claude-multiacc 2.0.58 → 2.0.60

package/lib/autoresume_cross.py

@@ -85,9 +85,11 @@ def plan_fallback(watcher, verdict, source_avoid):
     if shared_source(watcher):
         watcher.hold(verdict, reason='shared-source')
         return None
+    # Both pool roots feed the model catalog, so the target argv (probed below exactly as it will
+    # launch) pins the same-level model: a Claude target's model-scoped buckets judge that model.
     handoff = build_handoff(watcher.provider, target, watcher.argv, watcher.sid, watcher.transcript,
                             watcher.session_cwd(), inode=watcher.tail.ino if watcher.tail else None,
-                            prompt_override=watcher.cfg.prompt)
+                            prompt_override=watcher.cfg.prompt, roots=roots)
     if not handoff:
         watcher.hold(verdict, reason='handoff-history-or-permissions')
         return None

package/lib/autoresume_handoff.py

@@ -2,6 +2,9 @@
 
 The watcher already knows the source conversation; this module never searches for a
 replacement by directory or recency. It returns launch data without mutating either pool.
+The target starts on the model and effort of the same level as the source session, read
+from that validated history up to its snapshot boundary and matched through the catalog;
+anything unknown leaves the target CLI on its own defaults.
 """
 
 import json
@@ -14,6 +17,10 @@ PROVIDERS = ("claude", "codex")
 SID_RE = re.compile(r"^[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$")
 MAX_SOURCE_BYTES = 4 << 20
 PROMPT_PREFIX = "(claude-multiacc auto-resume)"
+# Only argv-safe values leave a history: never option-shaped, no whitespace or control text,
+# and an effort is a plain lowercase word -- what bin/codex accepts after model_reasoning_effort=.
+MODEL_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:/@+\[\]-]{0,199}$")
+EFFORT_RE = re.compile(r"^[a-z]{1,32}$")
 
 
 def _read_source(path, inode):
@@ -113,7 +120,7 @@ def validate_source(provider, sid, path, cwd, inode=None):
 
 
 def _permission_argv(source, argv):
-    """Map explicit permission intent, never models or provider-specific resume flags."""
+    """Map explicit permission intent, never the source's model flags or resume flags."""
     # Import lazily: autoresume imports this helper while initializing its own parsers.
     from autoresume import claude_argv_parse, codex_argv_parse
 
@@ -139,7 +146,57 @@ def _permission_argv(source, argv):
     return ["--sandbox", "read-only", "--ask-for-approval", "on-request"]
 
 
-def handoff_prompt(history, target, prompt_override=None):
+def _no_settings():
+    return {"source": {"model": None, "effort": None}, "target": {"model": None, "effort": None}, "flags": []}
+
+
+def _clean(values):
+    model, effort = (values or {}).get("model"), (values or {}).get("effort")
+    return {"model": model if isinstance(model, str) and MODEL_RE.fullmatch(model) else None,
+            "effort": effort if isinstance(effort, str) and EFFORT_RE.fullmatch(effort) else None}
+
+
+def mapped_settings(history, target, roots=None):
+    """``{source, target, flags}``: the source session's model/effort as its validated history
+    recorded them up to the snapshot boundary, the same-level target match, and the target argv
+    that pins it. ``roots`` ({provider: pool root}) feeds the catalog. Fail-open: an unreadable
+    history, an unknown model or any catalog error yields no flags, never a failed handoff."""
+    result = _no_settings()
+    try:
+        from session_settings import session_settings
+        source = _clean(session_settings(history["provider"], history["path"], upto=history["offset"]))
+        result["source"] = source
+        if source["model"] is None:
+            return result
+        from model_catalog import load
+        from model_match import resume_settings, settings_flags
+        catalog = load(roots)
+        target_settings = _clean(resume_settings(history["provider"], source, target, catalog))
+        # An effort name the target vocabulary does not know is omitted, not passed through.
+        if target_settings["effort"] not in ((catalog.get(target) or {}).get("efforts") or ()):
+            target_settings["effort"] = None
+        flags = settings_flags(target, target_settings["model"], target_settings["effort"])
+        if isinstance(flags, list) and all(isinstance(arg, str) for arg in flags):
+            result.update(target=target_settings, flags=list(flags))
+    except Exception:  # noqa: BLE001 -- fail open: the target keeps its own model defaults
+        return _no_settings()
+    return result
+
+
+def _settings_sentence(target, settings):
+    """Name the source model/effort and the matched target ones, only when the argv pins a model."""
+    source, matched = settings.get("source") or {}, settings.get("target") or {}
+    if not (source.get("model") and matched.get("model") and settings.get("flags")):
+        return ""
+
+    def named(values):
+        effort = values.get("effort")
+        return values["model"] + " (" + ("effort " + effort if effort else "default effort") + ")"
+    return (" Source model: " + named(source) + ". This conversation runs the matching " + target + " model "
+            + named(matched) + ".")
+
+
+def handoff_prompt(history, target, prompt_override=None, settings=None):
     """Mandatory identifiers and history instructions remain present with any override."""
     source = history["provider"]
     text = (
@@ -157,6 +214,8 @@ def handoff_prompt(history, target, prompt_override=None):
         "has not sent a new message. Background work may have stopped or may still be running. Inspect "
         "its state before relying on it or restarting it, and do not duplicate active or completed work."
     )
+    if settings:
+        text += _settings_sentence(target, settings)
     if isinstance(prompt_override, str) and prompt_override.strip() and not any(
             character in prompt_override for character in "\0\n\r"):
         text += " Additional continuation instruction: " + prompt_override.replace(
@@ -164,8 +223,8 @@ def handoff_prompt(history, target, prompt_override=None):
     return text
 
 
-def handoff_argv(source_provider, target_provider, original_argv, history, prompt_override=None):
-    """Fresh target argv, or None for unsupported source options or permission intent."""
+def _handoff(source_provider, target_provider, original_argv, history, prompt_override, roots):
+    """(target argv, mapped settings), or None for unsupported source options or permission intent."""
     if source_provider not in PROVIDERS or target_provider not in PROVIDERS or source_provider == target_provider:
         return None
     if not isinstance(history, dict) or history.get("provider") != source_provider:
@@ -179,13 +238,26 @@ def handoff_argv(source_provider, target_provider, original_argv, history, promp
     if not isinstance(original_argv, (list, tuple)) or not all(isinstance(arg, str) for arg in original_argv):
         return None
     options = _permission_argv(source_provider, original_argv)
-    return None if options is None else options + [handoff_prompt(history, target_provider, prompt_override)]
+    if options is None:
+        return None
+    settings = mapped_settings(history, target_provider, roots)
+    prompt = handoff_prompt(history, target_provider, prompt_override, settings)
+    # Permission options first, then the model pins; the prompt stays the last argument.
+    return options + settings["flags"] + [prompt], settings
+
+
+def handoff_argv(source_provider, target_provider, original_argv, history, prompt_override=None, roots=None):
+    """Fresh target argv, or None for unsupported source options or permission intent."""
+    built = _handoff(source_provider, target_provider, original_argv, history, prompt_override, roots)
+    return None if built is None else built[0]
 
 
-def build_handoff(source_provider, target_provider, argv, sid, transcript, cwd, inode=None, prompt_override=None):
-    """Validate source history and return ``{argv, history}`` without changing any state."""
+def build_handoff(source_provider, target_provider, argv, sid, transcript, cwd, inode=None, prompt_override=None,
+                  roots=None):
+    """Validate source history and return ``{argv, history, models}`` without changing any state;
+    ``models`` is the :func:`mapped_settings` result the argv was built from."""
     history = validate_source(source_provider, sid, transcript, cwd, inode)
     if history is None:
         return None
-    target_argv = handoff_argv(source_provider, target_provider, argv, history, prompt_override)
-    return None if target_argv is None else {"argv": target_argv, "history": history}
+    built = _handoff(source_provider, target_provider, argv, history, prompt_override, roots)
+    return None if built is None else {"argv": built[0], "history": history, "models": built[1]}

package/lib/autoresume_probe.py

@@ -4,7 +4,7 @@ import re
 
 
 ACCT_RE = re.compile(r"^acct-[A-Za-z0-9._-]{1,64}$")
-# These errors require a different account; transient/crash may retry the same one.
+# These errors require a different account; transient/crash/memory may retry the same one.
 ROTATE = ("quota", "auth", "blocked", "model")
 PROBE_DROP = {
     "claude": ("CLAUDE_CONFIG_DIR", "CLAUDE_CODE_OAUTH_TOKEN", "CLAUDE_SHIM_ACTIVE",
@@ -41,7 +41,7 @@ def probe_allows(cls, pick, tier, current):
 
     The shim excludes chain-avoided accounts from soft fallback, and treats exhausted
     accounts and observed client rejections as hard. Other rotation classes keep their
-    below-threshold requirement; transient/crash may retry anywhere still usable.
+    below-threshold requirement; transient/crash/memory may retry anywhere still usable.
     """
     if cls == "quota":
         return tier in ("eligible", "soft", "credits") and bool(pick) and pick != current

package/lib/claude_client_error.py

@@ -48,7 +48,14 @@ def iso_epoch(value):
 
 
 def newest_error(lines, claim, org_cleared=0):
-    """Return the newest org refusal, otherwise auth error, as (slug, ISO timestamp)."""
+    """Return the newest org refusal, otherwise auth error, as (slug, ISO timestamp).
+
+    `org_cleared` is the last time `claude-accounts verify` saw a real call reach the
+    account (.client-org-cleared, written by lift_park): the credential the pool runs it
+    on authenticated, for an organization that admits Claude Code. No error recorded at
+    or before it counts. Applied to org refusals alone, an older authentication failure
+    re-parked the account that very PASS had lifted (2026-10-19).
+    """
     claimed_at = iso_epoch(claim)
     if claimed_at is None:
         return None
@@ -71,9 +78,7 @@ def newest_error(lines, claim, org_cleared=0):
         code = record.get("error")
         slug = ERRORS.get(code) if isinstance(code, str) else None
         at = iso_epoch(record.get("timestamp"))
-        if not slug or at is None or at < claimed_at:
-            continue
-        if slug == "org-blocked" and at <= cleared_at:
+        if not slug or at is None or at < claimed_at or at <= cleared_at:
             continue
         if at >= latest.get(slug, (float("-inf"), ""))[0]:
             latest[slug] = (at, record["timestamp"])

package/lib/codex_trust.py

@@ -0,0 +1,263 @@
+#!/usr/bin/env python3
+"""Trust a directory in a Codex account's config.toml before an automatic relaunch starts there.
+
+Codex (0.162) looks a folder up under ``[projects."<path>"] trust_level`` -- the canonical
+spelling of the cwd first, then the literal cwd, then the git root's spellings -- and opens
+on "Folder access / Trust this folder?" when no entry carries a trust level. Nobody watches a
+relaunched pane, and the watcher never keys a TUI, so bin/codex runs this for a consumed
+relaunch token right before its exec: the logical $PWD, its physical path and the on-disk
+spelling macOS reports for it (Codex canonicalises with realpath(3), which returns the stored
+case and Unicode form; Python's realpath keeps the caller's) all get ``trust_level =
+"trusted"`` in the picked account, exactly as Codex itself writes it. An explicit
+``"untrusted"`` answer is overridden too: it was one account's one-time dialog answer, and a
+relaunch nobody is watching has to continue.
+
+Standalone on purpose: the shim runs it with ``-I`` under whatever python3 the watcher found
+(3.9 on a stock Mac), so no sibling imports, and tomllib only when present -- it then proves
+the edit (parse before == parse after, plus the trust keys). The edit is line-based and
+touches nothing but the one assignment: every other byte of the file, its key order, its
+comments and its mode survive. Layouts the edit could corrupt (``projects`` defined at the
+root as an inline table or dotted keys, a bare ``[projects]`` table, a project table defined
+twice) are refused.
+
+Exit 0: the directory is trusted now, or already was. Exit 1: the file was left as it was
+(unreadable, invalid, an unsupported layout, or rewritten by someone else between the read
+and the write); the shim logs that and the continuation still needs its prompt receipt.
+Exit 2: usage.
+"""
+
+import json
+import os
+import re
+import stat
+import sys
+import tempfile
+
+LINE = 'trust_level = "trusted"\n'
+BOM = "\ufeff"
+HEADER = re.compile(r'^\s*\[\s*projects\s*\.\s*(?:"((?:[^"\\]|\\.)*)"|\'([^\']*)\')\s*\]\s*(?:#.*)?$')
+ANY_HEADER = re.compile(r'^\s*\[')
+BARE_PROJECTS = re.compile(r'^\s*\[\s*projects\s*\]')
+ROOT_PROJECTS = re.compile(r'^\s*(?:projects|"projects"|\'projects\')\s*[.=]')
+TRUST_KEY = re.compile(r'^\s*(?:trust_level|"trust_level"|\'trust_level\')\s*=')
+TRUSTED = re.compile(r'^\s*(?:trust_level|"trust_level"|\'trust_level\')\s*=\s*(?:"trusted"|\'trusted\')\s*(?:#.*)?$')
+ROOT = object()
+
+
+class Unsupported(Exception):
+    """A config.toml layout this edit refuses to touch."""
+
+
+def _decode_key(match):
+    """The project path a ``[projects."..."]`` header names; None when its escapes are not
+    ones this reader understands (such a table is treated as somebody else's)."""
+    basic, literal = match.group(1), match.group(2)
+    if literal is not None:
+        return literal
+    try:
+        basic = re.sub(r'\\U([0-9A-Fa-f]{8})', lambda m: chr(int(m.group(1), 16)), basic)
+        return json.loads('"' + basic + '"')
+    except (ValueError, OverflowError):
+        return None
+
+
+def _scan(lines):
+    """path -> [header line, first trust_level line or None, already trusted] for every
+    ``[projects."<path>"]`` table. Raises Unsupported for the layouts the edit must not touch."""
+    found, current = {}, ROOT
+    for index, line in enumerate(lines):
+        if current is ROOT and ROOT_PROJECTS.match(line):
+            raise Unsupported("projects defined at the root")
+        if BARE_PROJECTS.match(line):
+            raise Unsupported("a bare [projects] table")
+        match = HEADER.match(line)
+        if match:
+            current = _decode_key(match)
+            if current in found:
+                raise Unsupported("a project table defined twice")
+            if current is not None:
+                found[current] = [index, None, False]
+            continue
+        if ANY_HEADER.match(line):
+            current = None
+            continue
+        if current not in (ROOT, None) and found[current][1] is None and TRUST_KEY.match(line):
+            found[current][1] = index
+            found[current][2] = bool(TRUSTED.match(line))
+    return found
+
+
+def _lines(text):
+    """Lines broken on LF only: TOML knows no other line break, while str.splitlines also
+    breaks on U+2028, U+0085 and friends, which may sit inside a string value."""
+    parts = text.split("\n")
+    lines = [part + "\n" for part in parts[:-1]]
+    if parts[-1]:
+        lines.append(parts[-1])
+    return lines
+
+
+def _quote(key):
+    """A TOML basic string for ``key``: JSON's escapes with non-ASCII left raw (a JSON
+    ``\\ud83d`` surrogate pair is not TOML) and DEL escaped (raw U+007F is not either)."""
+    return json.dumps(key, ensure_ascii=False).replace("\x7f", "\\u007F")
+
+
+def trusted_text(text, keys):
+    """``text`` with ``trust_level = "trusted"`` under ``[projects."<key>"]`` for every key,
+    and whether anything had to change. An existing assignment is replaced in place, a table
+    without one gets it right under its header, a missing table is appended. Raises
+    Unsupported (see _scan)."""
+    lines = _lines(text)
+    found = _scan(lines)
+    edits, tail = [], []
+    for key in keys:
+        if key not in found:
+            if key not in tail:
+                tail.append(key)
+            continue
+        header, trust_at, trusted = found[key]
+        if not trusted:
+            edits.append((header, LINE) if trust_at is None else (trust_at, None))
+    if not edits and not tail:
+        return text, False
+    for index, insert in sorted(edits, key=lambda edit: edit[0], reverse=True):
+        if insert is None:
+            lines[index] = LINE
+            continue
+        if not lines[index].endswith("\n"):
+            lines[index] += "\n"
+        lines.insert(index + 1, insert)
+    if tail and lines and not lines[-1].endswith("\n"):
+        lines[-1] += "\n"
+    for key in tail:
+        lines.append(("\n" if lines else "") + "[projects.%s]\n%s" % (_quote(key), LINE))
+    return "".join(lines), True
+
+
+def _verify(before, after, keys):
+    """With a TOML parser at hand, the edited text must parse to the original document plus
+    the trust keys and nothing else; without one the structural checks in _scan stand alone."""
+    try:
+        import tomllib
+    except ImportError:
+        try:
+            import tomli as tomllib
+        except ImportError:
+            return True
+    try:
+        expected, got = tomllib.loads(before), tomllib.loads(after)
+    except (tomllib.TOMLDecodeError, ValueError):
+        return False
+    projects = expected.setdefault("projects", {})
+    if not isinstance(projects, dict):
+        return False
+    for key in keys:
+        entry = projects.setdefault(key, {})
+        if not isinstance(entry, dict):
+            return False
+        entry["trust_level"] = "trusted"
+    return got == expected
+
+
+def _write(path, text, st):
+    """Atomic replace keeping the file's mode; a new file is created 0600 and only if nobody
+    created it meanwhile. A file rewritten since it was read (Codex writes its own config
+    whenever it likes) is left alone rather than lost to a stale copy."""
+    if st is None:
+        try:
+            handle = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+            with os.fdopen(handle, "w", encoding="utf-8") as fh:
+                fh.write(text)
+            return True
+        except OSError:
+            return False
+    try:
+        handle, scratch = tempfile.mkstemp(prefix=".config.toml.", dir=os.path.dirname(path))
+    except OSError:
+        return False
+    try:
+        with os.fdopen(handle, "w", encoding="utf-8") as fh:
+            os.fchmod(fh.fileno(), stat.S_IMODE(st.st_mode))
+            fh.write(text)
+        now = os.stat(path)
+        if (now.st_mtime_ns, now.st_size, now.st_ino) != (st.st_mtime_ns, st.st_size, st.st_ino):
+            raise OSError("config.toml changed meanwhile")
+        os.replace(scratch, path)
+        return True
+    except OSError:
+        try:
+            os.unlink(scratch)
+        except OSError:
+            pass
+        return False
+
+
+def spellings(cwd):
+    """The keys Codex may look the directory up under: as given, Python's realpath, and the
+    on-disk spelling (macOS F_GETPATH; the form realpath(3) returns there)."""
+    keys = [cwd]
+    real = os.path.realpath(cwd)
+    if real not in keys:
+        keys.append(real)
+    try:
+        import fcntl
+        handle = os.open(real, os.O_RDONLY)
+        try:
+            disk = os.fsdecode(fcntl.fcntl(handle, fcntl.F_GETPATH, b"\0" * 1024)).rstrip("\0")
+        finally:
+            os.close(handle)
+        if disk and disk not in keys:
+            keys.append(disk)
+    except (ImportError, AttributeError, OSError, UnicodeError):
+        pass
+    return keys
+
+
+def trust(acct_dir, cwd):
+    """Exit status for ``--acct-dir <acct_dir> --cwd <cwd>`` (see the module docstring)."""
+    if not os.path.isabs(cwd or "") or not os.path.isdir(acct_dir or ""):
+        return 1
+    path = os.path.join(acct_dir, "config.toml")
+    st, text = None, ""
+    try:
+        if os.path.lexists(path):
+            path = os.path.realpath(path)
+            if not stat.S_ISREG(os.stat(path).st_mode):
+                return 1  # a FIFO or a device would hang the relaunch on open()
+        with open(path, "rb") as fh:
+            st = os.fstat(fh.fileno())
+            text = fh.read().decode("utf-8")
+    except FileNotFoundError:
+        pass
+    except (OSError, UnicodeDecodeError):
+        return 1
+    bom = text.startswith(BOM)
+    text = text[len(BOM):] if bom else text
+    try:
+        result, changed = trusted_text(text, spellings(cwd))
+    except Unsupported:
+        return 1
+    if not changed:
+        return 0
+    if not _verify(text, result, spellings(cwd)):
+        return 1
+    return 0 if _write(path, (BOM if bom else "") + result, st) else 1
+
+
+def main(argv):
+    opts, i = {}, 0
+    while i < len(argv):
+        if argv[i] not in ("--acct-dir", "--cwd") or i + 1 >= len(argv) or argv[i] in opts:
+            opts = None
+            break
+        opts[argv[i]] = argv[i + 1]
+        i += 2
+    if opts is None or len(opts) != 2:
+        sys.stderr.write("usage: codex_trust.py --acct-dir <account dir> --cwd <directory>\n")
+        return 2
+    return trust(opts["--acct-dir"], opts["--cwd"])
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

package/lib/common.sh

@@ -139,6 +139,25 @@ pkg_version_at() {
   sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$1/package.json" | head -1
 }
 
+# Whether version $1 is NEWER than $2: dotted numbers compared part by part, a missing part
+# counting as 0. False for anything else (empty, a suffix, a part over nine digits): only a
+# version this can read is ever called newer. Builtins only.
+ver_newer() { # ver_newer <a> <b>
+  local a="$1" b="$2" x y
+  case "$a" in ''|*[!0-9.]*|.*|*.|*..*) return 1 ;; esac
+  case "$b" in ''|*[!0-9.]*|.*|*.|*..*) return 1 ;; esac
+  while [ -n "$a$b" ]; do
+    x="${a%%.*}"; y="${b%%.*}"
+    case "$a" in *.*) a="${a#*.}" ;; *) a="" ;; esac
+    case "$b" in *.*) b="${b#*.}" ;; *) b="" ;; esac
+    [ "${#x}" -le 9 ] && [ "${#y}" -le 9 ] || return 1
+    x=$((10#${x:-0})); y=$((10#${y:-0}))
+    [ "$x" -gt "$y" ] && return 0
+    [ "$x" -lt "$y" ] && return 1
+  done
+  return 1
+}
+
 # The npm that owns THIS install, resolved without trusting the ambient PATH.
 # A launchd agent (and a bare cron) runs with PATH=/usr/bin:/bin:/usr/sbin:/sbin —
 # no homebrew, no nvm — so `command -v npm` fails there and the daily self-update
@@ -465,23 +484,37 @@ has_local_auth() { # $1 = acct dir
   if [ "$MULTIACC_PROVIDER" = "codex" ]; then
     [ -s "$1/auth.json" ]
   else
-    [ -f "$1/.credentials.json" ] || [ -s "$1/server.token" ] || keychain_has_login "$1"
+    creds_file_has_login "$1/.credentials.json" || [ -s "$1/server.token" ] \
+      || keychain_has_login "$1"
   fi
 }
 
+# A claude credentials document is a LOGIN only when it carries a `claudeAiOauth` object.
+# The client keeps its MCP servers' OAuth state (`mcpOAuth`) in the same file, and from a
+# session that cannot open the Keychain it writes one holding ONLY that (2.1.303): no
+# login, whatever its entries' own expiry says. bin/claude's file_login is the same
+# check (the shim sources nothing); lib/audit.py file_has_login is the python twin.
+creds_file_has_login() { # $1 = a .credentials.json path
+  local doc="" LC_ALL=C re='"claudeAiOauth"[[:space:]]*:[[:space:]]*[{]'
+  [ -s "$1" ] || return 1
+  { doc="$(< "$1")"; } 2>/dev/null
+  [[ $doc =~ $re ]]
+}
+
 # ---- macOS Keychain-held logins (claude only) ------------------------------------
 # Claude Code on macOS moves a config dir's OAuth login into the login Keychain the
 # first time a GUI-session process can write there, deleting .credentials.json as it
 # goes (lib/keychain.py has the whole story). These wrap that module so bash callers
 # never parse `security` output themselves. Each one is a no-op (absent) off macOS.
-keychain_state() { # $1 = acct dir -> prints present|locked|absent|corrupt|unavailable
+keychain_state() { # $1 = acct dir -> prints present|nologin|locked|absent|corrupt|unavailable
   local state
   [ "$MULTIACC_PROVIDER" = "codex" ] && { echo absent; return 0; }
   state="$("$PYBIN" "$LIB_DIR/keychain.py" probe "$1" 2>/dev/null \
     | LC_ALL=C sed -n 's/.*"state": *"\([a-z]*\)".*/\1/p' | head -1)"
   printf '%s\n' "${state:-unavailable}"
 }
-keychain_has_login() { # $1 = acct dir: an item EXISTS here (readable or locked)
+keychain_has_login() { # $1 = acct dir: a login item EXISTS here (readable or locked); an
+                        # item holding MCP state alone ('nologin') is none
   case "$(keychain_state "$1")" in present|locked|corrupt) return 0 ;; *) return 1 ;; esac
 }
 keychain_forget() { # $1 = acct dir: drop every item (a removed account must not leave a grant behind)
@@ -738,6 +771,21 @@ seed_mcp_registry() { # $1 = acct dir
   return 0
 }
 
+# Once per scheduled limits pass: reconcile EVERY account, which first adopts what any
+# one of them holds that the registry does not know (lib/mcp_registry.py adopt) — the
+# backstop for a server added where the shims' mirror never saw it, reaching accounts no
+# session launched on since. Unlike the shims' pre-exec apply it also runs before this
+# pool has a registry at all. Inline, quiet, fail-open: a pass never dies on it.
+mcp_registry_pass() {
+  local off
+  if [ "$MULTIACC_PROVIDER" = "codex" ]; then off="${CODEX_MULTIACC_MCP:-1}"; else off="${CLAUDE_MULTIACC_MCP:-1}"; fi
+  [ "$off" = "0" ] && return 0
+  [ -f "$LIB_DIR/mcp_registry.py" ] || return 0
+  "$PYBIN" "$LIB_DIR/mcp_registry.py" --root "$ACC_ROOT" --provider "$MULTIACC_PROVIDER" apply \
+    --all --fail-open --quiet >/dev/null 2>&1 </dev/null || true
+  return 0
+}
+
 seed_account_dir() { # $1 = acct dir
   local d="$1"
   mkdir -p "$d"
@@ -831,3 +879,98 @@ rotate_log() { # keep logs bounded: rotate_log <file-in-acc-root> (keeps last ~2
     tail -c 262144 "$f" > "$f.tmp" 2>/dev/null && mv "$f.tmp" "$f"
   fi
 }
+
+# ---- the model/effort catalog (lib/model_catalog.py) --------------------------------
+# Auto-resume relaunches a session with the model and effort it ran with, mapped onto the
+# other provider's lineup when it changes provider. The mapping reads a catalog: the copy
+# shipped beside lib/model_catalog.py (a snapshot of the lineup, the fallback) merged with the model
+# caches the CLIs themselves keep in their account dirs, written to <pool>/model-catalog.json.
+# Nothing here sends a request or reads a credential. Every install and self-update refreshes
+# both pools; each limits pass refreshes its own pool once that copy is an hour old.
+#
+# <PROVIDER>_MULTIACC_MODEL_CATALOG=0 (false/no/off alike) stops every refresh of that pool's
+# copy, MULTIACC_MODEL_CATALOG=0 of both; the provider's own spelling wins when it is set.
+MODEL_CATALOG_OFF_BY=""
+model_catalog_on() { # $1 = claude|codex; when off, MODEL_CATALOG_OFF_BY names the deciding switch
+  local name v
+  if [ "$1" = codex ]; then name=CODEX_MULTIACC_MODEL_CATALOG v="${CODEX_MULTIACC_MODEL_CATALOG:-}"
+  else name=CLAUDE_MULTIACC_MODEL_CATALOG v="${CLAUDE_MULTIACC_MODEL_CATALOG:-}"; fi
+  [ -n "$v" ] || { name=MULTIACC_MODEL_CATALOG; v="${MULTIACC_MODEL_CATALOG:-1}"; }
+  case "$v" in
+    0|false|no|off|False|No|Off|FALSE|NO|OFF) MODEL_CATALOG_OFF_BY="$name=$v"; return 1 ;;
+  esac
+  return 0
+}
+
+model_catalog_root() { # $1 = claude|codex: that pool's root, by the same precedence as ACC_ROOT
+  if [ "$1" = codex ]; then printf '%s\n' "${CODEX_ACCOUNTS_ROOT:-${CODEX_ACCOUNTS_DIR:-$HOME/.codex-accounts}}"
+  else printf '%s\n' "${CLAUDE_ACCOUNTS_ROOT:-${CLAUDE_ACCOUNTS_DIR:-$HOME/.claude-accounts}}"; fi
+}
+
+# `<provider>-accounts model-catalog [refresh|show] [--if-stale] [--quiet]`, the same in both
+# CLIs. refresh (the default) writes both pools' copies, leaving out a pool whose switch is off;
+# --if-stale skips a copy younger than an hour; the status is lib/model_catalog.py's (1 = nothing
+# could be written). show prints the merged catalog. No manifest needed: the installer runs it.
+cmd_model_catalog() {
+  local sub="" stale="" quiet=0 p rc=0
+  local roots=()
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      refresh|show) [ -z "$sub" ] || die "model-catalog takes one of refresh or show"; sub="$1" ;;
+      --if-stale) stale=--if-stale ;;
+      --quiet) quiet=1 ;;
+      *) die "unknown model-catalog argument: $1 (refresh, show, --if-stale, --quiet)" ;;
+    esac
+    shift
+  done
+  [ -f "$LIB_DIR/model_catalog.py" ] || die "lib/model_catalog.py is missing from this install"
+  if [ "$sub" = show ]; then
+    "$PYBIN" -I "$LIB_DIR/model_catalog.py" show --claude-root "$(model_catalog_root claude)" \
+      --codex-root "$(model_catalog_root codex)"
+    return $?
+  fi
+  for p in claude codex; do
+    if model_catalog_on "$p"; then
+      roots+=("--$p-root" "$(model_catalog_root "$p")")
+    elif [ "$quiet" = 0 ]; then
+      printf '%s: model catalog refresh is off for the %s pool (%s); nothing written there\n' \
+        "$PROVIDER_CLI" "$p" "$MODEL_CATALOG_OFF_BY" >&2
+    fi
+  done
+  [ ${#roots[@]} -gt 0 ] || return 0
+  if [ "$quiet" = 1 ]; then
+    "$PYBIN" -I "$LIB_DIR/model_catalog.py" refresh ${stale:+"$stale"} "${roots[@]}" >/dev/null 2>&1 || rc=$?
+  else
+    "$PYBIN" -I "$LIB_DIR/model_catalog.py" refresh ${stale:+"$stale"} "${roots[@]}" || rc=$?
+    [ "$rc" = 1 ] && warn "no pool root could take the model catalog (none exists? run claude-multiacc install)"
+  fi
+  return "$rc"
+}
+
+# The limits passes' backstop: app-robot moves its git tag and docker updates npm without ever
+# running install.sh, so every pass keeps ITS OWN pool's copy within an hour of its sources
+# (python's --if-stale leaves a younger copy alone). Its own root only: a pass never writes the
+# other provider's pool, which a test sandboxing one pool would inherit from the operator. In
+# line, not detached: a detached writer outlives the pass, into a pool its caller may already be
+# deleting. Never changes the pass's status.
+model_catalog_backstop() {
+  model_catalog_on "$MULTIACC_PROVIDER" || return 0
+  [ -f "$LIB_DIR/model_catalog.py" ] || return 0
+  "$PYBIN" -I "$LIB_DIR/model_catalog.py" refresh --if-stale "--$MULTIACC_PROVIDER-root" "$ACC_ROOT" \
+    </dev/null >/dev/null 2>&1 || true
+  return 0
+}
+
+# After an npm update the NEW tree refreshes the catalog, in a process of its own: this bash
+# still runs the code it started with, and the catalog to merge is the one the new release
+# ships. Logged to update.log; it never changes the update's exit status.
+model_catalog_after_update() { # $1 = 1 when self-update runs --quiet
+  local rc=0 line
+  model_catalog_on claude || model_catalog_on codex || return 0
+  "$REPO_DIR/bin/$PROVIDER_CLI" model-catalog refresh --quiet </dev/null >>"$ACC_ROOT/update.log" 2>&1 || rc=$?
+  if [ "$rc" = 0 ]; then line="self-update: model catalog refreshed"
+  else line="self-update: model catalog refresh FAILED (rc=$rc); the limits passes retry within the hour"; fi
+  log_to update.log "$line"
+  [ "${1:-0}" = 1 ] || echo "$line"
+  return 0
+}

package/lib/credential.py

@@ -221,10 +221,13 @@ def cmd_export(argv):
     has_token = os.path.isfile(tpath) and os.path.getsize(tpath) > 0
     if not has_token:
         where = None
-        if os.path.isfile(cpath) and os.path.getsize(cpath) > 0:
+        sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+        # A login, not any credentials document: one holding only the client's MCP
+        # OAuth state is no credential material for this account (audit.file_has_login).
+        from audit import file_has_login
+        if file_has_login(cpath):
             where = '.credentials.json'
         else:
-            sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
             import keychain
             if keychain.probe(d)['state'] in ('present', 'locked', 'corrupt'):
                 where = 'macOS Keychain'