feat(codex): add account-qualified catalog entries

[chrisae9]

Summary

• Part of Expose Codex accounts as model namespaces in the picker #425 and layer 3 of the split requested in feat(codex): add account-qualified model namespaces #426. The namespace foundation and exact-account routing are already on dev; this layer adds the catalog, discovery, and subagent projection that make those selectors usable from model pickers.
• Generate one native GPT row per eligible public account selector. Selector labels are arbitrary user-chosen identifiers with no built-in account-role meaning; selecting a qualified row pins the request to exactly its mapped account without changing Pool selection or falling back to another account.
• Hide bare native rows in the Codex picker while qualified rows are active, while preserving bare routing and raw /v1/models availability. Missing stored-account targets are not advertised, and stored ids, aliases, and email addresses never enter public model metadata.
• Reconcile only trusted generated rows, preserve the complete native metadata and reasoning contract, and keep account-row recovery independent from routed-provider discovery outages.
• Honor exact-account cooldowns when account-qualified models appear as subagent fallback candidates, without borrowing Pool probe leases, including model-scoped quota groups.
• Make disabledModels consistent: a bare native id hides that model for every selector, while an account-qualified id hides only the matching selector row.
• Keep custom subagent prompts fail-closed for ambiguous bare native models: {{model}} is blank unless the request resolves a unique/current-route candidate, while explicit routed or account-qualified ids retain their existing raw fallback.
• Update the English, Russian, Korean, Japanese, and Chinese reference, App-picker, model-ordering, and subagent guidance docs. This layer does not add account lifecycle mutations, settings endpoints, or new dashboard controls.

Verification

• Current head 33270c3f: TypeScript typecheck, privacy scan, and git diff --check passed. The catalog restore, sync-hardening, and refresh suites passed with 31 tests and 162 assertions.
• Current head 33270c3f: the macOS-style symlinked-temp restore case passed 20 consecutive runs, and the catalog idempotency case passed 30 consecutive runs after moving its large intermediate snapshot out of child-process stdout.
• Parent head 7f82a4de: the catalog/discovery/restore, exact-account routing, subagent fallback, native visibility, and upstream retry integration matrix passed with 483 passed, 2 platform-only skipped, 0 failed, and 5,936 assertions across 18 files.
• Parent head 7f82a4de: Cross-platform CI passed all four Linux test shards, React Doctor, gates, keyring checks, and npm-global packaging on Linux, macOS, and Windows. The macOS suite reached 8,189 passed and 8 skipped; its only failure was the lexical /var versus canonical /private/var test expectation corrected by the current head.
• The local full 529-file run reached 8,187 passed and 10 skipped with one load-sensitive native-profile sideband assertion. The affected file then passed 20 consecutive isolated runs: 60 tests and 600 assertions.
• Rebased onto dev at 7343f0ba; git range-diff confirms the nine feature patches are unchanged, and every commit has a valid GPG signature.
• Independent post-rebase integration review found no conflict with provider reasoning metadata, NVIDIA NIM capability classification, the Qwen model rename/pricing update, or service repair. Its focused compatibility matrix passed 508 tests with 0 failures.
• Independent review of current feedback found no remaining straightforward code fix; exact-account routes remain deliberately fixed and fail closed rather than invoking a fallback that may target another account.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I fixed all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The change adds account-qualified native Codex models. It filters selectors, generates and reconciles account-bound catalog rows, updates discovery and parsing, applies provider-aware visibility, and scopes multi-agent guidance by account namespace.

Changes

Account-bound native catalog

Layer / File(s)	Summary
Catalog contracts and native visibility src/codex/catalog.ts, src/codex/catalog/account-models.ts, src/codex/catalog/metadata.ts, tests/native-model-toggle.test.ts	Adds selector filtering, display-name formatting, trusted slug validation, account-qualified slug generation, and provider-aware native visibility.
Catalog synchronization and model discovery src/codex/catalog/sync.ts, src/codex/catalog/aggregation.ts, src/server/index.ts, tests/claude-models-discovery.test.ts, tests/codex-catalog-sync-hardening.test.ts, tests/grok-models-effort-list.test.ts	Generates and reconciles account-bound rows, applies priorities and collision warnings, and exposes rows through Codex and OpenAI discovery.
Native slug parsing and restoration src/codex/catalog/parsing.ts	Uses trusted account-bound slugs for native context overrides and multi-agent mode restoration.
Account-aware multi-agent guidance src/server/responses/collaboration.ts, src/server/responses/core.ts, tests/multi-agent-compat.test.ts	Passes the account namespace into guidance and resolves namespaced rosters within the effective catalog window.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant ModelDiscovery
  participant CatalogSync
  participant CatalogStore
  participant MultiAgentGuidance
  Client->>ModelDiscovery: Request model listings
  ModelDiscovery->>CatalogSync: Provide provider state and account selectors
  CatalogSync->>CatalogStore: Generate and reconcile account-bound rows
  CatalogStore-->>ModelDiscovery: Return visible catalog entries
  ModelDiscovery-->>Client: Return Codex and OpenAI model listings
  Client->>MultiAgentGuidance: Request guidance with account namespace
  MultiAgentGuidance-->>Client: Return namespace-filtered model guidance

Loading

Possibly related PRs

• lidge-jun/opencodex#426: Adds related account-qualified Codex namespace handling.
• lidge-jun/opencodex#512: Adds account namespace configuration used by this change.
• lidge-jun/opencodex#671: Adds exact account routing for account-qualified Codex model slugs.

Suggested reviewers: ingwannu, lidge-jun, wibias

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: adding account-qualified catalog entries for Codex.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '=== PR metadata and checks ==='
gh pr view 949 --repo lidge-jun/opencodex \
  --json url,headRefOid,baseRefOid,isDraft,mergeStateStatus,statusCheckRollup \
  --jq '{url,headRefOid,baseRefOid,isDraft,mergeStateStatus,checks:[.statusCheckRollup[] | {name,status,conclusion}]}'

echo
echo '=== Discovery implementation outline ==='
ast-grep outline src/server/index.ts --items all --type function --match 'models|catalog' || true

echo
echo '=== Bare and qualified native discovery sources ==='
rg -n -C 8 'visibleNatives|visibleNativeSlugs|NATIVE_OPENAI_MODELS|accountSelectors|selectorNativeSlugs' \
  src/server/index.ts

echo
echo '=== Discovery regression assertions ==='
rg -n -C 5 'plainIds|gpt-5\.5|NATIVE_OPENAI_MODELS|selector' \
  tests/claude-models-discovery.test.ts

Length of output: 13389

---

@Wibias: The bare-row asymmetry is fixed on the current PR head 7f82a4ded4f21299c1a8b38f42d5648181675f88.

src/server/index.ts Lines 679-684 now derives bare native rows from NATIVE_OPENAI_MODELS, excluding disabledNatives, when accountSelectors.length > 0.

src/server/index.ts Lines 685-690 derives qualified rows from the same selectorNativeSlugs set. It also excludes an exact disabled qualified ID.

The regression assertion remains valid. tests/claude-models-discovery.test.ts Lines 185-190 requires both gpt-5.5 and desktop/gpt-5.5. The current source now satisfies that contract.

The test setup at Lines 172-188 also disables team/gpt-5.5 and asserts that discovery omits it. This confirms the current discovery path honors the exact qualified disable for that row.

I withdraw the finding that plain /v1/models omits bare supported native IDs when selectors are active. I cannot mark the PR ready from this evidence alone. The current PR is still UNSTABLE, and the retrieved check data does not show completed Cross-platform or React Doctor results.

---

✏️ Learnings added

Learnt from: Wibias
URL: https://github.com/lidge-jun/opencodex/pull/949

Timestamp: 2026-08-04T08:02:51.596Z
Learning: In PR `#949`, `src/server/index.ts` must derive both bare native OpenAI discovery rows and account-qualified discovery rows from `NATIVE_OPENAI_MODELS` when `accountSelectors.length > 0`, excluding disabled native slugs. Exact qualified IDs in `config.disabledModels`, such as `team/gpt-5.5`, must also omit that specific qualified discovery row.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

_{You are interacting with an AI system.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7f82a4ded4

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Preserve case-distinct account fallbacks

Once account-selector ids are admitted here, fallback chains still pass through normalizedChain(), which de-duplicates by trimmed.toLowerCase(). Account selectors are case-sensitive and can route to different accounts (for example work/gpt-5.5 and Work/gpt-5.5), so a chain containing both drops the second before availability checks; if the first account is paused/cooled down, the healthy case-distinct account is never tried. Keep the selector segment case-sensitive when de-duping account-qualified fallback ids.

Useful? React with 👍 / 👎.