@h2562961224/cc-runner 0.1.0 → 0.2.0

package/README.md

@@ -35,6 +35,42 @@ cc-runner install        # 挂载 launchd:开机自启、crash 自动拉起
 
 验证:`cc-runner status`;日志 `tail -f ~/.cc-runner/logs/daemon.log`。
 
+## 多账号:一个进程挂多组 token / 工作区
+
+一台机器要同时接几个 workspace(不同组织、不同项目、公私分开)时,不用起多个进程 —— `add` 就行:
+
+```bash
+cc-runner add --name acme     --api https://a.example.com/functions/v1/runner-api --token <tokenA> --workdir ~/work/acme
+cc-runner add --name personal --api https://b.example.com/functions/v1/runner-api --token <tokenB> --workdir ~/side
+cc-runner list        # 看所有账号
+cc-runner remove --name acme [--purge]
+```
+
+每个账号是一个**独立实例**:独立轮询、独立队列、独立数据目录 `~/.cc-runner/data/<账号名>/`。所以
+
+- **去重表不串**:两个服务器各发一条 `id=1` 的 job,`dedup_key` 都是 `job:1`,但 `done` 表按账号分家,不会被误吞。
+- **白名单按账号收窄**:`allowed_workdirs` 挂在账号上 —— 多账号场景下这是账号之间**唯一的隔离边界**,acme 的任务落不进 personal 的目录。
+- **并发有闸**:账号内串行,跨账号再过一层进程级 `max_concurrent_jobs`(默认 1),免得 N 个账号同时把机器跑满。要放开就在 config 顶层调大。
+
+配置形态(顶层字段是所有账号的默认值,账号里写同名字段即覆盖):
+
+```jsonc
+{
+  "max_concurrent_jobs": 1,
+  "poll_interval_seconds": 30,          // 公共默认
+  "accounts": [
+    { "name": "acme", "api_url": "...", "runner_token": "...", "allowed_workdirs": ["~/work/acme"] },
+    { "name": "personal", "api_url": "...", "runner_token": "...", "allowed_workdirs": ["~/side"],
+      "poll_interval_seconds": 60,      // 覆盖公共默认
+      "env": { "FOO": "bar" } }         // 透传给 claude 子进程的环境变量
+  ]
+}
+```
+
+旧版单账号扁平配置(顶层直接写 `api_url`/`runner_token`)照常能读,首次启动会自动把 `data/state.json`、`data/outbox/` 并进 `data/default/`,待补传的上报和 done 表都不丢。
+
+> ⚠️ 多 token 隔离的是**平台侧身份**(哪个 workspace 的队列、结果回填到哪),**不隔离本地 Claude 登录态** —— 所有任务都由同一个 `claude` 二进制、同一份凭证执行。要按账号分开计费/换号,用账号的 `env` 字段透传对应的环境变量。
+
 ## 协议契约(runner-api,全部 POST + `X-Runner-Token`)
 
 | 动作 | 调用 | 返回 |
@@ -54,24 +90,25 @@ cc-runner install        # 挂载 launchd:开机自启、crash 自动拉起
 ## 安全边界
 
 - 本地只有出站 HTTPS,不监听端口。
-- 云端建任务 ≈ 在本机执行代码:`allowed_workdirs` 白名单**由本地 config 说了算**,云端下发的 workdir 不在白名单内直接 `rejected`,不执行。
+- 云端建任务 ≈ 在本机执行代码:`allowed_workdirs` 白名单**由本地 config 说了算**,云端下发的 workdir 不在白名单内直接 `rejected`,不执行。白名单**按账号独立**,多账号之间靠它隔离。
 - `config.json` 含 runner token,权限 0600;默认 `--dangerously-skip-permissions` 跑 cc,介意就改 `claude_args`(如 `--permission-mode acceptEdits`)。
 
 ## 目录
 
 ```
 ~/.cc-runner/
-├── config.json          init 生成(0600)
-├── logs/daemon.log      launchd 重定向
+├── config.json              init/add 生成(0600)
+├── logs/daemon.log          launchd 重定向
 └── data/
-    ├── state.json       定时任务版本+缓存+done 表+outbox 序号
-    ├── outbox/          待补传的 /report(可重放)
-    └── transcripts/     每次执行的 cc 原始输出(按 run_id)
+    └── <账号名>/            每个账号一套,互不干扰
+        ├── state.json       定时任务版本+缓存+done 表+outbox 序号
+        ├── outbox/          待补传的 /report(可重放)
+        └── transcripts/     每次执行的 cc 原始输出(按 run_id)
 ```
 
 ## 已知取舍(MVP)
 
 - 轮询间隔即指令延迟(默认 30s);想更低做 long-poll,协议不用改。
 - cron 回看窗口 48h;`catchup_latest` 停机超 48h 不补。
-- 串行执行,同刻多任务排队;超时 SIGKILL。
+- 账号内串行,跨账号受 `max_concurrent_jobs`(默认 1)限流,同刻多任务排队;超时 SIGKILL。
 - 日志不轮转,大了自己清。

package/bin/cli.js

@@ -1,15 +1,16 @@
 #!/usr/bin/env node
-// cc-runner CLI:init(写配置)/ start(前台跑)/ install(挂 launchd 常驻)
-//              / uninstall / status
+// cc-runner CLI:init(写配置)/ add|remove|list(多账号)/ start(前台跑)
+//              / install(挂 launchd 常驻)/ uninstall / status
 'use strict';
 
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const { execSync } = require('child_process');
+const {
+  HOME_DIR, CONFIG_PATH, INHERITED, dataDirFor, loadRaw, saveRaw, normalize, validate,
+} = require('../config');
 
-const HOME_DIR = process.env.CC_RUNNER_HOME || path.join(os.homedir(), '.cc-runner');
-const CONFIG_PATH = path.join(HOME_DIR, 'config.json');
 const LOG_DIR = path.join(HOME_DIR, 'logs');
 const PLIST_LABEL = 'com.cc-runner.daemon';
 const PLIST_PATH = path.join(os.homedir(), 'Library', 'LaunchAgents', `${PLIST_LABEL}.plist`);
@@ -34,15 +35,23 @@ function usage() {
 
 用法:
   cc-runner init --api <runner-api地址> --token <X-Runner-Token> [选项]   写配置到 ~/.cc-runner/
-      选项: --workdir <path>   允许执行任务的目录白名单,可重复(默认 ~)
+      选项: --name <账号名>    账号标识,决定数据目录(默认 default)
+            --workdir <path>   允许执行任务的目录白名单,可重复(默认 ~)
             --feishu <webhook> 默认飞书通知地址
             --poll <秒>        轮询间隔(默认 30)
             --model <model>    执行任务用的模型
+            --force            覆盖已有的多账号配置
       说明: runner 身份由 token 决定,凭证在控制台 Runner 页复制、可随时重置
+
+  cc-runner add --name <账号名> --api <地址> --token <token> [同上选项]
+                               再挂一组 token/工作区到同一个进程(多 workspace)
+  cc-runner remove --name <账号名> [--purge]   摘掉一个账号(--purge 连数据目录一起删)
+  cc-runner list               列出所有账号
+
   cc-runner start              前台运行(调试用)
   cc-runner install            挂载为 launchd 常驻服务(macOS,开机自启+守护)
   cc-runner uninstall          卸载 launchd 服务
-  cc-runner status             查看运行状态与最近任务`);
+  cc-runner status             查看运行状态与最近任务(按账号分组)`);
 }
 
 function requireConfig() {
@@ -52,28 +61,108 @@ function requireConfig() {
   }
 }
 
+// 从 flag 拼一个 account 对象,只写用户实际给了的字段
+function accountFromFlags(f, defaultName) {
+  const a = {
+    name: f.name || defaultName,
+    api_url: f.api.replace(/\/$/, ''),
+    runner_token: f.token,
+    allowed_workdirs: f.workdir || [os.homedir()],
+  };
+  if (f.poll) a.poll_interval_seconds = parseInt(f.poll, 10);
+  if (f.feishu) a.default_feishu_webhook = f.feishu;
+  if (f.model) a.model = f.model;
+  return a;
+}
+
+// 读出来永远按多账号形态回写,避免 CLI 还要处理扁平/嵌套两种写法
+function loadForEdit() {
+  const raw = loadRaw() || {};
+  const conf = normalize(raw);
+  return { raw, accounts: conf.accounts };
+}
+
+function writeAccounts(raw, accounts, maxConcurrent) {
+  // 顶层的公共默认值(api_url/poll/model/...)normalize 时已经并进各 account,
+  // 不再重复写回顶层;其余顶层字段是用户自己加的,原样留着。
+  const out = { ...raw };
+  for (const k of INHERITED) delete out[k];
+  delete out.name; delete out.runner_token; delete out.runner_id; // 旧扁平配置的残留
+  out.max_concurrent_jobs = maxConcurrent ?? raw.max_concurrent_jobs ?? 1;
+  out.accounts = accounts;
+  saveRaw(out);
+}
+
 switch (cmd) {
   case 'init': {
     const f = parseFlags(rest, ['workdir']);
     if (!f.api || !f.token) { console.error('init 需要 --api 和 --token'); process.exit(1); }
-    fs.mkdirSync(HOME_DIR, { recursive: true });
-    const cfg = {
-      api_url: f.api.replace(/\/$/, ''),
-      runner_token: f.token,
-      runner_id: f.runner || '', // 留空:身份以服务器 heartbeat 返回的为准
-      poll_interval_seconds: f.poll ? parseInt(f.poll, 10) : 30,
-      allowed_workdirs: f.workdir || [os.homedir()],
-      default_feishu_webhook: f.feishu || '',
-      model: f.model || '',
-      claude_args: ['--dangerously-skip-permissions'],
-    };
-    fs.writeFileSync(CONFIG_PATH, JSON.stringify(cfg, null, 2));
-    fs.chmodSync(CONFIG_PATH, 0o600); // 里面有 runner token
-    console.log(`已写入 ${CONFIG_PATH}`);
+    const existing = loadRaw();
+    if (existing && !f.force) {
+      const n = normalize(existing).accounts.length;
+      if (n > 1) {
+        console.error(`已有 ${n} 个账号的配置,init 会全部覆盖。想再加一个用 cc-runner add,确实要重置加 --force`);
+        process.exit(1);
+      }
+    }
+    const acct = accountFromFlags(f, 'default');
+    acct.claude_args = ['--dangerously-skip-permissions'];
+    writeAccounts({}, [acct], 1);
+    console.log(`已写入 ${CONFIG_PATH}(账号 ${acct.name})`);
     console.log('下一步: cc-runner install(常驻)或 cc-runner start(前台调试)');
     break;
   }
 
+  case 'add': {
+    const f = parseFlags(rest, ['workdir']);
+    if (!f.api || !f.token || !f.name) { console.error('add 需要 --name、--api 和 --token'); process.exit(1); }
+    const { raw, accounts } = loadForEdit();
+    if (accounts.some((a) => a.name === f.name)) {
+      console.error(`账号 ${f.name} 已存在(名字决定数据目录,必须唯一)。先 remove 或换个名字`);
+      process.exit(1);
+    }
+    const acct = accountFromFlags(f);
+    acct.claude_args = ['--dangerously-skip-permissions'];
+    accounts.push(acct);
+    writeAccounts(raw, accounts);
+    console.log(`已添加账号 ${acct.name},白名单: ${acct.allowed_workdirs.join(', ')}`);
+    console.log('重启守护进程生效: cc-runner install(会先卸载再挂载)');
+    break;
+  }
+
+  case 'remove': {
+    const f = parseFlags(rest);
+    if (!f.name) { console.error('remove 需要 --name'); process.exit(1); }
+    const { raw, accounts } = loadForEdit();
+    const left = accounts.filter((a) => a.name !== f.name);
+    if (left.length === accounts.length) { console.error(`没有叫 ${f.name} 的账号`); process.exit(1); }
+    writeAccounts(raw, left);
+    console.log(`已摘掉账号 ${f.name}`);
+    if (f.purge) {
+      fs.rmSync(dataDirFor(f.name), { recursive: true, force: true });
+      console.log(`数据目录已删除: ${dataDirFor(f.name)}`);
+    } else {
+      console.log(`数据目录保留在 ${dataDirFor(f.name)}(要删加 --purge)`);
+    }
+    break;
+  }
+
+  case 'list': {
+    requireConfig();
+    const conf = normalize(loadRaw() || {});
+    const accounts = conf.accounts;
+    console.log(`并发上限: ${conf.maxConcurrent}`);
+    for (const a of accounts) {
+      const wd = (a.allowed_workdirs || []).join(', ') || '(空 — 所有任务都会被拒)';
+      console.log(`- ${a.name}  ${a.api_url}`);
+      console.log(`    token: ...${String(a.runner_token || '').slice(-6)}  poll: ${a.poll_interval_seconds || 30}s`);
+      console.log(`    workdirs: ${wd}`);
+    }
+    const problems = validate(conf);
+    for (const p of problems) console.log(`  ! ${p}`);
+    break;
+  }
+
   case 'start': {
     requireConfig();
     require(path.join(__dirname, '..', 'runner.js'));
@@ -126,16 +215,21 @@ switch (cmd) {
     let loaded = false;
     try { loaded = execSync('launchctl list').toString().includes(PLIST_LABEL); } catch (_) { /* 非 macOS */ }
     console.log(`launchd: ${loaded ? '已挂载' : '未挂载'}`);
-    try {
-      const st = JSON.parse(fs.readFileSync(path.join(HOME_DIR, 'data', 'state.json'), 'utf8'));
-      console.log(`同步版本: ${st.schedule_version},定时任务数: ${(st.schedules || []).length}`);
-      const done = Object.entries(st.done || {}).sort((a, b) => (a[1].at < b[1].at ? 1 : -1)).slice(0, 5);
-      for (const [k, v] of done) console.log(`  最近执行: ${k}  ${v.status}  ${v.at}`);
-    } catch (_) { console.log('还没有本地状态(从未成功同步/执行)'); }
-    const outbox = path.join(HOME_DIR, 'data', 'outbox');
-    if (fs.existsSync(outbox)) {
-      const n = fs.readdirSync(outbox).length;
-      if (n) console.log(`待补传上报: ${n} 条`);
+    const { accounts } = loadForEdit();
+    for (const a of accounts) {
+      const dir = dataDirFor(a.name);
+      console.log(`\n账号 ${a.name}  (${dir})`);
+      try {
+        const st = JSON.parse(fs.readFileSync(path.join(dir, 'state.json'), 'utf8'));
+        console.log(`  同步版本: ${st.schedule_version},定时任务数: ${(st.schedules || []).length}`);
+        const done = Object.entries(st.done || {}).sort((x, y) => (x[1].at < y[1].at ? 1 : -1)).slice(0, 5);
+        for (const [k, v] of done) console.log(`  最近执行: ${k}  ${v.status}  ${v.at}`);
+      } catch (_) { console.log('  还没有本地状态(从未成功同步/执行)'); }
+      const outbox = path.join(dir, 'outbox');
+      if (fs.existsSync(outbox)) {
+        const n = fs.readdirSync(outbox).length;
+        if (n) console.log(`  待补传上报: ${n} 条`);
+      }
     }
     break;
   }

package/config.js

@@ -0,0 +1,96 @@
+// 配置加载与规范化。runner.js 和 bin/cli.js 共用,保证两边对"账号"的理解一致。
+//
+// 配置有两种形态,都能读:
+//   1) 多账号(推荐):{ max_concurrent_jobs, accounts: [{ name, api_url, runner_token, ... }] }
+//   2) 单账号扁平(旧版):{ api_url, runner_token, ... }  —— 自动包成 name 为 default 的单账号
+// 顶层的公共字段(poll_interval_seconds / claude_bin / model / ...)是所有账号的默认值,
+// account 里写同名字段即覆盖。
+
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const HOME_DIR = process.env.CC_RUNNER_HOME || path.join(os.homedir(), '.cc-runner');
+const CONFIG_PATH = process.env.CC_RUNNER_CONFIG || path.join(HOME_DIR, 'config.json');
+const DATA_ROOT = path.join(HOME_DIR, 'data');
+
+// 云端下发的 workdir 常含字面量 ~(平台 UI 里用户自然会填 ~/xxx),path.resolve 不认
+// ~,会拼成 <cwd>/~/xxx。这里统一把开头的 ~ 展开成 home,再交给 resolve/白名单/spawn。
+function expandTilde(p) {
+  if (typeof p !== 'string' || !p) return p;
+  if (p === '~') return os.homedir();
+  if (p.startsWith('~/')) return path.join(os.homedir(), p.slice(2));
+  return p;
+}
+
+// 账号名 -> 文件系统安全的目录名。账号名在配置里校验唯一,所以这个 key 也唯一。
+function accountKey(name) {
+  return String(name || '').replace(/[^a-zA-Z0-9._-]/g, '_') || 'default';
+}
+
+function dataDirFor(name) {
+  return path.join(DATA_ROOT, accountKey(name));
+}
+
+// 顶层可写、account 可覆盖的字段
+const INHERITED = [
+  'api_url', 'poll_interval_seconds', 'claude_bin', 'claude_args', 'model',
+  'default_feishu_webhook', 'job_pull_limit', 'allowed_workdirs', 'env',
+];
+
+function loadRaw() {
+  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf8')); } catch (_) { return null; }
+}
+
+function saveRaw(raw) {
+  fs.mkdirSync(HOME_DIR, { recursive: true });
+  fs.writeFileSync(CONFIG_PATH, JSON.stringify(raw, null, 2));
+  fs.chmodSync(CONFIG_PATH, 0o600); // 里面有 runner token
+}
+
+// raw config -> { maxConcurrent, accounts: [...] }
+function normalize(raw) {
+  const maxConcurrent = Math.max(1, Number(raw.max_concurrent_jobs) || 1);
+  let accounts = [];
+  if (Array.isArray(raw.accounts) && raw.accounts.length) {
+    accounts = raw.accounts.map((a, i) => {
+      const inherited = {};
+      for (const k of INHERITED) if (raw[k] !== undefined) inherited[k] = raw[k];
+      return { name: `account${i + 1}`, ...inherited, ...a };
+    });
+  } else if (raw.api_url || raw.runner_token) {
+    const flat = { ...raw };
+    delete flat.accounts;
+    delete flat.max_concurrent_jobs;
+    accounts = [{ name: 'default', ...flat }];
+  }
+  return { maxConcurrent, accounts };
+}
+
+// 返回人类可读的问题列表,空数组 = 配置可用
+function validate(conf) {
+  const problems = [];
+  if (!conf.accounts.length) {
+    problems.push('配置里没有任何账号,先跑: cc-runner init --api <runner-api地址> --token <X-Runner-Token>');
+    return problems;
+  }
+  const seen = new Set();
+  for (const a of conf.accounts) {
+    const label = a.name || '(未命名)';
+    if (!a.name) problems.push('有账号缺 name');
+    else if (seen.has(a.name)) problems.push(`账号名重复: ${a.name}(名字决定数据目录,必须唯一)`);
+    else seen.add(a.name);
+    for (const k of ['api_url', 'runner_token']) {
+      if (!a[k]) problems.push(`账号 ${label} 缺少 ${k}(旧版 cloud_url/service_key 已废弃)`);
+    }
+  }
+  return problems;
+}
+
+module.exports = {
+  HOME_DIR, CONFIG_PATH, DATA_ROOT, INHERITED,
+  expandTilde, accountKey, dataDirFor,
+  loadRaw, saveRaw, normalize, validate,
+};

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@h2562961224/cc-runner",
-  "version": "0.1.0",
-  "description": "云端下发、本地执行的 Claude Code 任务守护进程(纯中心化 pull 模型,零依赖)",
+  "version": "0.2.0",
+  "description": "云端下发、本地执行的 Claude Code 任务守护进程(纯中心化 pull 模型,零依赖,支持一个进程挂多组 token/工作区)",
   "bin": {
     "cc-runner": "bin/cli.js"
   },
   "files": [
     "bin/cli.js",
+    "config.js",
     "runner.js",
     "README.md",
     "skills/"

package/runner.js

@@ -6,6 +6,11 @@
 // 一律由服务器生成为待领队列,runner 先 /claim 领到才执行** —— 不在本地算 cron、
 // 不离线自跑。断网就是纯粹拉不到任务,恢复后继续领。
 //
+// 多账号:一个进程可以同时挂多组 (token, workdir 白名单)。每个账号是一个独立实例 ——
+// 独立轮询、独立队列、独立数据目录(~/.cc-runner/data/<账号名>/),互不串扰;
+// 真正 spawn claude 时过一个**进程级并发闸**(max_concurrent_jobs,默认 1),
+// 免得 N 个账号同时炸开把机器跑满。
+//
 // 四个操作,全部 POST:
 //   /heartbeat  每 30s 打卡,返回 { schedulesVersion }
 //   /sync       版本变了拉本机定时任务定义(仅本地缓存供 status 展示,不驱动执行)
@@ -19,141 +24,59 @@
 'use strict';
 
 const fs = require('fs');
-const os = require('os');
 const path = require('path');
 const crypto = require('crypto');
 const { spawn } = require('child_process');
+const {
+  CONFIG_PATH, DATA_ROOT, expandTilde, dataDirFor, loadRaw, normalize, validate,
+} = require('./config');
 
 // ---------------------------------------------------------------------------
-// 配置与状态
+// 配置
 // ---------------------------------------------------------------------------
-const HOME_DIR = process.env.CC_RUNNER_HOME || path.join(os.homedir(), '.cc-runner');
-const CONFIG_PATH = process.env.CC_RUNNER_CONFIG || path.join(HOME_DIR, 'config.json');
-let cfg;
-try { cfg = JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf8')); } catch (e) {
+const raw = loadRaw();
+if (!raw) {
   console.error(`[fatal] 读不到配置 ${CONFIG_PATH},先跑: cc-runner init --api <runner-api地址> --token <X-Runner-Token>`);
   process.exit(1);
 }
-for (const k of ['api_url', 'runner_token']) {
-  if (!cfg[k]) { console.error(`[fatal] config 缺少 ${k}(旧版 cloud_url/service_key 已废弃,请重新 cc-runner init)`); process.exit(1); }
-}
-const API_BASE = cfg.api_url.replace(/\/$/, '');
-let runnerId = cfg.runner_id || 'default'; // 本地标签;首次 heartbeat 后用服务器返回的真实值覆盖
-let orgName = '';
-const POLL_MS = (cfg.poll_interval_seconds || 30) * 1000;
-const CLAUDE_BIN = cfg.claude_bin || 'claude';
-const CLAUDE_ARGS = cfg.claude_args || ['--dangerously-skip-permissions'];
-const MODEL = cfg.model || '';
-// 云端下发的 workdir 常含字面量 ~(平台 UI 里用户自然会填 ~/xxx),path.resolve 不认
-// ~,会拼成 <cwd>/~/xxx。这里统一把开头的 ~ 展开成 home,再交给 resolve/白名单/spawn。
-function expandTilde(p) {
-  if (typeof p !== 'string' || !p) return p;
-  if (p === '~') return os.homedir();
-  if (p.startsWith('~/')) return path.join(os.homedir(), p.slice(2));
-  return p;
-}
-const ALLOWED_WORKDIRS = (cfg.allowed_workdirs || []).map((p) => path.resolve(expandTilde(p)));
-const JOB_PULL_LIMIT = cfg.job_pull_limit || 20; // 每轮最多 /claim 多少条,防一次拉太多
-
-const DATA_DIR = path.join(HOME_DIR, 'data');
-const OUTBOX_DIR = path.join(DATA_DIR, 'outbox');
-const TRANSCRIPT_DIR = path.join(DATA_DIR, 'transcripts');
-const STATE_PATH = path.join(DATA_DIR, 'state.json');
-for (const d of [DATA_DIR, OUTBOX_DIR, TRANSCRIPT_DIR]) fs.mkdirSync(d, { recursive: true });
-
-// state = { schedule_version, schedules: [](仅缓存展示), done: {"<dedup_key>": {status, at}}, outbox_seq }
-let state = { schedule_version: -1, schedules: [], done: {}, outbox_seq: 0 };
-try { state = { ...state, ...JSON.parse(fs.readFileSync(STATE_PATH, 'utf8')) }; } catch (_) { /* 首次运行 */ }
-
-function saveState() {
-  const keys = Object.keys(state.done);
-  if (keys.length > 5000) {
-    keys.sort((a, b) => (state.done[a].at < state.done[b].at ? -1 : 1));
-    for (const k of keys.slice(0, keys.length - 5000)) delete state.done[k];
-  }
-  fs.writeFileSync(STATE_PATH, JSON.stringify(state));
-}
-
-function log(msg) { console.log(`${new Date().toISOString()} ${msg}`); }
-
-// ---------------------------------------------------------------------------
-// runner-api 调用(POST + X-Runner-Token)
-//   抛出的 error 带 .retriable:网络错误/5xx 可重试;4xx/{error} 视为永久失败。
-// ---------------------------------------------------------------------------
-async function api(op, body) {
-  let res;
-  try {
-    res = await fetch(`${API_BASE}/${op}`, {
-      method: 'POST',
-      headers: { 'X-Runner-Token': cfg.runner_token, 'Content-Type': 'application/json' },
-      body: JSON.stringify(body || {}),
-      signal: AbortSignal.timeout(20000),
-    });
-  } catch (e) {
-    const err = new Error(`${op} 网络错误: ${e.message}`); err.retriable = true; throw err;
-  }
-  const text = await res.text();
-  let data = null; try { data = text ? JSON.parse(text) : null; } catch (_) { /* 非 JSON */ }
-  if (!res.ok || (data && data.error)) {
-    const msg = (data && data.error) ? data.error : `${res.status} ${text.slice(0, 200)}`;
-    const err = new Error(`${op} -> ${msg}`); err.retriable = res.status >= 500; throw err;
-  }
-  return data;
-}
-
-// ---------------------------------------------------------------------------
-// 心跳拿版本 + 定时任务定义同步(仅缓存,供 status 展示;执行一律走 /claim)
-// ---------------------------------------------------------------------------
-async function heartbeat() {
-  const r = await api('heartbeat');
-  if (r && r.runner) runnerId = r.runner;
-  if (r && r.orgName) orgName = r.orgName;
-  return r && r.schedulesVersion != null ? Number(r.schedulesVersion) : null;
+const conf = normalize(raw);
+const problems = validate(conf);
+if (problems.length) {
+  for (const p of problems) console.error(`[fatal] ${p}`);
+  process.exit(1);
 }
 
-async function syncSchedules() {
-  const r = await api('sync');
-  state.schedules = Array.isArray(r && r.schedules) ? r.schedules : [];
-  if (r && r.version != null) state.schedule_version = Number(r.version);
-  saveState();
-  log(`[sync] 定时任务版本 ${state.schedule_version},清单 ${state.schedules.length} 条(仅缓存,执行走 /claim)`);
-}
+function ts() { return new Date().toISOString(); }
 
 // ---------------------------------------------------------------------------
-// 领取任务队列(服务器原子认领,逐条领到空为止)。webhook / 手动 / 定时 都在这。
+// 进程级并发闸:限制同时在跑的 claude 进程数,跨账号共享
 // ---------------------------------------------------------------------------
-async function claimJobs() {
-  const items = [];
-  for (let i = 0; i < JOB_PULL_LIMIT; i++) {
-    const r = await api('claim');
-    const job = r && r.job;
-    if (!job) break; // 队列空
-    items.push({
-      dedupKey: job.dedup_key || `job:${job.id}`, source: job.source || 'webhook', jobId: job.id,
-      scheduledAt: job.scheduled_at || job.created_at,
-      name: job.source === 'webhook' ? `webhook:${job.trigger_id || ''}` : (job.source || 'job'),
-      prompt: job.prompt, workdir: expandTilde(job.workdir),
-      timeoutSeconds: job.timeout_seconds || 900, output: job.output || {},
-    });
-  }
-  return items;
+function createSemaphore(limit) {
+  let active = 0;
+  const waiters = [];
+  return {
+    acquire() {
+      if (active < limit) { active++; return Promise.resolve(); }
+      return new Promise((resolve) => waiters.push(resolve));
+    },
+    release() {
+      const next = waiters.shift();
+      if (next) next(); // 名额直接转交,active 不变
+      else active--;
+    },
+  };
 }
+const gate = createSemaphore(conf.maxConcurrent);
 
 // ---------------------------------------------------------------------------
-// 执行
+// 执行 claude(纯函数,所有账号相关的东西从 ctx 传进来)
 // ---------------------------------------------------------------------------
-function workdirAllowed(dir) {
-  if (!ALLOWED_WORKDIRS.length) return false; // 白名单空 = 全拒,安全兜底本地说了算
-  const r = path.resolve(dir || '');
-  return ALLOWED_WORKDIRS.some((w) => r === w || r.startsWith(w + path.sep));
-}
-
-function runClaude(item, runId) {
+function runClaude(item, runId, ctx) {
   return new Promise((resolve) => {
-    const args = ['-p', item.prompt, '--output-format', 'json', ...CLAUDE_ARGS];
-    if (MODEL) args.push('--model', MODEL);
+    const args = ['-p', item.prompt, '--output-format', 'json', ...ctx.claudeArgs];
+    if (ctx.model) args.push('--model', ctx.model);
     const timeoutMs = item.timeoutSeconds * 1000;
-    const child = spawn(CLAUDE_BIN, args, { cwd: item.workdir, env: process.env, stdio: ['ignore', 'pipe', 'pipe'] });
+    const child = spawn(ctx.claudeBin, args, { cwd: item.workdir, env: ctx.env, stdio: ['ignore', 'pipe', 'pipe'] });
     let out = ''; let errOut = ''; let timedOut = false;
     const timer = setTimeout(() => { timedOut = true; child.kill('SIGKILL'); }, timeoutMs);
     child.stdout.on('data', (d) => { out += d; });
@@ -161,7 +84,7 @@ function runClaude(item, runId) {
     child.on('error', (e) => { clearTimeout(timer); resolve({ status: 'failed', error: `spawn 失败: ${e.message}` }); });
     child.on('close', (code) => {
       clearTimeout(timer);
-      fs.writeFileSync(path.join(TRANSCRIPT_DIR, `${runId}.json`), out || errOut || '');
+      fs.writeFileSync(path.join(ctx.transcriptDir, `${runId}.json`), out || errOut || '');
       if (timedOut) return resolve({ status: 'timeout', error: `超时(${timeoutMs / 1000}s)强杀`, exitCode: code });
       let summary = '';
       try { summary = String(JSON.parse(out).result || '').slice(0, 4000); } catch (_) { summary = (out || '').slice(0, 4000); }
@@ -171,124 +94,275 @@ function runClaude(item, runId) {
   });
 }
 
-async function notifyFeishu(item, run) {
-  const url = (item.output && item.output.feishu_webhook) || cfg.default_feishu_webhook;
-  if (!url) return;
-  const icon = { success: '✅', failed: '❌', timeout: '⏱️', rejected: '🚫' }[run.status] || '•';
-  const body = {
-    msg_type: 'interactive',
-    card: {
-      header: { title: { tag: 'plain_text', content: `${icon} [${run.status}] ${item.name}` },
-        template: run.status === 'success' ? 'green' : 'red' },
-      elements: [{ tag: 'markdown',
-        content: `${(run.summary || run.error || '(无输出)').slice(0, 2000)}\n<font color="grey">runner ${runnerId} · ${item.source} · ${run.scheduled_at}</font>` }],
-    },
-  };
-  try {
-    await fetch(url, { method: 'POST', headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(body), signal: AbortSignal.timeout(10000) });
-  } catch (e) { log(`[feishu] ${e.message}`); }
-}
-
 // ---------------------------------------------------------------------------
-// 上报(outbox:存可重放的 /report 调用;断线累积,恢复补传)
+// 一个账号 = 一个 runner 实例
 // ---------------------------------------------------------------------------
-function enqueueOp(op) {
-  const seq = String(state.outbox_seq++).padStart(9, '0');
-  fs.writeFileSync(path.join(OUTBOX_DIR, `${seq}.json`), JSON.stringify(op));
-  saveState();
-}
+function createRunner(acct) {
+  const API_BASE = String(acct.api_url).replace(/\/$/, '');
+  const pollMs = (acct.poll_interval_seconds || 30) * 1000;
+  const jobPullLimit = acct.job_pull_limit || 20; // 每轮最多 /claim 多少条,防一次拉太多
+  const allowedWorkdirs = (acct.allowed_workdirs || []).map((p) => path.resolve(expandTilde(p)));
+  const ctx = {
+    claudeBin: acct.claude_bin || 'claude',
+    claudeArgs: acct.claude_args || ['--dangerously-skip-permissions'],
+    model: acct.model || '',
+    // account.env 可覆盖子进程环境(比如给不同 workspace 配不同的 Claude 凭证目录)
+    env: { ...process.env, ...(acct.env || {}) },
+    transcriptDir: path.join(dataDirFor(acct.name), 'transcripts'),
+  };
 
-async function flushOutbox() {
-  for (const f of fs.readdirSync(OUTBOX_DIR).sort()) {
-    const p = path.join(OUTBOX_DIR, f);
-    let op;
-    try { op = JSON.parse(fs.readFileSync(p, 'utf8')); } catch (_) { fs.unlinkSync(p); continue; }
-    if (!op || !op.op) { fs.unlinkSync(p); continue; } // 旧格式/损坏,丢弃
+  let runnerId = acct.runner_id || acct.name; // 本地标签;首次 heartbeat 后用服务器返回的真实值覆盖
+  let orgName = '';
+
+  const dataDir = dataDirFor(acct.name);
+  const outboxDir = path.join(dataDir, 'outbox');
+  const statePath = path.join(dataDir, 'state.json');
+  for (const d of [dataDir, outboxDir, ctx.transcriptDir]) fs.mkdirSync(d, { recursive: true });
+
+  // state = { schedule_version, schedules: [](仅缓存展示), done: {"<dedup_key>": {status, at}}, outbox_seq }
+  let state = { schedule_version: -1, schedules: [], done: {}, outbox_seq: 0 };
+  try { state = { ...state, ...JSON.parse(fs.readFileSync(statePath, 'utf8')) }; } catch (_) { /* 首次运行 */ }
+
+  function saveState() {
+    const keys = Object.keys(state.done);
+    if (keys.length > 5000) {
+      keys.sort((a, b) => (state.done[a].at < state.done[b].at ? -1 : 1));
+      for (const k of keys.slice(0, keys.length - 5000)) delete state.done[k];
+    }
+    fs.writeFileSync(statePath, JSON.stringify(state));
+  }
+
+  function log(msg) { console.log(`${ts()} [${acct.name}] ${msg}`); }
+
+  // -------------------------------------------------------------------------
+  // runner-api 调用(POST + X-Runner-Token)
+  //   抛出的 error 带 .retriable:网络错误/5xx 可重试;4xx/{error} 视为永久失败。
+  // -------------------------------------------------------------------------
+  async function api(op, body) {
+    let res;
     try {
-      await api(op.op, op.body);
-      fs.unlinkSync(p);
+      res = await fetch(`${API_BASE}/${op}`, {
+        method: 'POST',
+        headers: { 'X-Runner-Token': acct.runner_token, 'Content-Type': 'application/json' },
+        body: JSON.stringify(body || {}),
+        signal: AbortSignal.timeout(20000),
+      });
     } catch (e) {
-      if (e.retriable) { log(`[outbox] ${f} 稍后重试: ${e.message}`); return; } // 网络/5xx:留待下轮
-      log(`[outbox] ${f} 永久失败,丢弃: ${e.message}`); fs.unlinkSync(p); // 4xx(如 job 已被接管)
+      const err = new Error(`${op} 网络错误: ${e.message}`); err.retriable = true; throw err;
+    }
+    const text = await res.text();
+    let data = null; try { data = text ? JSON.parse(text) : null; } catch (_) { /* 非 JSON */ }
+    if (!res.ok || (data && data.error)) {
+      const msg = (data && data.error) ? data.error : `${res.status} ${text.slice(0, 200)}`;
+      const err = new Error(`${op} -> ${msg}`); err.retriable = res.status >= 500; throw err;
     }
+    return data;
   }
-}
 
-function reportRun(item, run) {
-  enqueueOp({ op: 'report', body: {
-    jobId: item.jobId, status: run.status, exitCode: run.exit_code ?? null,
-    summary: run.summary, error: run.error, startedAt: run.started_at, finishedAt: run.finished_at,
-  } });
-}
+  // 心跳拿版本 + 定时任务定义同步(仅缓存,供 status 展示;执行一律走 /claim)
+  async function heartbeat() {
+    const r = await api('heartbeat');
+    if (r && r.runner) runnerId = r.runner;
+    if (r && r.orgName) orgName = r.orgName;
+    return r && r.schedulesVersion != null ? Number(r.schedulesVersion) : null;
+  }
 
-// ---------------------------------------------------------------------------
-// 串行执行队列 + 主循环
-// ---------------------------------------------------------------------------
-const queue = [];
-const enqueued = new Set(); // 本进程内已排队的 dedupKey,防同一 tick 重复入队
-let working = false;
-
-function enqueue(items) {
-  for (const it of items) {
-    if (state.done[it.dedupKey] || enqueued.has(it.dedupKey)) continue;
-    enqueued.add(it.dedupKey);
-    queue.push(it);
+  async function syncSchedules() {
+    const r = await api('sync');
+    state.schedules = Array.isArray(r && r.schedules) ? r.schedules : [];
+    if (r && r.version != null) state.schedule_version = Number(r.version);
+    saveState();
+    log(`[sync] 定时任务版本 ${state.schedule_version},清单 ${state.schedules.length} 条(仅缓存,执行走 /claim)`);
   }
-}
 
-async function processQueue() {
-  if (working) return;
-  working = true;
-  while (queue.length) {
-    const item = queue.shift();
-    const key = item.dedupKey;
-    if (state.done[key]) { enqueued.delete(key); continue; }
-
-    const runId = crypto.randomUUID();
-    const startedAt = new Date().toISOString();
-    log(`[run] ${item.name}(${item.source})sched=${item.scheduledAt}`);
-
-    let result;
-    if (!workdirAllowed(item.workdir)) {
-      result = { status: 'rejected', error: `workdir 不在本地白名单: ${item.workdir}` };
-    } else {
-      result = await runClaude(item, runId);
+  // 领取任务队列(服务器原子认领,逐条领到空为止)。webhook / 手动 / 定时 都在这。
+  async function claimJobs() {
+    const items = [];
+    for (let i = 0; i < jobPullLimit; i++) {
+      const r = await api('claim');
+      const job = r && r.job;
+      if (!job) break; // 队列空
+      items.push({
+        dedupKey: job.dedup_key || `job:${job.id}`, source: job.source || 'webhook', jobId: job.id,
+        scheduledAt: job.scheduled_at || job.created_at,
+        name: job.source === 'webhook' ? `webhook:${job.trigger_id || ''}` : (job.source || 'job'),
+        prompt: job.prompt, workdir: expandTilde(job.workdir),
+        timeoutSeconds: job.timeout_seconds || 900, output: job.output || {},
+      });
     }
+    return items;
+  }
 
-    const run = {
-      scheduled_at: item.scheduledAt, started_at: startedAt, finished_at: new Date().toISOString(),
-      status: result.status, exit_code: result.exitCode ?? null,
-      summary: result.summary || null, error: result.error || null,
+  // 白名单由本地说了算:云端下发的 workdir 不在白名单内直接拒。多账号下这是账号之间
+  // 唯一的隔离边界,所以白名单必须挂在账号上,不能全局共用。
+  function workdirAllowed(dir) {
+    if (!allowedWorkdirs.length) return false; // 白名单空 = 全拒,安全兜底本地说了算
+    const r = path.resolve(dir || '');
+    return allowedWorkdirs.some((w) => r === w || r.startsWith(w + path.sep));
+  }
+
+  async function notifyFeishu(item, run) {
+    const url = (item.output && item.output.feishu_webhook) || acct.default_feishu_webhook;
+    if (!url) return;
+    const icon = { success: '✅', failed: '❌', timeout: '⏱️', rejected: '🚫' }[run.status] || '•';
+    const body = {
+      msg_type: 'interactive',
+      card: {
+        header: { title: { tag: 'plain_text', content: `${icon} [${run.status}] ${item.name}` },
+          template: run.status === 'success' ? 'green' : 'red' },
+        elements: [{ tag: 'markdown',
+          content: `${(run.summary || run.error || '(无输出)').slice(0, 2000)}\n<font color="grey">${orgName ? `${orgName} · ` : ''}runner ${runnerId} · ${item.source} · ${run.scheduled_at}</font>` }],
+      },
     };
-    state.done[key] = { status: result.status, at: run.finished_at }; saveState();
-    enqueued.delete(key);
-    log(`[run] ${item.name} -> ${result.status}`);
-    reportRun(item, run);
-    await flushOutbox();
-    await notifyFeishu(item, run);
+    try {
+      await fetch(url, { method: 'POST', headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body), signal: AbortSignal.timeout(10000) });
+    } catch (e) { log(`[feishu] ${e.message}`); }
   }
-  working = false;
-}
 
-async function tick() {
-  let online = true;
-  // 先补传上一轮攒下的上报
-  try { await flushOutbox(); } catch (e) { log(`[tick/outbox] ${e.message}`); }
-  // 心跳拿版本
-  let remoteVersion = null;
-  try { remoteVersion = await heartbeat(); } catch (e) { online = false; log(`[heartbeat] ${e.message}`); }
-  // 版本变了才拉全量定时任务定义(仅刷新本地缓存,不驱动执行)
-  if (online && remoteVersion !== null && remoteVersion !== state.schedule_version) {
-    try { await syncSchedules(); } catch (e) { log(`[sync] ${e.message}`); }
+  // 上报(outbox:存可重放的 /report 调用;断线累积,恢复补传)
+  function enqueueOp(op) {
+    const seq = String(state.outbox_seq++).padStart(9, '0');
+    fs.writeFileSync(path.join(outboxDir, `${seq}.json`), JSON.stringify(op));
+    saveState();
   }
-  // 唯一执行入口:领取待办队列(webhook / 手动 / 定时都在服务器侧生成为 job)
-  if (online) {
-    try { enqueue(await claimJobs()); } catch (e) { log(`[claim] ${e.message}`); }
+
+  async function flushOutbox() {
+    for (const f of fs.readdirSync(outboxDir).sort()) {
+      const p = path.join(outboxDir, f);
+      let op;
+      try { op = JSON.parse(fs.readFileSync(p, 'utf8')); } catch (_) { fs.unlinkSync(p); continue; }
+      if (!op || !op.op) { fs.unlinkSync(p); continue; } // 旧格式/损坏,丢弃
+      try {
+        await api(op.op, op.body);
+        fs.unlinkSync(p);
+      } catch (e) {
+        if (e.retriable) { log(`[outbox] ${f} 稍后重试: ${e.message}`); return; } // 网络/5xx:留待下轮
+        log(`[outbox] ${f} 永久失败,丢弃: ${e.message}`); fs.unlinkSync(p); // 4xx(如 job 已被接管)
+      }
+    }
   }
-  processQueue();
+
+  function reportRun(item, run) {
+    enqueueOp({ op: 'report', body: {
+      jobId: item.jobId, status: run.status, exitCode: run.exit_code ?? null,
+      summary: run.summary, error: run.error, startedAt: run.started_at, finishedAt: run.finished_at,
+    } });
+  }
+
+  // 串行执行队列(账号内串行;跨账号再过一层 gate)
+  const queue = [];
+  const enqueued = new Set(); // 本实例内已排队的 dedupKey,防同一 tick 重复入队
+  let working = false;
+  let timer = null;
+  let stopped = false;
+
+  function enqueue(items) {
+    for (const it of items) {
+      if (state.done[it.dedupKey] || enqueued.has(it.dedupKey)) continue;
+      enqueued.add(it.dedupKey);
+      queue.push(it);
+    }
+  }
+
+  async function processQueue() {
+    if (working) return;
+    working = true;
+    while (queue.length) {
+      const item = queue.shift();
+      const key = item.dedupKey;
+      if (state.done[key]) { enqueued.delete(key); continue; }
+
+      const runId = crypto.randomUUID();
+      const startedAt = new Date().toISOString();
+      log(`[run] ${item.name}(${item.source})sched=${item.scheduledAt}`);
+
+      let result;
+      if (!workdirAllowed(item.workdir)) {
+        result = { status: 'rejected', error: `workdir 不在本账号白名单: ${item.workdir}` };
+      } else {
+        await gate.acquire();
+        try { result = await runClaude(item, runId, ctx); } finally { gate.release(); }
+      }
+
+      const run = {
+        scheduled_at: item.scheduledAt, started_at: startedAt, finished_at: new Date().toISOString(),
+        status: result.status, exit_code: result.exitCode ?? null,
+        summary: result.summary || null, error: result.error || null,
+      };
+      state.done[key] = { status: result.status, at: run.finished_at }; saveState();
+      enqueued.delete(key);
+      log(`[run] ${item.name} -> ${result.status}`);
+      reportRun(item, run);
+      await flushOutbox();
+      await notifyFeishu(item, run);
+    }
+    working = false;
+  }
+
+  async function tick() {
+    if (stopped) return;
+    let online = true;
+    // 先补传上一轮攒下的上报
+    try { await flushOutbox(); } catch (e) { log(`[tick/outbox] ${e.message}`); }
+    // 心跳拿版本
+    let remoteVersion = null;
+    try { remoteVersion = await heartbeat(); } catch (e) { online = false; log(`[heartbeat] ${e.message}`); }
+    // 版本变了才拉全量定时任务定义(仅刷新本地缓存,不驱动执行)
+    if (online && remoteVersion !== null && remoteVersion !== state.schedule_version) {
+      try { await syncSchedules(); } catch (e) { log(`[sync] ${e.message}`); }
+    }
+    // 唯一执行入口:领取待办队列(webhook / 手动 / 定时都在服务器侧生成为 job)
+    if (online) {
+      try { enqueue(await claimJobs()); } catch (e) { log(`[claim] ${e.message}`); }
+    }
+    processQueue();
+  }
+
+  return {
+    name: acct.name,
+    start() {
+      log(`启动 api=${API_BASE} poll=${pollMs / 1000}s workdirs=${allowedWorkdirs.length || '(空,全拒)'}`);
+      tick();
+      timer = setInterval(tick, pollMs);
+    },
+    stop() { stopped = true; if (timer) clearInterval(timer); },
+  };
+}
+
+// ---------------------------------------------------------------------------
+// 旧版单账号的数据目录(data/state.json + data/outbox)并进 data/<账号名>/
+// 只在配置刚好只有一个账号时做,免得猜错归属。
+// ---------------------------------------------------------------------------
+function migrateLegacyData(name) {
+  const legacyState = path.join(DATA_ROOT, 'state.json');
+  if (!fs.existsSync(legacyState)) return;
+  const dst = dataDirFor(name);
+  if (fs.existsSync(path.join(dst, 'state.json'))) return; // 已迁过
+  for (const sub of ['outbox', 'transcripts']) fs.mkdirSync(path.join(dst, sub), { recursive: true });
+  fs.renameSync(legacyState, path.join(dst, 'state.json'));
+  for (const sub of ['outbox', 'transcripts']) {
+    const from = path.join(DATA_ROOT, sub);
+    if (!fs.existsSync(from)) continue;
+    for (const f of fs.readdirSync(from)) {
+      try { fs.renameSync(path.join(from, f), path.join(dst, sub, f)); } catch (_) { /* 跳过 */ }
+    }
+    try { fs.rmdirSync(from); } catch (_) { /* 非空就留着 */ }
+  }
+  console.log(`${ts()} [migrate] 旧数据目录已并入账号 ${name}`);
 }
 
-log(`[cc-runner] 启动 runner_id=${runnerId} poll=${POLL_MS / 1000}s(纯中心化,任务一律 /claim 领取)`);
-tick();
-setInterval(tick, POLL_MS);
+// ---------------------------------------------------------------------------
+// 起进程:每个账号一个实例
+// ---------------------------------------------------------------------------
+if (conf.accounts.length === 1) migrateLegacyData(conf.accounts[0].name);
+
+const runners = conf.accounts.map(createRunner);
+console.log(`${ts()} [cc-runner] 启动 ${runners.length} 个账号: ${runners.map((r) => r.name).join(', ')}`
+  + `(并发上限 ${conf.maxConcurrent},纯中心化,任务一律 /claim 领取)`);
+// 错开首轮,免得多账号同刻齐发
+runners.forEach((r, i) => (i === 0 ? r.start() : setTimeout(() => r.start(), i * 1000)));
+
+for (const sig of ['SIGTERM', 'SIGINT']) {
+  process.on(sig, () => { for (const r of runners) r.stop(); process.exit(0); });
+}

package/skills/cc-runner/SKILL.md

@@ -94,6 +94,18 @@ cc-runner status     # 看是否已同步、launchd 是否挂载
 
 这台机器的 runner 身份由 token 决定（不再手填 `--runner`）。首次心跳后，它会自动出现在控制台「看板」。想在多台机器跑，就在控制台各建一个 runner、拿各自的 token，在每台机器 `init`。
 
+**同一台机器要接多个 workspace**（不同组织、公私分开）时，不用起多个进程 —— `cc-runner add` 再挂一组 token 和白名单即可：
+
+```bash
+cc-runner add --name <账号名> --api <该 workspace 的 runner-api 地址> --token <该 workspace 的 token> --workdir ~/对应项目目录
+cc-runner list                          # 看所有账号
+cc-runner remove --name <账号名>        # 摘掉（加 --purge 连数据一起删）
+```
+
+每个账号独立轮询、独立队列、独立数据目录（`~/.cc-runner/data/<账号名>/`），**白名单按账号各管各的** —— 这是账号之间唯一的隔离边界，加 workdir 时同样要和用户确认。跨账号的 claude 并发受 config 顶层 `max_concurrent_jobs` 限制（默认 1，串行）。改完配置要重启守护进程才生效（`cc-runner install` 会先卸载再挂载）。
+
+> 注意：多 token 隔离的是**平台侧身份**，不隔离本地 Claude 登录态 —— 所有任务都由同一份 `claude` 凭证执行。
+
 验证心跳到了云端：
 
 ```bash
@@ -209,7 +221,7 @@ tail -f ~/.cc-runner/logs/daemon.log    # 守护进程实时日志
 ## 运维与排查
 
 - **runner 显示离线**（看板灰点 / `last_seen_at` 很旧）：`cc-runner status` 看 launchd 是否挂载；`tail ~/.cc-runner/logs/daemon.log` 看报错。断网期间领不到新任务（纯中心化，不本地自跑）；已跑完待回填的结果攒在 outbox，恢复后自动补传。
-- **任务 `rejected`**：workdir 不在本地白名单。要么改触发器/定时的 `workdir`，要么 `cc-runner init` 时把目录加进 `--workdir`（可重复传多个）。
+- **任务 `rejected`**：workdir 不在**该账号**的本地白名单。要么改触发器/定时的 `workdir`，要么在 `cc-runner init` / `add` 时把目录加进 `--workdir`（可重复传多个）；`cc-runner list` 能看到每个账号当前的白名单。
 - **webhook 打过去没反应**：确认地址带对了 `?token=<secret>`；`secret` 不匹配返回 401，`slug` 不存在返回 404。
 - **卸载**：`cc-runner uninstall`（配置和数据保留在 `~/.cc-runner`，需要再手删）。