Web UI: add OpenAI Codex CLI as a configure host

[hyoshi]

Summary

mureo setup codex already exists at the CLI level (mureo/cli/setup_codex.py) and installs the full kit for OpenAI Codex CLI. The configure Web UI does not support Codex — SUPPORTED_HOSTS = ("claude-code", "claude-desktop") only, and the wizard host step offers just Claude Code / Claude Desktop. This issue tracks extending the Web UI to Codex.

Current state

CLI (setup_codex.py) already handles, idempotently (tag markers):

• MCP server config in ~/.codex/config.toml — a [mcp_servers.mureo] TOML table (append-only tagged block; there is no claude mcp-style CLI for Codex).
• Credential-guard PreToolUse hooks in ~/.codex/hooks.json.
• Workflow + shared skills under ~/.codex/skills/<name>/SKILL.md.

The Web UI knows none of this.

Work required

The Web UI host abstraction is Claude-only and was just rebuilt around the claude mcp CLI / ~/.claude.json (Phase 1). Codex needs a distinct registration/detection driver:

• host_paths.py: add a codex host (~/.codex/config.toml, ~/.codex/hooks.json, ~/.codex/skills, mureo credentials path). The MCP registry is TOML, so mcp_registry_path + the JSON read_json_safe detection in status_collector.py do not apply as-is — a TOML reader / Codex-specific detector is needed.
• SUPPORTED_HOSTS + wizard host step (buildStepBody_host, i18n) + wizard.js host options.
• setup_actions.py: host branch calling the Codex install/remove primitives (mirroring the claude-code / claude-desktop branches) instead of claude mcp.
• status_collector.py: detect installed mureo / official providers from ~/.codex/config.toml.
• Generalize the host layer from a Claude-binary assumption into a per-host "registration driver" (Claude claude mcp/JSON, Codex TOML append-block, etc.).

Decisions required

• Does the Web UI register official providers (google-ads-official etc.) for Codex too, or only the mureo MCP + guard + skills? (Ties into Phase 2: Credential supply for official MCP providers (google-ads-official, ga4-official) #102 — official-provider credential supply.)
• Codex config.toml append-block vs. structured rewrite for idempotent add/remove via the UI.

Acceptance criteria

• Wizard offers Codex as a host; selecting it installs the mureo MCP (+ guard + skills) into the correct ~/.codex/* locations, idempotently.
• Dashboard status reflects what is actually registered in ~/.codex/config.toml.
• Bulk-clear / remove unregister from the Codex locations (no settings.json / ~/.claude.json cross-talk).
• Parity with the CLI mureo setup codex; validated against the real ~/.codex/config.toml, not only unit tests.

References

• mureo/cli/setup_codex.py (existing CLI primitives to reuse).
• Web UI host layer: mureo/web/host_paths.py, status_collector.py, setup_actions.py, mureo/_data/web/wizard.js, i18n.json.
• Related: feat: Browser-based config UI for non-engineer onboarding #88 (config UI), Phase 2: Credential supply for official MCP providers (google-ads-official, ga4-official) #102 (Phase 2 official-provider credentials). Sibling issue: Gemini CLI Web UI host.