Feature request: opt out of server-side chat storage / keep local CLI chats local-only

Context

I run Codex in two forms on Linux:

• codex CLI (codex-cli 0.147.0)
• codex-desktop-linux

I authenticate with a ChatGPT account. ~/.codex/config.toml uses:

model_provider = "chatgpt-http"

[model_providers.chatgpt-http]
base_url = "https://chatgpt.com/backend-api/codex"
requires_openai_auth = true

I use a single Pro account shared across a team, and every local chat I start in the CLI or desktop app appears in the account's chat list. Because all clients read the same account, everyone on the account can see each other's conversations.

Team privacy risk

This is a privacy/security concern, not just a preference:

• A shared-account team has no separation of conversations; sensitive client work is visible to every member using the account.
• There is no per-user or per-device boundary when a single plan seat is reused by a team.
• Conversations cannot be kept off the shared account without switching to API-key billing (which a Pro plan does not include).

What I want

A way to keep local chats local-only — not stored as saved threads in the ChatGPT/Codex account — while still authenticating with the ChatGPT account (to keep plan-based usage).

Concretely, one of:

1. A config key to disable server-side thread persistence (e.g. threads.store = "local" | "account"), or
2. A per-session "local-only / ephemeral" mode, or
3. A privacy toggle in the desktop app to stop publishing local conversations to the account.

What I found

• history.persistence = "none" only stops writing the local history.jsonl; it does not affect the server-side copy.
• There is no sync-related key in the config reference.
• Conversations are stored server-side because the chatgpt-http provider talks directly to chatgpt.com/backend-api/codex, so the backend is the source of truth.

Related issues

• #31871 (privacy setting between ChatGPT and Codex surfaces)
• #35812 (local-only transfer for Work chats)
• #28187 (local session retention/cleanup UX)

Ask

Is server-side thread storage an intentional requirement of ChatGPT-account auth, or is there a planned way to opt out? If not planned, this would be very valuable for shared-account/team scenarios.

Start by reviewing the provider configuration in ~/.codex/config.toml, the chatgpt-http provider behavior, and the config reference. Compare the reported history.persistence behavior with the related issues #31871, #35812, and #28187. Done would mean a clearly defined local-only or ephemeral mode that prevents server-side thread storage while retaining ChatGPT-account authentication.