claude-multiacc 2.0.57 → 2.0.59

package/bin/claude-accounts

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # claude-accounts — manage the claude-multiacc account pool.
 # Subcommands: list status add import remove mint sync verify limits post-sync health
-#              expired relogin export-credential import-credential
+#              expired relogin export-credential import-credential model-catalog
 set -u
 # lib/audit.py is imported by several subcommands; keep the install tree free of
 # __pycache__ (it may be root-owned, read-only, or an npm global prefix).
@@ -97,7 +97,14 @@ USAGE
       Skips accounts fetched in the last 45s and honors 429/refresh backoff;
       --force ignores all three.
   claude-accounts health                    limits + full verify + shim-on-PATH probe; logs to health.log
-  claude-accounts self-update               update this npm/git install; logs to update.log
+  claude-accounts self-update               update this npm/git install (never to an older version); logs to update.log
+  claude-accounts model-catalog [refresh|show] [--if-stale] [--quiet]
+      the model/effort catalog auto-resume relaunches a session with. refresh (the default)
+      merges the catalog this release ships with the model caches the CLIs keep in their
+      account dirs (no request, no credential) into model-catalog.json in BOTH pool roots;
+      every install and self-update runs it, and each limits pass refreshes its own pool's
+      copy once it is an hour old. --if-stale leaves a younger copy alone; --quiet prints
+      nothing. show prints the merged catalog.
   claude-accounts post-sync                 (server side) seed dirs, fix perms, quick verify
   claude-accounts mcp add <name> [--provider claude|codex|both] [--scope user|project]
                           [--project PATH] [-e KEY=VAL]... [-H 'Header: v']...
@@ -123,6 +130,22 @@ USAGE
                                             re-apply the registry now (repair drift)
   claude-accounts mcp import-local --owner NAME   (stdin JSON) machine-local overlay for
                                             a runner daemon; applied here, never synced
+  claude-accounts mcp auth-status [--json]  MCP OAuth logins shared across THIS machine's
+      accounts: per server the pool's login (expiry, source account, refresh state, why
+      it is not shared), per account whether its file / Keychain item holds it (fresh,
+      stale, own, stub, missing, absent). A server authenticated once in ANY account
+      works in every account: the shim merges the newest login into the picked account's
+      stores before exec (a setup-token account with no .credentials.json gets one holding
+      the MCP logins alone; a Keychain item is never created), and every limits pass
+      refreshes it ahead of expiry and shares it into all of them. Never prints a token.
+  claude-accounts mcp auth-sync [--force]   harvest + refresh what is due + share now, one
+                                            line per server (--force: retry a refresh
+                                            that is backing off)
+  claude-accounts mcp auth-forget <server-name>
+      log that server out of EVERY account on this machine. A /mcp "Clear
+      authentication", `claude mcp login` or re-authentication in ANY one account
+      revokes the shared login at the server too, so the pool retires it everywhere;
+      one sign-in in any account then shares the new login
 
 ENV
   CLAUDE_ACCOUNTS_ROOT  pool root, overriding ~/.claude-accounts — one isolated pool
@@ -136,6 +159,12 @@ ENV
   CLAUDE_MULTIACC_DISABLE=1  bypass the shim entirely
   CLAUDE_MULTIACC_AUTO_RESET=0  disable automatic limit-reset redemption
   CLAUDE_MULTIACC_MCP=0  disable the MCP registry (no reconcile at seed/launch, no mirror)
+  CLAUDE_MULTIACC_MCP_OAUTH=0  stop sharing MCP OAuth logins (no merge at launch, no
+                        sync in the limits pass); CLAUDE_MULTIACC_MCP_OAUTH_REFRESH=0
+                        never refreshes them — and so shares none: one shared login
+                        needs one refresher
+  CLAUDE_MULTIACC_MODEL_CATALOG=0  never refresh the claude pool's model-catalog.json
+                        (MULTIACC_MODEL_CATALOG=0: neither pool's)
   CLAUDE_MULTIACC_RESET_MIN_HORIZON  a reset is held while every park lifts on
                         its own within this many seconds (default 3600)
 EOF
@@ -432,6 +461,9 @@ for a in doc.get('accounts', []):
             print(f"  oauth creds : unreadable ({e})")
     elif login['store'] == 'keychain':
         print(f"  oauth creds : in the macOS Keychain — {login['reason']}")
+    elif login['reason']:
+        # e.g. a .credentials.json the client wrote with MCP server state only
+        print(f"  oauth creds : none on this machine — {login['reason']}")
     else:
         print("  oauth creds : none on this machine")
     tpath = os.path.join(d, 'server.token')
@@ -706,6 +738,36 @@ add_cleanup_reserved() {
   mutate_unlock 2>/dev/null || true
 }
 
+# Write the credentials document <src> INTO <dest>, the account's .credentials.json
+# (0600, atomic): <src>'s top-level keys replace <dest>'s and every other key stays — the
+# client keeps its MCP servers' OAuth state (mcpOAuth) in that same file. Fails, leaving
+# <dest> as it was, when <src> is not a JSON object.
+creds_merge_into() { # $1 = source document, $2 = destination .credentials.json
+  "$PYBIN" - "$1" "$2" <<'PYEOF'
+import json, os, sys
+src, dest = sys.argv[1], sys.argv[2]
+try:
+    new = json.load(open(src))
+except Exception:
+    sys.exit(1)
+if not isinstance(new, dict):
+    sys.exit(1)
+try:
+    cur = json.load(open(dest))
+except Exception:
+    cur = None
+doc = dict(cur) if isinstance(cur, dict) else {}
+doc.update(new)
+tmp = f'{dest}.tmp.{os.getpid()}'
+fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+with os.fdopen(fd, 'w') as f:
+    json.dump(doc, f)
+    f.flush()
+    os.fsync(f.fileno())
+os.replace(tmp, dest)
+PYEOF
+}
+
 cmd_import() {
   require_manifest
   local email="${1:-}"
@@ -735,6 +797,10 @@ cmd_import() {
   # Validate ALL inputs before creating anything, so a bad token/creds path leaves no
   # half-made account dir behind.
   [ -n "$creds" ] && { [ -f "$creds" ] || die "credentials file not found: $creds"; }
+  # ...and a credentials file is a login only when it carries one: the client's MCP
+  # OAuth state alone would register an account with nothing to authenticate by.
+  [ -n "$creds" ] && { creds_file_has_login "$creds" \
+    || die "credentials file holds no Claude login (no claudeAiOauth): $creds"; }
   case "$mode" in copy|move|link) ;; *) die "mode must be copy|move|link" ;; esac
   local tok=""
   if [ -n "$token_file" ]; then
@@ -756,11 +822,19 @@ cmd_import() {
     fi
   fi
   if [ -n "$creds" ]; then
-    case "$mode" in
-      copy) cp "$creds" "$d/.credentials.json" ;;
-      move) mv "$creds" "$d/.credentials.json" ;;
-      link) ln -sf "$(canon_path "$creds")" "$d/.credentials.json" ;;
-    esac
+    if [ "$mode" != "link" ] && [ -s "$d/.credentials.json" ] && [ ! -L "$d/.credentials.json" ]; then
+      # The account's file may already hold its MCP servers' OAuth state: the imported
+      # login lands INTO it rather than signing every one of them out.
+      creds_merge_into "$creds" "$d/.credentials.json" \
+        || die "could not merge $creds into $d/.credentials.json — nothing imported"
+      [ "$mode" = "move" ] && rm -f "$creds"
+    else
+      case "$mode" in
+        copy) cp "$creds" "$d/.credentials.json" ;;
+        move) mv "$creds" "$d/.credentials.json" ;;
+        link) ln -sf "$(canon_path "$creds")" "$d/.credentials.json" ;;
+      esac
+    fi
     chmod 600 "$d/.credentials.json" 2>/dev/null || true
   fi
   if [ -n "$tok" ]; then
@@ -783,13 +857,14 @@ import json, os, re, sys
 manifest, root = sys.argv[1], sys.argv[2]
 sys.path = [sys.argv[3]] + [p for p in sys.path if p not in ('', '.')]
 import keychain  # noqa: E402  (macOS Keychain-held logins; a no-op elsewhere)
+from audit import file_has_login  # noqa: E402  (a login, not MCP state alone)
 accts = [a for a in json.load(open(manifest)).get('accounts', [])
          if isinstance(a, dict) and re.fullmatch(r'acct-\d{2}', str(a.get('id', '')))]
 def has_auth(aid):
     d = os.path.join(root, aid)
     c = os.path.join(d, '.credentials.json')
     t = os.path.join(d, 'server.token')
-    if (os.path.isfile(c) and os.path.getsize(c) > 0) or (os.path.isfile(t) and os.path.getsize(t) > 0):
+    if file_has_login(c) or (os.path.isfile(t) and os.path.getsize(t) > 0):
         return True
     # A login the client moved into the macOS Keychain still counts — deduping must
     # not throw away the one duplicate that actually holds the grant, even one filed
@@ -863,7 +938,7 @@ cmd_adopt() {
   valid_acct_id "$id" || die "not a valid account id: $id"
   account_ids | grep -qx "$id" || die "unknown account: $id (import it first)"
   local d="$ACC_ROOT/$id" default="$HOME/.claude"
-  [ -f "$default/.credentials.json" ] || die "no default login at $default to adopt"
+  creds_file_has_login "$default/.credentials.json" || die "no default login at $default to adopt"
   # Seed the config-dir state file inside ~/.claude (CLAUDE_CONFIG_DIR mode reads
   # <dir>/.claude.json, while default mode uses ~/.claude.json at HOME level).
   if [ ! -f "$default/.claude.json" ] && [ -f "$HOME/.claude.json" ]; then
@@ -883,7 +958,11 @@ PYEOF
     return 0
   fi
   if [ -d "$d" ]; then
-    [ -f "$d/.credentials.json" ] && die "$id already has its own credentials — refusing to replace with adopt"
+    # ANY credential refuses, not only a login: the rm below destroys what the dir holds,
+    # and the client keeps its MCP servers' OAuth grants in .credentials.json even beside
+    # no login at all (2.1.303) — while a portable token is a credential in its own right.
+    { [ -f "$d/.credentials.json" ] || [ -s "$d/server.token" ]; } \
+      && die "$id already has its own credentials — refusing to replace with adopt"
     rm -rf "${ACC_ROOT:?}/${id:?}"
   fi
   ln -s "$default" "$d"
@@ -1356,7 +1435,9 @@ cmd_login() {
     # as the wrong account (died above) must leave every item as it was.
     keychain_prune "$d"
     clear_auth_markers "$d" keep-token-park
-    if [ -s "$d/.credentials.json" ]; then
+    # Where the login landed: the file only when it carries one — beside a Keychain
+    # login it may hold the client's MCP server state alone.
+    if creds_file_has_login "$d/.credentials.json"; then
       echo "$id login saved (.credentials.json, this machine, auto-refreshing)."
     else
       echo "$id login saved (macOS Keychain, this machine, auto-refreshing — sessions without keychain access, e.g. ssh, cannot use it)."
@@ -1583,6 +1664,27 @@ os.execv(sys.argv[1], [sys.argv[1], "limits-distribute-now"])
   return 0
 }
 
+# MCP OAuth logins (lib/mcp_oauth.py), once per pass: harvest every account's store,
+# refresh what is due (two hours ahead, or half a shorter lifetime) — the ONE refresher,
+# long before any client's own 5-minute window, because refresh tokens rotate — and share
+# the newest login into every account's existing stores. Its beat is what the shim's merge
+# shares behind, so a pool whose pass stops running stops spreading logins. Machine-local
+# (nothing here is pushed anywhere), so a replica runs it too. Detached the same way as
+# the telemetry push, so neither the pass nor a `--json` caller waits on a token
+# endpoint; the sync bounds itself and fails open.
+mcp_oauth_kick() {
+  [ "${CLAUDE_MULTIACC_MCP_OAUTH:-1}" = "0" ] && return 0
+  [ -f "$LIB_DIR/mcp_oauth.py" ] || return 0
+  "$PYBIN" -c '
+import os, sys
+if os.fork():
+    sys.exit(0)
+os.setsid()
+os.execv(sys.executable, [sys.executable] + sys.argv[1:])
+' "$LIB_DIR/mcp_oauth.py" sync --root "$ACC_ROOT" --quiet >/dev/null 2>&1 </dev/null &
+  return 0
+}
+
 token_identities_check() {
   # A source may always use Keychain OAuth locally while its peers use setup tokens.
   # Prove those tokens before distributing telemetry, even if nobody launched them here.
@@ -1639,7 +1741,8 @@ limits_distribute_now() {
   done
   # The MCP registry rides along: a server the shim mirrored from a stock `claude mcp
   # add` reaches every peer within one limits cadence, with no explicit sync. The
-  # machine-local overlay stays home (see sync_push_target).
+  # machine-local overlay stays home (see sync_push_target), and so does mcp-oauth.json:
+  # its MCP OAuth grants belong to this machine (lib/mcp_oauth.py).
   [ -f "$ACC_ROOT/mcp-servers.json" ] && printf 'mcp-servers.json\n' >> "$list"
   if [ ! -s "$list" ]; then rm -f "$list"; return 0; fi
 
@@ -1726,7 +1829,7 @@ cmd_limits() {
 import hashlib, json, os, sys, time, urllib.request
 sys.path = [sys.argv[6]] + [p for p in sys.path if p not in ('', '.')]
 import keychain  # noqa: E402  (macOS Keychain-held logins; a no-op elsewhere)
-from audit import creds_doc_state, org_block_in_force  # noqa: E402  (one rule for "can this credential work")
+from audit import creds_doc_state, file_has_login, org_block_in_force  # noqa: E402  (one rule for "can this credential work")
 import claude_reset  # noqa: E402  (automatic limit-reset redemption, the codex_reset twin)
 
 root, threshold, quiet, url, force = sys.argv[1], int(sys.argv[2]), sys.argv[3] == '1', sys.argv[4], sys.argv[5] == '1'
@@ -1905,20 +2008,66 @@ def park_dead_grant(aid, d, slug, detail):
     say(f'{aid}: {detail} — re-login needed (claude-accounts relogin {aid})')
 
 
+# The client's own write lock: proper-lockfile's DIRECTORY <dir>/.storage-write.lock, stale
+# after 15 s (lib/mcp_oauth.py ClientLock). Claude Code takes it around every write of its
+# credential document, file or Keychain item alike — re-read, one change, the whole
+# document back — and its write FAILS after about 7.5 s of retries on a held lock. So the
+# refresher never holds it across the token POST: a lock held when a refresh would start
+# skips that refresh (nothing has rotated yet; the next pass retries), and the
+# check-and-set and the write take it after the POST, waiting longer, because a rotated
+# grant must land: past the wait (or with no helper) it is written as before, without it.
+try:
+    from mcp_oauth import CLIENT_LOCK, CLIENT_LOCK_STALE_S, ClientLock  # noqa: E402
+except Exception:  # noqa: BLE001 — fail open: refresh exactly as before, unlocked
+    ClientLock = None
+CLIENT_LOCK_PROBE_S = 1.0   # a client's write takes milliseconds: held this long, it is busy
+CLIENT_LOCK_WAIT_S = 10.0
+
+
+def client_lock_busy(d):
+    """A live writer holds <d>'s client lock, and still does CLIENT_LOCK_PROBE_S later."""
+    if ClientLock is None:
+        return False
+    path = os.path.join(d, CLIENT_LOCK)
+    deadline = time.monotonic() + CLIENT_LOCK_PROBE_S
+    while True:
+        try:
+            if time.time() - os.stat(path).st_mtime > CLIENT_LOCK_STALE_S:
+                return False             # its holder is gone; the write takes it over
+        except OSError:
+            return False                 # no lock: nobody is writing
+        if time.monotonic() >= deadline:
+            return True
+        time.sleep(0.05)
+
+
 class FileStore:
-    """The OAuth credential as `.credentials.json`: atomic 0600 writes."""
+    """The OAuth credential as `.credentials.json`: atomic 0600 writes. The client keeps
+    its MCP servers' OAuth state (mcpOAuth, mcpOAuthClientConfig) in this same file, so
+    a write lands INTO the document as it is at that moment: the keys it is given replace
+    theirs, every other key stays (the last good read stands in for a file caught
+    mid-write). Replacing it would sign every MCP server of the account out."""
     kind = 'file'
 
     def __init__(self, path):
         self.path = path
+        self.base = None
 
     def read(self):
-        return json.load(open(self.path))
+        doc = json.load(open(self.path))
+        self.base = doc if isinstance(doc, dict) else None
+        return doc
 
     def write(self, doc):
+        try:
+            cur = json.load(open(self.path))
+        except Exception:
+            cur = self.base
+        merged = dict(cur) if isinstance(cur, dict) else {}
+        merged.update(doc)
         fd = os.open(self.path + '.tmp', os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
         with os.fdopen(fd, 'w') as f:
-            json.dump(doc, f)
+            json.dump(merged, f)
             f.flush()
             os.fsync(f.fileno())
         os.replace(self.path + '.tmp', self.path)
@@ -1931,7 +2080,8 @@ class KeychainStore:
     back under the canonical name, which also drops the siblings holding the grant the
     refresh started from — NEVER copied out to a file: a file beside a Keychain item is
     a second copy of a ROTATING refresh grant, and the client reads the Keychain first,
-    so the two would drift apart and strand one."""
+    so the two would drift apart and strand one. keychain.write lands INTO the item, so
+    its MCP state stays as it is."""
     kind = 'keychain'
 
     def __init__(self, d, probe):
@@ -1955,19 +2105,35 @@ class KeychainStore:
 def oauth_store(d):
     """Where <d>'s OAuth login lives for THIS process: a FileStore, a KeychainStore,
     the string 'locked' (Keychain item exists but this session cannot open it), or
-    None. The file wins when both exist — same rule as lib/audit.oauth_login.
+    None. The file wins when it holds a login — same rule as lib/audit.oauth_login; one
+    holding only MCP state is no login store, and the Keychain is asked instead.
 
     A Keychain login found only under a name its client no longer reads (a USER-less
     sign-in's "unknown", lib/keychain.py) is moved under the canonical name here, once:
     until then the client, the shim and the audit all see no login."""
     cpath = os.path.join(d, '.credentials.json')
-    if os.path.isfile(cpath):
+    if file_has_login(cpath):
         return FileStore(cpath)
     p = keychain.probe(d, legacy=True)
     if p['state'] == 'present':
         store = KeychainStore(d, p)
         if p['account'] != p['canonical']:
-            store.moved = keychain.write(d, p['doc'])
+            # INTO the item the client reads: MCP state it already holds stays as it is;
+            # the stranded item's own comes along only where that item has none. Under
+            # the client's lock, like the refresher's write (a held one is waited on, then
+            # the move goes ahead: until it lands no client can see this login at all).
+            lock = ClientLock(d, CLIENT_LOCK_WAIT_S) if ClientLock is not None else None
+            try:
+                held = lock is not None and lock.acquire()
+            except Exception:  # noqa: BLE001
+                held = False
+            try:
+                here = keychain.probe(d).get('doc') or {}
+                store.moved = keychain.write(d, {k: v for k, v in p['doc'].items()
+                                                 if k == 'claudeAiOauth' or k not in here})
+            finally:
+                if held:
+                    lock.release()
         return store
     if p['state'] == 'locked':
         return 'locked'
@@ -1984,10 +2150,11 @@ def refresh_oauth(aid, d, store):
     spath = os.path.join(d, '.oauth-refresh.json')
     try:
         doc = store.read()
-        o = doc.get('claudeAiOauth', {})
+        o = doc.get('claudeAiOauth') if isinstance(doc, dict) else None
         # Present-but-null/non-object claudeAiOauth (interrupted or reset credential
-        # write) must degrade THIS account only, like every other malformed input.
-        if not isinstance(doc, dict) or not isinstance(o, dict):
+        # write) must degrade THIS account only, like every other malformed input; and a
+        # document with no login in it at all (MCP state alone) has nothing to refresh.
+        if not isinstance(o, dict):
             return None
     except Exception:
         return None
@@ -2026,6 +2193,12 @@ def refresh_oauth(aid, d, store):
             pass
         say(f'{aid}: oauth refresh failed ({why}); backing off {wait}s; limits left as-is')
 
+    if client_lock_busy(d):
+        # The client is writing this credential right now (it may be its own refresh of
+        # the same grant): no request is sent, so nothing rotates, and no backoff is noted.
+        say(f'{aid}: oauth refresh skipped — the client holds its credential lock '
+            f'({CLIENT_LOCK}); the next pass retries')
+        return None
     started_with = o['refreshToken']
     body = json.dumps({'grant_type': 'refresh_token',
                        'refresh_token': o['refreshToken'],
@@ -2086,25 +2259,39 @@ def refresh_oauth(aid, d, store):
         o['expiresAt'] = int((now + 3600) * 1000)
     if data.get('refresh_token_expires_in'):
         o['refreshTokenExpiresAt'] = int((now + float(data['refresh_token_expires_in'])) * 1000)
-    doc['claudeAiOauth'] = o
     # CHECK-AND-SET. The grant rotates, and a live claude session refreshes the same
     # file. REFRESH_MIN_EXPIRED makes that unlikely, not impossible — and losing the
     # race by overwriting means the session's newer credential is destroyed. If the
     # on-disk refresh token is no longer the one this grant was issued against, the
-    # other writer won: keep its result, discard ours.
+    # other writer won: keep its result, discard ours. Both under the client's own lock,
+    # so no client write lands between the check and the write.
+    lock = ClientLock(d, CLIENT_LOCK_WAIT_S) if ClientLock is not None else None
     try:
-        disk = store.read().get('claudeAiOauth', {})
-        if isinstance(disk, dict) and disk.get('refreshToken') != started_with:
-            say(f'{aid}: credential was refreshed by something else mid-flight — '
-                f'keeping the newer one in the {store.kind}')
-            return None
-    except Exception:
-        pass
+        held = lock is not None and lock.acquire()
+    except Exception:  # noqa: BLE001 — the rotated grant lands either way
+        held = False
+    if lock is not None and not held and os.path.isdir(lock.path):
+        say(f'{aid}: the client kept its credential lock ({CLIENT_LOCK}) past '
+            f'{int(CLIENT_LOCK_WAIT_S)}s — writing the rotated login without it')
     try:
-        store.write(doc)
-    except Exception as e:
-        say(f'{aid}: token refreshed but credentials NOT persisted ({e}) — re-login may be needed')
-        return None
+        try:
+            disk = store.read().get('claudeAiOauth', {})
+            if isinstance(disk, dict) and disk.get('refreshToken') != started_with:
+                say(f'{aid}: credential was refreshed by something else mid-flight — '
+                    f'keeping the newer one in the {store.kind}')
+                return None
+        except Exception:
+            pass
+        try:
+            # Only the login is ours: both stores write it INTO the document as it is now,
+            # so the MCP state the client saved meanwhile (mcpOAuth) is never rolled back.
+            store.write({'claudeAiOauth': o})
+        except Exception as e:
+            say(f'{aid}: token refreshed but credentials NOT persisted ({e}) — re-login may be needed')
+            return None
+    finally:
+        if held:
+            lock.release()
     try:
         os.remove(spath)
     except OSError:
@@ -2779,6 +2966,10 @@ PYEOF
   # Whoever just refreshed is the only machine that CAN — pass it on before the
   # report, so a blind peer stops picking drained accounts within one cycle.
   limits_distribute
+  # This machine's MCP OAuth logins: harvested, refreshed when due, shared (detached).
+  mcp_oauth_kick
+  # This pool's model catalog, once its copy is an hour old (lib/common.sh).
+  model_catalog_backstop
   # The refresher fails open per account; a NON-zero status means the pass itself
   # broke (unreadable manifest, dead python). Report the state anyway — stale data
   # beats silence — but hand the caller the failure, exactly as before --json existed.
@@ -2802,7 +2993,7 @@ import hashlib, json, os, re, subprocess, sys, time
 root, quick, real = sys.argv[1], sys.argv[2] == '1', sys.argv[3]
 sys.path = [sys.argv[4]] + [p for p in sys.path if p not in ('', '.')]
 from audit import (audit_account, creds_state, creds_doc_state,  # noqa: E402  (shared with the shim's rule)
-                   marker_slug, org_block_in_force)
+                   file_has_login, marker_slug, org_block_in_force)
 import keychain  # noqa: E402
 from claude_token_identity import check_identity  # noqa: E402
 from claude_reset import cli_version  # noqa: E402
@@ -2933,7 +3124,10 @@ for acct in manifest.get('accounts', []):
     d = os.path.join(root, aid)
     cpath = os.path.join(d, '.credentials.json')
     tpath = os.path.join(d, 'server.token')
-    has_creds = os.path.isfile(cpath)
+    # A login, not merely a file: one holding the client's MCP state alone is no
+    # credential to test — testing "it" ran the client with nothing to authenticate by,
+    # and its "Not logged in" parked the account (the shim's file_login, 2026-10-19).
+    has_creds = file_has_login(cpath)
     has_token = os.path.isfile(tpath) and os.path.getsize(tpath) > 0
     cred_doc = None
     cred_state = None
@@ -3087,7 +3281,9 @@ PYEOF
 # A target can be the Linux server (token-authenticated) or a peer Mac (which has
 # its own machine-local OAuth logins) — the pushed material is valid on both:
 # manifest, portable server.token files, seeds, and advisory limit state.
-# Credentials (.credentials.json) are NEVER pushed anywhere.
+# Credentials (.credentials.json) are NEVER pushed anywhere — nor is the pool's
+# mcp-oauth.json, which holds this machine's MCP OAuth grants (lib/mcp_oauth.py): a
+# rotating refresh token used from two machines strands one of them.
 sync_push_target() {
   local server="$1" sroot="$2" srepo="$3"
   slog "push -> $server:$sroot"
@@ -3317,8 +3513,9 @@ cmd_mcp() {
   local args=()
   case "$sub" in
     add|add-json|remove|list|apply|import-local) shift ;;
+    auth-status|auth-sync|auth-forget) shift; cmd_mcp_auth "$sub" "$@"; return $? ;;
     "") usage; return 1 ;;
-    *) die "unknown mcp subcommand: $sub (add, add-json, remove, list, apply, import-local)" ;;
+    *) die "unknown mcp subcommand: $sub (add, add-json, remove, list, apply, import-local, auth-status, auth-sync, auth-forget)" ;;
   esac
   [ -f "$LIB_DIR/mcp_registry.py" ] || die "lib/mcp_registry.py is missing from this install"
   case "$sub" in
@@ -3389,6 +3586,24 @@ cmd_mcp() {
   return "$rc"
 }
 
+# MCP OAuth logins shared across THIS machine's accounts (lib/mcp_oauth.py) — the claude
+# pool alone, and never the sibling hop above: the store is <pool>/mcp-oauth.json of the
+# pool this CLI was pinned to, and nothing about it is synced.
+cmd_mcp_auth() { # $1 = auth-status|auth-sync|auth-forget, then its options
+  local sub="$1"
+  shift
+  [ -f "$LIB_DIR/mcp_oauth.py" ] || die "lib/mcp_oauth.py is missing from this install"
+  case "$sub" in
+    auth-status)
+      "$PYBIN" "$LIB_DIR/mcp_oauth.py" status --root "$ACC_ROOT" "$@" ;;
+    auth-sync)
+      "$PYBIN" "$LIB_DIR/mcp_oauth.py" sync --root "$ACC_ROOT" "$@" ;;
+    auth-forget)
+      [ $# -ge 1 ] || die "usage: $PROVIDER_CLI mcp auth-forget <server-name>"
+      "$PYBIN" "$LIB_DIR/mcp_oauth.py" forget --root "$ACC_ROOT" "$@" ;;
+  esac
+}
+
 cmd_post_sync() {
   require_manifest
   local_pool_fixup
@@ -3442,7 +3657,21 @@ cmd_self_update() {
         ulog "self-update: already latest ($cur)"
         return 0
       fi
-      ulog "self-update: npm $cur -> ${lat:-latest} (prefix $prefix, npm $npm_bin)"
+      # Only ever UP, and only to a version known to be newer. A copy installed by hand ahead
+      # of the registry (this Mac's builds, while npm publishing is down) must survive the
+      # app-robot loop that calls this every 10 minutes: installing `latest` over it swapped
+      # in a build that misreads state the newer one had already written (MCP-only
+      # credential files: every setup-token account "Not logged in"). An unreadable registry
+      # answer is no licence to install blind either.
+      case "$lat" in [0-9]*.*[0-9]) ;; *)
+        ulog "self-update: could not read the registry's version (npm view); not updating"
+        return 1 ;;
+      esac
+      if ver_newer "$cur" "$lat"; then
+        ulog "self-update: this install ($cur) is newer than the registry's $lat; not downgrading"
+        return 0
+      fi
+      ulog "self-update: npm $cur -> $lat (prefix $prefix, npm $npm_bin)"
       if PATH="$npm_path" "$npm_bin" install -g --prefix "$prefix" claude-multiacc@latest \
            >>"$ACC_ROOT/update.log" 2>&1; then
         # Verify by re-reading the file on disk. npm reporting success says nothing
@@ -3453,6 +3682,7 @@ cmd_self_update() {
           return 1
         fi
         ulog "self-update: npm update ok ($after)"
+        model_catalog_after_update "$quiet"
       else
         ulog "self-update: npm update FAILED (see update.log)"
         return 1
@@ -3504,7 +3734,7 @@ $shim_out"
 # distribution for as long as the arg loops rejected the flag. An UNKNOWN verb must still
 # FAIL, or the probe stops meaning what it says — so this list must hold exactly the verbs
 # the dispatcher below implements, and a test pins that both ways.
-_KNOWN_VERBS="list status add import export-credential export-cred import-credential import-cred adopt dedupe remove mint login expired relogin re-login sync verify limits post-sync health self-update mcp"
+_KNOWN_VERBS="list status add import export-credential export-cred import-credential import-cred adopt dedupe remove mint login expired relogin re-login sync verify limits post-sync health self-update mcp model-catalog"
 case " $_KNOWN_VERBS " in
   *" ${1:-help} "*)
     # ...but never past a literal `--`: from there on the words belong to an MCP
@@ -3537,6 +3767,7 @@ case "${1:-help}" in
   health) shift; cmd_health "$@" ;;
   self-update) shift; cmd_self_update "$@" ;;
   mcp) shift; cmd_mcp "$@" ;;
+  model-catalog) shift; cmd_model_catalog "$@" ;;
   help|--help|-h) usage ;;
   *) usage; exit 1 ;;
 esac

package/bin/codex

@@ -766,6 +766,7 @@ AR_AVOID_CLAUDE="" AR_AVOID_CODEX="" AR_POOL_CLAUDE="" AR_POOL_CODEX=""
 AR_ARGV=()
 AR_ORIG_ARGV=()
 AR_NO_DAEMON=0
+AR_TRUST=0         # only a consumed automatic relaunch trusts its cwd in the new account
 AR_ROLLOUT_CURSOR=""
 AR_TIER=""          # which cut produced the pick: eligible | soft | hard (probe answer)
 AR_R_SID=""         # the session a relaunch file named, for the dead-token hint
@@ -987,11 +988,14 @@ ar_relaunch() { # $1 token
   # Field 2 is the word `autoresume`, never an account id: lib/report.py and the
   # *-accounts tools read an acct-NN in field 2 as a pick.
   sel_log "autoresume relaunch chain=${AR_CHAIN:--} from=${acct:--} class=${cls:--} depth=$AR_DEPTH"
+  AR_TRUST=1
   return 0
 }
 
 # The argv shapes a relaunch can rebuild as `resume <kept opts> <sid> <prompt>` — anything
 # else (exec/e, -p profile, -c overrides, any subcommand, an unknown flag) gets no watcher.
+# The one -c a relaunch carries itself is let through: `-c model_reasoning_effort=<level>`,
+# beside `-m`, pins the session's own effort (lib/autoresume.py codex_argv_parse mirrors it).
 # A positional must contain a space to count as a prompt: a single word may be a
 # subcommand.
 ar_argv_ok() { # the argv codex is about to get
@@ -1002,6 +1006,8 @@ ar_argv_ok() { # the argv codex is about to get
         sandbox:read-only) sandbox=1 ;;
         approval:on-request) approval=1 ;;
         model:*) case "$a" in ''|-*) return 1 ;; esac ;;
+        effort:model_reasoning_effort=?*)
+          case "${a#model_reasoning_effort=}" in *[!$AR_LOWER]*) return 1 ;; esac ;;
         *) return 1 ;;
       esac
       want=""
@@ -1013,6 +1019,7 @@ ar_argv_ok() { # the argv codex is about to get
       --sandbox) [ "$sandbox" = 0 ] || return 1; want=sandbox ;;
       --ask-for-approval) [ "$approval" = 0 ] || return 1; want=approval ;;
       -m|--model) want=model ;;
+      -c) want=effort ;;
       --model=?*) ;;
       --last)
         [ "$resume" = 1 ] && [ "$sid" = 0 ] || return 1
@@ -1554,6 +1561,14 @@ fi
 share_state_index "$pick"
 if [ "$wants_retry" = "0" ]; then
   export CODEX_HOME="$pick"
+  # Folder access is account-local even when the conversation and cwd are unchanged.
+  # Persist the relaunch's trust before Codex starts, without sending keys into its TUI.
+  if [ "$AR_TRUST" = "1" ]; then
+    if ! ar_find_python || ! "$AR_PY" -I "$SELF_DIR/../lib/codex_trust.py" \
+      --acct-dir "$pick" --cwd "$PWD" </dev/null >/dev/null 2>&1; then
+      sel_log "autoresume trust-failed chain=${AR_CHAIN:--} acct=${pick##*/}"
+    fi
+  fi
   # Auto-resume: a gated, detached watcher beside this exec — the exec itself (same pid,
   # same environment minus the auto-resume variables). Supported clients own their
   # task through --no-daemon, including the continuation passed on resume.