claude-multiacc 1.0.7 → 1.0.8

package/README.md

@@ -1,16 +1,23 @@
 # claude-multiacc
 
-Multi-account addon for Claude Code: every `claude` / `claude -p` invocation runs under a
+Multi-account addon for **Claude Code AND OpenAI Codex CLI**: every `claude` /
+`claude -p` invocation — and every `codex` / `codex exec` invocation — runs under a
 randomly picked **subscription** account with limit headroom (no API keys, ever). The
-account set mirrors automatically from the Mac (source of truth) to the deploy server.
+account sets mirror automatically from the Mac (source of truth) to the deploy server.
 
-Installs as a PATH shim + helper CLI from this repo. **Never touches the Claude Code app**:
-no binary edits, no install-dir writes, survives `claude update` — the real binary is
-resolved dynamically at exec time.
+Installs as PATH shims + helper CLIs from this repo. **Never touches the Claude Code or
+Codex apps**: no binary edits, no install-dir writes, survives `claude update` /
+`codex update` — the real binaries are resolved dynamically at exec time.
 
-Tested on: macOS (bash 3.2, zsh, Claude Code 2.1.207) and Ubuntu 24.04
-(bash 5.2, Claude Code 2.1.201). Test suite: `tests/run-tests.sh` (221 sandboxed tests,
-no network / no quota — passes on both platforms).
+One install covers both: the same `install.sh` / `npm i -g claude-multiacc` wires up
+the `claude` shim + `claude-accounts` CLI (pool at `~/.claude-accounts`) and the
+`codex` shim + `codex-accounts` CLI (pool at `~/.codex-accounts`). The two pools are
+completely independent — separate manifests, credentials, telemetry, and logs — so
+either provider can be used, re-authenticated, or emptied without touching the other.
+
+Tested on: macOS (bash 3.2, zsh, Claude Code 2.1.207+, Codex CLI 0.147) and Ubuntu 24.04
+(bash 5.2). Test suite: `tests/run-tests.sh` (348 sandboxed tests, no network / no
+quota — passes on both platforms).
 
 ---
 
@@ -130,6 +137,65 @@ an account, and if one slips through it returns to the pool by itself. Output is
 never double-emits. Only engages when stdin is finite (tty / regular file / `/dev/null`)
 and ≥2 accounts are eligible; service-spawned pipes take the plain exec path untouched.
 
+## Codex support (OpenAI Codex CLI)
+
+The exact same machinery, instantiated a second time for Codex. Everything documented
+above about the claude pool holds for the codex pool with these translations:
+
+| Claude side | Codex side |
+| --- | --- |
+| `bin/claude` shim, `claude-accounts` CLI | `bin/codex` shim, `codex-accounts` CLI |
+| pool `~/.claude-accounts`, server `/root/.claude-accounts` | pool `~/.codex-accounts`, server `/root/.codex-accounts` |
+| `CLAUDE_CONFIG_DIR` per-account dirs | `CODEX_HOME` per-account dirs |
+| `.credentials.json` (OAuth, machine-local) | `auth.json` (ChatGPT OAuth, machine-local) |
+| `claude -p` auto-retry | `codex exec` auto-retry |
+| Anthropic OAuth usage endpoint, per-model Fable bucket | `chatgpt.com/backend-api/codex/usage`, per-model buckets (e.g. `GPT-5.3-Codex-Spark:5h/7d`) |
+| `CLAUDE_ACCOUNT` / `CLAUDE_SHIM_RETRY` / `CLAUDE_MULTIACC_DISABLE` / … | `CODEX_ACCOUNT` / `CODEX_SHIM_RETRY` / `CODEX_MULTIACC_DISABLE` / … |
+
+Same selection rule (weekly headroom primary, session tiebreak, ≥90% any-bucket
+exclusion), same marker semantics (`.limited` cooldowns, `.expired` parks with
+credential/policy scoping and soft expiry), same fail-open guarantees, same sync
+safety guards. The `codex` shim engages the buffered auto-retry only for
+`codex exec` runs with finite stdin, exactly like `-p` on the claude side.
+
+Codex-specific notes:
+
+- **Auth is the Codex device-code sign-in by default**: `codex-accounts add` prints
+  a URL + one-time code you can open in ANY browser (this machine, your laptop, a
+  phone), so it works identically on a local Mac, over SSH, and on servers — there
+  is no portable setup-token equivalent for Codex, so a server account is signed in
+  ON the server the same way. `--browser` opts into the localhost browser-callback
+  flow instead (only works when the browser runs on the same machine — the callback
+  goes to `localhost:1455`). Either way the login runs with `CODEX_HOME` pointed at
+  the account dir, and identity is verified offline from the id-token before
+  anything is registered.
+- **`auth.json` is never synced** in either direction, for the same reason
+  `.credentials.json` never is: the refresh token rotates, and two machines
+  refreshing one grant strand each other. Sync pushes manifest + `config.toml`
+  seeds + advisory limit state only.
+- **Windows are classified by length**, not by name: any window ≤6h counts as the
+  self-healing session signal, anything longer as durable/weekly. A hard
+  `limit_reached`/`allowed:false` verdict marks the account even if no window shows
+  ≥90%, and a reshaped payload is still scanned recursively for window-shaped
+  objects (fail open if nothing parses).
+- **Idle-account telemetry** stays fresh the same way: a long-expired access token is
+  renewed via the OAuth refresh-token grant (`auth.openai.com/oauth/token`, the CLI's
+  own public client id) and the rotated credential is persisted 0600. Overrides for
+  tests: `CODEX_MULTIACC_TOKEN_URL`, `CODEX_MULTIACC_CLIENT_ID`,
+  `CODEX_MULTIACC_USAGE_URL`.
+- **API-key logins are rejected** — ChatGPT subscription accounts only, matching the
+  addon's no-API-keys rule.
+
+```bash
+codex-accounts add                    # sign in a new ChatGPT account (device code —
+                                      # open the URL in any browser, enter the code)
+codex-accounts add --browser          # localhost browser-callback flow instead
+codex-accounts import <email> --id acct-01 && codex-accounts adopt acct-01
+                                      # adopt this machine's existing ~/.codex login
+codex-accounts list | status | expired | relogin | verify | limits | health | sync
+claude-multiacc codex <cmd>           # same commands via the npm wrapper
+```
+
 ## Install / update / uninstall
 
 ### npm (recommended)
@@ -308,6 +374,10 @@ failures are loud and non-zero.
 | `CLAUDE_SHIM_RETRY=0` | disable the `-p` auto-retry |
 | `CLAUDE_ACCOUNTS_DIR=...` | relocate the pool (used by the test suite) |
 
+The codex shim honors the same switches spelled `CODEX_*`: `CODEX_ACCOUNT`,
+`CODEX_HOME` (passthrough), `CODEX_MULTIACC_DISABLE`, `CODEX_SHIM_RETRY`,
+`CODEX_SHIM_SELECT`, `CODEX_ACCOUNTS_DIR`, `CODEX_MULTIACC_THRESHOLD`.
+
 ## Verification
 
 ```bash

package/bin/cli.mjs

@@ -42,24 +42,31 @@ function runAccounts(args) {
   return sh('bash', [join(ROOT, 'bin', 'claude-accounts'), ...args]);
 }
 
+function runCodexAccounts(args) {
+  return sh('bash', [join(ROOT, 'bin', 'codex-accounts'), ...args]);
+}
+
 const HELP = `claude-multiacc ${pkg.version}
 
-Every 'claude' / 'claude -p' runs under a randomly-picked subscription account with the
-most usage headroom; the account set mirrors to a deploy server. No API keys.
+Every 'claude' / 'claude -p' AND every 'codex' / 'codex exec' runs under a
+randomly-picked subscription account with the most usage headroom; the account sets
+mirror to a deploy server. No API keys — Claude and ChatGPT subscription logins only.
 
 USAGE
   claude-multiacc [install]            install or update the addon (idempotent)
   claude-multiacc uninstall [--purge-data]
   claude-multiacc self-update          update to the latest npm release + re-install
-  claude-multiacc doctor               show environment + account health
+  claude-multiacc doctor               show environment + account health (both pools)
   claude-multiacc <cmd> [args...]      run a claude-accounts command, e.g.
                                        list | status | add <email> | login <acct-NN> |
                                        remove <acct-NN> | sync | verify | limits | health
+  claude-multiacc codex <cmd> [args...]  same commands for the Codex pool
+                                       (runs codex-accounts <cmd>)
   claude-multiacc -v | --version
   claude-multiacc -h | --help
 
 INSTALL
-  npm install -g claude-multiacc       # postinstall wires up the PATH shim + schedules
+  npm install -g claude-multiacc       # postinstall wires up the PATH shims + schedules
   # or, no global install:
   npx claude-multiacc                  # runs the installer once
 
@@ -91,8 +98,17 @@ switch (cmd) {
     console.log('Updated. Open a new shell to pick up any PATH changes.');
     break;
   }
-  case 'doctor':
-    status = runAccounts(['status']);
+  case 'doctor': {
+    console.log('== claude pool ==');
+    const claudeStatus = runAccounts(['status']);
+    console.log('\n== codex pool ==');
+    const codexStatus = runCodexAccounts(['status']);
+    status = claudeStatus || codexStatus;
+    break;
+  }
+  case 'codex':
+    // Codex-pool passthrough: claude-multiacc codex list | status | add | ...
+    status = argv.length > 1 ? runCodexAccounts(argv.slice(1)) : runCodexAccounts(['help']);
     break;
   case '-v':
   case '--version':

package/bin/codex

@@ -0,0 +1,453 @@
+#!/usr/bin/env bash
+# codex-multiacc-shim — PATH-shadows the real `codex` binary; never replaces or edits it.
+# Every invocation runs under a randomly picked ChatGPT subscription account with limit
+# headroom. Self-contained on purpose: no sourcing, so a broken repo file can never
+# break `codex`.
+# Selection: CODEX_HOME passthrough > CODEX_ACCOUNT pin > most-headroom among
+# limit-eligible accounts > least-utilized fallback (degraded beats down).
+# Accounts whose login is DEAD (a `.expired` marker from a failed refresh/verify/run)
+# are never selected — not even as the all-limited fallback — because they fail every
+# call outright; `codex-accounts expired` / `relogin` fix them.
+
+set -u
+
+# ${HOME:-} guards: with HOME stripped (env -i, some cron/systemd units) the shim
+# must still fail OPEN into plain passthrough, never abort on an unbound variable.
+ACC_ROOT="${CODEX_ACCOUNTS_DIR:-${HOME:-/nonexistent}/.codex-accounts}"
+MANIFEST="$ACC_ROOT/accounts.json"
+
+canon_path() {
+  local p="$1" t i=0 d b
+  case "$p" in /*) ;; *) p="$PWD/$p" ;; esac
+  while [ -L "$p" ] && [ "$i" -lt 40 ]; do
+    t="$(readlink "$p")" || break
+    case "$t" in /*) p="$t" ;; *) p="$(dirname "$p")/$t" ;; esac
+    i=$((i+1))
+  done
+  d="$(cd "$(dirname "$p")" 2>/dev/null && pwd -P)" || { printf '%s\n' "$p"; return 0; }
+  b="$(basename "$p")"
+  if [ "$d" = "/" ]; then printf '/%s\n' "$b"; else printf '%s/%s\n' "$d" "$b"; fi
+}
+
+# 'multiacc-shim' matches this file AND bin/claude — a shim must never exec a shim.
+is_shim_file() { head -c 300 "$1" 2>/dev/null | grep -q multiacc-shim; }
+
+SELF="$(canon_path "$0")"
+SELF_DIR="$(dirname "$SELF")"
+
+find_real() {
+  local cand c d
+  local oldifs="$IFS"
+  IFS=':'; set -f
+  # shellcheck disable=SC2086
+  set -- $PATH
+  IFS="$oldifs"; set +f
+  for d in "$@"; do
+    [ -n "$d" ] || continue
+    cand="$d/codex"
+    [ -f "$cand" ] && [ -x "$cand" ] || continue
+    c="$(canon_path "$cand")"
+    [ "$c" = "$SELF" ] && continue
+    case "$c" in "$ACC_ROOT"/*) continue ;; esac
+    is_shim_file "$c" && continue
+    printf '%s\n' "$cand"; return 0
+  done
+  # Fallbacks: resolved dynamically at exec time, so `codex update`/reinstalls keep working.
+  for cand in "${HOME:-/nonexistent}/.local/bin/codex" /usr/local/bin/codex /opt/homebrew/bin/codex /usr/bin/codex; do
+    [ -f "$cand" ] && [ -x "$cand" ] || continue
+    c="$(canon_path "$cand")"
+    [ "$c" = "$SELF" ] && continue
+    is_shim_file "$c" && continue
+    printf '%s\n' "$cand"; return 0
+  done
+  return 1
+}
+
+REAL="$(find_real)" || {
+  printf 'codex-multiacc shim: real codex binary not found (PATH or fallback locations)\n' >&2
+  exit 127
+}
+
+# Fast passthrough: caller pinned a config dir, addon disabled, recursion guard, or
+# no account data yet. Byte-identical behavior to stock codex.
+if [ -n "${CODEX_HOME:-}" ] \
+  || [ "${CODEX_MULTIACC_DISABLE:-0}" = "1" ] || [ -n "${CODEX_SHIM_ACTIVE:-}" ] \
+  || [ ! -f "$MANIFEST" ]; then
+  exec "$REAL" "$@"
+fi
+
+now="$(date +%s)"
+
+# Threshold used by the telemetry backstop below; the manifest is the source of
+# truth, but a corrupt/unreadable manifest must never break selection => plain
+# sed with a safe default, never a JSON parse.
+if [ -z "${CODEX_MULTIACC_THRESHOLD:-}" ]; then
+  CODEX_MULTIACC_THRESHOLD="$(sed -n 's/.*"threshold"[^0-9]*\([0-9][0-9]*\).*/\1/p' "$MANIFEST" 2>/dev/null | head -1)"
+  case "$CODEX_MULTIACC_THRESHOLD" in ''|*[!0-9]*) CODEX_MULTIACC_THRESHOLD=90 ;; esac
+fi
+
+if [ "$(uname -s)" = "Darwin" ]; then
+  file_mtime() { stat -f %m "$1" 2>/dev/null || echo 0; }
+else
+  file_mtime() { stat -c %Y "$1" 2>/dev/null || echo 0; }
+fi
+
+sel_log() {
+  printf '%s %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$*" >> "$ACC_ROOT/selection.log" 2>/dev/null || true
+}
+
+marker_active() { # true if $1/.limited is still in force; clears cleanly-expired markers
+  local m="$1/.limited" reset=""
+  [ -f "$m" ] || return 1
+  IFS= read -r reset < "$m" 2>/dev/null || reset=""
+  case "$reset" in
+    ''|*[!0-9]*)
+      # Empty/partial/garbled marker — e.g. read during a concurrent rewrite.
+      # Treat as ACTIVE and never delete: deleting here could destroy a marker
+      # another process is mid-write. The next limits refresh rewrites or clears it.
+      return 0 ;;
+  esac
+  if [ "$now" -ge "$reset" ]; then
+    rm -f "$m" 2>/dev/null
+    return 1
+  fi
+  return 0
+}
+
+STALE_AFTER=900
+
+fresh_field() { # fresh_field <acct dir> <json key> -> integer if telemetry fresh, else fail
+  local f="$1/limits.json" fetched v
+  [ -f "$f" ] || return 1
+  fetched="$(sed -n 's/.*"fetched_at"[^0-9]*\([0-9][0-9]*\).*/\1/p' "$f" 2>/dev/null | head -1)"
+  case "$fetched" in ''|*[!0-9]*) return 1 ;; esac
+  [ $((now - fetched)) -le "$STALE_AFTER" ] || return 1
+  v="$(sed -n "s/.*\"$2\"[^0-9]*\([0-9][0-9]*\).*/\1/p" "$f" 2>/dev/null | head -1)"
+  case "$v" in ''|*[!0-9]*) return 1 ;; esac
+  printf '%s\n' "$v"
+}
+
+# RANKING score — lower is better (more headroom). Weekly headroom dominates: a weekly
+# window only refills on its multi-day reset, while the ~5h window self-heals, so
+# session is a mild tiebreaker only (same reset asymmetry as the claude pool).
+#   score = weekly%*1000 + session%      weekly,session in [0,100]
+# Stale/unreadable telemetry ranks NEUTRAL (weekly 50, session 50), never "free".
+sel_score_of() { # $1 = acct dir
+  local w s
+  w="$(fresh_field "$1" weekly_percent)" || w="$(fresh_field "$1" max_percent)" || w=50
+  s="$(fresh_field "$1" session_percent)" || s=50
+  printf '%s\n' $((w * 1000 + s))
+}
+
+# Backstop for a lost/failed marker write: fresh telemetry with ANY bucket at/over the
+# threshold excludes the account even if .limited is missing. Stale/unreadable => not
+# over (fail open — telemetry must never invent exclusions).
+over_threshold() { # $1 = acct dir
+  local v
+  v="$(fresh_field "$1" max_percent)" || return 1
+  [ "$v" -ge "${CODEX_MULTIACC_THRESHOLD:-90}" ]
+}
+
+# Auth is a ChatGPT login: auth.json carrying a non-empty access token. An API-key-only
+# auth.json is NOT auth here (subscription-only by design), and an empty file is NOT
+# auth (an interrupted write must not make a dead account selectable).
+has_auth() {
+  [ -s "$1/auth.json" ] \
+    && LC_ALL=C grep -q '"access_token"[[:space:]]*:[[:space:]]*"[^"]' "$1/auth.json" 2>/dev/null
+}
+
+# `.expired` is the persistent "this account needs a re-login" marker: written by
+# codex-accounts (refresh grant expired/revoked, failed verify) and by the retry path
+# below when a real call fails with an auth error. It SELF-HEALS: any auth.json written
+# after the marker (successful re-login, or a refresh by another process) clears it.
+# A marker written by the SHIM (a guess from one failed run) also carries
+# `soft_until=<epoch>`: once that passes the account returns to the pool by itself, so
+# a misread never costs an account permanently. Markers written by codex-accounts —
+# a refresh grant that answered invalid_grant, a failed real call — carry no soft_until
+# and stay until the account provably works again.
+expired_marked() { # $1 = acct dir
+  local m="$1/.expired" mt soft reason
+  [ -f "$m" ] || return 1
+  reason="$(LC_ALL=C sed -n 's/.*reason=\([A-Za-z0-9._-][A-Za-z0-9._-]*\).*/\1/p' "$m" 2>/dev/null | head -1)"
+  # CREDENTIAL-scoped parks clear the moment a newer credential lands — that is the
+  # evidence they were about. A POLICY park (org-blocked: a workspace admin turned
+  # Codex off for the account) is about the account, not the credential: refreshing
+  # its token does not re-enable Codex, so only a passing real call or a re-login
+  # lifts it.
+  if [ "$reason" != "org-blocked" ]; then
+    mt="$(file_mtime "$m")"
+    if [ -f "$1/auth.json" ] && [ "$(file_mtime "$1/auth.json")" -gt "$mt" ]; then
+      rm -f "$m" 2>/dev/null
+      return 1
+    fi
+  fi
+  soft="$(LC_ALL=C sed -n 's/.*soft_until=\([0-9][0-9]*\).*/\1/p' "$m" 2>/dev/null | head -1)"
+  case "$soft" in
+    ''|*[!0-9]*) return 0 ;;                       # no soft stamp => proven dead, keep
+    *) [ "$now" -lt "$soft" ] && return 0
+       rm -f "$m" 2>/dev/null                      # soft window elapsed: give it another go
+       return 1 ;;
+  esac
+}
+
+# Codex access-token expiry lives inside a JWT (not scrapeable with sed), so unlike
+# the claude shim there is no plaintext creds_dead check here: the codex CLI refreshes
+# a stale token itself at startup, and a DEAD refresh grant is detected by the limits
+# refresher / verify / the retry path below — all of which write `.expired`.
+auth_dead() { expired_marked "$1"; }
+
+# Explicit pin wins over everything — markers, and even missing auth: the
+# add/login ceremony pins to a dir that has no credentials yet, and the login
+# must land exactly there, never in a randomly selected account's dir.
+if [ -n "${CODEX_ACCOUNT:-}" ]; then
+  d="$ACC_ROOT/$CODEX_ACCOUNT"
+  if [ -d "$d" ]; then
+    sel_log "$CODEX_ACCOUNT pinned pwd=$PWD"
+    export CODEX_HOME="$d"
+    export CODEX_SHIM_ACTIVE=1
+    exec "$REAL" "$@"
+  fi
+  sel_log "pin-invalid account=$CODEX_ACCOUNT (no such dir; random fallback)"
+fi
+
+valid=()
+eligible=()
+expired=()
+for d in "$ACC_ROOT"/acct-*; do
+  [ -d "$d" ] || continue
+  has_auth "$d" || continue
+  # Expired logins are excluded BEFORE anything else: unlike a limit marker (degraded
+  # but working), dead auth guarantees a hard failure, so it can never be the
+  # "degraded beats down" fallback either.
+  if auth_dead "$d"; then
+    expired+=("$d")
+    continue
+  fi
+  valid+=("$d")
+  marker_active "$d" && continue
+  over_threshold "$d" && continue
+  eligible+=("$d")
+done
+
+if [ "${#expired[@]}" -gt 0 ]; then
+  ids=""
+  for d in "${expired[@]}"; do ids="$ids $(basename "$d")"; done
+  sel_log "skipped-expired:$ids (unusable — see: codex-accounts expired)"
+  # One actionable line, at most hourly, and only on a terminal — a service-spawned
+  # `codex exec` must keep its stderr byte-clean.
+  if [ -t 2 ]; then
+    n="$ACC_ROOT/.expired-notice"
+    last=0
+    [ -f "$n" ] && last="$(file_mtime "$n")"
+    if [ $((now - last)) -gt 3600 ]; then
+      : > "$n" 2>/dev/null || true
+      printf 'codex-multiacc: %s account(s) unusable (%s) — see: codex-accounts expired\n' \
+        "${#expired[@]}" "${ids# }" >&2
+    fi
+  fi
+fi
+
+# No usable accounts => stock behavior (fail open, never block work), but say WHY when
+# the pool is merely un-authenticated: this is the one case the user can actually fix.
+if [ "${#valid[@]}" -eq 0 ]; then
+  if [ "${#expired[@]}" -gt 0 ]; then
+    sel_log "all-expired: falling back to the default login (see: codex-accounts expired)"
+    # Terminal only: a service-spawned `codex exec` must keep its stderr byte-clean,
+    # and the fallback may well succeed on the machine's own login.
+    [ -t 2 ] && printf 'codex-multiacc: no pool account is usable (%s) — see: codex-accounts expired, then: codex-accounts relogin\n' \
+      "${ids# }" >&2
+  fi
+  exec "$REAL" "$@"
+fi
+
+# Pick the account with the MOST headroom (lowest ranking score = most weekly headroom,
+# session as tiebreaker). Ties break randomly so equally-idle accounts still spread load.
+# Sets PICK_DIR/PICK_SCORE as globals — it must never touch "$@", which holds the
+# user's codex arguments.
+PICK_DIR=""
+PICK_SCORE=""
+pick_best() { # args: candidate dirs
+  local d v best="" bestv=1000000 ties=1
+  for d in "$@"; do
+    v="$(sel_score_of "$d")"
+    if [ "$v" -lt "$bestv" ]; then
+      bestv="$v"; best="$d"; ties=1
+    elif [ "$v" -eq "$bestv" ]; then
+      ties=$((ties + 1))
+      [ $((RANDOM % ties)) -eq 0 ] && best="$d"   # reservoir-sample among equals
+    fi
+  done
+  PICK_DIR="$best"
+  PICK_SCORE="$bestv"
+}
+
+if [ "${#eligible[@]}" -gt 0 ]; then
+  if [ "${CODEX_SHIM_SELECT:-headroom}" = "random" ]; then
+    PICK_DIR="${eligible[$((RANDOM % ${#eligible[@]}))]}"
+  else
+    pick_best "${eligible[@]}"
+  fi
+else
+  # Every account is limit-marked: degraded service beats a hard failure (100% rule).
+  pick_best "${valid[@]}"
+  sel_log "all-limited fallback=$(basename "$PICK_DIR") weekly=$(fresh_field "$PICK_DIR" weekly_percent || echo '?')%"
+fi
+pick="$PICK_DIR"
+
+# Opportunistic limits refresh: non-blocking, throttled, backgrounded.
+kick="$ACC_ROOT/.limits-kick"
+stale=0
+for d in "${valid[@]}"; do
+  f="$d/limits.json"
+  if [ ! -f "$f" ] || [ $((now - $(file_mtime "$f"))) -gt 180 ]; then stale=1; break; fi
+done
+if [ "$stale" = 1 ] && [ -x "$SELF_DIR/codex-accounts" ]; then
+  last=0
+  [ -f "$kick" ] && last="$(file_mtime "$kick")"
+  if [ $((now - last)) -gt 120 ]; then
+    : > "$kick" 2>/dev/null || true
+    ( "$SELF_DIR/codex-accounts" limits --quiet >/dev/null 2>&1 & ) >/dev/null 2>&1
+  fi
+fi
+
+acct="$(basename "$pick")"
+sel_log "$acct weekly=$(fresh_field "$pick" weekly_percent || echo '?')% session=$(fresh_field "$pick" session_percent || echo '?')% pwd=$PWD"
+
+export CODEX_SHIM_ACTIVE=1
+
+# Auto-retry applies only to `codex exec` runs with an alternative account available,
+# and only when stdin is finite (tty, regular file, or char device like /dev/null).
+# A service-spawned pipe that never EOFs must take the plain exec path, or the
+# stdin pre-buffering below would hang the call.
+wants_retry=0
+if [ "${CODEX_SHIM_RETRY:-1}" != "0" ] && [ "${#eligible[@]}" -ge 2 ]; then
+  for a in "$@"; do
+    case "$a" in exec|e) wants_retry=1; break ;; esac
+  done
+  if [ "$wants_retry" = "1" ]; then
+    # A TTY cannot be buffered or replayed: `codex exec` with no prompt argument reads
+    # stdin, and the retry path would hand it /dev/null. Plain exec instead —
+    # stdin is inherited untouched. A pipe that never EOFs would hang the pre-buffer,
+    # so only finite stdin (regular file, /dev/null-style char device) takes the retry
+    # path; everything else execs directly.
+    if [ -t 0 ]; then
+      wants_retry=0
+    elif [ -f /dev/fd/0 ] || [ -c /dev/fd/0 ]; then
+      :
+    else
+      wants_retry=0
+    fi
+  fi
+fi
+
+if [ "$wants_retry" = "0" ]; then
+  export CODEX_HOME="$pick"
+  exec "$REAL" "$@"
+fi
+
+# Retry path: buffer stdio so a retried call never double-emits partial output.
+mkdir -p "$ACC_ROOT/tmp" 2>/dev/null || true
+tmpd="$(mktemp -d "$ACC_ROOT/tmp/shim.XXXXXX" 2>/dev/null)" || {
+  export CODEX_HOME="$pick"
+  exec "$REAL" "$@"
+}
+trap 'rm -rf "$tmpd"' EXIT
+
+# The output buffers must be writable BEFORE the run: if redirection failed at exec
+# time (disk full), the real binary would never launch and the shim would exit
+# nonzero — a hard failure. Verify now, fall back to plain exec if we cannot.
+if ! : > "$tmpd/out" 2>/dev/null || ! : > "$tmpd/err" 2>/dev/null; then
+  export CODEX_HOME="$pick"
+  exec "$REAL" "$@"
+fi
+
+stdin_file=""
+if [ ! -t 0 ]; then
+  stdin_file="$tmpd/in"
+  # If buffering fails midway (disk full) stdin is already partly consumed and cannot
+  # be rewound — keep whatever landed rather than silently substituting /dev/null.
+  cat > "$stdin_file" 2>/dev/null || [ -s "$stdin_file" ] || stdin_file=""
+fi
+
+# ERRPAT decides whether to RETRY at all (deliberately broad). The two PARK patterns
+# below decide whether the failed account is also taken out of the pool, and they are
+# deliberately NARROW: this grep also sees the model's own answer on stdout (an exec
+# run that merely *discusses* a 401 must not cost an account).
+#   PARK_AUTH  — the credential is dead: a cooldown would just re-fail, so the account
+#                is parked until a re-login / a refresh that works clears it.
+#   PARK_ORG   — a workspace admin turned Codex access off for the account; no
+#                re-login fixes that.
+# Both shim-written parks carry a soft_until stamp, so even a false positive returns to
+# the pool on its own — the shim's guess must never outlive the evidence for it.
+PARK_AUTH='not (logged|signed) in|authentication (required|failed)|please run `?codex login|run `?codex login`? to|401 unauthorized|token .{0,12}(expired|revoked)|refresh token.{0,20}(expired|invalid|revoked)|invalid_grant|could not refresh'
+PARK_ORG='disabled by (your )?(workspace )?admin|admin (has )?disabled|(workspace|organization) has disabled (codex|chatgpt)|codex.{0,20}disabled for (your|this) (workspace|organization)'
+LIMITPAT='rate[ _-]?limit|usage limit|limit (reached|exceeded)|too many requests|"?429"?|quota exceeded|hit your usage limit'
+ERRPAT="$LIMITPAT|$PARK_AUTH|$PARK_ORG"'|401|403|unauthorized|authentication[_ ]error|invalid[_ ](bearer|token|api key)|token (expired|revoked|invalid)|oauth.*(error|expired|invalid)'
+PARK_SOFT_AUTH=3600      # 1h: a mis-parked healthy account is back within the hour
+PARK_SOFT_ORG=21600      # 6h: a workspace policy will not change in minutes
+
+attempt=1
+cur="$pick"
+rc=0
+while :; do
+  if [ -n "$stdin_file" ]; then exec 3< "$stdin_file"; else exec 3< /dev/null; fi
+  CODEX_HOME="$cur" "$REAL" "$@" <&3 > "$tmpd/out" 2> "$tmpd/err"
+  rc=$?
+  exec 3<&-
+  if [ "$rc" -ne 0 ] && [ "$attempt" -eq 1 ] \
+    && grep -qiE "$ERRPAT" "$tmpd/out" "$tmpd/err" 2>/dev/null; then
+    # Atomic marker writes: a reader must never observe a half-written marker
+    # (it would parse as garbage and, before, could be deleted as "expired").
+    # A rate limit wins the classification: a limit message that happens to mention an
+    # auth word must get the self-expiring cooldown, never a park.
+    park_reason=""
+    park_soft=0
+    if grep -qiE "$LIMITPAT" "$tmpd/out" "$tmpd/err" 2>/dev/null; then
+      :
+    elif grep -qiE "$PARK_ORG" "$tmpd/out" "$tmpd/err" 2>/dev/null; then
+      park_reason="org-blocked"
+      park_detail="a workspace admin has disabled Codex access for the account"
+      park_soft=$((now + PARK_SOFT_ORG))
+    elif grep -qiE "$PARK_AUTH" "$tmpd/out" "$tmpd/err" 2>/dev/null; then
+      park_reason="auth-error"
+      park_detail="run failed to authenticate"
+      park_soft=$((now + PARK_SOFT_AUTH))
+    fi
+    if [ -n "$park_reason" ]; then
+      {
+        echo "$now"
+        echo "reason=$park_reason soft_until=$park_soft marked_at=$(date -u +%Y-%m-%dT%H:%M:%SZ) detail=$park_detail"
+      } > "$cur/.expired.$$" 2>/dev/null \
+        && mv -f "$cur/.expired.$$" "$cur/.expired" 2>/dev/null \
+        || rm -f "$cur/.expired.$$" 2>/dev/null || true
+      sel_log "$(basename "$cur") parked ($park_reason until $park_soft) — see: codex-accounts expired"
+    else
+      {
+        echo $((now + 600))
+        echo "bucket=error-cooldown percent=? marked_at=$(date -u +%Y-%m-%dT%H:%M:%SZ) reason=error-cooldown"
+      } > "$cur/.limited.$$" 2>/dev/null \
+        && mv -f "$cur/.limited.$$" "$cur/.limited" 2>/dev/null \
+        || rm -f "$cur/.limited.$$" 2>/dev/null || true
+    fi
+    next=""
+    n="${#eligible[@]}"
+    start=$((RANDOM % n))
+    i=0
+    while [ "$i" -lt "$n" ]; do
+      c="${eligible[$(((start + i) % n))]}"
+      if [ "$c" != "$cur" ]; then next="$c"; break; fi
+      i=$((i+1))
+    done
+    if [ -n "$next" ]; then
+      sel_log "retry from=$(basename "$cur") to=$(basename "$next") rc=$rc"
+      cur="$next"
+      attempt=2
+      continue
+    fi
+  fi
+  break
+done
+
+cat "$tmpd/out"
+cat "$tmpd/err" >&2
+exit "$rc"