settings: &BackendSettings,
 ) -> anyhow::Result<RelaySwitchResult> {
-    let relay = settings.active_relay_profile();
     let common_config = relay_combined_common_config(settings);
+    // Editing or switching a provider must not knock Codex off the router; the
+    // routed provider set is rebuilt from the settings that were just saved.
+    if settings.model_routing_enabled {
+        let router = crate::relay_config::model_router_profile(settings, home);
+        let result =
+            crate::relay_config::apply_relay_profile_to_home_with_switch_rules_and_computer_use_guard(
+                home,
+                &router,
+                &common_config,
+                settings.computer_use_guard_enabled,
+            )?;
+        let status = relay_config_status_from_home(home);
+        return Ok(RelaySwitchResult {
+            settings: settings.clone(),
+            configured: status.configured,
+            backup_path: result.backup_path,
+        });
+    }
+
+    let relay = settings.active_relay_profile();
     let result = if relay.relay_mode == RelayMode::Official && !relay.official_mix_api_key {
         let auth_contents =
             (!relay.auth_contents.trim().is_empty()).then_some(relay.auth_contents.as_str());
diff --git a/crates/codex-plus-core/tests/model_catalog.rs b/crates/codex-plus-core/tests/model_catalog.rs
index 52a14d579..1989733b6 100644
--- a/crates/codex-plus-core/tests/model_catalog.rs
+++ b/crates/codex-plus-core/tests/model_catalog.rs
@@ -1,7 +1,8 @@
 use std::collections::HashMap;
 use std::io::{Read, Write};
 use std::net::TcpListener;
-use std::path::Path;
+use std::path::{Path, PathBuf};
+use std::sync::{Mutex, MutexGuard, OnceLock};
 use std::thread;
 
 use codex_plus_core::model_catalog::{
@@ -114,6 +115,7 @@ experimental_bearer_token = "ark-key"
 
 #[tokio::test]
 async fn model_catalog_uses_active_relay_profile_model_list_for_display() {
+    let _lock = codex_home_test_lock();
     let temp = tempfile::tempdir().unwrap();
     let codex_home = temp.path().join("codex-home");
     std::fs::create_dir_all(&codex_home).unwrap();
@@ -374,6 +376,179 @@ fn write_config(home: &Path, contents: &str) {
     std::fs::write(home.join("config.toml"), contents.trim_start()).unwrap();
 }
 
+/// Serializes the tests that repoint `CODEX_HOME` and the settings path, both of
+/// which are process-wide.
+fn codex_home_test_lock() -> MutexGuard<'static, ()> {
+    static LOCK: OnceLock<Mutex<()>> = OnceLock::new();
+    LOCK.get_or_init(|| Mutex::new(()))
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner())
+}
+
+struct CodexHomeGuard {
+    previous: Option<std::ffi::OsString>,
+}
+
+impl CodexHomeGuard {
+    fn set(home: &Path) -> Self {
+        let previous = std::env::var_os("CODEX_HOME");
+        unsafe {
+            std::env::set_var("CODEX_HOME", home);
+        }
+        Self { previous }
+    }
+}
+
+impl Drop for CodexHomeGuard {
+    fn drop(&mut self) {
+        match self.previous.take() {
+            Some(value) => unsafe { std::env::set_var("CODEX_HOME", value) },
+            None => unsafe { std::env::remove_var("CODEX_HOME") },
+        }
+    }
+}
+
+struct SettingsPathGuard {
+    previous: Option<PathBuf>,
+}
+
+impl SettingsPathGuard {
+    fn set(path: PathBuf) -> Self {
+        Self {
+            previous: codex_plus_core::paths::set_settings_path_for_tests(Some(path)),
+        }
+    }
+}
+
+impl Drop for SettingsPathGuard {
+    fn drop(&mut self) {
+        codex_plus_core::paths::set_settings_path_for_tests(self.previous.take());
+    }
+}
+
+/// The three profiles the routing tests share: a plain official profile plus two
+/// third-party providers, one of which pins its context window with a suffix.
+fn model_routing_profiles() -> Vec<RelayProfile> {
+    vec![
+        RelayProfile {
+            id: "official".to_string(),
+            name: "ChatGPT".to_string(),
+            relay_mode: RelayMode::Official,
+            ..RelayProfile::default()
+        },
+        RelayProfile {
+            id: "mimo".to_string(),
+            name: "MiMo".to_string(),
+            relay_mode: RelayMode::PureApi,
+            base_url: "https://mimo.test/v1".to_string(),
+            model_list: "mimo-v2.5-pro[1M]".to_string(),
+            ..RelayProfile::default()
+        },
+        RelayProfile {
+            id: "claude".to_string(),
+            name: "Claude API".to_string(),
+            relay_mode: RelayMode::PureApi,
+            base_url: "https://claude.test/v1".to_string(),
+            model_list: "claude-sonnet-4-6".to_string(),
+            ..RelayProfile::default()
+        },
+    ]
+}
+
+/// Writes the catalog the launcher generates for the router: Codex's official
+/// models merged with every routed model.
+fn write_router_catalog(codex_home: &Path) {
+    std::fs::create_dir_all(codex_home.join("model-catalogs")).unwrap();
+    std::fs::write(
+        codex_home
+            .join("model-catalogs")
+            .join("codex-plus-router.json"),
+        r#"{"models":[
+            {"slug":"gpt-5.6-codex","context_window":272000},
+            {"slug":"gpt-5.6","context_window":272000},
+            {"slug":"claude-sonnet-4-6","context_window":200000},
+            {"slug":"mimo-v2.5-pro","context_window":1000000}
+        ]}"#,
+    )
+    .unwrap();
+}
+
+#[tokio::test]
+async fn model_catalog_lists_official_and_third_party_models_when_routing_is_enabled() {
+    let _lock = codex_home_test_lock();
+    let temp = tempfile::tempdir().unwrap();
+    let codex_home = temp.path().join("codex-home");
+    std::fs::create_dir_all(&codex_home).unwrap();
+    write_router_catalog(&codex_home);
+    let settings_path = temp.path().join("settings.json");
+    let _settings_guard = SettingsPathGuard::set(settings_path.clone());
+    let _home_guard = CodexHomeGuard::set(&codex_home);
+
+    SettingsStore::new(settings_path)
+        .save(&BackendSettings {
+            model_routing_enabled: true,
+            active_relay_id: "official".to_string(),
+            relay_profiles: model_routing_profiles(),
+            ..BackendSettings::default()
+        })
+        .unwrap();
+    let result = read_codex_model_catalog().await;
+
+    assert_eq!(result["status"], "ok");
+    assert_eq!(result["model_provider"], "codex-plus-router");
+    assert_eq!(result["provider_name"], "Codex++ Model Router");
+    // Official models first, then each provider's declared models. `mimo-v2.5-pro`
+    // and `claude-sonnet-4-6` are in the generated catalog too, but the routed
+    // profile owns them, so they appear once each rather than twice.
+    assert_eq!(
+        result["models"],
+        json!([
+            "gpt-5.6-codex",
+            "gpt-5.6",
+            "mimo-v2.5-pro",
+            "claude-sonnet-4-6"
+        ])
+    );
+    assert_eq!(result["sources"][0]["type"], "official_model_catalog");
+    assert_eq!(result["sources"][0]["models"], 2);
+    assert_eq!(result["sources"][1]["type"], "model_route");
+    assert_eq!(result["sources"][1]["name"], "MiMo");
+    assert_eq!(result["sources"][2]["name"], "Claude API");
+    // The plain official profile is not a route of its own.
+    assert_eq!(result["sources"].as_array().unwrap().len(), 3);
+}
+
+#[tokio::test]
+async fn model_catalog_keeps_per_profile_behaviour_when_routing_is_disabled() {
+    let _lock = codex_home_test_lock();
+    let temp = tempfile::tempdir().unwrap();
+    let codex_home = temp.path().join("codex-home");
+    std::fs::create_dir_all(&codex_home).unwrap();
+    // Left over from a previous routing session; it must not leak into the
+    // per-profile catalog once the switch is off again.
+    write_router_catalog(&codex_home);
+    let settings_path = temp.path().join("settings.json");
+    let _settings_guard = SettingsPathGuard::set(settings_path.clone());
+    let _home_guard = CodexHomeGuard::set(&codex_home);
+
+    SettingsStore::new(settings_path)
+        .save(&BackendSettings {
+            model_routing_enabled: false,
+            active_relay_id: "mimo".to_string(),
+            relay_profiles: model_routing_profiles(),
+            ..BackendSettings::default()
+        })
+        .unwrap();
+    let result = read_codex_model_catalog().await;
+
+    assert_eq!(result["status"], "ok");
+    assert_eq!(result["model_provider"], "mimo");
+    assert_eq!(result["provider_name"], "MiMo");
+    assert_eq!(result["models"], json!(["mimo-v2.5-pro"]));
+    assert_eq!(result["sources"][0]["type"], "relay_profile_model_list");
+    assert_eq!(result["sources"].as_array().unwrap().len(), 1);
+}
+
 struct ModelsServer {
     base_url: String,
     handle: thread::JoinHandle<Vec<ModelsRequest>>,
diff --git a/crates/codex-plus-core/tests/model_routing.rs b/crates/codex-plus-core/tests/model_routing.rs
new file mode 100644
index 000000000..c953a55f5
--- /dev/null
+++ b/crates/codex-plus-core/tests/model_routing.rs
@@ -0,0 +1,474 @@
+//! End-to-end coverage for “按模型自动路由供应商” (per-model provider routing).
+//!
+//! These tests drive the real `/v1/responses` entry point against loopback
+//! upstreams so the assertions cover what actually leaves the process: which
+//! provider a model lands on, which credential that request carries, and which
+//! official path is preserved.
+
+use std::io::{Read, Write};
+use std::net::{SocketAddr, TcpListener, TcpStream};
+use std::path::PathBuf;
+use std::sync::{Mutex, MutexGuard, OnceLock};
+use std::thread;
+use std::time::{Duration, Instant};
+
+use codex_plus_core::protocol_proxy::open_responses_proxy_request_with_settings_and_client_context;
+use codex_plus_core::settings::{BackendSettings, RelayMode, RelayProfile, RelayProtocol};
+
+const JSON_RESPONSE: &str = "HTTP/1.1 200 OK\r\ncontent-type: application/json\r\ncontent-length: 35\r\nconnection: close\r\n\r\n{\"id\":\"resp_1\",\"object\":\"response\"}";
+/// Discard port: any request routed here fails fast instead of silently passing.
+const UNREACHABLE_BASE_URL: &str = "http://127.0.0.1:9/v1";
+const OFFICIAL_BASE_URL_ENV: &str = "CODEX_PLUS_OFFICIAL_BASE_URL";
+
+#[tokio::test]
+async fn matched_model_goes_to_its_provider_with_that_providers_api_key() {
+    let _lock = routing_test_lock();
+    let temp = tempfile::tempdir().unwrap();
+    let _settings_path = SettingsPathGuard::set(temp.path().join("settings.json"));
+    let upstream = MockUpstream::start();
+    let settings = routing_settings(vec![
+        third_party_profile("alpha", UNREACHABLE_BASE_URL, "sk-alpha", "alpha-model"),
+        third_party_profile(
+            "beta",
+            &format!("{}/v1", upstream.base_url()),
+            "sk-beta",
+            "beta-model\nbeta-mini",
+        ),
+    ]);
+
+    let result = open_responses_proxy_request_with_settings_and_client_context(
+        r#"{"model":"beta-model","input":"hi","stream":false}"#,
+        settings,
+        None,
+        "/v1/responses",
+        &[header("authorization", "Bearer official-token")],
+    )
+    .await
+    .unwrap();
+
+    assert_eq!(result.status_code, 200);
+    let request = upstream.finish();
+    assert_eq!(request.method, "POST");
+    assert_eq!(request.path, "/v1/responses");
+    // The provider's own key, not the ChatGPT authorization the caller sent.
+    assert_eq!(request.header("authorization"), Some("Bearer sk-beta"));
+    assert_eq!(request.json()["model"], "beta-model");
+}
+
+#[tokio::test]
+async fn model_declared_with_a_context_suffix_still_routes_to_its_provider() {
+    let _lock = routing_test_lock();
+    let temp = tempfile::tempdir().unwrap();
+    let _settings_path = SettingsPathGuard::set(temp.path().join("settings.json"));
+    let upstream = MockUpstream::start();
+    let settings = routing_settings(vec![third_party_profile(
+        "mimo",
+        &format!("{}/v1", upstream.base_url()),
+        "sk-mimo",
+        "mimo-v2.5-pro[1M]",
+    )]);
+
+    let result = open_responses_proxy_request_with_settings_and_client_context(
+        r#"{"model":"mimo-v2.5-pro","input":"hi","stream":false}"#,
+        settings,
+        None,
+        "/v1/responses",
+        &[header("authorization", "Bearer official-token")],
+    )
+    .await
+    .unwrap();
+
+    assert_eq!(result.status_code, 200);
+    assert_eq!(
+        upstream.finish().header("authorization"),
+        Some("Bearer sk-mimo")
+    );
+}
+
+#[tokio::test]
+async fn unmatched_model_forwards_the_official_authorization() {
+    let _lock = routing_test_lock();
+    let temp = tempfile::tempdir().unwrap();
+    let _settings_path = SettingsPathGuard::set(temp.path().join("settings.json"));
+    let upstream = MockUpstream::start();
+    let _official = EnvGuard::set(
+        OFFICIAL_BASE_URL_ENV,
+        &format!("{}/backend-api/codex", upstream.base_url()),
+    );
+    let settings = routing_settings(vec![third_party_profile(
+        "beta",
+        UNREACHABLE_BASE_URL,
+        "sk-beta",
+        "beta-model",
+    )]);
+
+    let result = open_responses_proxy_request_with_settings_and_client_context(
+        r#"{"model":"gpt-5.6-codex","input":"hi","stream":false}"#,
+        settings,
+        Some("codex_cli_rs/1.0"),
+        "/v1/responses",
+        &[
+            header("authorization", "Bearer official-token"),
+            header("chatgpt-account-id", "acct_1"),
+            header("originator", "codex_cli_rs"),
+            header("x-api-key", "sk-must-not-leak"),
+        ],
+    )
+    .await
+    .unwrap();
+
+    assert_eq!(result.status_code, 200);
+    let request = upstream.finish();
+    assert_eq!(request.path, "/backend-api/codex/responses");
+    assert_eq!(
+        request.header("authorization"),
+        Some("Bearer official-token")
+    );
+    assert_eq!(request.header("chatgpt-account-id"), Some("acct_1"));
+    assert_eq!(request.header("originator"), Some("codex_cli_rs"));
+    // A third-party key must never ride along to the official backend.
+    assert_eq!(request.header("x-api-key"), None);
+    assert_eq!(request.json()["model"], "gpt-5.6-codex");
+}
+
+#[tokio::test]
+async fn unmatched_model_keeps_the_compact_endpoint() {
+    let _lock = routing_test_lock();
+    let temp = tempfile::tempdir().unwrap();
+    let _settings_path = SettingsPathGuard::set(temp.path().join("settings.json"));
+    let upstream = MockUpstream::start();
+    let _official = EnvGuard::set(
+        OFFICIAL_BASE_URL_ENV,
+        &format!("{}/backend-api/codex", upstream.base_url()),
+    );
+    let settings = routing_settings(vec![third_party_profile(
+        "beta",
+        UNREACHABLE_BASE_URL,
+        "sk-beta",
+        "beta-model",
+    )]);
+
+    let result = open_responses_proxy_request_with_settings_and_client_context(
+        r#"{"model":"gpt-5.6-codex","input":"hi","stream":false}"#,
+        settings,
+        None,
+        "/v1/responses/compact",
+        &[header("authorization", "Bearer official-token")],
+    )
+    .await
+    .unwrap();
+
+    assert_eq!(result.status_code, 200);
+    assert_eq!(
+        upstream.finish().path,
+        "/backend-api/codex/responses/compact"
+    );
+}
+
+#[tokio::test]
+async fn model_bound_to_two_providers_is_rejected_with_both_names() {
+    let _lock = routing_test_lock();
+    let temp = tempfile::tempdir().unwrap();
+    let _settings_path = SettingsPathGuard::set(temp.path().join("settings.json"));
+    let settings = routing_settings(vec![
+        third_party_profile("provider-a", UNREACHABLE_BASE_URL, "sk-a", "shared-model"),
+        third_party_profile("provider-b", UNREACHABLE_BASE_URL, "sk-b", "shared-model"),
+    ]);
+
+    let error = open_responses_proxy_request_with_settings_and_client_context(
+        r#"{"model":"shared-model","input":"hi","stream":false}"#,
+        settings,
+        None,
+        "/v1/responses",
+        &[header("authorization", "Bearer official-token")],
+    )
+    .await
+    .err()
+    .expect("a model bound to two providers must not be routed")
+    .to_string();
+
+    assert!(error.contains("同时存在于多个供应商"), "{error}");
+    assert!(error.contains("provider-a"), "{error}");
+    assert!(error.contains("provider-b"), "{error}");
+}
+
+#[tokio::test]
+async fn official_route_reports_a_missing_or_placeholder_chatgpt_login() {
+    let _lock = routing_test_lock();
+    let temp = tempfile::tempdir().unwrap();
+    let _settings_path = SettingsPathGuard::set(temp.path().join("settings.json"));
+    let profiles = vec![third_party_profile(
+        "beta",
+        UNREACHABLE_BASE_URL,
+        "sk-beta",
+        "beta-model",
+    )];
+
+    let missing = open_responses_proxy_request_with_settings_and_client_context(
+        r#"{"model":"gpt-5.6-codex","input":"hi","stream":false}"#,
+        routing_settings(profiles.clone()),
+        None,
+        "/v1/responses",
+        &[],
+    )
+    .await
+    .err()
+    .expect("the official route must refuse a request with no authorization")
+    .to_string();
+    assert!(
+        missing.contains("请先在 Codex 中完成 ChatGPT 登录"),
+        "{missing}"
+    );
+
+    let placeholder = open_responses_proxy_request_with_settings_and_client_context(
+        r#"{"model":"gpt-5.6-codex","input":"hi","stream":false}"#,
+        routing_settings(profiles),
+        None,
+        "/v1/responses",
+        &[header("authorization", "Bearer PROXY_MANAGED")],
+    )
+    .await
+    .err()
+    .expect("the official route must refuse the proxy placeholder credential")
+    .to_string();
+    assert!(
+        placeholder.contains("重新加载官方登录认证"),
+        "{placeholder}"
+    );
+}
+
+#[tokio::test]
+async fn routing_disabled_keeps_the_active_profile_for_every_model() {
+    let _lock = routing_test_lock();
+    let temp = tempfile::tempdir().unwrap();
+    let _settings_path = SettingsPathGuard::set(temp.path().join("settings.json"));
+    let upstream = MockUpstream::start();
+    let settings = BackendSettings {
+        model_routing_enabled: false,
+        active_relay_id: "alpha".to_string(),
+        ..routing_settings(vec![
+            third_party_profile(
+                "alpha",
+                &format!("{}/v1", upstream.base_url()),
+                "sk-alpha",
+                "alpha-model",
+            ),
+            third_party_profile("beta", UNREACHABLE_BASE_URL, "sk-beta", "beta-model"),
+        ])
+    };
+
+    // "beta-model" belongs to the beta profile, but with routing off the active
+    // profile still owns the request — the pre-existing per-profile behaviour.
+    let result = open_responses_proxy_request_with_settings_and_client_context(
+        r#"{"model":"beta-model","input":"hi","stream":false}"#,
+        settings,
+        None,
+        "/v1/responses",
+        &[header("authorization", "Bearer official-token")],
+    )
+    .await
+    .unwrap();
+
+    assert_eq!(result.status_code, 200);
+    assert_eq!(
+        upstream.finish().header("authorization"),
+        Some("Bearer sk-alpha")
+    );
+}
+
+fn routing_settings(relay_profiles: Vec<RelayProfile>) -> BackendSettings {
+    BackendSettings {
+        model_routing_enabled: true,
+        relay_profiles_enabled: true,
+        relay_profiles,
+        ..BackendSettings::default()
+    }
+}
+
+fn third_party_profile(id: &str, base_url: &str, api_key: &str, model_list: &str) -> RelayProfile {
+    RelayProfile {
+        id: id.to_string(),
+        name: id.to_string(),
+        base_url: base_url.to_string(),
+        api_key: api_key.to_string(),
+        protocol: RelayProtocol::Responses,
+        relay_mode: RelayMode::PureApi,
+        model_list: model_list.to_string(),
+        ..RelayProfile::default()
+    }
+}
+
+fn header(name: &str, value: &str) -> (String, String) {
+    (name.to_string(), value.to_string())
+}
+
+/// Serializes the tests: they share the process-wide settings path and the
+/// official base URL environment variable.
+fn routing_test_lock() -> MutexGuard<'static, ()> {
+    static LOCK: OnceLock<Mutex<()>> = OnceLock::new();
+    LOCK.get_or_init(|| Mutex::new(()))
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner())
+}
+
+struct SettingsPathGuard {
+    previous: Option<PathBuf>,
+}
+
+impl SettingsPathGuard {
+    fn set(path: PathBuf) -> Self {
+        Self {
+            previous: codex_plus_core::paths::set_settings_path_for_tests(Some(path)),
+        }
+    }
+}
+
+impl Drop for SettingsPathGuard {
+    fn drop(&mut self) {
+        codex_plus_core::paths::set_settings_path_for_tests(self.previous.take());
+    }
+}
+
+struct EnvGuard {
+    key: &'static str,
+    previous: Option<String>,
+}
+
+impl EnvGuard {
+    fn set(key: &'static str, value: &str) -> Self {
+        let previous = std::env::var(key).ok();
+        unsafe {
+            std::env::set_var(key, value);
+        }
+        Self { key, previous }
+    }
+}
+
+impl Drop for EnvGuard {
+    fn drop(&mut self) {
+        match self.previous.take() {
+            Some(value) => unsafe { std::env::set_var(self.key, value) },
+            None => unsafe { std::env::remove_var(self.key) },
+        }
+    }
+}
+
+struct MockUpstream {
+    address: SocketAddr,
+    handle: thread::JoinHandle<RecordedRequest>,
+}
+
+impl MockUpstream {
+    fn start() -> Self {
+        let listener = TcpListener::bind(("127.0.0.1", 0)).unwrap();
+        let address = listener.local_addr().unwrap();
+        listener.set_nonblocking(true).unwrap();
+        let handle = thread::spawn(move || {
+            let started = Instant::now();
+            let mut stream = loop {
+                match listener.accept() {
+                    Ok((stream, _)) => break stream,
+                    Err(error) if error.kind() == std::io::ErrorKind::WouldBlock => {
+                        assert!(
+                            started.elapsed() < Duration::from_secs(10),
+                            "test upstream did not receive a request"
+                        );
+                        thread::sleep(Duration::from_millis(10));
+                    }
+                    Err(error) => panic!("failed to accept test request: {error}"),
+                }
+            };
+            stream.set_nonblocking(false).unwrap();
+            stream
+                .set_read_timeout(Some(Duration::from_secs(10)))
+                .unwrap();
+            let raw = read_request(&mut stream);
+            stream.write_all(JSON_RESPONSE.as_bytes()).unwrap();
+            stream.flush().unwrap();
+            parse_request(&raw)
+        });
+        Self { address, handle }
+    }
+
+    fn base_url(&self) -> String {
+        format!("http://{}", self.address)
+    }
+
+    fn finish(self) -> RecordedRequest {
+        self.handle.join().unwrap()
+    }
+}
+
+struct RecordedRequest {
+    method: String,
+    path: String,
+    headers: Vec<(String, String)>,
+    body: String,
+}
+
+impl RecordedRequest {
+    fn header(&self, name: &str) -> Option<&str> {
+        self.headers
+            .iter()
+            .find(|(header_name, _)| header_name == name)
+            .map(|(_, value)| value.as_str())
+    }
+
+    fn json(&self) -> serde_json::Value {
+        serde_json::from_str(&self.body).expect("test upstream received a non-JSON body")
+    }
+}
+
+fn read_request(stream: &mut TcpStream) -> Vec<u8> {
+    let mut raw = Vec::new();
+    let mut chunk = [0u8; 4096];
+    loop {
+        let read = stream
+            .read(&mut chunk)
+            .expect("failed to read test request");
+        if read == 0 {
+            break;
+        }
+        raw.extend_from_slice(&chunk[..read]);
+        let Some(header_end) = find_header_end(&raw) else {
+            continue;
+        };
+        let head = String::from_utf8_lossy(&raw[..header_end]).to_string();
+        let content_length = head
+            .lines()
+            .filter_map(|line| line.split_once(':'))
+            .find(|(name, _)| name.eq_ignore_ascii_case("content-length"))
+            .and_then(|(_, value)| value.trim().parse::<usize>().ok())
+            .unwrap_or(0);
+        if raw.len() >= header_end + 4 + content_length {
+            break;
+        }
+    }
+    raw
+}
+
+fn find_header_end(raw: &[u8]) -> Option<usize> {
+    raw.windows(4).position(|window| window == b"\r\n\r\n")
+}
+
+fn parse_request(raw: &[u8]) -> RecordedRequest {
+    let header_end = find_header_end(raw).expect("test upstream received a truncated request");
+    let head = String::from_utf8_lossy(&raw[..header_end]).to_string();
+    let body = String::from_utf8_lossy(&raw[header_end + 4..]).to_string();
+    let mut lines = head.lines();
+    let mut request_line = lines.next().unwrap_or_default().split_whitespace();
+    let method = request_line.next().unwrap_or_default().to_string();
+    let path = request_line.next().unwrap_or_default().to_string();
+    let headers = lines
+        .filter_map(|line| {
+            let (name, value) = line.split_once(':')?;
+            Some((name.trim().to_ascii_lowercase(), value.trim().to_string()))
+        })
+        .collect();
+    RecordedRequest {
+        method,
+        path,
+        headers,
+        body,
+    }
+}
diff --git a/crates/codex-plus-core/tests/relay_switch.rs b/crates/codex-plus-core/tests/relay_switch.rs
index d9170ae6a..380809a45 100644
--- a/crates/codex-plus-core/tests/relay_switch.rs
+++ b/crates/codex-plus-core/tests/relay_switch.rs
@@ -360,6 +360,106 @@ fn switch_captures_safe_app_state_before_writing_provider_config() {
     );
 }
 
+#[test]
+fn switch_keeps_codex_on_the_router_while_model_routing_is_enabled() {
+    let temp = tempfile::tempdir().unwrap();
+    let home = temp.path().join("codex");
+    std::fs::create_dir(&home).unwrap();
+    // What the launcher left behind: Codex pointed at the local router.
+    std::fs::write(
+        home.join("config.toml"),
+        r#"model = "claude-sonnet-4-6"
+model_provider = "codex-plus-router"
+
+[model_providers.codex-plus-router]
+name = "Codex++ Model Router"
+wire_api = "responses"
+requires_openai_auth = true
+base_url = "http://127.0.0.1:57321/v1"
+"#,
+    )
+    .unwrap();
+    let store = SettingsStore::new(temp.path().join("settings.json"));
+    let profiles = vec![
+        pure_profile("a", "https://a.example/v1", "sk-a"),
+        pure_profile("b", "https://b.example/v1", "sk-b"),
+    ];
+    let original = BackendSettings {
+        model_routing_enabled: true,
+        active_relay_id: "a".to_string(),
+        relay_profiles: profiles.clone(),
+        ..BackendSettings::default()
+    };
+    store.save(&original).unwrap();
+    let next = BackendSettings {
+        model_routing_enabled: true,
+        active_relay_id: "b".to_string(),
+        relay_profiles: profiles,
+        ..BackendSettings::default()
+    };
+
+    let result = switch_relay_profile_in_home(&store, &home, next, "a").unwrap();
+    let live = std::fs::read_to_string(home.join("config.toml")).unwrap();
+    let stored = store.load().unwrap();
+    let previous = stored
+        .relay_profiles
+        .iter()
+        .find(|profile| profile.id == "a")
+        .unwrap();
+
+    assert!(result.configured);
+    assert!(live.contains(r#"model_provider = "codex-plus-router""#));
+    assert!(live.contains(r#"base_url = "http://127.0.0.1:57321/v1""#));
+    // The router's live config must not be backfilled onto the profile it replaced.
+    assert!(previous.config_contents.contains("https://a.example/v1"));
+    assert!(!previous.config_contents.contains("codex-plus-router"));
+}
+
+#[test]
+fn switch_restores_per_profile_config_after_model_routing_is_turned_off() {
+    let temp = tempfile::tempdir().unwrap();
+    let home = temp.path().join("codex");
+    std::fs::create_dir(&home).unwrap();
+    std::fs::write(
+        home.join("config.toml"),
+        r#"model_provider = "codex-plus-router"
+
+[model_providers.codex-plus-router]
+name = "Codex++ Model Router"
+wire_api = "responses"
+requires_openai_auth = true
+base_url = "http://127.0.0.1:57321/v1"
+"#,
+    )
+    .unwrap();
+    let store = SettingsStore::new(temp.path().join("settings.json"));
+    let profiles = vec![
+        pure_profile("a", "https://a.example/v1", "sk-a"),
+        pure_profile("b", "https://b.example/v1", "sk-b"),
+    ];
+    store
+        .save(&BackendSettings {
+            model_routing_enabled: true,
+            active_relay_id: "a".to_string(),
+            relay_profiles: profiles.clone(),
+            ..BackendSettings::default()
+        })
+        .unwrap();
+    let next = BackendSettings {
+        model_routing_enabled: false,
+        active_relay_id: "b".to_string(),
+        relay_profiles: profiles,
+        ..BackendSettings::default()
+    };
+
+    let result = switch_relay_profile_in_home(&store, &home, next, "a").unwrap();
+    let live = std::fs::read_to_string(home.join("config.toml")).unwrap();
+
+    assert!(result.configured);
+    assert!(live.contains(r#"base_url = "https://b.example/v1""#));
+    assert!(!live.contains("codex-plus-router"));
+}
+
 fn pure_profile(id: &str, base_url: &str, key: &str) -> RelayProfile {
     RelayProfile {
         id: id.to_string(),

From 2fa95e8341774437af2706bf51a0034687c4ed71 Mon Sep 17 00:00:00 2001
From: 121103qwq <121103qwq@users.noreply.github.com>
Date: Mon, 27 Jul 2026 00:32:48 +0800
Subject: [PATCH 3/6] feat(routing): fall back to the first provider for a
 duplicated model
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Relay APIs commonly resell the same model, so several providers declaring
e.g. claude-sonnet-4-6 is a normal setup rather than a misconfiguration.
relay_profile_for_model used to bail out and fail the whole request; it
now takes the first match in relay_profiles order — the same one the model
catalog already collapses the duplicate slug onto — and records the
shadowed providers as model_routing.duplicate_model_binding in the
diagnostic log so an unexpected choice stays traceable. Reordering the
provider list is how the user picks the winner.

The function can no longer fail, so it returns Option instead of Result.

Also adds an end-to-end test that the per-provider upstream protocol
toggle still applies under routing: a Chat Completions provider gets
/v1/chat/completions with a converted `messages` body and its own key,
while other providers stay on Responses.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/codex-plus-core/src/protocol_proxy.rs  |   2 +-
 crates/codex-plus-core/src/settings.rs        | 100 +++++++++++-------
 crates/codex-plus-core/tests/model_routing.rs |  74 +++++++++++--
 3 files changed, 128 insertions(+), 48 deletions(-)

diff --git a/crates/codex-plus-core/src/protocol_proxy.rs b/crates/codex-plus-core/src/protocol_proxy.rs
index 13f53b847..66db3cd57 100644
--- a/crates/codex-plus-core/src/protocol_proxy.rs
+++ b/crates/codex-plus-core/src/protocol_proxy.rs
@@ -571,7 +571,7 @@ pub async fn open_responses_proxy_request_with_settings_and_client_context(
             .get("model")
             .and_then(Value::as_str)
             .unwrap_or_default();
-        match settings.relay_profile_for_model(model)? {
+        match settings.relay_profile_for_model(model) {
             Some(relay) => vec![relay],
             None => {
                 return open_official_responses_proxy_request(
diff --git a/crates/codex-plus-core/src/settings.rs b/crates/codex-plus-core/src/settings.rs
index 6c9d5298f..ad5e310d0 100644
--- a/crates/codex-plus-core/src/settings.rs
+++ b/crates/codex-plus-core/src/settings.rs
@@ -660,17 +660,23 @@ impl BackendSettings {
             .cloned()
     }
 
-    /// Resolve a model to exactly one ordinary third-party relay profile.
+    /// Resolve a model to the third-party relay profile that serves it.
     ///
     /// `model_list` is the routing declaration: one model slug per line. Plain
     /// official profiles are intentionally excluded so an unmatched model can
     /// fall back to the native ChatGPT/Codex login route. Aggregate profiles are
     /// also excluded here to avoid proxy recursion through the same local port.
-    pub fn relay_profile_for_model(&self, model: &str) -> anyhow::Result<Option<RelayProfile>> {
+    ///
+    /// Relay APIs commonly resell the same model, so several providers declaring
+    /// e.g. `claude-sonnet-4-6` is expected rather than a configuration error.
+    /// The first match in `relay_profiles` order wins — the same one the model
+    /// catalog already collapses the duplicate slug onto — and the providers it
+    /// shadows go to the diagnostic log so an unexpected choice stays traceable.
+    pub fn relay_profile_for_model(&self, model: &str) -> Option<RelayProfile> {
         let (model, _) = crate::model_suffix::parse_model_suffix(model);
         let model = model.trim();
         if model.is_empty() {
-            return Ok(None);
+            return None;
         }
 
         let mut matches = self
@@ -689,28 +695,22 @@ impl BackendSettings {
                     .filter(|value| !value.is_empty())
                     .map(crate::model_suffix::parse_model_suffix)
                     .any(|(slug, _)| slug == model)
-            })
-            .cloned()
-            .collect::<Vec<_>>();
+            });
 
-        match matches.len() {
-            0 => Ok(None),
-            1 => Ok(matches.pop()),
-            _ => {
-                let names = matches
-                    .iter()
-                    .map(|profile| {
-                        if profile.name.trim().is_empty() {
-                            profile.id.as_str()
-                        } else {
-                            profile.name.as_str()
-                        }
-                    })
-                    .collect::<Vec<_>>()
-                    .join("、");
-                anyhow::bail!("模型 {model} 同时存在于多个供应商中：{names}")
-            }
+        let selected = matches.next()?;
+        let shadowed = matches.map(relay_profile_label).collect::<Vec<_>>();
+        if !shadowed.is_empty() {
+            let _ = crate::diagnostic_log::append_diagnostic_log(
+                "model_routing.duplicate_model_binding",
+                serde_json::json!({
+                    "model": model,
+                    "selectedId": selected.id,
+                    "selected": relay_profile_label(selected),
+                    "shadowed": shadowed,
+                }),
+            );
         }
+        Some(selected.clone())
     }
 
     pub fn active_relay_uses_protocol_proxy(&self) -> bool {
@@ -720,6 +720,15 @@ impl BackendSettings {
     }
 }
 
+/// Human-facing name for a relay profile, falling back to its id.
+fn relay_profile_label(profile: &RelayProfile) -> &str {
+    if profile.name.trim().is_empty() {
+        profile.id.as_str()
+    } else {
+        profile.name.as_str()
+    }
+}
+
 pub fn default_stepwise_api_key_env() -> String {
     "CODEX_STEPWISE_API_KEY".to_string()
 }
@@ -2558,20 +2567,14 @@ experimental_bearer_token = "sk-existing""#
 
         let relay = settings
             .relay_profile_for_model("claude-sonnet-4-6")
-            .unwrap()
             .unwrap();
         assert_eq!(relay.id, "claude");
-        assert!(
-            settings
-                .relay_profile_for_model("gpt-5.6")
-                .unwrap()
-                .is_none()
-        );
+        assert!(settings.relay_profile_for_model("gpt-5.6").is_none());
         assert!(settings.active_relay_uses_protocol_proxy());
     }
 
     #[test]
-    fn model_routing_ignores_plain_official_profile_and_rejects_duplicates() {
+    fn model_routing_ignores_plain_official_profile_and_prefers_the_first_duplicate() {
         let settings = BackendSettings {
             model_routing_enabled: true,
             relay_profiles: vec![
@@ -2601,15 +2604,38 @@ experimental_bearer_token = "sk-existing""#
             ..BackendSettings::default()
         };
 
-        assert!(
+        // The plain official profile never captures a model.
+        assert!(settings.relay_profile_for_model("gpt-5.6").is_none());
+        // Both A and B resell "same-model"; the earlier profile wins.
+        assert_eq!(
+            settings.relay_profile_for_model("same-model").unwrap().id,
+            "a"
+        );
+    }
+
+    #[test]
+    fn model_routing_duplicate_winner_follows_relay_profile_order() {
+        let profile = |id: &str| RelayProfile {
+            id: id.to_string(),
+            name: id.to_uppercase(),
+            relay_mode: RelayMode::PureApi,
+            model_list: "claude-sonnet-4-6".to_string(),
+            ..RelayProfile::default()
+        };
+        let settings = BackendSettings {
+            model_routing_enabled: true,
+            relay_profiles: vec![profile("b"), profile("a")],
+            ..BackendSettings::default()
+        };
+
+        // Reordering the provider list is how the user picks the winner.
+        assert_eq!(
             settings
-                .relay_profile_for_model("gpt-5.6")
+                .relay_profile_for_model("claude-sonnet-4-6")
                 .unwrap()
-                .is_none()
+                .id,
+            "b"
         );
-        let error = settings.relay_profile_for_model("same-model").unwrap_err();
-        assert!(error.to_string().contains("Provider A"));
-        assert!(error.to_string().contains("Provider B"));
     }
 
     #[test]
diff --git a/crates/codex-plus-core/tests/model_routing.rs b/crates/codex-plus-core/tests/model_routing.rs
index c953a55f5..c9fd7118f 100644
--- a/crates/codex-plus-core/tests/model_routing.rs
+++ b/crates/codex-plus-core/tests/model_routing.rs
@@ -12,7 +12,9 @@ use std::sync::{Mutex, MutexGuard, OnceLock};
 use std::thread;
 use std::time::{Duration, Instant};
 
-use codex_plus_core::protocol_proxy::open_responses_proxy_request_with_settings_and_client_context;
+use codex_plus_core::protocol_proxy::{
+    UpstreamWireApi, open_responses_proxy_request_with_settings_and_client_context,
+};
 use codex_plus_core::settings::{BackendSettings, RelayMode, RelayProfile, RelayProtocol};
 
 const JSON_RESPONSE: &str = "HTTP/1.1 200 OK\r\ncontent-type: application/json\r\ncontent-length: 35\r\nconnection: close\r\n\r\n{\"id\":\"resp_1\",\"object\":\"response\"}";
@@ -85,6 +87,51 @@ async fn model_declared_with_a_context_suffix_still_routes_to_its_provider() {
     );
 }
 
+#[tokio::test]
+async fn routed_provider_keeps_its_own_upstream_protocol() {
+    let _lock = routing_test_lock();
+    let temp = tempfile::tempdir().unwrap();
+    let _settings_path = SettingsPathGuard::set(temp.path().join("settings.json"));
+    let chat_upstream = MockUpstream::start();
+    let settings = routing_settings(vec![
+        RelayProfile {
+            protocol: RelayProtocol::ChatCompletions,
+            ..third_party_profile(
+                "chat",
+                &format!("{}/v1", chat_upstream.base_url()),
+                "sk-chat",
+                "chat-only-model",
+            )
+        },
+        third_party_profile(
+            "responses",
+            UNREACHABLE_BASE_URL,
+            "sk-responses",
+            "responses-model",
+        ),
+    ]);
+
+    let result = open_responses_proxy_request_with_settings_and_client_context(
+        r#"{"model":"chat-only-model","input":"hi","stream":false}"#,
+        settings,
+        None,
+        "/v1/responses",
+        &[header("authorization", "Bearer official-token")],
+    )
+    .await
+    .unwrap();
+
+    // The per-provider 上游协议 toggle still decides the wire format under routing.
+    assert_eq!(result.wire_api, UpstreamWireApi::ChatCompletions);
+    let request = chat_upstream.finish();
+    assert_eq!(request.path, "/v1/chat/completions");
+    assert_eq!(request.header("authorization"), Some("Bearer sk-chat"));
+    let body = request.json();
+    assert_eq!(body["model"], "chat-only-model");
+    assert!(body["messages"].is_array(), "{body}");
+    assert!(body.get("input").is_none(), "{body}");
+}
+
 #[tokio::test]
 async fn unmatched_model_forwards_the_official_authorization() {
     let _lock = routing_test_lock();
@@ -166,16 +213,23 @@ async fn unmatched_model_keeps_the_compact_endpoint() {
 }
 
 #[tokio::test]
-async fn model_bound_to_two_providers_is_rejected_with_both_names() {
+async fn model_sold_by_two_relays_goes_to_the_first_one_listed() {
     let _lock = routing_test_lock();
     let temp = tempfile::tempdir().unwrap();
     let _settings_path = SettingsPathGuard::set(temp.path().join("settings.json"));
+    let upstream = MockUpstream::start();
+    // Relay APIs commonly resell the same model; that must not fail the request.
     let settings = routing_settings(vec![
-        third_party_profile("provider-a", UNREACHABLE_BASE_URL, "sk-a", "shared-model"),
+        third_party_profile(
+            "provider-a",
+            &format!("{}/v1", upstream.base_url()),
+            "sk-a",
+            "shared-model",
+        ),
         third_party_profile("provider-b", UNREACHABLE_BASE_URL, "sk-b", "shared-model"),
     ]);
 
-    let error = open_responses_proxy_request_with_settings_and_client_context(
+    let result = open_responses_proxy_request_with_settings_and_client_context(
         r#"{"model":"shared-model","input":"hi","stream":false}"#,
         settings,
         None,
@@ -183,13 +237,13 @@ async fn model_bound_to_two_providers_is_rejected_with_both_names() {
         &[header("authorization", "Bearer official-token")],
     )
     .await
-    .err()
-    .expect("a model bound to two providers must not be routed")
-    .to_string();
+    .unwrap();
 
-    assert!(error.contains("同时存在于多个供应商"), "{error}");
-    assert!(error.contains("provider-a"), "{error}");
-    assert!(error.contains("provider-b"), "{error}");
+    assert_eq!(result.status_code, 200);
+    assert_eq!(
+        upstream.finish().header("authorization"),
+        Some("Bearer sk-a")
+    );
 }
 
 #[tokio::test]

From 337b58db79db4b167b4aa5e28aba4534e0997672 Mon Sep 17 00:00:00 2001
From: 121103qwq <121103qwq@users.noreply.github.com>
Date: Mon, 27 Jul 2026 21:16:05 +0800
Subject: [PATCH 4/6] fix(routing): keep live router while editing providers

---
 .../src-tauri/tests/windows_subsystem.rs      | 11 +++++++++
 apps/codex-plus-manager/src/App.tsx           | 24 ++++++++++++-------
 2 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/apps/codex-plus-manager/src-tauri/tests/windows_subsystem.rs b/apps/codex-plus-manager/src-tauri/tests/windows_subsystem.rs
index 51fe563a7..f7944a8d5 100644
--- a/apps/codex-plus-manager/src-tauri/tests/windows_subsystem.rs
+++ b/apps/codex-plus-manager/src-tauri/tests/windows_subsystem.rs
@@ -365,3 +365,14 @@ fn manager_update_install_keeps_visible_progress_bar() {
     assert!(app_tsx.contains("completedTitle={t(\"上次更新结果\")}"));
     assert!(app_tsx.contains("progress={updateInstallProgress}"));
 }
+
+#[test]
+fn model_routing_provider_edits_keep_the_live_router_config() {
+    let manifest_dir = std::path::Path::new(env!("CARGO_MANIFEST_DIR"));
+    let app_tsx = manifest_dir.parent().unwrap().join("src/App.tsx");
+    let app_tsx = std::fs::read_to_string(&app_tsx).expect("read manager App.tsx");
+
+    assert!(app_tsx.contains("if (!switchSettings.modelRoutingEnabled)"));
+    assert!(app_tsx.contains("if (form.modelRoutingEnabled)"));
+    assert!(app_tsx.contains("await actions.switchRelayProfile(next, form.activeRelayId)"));
+}
diff --git a/apps/codex-plus-manager/src/App.tsx b/apps/codex-plus-manager/src/App.tsx
index 9c9533011..79b6ec225 100644
--- a/apps/codex-plus-manager/src/App.tsx
+++ b/apps/codex-plus-manager/src/App.tsx
@@ -2208,7 +2208,9 @@ export function App() {
       showNotice(t("供应商配置可能不正确"), validationError, "failed");
       return;
     }
-    switchSettings = await snapshotActiveRelayFilesBeforeSwitch(switchSettings, previousActiveRelayId);
+    if (!switchSettings.modelRoutingEnabled) {
+      switchSettings = await snapshotActiveRelayFilesBeforeSwitch(switchSettings, previousActiveRelayId);
+    }
     const selectedAfterSave = activeRelayProfile(switchSettings);
     const command = relayProfileSwitchCommand(selectedAfterSave);
 
@@ -5393,14 +5395,18 @@ function RelayProfileDetail({
     const next = isNew
       ? addRelayProfile(form, normalizedDraft)
       : updateRelayProfile(form, profile.id, normalizedDraft);
-    await onFormChange(next);
-    if (isActive && relayProfileUsesLiveFiles(normalizedDraft)) {
-      await actions.saveRelayFile(
-        "config",
-        effectiveRelayConfigPreview(normalizedDraft, form, normalizedDraft),
-        true,
-      );
-      await actions.saveRelayFile("auth", normalizedDraft.authContents, true);
+    if (form.modelRoutingEnabled) {
+      await actions.switchRelayProfile(next, form.activeRelayId);
+    } else {
+      await onFormChange(next);
+      if (isActive && relayProfileUsesLiveFiles(normalizedDraft)) {
+        await actions.saveRelayFile(
+          "config",
+          effectiveRelayConfigPreview(normalizedDraft, form, normalizedDraft),
+          true,
+        );
+        await actions.saveRelayFile("auth", normalizedDraft.authContents, true);
+      }
     }
     onSaved?.();
   };

From 31711bd5d4d9a89566e2f14aa71d473a5e54be34 Mon Sep 17 00:00:00 2001
From: 121103qwq <121103qwq@users.noreply.github.com>
Date: Sat, 1 Aug 2026 03:15:57 +0800
Subject: [PATCH 5/6] fix(routing): restore provider after disabling model
 router

---
 crates/codex-plus-core/src/launcher.rs        | 33 ++++++++++++++++++-
 .../tests/upstream_theme_assets.rs            |  2 +-
 2 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/crates/codex-plus-core/src/launcher.rs b/crates/codex-plus-core/src/launcher.rs
index f1b937f59..756f0c893 100644
--- a/crates/codex-plus-core/src/launcher.rs
+++ b/crates/codex-plus-core/src/launcher.rs
@@ -144,6 +144,9 @@ pub trait LaunchHooks: Send + Sync {
     fn select_debug_port(&self, requested: u16) -> u16;
     fn select_helper_port(&self, requested: u16) -> u16;
     async fn load_settings(&self) -> anyhow::Result<BackendSettings>;
+    async fn live_config_uses_model_router(&self) -> bool {
+        false
+    }
     async fn run_provider_sync(&self) -> anyhow::Result<()>;
     async fn apply_active_relay_profile(&self, _settings: &BackendSettings) -> anyhow::Result<()> {
         Ok(())
@@ -322,7 +325,10 @@ where
                 );
             }
         }
-        if settings.model_routing_enabled {
+        let restore_previous_profile = settings.relay_profiles_enabled
+            && !settings.model_routing_enabled
+            && hooks.live_config_uses_model_router().await;
+        if settings.model_routing_enabled || restore_previous_profile {
             hooks.apply_active_relay_profile(&settings).await?;
         }
         let protocol_proxy_enabled = relay_protocol_proxy_enabled(&settings)
@@ -547,6 +553,10 @@ impl LaunchHooks for DefaultLaunchHooks {
         SettingsStore::default().load()
     }
 
+    async fn live_config_uses_model_router(&self) -> bool {
+        live_config_uses_model_router(&crate::relay_config::default_codex_home_dir())
+    }
+
     async fn run_provider_sync(&self) -> anyhow::Result<()> {
         anyhow::bail!("provider sync requires launcher hooks with codex-plus-data integration")
     }
@@ -2406,6 +2416,16 @@ fn should_probe_launcher_cdp(is_windows: bool, has_codex_process: bool) -> bool
     is_windows && !has_codex_process
 }
 
+fn live_config_uses_model_router(home: &Path) -> bool {
+    std::fs::read_to_string(home.join("config.toml"))
+        .ok()
+        .and_then(|contents| toml::from_str::<toml::Value>(&contents).ok())
+        .is_some_and(|document| {
+            document.get("model_provider").and_then(toml::Value::as_str)
+                == Some("codex-plus-router")
+        })
+}
+
 async fn check_and_reinject_bridge_inner(
     debug_port: u16,
     helper_port: u16,
@@ -3171,6 +3191,17 @@ mod tests {
         assert!(!should_probe_launcher_cdp(false, false));
     }
 
+    #[test]
+    fn detects_stale_model_router_config() {
+        let temp = tempfile::tempdir().unwrap();
+        let config = temp.path().join("config.toml");
+        std::fs::write(&config, "model_provider = \"codex-plus-router\"\n").unwrap();
+        assert!(live_config_uses_model_router(temp.path()));
+
+        std::fs::write(&config, "model_provider = \"custom\"\n").unwrap();
+        assert!(!live_config_uses_model_router(temp.path()));
+    }
+
     #[tokio::test]
     async fn bridge_reinjector_prefers_launcher_callback() {
         let launcher_calls = Arc::new(AtomicUsize::new(0));
diff --git a/crates/codex-plus-core/tests/upstream_theme_assets.rs b/crates/codex-plus-core/tests/upstream_theme_assets.rs
index 4c995b1e5..f81715b16 100644
--- a/crates/codex-plus-core/tests/upstream_theme_assets.rs
+++ b/crates/codex-plus-core/tests/upstream_theme_assets.rs
@@ -31,7 +31,7 @@ fn bundled_target_renderers_and_styles_remain_byte_exact() {
         ),
         (
             "assets/inject/upstream/dream-skin/macos/dream-skin.css",
-            "BBC44EBE8EEAA6A8F25BB00559C30294816FB185A86CD2BD425E061BFF57E05F",
+            "EC3C3BC5F6E10E20A3F2307796BD1E1350E80E5D23D37318EE5468833C95A6DF",
         ),
         (
             "assets/inject/upstream/cidala-tiger/windows/renderer-inject.js",

From 3f54a6c8535906474cd41ebd1b2c5e25d39c7bc5 Mon Sep 17 00:00:00 2001
From: 121103qwq <121103qwq@users.noreply.github.com>
Date: Sat, 1 Aug 2026 03:34:11 +0800
Subject: [PATCH 6/6] test: update normalized cidala theme asset hash

---
 crates/codex-plus-core/tests/upstream_theme_assets.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/codex-plus-core/tests/upstream_theme_assets.rs b/crates/codex-plus-core/tests/upstream_theme_assets.rs
index f81715b16..b1786386c 100644
--- a/crates/codex-plus-core/tests/upstream_theme_assets.rs
+++ b/crates/codex-plus-core/tests/upstream_theme_assets.rs
@@ -47,7 +47,7 @@ fn bundled_target_renderers_and_styles_remain_byte_exact() {
         ),
         (
             "assets/inject/upstream/cidala-tiger/macos/dream-skin.css",
-            "662B04F2E74570770394E3D6F012F6B5952C50E55A1AD47B1577161F860D775D",
+            "5E149E9A13985961C5F3125296178ACB2ABF0B528974F1E616AA625970430562",
         ),
         (
             "assets/inject/upstream/snow-skin/renderer-inject.js",