TLDR

Openai OAuth didnt use the workspace/team usage when you select workspace, it would always use your personal usage/plan. this fixes that

Problem

When authenticating with OpenAI Codex and selecting a workspace, Clawdbot ignores the account_id field stored in ~/.codex/auth.json. This causes API calls to be attributed to the user's personal ChatGPT account instead of the selected workspace.

Solution

This PR updates the Codex CLI credential reading to:

1. Add accountId field to CodexCliCredential type - Now includes optional accountId for ChatGPT account/workspace ID

2. Read account_id from ~/.codex/auth.json - The readCodexCliCredentials function now extracts tokens.account_id from the Codex CLI auth file

3. Read account_id from macOS Keychain - The readCodexKeychainCredentials function also extracts the account_id when reading from keychain

The accountId automatically flows through to the auth profile store since OAuthCredentials from pi-ai already includes this field.

Testing

• Build passes (pnpm build)
• All tests pass (pnpm test)

How to verify

1. Ensure you have authenticated with Codex CLI on the gateway host (verify ~/.codex/auth.json has the correct tokens.account_id)
2. Sync credentials using one of:
   • clawdbot onboard --auth-choice codex-cli (reuse existing Codex CLI login)
   • clawdbot models status (triggers sync)
   • Restart the gateway (credentials sync automatically on startup)
3. Run clawdbot doctor to verify the codex-cli profile is synced
4. Check that ~/.clawdbot/agents/main/agent/auth-profiles.json now contains accountId for the openai-codex:codex-cli profile