claude-multiacc 1.0.7 → 1.0.8

package/install.sh

@@ -11,6 +11,9 @@ set -u
 REPO_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 # shellcheck source=lib/common.sh
 . "$REPO_DIR/lib/common.sh"
+# common.sh is sourced in claude mode (ACC_ROOT = the claude pool); the codex pool
+# root is needed here too for uninstall/purge messaging.
+CODEX_ACC_ROOT="${CODEX_ACCOUNTS_DIR:-$HOME/.codex-accounts}"
 
 MARK_BEGIN="# >>> claude-multiacc >>>"
 MARK_END="# <<< claude-multiacc <<<"
@@ -18,6 +21,8 @@ CRON_TAG="# claude-multiacc"
 PLIST_LIMITS="$HOME/Library/LaunchAgents/com.claude-multiacc.limits.plist"
 PLIST_HEALTH="$HOME/Library/LaunchAgents/com.claude-multiacc.health.plist"
 PLIST_UPDATE="$HOME/Library/LaunchAgents/com.claude-multiacc.update.plist"
+PLIST_CODEX_LIMITS="$HOME/Library/LaunchAgents/com.claude-multiacc.codex-limits.plist"
+PLIST_CODEX_HEALTH="$HOME/Library/LaunchAgents/com.claude-multiacc.codex-health.plist"
 PROFILED="/etc/profile.d/claude-multiacc.sh"
 
 UNINSTALL=0
@@ -122,21 +127,63 @@ EOF
   <key>StandardOutPath</key><string>/dev/null</string>
   <key>StandardErrorPath</key><string>/dev/null</string>
 </dict></plist>
+EOF
+  # Codex pool: its own limits/health agents, so either provider's telemetry can
+  # fail or be removed without touching the other's.
+  cat > "$PLIST_CODEX_LIMITS" <<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>Label</key><string>com.claude-multiacc.codex-limits</string>
+  <key>ProgramArguments</key><array>
+    <string>$REPO_DIR/bin/codex-accounts</string>
+    <string>limits</string>
+    <string>--quiet</string>
+  </array>
+  <key>StartInterval</key><integer>60</integer>
+  <key>RunAtLoad</key><true/>
+  <key>StandardOutPath</key><string>/dev/null</string>
+  <key>StandardErrorPath</key><string>/dev/null</string>
+</dict></plist>
+EOF
+  cat > "$PLIST_CODEX_HEALTH" <<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>Label</key><string>com.claude-multiacc.codex-health</string>
+  <key>ProgramArguments</key><array>
+    <string>$REPO_DIR/bin/codex-accounts</string>
+    <string>health</string>
+  </array>
+  <key>StartCalendarInterval</key><dict>
+    <key>Weekday</key><integer>1</integer>
+    <key>Hour</key><integer>9</integer>
+    <key>Minute</key><integer>37</integer>
+  </dict>
+  <key>StandardOutPath</key><string>/dev/null</string>
+  <key>StandardErrorPath</key><string>/dev/null</string>
+</dict></plist>
 EOF
   launchctl unload "$PLIST_LIMITS" 2>/dev/null || true
   launchctl unload "$PLIST_HEALTH" 2>/dev/null || true
   launchctl unload "$PLIST_UPDATE" 2>/dev/null || true
+  launchctl unload "$PLIST_CODEX_LIMITS" 2>/dev/null || true
+  launchctl unload "$PLIST_CODEX_HEALTH" 2>/dev/null || true
   launchctl load -w "$PLIST_LIMITS" 2>/dev/null || echo "  (launchctl load limits agent failed — limits refresh will rely on the shim's opportunistic kick)"
   launchctl load -w "$PLIST_HEALTH" 2>/dev/null || true
+  launchctl load -w "$PLIST_CODEX_LIMITS" 2>/dev/null || true
+  launchctl load -w "$PLIST_CODEX_HEALTH" 2>/dev/null || true
   [ "${CLAUDE_MULTIACC_AUTOUPDATE:-1}" = "1" ] && launchctl load -w "$PLIST_UPDATE" 2>/dev/null || true
-  echo "  launchd: limits refresh every 60s + weekly health check + weekly auto-update"
+  echo "  launchd: limits refresh every 60s (claude + codex) + weekly health checks + weekly auto-update"
 }
 
 mac_schedule_remove() {
   launchctl unload "$PLIST_LIMITS" 2>/dev/null || true
   launchctl unload "$PLIST_HEALTH" 2>/dev/null || true
   launchctl unload "$PLIST_UPDATE" 2>/dev/null || true
-  rm -f "$PLIST_LIMITS" "$PLIST_HEALTH" "$PLIST_UPDATE"
+  launchctl unload "$PLIST_CODEX_LIMITS" 2>/dev/null || true
+  launchctl unload "$PLIST_CODEX_HEALTH" 2>/dev/null || true
+  rm -f "$PLIST_LIMITS" "$PLIST_HEALTH" "$PLIST_UPDATE" "$PLIST_CODEX_LIMITS" "$PLIST_CODEX_HEALTH"
 }
 
 linux_schedule_install() {
@@ -145,13 +192,15 @@ linux_schedule_install() {
   { crontab -l 2>/dev/null | grep -v "$CRON_TAG" || true; } > "$tmp"
   {
     echo "* * * * * $REPO_DIR/bin/claude-accounts limits --quiet >/dev/null 2>&1 $CRON_TAG"
+    echo "* * * * * $REPO_DIR/bin/codex-accounts limits --quiet >/dev/null 2>&1 $CRON_TAG"
     echo "17 9 * * 1 $REPO_DIR/bin/claude-accounts health >/dev/null 2>&1 $CRON_TAG"
+    echo "37 9 * * 1 $REPO_DIR/bin/codex-accounts health >/dev/null 2>&1 $CRON_TAG"
     [ "${CLAUDE_MULTIACC_AUTOUPDATE:-1}" = "1" ] && \
       echo "7 4 * * 0 $REPO_DIR/bin/claude-accounts self-update --quiet >/dev/null 2>&1 $CRON_TAG"
   } >> "$tmp"
   crontab "$tmp"
   rm -f "$tmp"
-  echo "  cron: limits refresh every 60s + weekly health check + weekly auto-update"
+  echo "  cron: limits refresh every 60s (claude + codex) + weekly health checks + weekly auto-update"
 }
 
 linux_schedule_remove() {
@@ -179,14 +228,22 @@ do_uninstall() {
       rm -f /usr/local/bin/claude
       echo "  removed /usr/local/bin/claude shim symlink"
     fi
+    if [ -L /usr/local/bin/codex ] && [ "$(canon_path /usr/local/bin/codex)" = "$(canon_path "$REPO_DIR/bin/codex")" ]; then
+      rm -f /usr/local/bin/codex
+      echo "  removed /usr/local/bin/codex shim symlink"
+    fi
   fi
-  if [ "$PURGE" = "1" ]; then
-    case "$ACC_ROOT" in
-      */.claude-accounts) rm -rf "$ACC_ROOT"; echo "  purged $ACC_ROOT" ;;
-      *) echo "  refusing to purge unusual ACC_ROOT: $ACC_ROOT" >&2 ;;
-    esac
-  else
-    echo "  account data kept at $ACC_ROOT (use --purge-data to remove)"
+  local root
+  for root in "$ACC_ROOT" "$CODEX_ACC_ROOT"; do
+    if [ "$PURGE" = "1" ]; then
+      case "$root" in
+        */.claude-accounts|*/.codex-accounts) rm -rf "$root"; echo "  purged $root" ;;
+        *) echo "  refusing to purge unusual accounts root: $root" >&2 ;;
+      esac
+    fi
+  done
+  if [ "$PURGE" != "1" ]; then
+    echo "  account data kept at $ACC_ROOT and $CODEX_ACC_ROOT (use --purge-data to remove)"
   fi
   echo "uninstall complete — stock claude behavior restored"
 }
@@ -198,6 +255,8 @@ do_install() {
 
   [ -x "$REPO_DIR/bin/claude" ] || chmod +x "$REPO_DIR/bin/claude" 2>/dev/null || true
   [ -x "$REPO_DIR/bin/claude-accounts" ] || chmod +x "$REPO_DIR/bin/claude-accounts" 2>/dev/null || true
+  [ -x "$REPO_DIR/bin/codex" ] || chmod +x "$REPO_DIR/bin/codex" 2>/dev/null || true
+  [ -x "$REPO_DIR/bin/codex-accounts" ] || chmod +x "$REPO_DIR/bin/codex-accounts" 2>/dev/null || true
 
   local real
   if real="$(find_real_claude "$REPO_DIR/bin/claude")"; then
@@ -205,6 +264,12 @@ do_install() {
   else
     echo "  WARNING: no real claude binary found yet — install Claude Code first (https://claude.com/claude-code)" >&2
   fi
+  local real_codex
+  if real_codex="$(find_real_codex "$REPO_DIR/bin/codex")"; then
+    echo "  real codex binary: $real_codex ($("$real_codex" --version 2>/dev/null | head -1 || echo 'version unknown'))"
+  else
+    echo "  note: no codex binary found — the codex pool stays idle until Codex CLI is installed (npm i -g @openai/codex)"
+  fi
 
   # Keychain-mode detection: per-dir /login isolation needs file-based credentials.
   if [ "$kind" = "mac" ] && [ ! -f "$HOME/.claude/.credentials.json" ] \
@@ -226,6 +291,12 @@ os.replace(sys.argv[1] + '.tmp', sys.argv[1])
 PYEOF
   fi
   echo "  account pool: $ACC_ROOT (manifest ready)"
+  # The codex pool gets its own skeleton + manifest (same schema, separate root).
+  if ! "$REPO_DIR/bin/codex-accounts" init-pool "${SERVER_OVERRIDE:-}" >/dev/null 2>&1; then
+    echo "  WARNING: codex pool init failed (codex-accounts init-pool)" >&2
+  else
+    echo "  codex account pool: $CODEX_ACC_ROOT (manifest ready)"
+  fi
 
   if [ "$kind" = "mac" ]; then
     # .zshenv covers non-interactive zsh; the .zshrc block must be LAST so it wins
@@ -260,14 +331,21 @@ PYEOF
         ln -sfn "$REPO_DIR/bin/claude" /usr/local/bin/claude
         echo "  shim: /usr/local/bin/claude -> $REPO_DIR/bin/claude (systemd-PATH compatible)"
       fi
+      if [ -e /usr/local/bin/codex ] && [ ! -L /usr/local/bin/codex ]; then
+        echo "  WARNING: /usr/local/bin/codex exists and is a real file — NOT overwriting." >&2
+      else
+        ln -sfn "$REPO_DIR/bin/codex" /usr/local/bin/codex
+        echo "  shim: /usr/local/bin/codex -> $REPO_DIR/bin/codex (systemd-PATH compatible)"
+      fi
     fi
     [ "$NO_SCHEDULE" = "1" ] || linux_schedule_install
   fi
 
   echo
   echo "install complete. Open a new shell (or 'export PATH=\"$REPO_DIR/bin:\$PATH\"'), then:"
-  echo "  claude-accounts list      # see the pool"
-  echo "  claude-accounts status    # auth + limits detail"
+  echo "  claude-accounts list      # the Claude Code pool"
+  echo "  codex-accounts list       # the Codex pool"
+  echo "  claude-accounts status | codex-accounts status    # auth + limits detail"
 }
 
 if [ "$UNINSTALL" = "1" ]; then

package/lib/codex_audit.py

@@ -0,0 +1,238 @@
+"""Shared codex account-auth audit — the ONE place that decides whether a codex
+account's login still works, so `expired`, `relogin`, `list` and `status` can never
+disagree with the shim's selection rule (bin/codex: expired_marked / auth_dead).
+
+Codex auth material is a single $CODEX_HOME/auth.json written by `codex login`:
+  {"auth_mode": "chatgpt", "OPENAI_API_KEY": null,
+   "tokens": {"id_token": JWT, "access_token": JWT, "refresh_token": str,
+              "account_id": str},
+   "last_refresh": ISO}
+The access token is a JWT whose `exp` claim is readable offline; the refresh token
+is opaque (no readable expiry), so a dead refresh grant is only ever known from a
+marker written by a failed refresh/verify — exactly like the shim assumes.
+
+States:
+  ok       usable right now (live access token, or expired-but-refreshable)
+  expired  has auth material that CANNOT authenticate — needs `codex-accounts relogin`
+  blocked  authenticates, but Codex access is disabled for it by a workspace admin —
+           a re-login usually re-issues the grant; if it stays blocked, an admin must act
+  missing  no auth on this machine, and this machine is supposed to own the grant
+  remote   no auth here, but the manifest says another machine owns it (informational)
+
+Only 'ok' accounts are selectable; everything else is excluded by the shim.
+
+Run directly for a TSV dump:  python3 lib/codex_audit.py <acc-root> [mac|linux]
+Columns: id, email, home, state, label, reason, fix
+"""
+
+import base64
+import json
+import os
+import re
+import sys
+import time
+
+VALID_ID = re.compile(r'acct-\d{2}')
+
+
+def _mtime(path):
+    try:
+        return os.path.getmtime(path)
+    except OSError:
+        return 0.0
+
+
+def _nonempty(path):
+    try:
+        return os.path.getsize(path) > 0
+    except OSError:
+        return False
+
+
+def marker_reason(mpath):
+    """Second line of a marker file, as a human string ('' when absent/unreadable)."""
+    try:
+        lines = open(mpath, errors='replace').read().splitlines()
+    except OSError:
+        return ''
+    return lines[1].strip() if len(lines) > 1 else ''
+
+
+def marker_slug(detail):
+    """The reason=<slug> field of a marker line ('' when absent)."""
+    m = re.search(r'reason=([A-Za-z0-9._-]+)', detail or '')
+    return m.group(1) if m else ''
+
+
+def expired_marked(d, now=None):
+    """True when <d>/.expired is still in force. Mirrors the shim exactly:
+    a CREDENTIAL-scoped park clears as soon as a newer auth.json lands (re-login, or a
+    refresh by another process); a POLICY park (org-blocked) does not, because a token
+    refresh says nothing about whether the workspace re-enabled Codex. Either kind also
+    expires at its own soft_until when the shim wrote it from a single failed run."""
+    now = time.time() if now is None else now
+    mpath = os.path.join(d, '.expired')
+    if not os.path.isfile(mpath):
+        return False
+    detail = marker_reason(mpath)
+    if marker_slug(detail) != 'org-blocked':
+        mt = _mtime(mpath)
+        p = os.path.join(d, 'auth.json')
+        if os.path.isfile(p) and _mtime(p) > mt:
+            return False
+    m = re.search(r'soft_until=(\d+)', detail)
+    if m and int(m.group(1)) <= now:
+        return False
+    return True
+
+
+def jwt_claims(token):
+    """Decode a JWT payload without verification (identity/expiry live client-side
+    anyway). Returns {} for anything that is not a well-formed JWT."""
+    try:
+        payload = str(token).split('.')[1]
+        payload += '=' * (-len(payload) % 4)
+        claims = json.loads(base64.urlsafe_b64decode(payload))
+        return claims if isinstance(claims, dict) else {}
+    except Exception:
+        return {}
+
+
+def auth_email(cpath):
+    """The signed-in identity, read offline from the id_token ('' when unknown)."""
+    try:
+        doc = json.load(open(cpath))
+        tokens = doc.get('tokens') or {}
+        return str(jwt_claims(tokens.get('id_token')).get('email') or '')
+    except Exception:
+        return ''
+
+
+def creds_state(cpath, now):
+    """(state, reason) for an on-disk auth.json."""
+    try:
+        doc = json.load(open(cpath))
+        if not isinstance(doc, dict):
+            raise ValueError('auth.json is not an object')
+    except Exception as e:
+        # Unparseable (truncated / mid-write): the shim still selects this account
+        # (it only checks for a non-empty access_token string), so fall back to the
+        # same lenient rule — a scrape-able access token keeps it in the pool.
+        try:
+            txt = open(cpath, errors='replace').read()
+        except OSError:
+            return 'expired', f'auth.json unreadable ({str(e)[:60]})'
+        if re.search(r'"access_token"\s*:\s*"[^"]', txt):
+            return 'ok', 'auth.json unreadable but carries a token — left in the pool'
+        return 'expired', f'auth.json unreadable ({str(e)[:60]})'
+    tokens = doc.get('tokens')
+    if not isinstance(tokens, dict) or not tokens.get('access_token'):
+        if doc.get('OPENAI_API_KEY'):
+            # Subscription-only by design (same rule as the claude pool: no API keys).
+            return 'expired', ('signed in with an API key — not supported; '
+                               'use the ChatGPT subscription login')
+        return 'expired', 'auth.json has no ChatGPT tokens'
+    exp = jwt_claims(tokens['access_token']).get('exp')
+    try:
+        exp = float(exp)
+    except (TypeError, ValueError):
+        exp = 0.0
+    if exp > now:
+        return 'ok', 'chatgpt access token valid'
+    if not tokens.get('refresh_token'):
+        return 'expired', 'access token expired and there is no refresh token'
+    # The refresh token is opaque (no readable expiry): assume refreshable. A dead
+    # grant is detected by the limits refresher / verify, which write `.expired`.
+    return 'ok', 'access token stale but auto-refreshes'
+
+
+LABELS = {'ok': 'OK', 'expired': 'EXPIRED', 'blocked': 'BLOCKED',
+          'missing': 'NO LOGIN', 'remote': 'ELSEWHERE'}
+
+# `import --home` speaks mac|server; machine_kind() speaks mac|linux. Same two boxes,
+# two vocabularies — normalize, or an un-authenticated account on the very machine that
+# owns it would be filed as "lives elsewhere" and silently drop off the worklist.
+_MACHINE_ALIASES = {'mac': 'mac', 'macos': 'mac', 'darwin': 'mac', 'osx': 'mac',
+                    'server': 'linux', 'linux': 'linux', 'ubuntu': 'linux',
+                    'debian': 'linux', 'remote': 'linux'}
+
+
+def _norm_machine(name):
+    return _MACHINE_ALIASES.get(str(name or '').strip().lower(), '')
+
+
+def _elsewhere(home, machine):
+    """True only when the manifest names a DIFFERENT machine as the grant's owner.
+    An unknown/blank home is never treated as 'elsewhere' — that would hide a real gap."""
+    h, m = _norm_machine(home), _norm_machine(machine)
+    return bool(h) and bool(m) and h != m
+
+
+def _fix_for(state, aid):
+    if state == 'blocked':
+        return (f'codex-accounts relogin {aid}   '
+                f'(if it stays BLOCKED, a workspace admin must enable Codex for it)')
+    if state in ('expired', 'missing'):
+        return f'codex-accounts relogin {aid}'
+    return ''
+
+
+def audit_account(root, acct, now=None, machine=None):
+    now = time.time() if now is None else now
+    aid = acct.get('id', '')
+    d = os.path.join(root, aid)
+    cpath = os.path.join(d, 'auth.json')
+    has_creds = _nonempty(cpath)
+    home = acct.get('home', '?')
+    row = {'id': aid, 'email': acct.get('email', ''), 'home': home,
+           'state': 'ok', 'reason': ''}
+
+    def done(r):
+        r['label'] = LABELS.get(r['state'], r['state'].upper())
+        r['fix'] = _fix_for(r['state'], aid)
+        return r
+
+    if expired_marked(d, now=now):
+        detail = marker_reason(os.path.join(d, '.expired'))
+        slug = marker_slug(detail)
+        if slug == 'org-blocked':
+            row['state'] = 'blocked'
+            row['reason'] = ('Codex access is disabled for this account by a '
+                             'workspace admin')
+        else:
+            row['state'] = 'expired'
+            row['reason'] = f'marked dead by the pool ({detail or "authentication failed"})'
+        return done(row)
+    if has_creds:
+        state, reason = creds_state(cpath, now)
+        row['state'] = state
+        row['reason'] = reason
+        return done(row)
+    if machine and _elsewhere(home, machine):
+        row['state'] = 'remote'
+        row['reason'] = f'no auth here — the grant lives on the {home} machine'
+    else:
+        row['state'] = 'missing'
+        row['reason'] = 'no credentials on this machine'
+    return done(row)
+
+
+def audit_all(root, machine=None, now=None):
+    try:
+        doc = json.load(open(os.path.join(root, 'accounts.json')))
+    except Exception:
+        return []
+    out = []
+    for a in doc.get('accounts', []):
+        if isinstance(a, dict) and VALID_ID.fullmatch(str(a.get('id', ''))):
+            out.append(audit_account(root, a, now=now, machine=machine))
+    return out
+
+
+if __name__ == '__main__':
+    root = sys.argv[1]
+    machine = sys.argv[2] if len(sys.argv) > 2 else None
+    for r in audit_all(root, machine=machine):
+        # Tabs are the field separator, so no field may contain one.
+        print('\t'.join(str(r[k]).replace('\t', ' ')
+                        for k in ('id', 'email', 'home', 'state', 'label', 'reason', 'fix')))

package/lib/common.sh

@@ -1,18 +1,37 @@
 #!/usr/bin/env bash
 # lib/common.sh — claude-multiacc shared helpers.
-# Sourced by bin/claude-accounts and install.sh. Bash 3.2 compatible (macOS stock).
+# Sourced by bin/claude-accounts, bin/codex-accounts and install.sh.
+# Bash 3.2 compatible (macOS stock).
+#
+# PROVIDER SUPPORT: the same pool machinery serves two independent providers —
+# claude (Claude Code, the default) and codex (OpenAI Codex CLI). A caller opts
+# into codex by exporting MULTIACC_PROVIDER=codex BEFORE sourcing this file; every
+# path/endpoint global below then points at the codex pool. The two pools are
+# completely separate on disk (~/.claude-accounts vs ~/.codex-accounts), so
+# nothing an operation does on one provider can ever touch the other's accounts.
 # shellcheck disable=SC2034
 
-ACC_ROOT="${CLAUDE_ACCOUNTS_DIR:-$HOME/.claude-accounts}"
-MANIFEST="$ACC_ROOT/accounts.json"
+MULTIACC_PROVIDER="${MULTIACC_PROVIDER:-claude}"
 PYBIN="${CLAUDE_MULTIACC_PYTHON:-python3}"
 DEFAULT_SERVER="root@138.197.36.107"
-DEFAULT_SERVER_ROOT="/root/.claude-accounts"
 DEFAULT_SERVER_REPO="/root/claude-multiacc"
-USAGE_URL="${CLAUDE_MULTIACC_USAGE_URL:-https://api.anthropic.com/api/oauth/usage}"
 
 LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd -P)"
-AUDIT_PY="$LIB_DIR/audit.py"
+
+if [ "$MULTIACC_PROVIDER" = "codex" ]; then
+  ACC_ROOT="${CODEX_ACCOUNTS_DIR:-$HOME/.codex-accounts}"
+  DEFAULT_SERVER_ROOT="/root/.codex-accounts"
+  USAGE_URL="${CODEX_MULTIACC_USAGE_URL:-https://chatgpt.com/backend-api/codex/usage}"
+  AUDIT_PY="$LIB_DIR/codex_audit.py"
+  PROVIDER_CLI="codex-accounts"
+else
+  ACC_ROOT="${CLAUDE_ACCOUNTS_DIR:-$HOME/.claude-accounts}"
+  DEFAULT_SERVER_ROOT="/root/.claude-accounts"
+  USAGE_URL="${CLAUDE_MULTIACC_USAGE_URL:-https://api.anthropic.com/api/oauth/usage}"
+  AUDIT_PY="$LIB_DIR/audit.py"
+  PROVIDER_CLI="claude-accounts"
+fi
+MANIFEST="$ACC_ROOT/accounts.json"
 
 ts_utc() { date -u +%Y-%m-%dT%H:%M:%SZ; }
 epoch_now() { date +%s; }
@@ -23,8 +42,8 @@ log_to() { # log_to <file-in-acc-root> <msg...>
   printf '%s %s\n' "$(ts_utc)" "$*" >> "$ACC_ROOT/$f" 2>/dev/null || true
 }
 
-die() { printf 'claude-accounts: error: %s\n' "$*" >&2; exit 1; }
-warn() { printf 'claude-accounts: warning: %s\n' "$*" >&2; }
+die() { printf '%s: error: %s\n' "$PROVIDER_CLI" "$*" >&2; exit 1; }
+warn() { printf '%s: warning: %s\n' "$PROVIDER_CLI" "$*" >&2; }
 
 machine_kind() { case "$(uname -s)" in Darwin) echo mac ;; *) echo linux ;; esac; }
 
@@ -47,14 +66,16 @@ canon_path() { # resolve symlinks (loop-guarded) and normalize; always prints so
   if [ "$d" = "/" ]; then printf '/%s\n' "$b"; else printf '%s/%s\n' "$d" "$b"; fi
 }
 
-is_shim_file() { head -c 300 "$1" 2>/dev/null | grep -q claude-multiacc-shim; }
+# Matches both shims: bin/claude ("claude-multiacc-shim") and bin/codex
+# ("codex-multiacc-shim") — find_real_bin must skip either, whatever it scans for.
+is_shim_file() { head -c 300 "$1" 2>/dev/null | grep -q multiacc-shim; }
 
-# Prints an INVOCABLE path to the real claude binary (kept as the symlink path,
+# Prints an INVOCABLE path to the real <name> binary (kept as the symlink path,
 # not the canonical target, so process cmdlines keep matching monitors like
-# `pgrep -f '.local/bin/claude'`). $1 = path of the caller to exclude (optional).
-find_real_claude() {
-  local self_c cand c d
-  self_c="$(canon_path "${1:-${BASH_SOURCE[0]}}")"
+# `pgrep -f '.local/bin/claude'`). $1 = binary name, $2 = caller path to exclude.
+find_real_bin() {
+  local name="$1" self_c cand c d
+  self_c="$(canon_path "${2:-${BASH_SOURCE[0]}}")"
   local oldifs="$IFS"
   IFS=':'; set -f
   # shellcheck disable=SC2086
@@ -62,7 +83,7 @@ find_real_claude() {
   IFS="$oldifs"; set +f
   for d in "$@"; do
     [ -n "$d" ] || continue
-    cand="$d/claude"
+    cand="$d/$name"
     [ -f "$cand" ] && [ -x "$cand" ] || continue
     c="$(canon_path "$cand")"
     [ "$c" = "$self_c" ] && continue
@@ -70,7 +91,7 @@ find_real_claude() {
     is_shim_file "$c" && continue
     printf '%s\n' "$cand"; return 0
   done
-  for cand in "$HOME/.local/bin/claude" /usr/local/bin/claude /opt/homebrew/bin/claude /usr/bin/claude; do
+  for cand in "$HOME/.local/bin/$name" "/usr/local/bin/$name" "/opt/homebrew/bin/$name" "/usr/bin/$name"; do
     [ -f "$cand" ] && [ -x "$cand" ] || continue
     c="$(canon_path "$cand")"
     [ "$c" = "$self_c" ] && continue
@@ -80,6 +101,9 @@ find_real_claude() {
   return 1
 }
 
+find_real_claude() { find_real_bin claude "${1:-}"; }
+find_real_codex() { find_real_bin codex "${1:-}"; }
+
 manifest_get() { # manifest_get <dot.path> [default]
   local val
   if [ -f "$MANIFEST" ]; then
@@ -136,7 +160,11 @@ valid_ssh_target() {
 acct_dir() { printf '%s/%s\n' "$ACC_ROOT" "$1"; }
 
 has_local_auth() { # $1 = acct dir
-  [ -f "$1/.credentials.json" ] || [ -s "$1/server.token" ]
+  if [ "$MULTIACC_PROVIDER" = "codex" ]; then
+    [ -s "$1/auth.json" ]
+  else
+    [ -f "$1/.credentials.json" ] || [ -s "$1/server.token" ]
+  fi
 }
 
 # ---- expired-login bookkeeping -------------------------------------------------
@@ -173,7 +201,7 @@ account_audit() {
   out="$("$PYBIN" "$AUDIT_PY" "$ACC_ROOT" "$(machine_kind)" 2>"$err")"
   rc=$?
   if [ "$rc" -ne 0 ]; then
-    printf 'claude-accounts: cannot audit accounts (%s)\n' "$(tail -1 "$err" 2>/dev/null)" >&2
+    printf '%s: cannot audit accounts (%s)\n' "$PROVIDER_CLI" "$(tail -1 "$err" 2>/dev/null)" >&2
     rm -f "$err" 2>/dev/null
     return 1
   fi
@@ -196,10 +224,13 @@ accounts_needing_login() {
     | awk -F'\t' 'NF >= 4 && $1 != "" && ($4 == "expired" || $4 == "blocked" || $4 == "missing") { print $1 }'
 }
 
-# True when <acct dir>'s credential can authenticate right now (audit.py's rule).
+# True when <acct dir>'s credential can authenticate right now (the audit module's
+# rule — audit.py for claude, codex_audit.py for codex; both expose creds_state).
 creds_alive() { # $1 = acct dir
-  [ -s "$1/.credentials.json" ] || return 1
-  "$PYBIN" - "$AUDIT_PY" "$1/.credentials.json" <<'PYEOF' 2>/dev/null
+  local cred
+  if [ "$MULTIACC_PROVIDER" = "codex" ]; then cred="$1/auth.json"; else cred="$1/.credentials.json"; fi
+  [ -s "$cred" ] || return 1
+  "$PYBIN" - "$AUDIT_PY" "$cred" <<'PYEOF' 2>/dev/null
 import importlib.util, sys, time
 spec = importlib.util.spec_from_file_location('audit', sys.argv[1])
 mod = importlib.util.module_from_spec(spec)
@@ -230,13 +261,28 @@ os.replace(sys.argv[1] + '.tmp', sys.argv[1])
 PYEOF
 }
 
-# Seed an account config dir so headless runs never prompt: stripped .claude.json,
-# copied settings.json, shared projects/ symlink (shared history => --continue/--resume
-# work regardless of which account was picked).
+# Seed an account config dir so headless runs never prompt.
+#   claude: stripped .claude.json, copied settings.json, shared projects/ symlink
+#           (shared history => --continue/--resume work regardless of picked account).
+#   codex:  copied config.toml (carries project trust + settings, no identity),
+#           shared sessions/ symlink (=> `codex resume` finds every session), and a
+#           shared AGENTS.md symlink so global instructions apply under any account.
 seed_account_dir() { # $1 = acct dir
   local d="$1"
   mkdir -p "$d"
   chmod 700 "$d"
+  if [ "$MULTIACC_PROVIDER" = "codex" ]; then
+    if [ ! -f "$d/config.toml" ] && [ -f "$HOME/.codex/config.toml" ]; then
+      cp "$HOME/.codex/config.toml" "$d/config.toml" 2>/dev/null || true
+    fi
+    if [ ! -e "$d/sessions" ] && [ -d "$HOME/.codex/sessions" ]; then
+      ln -s "$HOME/.codex/sessions" "$d/sessions" 2>/dev/null || true
+    fi
+    if [ ! -e "$d/AGENTS.md" ] && [ -f "$HOME/.codex/AGENTS.md" ]; then
+      ln -s "$HOME/.codex/AGENTS.md" "$d/AGENTS.md" 2>/dev/null || true
+    fi
+    return 0
+  fi
   if [ ! -f "$d/.claude.json" ] && [ -f "$HOME/.claude.json" ]; then
     "$PYBIN" - "$HOME/.claude.json" "$d/.claude.json" <<'PYEOF' 2>/dev/null || true
 import json, sys

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "claude-multiacc",
-  "version": "1.0.7",
-  "description": "Multi-account addon for Claude Code: every claude / claude -p runs under a randomly-picked subscription account with the most usage headroom. Mirrors to a deploy server. No API keys.",
+  "version": "1.0.8",
+  "description": "Multi-account addon for Claude Code and OpenAI Codex CLI: every claude / claude -p and every codex / codex exec runs under a randomly-picked subscription account with the most usage headroom. Mirrors to a deploy server. No API keys.",
   "type": "module",
   "bin": {
     "claude-multiacc": "bin/cli.mjs"
@@ -18,6 +18,10 @@
   "keywords": [
     "claude",
     "claude-code",
+    "codex",
+    "codex-cli",
+    "openai",
+    "chatgpt",
     "anthropic",
     "multi-account",
     "subscription",