claude-multiacc 1.0.10 → 1.0.12

package/README.md

@@ -240,6 +240,13 @@ git pull && ./install.sh                                  # update (data untouch
 
 `self-update` auto-detects which of these you used (npm global vs git checkout).
 
+**Servers / machines without repo access:** install via **npm** — the registry is
+public, so the daily self-update needs no credentials at all (no rsync, no keys).
+A git checkout self-updates too, but only if `git pull` can authenticate; for a
+private repo on a server that means a read-only deploy key (the 138 server runs
+this way: `core.sshCommand` pinned to its deploy key). A plain copied tree is the
+one layout that can NOT self-update — don't ship the addon that way.
+
 What install does (all reversible, nothing else):
 
 - **macOS:** marked PATH block at the END of `~/.zshenv`, `~/.zprofile`, `~/.zshrc`
@@ -351,21 +358,39 @@ login, so each runs on the machine that holds its credential.
 claude-accounts remove acct-NN          # deletes locally, propagates to the server
 ```
 
-## Server sync
+## Sync (multi-machine)
 
-Mac → server, one-way (Mac = source of truth), fired automatically by
-`add`/`import`/`remove`/`mint` and manually via:
+One machine is the **source of truth**; every other machine is a **target**. Sync is
+one-way, fired automatically by `add`/`import`/`remove`/`mint` on the source and
+manually via:
 
 ```bash
-claude-accounts sync
+claude-accounts sync      # and codex-accounts sync for the codex pool
+```
+
+Targets are the manifest's `server`/`server_root`/`server_repo` (the Linux box) plus
+an optional `peers` array for additional machines (e.g. a second Mac):
+
+```json
+"peers": [{"target": "gas@gas-mini", "root": "/Users/gas/.claude-accounts",
+           "repo": "/Users/gas/claude-multiacc"}]
 ```
 
-Pushes the manifest + per-account `server.token` (0600) + one-time seeds; **never**
-syncs `.credentials.json` in either direction (two machines refreshing one OAuth grant
-invalidate each other). Removals propagate; an empty/corrupt manifest refuses to sync
-(guard against wiping the server pool). After every push the server re-seeds dirs and
-re-runs its quick verification matrix (`post-sync` hook). Everything logs to `sync.log`;
-failures are loud and non-zero.
+Every target gets the manifest + per-account `server.token` (0600, claude pool) +
+one-time seeds + advisory limit state; **never** `.credentials.json` or codex
+`auth.json` in either direction (their refresh tokens rotate — two machines
+refreshing one grant invalidate each other; codex accounts are signed in per
+machine with the device-code flow instead). Removals propagate to every target; an
+empty/corrupt manifest — or one with an invalid target/peer shape — refuses to sync
+before anything is pushed anywhere. After every push each target re-seeds dirs and
+re-runs its quick verification matrix (`post-sync` hook). Everything logs to
+`sync.log`; failures are loud and non-zero.
+
+A target machine's pool carries a `sync-role` file containing `replica`: such a pool
+**never pushes** (manually or via auto-sync) — the source machine owns the account
+set, which is what prevents two machines from overwriting each other's manifests.
+Make account changes on the source; sign-ins (`login`/`relogin`) still happen on
+whichever machine needs the credential.
 
 ## Pinning & env switches
 

package/bin/claude-accounts

@@ -56,7 +56,10 @@ USAGE
                                             (same email), keeping one per email
   claude-accounts mint <acct-NN>            mint server token via `claude setup-token`
       --paste               paste an already-minted token instead of running setup-token
-  claude-accounts sync                      push manifest+tokens to the server (Mac only)
+  claude-accounts sync                      push manifest+tokens to the server AND any
+                                            manifest 'peers' (extra machines). Mac only.
+                                            A pool with a 'sync-role' file saying
+                                            'replica' never pushes (it receives).
   claude-accounts verify [--quick]          auth matrix; full mode runs `-p "reply OK"` per account
   claude-accounts limits [--quiet] [--force]
       refresh usage buckets, apply >=90% markers. Auto-refreshes long-expired
@@ -142,6 +145,9 @@ PYEOF
 auto_sync() { # best effort after mutations, Mac only, loud on failure
   [ "$(machine_kind)" = "mac" ] || return 0
   [ "${CLAUDE_MULTIACC_NO_SYNC:-0}" = "1" ] && return 0
+  # A replica pool never pushes (the source machine owns the account set) —
+  # silently, so every mutation on a replica does not nag about it.
+  sync_is_replica && return 0
   # subshell: cmd_sync exits on failure and must not take the CLI down with it
   ( cmd_sync ) || warn "server sync failed — run 'claude-accounts sync' manually"
 }
@@ -1496,71 +1502,43 @@ sys.exit(1 if failures else 0)
 PYEOF
 }
 
-cmd_sync() {
-  require_manifest
-  [ "$(machine_kind)" = "mac" ] || die "sync runs on the Mac (source of truth), not the server"
-  local allow_empty=0
-  [ "${1:-}" = "--allow-empty" ] && allow_empty=1
-  local server sroot srepo rc=0
-  server="$(manifest_get server "$DEFAULT_SERVER")"
-  sroot="$(manifest_get server_root "$DEFAULT_SERVER_ROOT")"
-  srepo="$(manifest_get server_repo "$DEFAULT_SERVER_REPO")"
-  # These land inside a remote shell command — anything but a plain target/path is a
-  # command-injection vector from a corrupted or hand-edited manifest.
-  valid_ssh_target "$server" || die "manifest 'server' is not a plain user@host: $server"
-  valid_remote_path "$sroot" || die "manifest 'server_root' is not a plain absolute path: $sroot"
-  valid_remote_path "$srepo" || die "manifest 'server_repo' is not a plain absolute path: $srepo"
-  rotate_log sync.log
-  slog() { log_to sync.log "$*"; }
-  fail() { slog "FAIL: $*"; printf 'claude-accounts sync: FAILED: %s\n' "$*" >&2; exit 1; }
-  slog "sync start -> $server:$sroot"
-
-  # Hard validation before anything destructive: a corrupt or accountless manifest must
-  # never be pushed (it would blank the server's pool), and must never make the removal
-  # loop below wipe the server's credentials. Emptying the pool on purpose is possible
-  # via `sync --allow-empty`, so this can never happen by accident.
-  "$PYBIN" - "$MANIFEST" <<'PYEOF' 2>/dev/null || fail "manifest is not valid JSON or has no well-formed accounts — refusing to sync"
-import json, re, sys
-doc = json.load(open(sys.argv[1]))
-accounts = doc.get('accounts')
-if not isinstance(accounts, list):
-    sys.exit(1)
-for a in accounts:
-    if not isinstance(a, dict) or not re.fullmatch(r'acct-\d{2}', str(a.get('id', ''))) \
-       or not str(a.get('email', '')).strip():
-        sys.exit(1)
-PYEOF
-  if [ -z "$(account_ids)" ] && [ "$allow_empty" != "1" ]; then
-    fail "manifest has zero accounts — refusing to blank the server pool (use 'sync --allow-empty' if that is really intended)"
-  fi
+# Push the pool to ONE remote target. $1 = user@host, $2 = remote pool root,
+# $3 = remote addon repo (for the post-sync hook). Uses the caller's slog/fail.
+# A target can be the Linux server (token-authenticated) or a peer Mac (which has
+# its own machine-local OAuth logins) — the pushed material is valid on both:
+# manifest, portable server.token files, seeds, and advisory limit state.
+# Credentials (.credentials.json) are NEVER pushed anywhere.
+sync_push_target() {
+  local server="$1" sroot="$2" srepo="$3"
+  slog "push -> $server:$sroot"
 
   ssh -o BatchMode=yes -o ConnectTimeout=10 "$server" "mkdir -p '$sroot'" >>"$ACC_ROOT/sync.log" 2>&1 \
     || fail "cannot reach $server"
   rsync -az "$MANIFEST" "$server:$sroot/accounts.json" >>"$ACC_ROOT/sync.log" 2>&1 \
-    || fail "manifest push failed"
+    || fail "manifest push to $server failed"
 
   local id d
   for id in $(account_ids); do
     d="$ACC_ROOT/$id"
     [ -d "$d" ] || continue
     ssh -o BatchMode=yes "$server" "mkdir -p '$sroot/$id'" >>"$ACC_ROOT/sync.log" 2>&1 \
-      || fail "mkdir $id failed"
+      || fail "mkdir $id on $server failed"
     if [ -s "$d/server.token" ]; then
       # NB: no --chmod — macOS 26 ships openrsync, which rejects it (the push would
       # fail outright). The mode is fixed with an explicit remote chmod instead.
       rsync -az "$d/server.token" "$server:$sroot/$id/" >>"$ACC_ROOT/sync.log" 2>&1 \
-        || fail "token push for $id failed"
+        || fail "token push for $id to $server failed"
       ssh -o BatchMode=yes "$server" "chmod 600 '$sroot/$id/server.token'" \
-        >>"$ACC_ROOT/sync.log" 2>&1 || fail "token chmod for $id failed"
+        >>"$ACC_ROOT/sync.log" 2>&1 || fail "token chmod for $id on $server failed"
     fi
     local seed
     for seed in .claude.json settings.json; do
       if [ -f "$d/$seed" ]; then
         rsync -az --ignore-existing "$d/$seed" "$server:$sroot/$id/" >>"$ACC_ROOT/sync.log" 2>&1 \
-          || fail "seed push for $id/$seed failed"
+          || fail "seed push for $id/$seed to $server failed"
       fi
     done
-    # Advisory limit state for accounts the server may lack a bearer for.
+    # Advisory limit state for accounts the target may lack a bearer for.
     local extra
     for extra in limits.json .limited; do
       if [ -f "$d/$extra" ]; then
@@ -1569,9 +1547,9 @@ PYEOF
     done
   done
 
-  # Removal propagation: any server acct dir not in the manifest gets deleted.
+  # Removal propagation: any target acct dir not in the manifest gets deleted.
   # Safety: an EMPTY id list (parse error, or a truly emptied pool) never deletes —
-  # wiping every server credential must be an explicit manual act, not a side effect.
+  # wiping every target credential must be an explicit manual act, not a side effect.
   local ids_list ids_spaced
   ids_list="$(account_ids)"
   if [ -z "$ids_list" ]; then
@@ -1585,16 +1563,124 @@ for dd in acct-*; do
     *\" \$dd \"*) ;;
     *) rm -rf -- \"\$dd\" ;;
   esac
-done" >>"$ACC_ROOT/sync.log" 2>&1 || fail "removal propagation failed"
+done" >>"$ACC_ROOT/sync.log" 2>&1 || fail "removal propagation on $server failed"
   fi
 
-  # Post-sync hook: server seeds dirs and re-runs its quick verification matrix.
+  # Post-sync hook: the target seeds dirs and re-runs its quick verification matrix.
+  # Non-fatal: a hook that is absent (not bootstrapped) or exits nonzero (accounts
+  # awaiting a login THERE) must not fail the push that just succeeded.
   ssh -o BatchMode=yes "$server" "[ -x '$srepo/bin/claude-accounts' ] && '$srepo/bin/claude-accounts' post-sync" \
-    >>"$ACC_ROOT/sync.log" 2>&1 || slog "post-sync hook not available yet (server not bootstrapped?)"
+    >>"$ACC_ROOT/sync.log" 2>&1 || slog "post-sync hook on $server unavailable or unhappy (see its pool state)"
+}
+
+# Prints manifest peers (extra sync targets, e.g. a second Mac), one per line:
+# target<TAB>root<TAB>repo. Empty output = no peers.
+manifest_peers() {
+  [ -f "$MANIFEST" ] || return 0
+  "$PYBIN" - "$MANIFEST" <<'PYEOF' 2>/dev/null
+import json, sys
+peers = json.load(open(sys.argv[1])).get('peers')
+if peers is None:
+    sys.exit(0)
+if not isinstance(peers, list):
+    print('MALFORMED\t\t')
+    sys.exit(0)
+for p in peers:
+    if not isinstance(p, dict):
+        print('MALFORMED\t\t')
+        continue
+    print('%s\t%s\t%s' % (p.get('target', ''), p.get('root', ''), p.get('repo', '')))
+PYEOF
+}
+
+# True when this pool is a sync REPLICA: it receives pushes from the source
+# machine and must never push back (two writers racing = last-writer-wins chaos).
+# The marker is a machine-local side file — deliberately NOT in the manifest,
+# because the manifest itself is what gets pushed to replicas.
+sync_is_replica() {
+  [ -f "$ACC_ROOT/sync-role" ] || return 1
+  # Whole-line match: only a line saying exactly 'replica' counts — a value like
+  # 'not-replica' must never silently disable sync.
+  LC_ALL=C grep -qixE '[[:space:]]*replica[[:space:]]*' "$ACC_ROOT/sync-role"
+}
+
+cmd_sync() {
+  require_manifest
+  [ "$(machine_kind)" = "mac" ] || die "sync runs on the Mac (source of truth), not the server"
+  if sync_is_replica; then
+    echo "this pool is a sync replica — the source machine pushes here; nothing sent"
+    return 0
+  fi
+  local allow_empty=0
+  [ "${1:-}" = "--allow-empty" ] && allow_empty=1
+  local server sroot srepo
+  server="$(manifest_get server "$DEFAULT_SERVER")"
+  sroot="$(manifest_get server_root "$DEFAULT_SERVER_ROOT")"
+  srepo="$(manifest_get server_repo "$DEFAULT_SERVER_REPO")"
+  # These land inside remote shell commands — anything but a plain target/path is a
+  # command-injection vector from a corrupted or hand-edited manifest. EVERY target
+  # (primary and peers) is validated before anything is pushed anywhere.
+  valid_ssh_target "$server" || die "manifest 'server' is not a plain user@host: $server"
+  valid_remote_path "$sroot" || die "manifest 'server_root' is not a plain absolute path: $sroot"
+  valid_remote_path "$srepo" || die "manifest 'server_repo' is not a plain absolute path: $srepo"
+  local peers pt pr pp tab
+  tab="$(printf '\t')"
+  peers="$(manifest_peers)"
+  if [ -n "$peers" ]; then
+    while IFS="$tab" read -r pt pr pp; do
+      [ -n "$pt$pr$pp" ] || continue   # blank line only — a partial entry is fatal below
+      [ "$pt" = "MALFORMED" ] && die "manifest 'peers' contains a malformed entry — each peer needs target, root and repo"
+      { [ -n "$pt" ] && [ -n "$pr" ] && [ -n "$pp" ]; } \
+        || die "manifest peer entry is incomplete (target, root and repo are all required): target='$pt' root='$pr' repo='$pp'"
+      valid_ssh_target "$pt" || die "manifest peer target is not a plain user@host: $pt"
+      valid_remote_path "$pr" || die "manifest peer root is not a plain absolute path: $pr"
+      valid_remote_path "$pp" || die "manifest peer repo is not a plain absolute path: $pp"
+    done <<EOF
+$peers
+EOF
+  fi
+  rotate_log sync.log
+  slog() { log_to sync.log "$*"; }
+  fail() { slog "FAIL: $*"; printf 'claude-accounts sync: FAILED: %s\n' "$*" >&2; exit 1; }
+  slog "sync start -> $server:$sroot${peers:+ (+ peers)}"
+
+  # Hard validation before anything destructive: a corrupt or accountless manifest must
+  # never be pushed (it would blank the target pools), and must never make the removal
+  # propagation wipe a target's credentials. Emptying the pool on purpose is possible
+  # via `sync --allow-empty`, so this can never happen by accident.
+  "$PYBIN" - "$MANIFEST" <<'PYEOF' 2>/dev/null || fail "manifest is not valid JSON or has no well-formed accounts — refusing to sync"
+import json, re, sys
+doc = json.load(open(sys.argv[1]))
+accounts = doc.get('accounts')
+if not isinstance(accounts, list):
+    sys.exit(1)
+for a in accounts:
+    if not isinstance(a, dict) or not re.fullmatch(r'acct-\d{2}', str(a.get('id', ''))) \
+       or not str(a.get('email', '')).strip():
+        sys.exit(1)
+PYEOF
+  if [ -z "$(account_ids)" ] && [ "$allow_empty" != "1" ]; then
+    fail "manifest has zero accounts — refusing to blank the target pools (use 'sync --allow-empty' if that is really intended)"
+  fi
+
+  sync_push_target "$server" "$sroot" "$srepo"
+  local npeers=0
+  if [ -n "$peers" ]; then
+    while IFS="$tab" read -r pt pr pp; do
+      [ -n "$pt" ] || continue
+      sync_push_target "$pt" "$pr" "$pp"
+      npeers=$((npeers + 1))
+    done <<EOF
+$peers
+EOF
+  fi
 
   slog "sync ok"
-  echo "sync ok -> $server:$sroot"
-  return $rc
+  if [ "$npeers" -gt 0 ]; then
+    echo "sync ok -> $server:$sroot + $npeers peer(s)"
+  else
+    echo "sync ok -> $server:$sroot"
+  fi
 }
 
 cmd_post_sync() {

package/bin/codex-accounts

@@ -58,8 +58,11 @@ USAGE
   codex-accounts remove <acct-NN> [--yes]   delete account (propagates to server)
   codex-accounts dedupe [--yes]             remove any account registered twice
                                             (same email), keeping one per email
-  codex-accounts sync                       push manifest+seeds to the server (Mac only;
-                                            auth.json is machine-local, NEVER synced)
+  codex-accounts sync                       push manifest+seeds to the server AND any
+                                            manifest 'peers' (extra machines). Mac only.
+                                            auth.json is machine-local, NEVER synced.
+                                            A pool with a 'sync-role' file saying
+                                            'replica' never pushes (it receives).
   codex-accounts verify [--quick]           auth matrix; full mode runs a real
                                             `codex exec` per account
   codex-accounts limits [--quiet] [--force]
@@ -146,6 +149,9 @@ PYEOF
 auto_sync() { # best effort after mutations, Mac only, loud on failure
   [ "$(machine_kind)" = "mac" ] || return 0
   [ "${CODEX_MULTIACC_NO_SYNC:-0}" = "1" ] && return 0
+  # A replica pool never pushes (the source machine owns the account set) —
+  # silently, so every mutation on a replica does not nag about it.
+  sync_is_replica && return 0
   # subshell: cmd_sync exits on failure and must not take the CLI down with it
   ( cmd_sync ) || warn "server sync failed — run 'codex-accounts sync' manually"
 }
@@ -415,8 +421,21 @@ cmd_add() {
   mutate_lock || die "could not acquire the account lock — try again"
   owner="$(email_owner "$got")"
   if [ -n "$owner" ]; then
-    mutate_unlock
-    echo "$got is already added as $owner — skipping (nothing added)."
+    # The sign-in itself succeeded and produced a fresh credential for an account
+    # that is already registered — don't throw it away: save it to that account,
+    # exactly as `login $owner` would have. This machine now runs $owner.
+    local od="$ACC_ROOT/$owner"
+    seed_account_dir "$od"
+    if mv -f "$d/auth.json" "$od/auth.json" 2>/dev/null; then
+      chmod 600 "$od/auth.json" 2>/dev/null || true
+      clear_auth_markers "$od"
+      mutate_unlock
+      log_to ops.log "add redirect: signed in as $got (already $owner) — credential saved to $owner"
+      echo "$got is already added as $owner — the fresh sign-in was saved to $owner (usable on this machine now)."
+    else
+      mutate_unlock
+      echo "$got is already added as $owner — skipping (nothing added)."
+    fi
     return 0   # RESERVED_DIR still set -> trap removes the temp dir
   fi
   if [ -n "$email" ] && [ "$got" != "$email" ]; then
@@ -686,6 +705,26 @@ PYEOF
   got_lc="$(printf '%s' "$got" | tr '[:upper:]' '[:lower:]')"
   email_lc="$(printf '%s' "$email" | tr '[:upper:]' '[:lower:]')"
   if [ -n "$got" ] && [ "$got_lc" != "$email_lc" ] && [ "$force" != "1" ]; then
+    # Signed in as a DIFFERENT account. If that account is registered in this pool,
+    # the sign-in was not a mistake worth discarding — route the fresh credential to
+    # ITS account dir (what `login <owner>` would have produced), restore this
+    # account's prior state, and report honestly that THIS account is still unfixed.
+    local owner
+    owner="$(email_owner "$got")"
+    if [ -n "$owner" ] && [ "$owner" != "$id" ]; then
+      local od="$ACC_ROOT/$owner"
+      seed_account_dir "$od"
+      if mv -f "$d/auth.json" "$od/auth.json" 2>/dev/null; then
+        chmod 600 "$od/auth.json" 2>/dev/null || true
+        clear_auth_markers "$od"
+        restore_snap
+        trap - INT TERM
+        log_to ops.log "login redirect: signed in as $got -> credential saved to $owner (target was $id)"
+        echo "you signed in as $got — that is $owner, so the credential was saved to $owner (usable now)."
+        echo "$id ($email) still needs its own sign-in: codex-accounts login $id"
+        return 1
+      fi
+    fi
     restore_snap
     trap - INT TERM
     die "you signed in as $got but $id is $email — nothing saved, previous credential restored (use --force to override)"
@@ -813,12 +852,27 @@ cmd_relogin() {
     read -r ans
     case "$ans" in y|Y|yes) ;; *) echo "aborted"; return 1 ;; esac
   fi
+  # Accounts that were BROKEN when this run started: if one of them turns healthy
+  # mid-run (a redirected sign-in from an earlier iteration landed its credential),
+  # asking the user to sign it in again would be pure friction — it gets skipped.
+  # Accounts that were healthy at start (explicit ids / --all) are never skipped:
+  # the user asked to re-authenticate them on purpose.
+  local pre_bad
+  pre_bad=" $(accounts_needing_login 2>/dev/null | tr '\n' ' ') "
   # One sync at the end instead of one per account: each auto_sync is an ssh round trip.
   local prev_no_sync="${CODEX_MULTIACC_NO_SYNC:-0}" failed="" done_ok=0
   export CODEX_MULTIACC_NO_SYNC=1
   for id in $ids; do
     echo
     echo "=== $id ==============================================================="
+    case "$pre_bad" in
+      *" $id "*)
+        if [ "$(account_audit 2>/dev/null | awk -F'\t' -v i="$id" '$1 == i { print $4 }')" = "ok" ]; then
+          echo "$id already has a working login (a credential landed during an earlier sign-in) — skipping."
+          done_ok=$((done_ok + 1))
+          continue
+        fi ;;
+    esac
     if [ "$browser" = "1" ]; then
       ( cmd_login "$id" --browser ) && done_ok=$((done_ok + 1)) || failed="$failed $id"
     else
@@ -1452,67 +1506,36 @@ sys.exit(1 if failures else 0)
 PYEOF
 }
 
-cmd_sync() {
-  require_manifest
-  [ "$(machine_kind)" = "mac" ] || die "sync runs on the Mac (source of truth), not the server"
-  local allow_empty=0
-  [ "${1:-}" = "--allow-empty" ] && allow_empty=1
-  local server sroot srepo rc=0
-  server="$(manifest_get server "$DEFAULT_SERVER")"
-  sroot="$(manifest_get server_root "$DEFAULT_SERVER_ROOT")"
-  srepo="$(manifest_get server_repo "$DEFAULT_SERVER_REPO")"
-  # These land inside a remote shell command — anything but a plain target/path is a
-  # command-injection vector from a corrupted or hand-edited manifest.
-  valid_ssh_target "$server" || die "manifest 'server' is not a plain user@host: $server"
-  valid_remote_path "$sroot" || die "manifest 'server_root' is not a plain absolute path: $sroot"
-  valid_remote_path "$srepo" || die "manifest 'server_repo' is not a plain absolute path: $srepo"
-  rotate_log sync.log
-  slog() { log_to sync.log "$*"; }
-  fail() { slog "FAIL: $*"; printf 'codex-accounts sync: FAILED: %s\n' "$*" >&2; exit 1; }
-  slog "sync start -> $server:$sroot"
-
-  # Hard validation before anything destructive: a corrupt or accountless manifest must
-  # never be pushed (it would blank the server's pool), and must never make the removal
-  # loop below wipe the server's account dirs. Emptying the pool on purpose is possible
-  # via `sync --allow-empty`, so this can never happen by accident.
-  "$PYBIN" - "$MANIFEST" <<'PYEOF' 2>/dev/null || fail "manifest is not valid JSON or has no well-formed accounts — refusing to sync"
-import json, re, sys
-doc = json.load(open(sys.argv[1]))
-accounts = doc.get('accounts')
-if not isinstance(accounts, list):
-    sys.exit(1)
-for a in accounts:
-    if not isinstance(a, dict) or not re.fullmatch(r'acct-\d{2}', str(a.get('id', ''))) \
-       or not str(a.get('email', '')).strip():
-        sys.exit(1)
-PYEOF
-  if [ -z "$(account_ids)" ] && [ "$allow_empty" != "1" ]; then
-    fail "manifest has zero accounts — refusing to blank the server pool (use 'sync --allow-empty' if that is really intended)"
-  fi
+# Push the pool to ONE remote target. $1 = user@host, $2 = remote pool root,
+# $3 = remote addon repo (for the post-sync hook). Uses the caller's slog/fail.
+# NB: auth.json is deliberately NEVER pushed (in either direction): the refresh
+# token inside it rotates, and two machines refreshing one grant invalidate each
+# other. A codex account that should run on a target machine is signed in THERE
+# (codex-accounts add / login — device-code flow). Sync aligns the account LIST,
+# seeds, and advisory limit state.
+sync_push_target() {
+  local server="$1" sroot="$2" srepo="$3"
+  slog "push -> $server:$sroot"
 
   ssh -o BatchMode=yes -o ConnectTimeout=10 "$server" "mkdir -p '$sroot'" >>"$ACC_ROOT/sync.log" 2>&1 \
     || fail "cannot reach $server"
   rsync -az "$MANIFEST" "$server:$sroot/accounts.json" >>"$ACC_ROOT/sync.log" 2>&1 \
-    || fail "manifest push failed"
+    || fail "manifest push to $server failed"
 
-  # NB: auth.json is deliberately NEVER pushed (in either direction): the refresh
-  # token inside it rotates, and two machines refreshing one grant invalidate each
-  # other. A codex account that should run on the server is signed in THERE
-  # (codex-accounts add --device over SSH).
   local id d
   for id in $(account_ids); do
     d="$ACC_ROOT/$id"
     [ -d "$d" ] || continue
     ssh -o BatchMode=yes "$server" "mkdir -p '$sroot/$id'" >>"$ACC_ROOT/sync.log" 2>&1 \
-      || fail "mkdir $id failed"
+      || fail "mkdir $id on $server failed"
     local seed
     for seed in config.toml; do
       if [ -f "$d/$seed" ]; then
         rsync -az --ignore-existing "$d/$seed" "$server:$sroot/$id/" >>"$ACC_ROOT/sync.log" 2>&1 \
-          || fail "seed push for $id/$seed failed"
+          || fail "seed push for $id/$seed to $server failed"
       fi
     done
-    # Advisory limit state for accounts the server may lack a bearer for.
+    # Advisory limit state for accounts the target may lack a bearer for.
     local extra
     for extra in limits.json .limited; do
       if [ -f "$d/$extra" ]; then
@@ -1521,9 +1544,10 @@ PYEOF
     done
   done
 
-  # Removal propagation: any server acct dir not in the manifest gets deleted.
+  # Removal propagation: any target acct dir not in the manifest gets deleted.
   # Safety: an EMPTY id list (parse error, or a truly emptied pool) never deletes —
-  # wiping every server credential must be an explicit manual act, not a side effect.
+  # wiping every target's account dirs must be an explicit manual act, never a
+  # side effect.
   local ids_list ids_spaced
   ids_list="$(account_ids)"
   if [ -z "$ids_list" ]; then
@@ -1537,16 +1561,124 @@ for dd in acct-*; do
     *\" \$dd \"*) ;;
     *) rm -rf -- \"\$dd\" ;;
   esac
-done" >>"$ACC_ROOT/sync.log" 2>&1 || fail "removal propagation failed"
+done" >>"$ACC_ROOT/sync.log" 2>&1 || fail "removal propagation on $server failed"
   fi
 
-  # Post-sync hook: server seeds dirs and re-runs its quick verification matrix.
+  # Post-sync hook: the target seeds dirs and re-runs its quick verification matrix.
+  # Non-fatal: a hook that is absent (not bootstrapped) or exits nonzero (accounts
+  # awaiting a login THERE) must not fail the push that just succeeded.
   ssh -o BatchMode=yes "$server" "[ -x '$srepo/bin/codex-accounts' ] && '$srepo/bin/codex-accounts' post-sync" \
-    >>"$ACC_ROOT/sync.log" 2>&1 || slog "post-sync hook not available yet (server not bootstrapped?)"
+    >>"$ACC_ROOT/sync.log" 2>&1 || slog "post-sync hook on $server unavailable or unhappy (see its pool state)"
+}
+
+# Prints manifest peers (extra sync targets, e.g. a second Mac), one per line:
+# target<TAB>root<TAB>repo. Empty output = no peers.
+manifest_peers() {
+  [ -f "$MANIFEST" ] || return 0
+  "$PYBIN" - "$MANIFEST" <<'PYEOF' 2>/dev/null
+import json, sys
+peers = json.load(open(sys.argv[1])).get('peers')
+if peers is None:
+    sys.exit(0)
+if not isinstance(peers, list):
+    print('MALFORMED\t\t')
+    sys.exit(0)
+for p in peers:
+    if not isinstance(p, dict):
+        print('MALFORMED\t\t')
+        continue
+    print('%s\t%s\t%s' % (p.get('target', ''), p.get('root', ''), p.get('repo', '')))
+PYEOF
+}
+
+# True when this pool is a sync REPLICA: it receives pushes from the source
+# machine and must never push back (two writers racing = last-writer-wins chaos).
+# The marker is a machine-local side file — deliberately NOT in the manifest,
+# because the manifest itself is what gets pushed to replicas.
+sync_is_replica() {
+  [ -f "$ACC_ROOT/sync-role" ] || return 1
+  # Whole-line match: only a line saying exactly 'replica' counts — a value like
+  # 'not-replica' must never silently disable sync.
+  LC_ALL=C grep -qixE '[[:space:]]*replica[[:space:]]*' "$ACC_ROOT/sync-role"
+}
+
+cmd_sync() {
+  require_manifest
+  [ "$(machine_kind)" = "mac" ] || die "sync runs on the Mac (source of truth), not the server"
+  if sync_is_replica; then
+    echo "this pool is a sync replica — the source machine pushes here; nothing sent"
+    return 0
+  fi
+  local allow_empty=0
+  [ "${1:-}" = "--allow-empty" ] && allow_empty=1
+  local server sroot srepo
+  server="$(manifest_get server "$DEFAULT_SERVER")"
+  sroot="$(manifest_get server_root "$DEFAULT_SERVER_ROOT")"
+  srepo="$(manifest_get server_repo "$DEFAULT_SERVER_REPO")"
+  # These land inside remote shell commands — anything but a plain target/path is a
+  # command-injection vector from a corrupted or hand-edited manifest. EVERY target
+  # (primary and peers) is validated before anything is pushed anywhere.
+  valid_ssh_target "$server" || die "manifest 'server' is not a plain user@host: $server"
+  valid_remote_path "$sroot" || die "manifest 'server_root' is not a plain absolute path: $sroot"
+  valid_remote_path "$srepo" || die "manifest 'server_repo' is not a plain absolute path: $srepo"
+  local peers pt pr pp tab
+  tab="$(printf '\t')"
+  peers="$(manifest_peers)"
+  if [ -n "$peers" ]; then
+    while IFS="$tab" read -r pt pr pp; do
+      [ -n "$pt$pr$pp" ] || continue   # blank line only — a partial entry is fatal below
+      [ "$pt" = "MALFORMED" ] && die "manifest 'peers' contains a malformed entry — each peer needs target, root and repo"
+      { [ -n "$pt" ] && [ -n "$pr" ] && [ -n "$pp" ]; } \
+        || die "manifest peer entry is incomplete (target, root and repo are all required): target='$pt' root='$pr' repo='$pp'"
+      valid_ssh_target "$pt" || die "manifest peer target is not a plain user@host: $pt"
+      valid_remote_path "$pr" || die "manifest peer root is not a plain absolute path: $pr"
+      valid_remote_path "$pp" || die "manifest peer repo is not a plain absolute path: $pp"
+    done <<EOF
+$peers
+EOF
+  fi
+  rotate_log sync.log
+  slog() { log_to sync.log "$*"; }
+  fail() { slog "FAIL: $*"; printf 'codex-accounts sync: FAILED: %s\n' "$*" >&2; exit 1; }
+  slog "sync start -> $server:$sroot${peers:+ (+ peers)}"
+
+  # Hard validation before anything destructive: a corrupt or accountless manifest must
+  # never be pushed (it would blank the target pools), and must never make the removal
+  # propagation wipe a target's account dirs. Emptying the pool on purpose is possible
+  # via `sync --allow-empty`, so this can never happen by accident.
+  "$PYBIN" - "$MANIFEST" <<'PYEOF' 2>/dev/null || fail "manifest is not valid JSON or has no well-formed accounts — refusing to sync"
+import json, re, sys
+doc = json.load(open(sys.argv[1]))
+accounts = doc.get('accounts')
+if not isinstance(accounts, list):
+    sys.exit(1)
+for a in accounts:
+    if not isinstance(a, dict) or not re.fullmatch(r'acct-\d{2}', str(a.get('id', ''))) \
+       or not str(a.get('email', '')).strip():
+        sys.exit(1)
+PYEOF
+  if [ -z "$(account_ids)" ] && [ "$allow_empty" != "1" ]; then
+    fail "manifest has zero accounts — refusing to blank the target pools (use 'sync --allow-empty' if that is really intended)"
+  fi
+
+  sync_push_target "$server" "$sroot" "$srepo"
+  local npeers=0
+  if [ -n "$peers" ]; then
+    while IFS="$tab" read -r pt pr pp; do
+      [ -n "$pt" ] || continue
+      sync_push_target "$pt" "$pr" "$pp"
+      npeers=$((npeers + 1))
+    done <<EOF
+$peers
+EOF
+  fi
 
   slog "sync ok"
-  echo "sync ok -> $server:$sroot"
-  return $rc
+  if [ "$npeers" -gt 0 ]; then
+    echo "sync ok -> $server:$sroot + $npeers peer(s)"
+  else
+    echo "sync ok -> $server:$sroot"
+  fi
 }
 
 cmd_post_sync() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "1.0.10",
+  "version": "1.0.12",
   "description": "Multi-account addon for Claude Code and OpenAI Codex CLI: every claude / claude -p and every codex / codex exec runs under a randomly-picked subscription account with the most usage headroom. Mirrors to a deploy server. No API keys.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -1134,9 +1134,128 @@ json.dump(d, open(sys.argv[1] + '.tmp', 'w'), indent=2); os.replace(sys.argv[1]
 EOF
   out="$(CLAUDE_MULTIACC_NO_SYNC=0 claude-accounts sync 2>&1)"
   rc=$?
-  check "empty manifest refuses to sync" "refusing to blank the server pool" "$out"
+  check "empty manifest refuses to sync" "refusing to blank the target pools" "$out"
   [ "$rc" != "0" ] && t_ok "empty-manifest sync exits nonzero" || t_fail "empty sync rc" "rc=0"
   cp "$WORK/manifest.bak" "$ACC/accounts.json"
+
+  # a REPLICA pool never pushes (side file, not manifest — the manifest is what
+  # gets pushed TO replicas)
+  printf 'replica\n' > "$ACC/sync-role"
+  out="$(CLAUDE_MULTIACC_NO_SYNC=0 claude-accounts sync 2>&1)"
+  rc=$?
+  check "replica pool refuses to push" "sync replica" "$out"
+  [ "$rc" = "0" ] && t_ok "replica sync exits 0 (informational, not an error)" || t_fail "replica sync rc" "rc=$rc"
+  # ...and auto_sync (after a mutation) is silent about it
+  out="$(CLAUDE_MULTIACC_NO_SYNC=0 claude-accounts import replica-test@x --id acct-31 --no-sync 2>&1
+         CLAUDE_MULTIACC_NO_SYNC=0 claude-accounts remove acct-31 --yes 2>&1)"
+  case "$out" in *"sync failed"*) t_fail "replica auto_sync" "a replica mutation warned about sync: $out" ;;
+    *) t_ok "replica auto_sync is silent (no push, no warning)" ;; esac
+  rm -f "$ACC/sync-role"
+
+  # peer targets are validated with the same injection guards as the primary.
+  # A fake ssh/rsync harness (prepended to PATH only for these calls) records every
+  # remote invocation, so "nothing pushed" and "both targets pushed, in order" are
+  # verified from the actual command stream, not inferred from silence.
+  SSHFAKE="$WORK/sshfake"
+  SSHLOG="$WORK/sshfake.log"
+  mkdir -p "$SSHFAKE"
+  cat > "$SSHFAKE/ssh" <<'EOF'
+#!/usr/bin/env bash
+printf 'ssh %s\n' "$*" >> "${SSHLOG:?}"
+case "$*" in *"${SSH_FAIL_HOST:-@@none@@}"*) exit 1 ;; esac
+exit 0
+EOF
+  cat > "$SSHFAKE/rsync" <<'EOF'
+#!/usr/bin/env bash
+printf 'rsync %s\n' "$*" >> "${SSHLOG:?}"
+exit 0
+EOF
+  chmod +x "$SSHFAKE/ssh" "$SSHFAKE/rsync"
+  export SSHLOG
+
+  python3 - "$ACC/accounts.json" <<'EOF'
+import json, os, sys
+d = json.load(open(sys.argv[1]))
+d['peers'] = [{'target': "gas@peer; touch /tmp/multiacc_PEER_PWNED", 'root': '/tmp/x', 'repo': '/tmp/y'}]
+json.dump(d, open(sys.argv[1] + '.tmp', 'w'), indent=2); os.replace(sys.argv[1] + '.tmp', sys.argv[1])
+EOF
+  rm -f /tmp/multiacc_PEER_PWNED
+  : > "$SSHLOG"
+  out="$(PATH="$SSHFAKE:$PATH" CLAUDE_MULTIACC_NO_SYNC=0 claude-accounts sync 2>&1)"
+  rc=$?
+  check "injected peer target refused" "peer target is not a plain user@host" "$out"
+  [ "$rc" != "0" ] && t_ok "bad peer exits nonzero" || t_fail "peer validation rc" "rc=0"
+  [ ! -s "$SSHLOG" ] && t_ok "bad peer: nothing pushed anywhere (no ssh/rsync ran)" \
+    || t_fail "peer pre-validation" "remote commands ran before peer validation: $(head -2 "$SSHLOG")"
+  [ ! -f /tmp/multiacc_PEER_PWNED ] && t_ok "peer injection never executed" \
+    || { t_fail "peer injection" "peer target injection EXECUTED"; rm -f /tmp/multiacc_PEER_PWNED; }
+  cp "$WORK/manifest.bak" "$ACC/accounts.json"
+
+  # a MALFORMED peer entry (missing fields / not an object) is fatal, never skipped
+  python3 - "$ACC/accounts.json" <<'EOF'
+import json, os, sys
+d = json.load(open(sys.argv[1]))
+d['peers'] = [{'root': '/tmp/x', 'repo': '/tmp/y'}]   # no target
+json.dump(d, open(sys.argv[1] + '.tmp', 'w'), indent=2); os.replace(sys.argv[1] + '.tmp', sys.argv[1])
+EOF
+  out="$(PATH="$SSHFAKE:$PATH" CLAUDE_MULTIACC_NO_SYNC=0 claude-accounts sync 2>&1)"
+  rc=$?
+  check "peer with missing field is fatal, not skipped" "incomplete" "$out"
+  [ "$rc" != "0" ] && t_ok "incomplete peer exits nonzero" || t_fail "incomplete peer rc" "rc=0"
+  python3 - "$ACC/accounts.json" <<'EOF'
+import json, os, sys
+d = json.load(open(sys.argv[1]))
+d['peers'] = ["gas@peer"]   # not an object
+json.dump(d, open(sys.argv[1] + '.tmp', 'w'), indent=2); os.replace(sys.argv[1] + '.tmp', sys.argv[1])
+EOF
+  out="$(PATH="$SSHFAKE:$PATH" CLAUDE_MULTIACC_NO_SYNC=0 claude-accounts sync 2>&1)"
+  check "non-object peer entry is fatal" "malformed" "$out"
+  cp "$WORK/manifest.bak" "$ACC/accounts.json"
+
+  # a SUCCESSFUL multi-target sync pushes primary first, then the peer — verified
+  # from the recorded command stream
+  python3 - "$ACC/accounts.json" <<'EOF'
+import json, os, sys
+d = json.load(open(sys.argv[1]))
+d['peers'] = [{'target': 'gas@peer1', 'root': '/Users/gas/.claude-accounts', 'repo': '/Users/gas/claude-multiacc'}]
+json.dump(d, open(sys.argv[1] + '.tmp', 'w'), indent=2); os.replace(sys.argv[1] + '.tmp', sys.argv[1])
+EOF
+  : > "$SSHLOG"
+  out="$(PATH="$SSHFAKE:$PATH" CLAUDE_MULTIACC_NO_SYNC=0 claude-accounts sync 2>&1)"
+  rc=$?
+  [ "$rc" = "0" ] && t_ok "multi-target sync succeeds" || t_fail "multi-target sync" "rc=$rc: $out"
+  check "multi-target sync reports the peer" "+ 1 peer(s)" "$out"
+  grep -q "rsync.*root@203.0.113.1:/root/.claude-accounts/accounts.json" "$SSHLOG" \
+    && grep -q "rsync.*gas@peer1:/Users/gas/.claude-accounts/accounts.json" "$SSHLOG" \
+    && t_ok "manifest pushed to BOTH targets" \
+    || t_fail "multi-target pushes" "missing a manifest push: $(grep accounts.json "$SSHLOG")"
+  first_primary="$(grep -n "root@203.0.113.1" "$SSHLOG" | head -1 | cut -d: -f1)"
+  first_peer="$(grep -n "gas@peer1" "$SSHLOG" | head -1 | cut -d: -f1)"
+  [ -n "$first_primary" ] && [ -n "$first_peer" ] && [ "$first_primary" -lt "$first_peer" ] \
+    && t_ok "primary target pushed before the peer" \
+    || t_fail "target order" "primary=$first_primary peer=$first_peer"
+  n_remov="$(grep -c "for dd in acct-" "$SSHLOG")"
+  [ "$n_remov" = "2" ] && t_ok "removal propagation ran on each target" \
+    || t_fail "per-target removal" "expected 2 removal sweeps, saw $n_remov"
+  grep -q "post-sync" "$SSHLOG" && t_ok "post-sync hooks invoked" || t_fail "post-sync hooks" "none recorded"
+  # a primary failure aborts the WHOLE sync: the peer is never contacted
+  : > "$SSHLOG"
+  out="$(PATH="$SSHFAKE:$PATH" SSH_FAIL_HOST="root@203.0.113.1" CLAUDE_MULTIACC_NO_SYNC=0 claude-accounts sync 2>&1)"
+  rc=$?
+  [ "$rc" != "0" ] && t_ok "primary failure fails the sync" || t_fail "fail-fast rc" "rc=0"
+  check "primary failure is loud" "cannot reach" "$out"
+  grep -q "gas@peer1" "$SSHLOG" \
+    && t_fail "fail-fast" "the peer was contacted after the primary failed" \
+    || t_ok "peer not contacted after a primary failure"
+  cp "$WORK/manifest.bak" "$ACC/accounts.json"
+
+  # only an EXACT 'replica' value suppresses sync ('not-replica' must still push)
+  printf 'not-replica\n' > "$ACC/sync-role"
+  out="$(PATH="$SSHFAKE:$PATH" CLAUDE_MULTIACC_NO_SYNC=0 claude-accounts sync 2>&1)"
+  case "$out" in *"sync replica"*) t_fail "replica anchor" "'not-replica' suppressed sync" ;;
+    *"sync ok"*) t_ok "only an exact 'replica' value suppresses sync" ;;
+    *) t_fail "replica anchor" "unexpected: $out" ;; esac
+  rm -f "$ACC/sync-role"
 else
   t_ok "sync validation tests skipped (Mac-only feature; server refuses sync by design)"
 fi
@@ -1638,6 +1757,62 @@ EOF
 )"
 [ "$got_email" = "d@cx" ] && t_ok "codex: refused login restores the prior credential" \
   || t_fail "codex login restore" "auth.json now belongs to: $got_email"
+# signing in as a DIFFERENT-but-REGISTERED account routes the credential to that
+# account instead of discarding it (and the target account stays honestly unfixed)
+rm -f "$CX/acct-01/auth.json"
+out="$(FAKE_EMAIL=a@cx codex-accounts login acct-04 2>&1)"
+rc=$?
+check "codex: cross-account sign-in is redirected, not discarded" "credential was saved to acct-01" "$out"
+check "codex: redirect says the target still needs its sign-in" "acct-04 (d@cx) still needs its own sign-in" "$out"
+[ "$rc" != "0" ] && t_ok "codex: redirected login still exits nonzero for the target" \
+  || t_fail "codex redirect rc" "rc=0 for an account that was not fixed"
+[ -s "$CX/acct-01/auth.json" ] && t_ok "codex: redirected credential landed at its owner" \
+  || t_fail "codex redirect landing" "acct-01/auth.json missing"
+got_email="$(python3 - "$CX/acct-04/auth.json" <<'EOF'
+import base64, json, sys
+t = json.load(open(sys.argv[1]))['tokens']['id_token']
+p = t.split('.')[1]; p += '=' * (-len(p) % 4)
+print(json.loads(base64.urlsafe_b64decode(p)).get('email', ''))
+EOF
+)"
+[ "$got_email" = "d@cx" ] && t_ok "codex: redirect restored the target's prior credential" \
+  || t_fail "codex redirect restore" "acct-04 auth.json belongs to: $got_email"
+# `add` while signed into an already-registered account also keeps the credential
+rm -f "$CX/acct-01/auth.json"
+before_dirs="$(ls "$CX" | sort)"
+out="$(FAKE_EMAIL=a@cx codex-accounts add 2>&1)"
+rc=$?
+check "codex: add of a registered account saves the fresh sign-in to it" "fresh sign-in was saved to acct-01" "$out"
+[ "$rc" = "0" ] && t_ok "codex: add redirect exits 0 (nothing new to register)" || t_fail "codex add redirect rc" "rc=$rc"
+[ -s "$CX/acct-01/auth.json" ] && t_ok "codex: add redirect landed the credential" \
+  || t_fail "codex add redirect" "acct-01/auth.json missing"
+[ "$before_dirs" = "$(ls "$CX" | sort)" ] && t_ok "codex: add redirect leaves no reserved dir behind" \
+  || t_fail "codex add redirect cleanup" "pool dirs changed"
+n="$(grep -c '"email": "a@cx"' "$CX/accounts.json")"
+[ "$n" = "1" ] && t_ok "codex: add redirect creates no duplicate entry" || t_fail "codex add redirect dup" "count=$n"
+# relogin end-to-end: a redirect mid-run fixes the OTHER account, whose own turn is
+# then skipped instead of demanding a second sign-in. Both accounts' home must be
+# THIS machine's kind, or a credless account reads as 'remote' (grant lives
+# elsewhere) on the other platform and never enters the worklist.
+cx_mk=mac; [ "$(uname -s)" = "Darwin" ] || cx_mk=linux
+python3 - "$CX/accounts.json" "$cx_mk" <<'EOF'
+import json, os, sys
+d = json.load(open(sys.argv[1]))
+for a in d['accounts']:
+    if a['id'] in ('acct-01', 'acct-04'):
+        a['home'] = sys.argv[2]
+json.dump(d, open(sys.argv[1] + '.tmp', 'w'), indent=2); os.replace(sys.argv[1] + '.tmp', sys.argv[1])
+EOF
+rm -f "$CX/acct-01/auth.json" "$CX/acct-04/auth.json"
+out="$(FAKE_EMAIL=d@cx codex-accounts relogin --yes 2>&1)"
+rc=$?
+check "codex: relogin redirect saves the mis-ordered sign-in" "credential was saved to acct-04" "$out"
+check "codex: relogin skips an account fixed mid-run" "already has a working login" "$out"
+check "codex: relogin counts the redirect-fixed account" "re-authenticated 1 of 2" "$out"
+check "codex: relogin still reports the unfixed account" "still failing: acct-01" "$out"
+[ "$rc" != "0" ] && t_ok "codex: relogin with an unfixed account exits nonzero" || t_fail "codex relogin redirect rc" "rc=0"
+mk_cx_auth "$CX/acct-01/auth.json" a@cx "$FUTURE_EXP"
+mk_cx_auth "$CX/acct-04/auth.json" d@cx "$FUTURE_EXP"
 # the sign-in ceremony is DEVICE-CODE by default (the localhost browser callback
 # cannot reach a remote/SSH machine); --browser opts into the callback flow
 export FAKE_LOGIN_ARGS="$WORK/cx-login-args"
@@ -2020,9 +2195,36 @@ json.dump(d, open(sys.argv[1] + '.tmp', 'w'), indent=2); os.replace(sys.argv[1]
 EOF
   out="$(CODEX_MULTIACC_NO_SYNC=0 codex-accounts sync 2>&1)"
   rc=$?
-  check "codex: empty manifest refuses to sync" "refusing to blank the server pool" "$out"
+  check "codex: empty manifest refuses to sync" "refusing to blank the target pools" "$out"
   [ "$rc" != "0" ] && t_ok "codex: empty-manifest sync exits nonzero" || t_fail "codex empty sync rc" "rc=0"
   cp "$WORK/cx-manifest.bak" "$CX/accounts.json"
+
+  # replica + peer guards, codex flavor
+  printf 'replica\n' > "$CX/sync-role"
+  out="$(CODEX_MULTIACC_NO_SYNC=0 codex-accounts sync 2>&1)"
+  rc=$?
+  check "codex: replica pool refuses to push" "sync replica" "$out"
+  [ "$rc" = "0" ] && t_ok "codex: replica sync exits 0" || t_fail "codex replica sync rc" "rc=$rc"
+  # ...and a codex replica's auto_sync (fired by remove) is silent — no push, no nag
+  out="$(CODEX_MULTIACC_NO_SYNC=0 codex-accounts import rep@cx --id acct-31 --no-sync 2>&1
+         CODEX_MULTIACC_NO_SYNC=0 codex-accounts remove acct-31 --yes 2>&1)"
+  case "$out" in *"sync failed"*) t_fail "codex replica auto_sync" "a replica mutation warned about sync: $out" ;;
+    *) t_ok "codex: replica auto_sync is silent (no push, no warning)" ;; esac
+  rm -f "$CX/sync-role"
+  python3 - "$CX/accounts.json" <<'EOF'
+import json, os, sys
+d = json.load(open(sys.argv[1]))
+d['peers'] = [{'target': 'gas@peer', 'root': "/tmp/x'; touch /tmp/cx_multiacc_PEER_PWNED; #", 'repo': '/tmp/y'}]
+json.dump(d, open(sys.argv[1] + '.tmp', 'w'), indent=2); os.replace(sys.argv[1] + '.tmp', sys.argv[1])
+EOF
+  rm -f /tmp/cx_multiacc_PEER_PWNED
+  out="$(CODEX_MULTIACC_NO_SYNC=0 codex-accounts sync 2>&1)"
+  rc=$?
+  check "codex: injected peer root refused" "peer root is not a plain absolute path" "$out"
+  [ "$rc" != "0" ] && t_ok "codex: bad peer exits nonzero" || t_fail "codex peer validation rc" "rc=0"
+  [ ! -f /tmp/cx_multiacc_PEER_PWNED ] && t_ok "codex: peer injection never executed" \
+    || { t_fail "codex peer injection" "peer root injection EXECUTED"; rm -f /tmp/cx_multiacc_PEER_PWNED; }
+  cp "$WORK/cx-manifest.bak" "$CX/accounts.json"
 else
   t_ok "codex: sync validation tests skipped (Mac-only feature)"
 fi