claude-multiacc 2.0.41 → 2.0.43

package/bin/claude-accounts

@@ -678,6 +678,8 @@ cmd_add() {
   mutate_unlock
   RESERVED_DIR=""            # committed — the trap must not delete it now
   trap - EXIT INT TERM
+  # Registered under the identity it read back: leave one Keychain item for the dir.
+  [ "$token" = "1" ] || keychain_prune "$d"
   # Only the full-login path actually READ the identity back. Saying "verified" for a
   # setup token would relaunder the very assumption this flow just warned about.
   local verdict="sign-in verified"
@@ -784,9 +786,10 @@ def has_auth(aid):
     if (os.path.isfile(c) and os.path.getsize(c) > 0) or (os.path.isfile(t) and os.path.getsize(t) > 0):
         return True
     # A login the client moved into the macOS Keychain still counts — deduping must
-    # not throw away the one duplicate that actually holds the grant.
+    # not throw away the one duplicate that actually holds the grant, even one filed
+    # under a name its client no longer reads (the limits pass moves those back).
     try:
-        return keychain.probe(d)['state'] in ('present', 'locked', 'corrupt')
+        return keychain.probe(d, legacy=True)['state'] in ('present', 'locked', 'corrupt')
     except Exception:
         return False
 by_email = {}
@@ -1323,6 +1326,9 @@ cmd_login() {
     if [ -z "$got" ] && [ "$force" != "1" ]; then
       die "signed in, but the account identity could not be read back — refusing to call $id fixed (retry, or pass --force)"
     fi
+    # Only now, with the identity confirmed, may the stale Keychain items go: a sign-in
+    # as the wrong account (died above) must leave every item as it was.
+    keychain_prune "$d"
     clear_auth_markers "$d" keep-token-park
     if [ -s "$d/.credentials.json" ]; then
       echo "$id login saved (.credentials.json, this machine, auto-refreshing)."
@@ -1859,36 +1865,49 @@ class FileStore:
 
 class KeychainStore:
     """The same credential, held in the macOS Keychain by the client itself (see
-    lib/keychain.py). Read and written in place — NEVER copied out to a file: a file
-    beside a Keychain item is a second copy of a ROTATING refresh grant, and the
-    client reads the Keychain first, so the two would drift apart and strand one."""
+    lib/keychain.py). Read from the item the client reads (the canonical name; this
+    pass alone also accepts the legacy first match, which oauth_store moves) and written
+    back under the canonical name, which also drops the siblings holding the grant the
+    refresh started from — NEVER copied out to a file: a file beside a Keychain item is
+    a second copy of a ROTATING refresh grant, and the client reads the Keychain first,
+    so the two would drift apart and strand one."""
     kind = 'keychain'
 
     def __init__(self, d, probe):
         self.d = d
-        self.account = probe.get('account')
+        self.grant = None
+        self.moved = False
 
     def read(self):
-        p = keychain.probe(self.d)
+        p = keychain.probe(self.d, legacy=True)
         if p['state'] != 'present':
             raise ValueError(f'keychain credential {p["state"]}')
+        grant = p['doc']['claudeAiOauth'].get('refreshToken')
+        self.grant = grant if isinstance(grant, str) else None
         return p['doc']
 
     def write(self, doc):
-        if not keychain.write(self.d, doc, account=self.account):
+        if not keychain.write(self.d, doc, supersedes=self.grant):
             raise OSError('keychain write refused')
 
 
 def oauth_store(d):
     """Where <d>'s OAuth login lives for THIS process: a FileStore, a KeychainStore,
     the string 'locked' (Keychain item exists but this session cannot open it), or
-    None. The file wins when both exist — same rule as lib/audit.oauth_login."""
+    None. The file wins when both exist — same rule as lib/audit.oauth_login.
+
+    A Keychain login found only under a name its client no longer reads (a USER-less
+    sign-in's "unknown", lib/keychain.py) is moved under the canonical name here, once:
+    until then the client, the shim and the audit all see no login."""
     cpath = os.path.join(d, '.credentials.json')
     if os.path.isfile(cpath):
         return FileStore(cpath)
-    p = keychain.probe(d)
+    p = keychain.probe(d, legacy=True)
     if p['state'] == 'present':
-        return KeychainStore(d, p)
+        store = KeychainStore(d, p)
+        if p['account'] != p['canonical']:
+            store.moved = keychain.write(d, p['doc'])
+        return store
     if p['state'] == 'locked':
         return 'locked'
     return None
@@ -2096,6 +2115,9 @@ for acct in manifest.get('accounts', []):
     except Exception as e:
         say(f'{aid}: could not locate the oauth credential ({str(e)[:120]}); failing open')
         store = None
+    if getattr(store, 'moved', False):
+        say(f'{aid}: Keychain login moved under {keychain.canonical_account()}, '
+            f'the name its client reads')
     locked = store == 'locked'
     if locked:
         store = None
@@ -2784,6 +2806,9 @@ for acct in manifest.get('accounts', []):
         # The login may be in the macOS Keychain (lib/keychain.py). A Keychain this
         # session cannot open is not a failure of the ACCOUNT: the real call below
         # would fail for the session, not the grant, so it is a skip with a reason.
+        # Only the canonical item counts — the one the client below reads; testing an
+        # item under another name would run the client on a login it cannot see and
+        # park an account its token serves.
         kc = keychain.probe(d)
         if kc['state'] == 'present':
             has_creds, cred_doc = True, kc['doc']

package/bin/codex

@@ -178,6 +178,9 @@ mcp_nested_mirror() {
 if [ -n "${CODEX_HOME:-}" ] \
   || [ "${CODEX_MULTIACC_DISABLE:-0}" = "1" ] || [ -n "${CODEX_SHIM_ACTIVE:-}" ] \
   || [ ! -f "$MANIFEST" ]; then
+  # An auto-resume probe (see "auto-resume" below) asks which account selection would
+  # pick; with no selection to run, the answer is none — it must never start a session.
+  if [ "${CODEX_MULTIACC_AR_PROBE:-0}" = "1" ]; then printf 'pick= tier=none\n'; exit 3; fi
   mcp_nested_mirror "$@" || true
   exec "$REAL" "$@"
 fi
@@ -729,10 +732,388 @@ expired_marked() { # $1 = acct dir
 # refresher / verify / the retry path below — all of which write `.expired`.
 auth_dead() { expired_marked "$1"; }
 
+# ---- auto-resume -------------------------------------------------------------------
+# An interactive codex that runs into a usage limit or a dead login does NOT exit: the
+# TUI stays open on "You've hit your usage limit ... try again at <date>" and waits for a
+# human. Auto-resume moves that session — same session id — onto another pooled account
+# without a keystroke, and it does so without touching the exec below: the real codex
+# still replaces this shim (same pid, same terminal), while a detached watcher
+# (lib/autoresume.py) tails the session's rollout beside it. On a limit/auth verdict the
+# watcher asks THIS shim which account a relaunch would get (probe mode), stops codex, and
+# types ` CODEX_MULTIACC_AR=<token>:<sid> [CODEX_ACCOUNTS_ROOT=<root>] <this shim's path>`
+# into the tmux pane's SHELL — never into the TUI (the pool root only when it is not the
+# default one). The relaunch comes back through here: the token names a single-use relaunch
+# file carrying the verdict and the argv (`resume <kept opts> <sid> <prompt>`); the old
+# account is parked the way the exec retry path below parks one, and ordinary selection
+# picks the next account. bin/claude carries the same hooks; docs/AUTORESUME.md is the
+# reference. Fail open everywhere: nothing here may block before exec — no network, no
+# waiting, no python in the foreground — and every path that cannot finish falls through
+# to exactly today's exec. The one exception is a typed relaunch whose token is gone: it
+# names the session to resume and exits 2, because its own (empty) argv would start a
+# fresh session in the stopped one's place.
+AR_DIR="$ACC_ROOT/tmp/autoresume"
+AR_DEPTH=0          # how many relaunches this session's chain has already taken
+AR_AVOID=""         # acct-NN:until,... — accounts the chain must not land on again
+AR_HIST=""          # class:epoch,... — the chain's verdicts, for the watcher's budgets
+AR_CHAIN=""         # the chain's id, as the watcher named it
+AR_ARGV=()
+AR_ORIG_ARGV=()
+AR_TIER=""          # which cut produced the pick: eligible | soft | hard (probe answer)
+AR_R_SID=""         # the session a relaunch file named, for the dead-token hint
+AR_PROBE=0
+[ "${CODEX_MULTIACC_AR_PROBE:-0}" = "1" ] && AR_PROBE=1
+# Spelled out, never ranges: under a UTF-8 locale bash matches `[a-z]` by collation, so
+# `*[!a-z]*` lets "BAD" and "é" through. These validate what the relaunch file hands us.
+AR_LOWER=abcdefghijklmnopqrstuvwxyz
+AR_ALNUM="ABCDEFGHIJKLMNOPQRSTUVWXYZ${AR_LOWER}0123456789"
+
+# Byte-identical with bin/claude's: a session id is hex and dashes, never an option.
+sess_id_ok() { case "$1" in ''|-*|*[!0-9a-fA-F-]*) return 1 ;; *) return 0 ;; esac; }
+
+ar_uuid_ok() { # $1 — a session id a relaunch may name: a bounded, dashed sess_id_ok
+  sess_id_ok "$1" || return 1
+  [ "${#1}" -le 64 ] || return 1
+  case "$1" in *-*) return 0 ;; esac
+  return 1
+}
+
+ar_word_ok() { # $1 value, $2 min length — [A-Za-z0-9]{min,64}: relaunch tokens, chain ids
+  case "$1" in ''|*[!$AR_ALNUM]*) return 1 ;; esac
+  [ "${#1}" -ge "$2" ] && [ "${#1}" -le 64 ]
+}
+
+ar_avoid_add() { # $1 comma list acct-NN:until -> appended to AR_AVOID, in-force entries only
+  # Every entry is re-validated here because the list arrives from a file or the probe's
+  # environment, and ar_avoided below does arithmetic on the until half.
+  local rest="$1" e id u n=0
+  while [ -n "$rest" ] && [ "$n" -lt 64 ]; do
+    e="${rest%%,*}"
+    case "$rest" in *,*) rest="${rest#*,}" ;; *) rest="" ;; esac
+    n=$((n + 1))
+    id="${e%%:*}"; u="${e#*:}"
+    case "$id" in acct-*[!0-9]*|acct-) continue ;; acct-*) ;; *) continue ;; esac
+    num_ok "$u" && [ "$u" -gt "$now" ] || continue
+    AR_AVOID="${AR_AVOID:+$AR_AVOID,}$id:$u"
+  done
+  return 0
+}
+
+ar_avoided() { # $1 acct dir — true while the relaunch chain asked to skip this account
+  # Fork-free: this runs once per candidate on every invocation, and AR_AVOID is empty
+  # for every launch that is not a relaunch or a probe.
+  local id="${1##*/}" rest="$AR_AVOID" e u
+  while [ -n "$rest" ]; do
+    e="${rest%%,*}"
+    case "$rest" in *,*) rest="${rest#*,}" ;; *) rest="" ;; esac
+    u="${e#*:}"
+    [ "${e%%:*}" = "$id" ] && num_ok "$u" && [ "$u" -gt "$now" ] && return 0
+  done
+  return 1
+}
+
+ar_set_hist() { # $1 comma list class:epoch -> AR_HIST: well-formed entries, newest 32
+  local rest="$1" e c t n=0 i keep=()
+  AR_HIST=""
+  while [ -n "$rest" ] && [ "$n" -lt 256 ]; do
+    e="${rest%%,*}"
+    case "$rest" in *,*) rest="${rest#*,}" ;; *) rest="" ;; esac
+    n=$((n + 1))
+    c="${e%%:*}"; t="${e#*:}"
+    case "$c" in ''|*[!$AR_LOWER]*) continue ;; esac
+    [ "${#c}" -le 16 ] && num_ok "$t" || continue
+    keep+=("$c:$t")
+  done
+  n=${#keep[@]}
+  i=$((n > 32 ? n - 32 : 0))
+  while [ "$i" -lt "$n" ]; do
+    AR_HIST="${AR_HIST:+$AR_HIST,}${keep[$i]}"
+    i=$((i + 1))
+  done
+  return 0
+}
+
+# The watcher's verdict, written in the exec retry path's own marker vocabulary (its park
+# writers at the bottom of this file) and never weakening a park that already reaches
+# further. A QUOTA verdict is only ever a
+# 10-minute error-cooldown, never a client:7d marker: a weekly park is sticky until its
+# reset (codex-accounts keeps it through every telemetry pass), and a watcher that read one
+# rollout line must not pin an account out for days — a peer may have redeemed its reset
+# in the meantime. The scheduled 5-minute limits pass marks the real window properly.
+ar_mark_cooldown() { # $1 acct dir
+  local m="$1/.limited" cur="" until=$((now + 600))
+  if [ -f "$m" ]; then
+    IFS= read -r cur < "$m" 2>/dev/null || cur=""
+    num_ok "$cur" || cur=0
+    [ "$cur" -ge "$until" ] && return 0
+  fi
+  {
+    echo "$until"
+    echo "bucket=error-cooldown percent=? marked_at=$(date -u +%Y-%m-%dT%H:%M:%SZ) reason=error-cooldown"
+  } 2>/dev/null > "$1/.limited.$$" \
+    && mv -f "$1/.limited.$$" "$m" 2>/dev/null \
+    || rm -f "$1/.limited.$$" 2>/dev/null || true
+  return 0
+}
+
+ar_mark_auth() { # $1 acct dir — the retry path's soft auth park (1h, self-healing)
+  local m="$1/.expired" soft=$((now + 3600)) cur
+  # A park still in force that is proven (no soft stamp: codex-accounts' verdict) or
+  # longer (org-blocked's 6h) says more than one failed session does: keep it.
+  if expired_marked "$1"; then
+    cur="$(LC_ALL=C sed -n 's/.*soft_until=\([0-9][0-9]*\).*/\1/p' "$m" 2>/dev/null | head -1)"
+    num_ok "$cur" || return 0
+    [ "$cur" -ge "$soft" ] && return 0
+  fi
+  {
+    echo "$now"
+    echo "reason=auth-error soft_until=$soft marked_at=$(date -u +%Y-%m-%dT%H:%M:%SZ) detail=interactive session failed to authenticate"
+  } 2>/dev/null > "$1/.expired.$$" \
+    && mv -f "$1/.expired.$$" "$m" 2>/dev/null \
+    || rm -f "$1/.expired.$$" 2>/dev/null || true
+  sel_log "$(basename "$1") parked (auth-error until $soft) — see: codex-accounts expired"
+  return 0
+}
+
+# A typed relaunch whose token cannot be honoured (missing, expired, malformed). The
+# watcher has already stopped the session and the typed line carries no argv of its own,
+# so running on would open a FRESH session in its place: say how to get it back, and stop.
+ar_token_dead() { # $1 session id (the token's, else the file's) or empty
+  local sid="$1"
+  ar_uuid_ok "$sid" || sid=""
+  sel_log "autoresume expired sid=${sid:--}"
+  if [ -n "$sid" ]; then
+    printf 'codex-multiacc: auto-resume could not continue automatically (the resume token expired). Resume with: codex resume %s\n' "$sid" >&2
+  else
+    printf 'codex-multiacc: auto-resume could not continue automatically (the resume token expired).\n' >&2
+  fi
+  exit 2
+}
+
+# Relaunch entry: load the single-use relaunch file a watcher left for this token. Sets
+# AR_ARGV (the argv to run) and the AR_* chain state; returns 1 when there is nothing
+# usable (AR_R_SID then holds the file's session id, if it named one).
+ar_relaunch() { # $1 token
+  local tok="$1" base f line k v n=0 a age
+  local ver="" prov="" cls="" acct="" sid="" cwd="" depth="" avoid="" hist="" chain=""
+  ar_word_ok "$tok" 8 || return 1
+  base="$AR_DIR/r-$tok"
+  f="$base.relaunch"
+  if [ ! -f "$f" ]; then
+    rm -f "$base.argv" 2>/dev/null
+    return 1
+  fi
+  while IFS= read -r line || [ -n "$line" ]; do
+    n=$((n + 1)); [ "$n" -le 64 ] || break
+    k="${line%%=*}"; v="${line#*=}"
+    [ "$k" != "$line" ] || continue
+    # Known keys only, each validated before anything can act on it.
+    case "$k" in
+      v) num_ok "$v" && ver="$v" ;;
+      provider) prov="$v" ;;
+      class) case "$v" in ''|*[!$AR_LOWER]*) ;; *) [ "${#v}" -le 16 ] && cls="$v" ;; esac ;;
+      acct) case "$v" in acct-*[!0-9]*|acct-) ;; acct-*) acct="$v" ;; esac ;;
+      sid) ar_uuid_ok "$v" && sid="$v" ;;
+      cwd) case "$v" in /*) cwd="$v" ;; esac ;;
+      depth) num_ok "$v" && depth="$v" ;;
+      avoid) avoid="$v" ;;
+      hist) hist="$v" ;;
+      chain) ar_word_ok "$v" 1 && chain="$v" ;;
+    esac
+  done < "$f"
+  age=$((now - $(file_mtime "$f")))
+  if [ "$ver" != "1" ] || [ "$prov" != "codex" ] || [ "$age" -gt 600 ] || [ ! -f "$base.argv" ]; then
+    rm -f "$f" "$base.argv" 2>/dev/null
+    AR_R_SID="$sid"
+    return 1
+  fi
+  n=0
+  while IFS= read -r -d '' a; do
+    n=$((n + 1)); [ "$n" -le 256 ] || break
+    AR_ARGV+=("$a")
+  done < "$base.argv"
+  rm -f "$f" "$base.argv" 2>/dev/null
+  if [ "${#AR_ARGV[@]}" -eq 0 ]; then
+    AR_R_SID="$sid"
+    return 1
+  fi
+  if [ -n "$acct" ] && [ -d "$ACC_ROOT/$acct" ]; then
+    case "$cls" in
+      quota) ar_mark_cooldown "$ACC_ROOT/$acct" ;;
+      auth) ar_mark_auth "$ACC_ROOT/$acct" ;;
+    esac
+  fi
+  AR_DEPTH="${depth:-0}"
+  ar_avoid_add "$avoid"
+  ar_set_hist "$hist"
+  AR_CHAIN="$chain"
+  if [ -n "$cwd" ] && [ -d "$cwd" ] && [ "$cwd" != "$PWD" ]; then
+    # Everything this shim resolved against the old directory has to survive the cd.
+    case "$ACC_ROOT" in /*) ;; *) ACC_ROOT="$PWD/$ACC_ROOT"; MANIFEST="$ACC_ROOT/accounts.json"; AR_DIR="$ACC_ROOT/tmp/autoresume" ;; esac
+    case "$REAL" in /*) ;; *) REAL="$PWD/$REAL" ;; esac
+    cd "$cwd" 2>/dev/null || true
+  fi
+  # Field 2 is the word `autoresume`, never an account id: lib/report.py and the
+  # *-accounts tools read an acct-NN in field 2 as a pick.
+  sel_log "autoresume relaunch chain=${AR_CHAIN:--} from=${acct:--} class=${cls:--} depth=$AR_DEPTH"
+  return 0
+}
+
+# The argv shapes a relaunch can rebuild as `resume <kept opts> <sid> <prompt>` — anything
+# else (exec/e, -p profile, -c overrides, any subcommand, an unknown flag) gets no watcher.
+# A positional must contain a space to count as a prompt: a single word may be a
+# subcommand.
+ar_argv_ok() { # the argv codex is about to get
+  local a resume=0 sid=0 prompt=0 want=0
+  for a in "$@"; do
+    if [ "$want" = 1 ]; then
+      case "$a" in ''|-*) return 1 ;; esac
+      want=0
+      continue
+    fi
+    case "$a" in
+      --dangerously-bypass-approvals-and-sandbox|--yolo) ;;
+      -m|--model) want=1 ;;
+      --model=?*) ;;
+      --last)
+        [ "$resume" = 1 ] && [ "$sid" = 0 ] || return 1
+        sid=1 ;;
+      resume)
+        [ "$resume" = 0 ] && [ "$prompt" = 0 ] || return 1
+        resume=1 ;;
+      -*) return 1 ;;
+      *)
+        if [ "$resume" = 1 ] && [ "$sid" = 0 ]; then
+          ar_uuid_ok "$a" || return 1          # codex reads it as SESSION_ID
+          sid=1
+        else
+          [ "$prompt" = 0 ] || return 1
+          case "$a" in *" "*) prompt=1 ;; *) return 1 ;; esac
+        fi ;;
+    esac
+  done
+  [ "$want" = 0 ] || return 1
+  # A bare `resume` opens the session picker: there is no session to follow yet.
+  [ "$resume" = 0 ] || [ "$sid" = 1 ]
+}
+
+# The relaunch line is typed into the pane's shell unquoted — this shim's own path, and the
+# pool root when it is not the default — so only paths that never need quoting qualify.
+ar_path_ok() { # $1 absolute path
+  case "$1" in /*) ;; *) return 1 ;; esac
+  case "$1" in *[!$AR_ALNUM/._+-]*) return 1 ;; esac
+  return 0
+}
+
+ar_find_python() { # -> AR_PY, a python3 the watcher can run on. Never RUNS a candidate.
+  AR_PY=""
+  if [ -n "${CODEX_MULTIACC_PYTHON:-}" ] && [ -f "$CODEX_MULTIACC_PYTHON" ] \
+    && [ -x "$CODEX_MULTIACC_PYTHON" ]; then
+    AR_PY="$CODEX_MULTIACC_PYTHON"
+    return 0
+  fi
+  AR_PY="$(command -v python3 2>/dev/null)" || AR_PY=""
+  [ -n "$AR_PY" ] || return 1
+  # macOS ships /usr/bin/python3 as a stub that pops the Command Line Tools installer
+  # when nothing backs it — a GUI dialog out of a background watcher. Only use it when
+  # the CLT python or the developer dir `xcode-select -p` names is actually present, and
+  # find that out with file tests (the xcode_select_link it reads, and Xcode's default
+  # location it falls back to) rather than by running anything.
+  case "${OSTYPE:-}" in darwin*)
+    if [ "$AR_PY" = "/usr/bin/python3" ] \
+      && [ ! -x /Library/Developer/CommandLineTools/usr/bin/python3 ] \
+      && [ ! -d /var/db/xcode_select_link ] \
+      && [ ! -d /Applications/Xcode.app/Contents/Developer ]; then
+      AR_PY=""
+      return 1
+    fi ;;
+  esac
+  return 0
+}
+
+# Gate + spawn, called ONLY from the plain interactive exec at the bottom, immediately
+# before it. Returns without doing anything unless every precondition holds, and never
+# waits on what it starts: the watcher is detached and the exec happens right after.
+ar_spawn_watcher() { # $1 provider, $2 picked acct dir, then the argv codex is about to get
+  local prov="$1" pick="$2" lib st root nl='
+'
+  shift 2
+  case "${CODEX_MULTIACC_AUTORESUME:-1}" in 0|false|no|off) return 1 ;; esac
+  [ -e "$ACC_ROOT/autoresume.off" ] && return 1
+  # A pin is the caller overriding selection. A valid one execs long before this; an
+  # invalid one fell through to a random pick, and moving that session is not ours to do.
+  [ -z "${CODEX_ACCOUNT:-}" ] || return 1
+  if [ "${CODEX_MULTIACC_AR_TEST_TTY:-0}" != "1" ]; then
+    [ -t 0 ] && [ -t 1 ] || return 1
+  fi
+  [ -n "${TMUX:-}" ] && [ -n "${TMUX_PANE:-}" ] || return 1
+  ar_argv_ok "$@" || return 1
+  ar_find_python || return 1
+  lib="$SELF_DIR/../lib/autoresume.py"
+  [ -f "$lib" ] || return 1
+  # The state file is line-oriented key=value: a value carrying a newline cannot be
+  # written faithfully, so such a launch simply goes unsupervised.
+  case "$PWD$TMUX$TMUX_PANE$SELF$ACC_ROOT$pick" in *"$nl"*) return 1 ;; esac
+  root="$ACC_ROOT"
+  case "$root" in /*) ;; *) root="$PWD/$root" ;; esac
+  ar_path_ok "$SELF" && ar_path_ok "$root" || return 1
+  [ -d "$AR_DIR" ] || mkdir -p "$AR_DIR" 2>/dev/null || return 1
+  st="$AR_DIR/$$.state"
+  # The ORIGINAL argv (A2), NUL-separated: the watcher rebuilds the relaunch from it.
+  if [ "${#AR_ORIG_ARGV[@]}" -gt 0 ]; then
+    printf '%s\0' "${AR_ORIG_ARGV[@]}" 2>/dev/null > "$AR_DIR/$$.argv.tmp"
+  else
+    : 2>/dev/null > "$AR_DIR/$$.argv.tmp"
+  fi && mv -f "$AR_DIR/$$.argv.tmp" "$AR_DIR/$$.argv" 2>/dev/null || {
+    rm -f "$AR_DIR/$$.argv.tmp" 2>/dev/null
+    return 1
+  }
+  {
+    printf 'v=1\nprovider=%s\npid=%s\nppid=%s\n' "$prov" "$$" "$PPID"
+    printf 'acct=%s\nacct_dir=%s\ncwd=%s\nlaunched=%s\n' "${pick##*/}" "$pick" "$PWD" "$(date +%s)"
+    printf 'tmux=%s\npane=%s\nself=%s\nacc_root=%s\n' "$TMUX" "$TMUX_PANE" "$SELF" "$root"
+    printf 'depth=%s\navoid=%s\nhist=%s\nchain=%s\n' "$AR_DEPTH" "$AR_AVOID" "$AR_HIST" "$AR_CHAIN"
+  } 2>/dev/null > "$st.tmp" && mv -f "$st.tmp" "$st" 2>/dev/null || {
+    rm -f "$st.tmp" "$AR_DIR/$$.argv" 2>/dev/null
+    return 1
+  }
+  # Detached and never waited on: the subshell returns as soon as the watcher is forked,
+  # and the watcher ignores the terminal's signals until its own setsid().
+  ( trap '' INT QUIT HUP TSTP
+    exec "$AR_PY" -I "$lib" watch --state "$st" </dev/null >/dev/null 2>&1 & ) >/dev/null 2>&1
+  return 0
+}
+
+ar_scrub_env() { # the TUI (and everything it spawns) never sees an auto-resume variable
+  local v
+  for v in ${!CODEX_MULTIACC_AR@}; do
+    case "$v" in CODEX_MULTIACC_AR|CODEX_MULTIACC_AR_*) unset "$v" ;; esac
+  done
+  return 0
+}
+
+# A1 — the relaunch entry, before any selection (the pin included): a token is consumed
+# exactly once, and a probe never consumes one. A2 — the argv selection starts from is
+# what a later relaunch rebuilds; codex never rewrites "$@" after this point.
+# The typed variable is <token>[:<session id>]: the id rides along so a token that cannot
+# be honoured still names the session to resume.
+if [ -n "${CODEX_MULTIACC_AR+x}" ]; then
+  ar_tok="$CODEX_MULTIACC_AR"
+  unset CODEX_MULTIACC_AR
+  if [ "$AR_PROBE" != "1" ] && [ -n "$ar_tok" ]; then
+    ar_sid=""
+    case "$ar_tok" in *:*) ar_sid="${ar_tok#*:}"; ar_tok="${ar_tok%%:*}" ;; esac
+    ar_relaunch "$ar_tok" || ar_token_dead "${ar_sid:-$AR_R_SID}"
+    set -- ${AR_ARGV[@]+"${AR_ARGV[@]}"}
+  fi
+fi
+[ -n "${CODEX_MULTIACC_AR_AVOID:-}" ] && ar_avoid_add "$CODEX_MULTIACC_AR_AVOID"
+AR_ORIG_ARGV=("$@")
+
 # Explicit pin wins over everything — markers, and even missing auth: the
 # add/login ceremony pins to a dir that has no credentials yet, and the login
 # must land exactly there, never in a randomly selected account's dir.
-if [ -n "${CODEX_ACCOUNT:-}" ]; then
+# A probe asks what SELECTION would pick, so it never takes (and never execs) a pin.
+if [ -n "${CODEX_ACCOUNT:-}" ] && [ "$AR_PROBE" != "1" ]; then
   d="$ACC_ROOT/$CODEX_ACCOUNT"
   if [ -d "$d" ]; then
     sel_log "$CODEX_ACCOUNT pinned pwd=$PWD"
@@ -774,6 +1155,9 @@ for d in "$ACC_ROOT"/acct-*; do
     continue
   fi
   over_threshold "$d" && continue
+  # An auto-resume relaunch (or its probe) skips the account the session just left until
+  # the reset it was handed. `eligible` only: the all-limited fallback still sees it.
+  ar_avoided "$d" && continue
   eligible+=("$d")
 done
 
@@ -798,6 +1182,8 @@ fi
 # No usable accounts => stock behavior (fail open, never block work), but say WHY when
 # the pool is merely un-authenticated: this is the one case the user can actually fix.
 if [ "${#valid[@]}" -eq 0 ]; then
+  # A probe has nothing to offer and must never exec (nor log a fallback it never took).
+  if [ "$AR_PROBE" = "1" ]; then printf 'pick= tier=none\n'; exit 3; fi
   if [ "${#expired[@]}" -gt 0 ]; then
     sel_log "all-expired: falling back to the default login (see: codex-accounts expired)"
     # Terminal only: a service-spawned `codex exec` must keep its stderr byte-clean,
@@ -911,6 +1297,7 @@ pick_best() { # args: candidate dirs
 }
 
 if [ "${#eligible[@]}" -gt 0 ]; then
+  AR_TIER=eligible
   if [ "${CODEX_SHIM_SELECT:-headroom}" = "random" ]; then
     PICK_DIR="${eligible[$((RANDOM % ${#eligible[@]}))]}"
     PICK_BAND_COUNT=${#eligible[@]}
@@ -932,12 +1319,16 @@ else
   for d in "${valid[@]}"; do
     if limited_hard_blocked "$d"; then hard+=("$d"); else soft+=("$d"); fi
   done
+  # A probe only ASKS: the fallback lines below would claim a pick nobody launched.
   if [ "${#soft[@]}" -gt 0 ]; then
+    AR_TIER=soft
     PICK_STRICT=1
     pick_best "${soft[@]}"
     PICK_STRICT=0
-    sel_log "all-limited fallback=$(basename "$PICK_DIR") weekly=$(fresh_field "$PICK_DIR" weekly_percent || echo '?')%"
+    [ "$AR_PROBE" = "1" ] \
+      || sel_log "all-limited fallback=$(basename "$PICK_DIR") weekly=$(fresh_field "$PICK_DIR" weekly_percent || echo '?')%"
   else
+    AR_TIER=hard
     # Every account is exhausted RIGHT NOW: nothing serves, so hand out the one that
     # unblocks first — its rejection window is the shortest.
     PICK_DIR=""
@@ -951,11 +1342,12 @@ else
         PICK_DIR="$d"; best_reset="$r"
       fi
     done
-    sel_log "all-limited fallback=$(basename "$PICK_DIR") all-exhausted resets_in=$((best_reset > now ? best_reset - now : 0))s"
+    [ "$AR_PROBE" = "1" ] \
+      || sel_log "all-limited fallback=$(basename "$PICK_DIR") all-exhausted resets_in=$((best_reset > now ? best_reset - now : 0))s"
     # Every candidate rejects right now, so this pick WILL fail: say so on a terminal
     # instead of letting the operator read the client's bare limit error as a bad
     # choice by the pool. Throttled, and never on a service's stderr.
-    if [ -t 2 ]; then
+    if [ -t 2 ] && [ "$AR_PROBE" != "1" ]; then
       exn="$ACC_ROOT/.exhausted-notice"
       exlast=0
       [ -f "$exn" ] && exlast="$(file_mtime "$exn")"
@@ -968,6 +1360,12 @@ else
   fi
 fi
 pick="$PICK_DIR"
+# A probe answers here, before anything that would count as a launch: no rotation
+# memory, no limits kick, no pick line in selection.log — and never an exec.
+if [ "$AR_PROBE" = "1" ]; then
+  printf 'pick=%s tier=%s\n' "${pick##*/}" "$AR_TIER"
+  exit 0
+fi
 # Remember the pick so the NEXT run does not hand back the same account. An explicit
 # CODEX_ACCOUNT pin deliberately does not: a pin is a caller overriding selection,
 # not a turn in the rotation.
@@ -1038,6 +1436,10 @@ fi
 share_state_index "$pick"
 if [ "$wants_retry" = "0" ]; then
   export CODEX_HOME="$pick"
+  # Auto-resume: a gated, detached watcher beside this exec — the exec itself (same pid,
+  # same argv, same environment minus the auto-resume variables) is unchanged.
+  ar_spawn_watcher codex "$pick" "$@" || true
+  ar_scrub_env
   exec "$REAL" "$@"
 fi
 

package/docs/ACCOUNT_OPERATIONS.md

@@ -73,6 +73,11 @@ auto-refreshing login — `.credentials.json`, or on macOS the login Keychain wh
 the session can open it (Claude Code migrates the file into the Keychain on the first
 refresh from a keychain-capable session; ssh sessions then see the account as
 `KEYCHAIN LOCKED` and cannot run it, while the Mac's own session uses it normally).
+The Keychain item is named after `$USER`; the CLI fills it from `id -un` when the caller's
+env has none (a USER-less client files its login under `unknown`, where the next client
+never reads it). The pool judges only the item under that name, as the client does; a
+login found only under another name is moved there by the next limits pass, and a
+sign-in whose identity matched leaves exactly one item, under that name.
 That credential is **machine-local** (never synced),
 which is what keeps two machines from invalidating each other's refresh token — so an
 account you `add` on the Mac runs on the Mac, and you `add` it on the server (over SSH) if
@@ -402,13 +407,14 @@ derived from the pool root. Uninstalling an instance removes only that instance'
 | `CLAUDE_MULTIACC_CLIENT_SCAN_TTL=<s>` | clean client-limit scan cache; default 20s |
 | `CLAUDE_MULTIACC_CLIENT_LIMIT_CONFIRM_DELAY=<s>` | five-hour recovery grace; default 300s (weekly never clears early) |
 | `CLAUDE_SHIM_RETRY=0` | disable the `-p` auto-retry |
+| `CLAUDE_MULTIACC_AUTORESUME=0` | no [auto-resume](AUTORESUME.md) watcher for launches from this environment. `touch <pool>/autoresume.off` also stops running watchers |
 | `CLAUDE_ACCOUNTS_ROOT=...` | relocate the pool; legacy spelling is `CLAUDE_ACCOUNTS_DIR` |
 | `CLAUDE_MULTIACC_SYNC_TARGET=...` | sync target, overriding the manifest; `none` = local-only |
 | `CLAUDE_MULTIACC_SYNC_ROOT=... / _SYNC_REPO=...` | remote pool root / addon repo that goes with it |
 
 The codex shim honors the same switches spelled `CODEX_*`: `CODEX_ACCOUNT`,
 `CODEX_HOME` (passthrough), `CODEX_MULTIACC_DISABLE`, `CODEX_SHIM_RETRY`,
-`CODEX_SHIM_SELECT`, `CODEX_MULTIACC_HEADROOM_BAND`, `CODEX_MULTIACC_SESSION_GATE`,
+`CODEX_MULTIACC_AUTORESUME`, `CODEX_SHIM_SELECT`, `CODEX_MULTIACC_HEADROOM_BAND`, `CODEX_MULTIACC_SESSION_GATE`,
 `CODEX_MULTIACC_CLIENT_LIMIT_CONFIRM_DELAY` (5h client-marker recovery grace, default
 300s — weekly markers never clear early), `CODEX_ACCOUNTS_ROOT` (legacy
 `CODEX_ACCOUNTS_DIR`), `CODEX_MULTIACC_SYNC_TARGET`, `CODEX_MULTIACC_THRESHOLD`.