claude-multiacc 1.0.12 → 1.0.14

package/bin/codex-accounts

@@ -2,6 +2,7 @@
 # codex-accounts — manage the codex-multiacc account pool (OpenAI Codex CLI).
 # Subcommands: list status add import adopt dedupe remove login expired relogin
 #              sync verify limits post-sync health self-update
+#              export-credential import-credential
 set -u
 # lib/codex_audit.py is imported by several subcommands; keep the install tree free
 # of __pycache__ (it may be root-owned, read-only, or an npm global prefix).
@@ -25,8 +26,8 @@ usage() {
 codex-accounts — multi-account pool manager for codex-multiacc (OpenAI Codex CLI)
 
 USAGE
-  codex-accounts list                       brief account list
-  codex-accounts status                     full health: auth, per-window limits, markers
+  codex-accounts list [--json]              brief account list (--json: machine-readable)
+  codex-accounts status [--json]            full health: auth, per-window limits, markers
   codex-accounts add [email] [--browser] [--force]
       login-FIRST: runs the Codex DEVICE-CODE sign-in by default — it prints a URL
       + one-time code you can open in ANY browser (this machine, your laptop, a
@@ -55,17 +56,32 @@ USAGE
   codex-accounts adopt <acct-NN>            make acct-NN THIS machine's existing
                                             default ~/.codex login (dir symlink —
                                             single credential file, no grant fork)
+  codex-accounts export-credential <acct-NN> [--out PATH] [--identity-only]
+      codex has NO portable credential class: auth.json carries a rotating refresh
+      token, so a copy breaks both machines. This ALWAYS refuses a credential
+      export (exit 3) and says what to do instead (sign in on that machine with
+      the device-code flow). --identity-only exports the registry entry
+      (id/email/home) so a daemon can seed the account list on another machine.
+  codex-accounts import-credential [acct-NN] [--in PATH|-] [--home mac|server]
+                                   [--force] [--no-sync]
+      install a blob from export-credential (stdin by default). For codex that is
+      always an identity-only blob: the account is registered and then needs ONE
+      interactive sign-in here (codex-accounts login <acct-NN>).
   codex-accounts remove <acct-NN> [--yes]   delete account (propagates to server)
   codex-accounts dedupe [--yes]             remove any account registered twice
                                             (same email), keeping one per email
-  codex-accounts sync                       push manifest+seeds to the server AND any
-                                            manifest 'peers' (extra machines). Mac only.
-                                            auth.json is machine-local, NEVER synced.
-                                            A pool with a 'sync-role' file saying
+  codex-accounts sync [--no-server]         push manifest+seeds to the sync target AND
+                                            any manifest 'peers' (extra machines). Mac
+                                            only. auth.json is machine-local, NEVER
+                                            synced. A pool with a 'sync-role' file saying
                                             'replica' never pushes (it receives).
+                                            --no-server (or a pool whose target is
+                                            'none') keeps sync LOCAL: validate + seed +
+                                            fix perms, push nowhere — for pools a panel
+                                            or runner daemon distributes.
   codex-accounts verify [--quick]           auth matrix; full mode runs a real
                                             `codex exec` per account
-  codex-accounts limits [--quiet] [--force]
+  codex-accounts limits [--quiet] [--force] [--json]
       refresh usage windows from the ChatGPT usage endpoint, apply >=90% markers.
       Auto-refreshes long-expired access tokens via the OAuth refresh-token grant
       (rotated credential is persisted), so idle accounts keep fresh telemetry and
@@ -77,7 +93,12 @@ USAGE
   codex-accounts post-sync                  (server side) seed dirs, fix perms, quick verify
 
 ENV
-  CODEX_ACCOUNTS_DIR    override ~/.codex-accounts
+  CODEX_ACCOUNTS_ROOT   pool root, overriding ~/.codex-accounts — one isolated pool
+                        per app-robot instance on a shared machine (legacy spelling
+                        CODEX_ACCOUNTS_DIR still works)
+  CODEX_MULTIACC_SYNC_TARGET   sync target (user@host), overriding the manifest;
+                        'none' = local-only, nothing is pushed anywhere
+  CODEX_MULTIACC_SYNC_ROOT / _SYNC_REPO   remote pool root / addon repo for it
   CODEX_ACCOUNT         pin the shim to one account
   CODEX_SHIM_RETRY=0    disable the `codex exec` auto-retry
   CODEX_MULTIACC_DISABLE=1  bypass the shim entirely
@@ -99,17 +120,19 @@ next_id() {
   done
 }
 
-manifest_add_account() { # id email home
-  "$PYBIN" - "$MANIFEST" "$1" "$2" "$3" <<'PYEOF'
+manifest_add_account() { # id email home [added_at]
+  "$PYBIN" - "$MANIFEST" "$1" "$2" "$3" "${4:-}" <<'PYEOF'
 import json, sys, time
-path, aid, email, home = sys.argv[1:5]
+path, aid, email, home, added_at = sys.argv[1:6]
 doc = json.load(open(path))
 accounts = [a for a in doc.get('accounts', []) if a['id'] != aid]
 accounts.append({
     'id': aid,
     'email': email,
     'home': home,
-    'added_at': time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime()),
+    # An imported account keeps the added_at it was registered with on the machine it
+    # came from, so the same account reads identically across the fleet.
+    'added_at': added_at or time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime()),
 })
 accounts.sort(key=lambda a: a['id'])
 doc['accounts'] = accounts
@@ -132,6 +155,17 @@ for a in json.load(open(sys.argv[1])).get('accounts', []):
 PYEOF
 }
 
+manifest_email_of() { # prints the email registered for <id>, empty if unknown
+  [ -f "$MANIFEST" ] || return 0
+  "$PYBIN" - "$MANIFEST" "$1" <<'PYEOF' 2>/dev/null
+import json, sys
+for a in json.load(open(sys.argv[1])).get('accounts', []):
+    if isinstance(a, dict) and a.get('id') == sys.argv[2]:
+        print(a.get('email', ''))
+        break
+PYEOF
+}
+
 manifest_del_account() { # id
   "$PYBIN" - "$MANIFEST" "$1" <<'PYEOF'
 import json, sys
@@ -146,9 +180,42 @@ os.replace(path + '.tmp', path)
 PYEOF
 }
 
+# ---- per-account login lock ----------------------------------------------------
+# Two concurrent logins for the SAME account corrupt each other: the later one
+# snapshots the OLD credential and its abort/refusal "restores" that stale
+# credential over the fresh one the first sign-in produced. A ceremony can take
+# minutes, so the lock is only reclaimed after 30 minutes (holder presumed dead).
+# Stale reclaim is ATOMIC between contenders: rename steals the stale lock
+# (exactly one mv succeeds); the loser finds a live lock and refuses. Release is
+# OWNERSHIP-GUARDED (owner.<pid> marker), so a process can never remove a lock a
+# later contender legitimately re-took.
+login_lock_acquire() { # $1 = lock dir; nonzero when someone else holds it
+  local L="$1"
+  if ! mkdir "$L" 2>/dev/null; then
+    [ $(( $(epoch_now) - $(file_mtime "$L") )) -gt 1800 ] || return 1
+    mv "$L" "$L.stale.$$" 2>/dev/null || return 1
+    rm -rf "$L.stale.$$" 2>/dev/null
+    mkdir "$L" 2>/dev/null || return 1
+  fi
+  : > "$L/owner.$$" 2>/dev/null || true
+  return 0
+}
+login_lock_release() { # $1 = lock dir; removes it ONLY if this process owns it
+  local L="$1"
+  [ -e "$L/owner.$$" ] && rm -rf "$L" 2>/dev/null
+  return 0
+}
+login_lock_busy() { # $1 = acct dir; true when a LIVE login ceremony holds it
+  [ -d "$1/.login-lock" ] \
+    && [ $(( $(epoch_now) - $(file_mtime "$1/.login-lock") )) -le 1800 ]
+}
+
 auto_sync() { # best effort after mutations, Mac only, loud on failure
-  [ "$(machine_kind)" = "mac" ] || return 0
   [ "${CODEX_MULTIACC_NO_SYNC:-0}" = "1" ] && return 0
+  # Local-only pool (target 'none'): there is nothing to push — the panel/runner
+  # daemon distributes accounts — so a mutation must not warn about a missing server.
+  sync_target_is_local "$(sync_target)" && return 0
+  [ "$(machine_kind)" = "mac" ] || return 0
   # A replica pool never pushes (the source machine owns the account set) —
   # silently, so every mutation on a replica does not nag about it.
   sync_is_replica && return 0
@@ -158,6 +225,14 @@ auto_sync() { # best effort after mutations, Mac only, loud on failure
 
 cmd_list() {
   require_manifest
+  local json=0
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --json) json=1; shift ;;
+      *) die "unknown option: $1 (usage: codex-accounts list [--json])" ;;
+    esac
+  done
+  if [ "$json" = "1" ]; then emit_report_json list; return $?; fi
   "$PYBIN" - "$MANIFEST" "$ACC_ROOT" "$LIB_DIR" "$(machine_kind)" <<'PYEOF'
 import json, os, re, sys
 doc = json.load(open(sys.argv[1]))
@@ -206,6 +281,14 @@ PYEOF
 
 cmd_status() {
   require_manifest
+  local json=0
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --json) json=1; shift ;;
+      *) die "unknown option: $1 (usage: codex-accounts status [--json])" ;;
+    esac
+  done
+  if [ "$json" = "1" ]; then emit_report_json status; return $?; fi
   "$PYBIN" - "$MANIFEST" "$ACC_ROOT" "$LIB_DIR" "$(machine_kind)" <<'PYEOF'
 import json, os, sys, time
 doc = json.load(open(sys.argv[1]))
@@ -424,15 +507,19 @@ cmd_add() {
     # The sign-in itself succeeded and produced a fresh credential for an account
     # that is already registered — don't throw it away: save it to that account,
     # exactly as `login $owner` would have. This machine now runs $owner.
+    # Needs the owner's login lock (non-blocking): writing under a mid-ceremony
+    # login for that account would corrupt it.
     local od="$ACC_ROOT/$owner"
     seed_account_dir "$od"
-    if mv -f "$d/auth.json" "$od/auth.json" 2>/dev/null; then
+    if login_lock_acquire "$od/.login-lock" && mv -f "$d/auth.json" "$od/auth.json" 2>/dev/null; then
       chmod 600 "$od/auth.json" 2>/dev/null || true
       clear_auth_markers "$od"
+      login_lock_release "$od/.login-lock"
       mutate_unlock
       log_to ops.log "add redirect: signed in as $got (already $owner) — credential saved to $owner"
       echo "$got is already added as $owner — the fresh sign-in was saved to $owner (usable on this machine now)."
     else
+      login_lock_release "$od/.login-lock"
       mutate_unlock
       echo "$got is already added as $owner — skipping (nothing added)."
     fi
@@ -493,20 +580,29 @@ cmd_import() {
       link) link_target="$(canon_path "$auth")" ;;
       *)
         mkdir -p "$ACC_ROOT/tmp"
-        stage="$ACC_ROOT/tmp/import-auth.$$"
+        # mktemp, not a predictable name: the staged file briefly holds a live
+        # credential, and a predictable path in a shared pool root could be
+        # pre-planted as a symlink and written through.
+        stage="$(mktemp "$ACC_ROOT/tmp/import-auth.XXXXXX")" \
+          || die "could not create a staging file under $ACC_ROOT/tmp"
+        IMPORT_STAGE="$stage"
+        trap import_cred_cleanup EXIT
         case "$mode" in
-          copy) ( umask 077; cp "$auth" "$stage" ) ;;
-          move) mv "$auth" "$stage" ;;
-        esac || { rm -f "$stage" 2>/dev/null; die "could not stage $auth (mode=$mode) — nothing registered"; }
+          copy) ( umask 077; cat "$auth" > "$stage" ) ;;
+          move) cat "$auth" > "$stage" && rm -f "$auth" ;;
+        esac || { import_cred_cleanup; trap - EXIT; die "could not stage $auth (mode=$mode) — nothing registered"; }
+        chmod 600 "$stage" 2>/dev/null || true
         ;;
     esac
   fi
   # Id allocation + duplicate check + manifest write run under the mutation lock, so
   # two parallel imports can never claim the same slot or drop each other's entry.
-  mutate_lock || { rm -f "$stage" 2>/dev/null; die "could not acquire the account lock (another op is stuck?) — try again"; }
-  # shellcheck disable=SC2064
-  trap "mutate_unlock 2>/dev/null || true; rm -f '$stage' 2>/dev/null || true" EXIT
-  fail_locked() { mutate_unlock; rm -f "$stage" 2>/dev/null; die "$@"; }
+  IMPORT_STAGE="$stage"
+  mutate_lock || { import_cred_cleanup; trap - EXIT; die "could not acquire the account lock (another op is stuck?) — try again"; }
+  # A CONSTANT trap program (import_cred_cleanup): interpolating the staged path would
+  # let a pool root containing a quote inject shell code into the trap body.
+  trap import_cred_cleanup EXIT
+  fail_locked() { import_cred_cleanup; trap - EXIT; die "$@"; }
   [ -n "$id" ] || id="$(next_id)"
   case "$id" in acct-[0-9][0-9]) ;; *) fail_locked "id must look like acct-NN" ;; esac
   local owner
@@ -521,6 +617,7 @@ cmd_import() {
     mv -f "$stage" "$d/auth.json" \
       || fail_locked "could not adopt $auth into $d (mode=$mode) — nothing registered"
     stage=""
+    IMPORT_STAGE=""
     chmod 600 "$d/auth.json" 2>/dev/null || true
   elif [ -n "$link_target" ]; then
     ln -sf "$link_target" "$d/auth.json" \
@@ -632,6 +729,10 @@ cmd_remove() {
     read -r ans
     case "$ans" in y|Y|yes) ;; *) echo "aborted"; return 1 ;; esac
   fi
+  # Never delete an account out from under a live sign-in ceremony: the login's
+  # cleanup would then operate on a removed (or later recreated) path.
+  login_lock_busy "$ACC_ROOT/$id" \
+    && die "a login for $id is in progress — finish or abort it first"
   if [ -L "$ACC_ROOT/$id" ]; then
     rm -f "${ACC_ROOT:?}/${id:?}"   # adopted account: remove the symlink, never the target
   else
@@ -671,6 +772,18 @@ for a in json.load(open(sys.argv[1])).get('accounts', []):
         break
 PYEOF
 )"
+  # PER-ACCOUNT login lock (observed in the field: parallel relogin runs left a
+  # months-dead token inside a minutes-old auth.json — see login_lock_acquire).
+  local llock="$d/.login-lock"
+  login_lock_acquire "$llock" \
+    || die "another login for $id is already in progress (this terminal or another) — finish or abort it first"
+  # Released on EVERY exit: normal returns, die (exit fires EXIT), Ctrl-C (the INT
+  # handler exits, which fires EXIT). Runs in a subshell under relogin, so the trap
+  # scope is exactly this one login. Ownership-guarded: never removes a lock a
+  # later contender re-took.
+  # shellcheck disable=SC2064
+  trap "login_lock_release '$llock'" EXIT
+
   echo "Sign in as $email for $id."
   # Snapshot the credential BEFORE the ceremony: `codex login` writes auth.json into
   # the dir directly, so a sign-in to the WRONG account would otherwise leave that
@@ -712,17 +825,27 @@ PYEOF
     local owner
     owner="$(email_owner "$got")"
     if [ -n "$owner" ] && [ "$owner" != "$id" ]; then
+      # The redirect mutates the OWNER's credential, so it needs the owner's login
+      # lock too (non-blocking: if a login for that account is mid-ceremony, writing
+      # under it would recreate exactly the corruption this lock prevents — skip the
+      # redirect and fall through to the plain refusal instead).
       local od="$ACC_ROOT/$owner"
       seed_account_dir "$od"
-      if mv -f "$d/auth.json" "$od/auth.json" 2>/dev/null; then
-        chmod 600 "$od/auth.json" 2>/dev/null || true
-        clear_auth_markers "$od"
-        restore_snap
-        trap - INT TERM
-        log_to ops.log "login redirect: signed in as $got -> credential saved to $owner (target was $id)"
-        echo "you signed in as $got — that is $owner, so the credential was saved to $owner (usable now)."
-        echo "$id ($email) still needs its own sign-in: codex-accounts login $id"
-        return 1
+      if login_lock_acquire "$od/.login-lock"; then
+        if mv -f "$d/auth.json" "$od/auth.json" 2>/dev/null; then
+          chmod 600 "$od/auth.json" 2>/dev/null || true
+          clear_auth_markers "$od"
+          login_lock_release "$od/.login-lock"
+          restore_snap
+          trap - INT TERM
+          log_to ops.log "login redirect: signed in as $got -> credential saved to $owner (target was $id)"
+          echo "you signed in as $got — that is $owner, so the credential was saved to $owner (usable now)."
+          echo "$id ($email) still needs its own sign-in: codex-accounts login $id"
+          return 1
+        fi
+        login_lock_release "$od/.login-lock"
+      else
+        echo "note: a login for $owner is in progress — not saving this credential there."
       fi
     fi
     restore_snap
@@ -892,11 +1015,12 @@ cmd_relogin() {
 
 cmd_limits() {
   require_manifest
-  local quiet=0 force=0
+  local quiet=0 force=0 json=0
   while [ $# -gt 0 ]; do
     case "$1" in
       --quiet) quiet=1; shift ;;
       --force) force=1; shift ;;   # ignore freshness/backoff (manual override)
+      --json) json=1; quiet=1; shift ;;   # refresh silently, then emit the report
       *) die "unknown option: $1" ;;
     esac
   done
@@ -905,14 +1029,20 @@ cmd_limits() {
   if ! mkdir "$lock" 2>/dev/null; then
     local age=$(( $(epoch_now) - $(file_mtime "$lock") ))
     if [ "$age" -lt 120 ]; then
+      # A --json caller still gets the document (built from the state on disk) —
+      # a machine-readable verb must never answer a concurrent run with silence.
+      if [ "$json" = "1" ]; then emit_report_json limits; return $?; fi
       [ "$quiet" = "1" ] || echo "another limits refresh is running; skipping"
       return 0
     fi
     rm -rf "$lock"
-    mkdir "$lock" 2>/dev/null || return 0
+    if ! mkdir "$lock" 2>/dev/null; then
+      if [ "$json" = "1" ]; then emit_report_json limits; return $?; fi
+      return 0
+    fi
   fi
-  # shellcheck disable=SC2064
-  trap "rm -rf '$lock'" EXIT
+  LIMITS_LOCK="$lock"
+  trap limits_lock_release EXIT
   rotate_log limits.log
   # The >=90% exclusion rule is a hard requirement: the manifest may tighten it but
   # never loosen it, or an account could sit at 95% and still be selected.
@@ -927,7 +1057,7 @@ import base64, datetime, json, os, sys, time, urllib.request
 root, threshold, quiet, url, force = sys.argv[1], int(sys.argv[2]), sys.argv[3] == '1', sys.argv[4], sys.argv[5] == '1'
 now = time.time()
 # Don't re-fetch an account whose data is younger than this (endpoint rate-limits).
-MIN_FETCH_INTERVAL = int(os.environ.get('CODEX_MULTIACC_MIN_FETCH', '45'))
+MIN_FETCH_INTERVAL = int(os.environ.get('CODEX_MULTIACC_MIN_FETCH', '240'))
 
 # OAuth refresh-token grant — the same endpoint + public client id the Codex CLI
 # itself uses to keep auth.json alive. An account that sits idle past its
@@ -1356,13 +1486,20 @@ for acct in manifest.get('accounts', []):
         say(f"{aid}: LIMITED {worst['name']} at {worst['percent']}% (resets {worst['resets_at']})")
     else:
         if os.path.exists(mpath):
-            # A shim-written error-cooldown marker outlives a clean limits pass:
-            # the account failed a real call moments ago; give the cooldown its window.
+            # A shim-written marker outlives a clean limits pass while its own window
+            # is still open:
+            #   error-cooldown     — the account failed a real call moments ago.
+            #   client-rate-limit  — a real codex run was told by the server that this
+            #                        window is spent, and recorded the reset it was
+            #                        handed. That is first-hand evidence; a usage
+            #                        payload that disagrees must not unpark the account
+            #                        early and send work straight back into the wall.
             keep = False
             try:
                 txt = open(mpath).read()
                 first = txt.splitlines()[0] if txt else ''
-                if 'reason=error-cooldown' in txt and first.isdigit() and int(first) > now:
+                if ('reason=error-cooldown' in txt or 'reason=client-rate-limit' in txt) \
+                        and first.isdigit() and int(first) > now:
                     keep = True
             except Exception:
                 pass
@@ -1373,6 +1510,18 @@ for acct in manifest.get('accounts', []):
             detail = '  '.join(f"{b['name']}={b['percent']}%" for b in buckets)
             print(f'{aid}: ok  {detail}')
 PYEOF
+  local refresh_rc=$?
+  # Release the lock BEFORE the report: a --json caller must not hold the refresh
+  # lock while a consumer reads its output.
+  limits_lock_release
+  trap - EXIT
+  # The refresher fails open per account; a NON-zero status means the pass itself
+  # broke (unreadable manifest, dead python). Report the state anyway — stale data
+  # beats silence — but hand the caller the failure, exactly as before --json existed.
+  if [ "$json" = "1" ]; then
+    emit_report_json limits || return $?
+  fi
+  return "$refresh_rc"
 }
 
 cmd_verify() {
@@ -1604,17 +1753,45 @@ sync_is_replica() {
 
 cmd_sync() {
   require_manifest
+  local allow_empty=0 no_server=0
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --allow-empty) allow_empty=1; shift ;;
+      --no-server) no_server=1; shift ;;   # this run pushes nowhere, whatever the manifest says
+      *) die "unknown option: $1 (usage: codex-accounts sync [--no-server] [--allow-empty])" ;;
+    esac
+  done
+  local server sroot srepo
+  server="$(sync_target)"
+  sroot="$(sync_target_root)"
+  srepo="$(sync_target_repo)"
+  # LOCAL-ONLY: no ssh target at all, because a panel/runner daemon distributes this
+  # pool. Validate + fix up locally and stop — the same verb keeps working, it simply
+  # has nowhere to push. (Not Mac-gated: a local pool is legitimate on any host.)
+  # This mode NARROWS the replica rule, it never widens it: a replica pushes nothing,
+  # and a local-only pool pushes nothing whether or not it is a replica. The marker is
+  # still honored and still reported, so a replica can never start pushing by having
+  # its sync target changed.
+  if [ "$no_server" = "1" ] || sync_target_is_local "$server"; then
+    rotate_log sync.log
+    manifest_well_formed || { log_to sync.log "FAIL: manifest malformed (local sync)"; \
+      die "manifest is not valid JSON or has no well-formed accounts — fix $MANIFEST"; }
+    local role="source"
+    sync_is_replica && role="replica"
+    log_to sync.log "sync (local-only, role=$role): no server target${no_server:+ (--no-server)}"
+    local_pool_fixup
+    if [ "$role" = "replica" ]; then
+      echo "sync ok (local-only, and this pool is a sync replica — nothing pushed either way)"
+    else
+      echo "sync ok (local-only: pool at $ACC_ROOT validated and re-seeded; nothing pushed)"
+    fi
+    return 0
+  fi
   [ "$(machine_kind)" = "mac" ] || die "sync runs on the Mac (source of truth), not the server"
   if sync_is_replica; then
     echo "this pool is a sync replica — the source machine pushes here; nothing sent"
     return 0
   fi
-  local allow_empty=0
-  [ "${1:-}" = "--allow-empty" ] && allow_empty=1
-  local server sroot srepo
-  server="$(manifest_get server "$DEFAULT_SERVER")"
-  sroot="$(manifest_get server_root "$DEFAULT_SERVER_ROOT")"
-  srepo="$(manifest_get server_repo "$DEFAULT_SERVER_REPO")"
   # These land inside remote shell commands — anything but a plain target/path is a
   # command-injection vector from a corrupted or hand-edited manifest. EVERY target
   # (primary and peers) is validated before anything is pushed anywhere.
@@ -1646,17 +1823,8 @@ EOF
   # never be pushed (it would blank the target pools), and must never make the removal
   # propagation wipe a target's account dirs. Emptying the pool on purpose is possible
   # via `sync --allow-empty`, so this can never happen by accident.
-  "$PYBIN" - "$MANIFEST" <<'PYEOF' 2>/dev/null || fail "manifest is not valid JSON or has no well-formed accounts — refusing to sync"
-import json, re, sys
-doc = json.load(open(sys.argv[1]))
-accounts = doc.get('accounts')
-if not isinstance(accounts, list):
-    sys.exit(1)
-for a in accounts:
-    if not isinstance(a, dict) or not re.fullmatch(r'acct-\d{2}', str(a.get('id', ''))) \
-       or not str(a.get('email', '')).strip():
-        sys.exit(1)
-PYEOF
+  manifest_well_formed \
+    || fail "manifest is not valid JSON or has no well-formed accounts — refusing to sync"
   if [ -z "$(account_ids)" ] && [ "$allow_empty" != "1" ]; then
     fail "manifest has zero accounts — refusing to blank the target pools (use 'sync --allow-empty' if that is really intended)"
   fi
@@ -1683,12 +1851,7 @@ EOF
 
 cmd_post_sync() {
   require_manifest
-  local id d
-  for id in $(account_ids); do
-    d="$ACC_ROOT/$id"
-    seed_account_dir "$d"
-    [ -f "$d/auth.json" ] && chmod 600 "$d/auth.json" 2>/dev/null
-  done
+  local_pool_fixup
   log_to sync.log "post-sync: seeded $(account_ids | wc -l | tr -d ' ') account dirs"
   ( cmd_limits --quiet ) || true   # subshell: release the limits lock before verify
   cmd_verify --quick
@@ -1777,6 +1940,8 @@ case "${1:-help}" in
   status) shift; cmd_status "$@" ;;
   add) shift; cmd_add "$@" ;;
   import) shift; cmd_import "$@" ;;
+  export-credential|export-cred) shift; cmd_export_credential "$@" ;;
+  import-credential|import-cred) shift; cmd_import_credential "$@" ;;
   adopt) shift; cmd_adopt "$@" ;;
   dedupe) shift; cmd_dedupe "$@" ;;
   remove) shift; cmd_remove "$@" ;;