feat(codex): initialize account picker selectors

[chrisae9]

Summary

• add a pure selector initializer that runs only after an explicit account-picker opt-in and only when the selector map is absent or empty
• build the complete selector map before one assignment, preserving non-empty user maps by identity and insertion order
• reserve the canonical policy namespace and existing slash-qualified routing-profile prefixes during default and append allocation
• preserve exact-case account/profile prefix matching while keeping provider and reserved namespace collision checks normalized
• reject routing-profile/account-selector collisions before mutation, persistence, catalog convergence, or reference migration, without exposing private account identifiers
• document the selector namespace ownership contract in the internal SOT and provider references

This is the second slice requested in #1019, following #1096. It intentionally contains only selector initialization and collision foundations. Catalog convergence and management API/dashboard activation remain in later slices.

Part of #425.

Verification

• based on current dev@b39eecfc
• focused feature suite: 189 passed across namespace, config, routing-profile, and management regression coverage
• final changed-area smoke: 35 passed
• bun run typecheck
• bun run privacy:scan
• bun test tests/repo-hygiene.test.ts
• node --test .github/scripts/pr-sponsored-surface.test.cjs
• git diff --check
• full repository suite: 9,464 passed, 10 skipped, with one unrelated timing failure in native-profile-drain-server.test.ts; that complete file then passed 3/3 in isolation
• independent design, security/privacy, and repository-conventions reviews found no remaining blockers

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Summary by CodeRabbit

• New Features

  • Improved automatic account-selector namespace generation to avoid conflicts with providers, combos, routing policies, and routing-profile aliases.
  • Added opt-in initialization for default account selectors while preserving existing configuration.

• Bug Fixes

  • Prevented invalid namespace collisions, including policy and case-insensitive variants.
  • Routing-profile aliases that conflict with account-selector namespaces are now rejected without changing configuration.

• Documentation

  • Updated provider configuration guidance across supported languages to clarify namespace collision rules.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 70f91d1d-6033-4f51-becb-bc21e3796496

📥 Commits

Reviewing files that changed from the base of the PR and between b39eecf and 813bd7f.

📒 Files selected for processing (13)

• docs-site/src/content/docs/ja/reference/configuration/providers.md
• docs-site/src/content/docs/ko/reference/configuration/providers.md
• docs-site/src/content/docs/reference/configuration/providers.md
• docs-site/src/content/docs/ru/reference/configuration/providers.md
• docs-site/src/content/docs/zh-cn/reference/configuration/providers.md
• src/codex/account-namespaces.ts
• src/config.ts
• src/routing/profile-namespace.ts
• src/routing/profile.ts
• structure/03_catalog-and-subagents.md
• tests/codex-account-namespaces.test.ts
• tests/config.test.ts
• tests/routing-profile-management-editor.test.ts

---

📝 Walkthrough

Walkthrough

Codex account selector validation now reserves the policy namespace and routing-profile alias prefixes. Default selector generation and initialization avoid these namespaces. Documentation and tests cover validation, preservation, atomic failure, and management-operation behavior.

Changes

Namespace validation and allocation

Layer / File(s)	Summary
Routing namespace contracts and validation src/routing/profile-namespace.ts, src/routing/profile.ts, src/config.ts, tests/config.test.ts, docs-site/src/content/docs/.../configuration/providers.md	The policy namespace and routing-profile alias prefixes now participate in selector collision checks. Documentation and tests cover case-insensitive policy collisions.
Account selector generation and initialization src/codex/account-namespaces.ts, tests/codex-account-namespaces.test.ts, structure/03_catalog-and-subagents.md	Generated selectors avoid routing-profile prefixes and reserved namespaces. Initialization is opt-in, preserves existing non-empty maps, and fails atomically when allocation is unavailable.
Routing-profile management validation coverage tests/routing-profile-management-editor.test.ts	Create and update operations reject conflicting aliases before mutation, persistence, refresh, or reference migration. Tests also verify private account data is not exposed.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• lidge-jun/opencodex#1011: Introduces routing-profile namespace and POLICY_NAMESPACE handling extended by this change.
• lidge-jun/opencodex#1012: Adds related policy namespace collision validation in src/config.ts.
• lidge-jun/opencodex#1108: Adds related routing-profile management API collision tests.

Suggested labels: enhancement

Suggested reviewers: wibias, ingwannu, lidge-jun

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: initializing Codex account-picker selectors.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}