Add guarded OpenAI active account switching

[cbusillo]

Objective

Let Context Panel switch the active OpenAI account used by local Codex/Code auth files without asking the user to manually edit credential JSON.

Finish Line

The user can choose an available OpenAI account from the app/widget flow and the host app safely updates .code/auth.json and/or .codex/auth.json from the corresponding auth_accounts.json entry, then refreshes usage and WidgetKit.

Current Status

State: Ready to revisit. Account setup/settings flow prerequisite #25 is complete, so guarded OpenAI active account switching can resume when it becomes a priority.
Next action: Reconfirm where account setup and account actions now live, then design the guarded switch action around the completed settings flow.
Blocked by: Nothing current.
Last verified: 2026-05-16 during cross-repo issue audit; stale native blocker edge to completed #25 was removed.

Scope

• Discover available ChatGPT accounts from .code/auth_accounts.json and any future .codex/auth_accounts.json.
• Expose a safe app-side switch action, potentially triggered from the widget via app intent/deep link.
• Write active auth.json atomically from the selected account tokens.
• Avoid logging tokens or raw auth file contents.
• Refresh provider data and reload widget timelines after a switch.

Acceptance Criteria

• Switching accounts updates the intended auth file only after an explicit app-side action.
• Widget never directly writes credential files from extension UI code.
• The app handles missing account lists, malformed files, and write failures with clear local errors.
• Usage refresh after switching reflects the selected account.

Relationships

Related to #24, #25, and #26. #25 is complete and should be treated as historical context, not a blocker.

Validation

Use tests with fixture auth files; manually verify against local dev auth files only with explicit user approval.

Decisions

• Widget should trigger the host app/app intent; credential mutation belongs in the app process, not the widget view.

Open Questions

• Should one switch action update both .code/auth.json and .codex/auth.json, or should the app expose them separately?

[cbusillo]

2026-05-15 release-triage update:\n\nLeaving this open as a post-beta enhancement, not a blocker for the first trust-focused TestFlight.\n\nReasoning:\n- The current beta can read and display multiple OpenAI/Code accounts from auth_accounts.json without mutating auth files.\n- This issue would write active auth.json files, which is higher-risk credential mutation and should have its own explicit design/test pass.\n- Widget/app switching is useful, but not required for the core TestFlight promise: setup providers, refresh limits, show app/widget status, and preserve understandable degraded states.\n\nNext action after TestFlight baseline: design the app-only switch action, fixture auth-file tests, atomic write behavior, and clear recovery path before touching real local auth files.