Local web helper for managing CC Switch Codex OAuth bridge providers and launcher-only Codex CLI account routes.
本工具是一个本地网页助手,用于管理 CC Switch 的 Codex OAuth 桥接 Provider,以及为 Codex CLI 生成不复制 token 的账号启动器。
- Create or repair Claude providers that route through a local Codex bridge.
- 创建或修复走本地 Codex bridge 的 Claude Provider。
- Keep Claude provider account binding and quota identity intact.
- 保留 Claude Provider 的账号绑定和额度身份。
- Generate launcher-only Codex CLI routes under
~/.cc-switch/codex-cli-launchers/. - 在
~/.cc-switch/codex-cli-launchers/下生成 launcher-only Codex CLI 账号路由。 - Detect stale tokenful
~/.codex-cli-*profiles without copying or refreshing OpenAI tokens. - 检测旧的 tokenful
~/.codex-cli-*配置,不复制、不刷新 OpenAI token。 - Detect Codex Desktop config state, and optionally set a default Codex account for tools that cannot pass CLI flags.
- 检测 Codex Desktop 配置状态,并可选设置默认 Codex 账号,供无法输入 CLI 参数的工具使用。
- Detect Codex provider account/token mismatch.
- 检查 Codex Provider 的显示账号和实际 token 账号是否不一致。
- Hide tokens by default; reveal only on explicit user action.
- 默认隐藏 token,只有用户主动点击才显示。
- Back up local files before writes.
- 写入前自动备份本地文件。
This project is an independent local helper. It is not affiliated with CC Switch, OpenAI, Anthropic, GitHub, or Microsoft.
本项目是独立本地辅助工具,与 CC Switch、OpenAI、Anthropic、GitHub、Microsoft 无官方关联。
Using reverse-proxy, bridge, OAuth, or account-routing workflows may be subject to the terms of the relevant services. You are responsible for deciding whether a workflow is allowed for your account and environment.
使用反向代理、桥接、OAuth 或账号路由相关流程,可能受到对应服务条款约束。是否适合你的账号和环境,由使用者自行判断。
- macOS
- Python 3.10+
- CC Switch installed and configured
- 已安装并配置 CC Switch
- Codex OAuth accounts already logged in inside CC Switch
- 已在 CC Switch 内完成 Codex OAuth 账号登录
- Optional: local Codex bridge running on
127.0.0.1:8876 - 可选:本地 Codex bridge 已运行在
127.0.0.1:8876
Tested locally on macOS with the system Python 3 runtime. CC Switch schema compatibility is checked at runtime through SQLite columns where possible.
本工具在 macOS 系统 Python 3 环境下测试。CC Switch 数据库兼容性会尽量通过 SQLite 字段检测处理。
chmod +x run-bridgedeck.command
./run-bridgedeck.commandOpen / 打开:
http://127.0.0.1:8899
Manual start / 手动启动:
python3 bridgedeck.py --host 127.0.0.1 --port 8899-
Download
BridgeDeck.dmgfrom GitHub Releases. -
Open the DMG and drag the app to
Applications, or run it directly. -
If macOS Gatekeeper blocks the unsigned app, right-click the app and choose
Open. -
从 GitHub Releases 下载
BridgeDeck.dmg。 -
打开 DMG,将 App 拖到
Applications,或直接运行。 -
如果 macOS Gatekeeper 拦截未签名 App,右键 App 选择“打开”。
-
Log in to the target Codex OAuth account in CC Switch.
-
Open this tool.
-
In
Claude 桥接账号, select the account. -
Keep
设为当前enabled if you want Claude Code to switch immediately. -
Click
创建/更新 Claude 桥接. -
In
Claude Provider 管理, confirm the provider showssettings=true. -
先在 CC Switch 里登录目标 Codex OAuth 账号。
-
打开本工具。
-
在
Claude 桥接账号中选择账号。 -
如果要立刻切换 Claude Code,保持
设为当前勾选。 -
点击
创建/更新 Claude 桥接。 -
在
Claude Provider 管理中确认目标 Provider 显示settings=true。
This creates a per-account launcher and does not change the global default Codex account.
单独 Codex CLI 只生成某个账号的独立启动器,不改变全局默认 Codex 账号。
-
In
单独 Codex CLI, click选用for the account. -
Keep the generated directory such as
~/.codex-cli-pro. -
Click
生成启动器. -
Start CLI using the displayed command:
-
在
单独 Codex CLI中,对目标账号点击选用。 -
保持生成的目录,例如
~/.codex-cli-pro。 -
点击
生成启动器。 -
使用页面输出命令启动 CLI:
CODEX_HOME=/Users/you/.codex-cli-pro OPENAI_API_KEY=local-bridge codex -c 'base_url="http://127.0.0.1:8876/accounts/<account_id>/v1"'or use the generated launcher:
也可以使用自动生成的启动器:
~/.cc-switch/codex-cli-launchers/codex-<name>.command
BridgeDeck exposes account-scoped OpenAI-compatible and Anthropic-compatible routes on the local bridge. The UI shows copy-safe examples with a placeholder key only.
BridgeDeck 在本地 bridge 上提供账号级 OpenAI 兼容和 Anthropic 兼容路由。UI 只展示 placeholder key,不展示真实 OAuth token。
OPENAI_API_KEY=sk-bridgedeck-local-placeholder
OPENAI_BASE_URL=http://127.0.0.1:8876/accounts/<account_id>/v1Claude Desktop 3P gateway style:
Claude Desktop 第三方 gateway 形式:
ANTHROPIC_BASE_URL=http://127.0.0.1:8876/accounts/<account_id>/v1
ANTHROPIC_AUTH_TOKEN=sk-bridgedeck-local-placeholder
ANTHROPIC_MODEL=gpt-5.5Supported local routes:
本地支持路由:
POST /accounts/<account_id>/v1/responsesPOST /accounts/<account_id>/v1/messagesPOST /accounts/<account_id>/v1/chat/completionsGET /accounts/<account_id>/v1/models
gpt-5.5 is exposed as 272000 context tokens, 128000 max output tokens, with thinking levels low, medium, high, and xhigh.
gpt-5.5 展示为 272000 context tokens、128000 max output tokens,thinking levels 为 low、medium、high、xhigh。
For tools such as Paperclip that call the default codex command and do not let you enter a launch command, use 设为全局 Codex CLI.
对于 Paperclip 这类直接调用默认 codex、不提供命令输入位置的工具,使用 设为全局 Codex CLI。
This writes only base_url in ~/.codex/config.toml after making a backup. It does not copy access_token, refresh_token, or id_token.
该操作会先备份,再只写入 ~/.codex/config.toml 里的 base_url。不会复制 access_token、refresh_token 或 id_token。
The tool reads/writes these local files:
本工具会读写以下本地文件:
~/.cc-switch/cc-switch.db~/.cc-switch/settings.json~/.cc-switch/codex_oauth_auth.json~/.codex-cli-*~/.cc-switch/codex-cli-launchers/*~/.codex/config.tomlonly when默认都用这个账号is clicked- 只有点击
默认都用这个账号时才会写入~/.codex/config.toml
Codex CLI launchers no longer write auth.json or copy OAuth tokens. Migration may disable an old ~/.codex-cli-*/auth.json after backing it up.
Codex CLI 启动器不再写 auth.json,也不复制 OAuth token。迁移旧配置时会先备份,再禁用旧的 ~/.codex-cli-*/auth.json。
By default, it reads but does not overwrite the default Codex config:
默认只读取、不覆盖默认 Codex 配置:
~/.codex/config.toml~/.codex/.env
Backups are written to:
备份文件写入:
~/.cc-switch/bridgedeck-backups/
- The app binds to
127.0.0.1by default. - 默认只监听
127.0.0.1。 - Non-loopback binding requires
--allow-remote. - 非本机监听必须显式传入
--allow-remote。 - Remote mode is read-only by default and cannot reveal full tokens.
- 远程模式默认只读,不能显示完整 token。
- Remote read-only mode redacts account IDs, email addresses, local paths, and bridge account URLs in API responses.
- 远程只读模式会在 API 响应中脱敏 account id、邮箱、本地路径和 bridge 账号 URL。
- Write APIs and token reveal in remote mode require
--allow-remote-write. - 远程模式下写入和显示 token 必须额外传入
--allow-remote-write。 - All API requests require a per-run browser token.
- 所有 API 请求都需要本次启动生成的浏览器令牌。
- API requests reject cross-site Fetch Metadata where supported by the browser.
- 浏览器支持 Fetch Metadata 时,API 会拒绝跨站请求。
- Full tokens are not returned by
/api/dataunless the UI explicitly requestsinclude_secrets=1. /api/data默认不返回完整 token,只有 UI 明确请求include_secrets=1才返回。- The page sends CSP, frame blocking, no-store, nosniff, and referrer policy headers.
- 页面会发送 CSP、防嵌入、no-store、nosniff 和 referrer policy 安全响应头。
- Do not expose this app to a public network.
- 不要把本工具暴露到公网。
The UI may show account IDs, email addresses, local paths, and masked tokens. Do not include screenshots or logs from your real environment in public issues unless you redact them first.
页面可能显示 account id、邮箱、本地路径和脱敏 token。提交公开 issue 前,请先对截图和日志做脱敏。
Never publish:
不要公开:
- OAuth access tokens
- OAuth refresh tokens
auth.jsoncodex_oauth_auth.jsoncc-switch.db- private screenshots with account IDs or emails
- 带账号 ID、邮箱、本地路径的未脱敏截图
Remove the app or this folder. The tool does not install background services.
删除 App 或本目录即可。本工具不会安装后台服务。
Optional generated files:
可选清理自动生成文件:
rm -rf ~/.cc-switch/codex-cli-launchers
rm -rf ~/.cc-switch/bridgedeck-backups
rm -rf ~/.codex-cli-*chmod +x package-bridgedeck-dmg.command
./package-bridgedeck-dmg.commandOutput / 输出:
dist/BridgeDeck.dmg
For public releases, add a checksum:
公开发布建议同时提供校验值:
shasum -a 256 dist/BridgeDeck.dmgpython3 -m py_compile bridgedeck.py
python3 -m unittest discover -s tests
python3 bridgedeck.py --host 127.0.0.1 --port 8899
zsh -n run-bridgedeck.command
zsh -n package-bridgedeck-dmg.command--db PATH path to cc-switch.db
--settings PATH path to settings.json
--auth-store PATH path to codex_oauth_auth.json
--host HOST listen host, default 127.0.0.1
--port PORT listen port, default 8899
--allow-remote allow non-loopback bind; read-only and no secret reveal
--allow-remote-write allow write APIs and token reveal in remote mode
--db PATH cc-switch.db 路径
--settings PATH settings.json 路径
--auth-store PATH codex_oauth_auth.json 路径
--host HOST 监听地址,默认 127.0.0.1
--port PORT 监听端口,默认 8899
--allow-remote 允许非本机监听;默认只读且不能显示完整 token
--allow-remote-write 允许远程模式写入和显示完整 token
bridgedeck.py local web app and API / 本地网页应用和 API
run-bridgedeck.command macOS launcher / macOS 启动脚本
package-bridgedeck-dmg.command macOS app/dmg packager / macOS 打包脚本
README.md documentation / 文档
SECURITY.md security policy / 安全说明
CONTRIBUTING.md contribution guide / 贡献说明
CHANGELOG.md changelog / 变更记录
OPEN_SOURCE_CHECKLIST.md release checklist / 开源发布清单
LICENSE PolyForm Noncommercial 1.0.0 / PolyForm 非商用许可证
COMMERCIAL.md commercial licensing notes / 商业授权说明
.github/ issue and PR templates / issue 和 PR 模板
python3 -m py_compile bridgedeck.py
python3 -m unittest discover -s tests
zsh -n run-bridgedeck.command
zsh -n package-bridgedeck-dmg.command
./package-bridgedeck-dmg.command
shasum -a 256 dist/BridgeDeck.dmgBefore publishing, make sure the repository does not contain:
发布前确认仓库不包含:
private-notes/__pycache__/.env*.dbauth.jsoncodex_oauth_auth.json- screenshots with private account data
- 含私人账号信息的截图
BridgeDeck is licensed under the PolyForm Noncommercial License 1.0.0.
Commercial use requires a separate written commercial license. See COMMERCIAL.md.
BridgeDeck 使用 PolyForm Noncommercial License 1.0.0 授权。
商业使用需要单独取得书面商业授权。见 COMMERCIAL.md。