feat(codex): add account-qualified catalog entries

[chrisae9]

Summary

• Part of Expose Codex accounts as model namespaces in the picker #425 and layer 3 of the split requested in feat(codex): add account-qualified model namespaces #426. The namespace foundation and exact-account routing are already on dev; this layer adds the catalog, discovery, and subagent projection that make those selectors usable from model pickers.
• Generate one native GPT row per eligible public account selector. Selector labels are arbitrary user-chosen identifiers with no built-in account-role meaning; selecting a qualified row pins the request to exactly its mapped account without changing Pool selection or falling back to another account.
• Hide bare native rows in the Codex picker while qualified rows are active, while preserving bare routing and raw /v1/models availability. Missing stored-account targets are not advertised, and stored ids, aliases, and email addresses never enter public model metadata.
• Reconcile only trusted generated rows, preserve the complete native metadata and reasoning contract, and keep account-row recovery independent from routed-provider discovery outages.
• Honor exact-account cooldowns when account-qualified models appear as subagent fallback candidates, without borrowing Pool probe leases, including model-scoped quota groups.
• Preserve case-distinct account selectors when de-duplicating subagent fallback chains, while retaining case-insensitive de-duplication for ordinary provider/model ids.
• Make disabledModels consistent: a bare native id hides that model for every selector, while an account-qualified id hides only the matching selector row.
• Keep custom subagent prompts fail-closed for ambiguous bare native models: {{model}} is blank unless the request resolves a unique/current-route candidate, while explicit routed or account-qualified ids retain their existing raw fallback.
• Update the English, Russian, Korean, Japanese, and Chinese reference, App-picker, model-routing, model-ordering, and subagent guidance docs. This layer does not add account lifecycle mutations, settings endpoints, or new dashboard controls.

Verification

• Current head e8df9782: Cross-platform CI and its ci aggregate passed on Ubuntu, macOS, and Windows; React Doctor also passed.
• Current head e8df9782: 108 focused catalog/subagent tests passed with 2 platform-specific skips and 0 failures across 3 files; TypeScript typecheck and git diff --check passed.
• Rebased onto dev at de7f5c81; the original 12-patch stack remained unchanged by git range-diff and retained valid GPG signatures. The maintainer-authored follow-up e8df9782 reuses the selector-aware de-duplication key for role-TOML fallbacks.
• The branch has regression coverage for both global and role-level case-distinct selectors, including suffix-only case de-duplication. Exact-account routes remain deliberately fixed and fail closed, and all five routing guides preserve the same selector, combo, provider, and bare-OpenAI precedence.
• All actionable Codex findings are fixed or intentionally declined as incompatible with the exact-account contract; the corresponding review threads are resolved.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I fixed all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The change adds account-qualified native Codex models. It filters selectors, generates and reconciles account-bound catalog rows, updates discovery and parsing, applies provider-aware visibility, and scopes multi-agent guidance by account namespace.

Changes

Account-bound native catalog

Layer / File(s)	Summary
Catalog contracts and native visibility src/codex/catalog.ts, src/codex/catalog/account-models.ts, src/codex/catalog/metadata.ts, tests/native-model-toggle.test.ts	Adds selector filtering, display-name formatting, trusted slug validation, account-qualified slug generation, and provider-aware native visibility.
Catalog synchronization and model discovery src/codex/catalog/sync.ts, src/codex/catalog/aggregation.ts, src/server/index.ts, tests/claude-models-discovery.test.ts, tests/codex-catalog-sync-hardening.test.ts, tests/grok-models-effort-list.test.ts	Generates and reconciles account-bound rows, applies priorities and collision warnings, and exposes rows through Codex and OpenAI discovery.
Native slug parsing and restoration src/codex/catalog/parsing.ts	Uses trusted account-bound slugs for native context overrides and multi-agent mode restoration.
Account-aware multi-agent guidance src/server/responses/collaboration.ts, src/server/responses/core.ts, tests/multi-agent-compat.test.ts	Passes the account namespace into guidance and resolves namespaced rosters within the effective catalog window.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant ModelDiscovery
  participant CatalogSync
  participant CatalogStore
  participant MultiAgentGuidance
  Client->>ModelDiscovery: Request model listings
  ModelDiscovery->>CatalogSync: Provide provider state and account selectors
  CatalogSync->>CatalogStore: Generate and reconcile account-bound rows
  CatalogStore-->>ModelDiscovery: Return visible catalog entries
  ModelDiscovery-->>Client: Return Codex and OpenAI model listings
  Client->>MultiAgentGuidance: Request guidance with account namespace
  MultiAgentGuidance-->>Client: Return namespace-filtered model guidance

Loading

Possibly related PRs

• lidge-jun/opencodex#426: Adds related account-qualified Codex namespace handling.
• lidge-jun/opencodex#512: Adds account namespace configuration used by this change.
• lidge-jun/opencodex#671: Adds exact account routing for account-qualified Codex model slugs.

Suggested reviewers: ingwannu, lidge-jun, wibias

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding account-qualified entries to the Codex catalog.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7f82a4ded4

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[Wibias]

[GD] Verdict: approve-comment

TLDR

• PR: feat(codex): add account-qualified catalog entries #949 — feat(codex): add account-qualified catalog entries
• Head: 3704869c1b on dev (base 7343f0ba = current tip; mergeable: MERGEABLE; not draft)
• Decision: previous blockers are fixed; re-review finds no remaining in-scope correctness bug that should block this layer.
• Usefulness: high — layer 3 of the feat(codex): add account-qualified model namespaces #426 split; catalog/discovery/subagent projection for account selectors is now coherent with the stated contracts.
• Bugs: none blocking on this head. Residual: role-TOML model_fallback de-dup still lowercases whole ids (global chain path is fixed).
• Security: no new confirmed issue on re-check of privacy/selector surfaces; stored ids/emails stay out of discovery.
• Spec / standards: matches PR body and feat(codex): add account-qualified model namespaces #426 layer scope; docs now describe picker rows, dashboard limits, and projected {{model}}.
• Reviews: earlier Wibias blockers (plain /v1/models availability, exact disables, cooled exact-account fallbacks, docs/dashboard claims, ambiguous prompt substitution, case-distinct global fallbacks) are addressed in subsequent commits through 3704869c. Many open Codex threads are stale/outdated against the current head.
• Base / CI: base is current. Required suite mostly green; test 3/4 failed on unrelated runWithImageBridge assertion expect(sse).not.toContain("504") against a successful recovery stream whose payload contains 504 only as an incidental substring (not this PR's files). Treat as separate flake/brittle test, not a PR product regression.
• Owner actions (foreign PR): none required for the prior correctness blockers. Optional: mirror case-sensitive account de-dup into resolveAgentModelFallbackForPrimary if role-TOML fallbacks will list case-distinct selectors. Optional: harden the image-bridge 504 assertion so incidental id/timestamp substrings do not fail CI.
• Bottom line: approve on substance. Not merge-ready only because CI still has one unrelated red leg and open bot threads are noisy; the account-catalog work itself looks ready.

Full re-review

Concerns vs new commits

Earlier concern	Current evidence on 3704869c	Status
Plain /v1/models drops bare natives / qualified clones when selectors are active	src/server/index.ts seeds bare + account rows from NATIVE_OPENAI_MODELS (disabled-filtered) when selectors are active; discovery tests assert gpt-5.5 and selector rows	fixed
Exact disabledModels like team/gpt-5.5 ignored	applyNativeVisibility checks exact slug for account-bound rows; raw list skips disabled exact ids; tests cover hide of team/gpt-5.5	fixed
Cooled exact-account fallbacks treated as available via Pool probe	isSubagentModelUnavailable fails closed for route.codexAccountId using quota-health snapshots, including model-scoped scopes; tests cover account-wide and model-scoped cooldowns	fixed
Account selectors rejected by fallback routability	isRoutableFallbackModel admits configured account namespaces before provider checks	fixed
Restore leaves bare natives hidden after removing account rows	restoreAccountHiddenBareNatives / visibleAccountReplacementNatives unhide supported natives when safe	fixed
Docs promised dashboard exact-account picks / Models toggles	codex-app-models.md and agents/routing docs now state dashboard limits and hand-edit/CLI for exact selector rows	fixed
Ambiguous bare {{model}} injection	custom prompt uses projected preferred or blanks bare ambiguous ids; tests assert blank expansion	fixed
Case-distinct account fallbacks collapsed	fallbackChainKey keeps selector case; global chain tests keep work/gpt-5.5 and Work/gpt-5.5	fixed (global path)
Exact-account primaries skip subagent fallback	still gated by route.codexAccountId === undefined in src/server/responses/core.ts; PR body deliberately keeps exact routes fail-closed rather than auto-rewriting to another account	accepted design for this layer

Residual

1. Role-TOML path only (non-blocking): resolveAgentModelFallbackForPrimary still de-dupes with trimmed.toLowerCase(). Global subagentModelFallback is fixed; only agent-role model_fallback lists can still collapse case-distinct selectors.
2. CI noise: test 3/4 failure is outside this PR's changed files and looks like a brittle substring assertion on a recovered stream.

Security (light re-check)

• Selector keys validated by config (isValidProviderName / single-segment pattern).
• Discovery privacy tests keep account id/email out of payloads; aliases covered in hardening intent.
• No new secret/auth surface in this re-review.

Bottom line

Ship-worthy on product correctness relative to the earlier requested changes. Clear the unrelated CI flake and optionally close stale bot threads; no further account-catalog code change is required for the previous blockers.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3704869c1b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[Wibias]

[GD] Verdict: gated

TLDR

• PR: feat(codex): add account-qualified catalog entries #949 — feat(codex): add account-qualified catalog entries
• Head: 0a6f93c5 on dev (base 67128879; current dev tip is ahead/diverged; mergeable: MERGEABLE; draft again)
• Decision: previous code blockers remain fixed; latest commit only docs account-selector precedence. Gate is draft + incomplete CI + base drift, not a new product regression.
• Usefulness: high — layer 3 of feat(codex): add account-qualified model namespaces #426; catalog/discovery/subagent projection is still coherent.
• Bugs: none blocking relative to earlier review. Residual only: role-TOML model_fallback still de-dupes with full-string toLowerCase() (global chain path is fixed).
• Security: no new confirmed issue; selector privacy/disable contracts still hold.
• Spec / standards: latest commit documents selector-before-provider precedence in model-routing docs; app-picker/dashboard boundaries remain accurate.
• Reviews: open Codex threads are largely stale against this head (availability, cooldown, docs, case-distinct global fallbacks already fixed). Exact-account primary skip of subagent fallback remains intentional fail-closed design.
• Base / CI: PR is draft; only lightweight checks visible (enforce-target, label). Head is behind current dev (diverged). Owner must mark ready and refresh from latest dev before merge-ready claims.
• Owner actions (foreign PR): 1) convert draft → ready when finished, 2) update/rebase onto latest dev, 3) wait for full Cross-platform CI, 4) optional: case-sensitive de-dup in resolveAgentModelFallbackForPrimary.
• Bottom line: approve on substance of the account-catalog work; gated for draft/CI/base, not for the earlier correctness blockers.

Full re-review

Delta since previous re-review (3704869c)

• New head 0a6f93c5: docs(codex): document account selector precedence only.
• Updates model-routing guide (and translations) so exact <selector>/<native-openai-model> is rule 1, before provider/model.
• That closes the newest Codex docs-precedence comment on the product side.

Earlier blockers vs current head

Concern	Status on 0a6f93c5
Plain /v1/models bare + selector availability	fixed (NATIVE_OPENAI_MODELS + disabled filters)
Exact disabledModels for selector rows	fixed
Cooled exact-account fallbacks	fixed
Account selectors in fallback routability	fixed
Restore unhides bare natives	fixed
Docs/dashboard boundary claims	fixed
Ambiguous bare {{model}}	fixed
Case-distinct global fallbacks	fixed
Exact-account primaries skip fallback	accepted design (fail-closed; not a silent rewrite to another account)
Role-TOML case-distinct de-dup	residual non-blocking

Gate

• Draft / WIP: yes (PR is draft again)
• Base drift: head diverged from current dev (owner update required; foreign PR — no push from this review)
• Required CI: incomplete on this head (no full suite result yet)

Bottom line

No new account-catalog correctness regression. Mark ready, refresh from dev, and land green CI; then this is ready for a merge-ready pass.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0a6f93c5de

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[Wibias]

[GD] Thanks @chrisae9 — merging this.

Why it helps: this completes the account-catalog layer of the #426 split — account-qualified rows are generated per eligible public account selector, surfaced in Codex and OpenAI discovery without leaking stored ids/aliases/emails, and honored end-to-end by routing, disabledModels, exact-account cooldowns, and subagent fallback including case-distinct selector chains. Bare native routing and raw /v1/models availability stay intact, and the routing guides are updated across all five languages.

Ship it.