Switch a stored Codex account into the native main login from OpenCodex

[luvs01]

Area

Authentication and account pool

What are you trying to accomplish?

Switch the physical Codex/ChatGPT identity used as the native main login (__main__, backed by $CODEX_HOME/auth.json) from the OpenCodex UI or CLI, similar to a CodexSwitcher-style profile switcher.

This is intentionally different from choosing an active account in the OpenCodex Pool. The selected profile should become the login seen by native Codex App/CLI and by Direct mode, while local task/history files remain in the same Codex home.

What prevents this today?

• ocx account use openai <id> and the dashboard account cards only change Pool routing (activeCodexAccountId); they do not change the physical native login.
• The native main credential is treated as a read-only external source. OpenCodex can detect that another tool already replaced auth.json, but it does not provide the switch itself.
• Users must log out and back in, run a separate switcher, or manually swap credential files. That is slow and can race a running Codex process, target the wrong CODEX_HOME, leave stale __main__ quota/cooldown/reauth state, or make rollback difficult.

What should OpenCodex do?

Add a separate Native main login profiles surface in the dashboard and CLI.

• Let the user save the current native login as a named local profile and switch a previously authenticated/stored Codex identity into the native main slot.
• Keep this UI and terminology separate from Pool selection. A native-login switch must not silently change Pool strategy, Pool membership, or per-conversation account namespaces.
• Resolve the effective Codex home first and show which installation/home will be changed.
• Validate the target identity before activation, then atomically replace auth.json with restrictive permissions/ACLs. Preserve a recoverable backup and roll back automatically if validation or the final write fails.
• Never log or display tokens. Reuse the existing protected credential storage where possible instead of creating extra plaintext profile copies.
• After a successful physical identity change, invoke the existing main-account reconciliation behavior: clear only __main__ quota, cooldown, reauthentication, plan/cache and thread-affinity state, and invalidate stale __main__ WebSockets.
• Requests already in flight may keep their captured identity; the next request must use the newly selected native login. Report clearly if a full Codex App restart is required on a particular platform/version.
• Preserve local task/history data. If an existing remote continuation is account-bound and cannot be resumed by the new login, fail with an explicit compatibility error rather than silently starting a different task.
• Provide an explicit switch-back/rollback action.

Example usage or interface

$ ocx account main list
  personal   current
  work

$ ocx account main switch work
  Switching the native Codex login in C:\\Users\\me\\.codex ...
  ✓ Native main login is now: work

Dashboard:

Native main login
  Current: personal
  [Switch to work]  [Save current as profile]  [Restore previous]

OpenCodex Pool routing
  Active pool account: team-a

The two sections must remain independent.

Alternatives or workarounds

• Manually selecting a Pool account changes proxy routing only.
• Logging out and back in through Codex changes the main identity but is disruptive and does not provide quick rollback.
• External switchers or manual auth.json replacement work, but OpenCodex can only react after the change and cannot validate or coordinate it.

Additional context

• Issue #425 is about account-qualified model namespaces and does not replace the native main login.
• PR #370 detects an externally changed physical main identity and purges stale __main__ runtime state. This request would provide the user-facing, validated switch that occurs before that reconciliation.
• Current dev still documents the native main token as read-only from auth.json; this request intentionally proposes a new, explicit credential-lifecycle operation rather than changing normal request routing.
• On Windows, an implementation that reuses OpenCodex's generic secret-file/ACL-hardening path should avoid inheriting the synchronous event-loop wait tracked separately in #612. This cross-reference is implementation context only; this request neither duplicates nor expands the scope of [Bug]: synchronous Windows ACL hardening stalls the proxy on response-state writes #612.

Checks

• I searched existing issues and documentation.
• This request describes a concrete OpenCodex workflow rather than merely naming a desired technology.
• I removed secrets and personal data.

[github-actions]

_{Automated translation bookkeeping — detected language: English.}