[saioai]

Switching projects requires repeated flags or environment changes. This adds saved nonsecret profiles, folder defaults, and explicit identity reporting.
For example, openai --profile work auth status shows effective configuration and each credential's identity state.

What changes

• Profiles save organization, project, and base URL values. Credentials stay in existing environment variables or request flags.
• Explicit flags, environment values, selected profiles, and folder defaults retain their documented precedence.
• Folder links support parent inheritance, canonical aliases, repair, and errors that preserve committed outcomes.
• Offline status reports unknown API and Admin identities. Optional verification resolves only the selected credential's authenticated principal.
• Failed verification returns nonzero and leaves identity unknown. Unsupported providers receive no request or production fallback.
• Admin checks, setup, and copied commands retain the selected profile context, including explicit empty selectors.
• Saved endpoints follow the shared HTTPS policy. HTTP remains available for localhost and loopback IP addresses.
• Recovery guidance preserves the invoked executable, shell quoting, output format, cancellation status, and private diagnostics.

Commands

New local profile and folder commands:

openai profile create work
openai profile set work --organization org_demo --project proj_work
openai profile activate work
openai --profile work auth switch --to-project proj_other
openai profile get work --format json
openai profile list --format jsonl
openai profile set work --unset project       # restore project fallback
openai link --project proj_folder            # save this folder's project
openai --profile= auth status                # disable profile selection
openai unlink                               # remove this folder's own link
openai profile delete work --deactivate      # delete the saved default explicitly

New identity options:

openai auth status                          # offline configuration and unknown identities
openai auth status --verify --credential-kind api
openai auth status --verify --credential-kind admin --format json

Profile creation does not activate the profile. Only command-local profile set flags persist edits.
auth switch --to-project changes the selected profile's project without activating another profile.
Empty organization/project fields suppress fallback. Absent fields permit fallback.
Profile commands and project switching stay offline. They never persist credentials or identity.

Offline status reports both identities as unknown, with not_configured or not_requested reasons.
Successful verification reports the selected identity as resolved, with a principal ID and nullable name and email.
The other identity stays unknown. Verification does not establish project permissions, billing, key identity, or a human principal.
Verification sends one GET /v1/me request using the selected effective Bearer credential and supported HTTPS OpenAI provider.
The route is absent from the public SDK and API reference. Pinned backend source supports the response contract.

Profile commands support text, JSON, and JSONL. Identity status supports text and JSON.
Unsupported modes fail before execution. Offline inspection and repair remain available when a saved endpoint is invalid.
Endpoint errors point to profile set --help through the invoked executable.
See the authentication guide and profiles guide.

Code

Profiles, identity verification, registry transactions, and request-context snapshots now live in internal/app, following main's assembly migration.
The existing Admin, Audio, Files, Batch, and Images packages retain their feature behavior.
A shared resolver supplies selected context to requests, status, and Admin setup.
The implementation reuses shared request, input, help, and output helpers.
Declaration scanning preserves flag aliases, hidden flags, and inherited scope before parsing.

pkg/custom/runtime.go remains main's compatibility facade for generated callers.
Generated commands stay in generated/commands; response projections stay in internal/output/transform.
cmd/openai/main.go retains startup and wiring.
Dependency versions match base 7639dab1, including SDK v3.82.0.
The feature retains the direct golang.org/x/text requirement.
This diff changes no generated-owned files or custom-code budget policy.

Tested

Review candidate: 721943ab5d3ffb18e904f3ffe94de5ae13c07176, based on 7639dab16a033ef6335cbb386b990b2ff6098d80.

Local validation passed 189 named results on macOS ARM64: 102 application, 29 Admin, and 58 public process results.
No selected test failed or skipped. Bash and zsh copied commands executed.
Workflow inventory checks and the CLI build also passed, using Go 1.26.9 and SDK v3.82.0.
The validation bundle exited zero and completed process cleanup.

CI and Help compatibility passed for this candidate.
Native row 11 checks passed 3,306 named platform results across macOS, Linux, and Windows on x64 and ARM64.
A separate PowerShell-reference selection passed 28 named results across Windows x64 and ARM64.
Both selections had zero failures or skips.
Supplemental checks covered 7,702 command-error cases and 22 suites with exact test inventories.

Independent source, local-result, native-evidence, and protected-gate reviews passed.
Protected checks passed, including trusted CodeQL publication and Castiron budget checks.
Code Quality analysis passed. Detailed quality findings remain unavailable through the reviewed surfaces.

The operator verified deployed identity lookup through API and Admin selection paths on October 19.
The binary came from bddc8ac6, with runtime equivalent to 03af00b1.
Both selected identities resolved; both unselected identities stayed unknown. The sanitized receipt retained no credentials or identity values.
This observation covers the supplied credentials and paths. It does not attest key subtype, distinct key material, or future availability.
It does not validate this candidate or establish stable public provider support.

SDK CODEOWNER approval remains required for authentication, endpoints, storage, and workflow changes.
That review must decide whether the undocumented identity-provider contract has acceptable support guarantees.
Installed-package execution and graphical-terminal acceptance remain unverified.
This PR stays draft and unmerged. No review request has been sent.

Demo

These recordings are historical. They do not demonstrate the current Admin, Audio, Images, or recovery changes.

The identity replay compares 05ca236 with b8cdc77 in a macOS ARM64 Bash PTY. It uses 120 columns and Menlo 18.
It shows unknown identities offline, then rejects an unsupported provider with zero requests to a synthetic loopback trap.
Both offline commands returned zero. Unsupported verification returned one.
Both screenshots and all eight GIF frames passed visual inspection.
This replay does not show resolved identity or establish native graphical terminal acceptance.
Synthetic TLS tests covered resolved identity at b8cdc77.

Before:

After:

The identity recording recipe and synthetic fixtures remain in the local review packet.

The historical profile replay compares accepted A1 cd5f1477 with A2 8772eb0 in a macOS ARM64 Bash PTY.
It uses 120 columns, Menlo 18, isolated synthetic settings, and offline commands.
All six 8772eb0 commands returned zero, with zero loopback requests. The baseline rejected the profile command with exit 3.
Both screenshots and all 16 GIF frames passed visual inspection.
This recording does not demonstrate the directory-replacement repair or native graphical terminal acceptance.

Before:

After:

The profile recording recipe uses isolated synthetic settings and offline commands.

Historical folder recordings compare macOS draft 8476466 with runtime dab5c29e, retained in a1f98de.

Before:

After:

Recording recipe · 40-column screenshot

The original feature replay compares base e6893982 with draft 8476466.
It demonstrates linking, inspection, a synthetic Files request, and unlinking.

[github-actions]

Castiron custom code

Evaluated main: 7639dab16a033ef6335cbb386b990b2ff6098d80.

Trusted main policy: 7639dab16a033ef6335cbb386b990b2ff6098d80.

✅ No new custom-code files detected.

0 mixed files remain; 0 existing customizations changed.

Compared 7639dab16a03 → 721943ab5d3f. Generated baselines verified.

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 39377321776 --repo openai/openai-cli \
  --name castiron-custom-code-39377321776-1 --dir /tmp/castiron-custom-code-39377321776-1
git apply --stat /tmp/castiron-custom-code-39377321776-1/custom-code.patch
cat /tmp/castiron-custom-code-39377321776-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin 7639dab16a033ef6335cbb386b990b2ff6098d80 721943ab5d3ffb18e904f3ffe94de5ae13c07176
python3 scripts/castiron/custom_code_report.py report \
  --base 7639dab16a033ef6335cbb386b990b2ff6098d80 \
  --head 721943ab5d3ffb18e904f3ffe94de5ae13c07176 --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-721943ab5d3f
cat /tmp/castiron-custom-code-721943ab5d3f/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch