Profile-specific `auth.json` for Codex CLI

What variant of Codex are you using?

CLI

What feature would you like to see?

Please make Codex load a profile-specific auth file when a runtime config
profile is selected.

Today, codex --profile work (or codex -p work) layers
$CODEX_HOME/work.config.toml over $CODEX_HOME/config.toml, but authentication
still uses only $CODEX_HOME/auth.json. This prevents using two ChatGPT
accounts with two profiles.

Suggested behavior:

codex --profile work
  1. load $CODEX_HOME/work.auth.json when it exists and is valid
  2. when that file is absent, load $CODEX_HOME/auth.json for backward compatibility
  3. when that file exists but is invalid, return an error

With this layout:

$CODEX_HOME/
  config.toml
  work.config.toml
  auth.json          # default account
  work.auth.json     # work account

codex would use the default account, while codex --profile work would use
the work account.

Additional information

I explored a prototype of this behavior, but the blast radius is larger than
the file lookup alone. Profile-scoped authentication also interacts with
Auto storage fallback, cloud-config policy loading, config-lock replay, token
refresh persistence, restriction-triggered cleanup, and logout/revocation
behavior. Implementing only the normal file-loading path could cause different
parts of the same profile session to use different accounts.

Before reworking the implementation, it would be helpful to confirm the
intended semantics:

• Should profile scope apply only to explicit file storage, or also to the file

fallback used by Auto storage?

• Should cloud-config and managed-policy loading use the profile account or the

global account?

• Should logout and token revocation target the active profile or remain

global?

• Should config-lock replay preserve the CLI-selected profile for auth-file

resolution?

Once these boundaries are agreed on, the implementation can be rebuilt and
split into smaller, reviewable changes.