claude-multiacc 1.0.9 → 1.0.11

package/README.md

@@ -217,8 +217,9 @@ claude-multiacc list | status | add <email> | ...   # passthrough to claude-acco
 
 **Automatic updates:** a globally-installed package re-runs `install.sh` from its own
 postinstall, so `npm i -g claude-multiacc@latest` fully updates the shim, CLI, and jobs.
-A weekly job (launchd on macOS, cron on Linux) runs `claude-accounts self-update` to pull
-the latest npm release on its own; set `CLAUDE_MULTIACC_AUTOUPDATE=0` before install to
+A daily job (launchd on macOS, cron on Linux, 04:07) runs `claude-accounts self-update`
+to pull the latest release on its own — `npm i -g @latest` for npm installs, `git pull +
+reinstall` for git checkouts; set `CLAUDE_MULTIACC_AUTOUPDATE=0` before install to
 opt out. `update-notifier` also prints a one-line nudge when a newer version is on npm.
 (Note: newer npm versions gate install scripts; if postinstall is blocked, just run
 `claude-multiacc install` once.)
@@ -239,16 +240,25 @@ git pull && ./install.sh                                  # update (data untouch
 
 `self-update` auto-detects which of these you used (npm global vs git checkout).
 
+**Servers / machines without repo access:** install via **npm** — the registry is
+public, so the daily self-update needs no credentials at all (no rsync, no keys).
+A git checkout self-updates too, but only if `git pull` can authenticate; for a
+private repo on a server that means a read-only deploy key (the 138 server runs
+this way: `core.sshCommand` pinned to its deploy key). A plain copied tree is the
+one layout that can NOT self-update — don't ship the addon that way.
+
 What install does (all reversible, nothing else):
 
 - **macOS:** marked PATH block at the END of `~/.zshenv`, `~/.zprofile`, `~/.zshrc`
   (+ bash rc files if present) — end-of-file placement matters because those files
-  re-prepend `~/.local/bin`; launchd agents `com.claude-multiacc.limits` (60s) and
-  `.health` (weekly Mon 09:17). Warns if this Mac stores credentials in the Keychain
+  re-prepend `~/.local/bin`; launchd agents `com.claude-multiacc.limits` +
+  `.codex-limits` (60s), `.health` + `.codex-health` (weekly Mon morning), and
+  `.update` (daily 04:07). Warns if this Mac stores credentials in the Keychain
   (file-based credentials are required for per-dir logins).
 - **Linux (root):** PATH block in `~/.bashrc` + `/etc/profile.d/claude-multiacc.sh`,
-  shim symlink at `/usr/local/bin/claude` (shadows via PATH order — on the systemd
-  default PATH too; the original binary is untouched), cron entries for limits/health.
+  shim symlinks at `/usr/local/bin/claude` and `/usr/local/bin/codex` (shadow via
+  PATH order — on the systemd default PATH too; the original binaries are untouched),
+  cron entries for limits/health (both providers) + the daily auto-update.
 - Both: `~/.claude-accounts/` skeleton + `accounts.json` manifest.
 
 ## Accounts
@@ -348,21 +358,39 @@ login, so each runs on the machine that holds its credential.
 claude-accounts remove acct-NN          # deletes locally, propagates to the server
 ```
 
-## Server sync
+## Sync (multi-machine)
 
-Mac → server, one-way (Mac = source of truth), fired automatically by
-`add`/`import`/`remove`/`mint` and manually via:
+One machine is the **source of truth**; every other machine is a **target**. Sync is
+one-way, fired automatically by `add`/`import`/`remove`/`mint` on the source and
+manually via:
 
 ```bash
-claude-accounts sync
+claude-accounts sync      # and codex-accounts sync for the codex pool
+```
+
+Targets are the manifest's `server`/`server_root`/`server_repo` (the Linux box) plus
+an optional `peers` array for additional machines (e.g. a second Mac):
+
+```json
+"peers": [{"target": "gas@gas-mini", "root": "/Users/gas/.claude-accounts",
+           "repo": "/Users/gas/claude-multiacc"}]
 ```
 
-Pushes the manifest + per-account `server.token` (0600) + one-time seeds; **never**
-syncs `.credentials.json` in either direction (two machines refreshing one OAuth grant
-invalidate each other). Removals propagate; an empty/corrupt manifest refuses to sync
-(guard against wiping the server pool). After every push the server re-seeds dirs and
-re-runs its quick verification matrix (`post-sync` hook). Everything logs to `sync.log`;
-failures are loud and non-zero.
+Every target gets the manifest + per-account `server.token` (0600, claude pool) +
+one-time seeds + advisory limit state; **never** `.credentials.json` or codex
+`auth.json` in either direction (their refresh tokens rotate — two machines
+refreshing one grant invalidate each other; codex accounts are signed in per
+machine with the device-code flow instead). Removals propagate to every target; an
+empty/corrupt manifest — or one with an invalid target/peer shape — refuses to sync
+before anything is pushed anywhere. After every push each target re-seeds dirs and
+re-runs its quick verification matrix (`post-sync` hook). Everything logs to
+`sync.log`; failures are loud and non-zero.
+
+A target machine's pool carries a `sync-role` file containing `replica`: such a pool
+**never pushes** (manually or via auto-sync) — the source machine owns the account
+set, which is what prevents two machines from overwriting each other's manifests.
+Make account changes on the source; sign-ins (`login`/`relogin`) still happen on
+whichever machine needs the credential.
 
 ## Pinning & env switches
 

package/bin/claude-accounts

@@ -56,7 +56,10 @@ USAGE
                                             (same email), keeping one per email
   claude-accounts mint <acct-NN>            mint server token via `claude setup-token`
       --paste               paste an already-minted token instead of running setup-token
-  claude-accounts sync                      push manifest+tokens to the server (Mac only)
+  claude-accounts sync                      push manifest+tokens to the server AND any
+                                            manifest 'peers' (extra machines). Mac only.
+                                            A pool with a 'sync-role' file saying
+                                            'replica' never pushes (it receives).
   claude-accounts verify [--quick]          auth matrix; full mode runs `-p "reply OK"` per account
   claude-accounts limits [--quiet] [--force]
       refresh usage buckets, apply >=90% markers. Auto-refreshes long-expired
@@ -142,6 +145,9 @@ PYEOF
 auto_sync() { # best effort after mutations, Mac only, loud on failure
   [ "$(machine_kind)" = "mac" ] || return 0
   [ "${CLAUDE_MULTIACC_NO_SYNC:-0}" = "1" ] && return 0
+  # A replica pool never pushes (the source machine owns the account set) —
+  # silently, so every mutation on a replica does not nag about it.
+  sync_is_replica && return 0
   # subshell: cmd_sync exits on failure and must not take the CLI down with it
   ( cmd_sync ) || warn "server sync failed — run 'claude-accounts sync' manually"
 }
@@ -1496,71 +1502,43 @@ sys.exit(1 if failures else 0)
 PYEOF
 }
 
-cmd_sync() {
-  require_manifest
-  [ "$(machine_kind)" = "mac" ] || die "sync runs on the Mac (source of truth), not the server"
-  local allow_empty=0
-  [ "${1:-}" = "--allow-empty" ] && allow_empty=1
-  local server sroot srepo rc=0
-  server="$(manifest_get server "$DEFAULT_SERVER")"
-  sroot="$(manifest_get server_root "$DEFAULT_SERVER_ROOT")"
-  srepo="$(manifest_get server_repo "$DEFAULT_SERVER_REPO")"
-  # These land inside a remote shell command — anything but a plain target/path is a
-  # command-injection vector from a corrupted or hand-edited manifest.
-  valid_ssh_target "$server" || die "manifest 'server' is not a plain user@host: $server"
-  valid_remote_path "$sroot" || die "manifest 'server_root' is not a plain absolute path: $sroot"
-  valid_remote_path "$srepo" || die "manifest 'server_repo' is not a plain absolute path: $srepo"
-  rotate_log sync.log
-  slog() { log_to sync.log "$*"; }
-  fail() { slog "FAIL: $*"; printf 'claude-accounts sync: FAILED: %s\n' "$*" >&2; exit 1; }
-  slog "sync start -> $server:$sroot"
-
-  # Hard validation before anything destructive: a corrupt or accountless manifest must
-  # never be pushed (it would blank the server's pool), and must never make the removal
-  # loop below wipe the server's credentials. Emptying the pool on purpose is possible
-  # via `sync --allow-empty`, so this can never happen by accident.
-  "$PYBIN" - "$MANIFEST" <<'PYEOF' 2>/dev/null || fail "manifest is not valid JSON or has no well-formed accounts — refusing to sync"
-import json, re, sys
-doc = json.load(open(sys.argv[1]))
-accounts = doc.get('accounts')
-if not isinstance(accounts, list):
-    sys.exit(1)
-for a in accounts:
-    if not isinstance(a, dict) or not re.fullmatch(r'acct-\d{2}', str(a.get('id', ''))) \
-       or not str(a.get('email', '')).strip():
-        sys.exit(1)
-PYEOF
-  if [ -z "$(account_ids)" ] && [ "$allow_empty" != "1" ]; then
-    fail "manifest has zero accounts — refusing to blank the server pool (use 'sync --allow-empty' if that is really intended)"
-  fi
+# Push the pool to ONE remote target. $1 = user@host, $2 = remote pool root,
+# $3 = remote addon repo (for the post-sync hook). Uses the caller's slog/fail.
+# A target can be the Linux server (token-authenticated) or a peer Mac (which has
+# its own machine-local OAuth logins) — the pushed material is valid on both:
+# manifest, portable server.token files, seeds, and advisory limit state.
+# Credentials (.credentials.json) are NEVER pushed anywhere.
+sync_push_target() {
+  local server="$1" sroot="$2" srepo="$3"
+  slog "push -> $server:$sroot"
 
   ssh -o BatchMode=yes -o ConnectTimeout=10 "$server" "mkdir -p '$sroot'" >>"$ACC_ROOT/sync.log" 2>&1 \
     || fail "cannot reach $server"
   rsync -az "$MANIFEST" "$server:$sroot/accounts.json" >>"$ACC_ROOT/sync.log" 2>&1 \
-    || fail "manifest push failed"
+    || fail "manifest push to $server failed"
 
   local id d
   for id in $(account_ids); do
     d="$ACC_ROOT/$id"
     [ -d "$d" ] || continue
     ssh -o BatchMode=yes "$server" "mkdir -p '$sroot/$id'" >>"$ACC_ROOT/sync.log" 2>&1 \
-      || fail "mkdir $id failed"
+      || fail "mkdir $id on $server failed"
     if [ -s "$d/server.token" ]; then
       # NB: no --chmod — macOS 26 ships openrsync, which rejects it (the push would
       # fail outright). The mode is fixed with an explicit remote chmod instead.
       rsync -az "$d/server.token" "$server:$sroot/$id/" >>"$ACC_ROOT/sync.log" 2>&1 \
-        || fail "token push for $id failed"
+        || fail "token push for $id to $server failed"
       ssh -o BatchMode=yes "$server" "chmod 600 '$sroot/$id/server.token'" \
-        >>"$ACC_ROOT/sync.log" 2>&1 || fail "token chmod for $id failed"
+        >>"$ACC_ROOT/sync.log" 2>&1 || fail "token chmod for $id on $server failed"
     fi
     local seed
     for seed in .claude.json settings.json; do
       if [ -f "$d/$seed" ]; then
         rsync -az --ignore-existing "$d/$seed" "$server:$sroot/$id/" >>"$ACC_ROOT/sync.log" 2>&1 \
-          || fail "seed push for $id/$seed failed"
+          || fail "seed push for $id/$seed to $server failed"
       fi
     done
-    # Advisory limit state for accounts the server may lack a bearer for.
+    # Advisory limit state for accounts the target may lack a bearer for.
     local extra
     for extra in limits.json .limited; do
       if [ -f "$d/$extra" ]; then
@@ -1569,9 +1547,9 @@ PYEOF
     done
   done
 
-  # Removal propagation: any server acct dir not in the manifest gets deleted.
+  # Removal propagation: any target acct dir not in the manifest gets deleted.
   # Safety: an EMPTY id list (parse error, or a truly emptied pool) never deletes —
-  # wiping every server credential must be an explicit manual act, not a side effect.
+  # wiping every target credential must be an explicit manual act, not a side effect.
   local ids_list ids_spaced
   ids_list="$(account_ids)"
   if [ -z "$ids_list" ]; then
@@ -1585,16 +1563,124 @@ for dd in acct-*; do
     *\" \$dd \"*) ;;
     *) rm -rf -- \"\$dd\" ;;
   esac
-done" >>"$ACC_ROOT/sync.log" 2>&1 || fail "removal propagation failed"
+done" >>"$ACC_ROOT/sync.log" 2>&1 || fail "removal propagation on $server failed"
   fi
 
-  # Post-sync hook: server seeds dirs and re-runs its quick verification matrix.
+  # Post-sync hook: the target seeds dirs and re-runs its quick verification matrix.
+  # Non-fatal: a hook that is absent (not bootstrapped) or exits nonzero (accounts
+  # awaiting a login THERE) must not fail the push that just succeeded.
   ssh -o BatchMode=yes "$server" "[ -x '$srepo/bin/claude-accounts' ] && '$srepo/bin/claude-accounts' post-sync" \
-    >>"$ACC_ROOT/sync.log" 2>&1 || slog "post-sync hook not available yet (server not bootstrapped?)"
+    >>"$ACC_ROOT/sync.log" 2>&1 || slog "post-sync hook on $server unavailable or unhappy (see its pool state)"
+}
+
+# Prints manifest peers (extra sync targets, e.g. a second Mac), one per line:
+# target<TAB>root<TAB>repo. Empty output = no peers.
+manifest_peers() {
+  [ -f "$MANIFEST" ] || return 0
+  "$PYBIN" - "$MANIFEST" <<'PYEOF' 2>/dev/null
+import json, sys
+peers = json.load(open(sys.argv[1])).get('peers')
+if peers is None:
+    sys.exit(0)
+if not isinstance(peers, list):
+    print('MALFORMED\t\t')
+    sys.exit(0)
+for p in peers:
+    if not isinstance(p, dict):
+        print('MALFORMED\t\t')
+        continue
+    print('%s\t%s\t%s' % (p.get('target', ''), p.get('root', ''), p.get('repo', '')))
+PYEOF
+}
+
+# True when this pool is a sync REPLICA: it receives pushes from the source
+# machine and must never push back (two writers racing = last-writer-wins chaos).
+# The marker is a machine-local side file — deliberately NOT in the manifest,
+# because the manifest itself is what gets pushed to replicas.
+sync_is_replica() {
+  [ -f "$ACC_ROOT/sync-role" ] || return 1
+  # Whole-line match: only a line saying exactly 'replica' counts — a value like
+  # 'not-replica' must never silently disable sync.
+  LC_ALL=C grep -qixE '[[:space:]]*replica[[:space:]]*' "$ACC_ROOT/sync-role"
+}
+
+cmd_sync() {
+  require_manifest
+  [ "$(machine_kind)" = "mac" ] || die "sync runs on the Mac (source of truth), not the server"
+  if sync_is_replica; then
+    echo "this pool is a sync replica — the source machine pushes here; nothing sent"
+    return 0
+  fi
+  local allow_empty=0
+  [ "${1:-}" = "--allow-empty" ] && allow_empty=1
+  local server sroot srepo
+  server="$(manifest_get server "$DEFAULT_SERVER")"
+  sroot="$(manifest_get server_root "$DEFAULT_SERVER_ROOT")"
+  srepo="$(manifest_get server_repo "$DEFAULT_SERVER_REPO")"
+  # These land inside remote shell commands — anything but a plain target/path is a
+  # command-injection vector from a corrupted or hand-edited manifest. EVERY target
+  # (primary and peers) is validated before anything is pushed anywhere.
+  valid_ssh_target "$server" || die "manifest 'server' is not a plain user@host: $server"
+  valid_remote_path "$sroot" || die "manifest 'server_root' is not a plain absolute path: $sroot"
+  valid_remote_path "$srepo" || die "manifest 'server_repo' is not a plain absolute path: $srepo"
+  local peers pt pr pp tab
+  tab="$(printf '\t')"
+  peers="$(manifest_peers)"
+  if [ -n "$peers" ]; then
+    while IFS="$tab" read -r pt pr pp; do
+      [ -n "$pt$pr$pp" ] || continue   # blank line only — a partial entry is fatal below
+      [ "$pt" = "MALFORMED" ] && die "manifest 'peers' contains a malformed entry — each peer needs target, root and repo"
+      { [ -n "$pt" ] && [ -n "$pr" ] && [ -n "$pp" ]; } \
+        || die "manifest peer entry is incomplete (target, root and repo are all required): target='$pt' root='$pr' repo='$pp'"
+      valid_ssh_target "$pt" || die "manifest peer target is not a plain user@host: $pt"
+      valid_remote_path "$pr" || die "manifest peer root is not a plain absolute path: $pr"
+      valid_remote_path "$pp" || die "manifest peer repo is not a plain absolute path: $pp"
+    done <<EOF
+$peers
+EOF
+  fi
+  rotate_log sync.log
+  slog() { log_to sync.log "$*"; }
+  fail() { slog "FAIL: $*"; printf 'claude-accounts sync: FAILED: %s\n' "$*" >&2; exit 1; }
+  slog "sync start -> $server:$sroot${peers:+ (+ peers)}"
+
+  # Hard validation before anything destructive: a corrupt or accountless manifest must
+  # never be pushed (it would blank the target pools), and must never make the removal
+  # propagation wipe a target's credentials. Emptying the pool on purpose is possible
+  # via `sync --allow-empty`, so this can never happen by accident.
+  "$PYBIN" - "$MANIFEST" <<'PYEOF' 2>/dev/null || fail "manifest is not valid JSON or has no well-formed accounts — refusing to sync"
+import json, re, sys
+doc = json.load(open(sys.argv[1]))
+accounts = doc.get('accounts')
+if not isinstance(accounts, list):
+    sys.exit(1)
+for a in accounts:
+    if not isinstance(a, dict) or not re.fullmatch(r'acct-\d{2}', str(a.get('id', ''))) \
+       or not str(a.get('email', '')).strip():
+        sys.exit(1)
+PYEOF
+  if [ -z "$(account_ids)" ] && [ "$allow_empty" != "1" ]; then
+    fail "manifest has zero accounts — refusing to blank the target pools (use 'sync --allow-empty' if that is really intended)"
+  fi
+
+  sync_push_target "$server" "$sroot" "$srepo"
+  local npeers=0
+  if [ -n "$peers" ]; then
+    while IFS="$tab" read -r pt pr pp; do
+      [ -n "$pt" ] || continue
+      sync_push_target "$pt" "$pr" "$pp"
+      npeers=$((npeers + 1))
+    done <<EOF
+$peers
+EOF
+  fi
 
   slog "sync ok"
-  echo "sync ok -> $server:$sroot"
-  return $rc
+  if [ "$npeers" -gt 0 ]; then
+    echo "sync ok -> $server:$sroot + $npeers peer(s)"
+  else
+    echo "sync ok -> $server:$sroot"
+  fi
 }
 
 cmd_post_sync() {

package/bin/codex-accounts

@@ -58,8 +58,11 @@ USAGE
   codex-accounts remove <acct-NN> [--yes]   delete account (propagates to server)
   codex-accounts dedupe [--yes]             remove any account registered twice
                                             (same email), keeping one per email
-  codex-accounts sync                       push manifest+seeds to the server (Mac only;
-                                            auth.json is machine-local, NEVER synced)
+  codex-accounts sync                       push manifest+seeds to the server AND any
+                                            manifest 'peers' (extra machines). Mac only.
+                                            auth.json is machine-local, NEVER synced.
+                                            A pool with a 'sync-role' file saying
+                                            'replica' never pushes (it receives).
   codex-accounts verify [--quick]           auth matrix; full mode runs a real
                                             `codex exec` per account
   codex-accounts limits [--quiet] [--force]
@@ -146,6 +149,9 @@ PYEOF
 auto_sync() { # best effort after mutations, Mac only, loud on failure
   [ "$(machine_kind)" = "mac" ] || return 0
   [ "${CODEX_MULTIACC_NO_SYNC:-0}" = "1" ] && return 0
+  # A replica pool never pushes (the source machine owns the account set) —
+  # silently, so every mutation on a replica does not nag about it.
+  sync_is_replica && return 0
   # subshell: cmd_sync exits on failure and must not take the CLI down with it
   ( cmd_sync ) || warn "server sync failed — run 'codex-accounts sync' manually"
 }
@@ -1452,67 +1458,36 @@ sys.exit(1 if failures else 0)
 PYEOF
 }
 
-cmd_sync() {
-  require_manifest
-  [ "$(machine_kind)" = "mac" ] || die "sync runs on the Mac (source of truth), not the server"
-  local allow_empty=0
-  [ "${1:-}" = "--allow-empty" ] && allow_empty=1
-  local server sroot srepo rc=0
-  server="$(manifest_get server "$DEFAULT_SERVER")"
-  sroot="$(manifest_get server_root "$DEFAULT_SERVER_ROOT")"
-  srepo="$(manifest_get server_repo "$DEFAULT_SERVER_REPO")"
-  # These land inside a remote shell command — anything but a plain target/path is a
-  # command-injection vector from a corrupted or hand-edited manifest.
-  valid_ssh_target "$server" || die "manifest 'server' is not a plain user@host: $server"
-  valid_remote_path "$sroot" || die "manifest 'server_root' is not a plain absolute path: $sroot"
-  valid_remote_path "$srepo" || die "manifest 'server_repo' is not a plain absolute path: $srepo"
-  rotate_log sync.log
-  slog() { log_to sync.log "$*"; }
-  fail() { slog "FAIL: $*"; printf 'codex-accounts sync: FAILED: %s\n' "$*" >&2; exit 1; }
-  slog "sync start -> $server:$sroot"
-
-  # Hard validation before anything destructive: a corrupt or accountless manifest must
-  # never be pushed (it would blank the server's pool), and must never make the removal
-  # loop below wipe the server's account dirs. Emptying the pool on purpose is possible
-  # via `sync --allow-empty`, so this can never happen by accident.
-  "$PYBIN" - "$MANIFEST" <<'PYEOF' 2>/dev/null || fail "manifest is not valid JSON or has no well-formed accounts — refusing to sync"
-import json, re, sys
-doc = json.load(open(sys.argv[1]))
-accounts = doc.get('accounts')
-if not isinstance(accounts, list):
-    sys.exit(1)
-for a in accounts:
-    if not isinstance(a, dict) or not re.fullmatch(r'acct-\d{2}', str(a.get('id', ''))) \
-       or not str(a.get('email', '')).strip():
-        sys.exit(1)
-PYEOF
-  if [ -z "$(account_ids)" ] && [ "$allow_empty" != "1" ]; then
-    fail "manifest has zero accounts — refusing to blank the server pool (use 'sync --allow-empty' if that is really intended)"
-  fi
+# Push the pool to ONE remote target. $1 = user@host, $2 = remote pool root,
+# $3 = remote addon repo (for the post-sync hook). Uses the caller's slog/fail.
+# NB: auth.json is deliberately NEVER pushed (in either direction): the refresh
+# token inside it rotates, and two machines refreshing one grant invalidate each
+# other. A codex account that should run on a target machine is signed in THERE
+# (codex-accounts add / login — device-code flow). Sync aligns the account LIST,
+# seeds, and advisory limit state.
+sync_push_target() {
+  local server="$1" sroot="$2" srepo="$3"
+  slog "push -> $server:$sroot"
 
   ssh -o BatchMode=yes -o ConnectTimeout=10 "$server" "mkdir -p '$sroot'" >>"$ACC_ROOT/sync.log" 2>&1 \
     || fail "cannot reach $server"
   rsync -az "$MANIFEST" "$server:$sroot/accounts.json" >>"$ACC_ROOT/sync.log" 2>&1 \
-    || fail "manifest push failed"
+    || fail "manifest push to $server failed"
 
-  # NB: auth.json is deliberately NEVER pushed (in either direction): the refresh
-  # token inside it rotates, and two machines refreshing one grant invalidate each
-  # other. A codex account that should run on the server is signed in THERE
-  # (codex-accounts add --device over SSH).
   local id d
   for id in $(account_ids); do
     d="$ACC_ROOT/$id"
     [ -d "$d" ] || continue
     ssh -o BatchMode=yes "$server" "mkdir -p '$sroot/$id'" >>"$ACC_ROOT/sync.log" 2>&1 \
-      || fail "mkdir $id failed"
+      || fail "mkdir $id on $server failed"
     local seed
     for seed in config.toml; do
       if [ -f "$d/$seed" ]; then
         rsync -az --ignore-existing "$d/$seed" "$server:$sroot/$id/" >>"$ACC_ROOT/sync.log" 2>&1 \
-          || fail "seed push for $id/$seed failed"
+          || fail "seed push for $id/$seed to $server failed"
       fi
     done
-    # Advisory limit state for accounts the server may lack a bearer for.
+    # Advisory limit state for accounts the target may lack a bearer for.
     local extra
     for extra in limits.json .limited; do
       if [ -f "$d/$extra" ]; then
@@ -1521,9 +1496,10 @@ PYEOF
     done
   done
 
-  # Removal propagation: any server acct dir not in the manifest gets deleted.
+  # Removal propagation: any target acct dir not in the manifest gets deleted.
   # Safety: an EMPTY id list (parse error, or a truly emptied pool) never deletes —
-  # wiping every server credential must be an explicit manual act, not a side effect.
+  # wiping every target's account dirs must be an explicit manual act, never a
+  # side effect.
   local ids_list ids_spaced
   ids_list="$(account_ids)"
   if [ -z "$ids_list" ]; then
@@ -1537,16 +1513,124 @@ for dd in acct-*; do
     *\" \$dd \"*) ;;
     *) rm -rf -- \"\$dd\" ;;
   esac
-done" >>"$ACC_ROOT/sync.log" 2>&1 || fail "removal propagation failed"
+done" >>"$ACC_ROOT/sync.log" 2>&1 || fail "removal propagation on $server failed"
   fi
 
-  # Post-sync hook: server seeds dirs and re-runs its quick verification matrix.
+  # Post-sync hook: the target seeds dirs and re-runs its quick verification matrix.
+  # Non-fatal: a hook that is absent (not bootstrapped) or exits nonzero (accounts
+  # awaiting a login THERE) must not fail the push that just succeeded.
   ssh -o BatchMode=yes "$server" "[ -x '$srepo/bin/codex-accounts' ] && '$srepo/bin/codex-accounts' post-sync" \
-    >>"$ACC_ROOT/sync.log" 2>&1 || slog "post-sync hook not available yet (server not bootstrapped?)"
+    >>"$ACC_ROOT/sync.log" 2>&1 || slog "post-sync hook on $server unavailable or unhappy (see its pool state)"
+}
+
+# Prints manifest peers (extra sync targets, e.g. a second Mac), one per line:
+# target<TAB>root<TAB>repo. Empty output = no peers.
+manifest_peers() {
+  [ -f "$MANIFEST" ] || return 0
+  "$PYBIN" - "$MANIFEST" <<'PYEOF' 2>/dev/null
+import json, sys
+peers = json.load(open(sys.argv[1])).get('peers')
+if peers is None:
+    sys.exit(0)
+if not isinstance(peers, list):
+    print('MALFORMED\t\t')
+    sys.exit(0)
+for p in peers:
+    if not isinstance(p, dict):
+        print('MALFORMED\t\t')
+        continue
+    print('%s\t%s\t%s' % (p.get('target', ''), p.get('root', ''), p.get('repo', '')))
+PYEOF
+}
+
+# True when this pool is a sync REPLICA: it receives pushes from the source
+# machine and must never push back (two writers racing = last-writer-wins chaos).
+# The marker is a machine-local side file — deliberately NOT in the manifest,
+# because the manifest itself is what gets pushed to replicas.
+sync_is_replica() {
+  [ -f "$ACC_ROOT/sync-role" ] || return 1
+  # Whole-line match: only a line saying exactly 'replica' counts — a value like
+  # 'not-replica' must never silently disable sync.
+  LC_ALL=C grep -qixE '[[:space:]]*replica[[:space:]]*' "$ACC_ROOT/sync-role"
+}
+
+cmd_sync() {
+  require_manifest
+  [ "$(machine_kind)" = "mac" ] || die "sync runs on the Mac (source of truth), not the server"
+  if sync_is_replica; then
+    echo "this pool is a sync replica — the source machine pushes here; nothing sent"
+    return 0
+  fi
+  local allow_empty=0
+  [ "${1:-}" = "--allow-empty" ] && allow_empty=1
+  local server sroot srepo
+  server="$(manifest_get server "$DEFAULT_SERVER")"
+  sroot="$(manifest_get server_root "$DEFAULT_SERVER_ROOT")"
+  srepo="$(manifest_get server_repo "$DEFAULT_SERVER_REPO")"
+  # These land inside remote shell commands — anything but a plain target/path is a
+  # command-injection vector from a corrupted or hand-edited manifest. EVERY target
+  # (primary and peers) is validated before anything is pushed anywhere.
+  valid_ssh_target "$server" || die "manifest 'server' is not a plain user@host: $server"
+  valid_remote_path "$sroot" || die "manifest 'server_root' is not a plain absolute path: $sroot"
+  valid_remote_path "$srepo" || die "manifest 'server_repo' is not a plain absolute path: $srepo"
+  local peers pt pr pp tab
+  tab="$(printf '\t')"
+  peers="$(manifest_peers)"
+  if [ -n "$peers" ]; then
+    while IFS="$tab" read -r pt pr pp; do
+      [ -n "$pt$pr$pp" ] || continue   # blank line only — a partial entry is fatal below
+      [ "$pt" = "MALFORMED" ] && die "manifest 'peers' contains a malformed entry — each peer needs target, root and repo"
+      { [ -n "$pt" ] && [ -n "$pr" ] && [ -n "$pp" ]; } \
+        || die "manifest peer entry is incomplete (target, root and repo are all required): target='$pt' root='$pr' repo='$pp'"
+      valid_ssh_target "$pt" || die "manifest peer target is not a plain user@host: $pt"
+      valid_remote_path "$pr" || die "manifest peer root is not a plain absolute path: $pr"
+      valid_remote_path "$pp" || die "manifest peer repo is not a plain absolute path: $pp"
+    done <<EOF
+$peers
+EOF
+  fi
+  rotate_log sync.log
+  slog() { log_to sync.log "$*"; }
+  fail() { slog "FAIL: $*"; printf 'codex-accounts sync: FAILED: %s\n' "$*" >&2; exit 1; }
+  slog "sync start -> $server:$sroot${peers:+ (+ peers)}"
+
+  # Hard validation before anything destructive: a corrupt or accountless manifest must
+  # never be pushed (it would blank the target pools), and must never make the removal
+  # propagation wipe a target's account dirs. Emptying the pool on purpose is possible
+  # via `sync --allow-empty`, so this can never happen by accident.
+  "$PYBIN" - "$MANIFEST" <<'PYEOF' 2>/dev/null || fail "manifest is not valid JSON or has no well-formed accounts — refusing to sync"
+import json, re, sys
+doc = json.load(open(sys.argv[1]))
+accounts = doc.get('accounts')
+if not isinstance(accounts, list):
+    sys.exit(1)
+for a in accounts:
+    if not isinstance(a, dict) or not re.fullmatch(r'acct-\d{2}', str(a.get('id', ''))) \
+       or not str(a.get('email', '')).strip():
+        sys.exit(1)
+PYEOF
+  if [ -z "$(account_ids)" ] && [ "$allow_empty" != "1" ]; then
+    fail "manifest has zero accounts — refusing to blank the target pools (use 'sync --allow-empty' if that is really intended)"
+  fi
+
+  sync_push_target "$server" "$sroot" "$srepo"
+  local npeers=0
+  if [ -n "$peers" ]; then
+    while IFS="$tab" read -r pt pr pp; do
+      [ -n "$pt" ] || continue
+      sync_push_target "$pt" "$pr" "$pp"
+      npeers=$((npeers + 1))
+    done <<EOF
+$peers
+EOF
+  fi
 
   slog "sync ok"
-  echo "sync ok -> $server:$sroot"
-  return $rc
+  if [ "$npeers" -gt 0 ]; then
+    echo "sync ok -> $server:$sroot + $npeers peer(s)"
+  else
+    echo "sync ok -> $server:$sroot"
+  fi
 }
 
 cmd_post_sync() {

package/install.sh

@@ -108,7 +108,7 @@ EOF
   <key>StandardErrorPath</key><string>/dev/null</string>
 </dict></plist>
 EOF
-  # Weekly auto-update (Sunday 04:07). No-op unless this is an npm or git install.
+  # Daily auto-update (04:07). No-op unless this is an npm or git install.
   cat > "$PLIST_UPDATE" <<EOF
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -120,7 +120,6 @@ EOF
     <string>--quiet</string>
   </array>
   <key>StartCalendarInterval</key><dict>
-    <key>Weekday</key><integer>0</integer>
     <key>Hour</key><integer>4</integer>
     <key>Minute</key><integer>7</integer>
   </dict>
@@ -174,7 +173,7 @@ EOF
   launchctl load -w "$PLIST_CODEX_LIMITS" 2>/dev/null || true
   launchctl load -w "$PLIST_CODEX_HEALTH" 2>/dev/null || true
   [ "${CLAUDE_MULTIACC_AUTOUPDATE:-1}" = "1" ] && launchctl load -w "$PLIST_UPDATE" 2>/dev/null || true
-  echo "  launchd: limits refresh every 60s (claude + codex) + weekly health checks + weekly auto-update"
+  echo "  launchd: limits refresh every 60s (claude + codex) + weekly health checks + daily auto-update"
 }
 
 mac_schedule_remove() {
@@ -196,11 +195,11 @@ linux_schedule_install() {
     echo "17 9 * * 1 $REPO_DIR/bin/claude-accounts health >/dev/null 2>&1 $CRON_TAG"
     echo "37 9 * * 1 $REPO_DIR/bin/codex-accounts health >/dev/null 2>&1 $CRON_TAG"
     [ "${CLAUDE_MULTIACC_AUTOUPDATE:-1}" = "1" ] && \
-      echo "7 4 * * 0 $REPO_DIR/bin/claude-accounts self-update --quiet >/dev/null 2>&1 $CRON_TAG"
+      echo "7 4 * * * $REPO_DIR/bin/claude-accounts self-update --quiet >/dev/null 2>&1 $CRON_TAG"
   } >> "$tmp"
   crontab "$tmp"
   rm -f "$tmp"
-  echo "  cron: limits refresh every 60s (claude + codex) + weekly health checks + weekly auto-update"
+  echo "  cron: limits refresh every 60s (claude + codex) + weekly health checks + daily auto-update"
 }
 
 linux_schedule_remove() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "1.0.9",
+  "version": "1.0.11",
   "description": "Multi-account addon for Claude Code and OpenAI Codex CLI: every claude / claude -p and every codex / codex exec runs under a randomly-picked subscription account with the most usage headroom. Mirrors to a deploy server. No API keys.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -1134,9 +1134,128 @@ json.dump(d, open(sys.argv[1] + '.tmp', 'w'), indent=2); os.replace(sys.argv[1]
 EOF
   out="$(CLAUDE_MULTIACC_NO_SYNC=0 claude-accounts sync 2>&1)"
   rc=$?
-  check "empty manifest refuses to sync" "refusing to blank the server pool" "$out"
+  check "empty manifest refuses to sync" "refusing to blank the target pools" "$out"
   [ "$rc" != "0" ] && t_ok "empty-manifest sync exits nonzero" || t_fail "empty sync rc" "rc=0"
   cp "$WORK/manifest.bak" "$ACC/accounts.json"
+
+  # a REPLICA pool never pushes (side file, not manifest — the manifest is what
+  # gets pushed TO replicas)
+  printf 'replica\n' > "$ACC/sync-role"
+  out="$(CLAUDE_MULTIACC_NO_SYNC=0 claude-accounts sync 2>&1)"
+  rc=$?
+  check "replica pool refuses to push" "sync replica" "$out"
+  [ "$rc" = "0" ] && t_ok "replica sync exits 0 (informational, not an error)" || t_fail "replica sync rc" "rc=$rc"
+  # ...and auto_sync (after a mutation) is silent about it
+  out="$(CLAUDE_MULTIACC_NO_SYNC=0 claude-accounts import replica-test@x --id acct-31 --no-sync 2>&1
+         CLAUDE_MULTIACC_NO_SYNC=0 claude-accounts remove acct-31 --yes 2>&1)"
+  case "$out" in *"sync failed"*) t_fail "replica auto_sync" "a replica mutation warned about sync: $out" ;;
+    *) t_ok "replica auto_sync is silent (no push, no warning)" ;; esac
+  rm -f "$ACC/sync-role"
+
+  # peer targets are validated with the same injection guards as the primary.
+  # A fake ssh/rsync harness (prepended to PATH only for these calls) records every
+  # remote invocation, so "nothing pushed" and "both targets pushed, in order" are
+  # verified from the actual command stream, not inferred from silence.
+  SSHFAKE="$WORK/sshfake"
+  SSHLOG="$WORK/sshfake.log"
+  mkdir -p "$SSHFAKE"
+  cat > "$SSHFAKE/ssh" <<'EOF'
+#!/usr/bin/env bash
+printf 'ssh %s\n' "$*" >> "${SSHLOG:?}"
+case "$*" in *"${SSH_FAIL_HOST:-@@none@@}"*) exit 1 ;; esac
+exit 0
+EOF
+  cat > "$SSHFAKE/rsync" <<'EOF'
+#!/usr/bin/env bash
+printf 'rsync %s\n' "$*" >> "${SSHLOG:?}"
+exit 0
+EOF
+  chmod +x "$SSHFAKE/ssh" "$SSHFAKE/rsync"
+  export SSHLOG
+
+  python3 - "$ACC/accounts.json" <<'EOF'
+import json, os, sys
+d = json.load(open(sys.argv[1]))
+d['peers'] = [{'target': "gas@peer; touch /tmp/multiacc_PEER_PWNED", 'root': '/tmp/x', 'repo': '/tmp/y'}]
+json.dump(d, open(sys.argv[1] + '.tmp', 'w'), indent=2); os.replace(sys.argv[1] + '.tmp', sys.argv[1])
+EOF
+  rm -f /tmp/multiacc_PEER_PWNED
+  : > "$SSHLOG"
+  out="$(PATH="$SSHFAKE:$PATH" CLAUDE_MULTIACC_NO_SYNC=0 claude-accounts sync 2>&1)"
+  rc=$?
+  check "injected peer target refused" "peer target is not a plain user@host" "$out"
+  [ "$rc" != "0" ] && t_ok "bad peer exits nonzero" || t_fail "peer validation rc" "rc=0"
+  [ ! -s "$SSHLOG" ] && t_ok "bad peer: nothing pushed anywhere (no ssh/rsync ran)" \
+    || t_fail "peer pre-validation" "remote commands ran before peer validation: $(head -2 "$SSHLOG")"
+  [ ! -f /tmp/multiacc_PEER_PWNED ] && t_ok "peer injection never executed" \
+    || { t_fail "peer injection" "peer target injection EXECUTED"; rm -f /tmp/multiacc_PEER_PWNED; }
+  cp "$WORK/manifest.bak" "$ACC/accounts.json"
+
+  # a MALFORMED peer entry (missing fields / not an object) is fatal, never skipped
+  python3 - "$ACC/accounts.json" <<'EOF'
+import json, os, sys
+d = json.load(open(sys.argv[1]))
+d['peers'] = [{'root': '/tmp/x', 'repo': '/tmp/y'}]   # no target
+json.dump(d, open(sys.argv[1] + '.tmp', 'w'), indent=2); os.replace(sys.argv[1] + '.tmp', sys.argv[1])
+EOF
+  out="$(PATH="$SSHFAKE:$PATH" CLAUDE_MULTIACC_NO_SYNC=0 claude-accounts sync 2>&1)"
+  rc=$?
+  check "peer with missing field is fatal, not skipped" "incomplete" "$out"
+  [ "$rc" != "0" ] && t_ok "incomplete peer exits nonzero" || t_fail "incomplete peer rc" "rc=0"
+  python3 - "$ACC/accounts.json" <<'EOF'
+import json, os, sys
+d = json.load(open(sys.argv[1]))
+d['peers'] = ["gas@peer"]   # not an object
+json.dump(d, open(sys.argv[1] + '.tmp', 'w'), indent=2); os.replace(sys.argv[1] + '.tmp', sys.argv[1])
+EOF
+  out="$(PATH="$SSHFAKE:$PATH" CLAUDE_MULTIACC_NO_SYNC=0 claude-accounts sync 2>&1)"
+  check "non-object peer entry is fatal" "malformed" "$out"
+  cp "$WORK/manifest.bak" "$ACC/accounts.json"
+
+  # a SUCCESSFUL multi-target sync pushes primary first, then the peer — verified
+  # from the recorded command stream
+  python3 - "$ACC/accounts.json" <<'EOF'
+import json, os, sys
+d = json.load(open(sys.argv[1]))
+d['peers'] = [{'target': 'gas@peer1', 'root': '/Users/gas/.claude-accounts', 'repo': '/Users/gas/claude-multiacc'}]
+json.dump(d, open(sys.argv[1] + '.tmp', 'w'), indent=2); os.replace(sys.argv[1] + '.tmp', sys.argv[1])
+EOF
+  : > "$SSHLOG"
+  out="$(PATH="$SSHFAKE:$PATH" CLAUDE_MULTIACC_NO_SYNC=0 claude-accounts sync 2>&1)"
+  rc=$?
+  [ "$rc" = "0" ] && t_ok "multi-target sync succeeds" || t_fail "multi-target sync" "rc=$rc: $out"
+  check "multi-target sync reports the peer" "+ 1 peer(s)" "$out"
+  grep -q "rsync.*root@203.0.113.1:/root/.claude-accounts/accounts.json" "$SSHLOG" \
+    && grep -q "rsync.*gas@peer1:/Users/gas/.claude-accounts/accounts.json" "$SSHLOG" \
+    && t_ok "manifest pushed to BOTH targets" \
+    || t_fail "multi-target pushes" "missing a manifest push: $(grep accounts.json "$SSHLOG")"
+  first_primary="$(grep -n "root@203.0.113.1" "$SSHLOG" | head -1 | cut -d: -f1)"
+  first_peer="$(grep -n "gas@peer1" "$SSHLOG" | head -1 | cut -d: -f1)"
+  [ -n "$first_primary" ] && [ -n "$first_peer" ] && [ "$first_primary" -lt "$first_peer" ] \
+    && t_ok "primary target pushed before the peer" \
+    || t_fail "target order" "primary=$first_primary peer=$first_peer"
+  n_remov="$(grep -c "for dd in acct-" "$SSHLOG")"
+  [ "$n_remov" = "2" ] && t_ok "removal propagation ran on each target" \
+    || t_fail "per-target removal" "expected 2 removal sweeps, saw $n_remov"
+  grep -q "post-sync" "$SSHLOG" && t_ok "post-sync hooks invoked" || t_fail "post-sync hooks" "none recorded"
+  # a primary failure aborts the WHOLE sync: the peer is never contacted
+  : > "$SSHLOG"
+  out="$(PATH="$SSHFAKE:$PATH" SSH_FAIL_HOST="root@203.0.113.1" CLAUDE_MULTIACC_NO_SYNC=0 claude-accounts sync 2>&1)"
+  rc=$?
+  [ "$rc" != "0" ] && t_ok "primary failure fails the sync" || t_fail "fail-fast rc" "rc=0"
+  check "primary failure is loud" "cannot reach" "$out"
+  grep -q "gas@peer1" "$SSHLOG" \
+    && t_fail "fail-fast" "the peer was contacted after the primary failed" \
+    || t_ok "peer not contacted after a primary failure"
+  cp "$WORK/manifest.bak" "$ACC/accounts.json"
+
+  # only an EXACT 'replica' value suppresses sync ('not-replica' must still push)
+  printf 'not-replica\n' > "$ACC/sync-role"
+  out="$(PATH="$SSHFAKE:$PATH" CLAUDE_MULTIACC_NO_SYNC=0 claude-accounts sync 2>&1)"
+  case "$out" in *"sync replica"*) t_fail "replica anchor" "'not-replica' suppressed sync" ;;
+    *"sync ok"*) t_ok "only an exact 'replica' value suppresses sync" ;;
+    *) t_fail "replica anchor" "unexpected: $out" ;; esac
+  rm -f "$ACC/sync-role"
 else
   t_ok "sync validation tests skipped (Mac-only feature; server refuses sync by design)"
 fi
@@ -2020,9 +2139,36 @@ json.dump(d, open(sys.argv[1] + '.tmp', 'w'), indent=2); os.replace(sys.argv[1]
 EOF
   out="$(CODEX_MULTIACC_NO_SYNC=0 codex-accounts sync 2>&1)"
   rc=$?
-  check "codex: empty manifest refuses to sync" "refusing to blank the server pool" "$out"
+  check "codex: empty manifest refuses to sync" "refusing to blank the target pools" "$out"
   [ "$rc" != "0" ] && t_ok "codex: empty-manifest sync exits nonzero" || t_fail "codex empty sync rc" "rc=0"
   cp "$WORK/cx-manifest.bak" "$CX/accounts.json"
+
+  # replica + peer guards, codex flavor
+  printf 'replica\n' > "$CX/sync-role"
+  out="$(CODEX_MULTIACC_NO_SYNC=0 codex-accounts sync 2>&1)"
+  rc=$?
+  check "codex: replica pool refuses to push" "sync replica" "$out"
+  [ "$rc" = "0" ] && t_ok "codex: replica sync exits 0" || t_fail "codex replica sync rc" "rc=$rc"
+  # ...and a codex replica's auto_sync (fired by remove) is silent — no push, no nag
+  out="$(CODEX_MULTIACC_NO_SYNC=0 codex-accounts import rep@cx --id acct-31 --no-sync 2>&1
+         CODEX_MULTIACC_NO_SYNC=0 codex-accounts remove acct-31 --yes 2>&1)"
+  case "$out" in *"sync failed"*) t_fail "codex replica auto_sync" "a replica mutation warned about sync: $out" ;;
+    *) t_ok "codex: replica auto_sync is silent (no push, no warning)" ;; esac
+  rm -f "$CX/sync-role"
+  python3 - "$CX/accounts.json" <<'EOF'
+import json, os, sys
+d = json.load(open(sys.argv[1]))
+d['peers'] = [{'target': 'gas@peer', 'root': "/tmp/x'; touch /tmp/cx_multiacc_PEER_PWNED; #", 'repo': '/tmp/y'}]
+json.dump(d, open(sys.argv[1] + '.tmp', 'w'), indent=2); os.replace(sys.argv[1] + '.tmp', sys.argv[1])
+EOF
+  rm -f /tmp/cx_multiacc_PEER_PWNED
+  out="$(CODEX_MULTIACC_NO_SYNC=0 codex-accounts sync 2>&1)"
+  rc=$?
+  check "codex: injected peer root refused" "peer root is not a plain absolute path" "$out"
+  [ "$rc" != "0" ] && t_ok "codex: bad peer exits nonzero" || t_fail "codex peer validation rc" "rc=0"
+  [ ! -f /tmp/cx_multiacc_PEER_PWNED ] && t_ok "codex: peer injection never executed" \
+    || { t_fail "codex peer injection" "peer root injection EXECUTED"; rm -f /tmp/cx_multiacc_PEER_PWNED; }
+  cp "$WORK/cx-manifest.bak" "$CX/accounts.json"
 else
   t_ok "codex: sync validation tests skipped (Mac-only feature)"
 fi