claude-multiacc 2.0.58 → 2.0.60

package/bin/codex

@@ -119,11 +119,60 @@ mcp_ensure() { # $1 acct dir — silent, never changes the exit status
 # snapshot taken just before). The real CLI's own parser and writer do the work; the shim
 # only copies the outcome. Exits with the real binary's status; a mirror failure is one
 # hint line. Returns 1 when this run is not such a command.
+# The index of the first positional argument as the real CLI's parser (clap) finds it:
+# global options may come first, in any number. The operator's `alias codex='codex
+# --dangerously-bypass-approvals-and-sandbox'` puts one in front of every `codex mcp add`
+# typed at a prompt, and the mirror once looked at $1 alone (bin/claude met the same on
+# 2026-10-22). A value option skips its value (attached `-mX`/`--model=X` is one word); a
+# variadic one every word up to the next option. `--`, or no positional: status 1.
+# Options of codex-cli 0.163 (`codex --help`); an unknown one counts as a flag.
+CLI_VALUE_OPTS=" -c --config --enable --disable --remote --remote-auth-token-env -m --model \
+--local-provider -p --profile -s --sandbox -C --cd --add-dir -a --ask-for-approval "
+CLI_VARIADIC_OPTS=" -i --image "
+cli_positional_at() { # argv -> prints the index of its first positional argument
+  local i=1 a nx
+  while [ "$i" -le "$#" ]; do
+    a="${!i}"
+    case "$a" in
+      --) return 1 ;;
+      --*=*) i=$((i + 1)); continue ;;
+      -?*) ;;
+      *) printf '%s\n' "$i"; return 0 ;;
+    esac
+    i=$((i + 1))
+    case "$CLI_VALUE_OPTS" in *" $a "*) i=$((i + 1)); continue ;; esac
+    case "$CLI_VARIADIC_OPTS" in
+      *" $a "*)
+        while [ "$i" -le "$#" ]; do
+          nx="${!i}"; case "$nx" in -*) break ;; esac; i=$((i + 1))
+        done ;;
+    esac
+  done
+  return 1
+}
+
+# Whether argv is `codex [global options] mcp add|remove …`.
+mcp_mutation_argv() {
+  local i j
+  i="$(cli_positional_at "$@")" || return 1
+  [ "${!i}" = "mcp" ] || return 1
+  j=$((i + 1))
+  # `mcp` takes options of its own before its subcommand: -c/--config, --enable, --disable
+  while :; do
+    case "${!j:-}" in
+      -c|--config|--enable|--disable) j=$((j + 2)) ;;
+      --*=*|-c?*) j=$((j + 1)) ;;
+      *) break ;;
+    esac
+  done
+  case "${!j:-}" in add|remove) return 0 ;; esac
+  return 1
+}
+
 mcp_mirror_run() { # $1 acct dir, then the user's argv — exits when it handled the run
   local d="$1" snap="" rc
   shift
-  [ "${1:-}" = "mcp" ] || return 1
-  case "${2:-}" in add|remove) ;; *) return 1 ;; esac
+  mcp_mutation_argv "$@" || return 1
   [ "${CODEX_MULTIACC_MCP:-1}" != "0" ] && [ -f "$MCP_PY" ] || return 1
   mcp_ensure "$d"
   snap="$(mktemp "${TMPDIR:-/tmp}/codex-mcp-snap.XXXXXX" 2>/dev/null)" || snap=""
@@ -156,8 +205,8 @@ mcp_nested_mirror() {
   [ "${CODEX_MULTIACC_DISABLE:-0}" = "1" ] && return 1
   [ "${CODEX_MULTIACC_MCP:-1}" = "0" ] && return 1
   [ -n "${CODEX_HOME:-}" ] || return 1
-  local verb="${1:-}" cfg="${CODEX_HOME%/}" d=""
-  [ "$verb" = "mcp" ] || return 1
+  local cfg="${CODEX_HOME%/}" d=""
+  mcp_mutation_argv "$@" || return 1
   # A DIRECT child of the pool root, by its given spelling or its physical one (an
   # adopted account is a symlink whose target is the operator's ~/.claude).
   case "$cfg" in
@@ -766,6 +815,7 @@ AR_AVOID_CLAUDE="" AR_AVOID_CODEX="" AR_POOL_CLAUDE="" AR_POOL_CODEX=""
 AR_ARGV=()
 AR_ORIG_ARGV=()
 AR_NO_DAEMON=0
+AR_TRUST=0         # only a consumed automatic relaunch trusts its cwd in the new account
 AR_ROLLOUT_CURSOR=""
 AR_TIER=""          # which cut produced the pick: eligible | soft | hard (probe answer)
 AR_R_SID=""         # the session a relaunch file named, for the dead-token hint
@@ -987,11 +1037,14 @@ ar_relaunch() { # $1 token
   # Field 2 is the word `autoresume`, never an account id: lib/report.py and the
   # *-accounts tools read an acct-NN in field 2 as a pick.
   sel_log "autoresume relaunch chain=${AR_CHAIN:--} from=${acct:--} class=${cls:--} depth=$AR_DEPTH"
+  AR_TRUST=1
   return 0
 }
 
 # The argv shapes a relaunch can rebuild as `resume <kept opts> <sid> <prompt>` — anything
 # else (exec/e, -p profile, -c overrides, any subcommand, an unknown flag) gets no watcher.
+# The one -c a relaunch carries itself is let through: `-c model_reasoning_effort=<level>`,
+# beside `-m`, pins the session's own effort (lib/autoresume.py codex_argv_parse mirrors it).
 # A positional must contain a space to count as a prompt: a single word may be a
 # subcommand.
 ar_argv_ok() { # the argv codex is about to get
@@ -1002,6 +1055,8 @@ ar_argv_ok() { # the argv codex is about to get
         sandbox:read-only) sandbox=1 ;;
         approval:on-request) approval=1 ;;
         model:*) case "$a" in ''|-*) return 1 ;; esac ;;
+        effort:model_reasoning_effort=?*)
+          case "${a#model_reasoning_effort=}" in *[!$AR_LOWER]*) return 1 ;; esac ;;
         *) return 1 ;;
       esac
       want=""
@@ -1013,6 +1068,7 @@ ar_argv_ok() { # the argv codex is about to get
       --sandbox) [ "$sandbox" = 0 ] || return 1; want=sandbox ;;
       --ask-for-approval) [ "$approval" = 0 ] || return 1; want=approval ;;
       -m|--model) want=model ;;
+      -c) want=effort ;;
       --model=?*) ;;
       --last)
         [ "$resume" = 1 ] && [ "$sid" = 0 ] || return 1
@@ -1519,7 +1575,7 @@ export CODEX_SHIM_ACTIVE=1
 
 # A `codex mcp add|remove` is run as a child under the picked account and mirrored to
 # every other one (exits inside); anything else falls through to exec.
-if [ "${1:-}" = "mcp" ]; then
+if mcp_mutation_argv "$@"; then
   share_state_index "$pick"
   export CODEX_HOME="$pick"
   mcp_mirror_run "$pick" "$@" || true
@@ -1554,6 +1610,14 @@ fi
 share_state_index "$pick"
 if [ "$wants_retry" = "0" ]; then
   export CODEX_HOME="$pick"
+  # Folder access is account-local even when the conversation and cwd are unchanged.
+  # Persist the relaunch's trust before Codex starts, without sending keys into its TUI.
+  if [ "$AR_TRUST" = "1" ]; then
+    if ! ar_find_python || ! "$AR_PY" -I "$SELF_DIR/../lib/codex_trust.py" \
+      --acct-dir "$pick" --cwd "$PWD" </dev/null >/dev/null 2>&1; then
+      sel_log "autoresume trust-failed chain=${AR_CHAIN:--} acct=${pick##*/}"
+    fi
+  fi
   # Auto-resume: a gated, detached watcher beside this exec — the exec itself (same pid,
   # same environment minus the auto-resume variables). Supported clients own their
   # task through --no-daemon, including the continuation passed on resume.

package/bin/codex-accounts

@@ -2,7 +2,7 @@
 # codex-accounts — manage the codex-multiacc account pool (OpenAI Codex CLI).
 # Subcommands: list status add import adopt dedupe remove login expired relogin
 #              sync verify limits post-sync health self-update
-#              export-credential import-credential
+#              export-credential import-credential model-catalog
 set -u
 # lib/codex_audit.py is imported by several subcommands; keep the install tree free
 # of __pycache__ (it may be root-owned, read-only, or an npm global prefix).
@@ -98,7 +98,14 @@ USAGE
       stay selectable. Skips accounts fetched in the last 45s and honors
       429/refresh backoff; --force ignores all three.
   codex-accounts health                     limits + full verify; logs to health.log
-  codex-accounts self-update                update this npm/git install; logs to update.log
+  codex-accounts self-update                update this npm/git install (never to an older version); logs to update.log
+  codex-accounts model-catalog [refresh|show] [--if-stale] [--quiet]
+      the model/effort catalog auto-resume relaunches a session with. refresh (the default)
+      merges the catalog this release ships with the model caches the CLIs keep in their
+      account dirs (no request, no credential) into model-catalog.json in BOTH pool roots;
+      every install and self-update runs it, and each limits pass refreshes its own pool's
+      copy once it is an hour old. --if-stale leaves a younger copy alone; --quiet prints
+      nothing. show prints the merged catalog.
   codex-accounts post-sync                  (server side) seed dirs, fix perms, quick verify
   codex-accounts mcp add <name> [--provider claude|codex|both] [--scope user]
                           [-e KEY=VAL]... [-H 'Header: v']... [--transport stdio|http]
@@ -139,6 +146,8 @@ ENV
   CODEX_MULTIACC_DISABLE=1  bypass the shim entirely
   CODEX_MULTIACC_AUTO_RESET=0  disable automatic usage-reset redemption
   CODEX_MULTIACC_MCP=0   disable the MCP registry (no reconcile at seed/launch, no mirror)
+  CODEX_MULTIACC_MODEL_CATALOG=0  never refresh the codex pool's model-catalog.json
+                        (MULTIACC_MODEL_CATALOG=0: neither pool's)
 EOF
 }
 
@@ -1837,6 +1846,10 @@ PYEOF
   # lock while a consumer reads its output.
   codex_limits_lock_release
   trap - EXIT
+  # Every account's MCP servers, adopting what one holds that the registry does not know.
+  mcp_registry_pass
+  # This pool's model catalog, once its copy is an hour old (lib/common.sh).
+  model_catalog_backstop
   # The refresher fails open per account; a NON-zero status means the pass itself
   # broke (unreadable manifest, dead python). Report the state anyway — stale data
   # beats silence — but hand the caller the failure, exactly as before --json existed.
@@ -2251,6 +2264,10 @@ cmd_mcp() {
   local args=()
   case "$sub" in
     add|add-json|remove|list|apply|import-local) shift ;;
+    # Sharing MCP OAuth logins across accounts is a claude-pool feature (lib/mcp_oauth.py):
+    # Codex keeps an MCP server's OAuth state in its own per-account store.
+    auth-status|auth-sync|auth-forget)
+      die "mcp $sub is not supported for the codex pool — MCP OAuth logins are shared across the claude pool only (claude-accounts mcp $sub)" ;;
     "") usage; return 1 ;;
     *) die "unknown mcp subcommand: $sub (add, add-json, remove, list, apply, import-local)" ;;
   esac
@@ -2369,7 +2386,17 @@ cmd_self_update() {
         ulog "self-update: already latest ($cur)"
         return 0
       fi
-      ulog "self-update: npm $cur -> ${lat:-latest} (prefix $prefix, npm $npm_bin)"
+      # Only ever UP, to a version known to be newer (claude-accounts says why): the same
+      # package, so either CLI could otherwise install `latest` over a newer hand install.
+      case "$lat" in [0-9]*.*[0-9]) ;; *)
+        ulog "self-update: could not read the registry's version (npm view); not updating"
+        return 1 ;;
+      esac
+      if ver_newer "$cur" "$lat"; then
+        ulog "self-update: this install ($cur) is newer than the registry's $lat; not downgrading"
+        return 0
+      fi
+      ulog "self-update: npm $cur -> $lat (prefix $prefix, npm $npm_bin)"
       if PATH="$npm_path" "$npm_bin" install -g --prefix "$prefix" claude-multiacc@latest \
            >>"$ACC_ROOT/update.log" 2>&1; then
         after="$(pkg_version_at "$REPO_DIR")"
@@ -2378,6 +2405,7 @@ cmd_self_update() {
           return 1
         fi
         ulog "self-update: npm update ok ($after)"
+        model_catalog_after_update "$quiet"
       else
         ulog "self-update: npm update FAILED (see update.log)"
         return 1
@@ -2441,7 +2469,7 @@ PYEOF
 # distribution for as long as the arg loops rejected the flag. An UNKNOWN verb must still
 # FAIL, or the probe stops meaning what it says — so this list must hold exactly the verbs
 # the dispatcher below implements, and a test pins that both ways.
-_KNOWN_VERBS="list status add import export-credential export-cred import-credential import-cred adopt dedupe remove login expired relogin re-login sync configure verify limits post-sync health self-update init-pool mcp"
+_KNOWN_VERBS="list status add import export-credential export-cred import-credential import-cred adopt dedupe remove login expired relogin re-login sync configure verify limits post-sync health self-update init-pool mcp model-catalog"
 case " $_KNOWN_VERBS " in
   *" ${1:-help} "*)
     # ...but never past a literal `--`: from there on the words belong to an MCP
@@ -2473,6 +2501,7 @@ case "${1:-help}" in
   self-update) shift; cmd_self_update "$@" ;;
   init-pool) shift; cmd_init_pool "$@" ;;
   mcp) shift; cmd_mcp "$@" ;;
+  model-catalog) shift; cmd_model_catalog "$@" ;;
   help|--help|-h) usage ;;
   *) usage; exit 1 ;;
 esac

package/docs/ACCOUNT_OPERATIONS.md

@@ -59,7 +59,9 @@ claude-accounts adopt acct-01
 `adopt` makes the account dir a **symlink to `~/.claude`** — the machine's existing
 login joins the pool with a single credential file (no copy of the OAuth grant exists
 anywhere else, so refreshes can never race). This is how the two current accounts run:
-acct-01 = the Mac's login, acct-02 = the server's login (adopted server-side).
+acct-01 = the Mac's login, acct-02 = the server's login (adopted server-side). It refuses
+an account dir that already holds a credential of its own — any `.credentials.json`, even
+one with only MCP server sign-ins in it, or a `server.token` — rather than delete it.
 
 ### Add a fresh account (~1 min, one browser sign-in)
 
@@ -212,6 +214,62 @@ is applied on the Mac and never synced. `--help` on `mcp` lists every option;
 `CLAUDE_MULTIACC_MCP=0` / `CODEX_MULTIACC_MCP=0` stop the reconcile at seed and launch and the
 shim's mirror (the CLI, sync and fan-out keep working).
 
+### MCP OAuth logins (per machine, shared by every account)
+
+The registry carries a server's CONFIG; an OAuth server's LOGIN lives in each account's
+credential store (`mcpOAuth` in `.credentials.json`, or the account's Keychain item). The
+claude pool shares those logins across every account on the machine through
+`<pool>/mcp-oauth.json` (lib/mcp_oauth.py): authenticate a server once in any account
+(`/mcp` in a session) and every account has it from its next launch. It goes into the store
+each account already has — its `.credentials.json`, or its Keychain item — and an account that
+runs on its setup token with no file gets one created, holding the MCP logins alone (0600):
+in an ssh/tmux session that file is all its client reads them from, and it is no Claude login
+to the shim, the limits pass, the audit or verify (`list` keeps showing `auth=token`). No file
+is created beside a Keychain login, in a parked account (`.expired`) or an adopted dir.
+
+```bash
+claude-accounts mcp auth-status                # server, expiry, source account, refresh state, per-account stores
+claude-accounts mcp auth-sync                  # what the limits pass does every 15 minutes, now
+claude-accounts mcp auth-sync --force          # ...retrying a refresh that is backing off
+claude-accounts mcp auth-forget higgsfield     # deliberate logout, every account on this machine
+```
+
+What to expect, and how to read `auth-status`:
+
+- **fresh / stale / own / stub / missing / absent** per account file or Keychain item. `stale`
+  (a provably older copy), `stub` and `missing` turn `fresh` at that account's next launch (the
+  shim merges before exec) or at the next limits pass; `own` is a login of another grant whose
+  age the expiries cannot settle — left where it is; `locked` means the item exists but this
+  session (ssh, tmux) cannot open it — a Terminal on the Mac, or the scheduled pass, reaches it.
+  An `absent` file turns `fresh` only for a setup-token account (the file is created for it);
+  an absent Keychain item is never created.
+- **NOT shared: …** / **sharing paused: …**: one login in many accounts needs ONE refresher —
+  the pool, ahead of every client — so nothing is shared with
+  `CLAUDE_MULTIACC_MCP_OAUTH_REFRESH=0`, by a launch when no refreshing limits pass ran in the
+  last hour (`mcp auth-sync` runs one now), or for a login inside the clients' own 5-minute
+  window, refused by its server, or whose failing refresh would next try too late. Each
+  account keeps what it holds meanwhile.
+- **NEEDS RE-AUTH**: the authorization server refused the refresh token. Sign in again in any
+  one account (`/mcp`); the new login replaces the old one everywhere. A backoff (`N
+  failure(s), last http 503`) retries by itself, 15 minutes doubling to 6 hours; `refresh: due
+  … — deferred: a copy sits in acct-NN keychain` waits for a pass that can open that item,
+  until 20 minutes before expiry.
+- **Never synced**: each Mac keeps its own grants. A runner Mac, a replica and the source
+  each sign in once; `sync` and the limits fan-out push explicit file lists without it.
+- **Logging out**: a `/mcp` "Clear authentication", `claude mcp login <server>` or a
+  re-authentication in ANY one account revokes the shared login at the server, so the pool
+  retires it in every account (`login: none — retired … (cleared in acct-NN file)`); one
+  sign-in in any account shares the new one. `mcp auth-forget NAME` is the same logout from
+  the operator's side. `codex-accounts mcp auth-*` is not supported (Codex keeps MCP OAuth in
+  its own store).
+- **Rolling it out**: the first share runs at install time (the limits agent starts on
+  install), and a build older than this one reads a shared MCP-only file as a live login:
+  every setup-token account would then say "Not logged in". Install it only where no older
+  build can come back: from the registry once it is published, or by hand at or above the
+  registry's version (npm `self-update` never installs an older one). Until then, hold the
+  sharing with `CLAUDE_MULTIACC_MCP_OAUTH=0` (`launchctl setenv` before the install for the
+  scheduled agents).
+
 ### Pointing sync somewhere else (or nowhere)
 
 The target is no longer baked in. In precedence order:
@@ -332,7 +390,7 @@ emitted for diagnostics.
 | Credential | Where it lives | Class | Can it be copied to another machine? |
 | --- | --- | --- | --- |
 | claude setup-token | `<acct>/server.token` | **portable** | **Yes**; the fleet-distributed credential |
-| claude OAuth login | `<acct>/.credentials.json`, or a macOS Keychain item | machine-local | **No**; refresh tokens rotate |
+| claude OAuth login | `<acct>/.credentials.json`, or a macOS Keychain item, carrying `claudeAiOauth` (MCP OAuth state alone is no login) | machine-local | **No**; refresh tokens rotate |
 | codex ChatGPT login | `<acct>/auth.json` | machine-local | **No**; Codex has no portable credential |
 
 Non-portable accounts are not a dead end: they show up as `credential_class:
@@ -422,6 +480,8 @@ derived from the pool root. Uninstalling an instance removes only that instance'
 | `CLAUDE_MULTIACC_CLIENT_LIMIT_CONFIRM_DELAY=<s>` | five-hour recovery grace; default 300s (weekly never clears early) |
 | `CLAUDE_SHIM_RETRY=0` | disable the `-p` auto-retry |
 | `CLAUDE_MULTIACC_AUTORESUME=0` | no [auto-resume](AUTORESUME.md) watcher for launches from this environment. `touch <pool>/autoresume.off` also stops running watchers |
+| `CLAUDE_MULTIACC_MCP_OAUTH=0` | stop sharing MCP OAuth logins across accounts (no merge before exec, no sync in the limits pass); `auth-status` / `auth-forget` still run |
+| `CLAUDE_MULTIACC_MCP_OAUTH_REFRESH=0` | never refresh MCP OAuth logins — and so share none: a login in many accounts needs ONE refresher, or their clients refresh one rotating grant at once (each account keeps what it holds) |
 | `CLAUDE_ACCOUNTS_ROOT=...` | relocate the pool; legacy spelling is `CLAUDE_ACCOUNTS_DIR` |
 | `CLAUDE_MULTIACC_SYNC_TARGET=...` | sync target, overriding the manifest; `none` = local-only |
 | `CLAUDE_MULTIACC_SYNC_ROOT=... / _SYNC_REPO=...` | remote pool root / addon repo that goes with it |

package/docs/AUTORESUME-HANDOFF.md

@@ -42,9 +42,34 @@ Account avoidance is separate for each provider, so Claude's `acct-01` and Codex
 
 ## Permissions and arguments
 
-The working directory is preserved. Source model names, effort settings, session
-selectors and the original launch prompt are not replayed as destination CLI arguments.
-The destination uses its own configured model.
+The working directory is preserved. Session selectors, the original launch prompt and the
+source's own model and effort flags are not replayed as destination CLI arguments. The
+destination starts on the model and effort of the **same level** instead. Both are read from
+the validated source history, up to its snapshot boundary, and matched through the
+[model catalog](../README.md#auto-resume):
+
+- **Models match by level** (operator's map, 2026-10-14):
+
+  | Codex source | Claude destination | | Claude source | Codex destination |
+  |---|---|---|---|---|
+  | astra | opus | | fable, mythos | astra |
+  | sol | sonnet | | opus | astra |
+  | terra | haiku | | sonnet | sol |
+  | luna | haiku | | haiku | terra |
+
+  The catalog encodes it as levels: Claude haiku 2, sonnet 3, opus 4, fable 5 (mythos counts
+  as fable); Codex luna 1, terra 2, sol 3, astra 4. Equal levels match; a level with no
+  family on the other side (luna, fable) takes the nearest one, the higher on a tie. The
+  match is that family's newest listed model, whatever its version (launches are staggered,
+  so a family a release behind is still its own level). A retiring model counts as the model
+  the catalog upgrades it to.
+- **Efforts match by name.** low, medium, high, xhigh and max carry over unchanged. Codex's
+  `ultra` becomes `max`, and `minimal` or `none` becomes `low`. The result is clamped to the
+  destination model: the nearest supported level below, else its lowest.
+- **Unknown means the destination's default.** A model or effort the history does not
+  record, or the catalog cannot place, is left out, and the destination CLI applies its own
+  default. Claude takes either flag alone. Codex takes both or neither, with the matched
+  model's default effort when only the model is known.
 
 An explicit permission bypass maps to the equivalent destination bypass. Merely allowing
 a bypass flag is not treated as enabling it. Ordinary launches use explicit conservative