fix(codex): preserve account-scoped native model ids

docs-site/src/content/docs/guides/codex-app-models.md

@@ -16,7 +16,12 @@ opencodex adds separate `<selector>/<native-openai-model>` rows for the mapped a
 the bare native rows from the Codex picker. Selector labels are user-chosen public names with no
 built-in account-role meaning. Selecting a qualified row uses only its mapped account, does not
 change the active Pool account, and fails closed instead of switching accounts when the target is
-unavailable. See [Exact Codex account selectors](/reference/configuration/routing/#exact-codex-account-selectors).
+unavailable. If Codex's account-scoped catalog contains a visible, API-supported OpenAI-family id
+that is not yet in opencodex's static set, the exact id is preserved as a selector-qualified row
+for eligible main-account selectors; it is not copied to an unrelated account and is not added to
+the bare or API-key model list. The row is matched on the field shape a real catalog row has,
+which filters malformed entries — it does not prove the id came from an upstream response, since
+the cache is a user-owned file. See [Exact Codex account selectors](/reference/configuration/routing/#exact-codex-account-selectors).
 
 When the `codexAccountNamespaces` map is empty, account-qualified picker rows are off. If
 `codexAccountPickerEnabled` is omitted with a non-empty map, they are treated as enabled for

docs-site/src/content/docs/reference/configuration/routing.md

@@ -39,7 +39,13 @@ more than one provider, so use explicit namespaces when a bare model could be am
 `codexAccountNamespaces` maps a public selector such as `side` to one stored Codex account. A
 request for `side/gpt-5.6-sol` uses only that account, even when the canonical `openai` provider is
 in Direct mode, and sends the bare `gpt-5.6-sol` model id upstream. Only bare native OpenAI-family
-ids are valid after the selector.
+ids are valid after the selector. Account-scoped ids observed in Codex's current model catalog may
+also be preserved exactly when they are not yet part of opencodex's static set; the observation must
+carry the field shape of a real catalog row, stays qualified to its matching account selector, and
+is never promoted into the global bare model list. That shape check filters malformed and minimal
+rows — it is not a trust control, because the models cache is a user-owned file and a complete
+hand-written row is indistinguishable from an upstream observation. Nothing new becomes routable:
+a bare `gpt-*` id under an account selector is accepted by the router regardless of the catalog.
 
 Exact selection bypasses Pool assignment strategy and ordinary thread affinity. If the mapped
 account is missing, paused, cooling down, unusable, or requires reauthentication, the request fails

src/codex/catalog.ts

@@ -2,7 +2,7 @@
 // Public surface preserved exactly; importers keep using "src/codex/catalog".
 export { isMediaGenerationModelId, shouldExposeRoutedModel, readCodexCatalogPath, readCatalog, normalizeRoutedCatalogEntry, catalogModelSlug, filterSupportedNativeSlugs, catalogModelSupportsReasoningSummaries } from "./catalog/parsing";
 export type { CatalogModel, MultiAgentMode } from "./catalog/parsing";
-export { CODEX_NATIVE_ALIAS_CATALOG_KIND, NATIVE_OPENAI_MODELS, configuredNativeAliasSlugs, desktopAllowlistSuppressedNativeSlugs, isNativeAliasCatalogEntry, nativeOpenAiContextWindow, disabledNativeSlugs, visibleNativeSlugs, desktopVisibleNativeSlugs, nativeModelRows, applyNativeVisibility, upstreamNativeEntry, nativeOpenAiSlugs, listCatalogNativeSlugs, nativeInputModalities, nativeReasoningEfforts, nativeDefaultReasoningEffort, shouldIncludeAccountBoundNativeOpenAi, shouldIncludeNativeOpenAi } from "./catalog/metadata";
+export { accountBoundNativeOpenAiSlugs, accountBoundNativeOpenAiSlugsBySelector, CODEX_NATIVE_ALIAS_CATALOG_KIND, NATIVE_OPENAI_MODELS, configuredNativeAliasSlugs, desktopAllowlistSuppressedNativeSlugs, isNativeAliasCatalogEntry, nativeOpenAiContextWindow, disabledNativeSlugs, visibleNativeSlugs, desktopVisibleNativeSlugs, nativeModelRows, applyNativeVisibility, observedAccountBoundNativeEntries, observedAccountBoundNativeOpenAiSlugs, upstreamNativeEntry, nativeOpenAiSlugs, listCatalogNativeSlugs, nativeInputModalities, nativeReasoningEfforts, nativeDefaultReasoningEffort, shouldIncludeAccountBoundNativeOpenAi, shouldIncludeNativeOpenAi } from "./catalog/metadata";
 export { isSpawnableCodexCandidate, codexExecInvocation, loadBundledCodexCatalog, materializeBundledCodexCatalog, loadCatalogTemplate } from "./catalog/bundled";
 export { nativeEffortClamp, shouldApplyNativeEffortClamp, catalogModelEfforts, codexSupportedReasoningEfforts, clampedDefaultEffort, clampEntryToCodexSupportedEfforts, clampCatalogModelsToCodexSupport } from "./catalog/effort";
 export { applyProviderConfigHints, isDatedVariantId, filterCatalogVisibleModels, gatherRoutedModels, clearGatherRoutedModelsInflight, augmentRoutedModelsWithRegistryOpenAiApiRows, augmentRoutedModelsWithMetadata, resolveComboCatalogMember, configuredComboTargetModelsByProvider } from "./catalog/provider-fetch";

src/codex/catalog/bundled.ts

@@ -522,6 +522,22 @@ export function readCurrentCatalogOrCache(): RawCatalog | null {
   return readCatalog(path) ?? readCatalog(activeCodexModelsCachePath());
 }
 
+/**
+ * Read the user-owned Codex catalog surfaces without substituting the bundled catalog.
+ *
+ * The bundled catalog is intentionally the authority for static native metadata on the default
+ * path. Account-qualified discovery needs the opposite view: an exact model id that Codex has
+ * observed in the user's catalog/cache may be account-scoped even when this release does not know
+ * it statically yet.
+ */
+export function readCurrentCodexCatalog(): RawCatalog | null {
+  return readCatalog(readCodexCatalogPath());
+}
+
+export function readCurrentCodexModelsCache(): RawCatalog | null {
+  return readCatalog(activeCodexModelsCachePath());
+}
+
 export function loadCatalogTemplate(): RawEntry | null {
   const catalogPath = readCodexCatalogPath();
   const bundled = loadBundledCodexCatalog();

src/codex/catalog/metadata.ts

@@ -4,6 +4,7 @@ import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync } from
 import { delimiter, dirname, join, resolve } from "node:path";
 import { atomicWriteFile, expandUserPath, getConfigDir, websocketsEnabled } from "../../config";
 import { CODEX_CONFIG_PATH, CODEX_MODELS_CACHE_PATH, DEFAULT_CATALOG_PATH, readRootTomlString, resolveCodexConfigPath } from "../paths";
+import { codexAccountNamespaceEntries, isMainCodexAccountTarget } from "../account-namespaces";
 import { clearModelCache, DEFAULT_MODEL_CACHE_TTL_MS, getFreshCached, getStaleCached, isModelsFetchCoolingDown, markModelsFetchFailure, setCached } from "../model-cache";
 import { buildModelsRequest, resolveModelsAuthToken } from "../../oauth";
 import type { OcxConfig, OcxProviderConfig } from "../../types";
@@ -33,8 +34,8 @@ import upstreamModelsSnapshot from "../data/upstream-models.json";
 
 
 import type { RawEntry } from "./parsing";
-import { readCurrentCatalogOrCache, unique } from "./bundled";
-import { trustedAccountBoundNativeCatalogSlug } from "./account-models";
+import { readCurrentCatalogOrCache, readCurrentCodexCatalog, readCurrentCodexModelsCache, unique } from "./bundled";
+import { trustedAccountBoundNativeCatalogSlug, visibleCodexAccountSelectors } from "./account-models";
 import { CODEX_NATIVE_ALIAS_CATALOG_KIND } from "./kinds";
 import { NATIVE_OPENAI_MODELS, SUPPORTED_NATIVE_OPENAI_SLUGS } from "./native-models";
 export { CODEX_NATIVE_ALIAS_CATALOG_KIND } from "./kinds";
@@ -194,10 +195,35 @@ export function shouldIncludeNativeOpenAi(config: Pick<OcxConfig, "providers">):
   return !hasEnabledProvider || shouldIncludeAccountBoundNativeOpenAi(config);
 }
 
+type AccountSelectorConfig = Pick<
+  OcxConfig,
+  "codexAccounts" | "codexAccountNamespaces" | "codexAccountPickerEnabled"
+>;
+
+function mainAccountSelectors(config: AccountSelectorConfig): string[] {
+  const targets = new Map(codexAccountNamespaceEntries(config));
+  return visibleCodexAccountSelectors(config).filter(selector =>
+    isMainCodexAccountTarget(targets.get(selector) ?? ""));
+}
+
 /** Native slugs exposed to Claude Desktop show/export/apply (opt-out via claudeCode.desktopNativeModels). */
-export function desktopVisibleNativeSlugs(config: Pick<OcxConfig, "claudeCode" | "disabledModels" | "combos">): string[] {
+export function desktopVisibleNativeSlugs(
+  config: Pick<OcxConfig, "claudeCode" | "disabledModels" | "combos" | "providers"
+    | "codexAccounts" | "codexAccountNamespaces" | "codexAccountPickerEnabled">,
+): string[] {
   if (config.claudeCode?.desktopNativeModels === false) return [];
-  return visibleNativeSlugs(config);
+  const visible = visibleNativeSlugs(config);
+  if (!shouldIncludeAccountBoundNativeOpenAi(config)) return visible;
+  const qualified = [...accountBoundNativeOpenAiSlugsBySelector(config).entries()].flatMap(([selector, slugs]) =>
+    slugs
+      .filter(slug => !SUPPORTED_NATIVE_OPENAI_SLUGS.has(slug))
+      .map(slug => `${selector}/${slug}`),
+  );
+  const disabled = new Set(config.disabledModels ?? []);
+  return unique([
+    ...visible,
+    ...qualified.filter(slug => !disabled.has(slug) && !disabled.has(slug.slice(slug.indexOf("/") + 1))),
+  ]);
 }
 
 export function nativeModelRows(config: Pick<OcxConfig, "disabledModels" | "combos" | "providerContextCaps">): Array<{ slug: string; disabled: boolean; contextWindow?: number }> {
@@ -214,6 +240,7 @@ export function applyNativeVisibility(
   entries: RawEntry[],
   disabledModels: ReadonlySet<string>,
   hideBareNative = false,
+  observedNativeSlugs: ReadonlySet<string> = new Set(),
 ): RawEntry[] {
   for (const entry of entries) {
     if (isNativeAliasCatalogEntry(entry)) continue;
@@ -222,7 +249,7 @@ export function applyNativeVisibility(
     const nativeSlug = accountBoundSlug ?? slug;
     if (!nativeSlug
       || (!accountBoundSlug && slug.includes("/"))
-      || !SUPPORTED_NATIVE_OPENAI_SLUGS.has(nativeSlug)) continue;
+      || (!SUPPORTED_NATIVE_OPENAI_SLUGS.has(nativeSlug) && !observedNativeSlugs.has(nativeSlug))) continue;
     const disabled = disabledModels.has(nativeSlug)
       || (accountBoundSlug !== undefined && disabledModels.has(slug));
     entry.visibility = disabled || (!accountBoundSlug && hideBareNative)
@@ -259,6 +286,154 @@ export function nativeOpenAiSlugs(): string[] {
   return live.length > 0 ? unique([...live, ...DOCUMENTED_NATIVE_OPENAI_ADDITIONS]) : NATIVE_OPENAI_MODELS;
 }
 
+const ACCOUNT_BOUND_OPENAI_NATIVE_PREFIX = /^(?:gpt-|o1-|o3-|o4-)/;
+const ACCOUNT_BOUND_OBSERVED_NATIVE_MARKER = "opencodex_account_observed_native";
+const ACCOUNT_BOUND_OBSERVED_SELECTORS_MARKER = "opencodex_account_observed_selectors";
+
+function isAccountBoundOpenAiNativeSlug(slug: string): boolean {
+  return !slug.includes("/") && ACCOUNT_BOUND_OPENAI_NATIVE_PREFIX.test(slug);
+}
+
+/**
+ * Shape/plausibility filter for a candidate account-native row. **This is not a trust control.**
+ *
+ * It checks that a row carries the field shape a real Codex catalog row has, which rejects
+ * malformed and minimal hand-written rows. It cannot distinguish a genuine upstream observation
+ * from a complete row typed by hand into `$CODEX_HOME/models_cache.json`: there is no signature,
+ * source identity, or server attestation to check. A full-shape forged row is accepted, and
+ * `observedFullShapeRowIsAccepted` in tests/native-model-toggle.test.ts pins that so nobody
+ * later mistakes this predicate for a security boundary.
+ *
+ * That is acceptable here because the file is user-owned and written by Codex itself: anyone
+ * able to rewrite it can already edit `config.json` or run `ocx` directly, and `router.ts`
+ * accepts any bare `gpt-*` id under an account namespace regardless of this catalog. What the
+ * filter buys is that garbage rows do not get advertised through discovery — not that an
+ * advertised row is proven genuine.
+ */
+function hasNativeCatalogRowShape(entry: RawEntry): boolean {
+  const levels = entry.supported_reasoning_levels;
+  const messages = entry.model_messages;
+  return typeof entry.base_instructions === "string"
+    && entry.base_instructions.length > 0
+    && (typeof entry.comp_hash === "string" || entry.comp_hash === null)
+    && entry.shell_type === "shell_command"
+    && Array.isArray(levels)
+    && levels.length > 0
+    && levels.every(level => typeof level === "object" && level !== null
+      && typeof (level as { effort?: unknown }).effort === "string")
+    && typeof messages === "object"
+    && messages !== null
+    && !Array.isArray(messages);
+}
+
+function observedAccountBoundNativeSlug(entry: RawEntry): string | undefined {
+  const accountBound = trustedAccountBoundNativeCatalogSlug(entry);
+  const slug = accountBound ?? (typeof entry.slug === "string" ? entry.slug : "");
+  if (!isAccountBoundOpenAiNativeSlug(slug)
+    || entry.supported_in_api !== true
+    || !hasNativeCatalogRowShape(entry)
+    || (entry.visibility !== "list" && entry[ACCOUNT_BOUND_OBSERVED_NATIVE_MARKER] !== true)) {
+    return undefined;
+  }
+  return slug;
+}
+
+/**
+ * Return exact, previously observed account-native rows that are not in the static release set.
+ * The result is used only to carry a hidden observation across startup cache invalidation.
+ */
+export function observedAccountBoundNativeEntries(
+  observedEntries: readonly RawEntry[],
+): RawEntry[] {
+  const seen = new Set<string>();
+  return observedEntries.flatMap(entry => {
+    const slug = observedAccountBoundNativeSlug(entry);
+    // Only carry bare upstream observations across cache replacement. Account-qualified rows are
+    // already a projection of the current selector map and must not preserve private/stale labels.
+    if (!slug
+      || typeof entry.slug !== "string"
+      || entry.slug.includes("/")
+      || SUPPORTED_NATIVE_OPENAI_SLUGS.has(slug)
+      || seen.has(slug)) return [];
+    seen.add(slug);
+    return [structuredClone(entry)];
+  });
+}
+
+/**
+ * Native ids observed in the user's Codex catalog/cache for account-qualified discovery.
+ *
+ * Unknown ids are deliberately returned only to callers that build selector-qualified rows. The
+ * static bare set remains the source of truth for global/API-key discovery, while this preserves
+ * exact account-scoped ids such as `gpt-daybreak-blue-latest` until the static set catches up.
+ */
+export function accountBoundNativeOpenAiSlugs(
+  observedEntries: readonly RawEntry[] = [
+    ...(readCurrentCodexModelsCache()?.models ?? []),
+    // Existing generated rows are also safe to reuse after a process starts without a cache
+    // invalidation pass; bare user-authored catalog rows are intentionally not trusted here.
+    ...(readCurrentCodexCatalog()?.models ?? []).filter(entry =>
+      trustedAccountBoundNativeCatalogSlug(entry) !== undefined),
+  ],
+): string[] {
+  const observed = observedEntries.flatMap(entry => {
+    const slug = observedAccountBoundNativeSlug(entry);
+    return slug === undefined ? [] : [slug];
+  });
+  return unique([...NATIVE_OPENAI_MODELS, ...observed]);
+}
+
+/**
+ * Resolve account-native ids per public selector. Bare observations come from Codex's main
+ * catalog/cache, so they are eligible only for selectors that target the main account. A
+ * generated qualified row carries its own selector and never gets copied to an unrelated pool
+ * account. An explicit observation marker is public selector metadata only; private account ids
+ * never enter the catalog or cache.
+ */
+export function accountBoundNativeOpenAiSlugsBySelector(
+  config: AccountSelectorConfig,
+  observedEntries: readonly RawEntry[] = [
+    ...(readCurrentCodexModelsCache()?.models ?? []),
+    ...(readCurrentCodexCatalog()?.models ?? []).filter(entry =>
+      trustedAccountBoundNativeCatalogSlug(entry) !== undefined),
+  ],
+): ReadonlyMap<string, readonly string[]> {
+  const selectors = visibleCodexAccountSelectors(config);
+  const mainSelectors = new Set(mainAccountSelectors(config));
+  const result = new Map<string, Set<string>>(
+    selectors.map(selector => [selector, new Set(NATIVE_OPENAI_MODELS)]),
+  );
+  for (const entry of observedEntries) {
+    const slug = observedAccountBoundNativeSlug(entry);
+    if (slug === undefined || SUPPORTED_NATIVE_OPENAI_SLUGS.has(slug)) continue;
+    const generated = trustedAccountBoundNativeCatalogSlug(entry);
+    const generatedSelector = generated === undefined || typeof entry.slug !== "string"
+      ? undefined
+      : entry.slug.slice(0, entry.slug.indexOf("/"));
+    const markedSelectors = Array.isArray(entry[ACCOUNT_BOUND_OBSERVED_SELECTORS_MARKER])
+      ? entry[ACCOUNT_BOUND_OBSERVED_SELECTORS_MARKER].filter((value): value is string => typeof value === "string")
+      : [];
+    const eligible = generatedSelector !== undefined
+      ? (mainSelectors.has(generatedSelector) ? [generatedSelector] : [])
+      : markedSelectors.length > 0
+        ? markedSelectors.filter(selector => mainSelectors.has(selector))
+        : [...mainSelectors];
+    for (const selector of eligible) {
+      const rows = result.get(selector);
+      if (rows) rows.add(slug);
+    }
+  }
+  return new Map([...result.entries()].map(([selector, slugs]) => [selector, [...slugs]]));
+}
+
+/** Unknown native ids observed from Codex, excluding the static release set. */
+export function observedAccountBoundNativeOpenAiSlugs(
+  observedEntries?: readonly RawEntry[],
+): string[] {
+  const all = accountBoundNativeOpenAiSlugs(observedEntries);
+  return all.filter(slug => !SUPPORTED_NATIVE_OPENAI_SLUGS.has(slug));
+}
+
 function catalogNativeSlugs(): string[] {
   const cat = readCurrentCatalogOrCache();
   const models = cat?.models ?? [];