claude-multiacc 2.0.61 → 2.0.65

package/README.md

@@ -685,8 +685,12 @@ claude-accounts mcp auth-forget higgsfield   # log it out of EVERY account on th
   cannot open) stays ignored and is cleared by a later pass.
 - **Kill switches**: `CLAUDE_MULTIACC_MCP_OAUTH=0` stops sharing (the shim's merge and the
   limits pass's sync); `CLAUDE_MULTIACC_MCP_OAUTH_REFRESH=0` never refreshes — and so shares
-  nothing. `auth-status` and `auth-forget` always run. Claude pool only: Codex keeps MCP
-  OAuth in its own store, and `codex-accounts mcp auth-…` says so.
+  nothing. `auth-status` and `auth-forget` always run. These commands describe the Claude pool.
+
+Codex shares its native MCP credential file and refresh locks locally, so a login in
+one pooled account works in the others. Run `codex-accounts mcp auth-sync` to repair
+sharing now; use native `codex mcp login NAME`, `list`, and `logout NAME` for authentication.
+See [Codex MCP authentication](docs/CODEX_MCP_AUTH.md) for storage constraints and recovery.
 
 app-robot tasks are different: the panel launches Claude with `--strict-mcp-config` and a
 merged MCP document (`agent_mcp.servers_for`) and Codex with the same document as `-c`

package/bin/claude-accounts

@@ -1708,7 +1708,7 @@ token_identity_receipt() { # Unknown results must never overwrite a peer's prove
 limits_distribute_now() {
   local lock="$ACC_ROOT/tmp/limits-push.lock"
   mkdir -p "$ACC_ROOT/tmp" 2>/dev/null || return 0
-  if ! mkdir "$lock" 2>/dev/null; then
+  if ! atomic_mkdir "$lock" 2>/dev/null; then
     # A DETACHED push that is killed (logout, reboot, pkill) never runs its EXIT trap,
     # and mkdir can never take a lock dir nobody will remove: one stranded lock
     # silently stopped ALL telemetry distribution on the live pool from 2026-09-03
@@ -1721,7 +1721,7 @@ limits_distribute_now() {
     # exactly as before.
     [ $(( $(epoch_now) - $(file_mtime "$lock") )) -gt 600 ] || return 0
     rm -rf "$lock" 2>/dev/null
-    mkdir "$lock" 2>/dev/null || return 0
+    atomic_mkdir "$lock" 2>/dev/null || return 0
     log_to sync.log "stale limits-push lock broken (older than 600s); distributing"
   fi
   trap 'rmdir "$lock" 2>/dev/null || true' EXIT
@@ -1792,7 +1792,7 @@ cmd_limits() {
   done
   local lock="$ACC_ROOT/.locks/limits"
   mkdir -p "$ACC_ROOT/.locks"
-  if ! mkdir "$lock" 2>/dev/null; then
+  if ! atomic_mkdir "$lock" 2>/dev/null; then
     local age=$(( $(epoch_now) - $(file_mtime "$lock") ))
     if [ "$age" -lt 120 ]; then
       # A --json caller still gets the document (built from the state on disk) —
@@ -1802,7 +1802,7 @@ cmd_limits() {
       return 0
     fi
     rm -rf "$lock"
-    if ! mkdir "$lock" 2>/dev/null; then
+    if ! atomic_mkdir "$lock" 2>/dev/null; then
       if [ "$json" = "1" ]; then emit_report_json limits; return $?; fi
       return 0
     fi

package/bin/codex

@@ -93,6 +93,11 @@ fi
 # the servers themselves. Same contract as bin/claude's mcp_ensure.
 MCP_PY="$SELF_DIR/../lib/mcp_registry.py"
 MCP_PYBIN="${CLAUDE_MULTIACC_PYTHON:-python3}"
+mcp_oauth_ensure() {
+  [ -f "$SELF_DIR/../lib/codex_mcp_oauth.sh" ] || return 0
+  bash "$SELF_DIR/../lib/codex_mcp_oauth.sh" "$ACC_ROOT" "$MCP_PYBIN" \
+    "$SELF_DIR/../lib/codex_mcp_oauth.py" "$1" "$REAL" >/dev/null 2>&1 </dev/null || true
+}
 mcp_sig() { # $1 acct dir -> "m:z,m:z,m:z" (registry, overlay, account config; - = absent)
   local f out="" s
   for f in "$ACC_ROOT/mcp-servers.json" "$ACC_ROOT/mcp-servers.local.json" "$1/config.toml"; do
@@ -151,6 +156,20 @@ cli_positional_at() { # argv -> prints the index of its first positional argumen
   return 1
 }
 
+# Account/model capabilities are resolved only after the serving account is known.
+# The helper is optional so a damaged install retains the shim's fail-open contract.
+codex_native_argv() {
+  CODEX_SPEED_ARGV=("$@")
+  if [ -f "$SELF_DIR/../lib/codex_speed.sh" ]; then
+    . "$SELF_DIR/../lib/codex_speed.sh"
+    codex_speed_prepare "$@" || return $?
+  fi
+}
+codex_native_exec() {
+  codex_native_argv "$@" || exit $?
+  exec "$REAL" ${CODEX_SPEED_ARGV[@]+"${CODEX_SPEED_ARGV[@]}"}
+}
+
 # Whether argv is `codex [global options] mcp add|remove …`.
 mcp_mutation_argv() {
   local i j
@@ -243,8 +262,11 @@ if [ -n "${CODEX_HOME:-}" ] \
     printf 'codex-multiacc: auto-resume cannot enter account selection.\n' >&2
     exit 2
   fi
+  if [ "${CODEX_MULTIACC_DISABLE:-0}" != "1" ] && [ -n "${CODEX_HOME:-}" ]; then
+    mcp_oauth_ensure "$CODEX_HOME"
+  fi
   mcp_nested_mirror "$@" || true
-  exec "$REAL" "$@"
+  codex_native_exec "$@"
 fi
 
 now="$(date +%s)"
@@ -1066,6 +1088,9 @@ ar_argv_ok() { # the argv codex is about to get
         model:*) case "$a" in ''|-*) return 1 ;; esac ;;
         effort:model_reasoning_effort=?*)
           case "${a#model_reasoning_effort=}" in *[!$AR_LOWER]*) return 1 ;; esac ;;
+        effort:service_tier=*)
+          case "${a#service_tier=}" in default|fast|priority|ultrafast|'"default"'|'"fast"'|'"priority"'|'"ultrafast"'|"'default'"|"'fast'"|"'priority'"|"'ultrafast'") ;; *) return 1 ;; esac ;;
+        effort:features.fast_mode=true) ;;
         *) return 1 ;;
       esac
       want=""
@@ -1258,11 +1283,13 @@ if [ -n "${CODEX_ACCOUNT:-}" ] && [ "$AR_PROBE" != "1" ]; then
     share_state_index "$d"
     export CODEX_HOME="$d"
     export CODEX_SHIM_ACTIVE=1
+    unset CODEX_MULTIACC_SELECTED_HOME
     # A pinned account carries every registered MCP server too, and a pinned
     # `codex mcp add|remove` is mirrored like any other (exits inside).
     mcp_ensure "$d"
+    mcp_oauth_ensure "$d"
     mcp_mirror_run "$d" "$@" || true
-    exec "$REAL" "$@"
+    codex_native_exec "$@"
   fi
   sel_log "pin-invalid account=$CODEX_ACCOUNT (no such dir; random fallback)"
 fi
@@ -1333,7 +1360,7 @@ if [ "${#valid[@]}" -eq 0 ]; then
     [ -t 2 ] && printf 'codex-multiacc: no pool account is usable (%s) — see: codex-accounts expired, then: codex-accounts relogin\n' \
       "${ids# }" >&2
   fi
-  exec "$REAL" "$@"
+  codex_native_exec "$@"
 fi
 
 # ---- rotation ----------------------------------------------------------------
@@ -1551,6 +1578,7 @@ if [ "$AR_TIER" = "credits" ]; then
 fi
 # The picked account carries every registered MCP server before the client starts.
 mcp_ensure "$pick"
+mcp_oauth_ensure "$pick"
 
 # Opportunistic limits refresh: non-blocking, throttled, backgrounded. The windows are
 # deliberately wide (10m, matching the 5m scheduled pass): the usage endpoint rate-limits
@@ -1581,6 +1609,9 @@ sel_log "$acct weekly=$(fresh_field "$pick" weekly_percent || echo '?')%" \
   "session-ok=${PICK_GATE_COUNT} pwd=$PWD${credit_funding_log}"
 
 export CODEX_SHIM_ACTIVE=1
+# An isolated child job can distinguish this automatic selection from a caller pin.
+# Consumers must also require CODEX_HOME to match and respect explicit pins/disable.
+export CODEX_MULTIACC_SELECTED_HOME="$pick"
 
 # A `codex mcp add|remove` is run as a child under the picked account and mirrored to
 # every other one (exits inside); anything else falls through to exec.
@@ -1591,9 +1622,9 @@ if mcp_mutation_argv "$@"; then
 fi
 
 # Auto-retry applies only to `codex exec` runs with an alternative account available,
-# and only when stdin is finite (tty, regular file, or char device like /dev/null).
-# A service-spawned pipe that never EOFs must take the plain exec path, or the
-# stdin pre-buffering below would hang the call.
+# and stdin is a file/device or an explicit `exec ... -` prompt. That prompt needs
+# EOF in the native CLI too. Other pipes stay unbuffered so a non-consuming command
+# can finish even when its service leaves stdin open.
 wants_retry=0
 if [ "${CODEX_SHIM_RETRY:-1}" != "0" ] \
   && { [ "${#eligible[@]}" -ge 2 ] || [ "$AR_TIER" = "credits" ]; }; then
@@ -1603,19 +1634,26 @@ if [ "${CODEX_SHIM_RETRY:-1}" != "0" ] \
   if [ "$wants_retry" = "1" ]; then
     # A TTY cannot be buffered or replayed: `codex exec` with no prompt argument reads
     # stdin, and the retry path would hand it /dev/null. Plain exec instead —
-    # stdin is inherited untouched. A pipe that never EOFs would hang the pre-buffer,
-    # so only finite stdin (regular file, /dev/null-style char device) takes the retry
-    # path; everything else execs directly.
+    # stdin is inherited untouched. Explicit stdin prompts can replay a pipe: an
+    # AppInspire/Node child receives a complete prompt through a socket, not a file.
+    # Keep unknown commands and pipes the CLI need not consume on direct exec.
     if [ -t 0 ]; then
       wants_retry=0
     elif [ -f /dev/fd/0 ] || [ -c /dev/fd/0 ]; then
       :
+    elif bash "$SELF_DIR/../lib/codex_exec_stdin.sh" "$@" 2>/dev/null; then
+      :
     else
       wants_retry=0
     fi
   fi
 fi
 
+# Keep a damaged installation fail-open rather than wrapping an unowned child.
+if [ "$wants_retry" = 1 ] && ! . "$SELF_DIR/../lib/codex_retry_process.sh" 2>/dev/null; then
+  wants_retry=0
+fi
+
 share_state_index "$pick"
 if [ "$wants_retry" = "0" ]; then
   export CODEX_HOME="$pick"
@@ -1636,14 +1674,14 @@ if [ "$wants_retry" = "0" ]; then
   fi
   ar_scrub_env
   [ "$AR_NO_DAEMON" != 1 ] || set -- --no-daemon "$@"
-  exec "$REAL" "$@"
+  codex_native_exec "$@"
 fi
 
 # Retry path: buffer stdio so a retried call never double-emits partial output.
 mkdir -p "$ACC_ROOT/tmp" 2>/dev/null || true
 tmpd="$(mktemp -d "$ACC_ROOT/tmp/shim.XXXXXX" 2>/dev/null)" || {
   export CODEX_HOME="$pick"
-  exec "$REAL" "$@"
+  codex_native_exec "$@"
 }
 trap 'rm -rf "$tmpd"' EXIT
 
@@ -1652,7 +1690,7 @@ trap 'rm -rf "$tmpd"' EXIT
 # nonzero — a hard failure. Verify now, fall back to plain exec if we cannot.
 if ! : > "$tmpd/out" 2>/dev/null || ! : > "$tmpd/err" 2>/dev/null; then
   export CODEX_HOME="$pick"
-  exec "$REAL" "$@"
+  codex_native_exec "$@"
 fi
 
 stdin_file=""
@@ -1687,7 +1725,9 @@ cur="$pick"
 rc=0
 while :; do
   if [ -n "$stdin_file" ]; then exec 3< "$stdin_file"; else exec 3< /dev/null; fi
-  CODEX_HOME="$cur" "$REAL" "$@" <&3 > "$tmpd/out" 2> "$tmpd/err"
+  CODEX_HOME="$cur" codex_native_argv "$@" || exit $?
+  CODEX_HOME="$cur" CODEX_MULTIACC_SELECTED_HOME="$cur" \
+    codex_retry_run "$REAL" ${CODEX_SPEED_ARGV[@]+"${CODEX_SPEED_ARGV[@]}"} <&3 > "$tmpd/out" 2> "$tmpd/err"
   rc=$?
   exec 3<&-
   if [ "$rc" -ne 0 ] && [ "$attempt" -eq 1 ] \
@@ -1749,6 +1789,7 @@ while :; do
       # away from — not the one that bounced.
       remember_pick "$cur"
       mcp_ensure "$cur"
+      mcp_oauth_ensure "$cur"
       attempt=2
       continue
     fi

package/bin/codex-accounts

@@ -106,6 +106,10 @@ USAGE
       every install and self-update runs it, and each limits pass refreshes its own pool's
       copy once it is an hour old. --if-stale leaves a younger copy alone; --quiet prints
       nothing. show prints the merged catalog.
+  codex-accounts speed --account-dir DIR --model MODEL --speed normal|fast|ultrafast [--json]
+      resolve speed from this account's native model catalog. Ultrafast verifies
+      account access through native model/list without inference; unknown or
+      unavailable access falls back to Fast. Never changes account configuration.
   codex-accounts post-sync                  (server side) seed dirs, fix perms, quick verify
   codex-accounts mcp add <name> [--provider claude|codex|both] [--scope user]
                           [-e KEY=VAL]... [-H 'Header: v']... [--transport stdio|http]
@@ -133,6 +137,8 @@ USAGE
                                             re-apply the registry now (repair drift)
   codex-accounts mcp import-local --owner NAME   (stdin JSON) machine-local overlay for
                                             a runner daemon; applied here, never synced
+  codex-accounts mcp auth-sync               share native MCP files and refresh locks locally
+      Sign in with `codex mcp login NAME`; sign out with `codex mcp logout NAME`.
 
 ENV
   CODEX_ACCOUNTS_ROOT   pool root, overriding ~/.codex-accounts — one isolated pool
@@ -142,10 +148,13 @@ ENV
                         'none' = local-only, nothing is pushed anywhere
   CODEX_MULTIACC_SYNC_ROOT / _SYNC_REPO   remote pool root / addon repo for it
   CODEX_ACCOUNT         pin the shim to one account
+  CODEX_SPEED           normal|fast|ultrafast for this launch; unavailable Ultrafast uses Fast
+  CODEX_SPEED_MODEL     model hint for app-server launches that choose their model over RPC
   CODEX_SHIM_RETRY=0    disable the `codex exec` auto-retry
   CODEX_MULTIACC_DISABLE=1  bypass the shim entirely
   CODEX_MULTIACC_AUTO_RESET=0  disable automatic usage-reset redemption
   CODEX_MULTIACC_MCP=0   disable the MCP registry (no reconcile at seed/launch, no mirror)
+  CODEX_MULTIACC_MCP_OAUTH=0  stop preparing shared native MCP storage and locks
   CODEX_MULTIACC_MODEL_CATALOG=0  never refresh the codex pool's model-catalog.json
                         (MULTIACC_MODEL_CATALOG=0: neither pool's)
 EOF
@@ -153,6 +162,12 @@ EOF
 
 require_manifest() { [ -f "$MANIFEST" ] || die "no manifest at $MANIFEST — run claude-multiacc install first"; }
 
+cmd_speed() {
+  local native
+  native="$(find_real_codex "$_self" 2>/dev/null)" || native=""
+  "$PYBIN" "$LIB_DIR/codex_speed.py" --native-cli "$native" "$@"
+}
+
 cmd_configure() {
   require_manifest
   local apply=0 check=0 arg rc
@@ -254,11 +269,11 @@ PYEOF
 # later contender legitimately re-took.
 login_lock_acquire() { # $1 = lock dir; nonzero when someone else holds it
   local L="$1"
-  if ! mkdir "$L" 2>/dev/null; then
+  if ! atomic_mkdir "$L" 2>/dev/null; then
     [ $(( $(epoch_now) - $(file_mtime "$L") )) -gt 1800 ] || return 1
     mv "$L" "$L.stale.$$" 2>/dev/null || return 1
     rm -rf "$L.stale.$$" 2>/dev/null
-    mkdir "$L" 2>/dev/null || return 1
+    atomic_mkdir "$L" 2>/dev/null || return 1
   fi
   : > "$L/owner.$$" 2>/dev/null || true
   return 0
@@ -1848,6 +1863,7 @@ PYEOF
   trap - EXIT
   # Every account's MCP servers, adopting what one holds that the registry does not know.
   mcp_registry_pass
+  codex_mcp_oauth_ensure "$ACC_ROOT" "$PYBIN" "$LIB_DIR/codex_mcp_oauth.py"
   # This pool's model catalog, once its copy is an hour old (lib/common.sh).
   model_catalog_backstop
   # The refresher fails open per account; a NON-zero status means the pass itself
@@ -2264,10 +2280,14 @@ cmd_mcp() {
   local args=()
   case "$sub" in
     add|add-json|remove|list|apply|import-local) shift ;;
-    # Sharing MCP OAuth logins across accounts is a claude-pool feature (lib/mcp_oauth.py):
-    # Codex keeps an MCP server's OAuth state in its own per-account store.
-    auth-status|auth-sync|auth-forget)
-      die "mcp $sub is not supported for the codex pool — MCP OAuth logins are shared across the claude pool only (claude-accounts mcp $sub)" ;;
+    auth-sync)
+      shift
+      local real
+      real="$(find_real_codex "$_self")" || die "real codex binary not found"
+      "$PYBIN" "$LIB_DIR/codex_mcp_oauth.py" ensure --root "$ACC_ROOT" --codex-bin "$real" "$@"
+      return $? ;;
+    auth-status|auth-forget)
+      die "use codex mcp list for native auth status, or codex mcp logout NAME to clear shared MCP authentication" ;;
     "") usage; return 1 ;;
     *) die "unknown mcp subcommand: $sub (add, add-json, remove, list, apply, import-local)" ;;
   esac
@@ -2469,7 +2489,7 @@ PYEOF
 # distribution for as long as the arg loops rejected the flag. An UNKNOWN verb must still
 # FAIL, or the probe stops meaning what it says — so this list must hold exactly the verbs
 # the dispatcher below implements, and a test pins that both ways.
-_KNOWN_VERBS="list status add import export-credential export-cred import-credential import-cred adopt dedupe remove login expired relogin re-login sync configure verify limits post-sync health self-update init-pool mcp model-catalog"
+_KNOWN_VERBS="list status add import export-credential export-cred import-credential import-cred adopt dedupe remove login expired relogin re-login sync configure verify limits post-sync health self-update init-pool mcp model-catalog speed"
 case " $_KNOWN_VERBS " in
   *" ${1:-help} "*)
     # ...but never past a literal `--`: from there on the words belong to an MCP
@@ -2502,6 +2522,7 @@ case "${1:-help}" in
   init-pool) shift; cmd_init_pool "$@" ;;
   mcp) shift; cmd_mcp "$@" ;;
   model-catalog) shift; cmd_model_catalog "$@" ;;
+  speed) shift; cmd_speed "$@" ;;
   help|--help|-h) usage ;;
   *) usage; exit 1 ;;
 esac

package/docs/ACCOUNT_OPERATIONS.md

@@ -260,8 +260,8 @@ What to expect, and how to read `auth-status`:
   re-authentication in ANY one account revokes the shared login at the server, so the pool
   retires it in every account (`login: none — retired … (cleared in acct-NN file)`); one
   sign-in in any account shares the new one. `mcp auth-forget NAME` is the same logout from
-  the operator's side. `codex-accounts mcp auth-*` is not supported (Codex keeps MCP OAuth in
-  its own store).
+  the operator's side. Codex uses native login/logout over shared local storage;
+  `codex-accounts mcp auth-sync` repairs it. See [Codex MCP authentication](CODEX_MCP_AUTH.md).
 - **Rolling it out**: the first share runs at install time (the limits agent starts on
   install), and a build older than this one reads a shared MCP-only file as a live login:
   every setup-token account would then say "Not logged in". Install it only where no older

package/docs/AUTORESUME.md

@@ -164,7 +164,12 @@ shell:   runs the shim again → token → marker on the old account → normal
    1. It consumes the token. A token is single-use and valid for 10 minutes.
    2. It writes the old account's marker with the pool's existing writers (see the tables
       below).
-   3. It `cd`s to the session's directory.
+   3. It `cd`s to the session's directory. For Codex, this is the latest directory saved
+      by that session, including a change since its first turn. Starting or resuming it
+      from another shell directory therefore does not stop the automatic restart at
+      **Working directory · resume**. The selected account trusts this same directory
+      before startup. If the saved directory is unavailable, an existing initial session
+      directory or launch directory is used as a fallback.
    4. It runs **normal selection**, with one addition: the accounts this chain of
       relaunches left are skipped until their own reset. The selection policy is
       otherwise untouched.
@@ -220,7 +225,16 @@ The prompt is submitted automatically:
 - **To replace the whole text**, set `CLAUDE_MULTIACC_AUTORESUME_PROMPT` or
   `CODEX_MULTIACC_AUTORESUME_PROMPT`.
 
-### Model and effort
+### Model, effort, and Codex speed
+
+Codex relaunches also carry the most recently saved `service_tier` from the
+thread's own settings or turn context. Normal, Fast, and Ultrafast remain the same
+across account rotation; Ultrafast becomes Fast when the selected destination
+account/model does not advertise it. Claude receives no speed flag. The shim
+updates the named thread's tier through native `thread/resume` before launching
+the CLI, because native resume restores a saved tier ahead of `-c` configuration.
+See [Session speed](CODEX.md#session-speed) for capability discovery and the
+`CODEX_SPEED` launch override.
 
 The watcher reads the model and effort from the session's own history when it decides to
 relaunch, so a `/model` or `/effort` switch made after the launch is honoured:

package/docs/CODEX.md

@@ -18,8 +18,21 @@ then the 30-point weekly-headroom band with random spread, ≥90% any-bucket
 exclusion, peers rotate), same marker semantics (`.limited` cooldowns, `.expired` parks with
 credential/policy scoping and soft expiry), same fail-open guarantees, same sync
 safety guards. The `codex` shim engages the buffered auto-retry only for
-`codex exec` runs with finite stdin, exactly like `-p` on the claude side. Interactive
-`codex` in tmux gets [auto-resume](AUTORESUME.md) instead, like `claude`.
+`codex exec` runs with file/device stdin and explicit `codex exec ... -` prompts from pipes.
+The latter require EOF in the native CLI too; the shim saves and replays the exact prompt
+on its one account retry. Unknown commands, interactive stdin and non-consuming live pipes
+remain unbuffered. Explicit `CODEX_HOME` and `CODEX_ACCOUNT` pins still bypass rotation.
+Cancelling a buffered run forwards TERM/INT/HUP to its active native process and reaps it
+before removing the temporary prompt/output files.
+Interactive `codex` in tmux gets [auto-resume](AUTORESUME.md) instead, like `claude`.
+
+Automatic selection exports `CODEX_MULTIACC_SELECTED_HOME` equal to the serving
+`CODEX_HOME`, including after a retry. Selecting an explicit `CODEX_ACCOUNT` clears the marker;
+a home passthrough never creates it. Nested invocations still pass through.
+An isolated job launcher may request fresh pool selection only when `CODEX_SHIM_ACTIVE=1`,
+the marker exactly matches `CODEX_HOME`, no `CODEX_ACCOUNT` is set and
+`CODEX_MULTIACC_DISABLE` is not `1`. Omit the inherited home/guard/marker only for that
+child. Unmarked older sessions and overridden homes retain their existing pin behavior.
 
 Codex-specific notes:
 
@@ -79,6 +92,45 @@ Codex-specific notes:
 - **API-key logins are rejected** — ChatGPT subscription accounts only, matching the
   addon's no-API-keys rule.
 
+## Session speed
+
+Set `CODEX_SPEED=normal`, `fast`, or `ultrafast` for a Codex launch. Normal explicitly
+uses the standard tier, even when an account's configuration defaults to Fast.
+The setting also works with `CODEX_ACCOUNT` and `CODEX_HOME` pins. Explicit native
+`-c service_tier=...` overrides take precedence. Claude has no corresponding option.
+
+```bash
+CODEX_SPEED=fast codex
+CODEX_SPEED=ultrafast codex exec -m gpt-6.1-sol 'Review the changed code'
+codex-accounts speed --account-dir ~/.codex-accounts/acct-18 --model gpt-6.1-sol --speed ultrafast --json
+```
+
+The shim reads **the selected account's** native model catalog, never an e-mail or
+a plan-name guess. Ultrafast falls back to Fast when that account/model does not
+advertise it. Every Ultrafast launch verifies the native account's `model/list`
+with no inference, so even a copied cache cannot grant another account access;
+an inconclusive read falls back to Fast.
+Catalog probes use a temporary SQLite index, preserving the account's normal
+session-index work. The inspection command above uses the same native check for
+Ultrafast.
+
+Quota retries resolve the speed again for the next account. Automatic quota
+resumes carry the speed recorded in the session history. For those resumes and
+explicit speed requests on a named session UUID, the shim applies the resolved
+tier through native `thread/resume` before launching the resumed CLI: Codex
+currently restores its saved tier ahead of process configuration. That
+preparation sends no turn and preserves the conversation. A failed preparation
+stops the launch instead of silently selecting another speed.
+
+App-server callers may supply `CODEX_SPEED_MODEL` when their model is chosen over
+RPC. Read the resolved `config.service_tier` with native `config/read` and pass it
+as `serviceTier` on `thread/start`, `thread/resume`, and `turn/start`; otherwise
+saved thread settings can override the process configuration.
+
+The [official speed documentation](https://learn.chatgpt.com/docs/agent-configuration/speed)
+describes Fast's higher usage and Ultrafast access for Pro $500 and eligible
+Enterprise/Edu plans. Actual account/model capabilities remain authoritative.
+
 ## Spendable Codex credits
 
 The existing authenticated usage GET also supplies the account's spendable Codex
@@ -215,6 +267,10 @@ claude-multiacc codex status          # same status command via the npm wrapper
 
 ## MCP servers for every account
 
+OAuth logins also need shared storage; see
+[Codex MCP authentication](CODEX_MCP_AUTH.md). `codex-accounts mcp auth-sync` repairs
+local credential and refresh-lock sharing without touching account `auth.json` files.
+
 `codex-accounts mcp add|add-json|remove|list|apply|import-local` manages the pool's MCP
 registry (`~/.codex-accounts/mcp-servers.json`); `add`/`remove` default to `--provider both`,
 so the claude pool beside it gets the same change, and `mcp remove` retires the server in

package/docs/CODEX_MCP_AUTH.md

@@ -0,0 +1,58 @@
+# Codex MCP authentication across pooled accounts
+
+The MCP registry shares server configuration. Codex stores OAuth logins separately:
+the direct OS keyring is shared, but its fallback `.credentials.json` belongs to
+`CODEX_HOME`. On 2026-10-23 MotionSites was configured in all 18 accounts, while its
+login existed only in `acct-06`. The other 17 reported `not_logged_in`.
+
+The addon prepares one machine-local native MCP credential file and one directory
+of native refresh/store locks under `<pool>/.codex-mcp-oauth/`. Accounts hardlink
+`.credentials.json` to that file and link `mcp-oauth-locks` to the shared locks.
+Codex reads, refreshes, saves and logs out using its own implementation. The addon
+never refreshes a token or reads the OS keyring. Account `auth.json` files remain
+independent, and none of this MCP state is included in fleet sync.
+
+```bash
+codex-accounts mcp auth-sync       # repair storage sharing now
+codex mcp login motionsites       # authorize once on this machine
+codex mcp list                    # native authentication status
+codex mcp logout motionsites      # clear the shared login
+```
+
+Preparation runs before pooled launches, during seeding, and after limits passes.
+It requires native Codex 0.163.0 or newer, whose storage and lock contract is checked
+before preparation; older clients keep their existing stores.
+A first login saved after preparation is picked up at the next launch or explicit
+`auth-sync`. Restart an already running session to reload its MCP connections.
+`CODEX_MULTIACC_MCP_OAUTH=0` stops preparation; it does not undo existing shared
+storage. Each machine still needs its own authorization.
+
+## Native storage constraints
+
+Codex 0.163.0 refuses final-component credential symlinks with `O_NOFOLLOW`, so a
+regular hardlinked file is necessary. Its file writer updates that inode in place
+under `mcp-oauth-locks/file-store.lock`. A tokenless reserved entry keeps the native
+document nonempty after its last real login is removed: otherwise Codex unlinks
+only the account's filename, leaving the other hardlinks with the old login.
+The reserved entry is not a configured server and cannot authenticate a request.
+
+The refresh lock must be shared too: native locks normally live under each
+`CODEX_HOME`, even when the grant is in the globally shared direct OS keyring.
+Sharing a rotating grant without its lock lets simultaneous sessions reuse an
+obsolete refresh token. Preparation preserves existing lock inodes, defers busy
+stores and refuses independent credential documents rather than choosing a grant.
+Initial migration atomically exchanges native lock directories with their shared
+links. It retains discarded lock files until preexisting client handles close;
+an operation racing that first migration can make preparation wait for its native
+lock timeout. Later launches use the existing shared paths without that migration.
+Linux excludes an inaccessible process only after proving that it has exited with
+no living threads; inaccessible live or uncertain handle state still defers migration.
+Only manifest accounts are eligible, including the supported `acct-NN → ~/.codex`
+adoption. Foreign directory symlinks, duplicate homes and unsupported scoped
+credential entries are refused. Encrypted secrets storage is not merged.
+
+Implementation: `lib/codex_mcp_oauth.py` and its supporting modules. Native contract:
+[OAuth storage](https://github.com/openai/codex/blob/rust-v0.163.0/codex-rs/rmcp-client/src/oauth.rs)
+and [refresh locks](https://github.com/openai/codex/blob/rust-v0.163.0/codex-rs/rmcp-client/src/oauth/refresh_lock.rs).
+The supported store settings are documented in the
+[OpenAI configuration reference](https://learn.chatgpt.com/docs/config-file/config-reference).