Expose Codex accounts as model namespaces in the picker

[chrisae9]

Area

Authentication and account pool

What are you trying to accomplish?

Keep multiple Codex accounts authenticated at the same time and explicitly choose which exact account a new conversation uses from the model picker. The account choice should be visible in the selected model and remain fixed for that conversation, without logging out of any other account.

Account names should be arbitrary local IDs. They identify stored logins; they do not represent built-in roles or account types.

What prevents this today?

The active Pool account is selected separately from the model. A bare model such as gpt-5.6-sol does not show which credential will be used, and normal Pool behavior may rotate or fail over to another eligible account.

Changing the global active account is therefore not a strict per-conversation choice. Logging out and back in is also not a viable substitute when other Codex sessions depend on the existing login.

What should OpenCodex do?

Add an opt-in model-picker mode that exposes every supported native GPT model once per available Codex account.

• Selecting an account-qualified model pins the conversation to that exact stored account.
• Quota balancing, failure failover, affinity rebinding, and unsupported-model retry never switch that request to another account.
• If the selected account is missing, cooling down, or needs reauthentication, the request fails closed.
• Changing the active Pool account does not affect an account-qualified conversation.
• Bare gpt-* models retain their current Pool or Direct behavior.
• Hiding the account-specific picker entries does not turn an existing saved selector into a fallback route.
• Newly supported native GPT models automatically receive the same account-qualified choices.

Example usage or interface

With a built-in login and one added account whose local ID is team-a, the picker could expose:

main/gpt-5.6-sol
team-a/gpt-5.6-sol

main/gpt-5.6-sol always uses the built-in login. team-a/gpt-5.6-sol always uses the stored account identified locally as team-a. If team-a is unavailable, the request fails instead of using main or another account.

IDs such as team-a, client, personal, or work are user-chosen examples only. OpenCodex should not assign any semantics to them.

Alternatives or workarounds

• Switching the active Pool account is global and does not make the choice visible in the model selector.
• Disabling automatic balancing reduces switching but still does not create an explicit per-conversation account target.
• Logging out and back in disrupts other sessions and requires unnecessary credential churn.

Additional context

This is generic explicit account targeting, not a request for special Personal and Work account roles. The existing picker and Pool/Direct behavior should remain unchanged unless the user opts in.

Checks

• I searched existing issues and documentation.
• This request describes a concrete OpenCodex workflow rather than merely naming a desired technology.
• I removed secrets and personal data.

[github-actions]

Issue reopened

The report now contains the information required by the automated check. Thanks for updating it.

[Ingwannu]

The opt-in account-qualified namespace is a coherent direction, and draft PR #426 tracks the implementation. The important contract is stricter than normal Pool routing: a qualified selector must pin one stored account, fail closed when that account is unavailable, and bypass balancing, affinity rebinding, quota failover, and unsupported-model retry. Bare gpt-* selectors must remain unchanged.

Please keep the namespace derived from arbitrary local account ids rather than assigning built-in role semantics. I am keeping this issue open while #426 validates routing, catalog persistence, hidden-entry behavior, and failure handling across restarts.