fix: codexgo binary honors custom/real model providers from config (closes drop-in gap)

buildAssembly previously always used CreateOpenAIProvider(nil) + OPENAI_API_KEY,
ignoring config's model_provider selection, custom [model_providers.*] base_url, and
env_key — so 'codex exec' against a custom provider silently fell back to the mock.

- internal/cli/config_load.go: project selected provider id, [model_providers] map,
  default model, openai_base_url from the merged config (-c/profile already folded).
- internal/cli/provider_select.go (new): resolve the active provider (merge configured
  onto built-ins, validate), env_key bearer auth resolver; mock only when no
  credential resolves.
- internal/cli/assembly.go: build api.Provider for the SELECTED provider (custom
  base_url/wire_api/headers honored), pick auth resolver per requires_openai_auth,
  honor model selection, thread provider id+model into appserver.Defaults.
- cmd_exec/review/default/app_server consume resolved Defaults.
- internal/paritytest TestParityTurnExec upgraded to BINARY-vs-BINARY: the codexgo
  binary now actually contacts the fake endpoint (not the mock) — byte-identical
  normalized JSONL turn vs real codex. Behavioral drop-in proven at binary level.

Full tree green: 89 packages pass; parity suite (subcommand/models/apply_patch/turn)
passes binary-vs-binary; cross-compiles.

Author: SqlRush

docs/PARITY.md

@@ -31,7 +31,7 @@ Living record of differential validation of `codexgo` against the reference
 
 | Surface | Command | Result |
 |---|---|---|
-| `exec --json` turn lifecycle | `codex exec --json "hello"` vs codexgo | ✅ **Pass** — see `TestParityTurnExec`. Both binaries are pointed at the **same fake `/v1/responses` SSE endpoint** via the **same drop-in `config.toml`** (`[model_providers.parity]`, `env_key`), and produce a **byte-identical normalized JSONL stream**: same event-type sequence, same final agent message, same usage. No real OpenAI credentials required. |
+| `exec --json` turn lifecycle | `codex exec --json "hello"` vs codexgo | ✅ **Pass** — see `TestParityTurnExec`. **Both binaries** are pointed at the **same fake `/v1/responses` SSE endpoint** via the **same drop-in `config.toml`** (`[model_providers.parity]`, `env_key`), and produce a **byte-identical normalized JSONL stream**: same event-type sequence, same final agent message, same usage. The codexgo binary now honors the custom `model_provider` selection, its `base_url`, and its `env_key` directly — no in-process harness. No real OpenAI credentials required. |
 
 ### `TestParityTurnExec` — the turn-level differential
 
@@ -89,36 +89,41 @@ codexgo: {"type":"turn.completed","usage":{"input_tokens":11,"cached_input_token
    (`thread-00000000000000000001`). Both are opaque per-run identifiers. The test
    strips `thread_id` (and any item `id`) before comparing.
 
-**Drop-in gap found (genuine, documented): the codexgo binary does not honor a
-custom provider's `base_url`/`env_key`.**
+**Drop-in gap CLOSED: the codexgo binary now honors a custom provider's
+`base_url`/`env_key`.**
 
-The real codex binary is driven *exactly* as a user would: the actual binary,
-`exec --json`, configured purely through `config.toml`. It picks up
+Both binaries are now driven *exactly* as a user would: the actual binary,
+`exec --json`, configured purely through `config.toml`. Each picks up
 `[model_providers.parity]`, sends `Authorization: Bearer dummy`, POSTs to the
 fake `/v1/responses`, and emits a normal turn.
 
-**codexgo is driven in-process** through `internal/appserver.Assemble` plus a real
-`appserver.NewModelClientFactory` whose provider points at the same server. This
-is necessary because codexgo's `cmd/codex exec` assembly
-(`internal/cli/assembly.go` → `buildAssembly`) currently:
-
-- always builds the model provider with `modelproviderinfo.CreateOpenAIProvider(nil)`,
-  ignoring any custom `[model_providers.<id>]` `base_url`; and
-- resolves credentials only from `OPENAI_API_KEY` / `CODEX_API_KEY` / `auth.json`
-  (`internal/cli/model_client.go`), ignoring a provider's custom `env_key`.
-
-As a result, the **codexgo binary** run against this config.toml silently falls
-back to the scripted mock and never contacts the server (verified: no request
-reaches the test server, and it emits the mock reply). The in-process harness
-exercises the *same* real code path the binary would use against
-`api.openai.com` — `core.ResponsesModelClient` → the `internal/api` SSE parser →
-the exec turn loop → the exec JSONL sink — just with the provider base_url
-retargeted, so the turn-level behavioral comparison is faithful. Closing the
-binary-level gap (threading the parsed config's `model_provider` /
-`model_providers` and the provider `env_key` into `buildAssembly`) is the
-remaining work to make a *custom-provider* `config.toml` fully drop-in for the
-codexgo binary; the OpenAI-provider path (`OPENAI_API_KEY` + default base_url) is
-already wired in the binary.
+codexgo's `cmd/codex exec` assembly (`internal/cli/assembly.go` →
+`buildAssemblyWithDefaults`, with provider selection in
+`internal/cli/provider_select.go`) now:
+
+- reads the resolved `model_provider` selection and the `[model_providers]` map
+  from the loaded config (projected through `internal/cli/config_load.go`), merges
+  the configured providers onto the built-in catalog
+  (`modelproviderinfo.MergeConfiguredModelProviders` over
+  `BuiltInModelProviders`, honoring `openai_base_url`), and builds the
+  `api.Provider` for the **selected** provider — so a custom
+  `[model_providers.<id>]` `base_url` (and `wire_api`, `http_headers`, retry, …)
+  is honored;
+- resolves credentials honoring the provider's `env_key` first (a static
+  `Authorization: Bearer <env_key value>`), and only falls back to the
+  `OPENAI_API_KEY` / `CODEX_API_KEY` / `auth.json` login path for
+  `requires_openai_auth` providers; and
+- honors the configured `model` (over `CODEX_MODEL`, over the mock slug) and
+  threads the resolved provider id + model into the exec/review/TUI session
+  defaults.
+
+The scripted mock remains the fallback **only** when no usable credential /
+provider resolves (preserving the offline/dev behavior and
+`CODEX_EXEC_MOCK_REPLY`). As a result, the **codexgo binary** run against this
+config.toml now contacts the server and produces a real turn whose normalized
+JSONL stream is byte-identical to the real codex binary's — proving the binary
+itself is a behavioral drop-in for a custom provider. The OpenAI-provider path
+(`OPENAI_API_KEY` + default base_url) is wired through the same code.
 
 ## Pending (need a one-time authenticated recording — maintainer)
 
@@ -156,12 +161,12 @@ further offline differentials:
 
 Format/CLI-surface parity is validated and faithful (model catalog identical;
 subcommand set complete; `apply_patch` byte-identical). The **turn-level
-behavioral drop-in proof is now done**: `TestParityTurnExec` runs one real
-`exec --json` model turn through both binaries against a fake `/v1/responses`
-endpoint with **no OpenAI credentials**, and the normalized JSONL streams are
-byte-identical (same event sequence, message text, and usage). The remaining
-honest caveats are (1) the codexgo *binary* does not yet honor a custom
-provider's `base_url`/`env_key` from `config.toml` (so codexgo is driven
-in-process for this test; the OpenAI-provider path is wired in the binary), and
-(2) tool-call / compaction / app-server wire-stream differentials are still
-pending.
+behavioral drop-in proof is now done, binary-vs-binary**: `TestParityTurnExec`
+runs one real `exec --json` model turn through **both built binaries** against a
+fake `/v1/responses` endpoint, configured purely through the same drop-in
+`config.toml` + `PARITY_FAKE_KEY`, with **no OpenAI credentials**, and the
+normalized JSONL streams are byte-identical (same event sequence, message text,
+and usage). The codexgo binary now honors a custom provider's `model_provider`
+selection, `base_url`, and `env_key` (previous in-process workaround removed). The
+remaining honest caveat is that tool-call / compaction / app-server wire-stream
+differentials are still pending.

internal/cli/assembly.go

@@ -9,7 +9,6 @@ import (
 	"github.com/sqlrush/codexgo/internal/appserver"
 	"github.com/sqlrush/codexgo/internal/config"
 	"github.com/sqlrush/codexgo/internal/core"
-	"github.com/sqlrush/codexgo/internal/modelproviderinfo"
 	"github.com/sqlrush/codexgo/internal/protocol"
 )
 
@@ -18,53 +17,110 @@ import (
 // complete turn out of the box without credentials.
 const defaultMockReply = "Hello from codex (mock model). Set a real model client to run live."
 
-// buildAssembly constructs the Codex engine, selecting a real provider-backed
-// model client when credentials are present and a scripted mock otherwise.
+// buildAssemblyWithDefaults constructs the Codex engine, selecting a real
+// provider-backed model client when a usable provider + credentials resolve and a
+// scripted mock otherwise, and returns the resolved per-session defaults
+// (provider id + default model) alongside it.
 //
-// It resolves the Codex home + store mode from the loaded configuration, builds a
-// login-backed auth resolver, and wires appserver.NewModelClientFactory with the
-// mock as the offline/dev fallback. This mirrors the Rust ModelClient::new path
-// plus the exec provider-selection fallback. Configuration errors degrade to the
-// pure-mock assembly so the exec / mcp-server / app-server paths still run.
-func buildAssembly() (*appserver.Assembly, error) {
+// It loads the merged configuration, resolves the active `model_provider`
+// selection against the merged built-in + configured provider catalog, builds the
+// matching credential resolver (the login-backed OpenAI auth path for
+// requires_openai_auth providers; a provider env_key bearer otherwise), and wires
+// appserver.NewModelClientFactory with the scripted mock as the offline/dev
+// fallback. This mirrors the Rust ModelClient::new + create_model_provider path
+// plus the exec provider-selection fallback. Any configuration / provider error
+// degrades to the pure-mock assembly so the exec / mcp-server / app-server paths
+// still run out of the box.
+//
+// Threading the resolved provider id and model through the returned defaults is
+// what lets the binary honor a config.toml `model` / `model_provider` selection
+// end to end, rather than always defaulting to the mock slug and the "openai"
+// provider id.
+func buildAssemblyWithDefaults() (*appserver.Assembly, appserver.Defaults, error) {
 	fallback := mockClientFactory()
 
-	resolverCfg, ok := loadAuthResolverConfig()
+	cfg, ok := loadProviderConfig()
 	if !ok {
 		// Configuration could not be loaded; run with the mock so the engine still
 		// works offline (e.g. in tests or a fresh checkout without a config file).
-		return assembleWithFactory(fallback, resolverCfg.CodexHome)
+		return assembleResult(fallback, "", "", defaultModelProviderID)
+	}
+
+	model := configDefaultModel(cfg)
+
+	selected, err := resolveSelectedProvider(cfg)
+	if err != nil {
+		// A bad provider selection must not break the offline paths; fall back to
+		// the mock so the engine still runs.
+		return assembleResult(fallback, cfg.CodexHome, model, defaultModelProviderID)
+	}
+
+	resolver, ok := buildProviderAuthResolver(cfg, selected)
+	if !ok {
+		// No credential source applies to the selected provider; use the mock.
+		return assembleResult(fallback, cfg.CodexHome, model, selected.ID)
 	}
 
-	resolver := newLoginAuthResolver(resolverCfg)
-	// The OpenAI provider is built with a nil base URL so ToAPIProvider selects the
-	// correct default per resolved auth mode (the ChatGPT codex endpoint for
-	// ChatGPT-style auth, the public OpenAI API for API-key auth). The configured
-	// ChatGPT base URL only influences agent-identity JWKS verification, handled by
-	// the resolver, not the Responses endpoint default.
 	factory, err := appserver.NewModelClientFactory(appserver.RealModelClientFactoryConfig{
 		AuthResolver:   resolver,
-		Provider:       modelproviderinfo.CreateOpenAIProvider(nil),
+		Provider:       selected.Info,
 		InstallationID: resolveInstallationID(),
 		Fallback:       fallback,
 	})
 	if err != nil {
-		return nil, fmt.Errorf("cli: build model client factory: %w", err)
+		return nil, appserver.Defaults{}, fmt.Errorf("cli: build model client factory: %w", err)
+	}
+	return assembleResult(factory, cfg.CodexHome, model, selected.ID)
+}
+
+// buildProviderAuthResolver selects the credential resolver for the active
+// provider. requires_openai_auth providers (e.g. the built-in OpenAI provider)
+// use the login-backed resolver, which honors OPENAI_API_KEY / CODEX_API_KEY /
+// auth.json / ChatGPT login. Other providers authenticate from their declared
+// env_key. It returns ok == false when no credential source applies, so the
+// caller selects the mock fallback.
+func buildProviderAuthResolver(cfg loadedConfig, selected selectedProvider) (appserver.AuthResolver, bool) {
+	if isOpenAIAuthProvider(selected.Info) {
+		return newLoginAuthResolver(authResolverConfig{
+			CodexHome:            cfg.CodexHome,
+			StoreMode:            cfg.StoreMode,
+			ChatgptBaseURL:       cfg.ChatgptBaseURL,
+			EnableCodexAPIKeyEnv: true,
+		}), true
+	}
+	if envKeyDefined(selected.Info) {
+		return &envKeyAuthResolver{info: selected.Info}, true
 	}
-	return assembleWithFactory(factory, resolverCfg.CodexHome)
+	return nil, false
 }
 
-// assembleWithFactory builds the engine with the given model-client factory and
-// codex home, applying the shared defaults.
-func assembleWithFactory(factory appserver.ModelClientFactory, codexHome string) (*appserver.Assembly, error) {
+// assembleResult builds the engine with the given model-client factory, codex
+// home, default model slug, and provider id, returning the assembly alongside the
+// resolved per-session Defaults. An empty codexHome is resolved from the
+// environment; an empty defaultModel falls back to CODEX_MODEL and then the mock
+// slug. The same resolved model + provider id flow into both the assembly's
+// models manager and the returned Defaults so the binary's exec/review/TUI paths
+// honor the configured selection.
+func assembleResult(factory appserver.ModelClientFactory, codexHome, defaultModel, providerID string) (*appserver.Assembly, appserver.Defaults, error) {
 	if codexHome == "" {
 		codexHome = resolveCodexHome()
 	}
-	return appserver.Assemble(appserver.AssemblyConfig{
+	model := resolveDefaultModel(defaultModel)
+	asm, err := appserver.Assemble(appserver.AssemblyConfig{
 		ModelClientFactory: factory,
 		CodexHome:          codexHome,
-		DefaultModel:       defaultModelSlug(),
+		DefaultModel:       model,
 	})
+	if err != nil {
+		return nil, appserver.Defaults{}, err
+	}
+	defaults := appserver.Defaults{
+		Model:      model,
+		ProviderID: providerID,
+		Cwd:        resolveCwd(),
+		UserAgent:  "codex-cli-go",
+	}
+	return asm, defaults, nil
 }
 
 // mockClientFactory builds the scripted-mock ModelClientFactory used as the
@@ -83,29 +139,40 @@ func mockClientFactory() appserver.ModelClientFactory {
 	}
 }
 
-// loadAuthResolverConfig projects the loaded CLI configuration into the auth
-// resolver config. It returns ok == false when configuration cannot be loaded,
-// in which case the caller falls back to the pure-mock assembly. The default root
-// options are used because buildAssembly has no parsed -c overrides in scope; the
-// richer wiring through ParsedCommandLine can replace this when the exec/app-server
-// dispatch threads the root options here.
-func loadAuthResolverConfig() (authResolverConfig, bool) {
+// loadProviderConfig loads and projects the merged CLI configuration used by the
+// assembly: the codex home, auth store mode, the active provider selection, the
+// configured providers map, and the default model. It returns ok == false when
+// configuration cannot be loaded, in which case the caller falls back to the
+// pure-mock assembly. The default root options are used because the assembly
+// builder has no parsed -c overrides in scope; the richer wiring through
+// ParsedCommandLine can replace this when the exec/app-server dispatch threads the
+// root options here.
+func loadProviderConfig() (loadedConfig, bool) {
 	cfg, err := loadConfig(RootOptions{})
 	if err != nil {
-		return authResolverConfig{}, false
-	}
-	return authResolverConfig{
-		CodexHome:            cfg.CodexHome,
-		StoreMode:            cfg.StoreMode,
-		ChatgptBaseURL:       cfg.ChatgptBaseURL,
-		EnableCodexAPIKeyEnv: true,
-	}, true
+		return loadedConfig{}, false
+	}
+	return cfg, true
 }
 
-// defaultModelSlug returns the configured default model slug for the assembly. It
-// honors CODEX_MODEL when set and otherwise falls back to the mock slug so the
-// offline path keeps working out of the box.
-func defaultModelSlug() string {
+// configDefaultModel returns the configured `model` slug, or "" when unset. The
+// assembly's resolveDefaultModel then layers CODEX_MODEL and the mock slug below
+// it, so a config model wins over the env var, matching the Rust precedence
+// (config model resolved before the env-derived defaults).
+func configDefaultModel(cfg loadedConfig) string {
+	if cfg.DefaultModel != nil && *cfg.DefaultModel != "" {
+		return *cfg.DefaultModel
+	}
+	return ""
+}
+
+// resolveDefaultModel returns the effective default model slug for the assembly.
+// The configured model wins; otherwise CODEX_MODEL is honored, and finally the
+// mock slug keeps the offline path working out of the box.
+func resolveDefaultModel(configModel string) string {
+	if configModel != "" {
+		return configModel
+	}
 	if slug := os.Getenv("CODEX_MODEL"); slug != "" {
 		return slug
 	}

internal/cli/cmd_app_server.go

@@ -28,19 +28,12 @@ func runAppServerSubcommand(ctx context.Context, parsed ParsedCommandLine, strea
 		}
 	}
 
-	asm, err := buildAssembly()
+	asm, defaults, err := buildAssemblyWithDefaults()
 	if err != nil {
 		fmt.Fprintf(streams.Stderr, "codex app-server: %v\n", err)
 		return 1
 	}
 
-	defaults := appserver.Defaults{
-		Model:      "gpt-mock",
-		ProviderID: "openai",
-		Cwd:        resolveCwd(),
-		UserAgent:  "codex-cli-go",
-	}
-
 	if err := appserver.ServeStdioWithProcessor(ctx, asm, defaults, streams.Stdin, streams.Stdout); err != nil {
 		if errors.Is(err, io.EOF) || errors.Is(err, context.Canceled) {
 			return 0

internal/cli/cmd_default.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/sqlrush/codexgo/internal/appserver"
 	"github.com/sqlrush/codexgo/internal/appserverclient"
 	"github.com/sqlrush/codexgo/internal/tui"
 )
@@ -21,19 +20,17 @@ func runDefaultNoSubcommand(ctx context.Context, _ ParsedCommandLine, streams St
 		return 1
 	}
 
-	asm, err := buildAssembly()
+	asm, defaults, err := buildAssemblyWithDefaults()
 	if err != nil {
 		fmt.Fprintln(streams.Stderr, "codex:", err)
 		return 1
 	}
+	// Keep the versioned interactive user-agent; the model + provider id come from
+	// the resolved configuration so the TUI honors a custom `model_provider`.
+	defaults.UserAgent = "codex-cli-go/" + Version
 	client := appserverclient.StartInProcess(ctx, appserverclient.InProcessStartArgs{
 		Assembly: asm,
-		Defaults: appserver.Defaults{
-			Model:      "gpt-mock",
-			ProviderID: "openai",
-			Cwd:        resolveCwd(),
-			UserAgent:  "codex-cli-go/" + Version,
-		},
+		Defaults: defaults,
 	})
 	defer client.Shutdown(context.WithoutCancel(ctx))
 

internal/cli/cmd_exec.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/sqlrush/codexgo/internal/appserver"
 	"github.com/sqlrush/codexgo/internal/exec"
 )
 
@@ -18,7 +17,7 @@ func runExecSubcommand(ctx context.Context, parsed ParsedCommandLine, streams St
 		return 2
 	}
 
-	asm, err := buildAssembly()
+	asm, defaults, err := buildAssemblyWithDefaults()
 	if err != nil {
 		fmt.Fprintln(streams.Stderr, "codex exec:", err)
 		return 1
@@ -30,12 +29,7 @@ func runExecSubcommand(ctx context.Context, parsed ParsedCommandLine, streams St
 		Stderr:          streams.Stderr,
 		StdinIsTerminal: streams.StdinIsTerminal,
 		Assembly:        asm,
-		Defaults: appserver.Defaults{
-			Model:      "gpt-mock",
-			ProviderID: "openai",
-			Cwd:        resolveCwd(),
-			UserAgent:  "codex-cli-go",
-		},
+		Defaults:        defaults,
 	}
 
 	return exec.Run(ctx, cli, env)