claude-multiacc 2.0.20 → 2.0.22

package/bin/codex

@@ -3,8 +3,10 @@
 # Every invocation runs under a randomly picked ChatGPT subscription account with limit
 # headroom. Self-contained on purpose: no sourcing, so a broken repo file can never
 # break `codex`.
-# Selection: CODEX_HOME passthrough > CODEX_ACCOUNT pin > random among limit-eligible
-# accounts in the 30-point headroom band > least-utilized fallback (degraded beats down).
+# Selection: CODEX_HOME passthrough > CODEX_ACCOUNT pin > random among the limit-eligible
+# accounts that clear the 50-point session gate and then sit in the 30-point weekly
+# headroom band > all-limited fallback: the same two cuts over the still-serving limited
+# accounts, strict weekly (degraded beats down).
 # Accounts whose login is DEAD (a `.expired` marker from a failed refresh/verify/run)
 # are never selected — not even as the all-limited fallback — because they fail every
 # call outright; `codex-accounts expired` / `relogin` fix them.
@@ -106,11 +108,38 @@ fi
 # scraped number goes through here.
 num_ok() { case "$1" in ''|*[!0-9]*) return 1 ;; esac; [ "${#1}" -le 18 ]; }
 
+iso_of_epoch() { # $1 seconds -> UTC ISO8601 ('' when neither date(1) dialect works)
+  date -u -r "$1" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -d "@$1" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null
+}
+
+# Comparable digit string for an ISO timestamp: 2026-08-21T17:07:59.321Z -> 20260821170759.
+# Locale-proof (plain integers), and short enough that num_ok always passes. Byte-parallel
+# with bin/claude (~637), because client_limit_scan below compares a rollout record's
+# timestamp against the .client-limit-cleared watermark exactly the way that shim does.
+iso_key() { local t="${1%%.*}"; t="$(printf '%s' "$t" | LC_ALL=C tr -cd '0-9')"; printf '%s\n' "${t}"; }
+
 sel_log() {
   printf '%s %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$*" 2>/dev/null >> "$ACC_ROOT/selection.log" || true
 }
 
 marker_active() { # true if $1/.limited is still in force; clears cleanly-expired markers
+  # Parity with bin/claude's client_marker_recovered, by construction: this shim has NO
+  # telemetry-based clearing path. A marker leaves here only when its OWN reset epoch has
+  # passed, so no usage reading — informative or not — can unpark an account.
+  # The bucket names this pool actually carries are written by client_limit_scan below
+  # from the rollout's own `window_minutes`: `bucket=client:7d` (>= 1440 minutes) and
+  # `bucket=client:5h` (under it), plus a bare `bucket=client:primary|secondary` for a
+  # report that named no window at all. Those two raw key names are what the scan wrote
+  # before 2026-09-04 and they are NOT weekly tokens — live payloads report `primary` as
+  # the 10080-minute window — so the weekly guard could never match a codex marker.
+  # That guard is the rule 2026-09-04 forced on the claude side: acct-13/acct-14 were
+  # served fake-zero telemetry (every bucket percent 0, resets_at null), which read as 0%
+  # and deleted their truthful client:seven_day markers, and an interactive session was
+  # handed both weekly-exhausted accounts in a row. Codex's one telemetry-driven clear
+  # lives in `codex-accounts limits`: it keeps a client:7d marker until its own reset and
+  # clears an aged client:5h one on an informative pass (#22, 2026-09-03), stamping
+  # `.client-limit-cleared` as it does so this scan cannot re-mark from the same rollout.
+  # If a recovery path is ever added HERE, it must apply that identical rule.
   local m="$1/.limited" reset=""
   [ -f "$m" ] || return 1
   IFS= read -r reset < "$m" 2>/dev/null || reset=""
@@ -140,33 +169,101 @@ fresh_field() { # fresh_field <acct dir> <json key> -> integer if telemetry fres
   printf '%s\n' "$v"
 }
 
-# RANKING score — lower is better (more headroom). Weekly headroom dominates: a weekly
-# window only refills on its multi-day reset, while the ~5h window self-heals, so
-# session is a mild tiebreaker only (same reset asymmetry as the claude pool).
-#   score = weekly%*1000 + session%      weekly,session in [0,100]
-# Stale/unreadable telemetry ranks LAST (weekly 100, session 100), never "free".
-# Equal worst-case scores keep an entirely unknown pool selectable, but an unknown
-# account can never beat a candidate with truthful usage telemetry.
-sel_score_of() { # $1 = acct dir
-  local w s
-  w="$(fresh_field "$1" weekly_percent)" || w="$(fresh_field "$1" max_percent)" || w=100
-  s="$(fresh_field "$1" session_percent)" || s=100
-  printf '%s\n' $((w * 1000 + s))
-}
+# RANKING — TWO CUTS, in this order, then chance. The operator's ask (2026-09-03):
+# "among accounts where high session limits it must choose randomly from ones where
+# highest weekly limits."
+#   1. SESSION GATE (SESSION_GATE, default 50): a candidate clears the gate when its ~5h
+#      session usage is KNOWN and at or under the gate. When at least one candidate clears
+#      it, only those are ranked further — an account whose session bucket is nearly spent
+#      is about to be rejected whatever its weekly headroom is. When NOBODY clears it the
+#      gate steps aside and every candidate is ranked: the gate compares candidates, it
+#      never empties the pool.
+#   2. WEEKLY BAND (HEADROOM_BAND, default 30, kept at the operator's request): among the
+#      gated candidates the lowest KNOWN weekly usage leads, and every gated candidate
+#      within the band of it is a peer. Weekly dominates because a weekly window only
+#      refills on its multi-day reset while the ~5h window self-heals (same asymmetry as
+#      the claude pool) — which is exactly why session acts as the gate and is NOT a
+#      tiebreaker inside the band any more: the operator asked for a random choice among
+#      the best-weekly accounts.
+# Stale/unreadable telemetry never clears the gate and never enters the band — an unknown
+# account can never beat a candidate with truthful usage telemetry — but when NOTHING is
+# known the candidates all tie, which keeps an entirely blind pool selectable.
+# Band 0 (or the all-limited PICK_STRICT fallback) means exact weekly ties only; gate 100
+# turns the gate off.
 
 HEADROOM_BAND="${CODEX_MULTIACC_HEADROOM_BAND:-30}"
 case "$HEADROOM_BAND" in ''|*[!0-9]*|??????*) HEADROOM_BAND=30 ;; esac
 [ "$HEADROOM_BAND" -gt 100 ] && HEADROOM_BAND=100
-
+SESSION_GATE="${CODEX_MULTIACC_SESSION_GATE:-50}"
+case "$SESSION_GATE" in ''|*[!0-9]*|??????*) SESSION_GATE=50 ;; esac
+[ "$SESSION_GATE" -gt 100 ] && SESSION_GATE=100
+# What the selection log prints for the gate: "off" in random mode, where no gate ran —
+# the log must never claim a cut that was not made.
+SESSION_GATE_LOG="$SESSION_GATE"
+# The codex shim has no DEGRADED ranking mode (the claude shim ranks on still-valid stale
+# weekly readings when nothing in its pool is fresh). The constant exists so pick_best
+# can stay byte-identical with bin/claude.
+SEL_DEGRADED=0
+
+# weekly_percent ONLY. A reading without it is unknown here, exactly as it is unknown to
+# pool-selection.v2 (which never sees max_percent). The old max_percent fallback let a
+# weekly-less file rank — and, once the session gate existed, CLEAR the gate — on a number
+# that may well be the session bucket's own peak (codex review, 2026-09-04).
 rank_weekly_of() { # $1 = acct dir -> comparable weekly use, or fail when unknown
   local w
-  if w="$(fresh_field "$1" weekly_percent)" || w="$(fresh_field "$1" max_percent)"; then
+  if w="$(fresh_field "$1" weekly_percent)"; then
     printf '%s\n' "$w"
     return 0
   fi
   return 1
 }
 
+rank_session_of() { # $1 = acct dir -> fresh session use, or fail when unknown
+  fresh_field "$1" session_percent
+}
+
+# The .limited marker's own fields (line 1: reset epoch; line 2: "bucket=…
+# percent=… … reason=…"). All tolerant: an unreadable or bare marker answers
+# "unknown", never an error — these feed the all-limited fallback only.
+limited_reset_of() { # $1 acct dir -> the marker's reset epoch, or 0 (unknown)
+  local m="$1/.limited" r=""
+  [ -f "$m" ] && { IFS= read -r r < "$m" 2>/dev/null || r=""; }
+  if num_ok "$r"; then printf '%s\n' "$r"; else printf '0\n'; fi
+}
+
+limited_percent_of() { # $1 acct dir -> the marked window's percent, or -1 (unknown)
+  local m="$1/.limited" line=""
+  [ -f "$m" ] && line="$(sed -n 2p "$m" 2>/dev/null)"
+  case "$line" in
+    *percent=*) line="${line#*percent=}"; line="${line%% *}" ;;
+    *) line="" ;;
+  esac
+  if num_ok "$line"; then printf '%s\n' "$line"; else printf '%s\n' "-1"; fi
+}
+
+# Rejected RIGHT NOW, not merely near the threshold: the marked window is exhausted
+# (100%), or the marker records a real client rejection (a 429 the server sent) or an
+# error cooldown. A window at 90-99% still answers requests — the difference the
+# all-limited fallback lives on, because "degraded service beats a hard failure" only
+# holds for an account that can actually serve. Same rule as the claude shim.
+limited_hard_blocked() { # $1 acct dir
+  local m="$1/.limited" line="" p
+  if [ -f "$m" ]; then
+    line="$(sed -n 2p "$m" 2>/dev/null)"
+    case "$line" in *reason=client-rate-limit*|*reason=error-cooldown*) return 0 ;; esac
+    p="$(limited_percent_of "$1")"
+    if [ "$p" -ge 0 ] 2>/dev/null; then
+      [ "$p" -ge 100 ]
+      return
+    fi
+    return 1
+  fi
+  # No marker (the over-threshold backstop put it in valid-but-not-eligible):
+  # fresh telemetry's peak decides; stale/unknown reads as still serving.
+  p="$(fresh_field "$1" max_percent)" || return 1
+  [ "$p" -ge 100 ]
+}
+
 # Backstop for a lost/failed marker write: fresh telemetry with ANY bucket at/over the
 # threshold excludes the account even if .limited is missing. Stale/unreadable => not
 # over (fail open — telemetry must never invent exclusions).
@@ -219,7 +316,7 @@ rl_field() { # rl_field <json fragment> <key> -> leading integer of that key's v
 # Prints "<reset-epoch> <window>"; fails when there is none.
 client_limit_scan() { # $1 acct dir
   local day f line frag pct reset best=0 bestwin="" scanned=0 thr="${CODEX_MULTIACC_THRESHOLD:-90}" which
-  local memo="$1/.client-scan" last="" ttl
+  local memo="$1/.client-scan" last="" ttl mins win ts ck sk cleared
   [ "${CODEX_MULTIACC_CLIENT_LIMITS:-1}" = "0" ] && return 1
   sessions_owned "$1" || return 1
   # A CLEAN result is remembered for a few seconds so a tight loop of `codex exec` runs
@@ -281,15 +378,57 @@ EOF
         | LC_ALL=C grep -a '^{".*"rate_limits"' \
         | tail -1)"
       [ -n "$line" ] || continue
+      # A clean `codex-accounts limits` pass that DELETED this account's client marker
+      # supersedes every report at or before its stamp. Without this watermark the clear
+      # achieved nothing: the rollout is still on disk, so the very next launch re-read
+      # the same tail and rewrote the same park — a delete/rewrite flap once per pass,
+      # which is exactly what codex gaining 5h clearing bought us on 2026-09-04.
+      # bin/claude's scan (~800) has consumed the same file, with the same name and the
+      # same comparison, since the #22 five-hour clearing landed.
+      ts="$(printf '%s' "$line" | LC_ALL=C sed -n \
+        's/.*"timestamp"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')"
+      ck="$(iso_key "$ts")"
+      cleared=""
+      [ -f "$1/.client-limit-cleared" ] \
+        && { IFS= read -r cleared < "$1/.client-limit-cleared" 2>/dev/null || cleared=""; }
+      if num_ok "$cleared"; then
+        sk="$(iso_key "$(iso_of_epoch "$cleared")")"
+        if num_ok "$ck" && num_ok "$sk"; then
+          [ "$ck" -le "$sk" ] && continue
+        elif [ "$(file_mtime "$f")" -le "$cleared" ]; then
+          # An undatable report falls back to the rollout's mtime, exactly as the claude
+          # scan does: no timestamp, no way to prove it is newer than the clear.
+          continue
+        fi
+      fi
       for which in primary secondary; do
         frag="$(printf '%s' "$line" | LC_ALL=C sed -n "s/.*\"$which\"[[:space:]]*:[[:space:]]*{\([^}]*\)}.*/\1/p")"
         [ -n "$frag" ] || continue
         pct="$(rl_field "$frag" used_percent)"
         reset="$(rl_field "$frag" resets_at)"
+        mins="$(rl_field "$frag" window_minutes)"
         num_ok "$pct" || continue
         num_ok "$reset" || continue
         [ "$pct" -ge "$thr" ] || continue
-        if [ "$reset" -gt "$best" ]; then best="$reset"; bestwin="$which:$pct"; fi
+        # The marker's bucket has to name the KIND of window that was spent, because that
+        # token is the only thing the weekly guard (codex-accounts weekly_marker) can read.
+        # `primary`/`secondary` are just the rollout's key names and map to nothing fixed —
+        # live payloads report primary as the 10080-minute window — so a marker named after
+        # them was never protected by that guard (2026-09-04). window_minutes rides in the
+        # same fragment, so the label is derived HERE, at write time: a day or more is the
+        # weekly window (7d), which only refills on its multi-day reset and therefore
+        # outlives every later usage payload; anything shorter is the self-healing 5h
+        # bucket that #22 (2026-09-03) had to keep clearable. A report carrying no
+        # window_minutes keeps the raw key name and so stays clearable too — the same
+        # fail-open direction, still bounded by the marker's own reset epoch.
+        if num_ok "$mins" && [ "$mins" -ge 1440 ]; then
+          win="7d"
+        elif num_ok "$mins"; then
+          win="5h"
+        else
+          win="$which"
+        fi
+        if [ "$reset" -gt "$best" ]; then best="$reset"; bestwin="$win:$pct"; fi
       done
       [ "$best" -gt "$now" ] && break 2
     done
@@ -302,7 +441,13 @@ EOF
   printf '%s %s\n' "$best" "$bestwin"
 }
 
-mark_client_limit() { # $1 acct dir, $2 reset epoch, $3 window:pct
+mark_client_limit() { # $1 acct dir, $2 reset epoch, $3 window:pct (window: 7d|5h|primary|secondary)
+  # $3's window half is the SEMANTIC label client_limit_scan derived from window_minutes,
+  # so line 2 reads `bucket=client:7d` / `bucket=client:5h` and the writer's weekly guard
+  # matches it. A `client:primary` / `client:secondary` marker still on disk was written
+  # before 2026-09-04: it names no window, so it keeps the pre-guard, clearable behavior
+  # and simply expires at its own reset epoch. The sel_log line below keeps showing the
+  # window:pct detail either way.
   local m="$1/.limited" cur=""
   # Never shorten a marker that already reaches further out, and never rewrite the
   # same one on every invocation.
@@ -467,44 +612,69 @@ remember_pick() { # $1 acct dir — best effort. stderr is silenced BEFORE the r
   return 0
 }
 
-# Pick the account with the MOST headroom (lowest ranking score = most weekly headroom,
-# session as tiebreaker). Ties break randomly so equally-idle accounts still spread load.
-# Sets PICK_DIR/PICK_SCORE as globals — it must never touch "$@", which holds the
-# user's codex arguments.
+# Two cuts, then chance: the session gate first, the weekly headroom band second, and a
+# random peer with the account just handed out avoided. Sets PICK_DIR / PICK_BAND_COUNT /
+# PICK_GATE_COUNT as globals — it must never touch "$@", which holds the user's codex
+# arguments.
 PICK_DIR=""
-PICK_SCORE=""
 PICK_BAND_COUNT=0
+PICK_GATE_COUNT=0
 PICK_STRICT=0
 pick_best() { # args: candidate dirs
-  local d w avoid best="" bestv=1000000 bestw=101 ceiling=100 ties=0 i n match
-  local cand=() score=() weekly=() known=() pool=()
+  local d w s k sk avoid best="" bestw=101 band ceiling ties=0 i n
+  local cand=() weekly=() known=() gated=() pool=()
   avoid="$(last_pick_id)"
+  PICK_GATE_COUNT=0
   for d in "$@"; do
     cand+=("$d")
-    score+=("$(sel_score_of "$d")")
-    if w="$(rank_weekly_of "$d")"; then weekly+=("$w"); known+=(1)
-    else weekly+=(100); known+=(0); fi
+    w="$(rank_weekly_of "$d")" && k=1 || k=0
+    s="$(rank_session_of "$d")" && sk=1 || sk=0
+    # "Known" takes BOTH readings — pool-selection.v2's quota_known rule. A weekly figure
+    # on its own neither ranks nor clears the gate, and a session figure on its own could
+    # otherwise be the sole gate-clearer and win the all-gated tie over an account whose
+    # truthful weekly reading merely failed the gate. The one exception is a DEGRADED pool
+    # (SEL_DEGRADED=1): nothing is fresh anywhere, the gate has necessarily stepped aside,
+    # and a still-valid stale weekly reading is the only truth there is. (The writers DO
+    # emit one-signal documents — per-signal informative aggregation, 2026-09-04 — and
+    # such a document is exactly as unknown here as an empty one; parity with
+    # lib/selector_policy.py's quota_known.)
+    if [ "$k" = 1 ] && { [ "$sk" = 1 ] || [ "$SEL_DEGRADED" = 1 ]; }; then
+      weekly+=("$w"); known+=(1)
+    else
+      weekly+=(100); known+=(0)
+    fi
+    if [ "$k" = 1 ] && [ "$sk" = 1 ] && [ "$s" -le "$SESSION_GATE" ]; then
+      gated+=(1); PICK_GATE_COUNT=$((PICK_GATE_COUNT + 1))
+    else
+      gated+=(0)
+    fi
   done
   n=${#cand[@]}
   i=0
   while [ "$i" -lt "$n" ]; do
-    [ "${score[$i]}" -lt "$bestv" ] && bestv="${score[$i]}"
-    [ "${known[$i]}" = 1 ] && [ "${weekly[$i]}" -lt "$bestw" ] && bestw="${weekly[$i]}"
+    # Nobody clears the gate => everybody does: the gate compares, it never empties the pool.
+    [ "$PICK_GATE_COUNT" -eq 0 ] && gated[$i]=1
+    if [ "${gated[$i]}" = 1 ] && [ "${known[$i]}" = 1 ] && [ "${weekly[$i]}" -lt "$bestw" ]; then
+      bestw="${weekly[$i]}"
+    fi
     i=$((i + 1))
   done
-  ceiling=$((bestw + HEADROOM_BAND)); [ "$ceiling" -gt 100 ] && ceiling=100
+  band="$HEADROOM_BAND"
+  [ "$PICK_STRICT" = 1 ] && band=0
+  ceiling=$((bestw + band)); [ "$ceiling" -gt 100 ] && ceiling=100
   i=0
   while [ "$i" -lt "$n" ]; do
-    match=0
-    if [ "$PICK_STRICT" = 0 ] && [ "$HEADROOM_BAND" -gt 0 ] && [ "$bestw" -le 100 ]; then
-      [ "${known[$i]}" = 1 ] && [ "${weekly[$i]}" -le "$ceiling" ] && match=1
-    else
-      [ "${score[$i]}" -eq "$bestv" ] && match=1
+    if [ "${gated[$i]}" = 1 ]; then
+      if [ "$bestw" -gt 100 ]; then
+        pool+=("$i")                       # no weekly reading anywhere: all gated tie
+      elif [ "${known[$i]}" = 1 ] && [ "${weekly[$i]}" -le "$ceiling" ]; then
+        pool+=("$i")
+      fi
     fi
-    [ "$match" = 1 ] && pool+=("$i")
     i=$((i + 1))
   done
   PICK_BAND_COUNT=${#pool[@]}
+  # Reservoir-sample the peers, skipping the account just handed out.
   for i in "${pool[@]}"; do
     if [ "${cand[$i]##*/}" != "$avoid" ]; then
       ties=$((ties + 1))
@@ -518,22 +688,64 @@ pick_best() { # args: candidate dirs
     done
   fi
   PICK_DIR="$best"
-  PICK_SCORE="$(sel_score_of "$best")"
 }
 
 if [ "${#eligible[@]}" -gt 0 ]; then
   if [ "${CODEX_SHIM_SELECT:-headroom}" = "random" ]; then
     PICK_DIR="${eligible[$((RANDOM % ${#eligible[@]}))]}"
     PICK_BAND_COUNT=${#eligible[@]}
+    PICK_GATE_COUNT=${#eligible[@]}
+    SESSION_GATE_LOG=off
   else
     pick_best "${eligible[@]}"
   fi
 else
-  # Every account is limit-marked: degraded service beats a hard failure (100% rule).
-  PICK_STRICT=1
-  pick_best "${valid[@]}"
-  PICK_STRICT=0
-  sel_log "all-limited fallback=$(basename "$PICK_DIR") weekly=$(fresh_field "$PICK_DIR" weekly_percent || echo '?')%"
+  # Every account is limit-marked: degraded service beats a hard failure (100% rule) —
+  # but not every limited account is equally dead. A window at 90-99% still answers;
+  # one at 100% (or a real client 429) rejects every request until its reset. The claude
+  # shim learned this on 2026-08-29; the codex shim ranked the whole valid set on weekly
+  # headroom until the session gate reached the fallback, where an exhausted account
+  # that happened to clear the gate would beat a still-serving one that did not
+  # (codex review, 2026-09-04).
+  soft=()
+  hard=()
+  for d in "${valid[@]}"; do
+    if limited_hard_blocked "$d"; then hard+=("$d"); else soft+=("$d"); fi
+  done
+  if [ "${#soft[@]}" -gt 0 ]; then
+    PICK_STRICT=1
+    pick_best "${soft[@]}"
+    PICK_STRICT=0
+    sel_log "all-limited fallback=$(basename "$PICK_DIR") weekly=$(fresh_field "$PICK_DIR" weekly_percent || echo '?')%"
+  else
+    # Every account is exhausted RIGHT NOW: nothing serves, so hand out the one that
+    # unblocks first — its rejection window is the shortest.
+    PICK_DIR=""
+    best_reset=0
+    for d in "${hard[@]}"; do
+      r="$(limited_reset_of "$d")"
+      if [ -z "$PICK_DIR" ]; then
+        PICK_DIR="$d"; best_reset="$r"; continue
+      fi
+      if [ "$r" -gt 0 ] && { [ "$best_reset" -eq 0 ] || [ "$r" -lt "$best_reset" ]; }; then
+        PICK_DIR="$d"; best_reset="$r"
+      fi
+    done
+    sel_log "all-limited fallback=$(basename "$PICK_DIR") all-exhausted resets_in=$((best_reset > now ? best_reset - now : 0))s"
+    # Every candidate rejects right now, so this pick WILL fail: say so on a terminal
+    # instead of letting the operator read the client's bare limit error as a bad
+    # choice by the pool. Throttled, and never on a service's stderr.
+    if [ -t 2 ]; then
+      exn="$ACC_ROOT/.exhausted-notice"
+      exlast=0
+      [ -f "$exn" ] && exlast="$(file_mtime "$exn")"
+      if [ $((now - exlast)) -gt 600 ]; then
+        : 2>/dev/null > "$exn" || true
+        printf 'codex-multiacc: every usable account is at a limit right now; %s frees up in %ds and was chosen for that.\n' \
+          "$(basename "$PICK_DIR")" "$((best_reset > now ? best_reset - now : 0))" >&2
+      fi
+    fi
+  fi
 fi
 pick="$PICK_DIR"
 # Remember the pick so the NEXT run does not hand back the same account. An explicit
@@ -564,7 +776,7 @@ fi
 acct="$(basename "$pick")"
 sel_log "$acct weekly=$(fresh_field "$pick" weekly_percent || echo '?')%" \
   "session=$(fresh_field "$pick" session_percent || echo '?')%" \
-  "band=${HEADROOM_BAND} band-count=${PICK_BAND_COUNT} pwd=$PWD"
+  "band=${HEADROOM_BAND} band-count=${PICK_BAND_COUNT} session-gate=${SESSION_GATE_LOG} session-ok=${PICK_GATE_COUNT} pwd=$PWD"
 
 export CODEX_SHIM_ACTIVE=1