claude-multiacc 2.0.64 → 2.0.65

package/bin/claude-accounts

@@ -1708,7 +1708,7 @@ token_identity_receipt() { # Unknown results must never overwrite a peer's prove
 limits_distribute_now() {
   local lock="$ACC_ROOT/tmp/limits-push.lock"
   mkdir -p "$ACC_ROOT/tmp" 2>/dev/null || return 0
-  if ! mkdir "$lock" 2>/dev/null; then
+  if ! atomic_mkdir "$lock" 2>/dev/null; then
     # A DETACHED push that is killed (logout, reboot, pkill) never runs its EXIT trap,
     # and mkdir can never take a lock dir nobody will remove: one stranded lock
     # silently stopped ALL telemetry distribution on the live pool from 2026-09-03
@@ -1721,7 +1721,7 @@ limits_distribute_now() {
     # exactly as before.
     [ $(( $(epoch_now) - $(file_mtime "$lock") )) -gt 600 ] || return 0
     rm -rf "$lock" 2>/dev/null
-    mkdir "$lock" 2>/dev/null || return 0
+    atomic_mkdir "$lock" 2>/dev/null || return 0
     log_to sync.log "stale limits-push lock broken (older than 600s); distributing"
   fi
   trap 'rmdir "$lock" 2>/dev/null || true' EXIT
@@ -1792,7 +1792,7 @@ cmd_limits() {
   done
   local lock="$ACC_ROOT/.locks/limits"
   mkdir -p "$ACC_ROOT/.locks"
-  if ! mkdir "$lock" 2>/dev/null; then
+  if ! atomic_mkdir "$lock" 2>/dev/null; then
     local age=$(( $(epoch_now) - $(file_mtime "$lock") ))
     if [ "$age" -lt 120 ]; then
       # A --json caller still gets the document (built from the state on disk) —
@@ -1802,7 +1802,7 @@ cmd_limits() {
       return 0
     fi
     rm -rf "$lock"
-    if ! mkdir "$lock" 2>/dev/null; then
+    if ! atomic_mkdir "$lock" 2>/dev/null; then
       if [ "$json" = "1" ]; then emit_report_json limits; return $?; fi
       return 0
     fi

package/bin/codex

@@ -156,6 +156,20 @@ cli_positional_at() { # argv -> prints the index of its first positional argumen
   return 1
 }
 
+# Account/model capabilities are resolved only after the serving account is known.
+# The helper is optional so a damaged install retains the shim's fail-open contract.
+codex_native_argv() {
+  CODEX_SPEED_ARGV=("$@")
+  if [ -f "$SELF_DIR/../lib/codex_speed.sh" ]; then
+    . "$SELF_DIR/../lib/codex_speed.sh"
+    codex_speed_prepare "$@" || return $?
+  fi
+}
+codex_native_exec() {
+  codex_native_argv "$@" || exit $?
+  exec "$REAL" ${CODEX_SPEED_ARGV[@]+"${CODEX_SPEED_ARGV[@]}"}
+}
+
 # Whether argv is `codex [global options] mcp add|remove …`.
 mcp_mutation_argv() {
   local i j
@@ -252,7 +266,7 @@ if [ -n "${CODEX_HOME:-}" ] \
     mcp_oauth_ensure "$CODEX_HOME"
   fi
   mcp_nested_mirror "$@" || true
-  exec "$REAL" "$@"
+  codex_native_exec "$@"
 fi
 
 now="$(date +%s)"
@@ -1074,6 +1088,9 @@ ar_argv_ok() { # the argv codex is about to get
         model:*) case "$a" in ''|-*) return 1 ;; esac ;;
         effort:model_reasoning_effort=?*)
           case "${a#model_reasoning_effort=}" in *[!$AR_LOWER]*) return 1 ;; esac ;;
+        effort:service_tier=*)
+          case "${a#service_tier=}" in default|fast|priority|ultrafast|'"default"'|'"fast"'|'"priority"'|'"ultrafast"'|"'default'"|"'fast'"|"'priority'"|"'ultrafast'") ;; *) return 1 ;; esac ;;
+        effort:features.fast_mode=true) ;;
         *) return 1 ;;
       esac
       want=""
@@ -1272,7 +1289,7 @@ if [ -n "${CODEX_ACCOUNT:-}" ] && [ "$AR_PROBE" != "1" ]; then
     mcp_ensure "$d"
     mcp_oauth_ensure "$d"
     mcp_mirror_run "$d" "$@" || true
-    exec "$REAL" "$@"
+    codex_native_exec "$@"
   fi
   sel_log "pin-invalid account=$CODEX_ACCOUNT (no such dir; random fallback)"
 fi
@@ -1343,7 +1360,7 @@ if [ "${#valid[@]}" -eq 0 ]; then
     [ -t 2 ] && printf 'codex-multiacc: no pool account is usable (%s) — see: codex-accounts expired, then: codex-accounts relogin\n' \
       "${ids# }" >&2
   fi
-  exec "$REAL" "$@"
+  codex_native_exec "$@"
 fi
 
 # ---- rotation ----------------------------------------------------------------
@@ -1657,14 +1674,14 @@ if [ "$wants_retry" = "0" ]; then
   fi
   ar_scrub_env
   [ "$AR_NO_DAEMON" != 1 ] || set -- --no-daemon "$@"
-  exec "$REAL" "$@"
+  codex_native_exec "$@"
 fi
 
 # Retry path: buffer stdio so a retried call never double-emits partial output.
 mkdir -p "$ACC_ROOT/tmp" 2>/dev/null || true
 tmpd="$(mktemp -d "$ACC_ROOT/tmp/shim.XXXXXX" 2>/dev/null)" || {
   export CODEX_HOME="$pick"
-  exec "$REAL" "$@"
+  codex_native_exec "$@"
 }
 trap 'rm -rf "$tmpd"' EXIT
 
@@ -1673,7 +1690,7 @@ trap 'rm -rf "$tmpd"' EXIT
 # nonzero — a hard failure. Verify now, fall back to plain exec if we cannot.
 if ! : > "$tmpd/out" 2>/dev/null || ! : > "$tmpd/err" 2>/dev/null; then
   export CODEX_HOME="$pick"
-  exec "$REAL" "$@"
+  codex_native_exec "$@"
 fi
 
 stdin_file=""
@@ -1708,8 +1725,9 @@ cur="$pick"
 rc=0
 while :; do
   if [ -n "$stdin_file" ]; then exec 3< "$stdin_file"; else exec 3< /dev/null; fi
+  CODEX_HOME="$cur" codex_native_argv "$@" || exit $?
   CODEX_HOME="$cur" CODEX_MULTIACC_SELECTED_HOME="$cur" \
-    codex_retry_run "$REAL" "$@" <&3 > "$tmpd/out" 2> "$tmpd/err"
+    codex_retry_run "$REAL" ${CODEX_SPEED_ARGV[@]+"${CODEX_SPEED_ARGV[@]}"} <&3 > "$tmpd/out" 2> "$tmpd/err"
   rc=$?
   exec 3<&-
   if [ "$rc" -ne 0 ] && [ "$attempt" -eq 1 ] \

package/bin/codex-accounts

@@ -106,6 +106,10 @@ USAGE
       every install and self-update runs it, and each limits pass refreshes its own pool's
       copy once it is an hour old. --if-stale leaves a younger copy alone; --quiet prints
       nothing. show prints the merged catalog.
+  codex-accounts speed --account-dir DIR --model MODEL --speed normal|fast|ultrafast [--json]
+      resolve speed from this account's native model catalog. Ultrafast verifies
+      account access through native model/list without inference; unknown or
+      unavailable access falls back to Fast. Never changes account configuration.
   codex-accounts post-sync                  (server side) seed dirs, fix perms, quick verify
   codex-accounts mcp add <name> [--provider claude|codex|both] [--scope user]
                           [-e KEY=VAL]... [-H 'Header: v']... [--transport stdio|http]
@@ -144,6 +148,8 @@ ENV
                         'none' = local-only, nothing is pushed anywhere
   CODEX_MULTIACC_SYNC_ROOT / _SYNC_REPO   remote pool root / addon repo for it
   CODEX_ACCOUNT         pin the shim to one account
+  CODEX_SPEED           normal|fast|ultrafast for this launch; unavailable Ultrafast uses Fast
+  CODEX_SPEED_MODEL     model hint for app-server launches that choose their model over RPC
   CODEX_SHIM_RETRY=0    disable the `codex exec` auto-retry
   CODEX_MULTIACC_DISABLE=1  bypass the shim entirely
   CODEX_MULTIACC_AUTO_RESET=0  disable automatic usage-reset redemption
@@ -156,6 +162,12 @@ EOF
 
 require_manifest() { [ -f "$MANIFEST" ] || die "no manifest at $MANIFEST — run claude-multiacc install first"; }
 
+cmd_speed() {
+  local native
+  native="$(find_real_codex "$_self" 2>/dev/null)" || native=""
+  "$PYBIN" "$LIB_DIR/codex_speed.py" --native-cli "$native" "$@"
+}
+
 cmd_configure() {
   require_manifest
   local apply=0 check=0 arg rc
@@ -257,11 +269,11 @@ PYEOF
 # later contender legitimately re-took.
 login_lock_acquire() { # $1 = lock dir; nonzero when someone else holds it
   local L="$1"
-  if ! mkdir "$L" 2>/dev/null; then
+  if ! atomic_mkdir "$L" 2>/dev/null; then
     [ $(( $(epoch_now) - $(file_mtime "$L") )) -gt 1800 ] || return 1
     mv "$L" "$L.stale.$$" 2>/dev/null || return 1
     rm -rf "$L.stale.$$" 2>/dev/null
-    mkdir "$L" 2>/dev/null || return 1
+    atomic_mkdir "$L" 2>/dev/null || return 1
   fi
   : > "$L/owner.$$" 2>/dev/null || true
   return 0
@@ -2477,7 +2489,7 @@ PYEOF
 # distribution for as long as the arg loops rejected the flag. An UNKNOWN verb must still
 # FAIL, or the probe stops meaning what it says — so this list must hold exactly the verbs
 # the dispatcher below implements, and a test pins that both ways.
-_KNOWN_VERBS="list status add import export-credential export-cred import-credential import-cred adopt dedupe remove login expired relogin re-login sync configure verify limits post-sync health self-update init-pool mcp model-catalog"
+_KNOWN_VERBS="list status add import export-credential export-cred import-credential import-cred adopt dedupe remove login expired relogin re-login sync configure verify limits post-sync health self-update init-pool mcp model-catalog speed"
 case " $_KNOWN_VERBS " in
   *" ${1:-help} "*)
     # ...but never past a literal `--`: from there on the words belong to an MCP
@@ -2510,6 +2522,7 @@ case "${1:-help}" in
   init-pool) shift; cmd_init_pool "$@" ;;
   mcp) shift; cmd_mcp "$@" ;;
   model-catalog) shift; cmd_model_catalog "$@" ;;
+  speed) shift; cmd_speed "$@" ;;
   help|--help|-h) usage ;;
   *) usage; exit 1 ;;
 esac

package/docs/AUTORESUME.md

@@ -225,7 +225,16 @@ The prompt is submitted automatically:
 - **To replace the whole text**, set `CLAUDE_MULTIACC_AUTORESUME_PROMPT` or
   `CODEX_MULTIACC_AUTORESUME_PROMPT`.
 
-### Model and effort
+### Model, effort, and Codex speed
+
+Codex relaunches also carry the most recently saved `service_tier` from the
+thread's own settings or turn context. Normal, Fast, and Ultrafast remain the same
+across account rotation; Ultrafast becomes Fast when the selected destination
+account/model does not advertise it. Claude receives no speed flag. The shim
+updates the named thread's tier through native `thread/resume` before launching
+the CLI, because native resume restores a saved tier ahead of `-c` configuration.
+See [Session speed](CODEX.md#session-speed) for capability discovery and the
+`CODEX_SPEED` launch override.
 
 The watcher reads the model and effort from the session's own history when it decides to
 relaunch, so a `/model` or `/effort` switch made after the launch is honoured:

package/docs/CODEX.md

@@ -92,6 +92,45 @@ Codex-specific notes:
 - **API-key logins are rejected** — ChatGPT subscription accounts only, matching the
   addon's no-API-keys rule.
 
+## Session speed
+
+Set `CODEX_SPEED=normal`, `fast`, or `ultrafast` for a Codex launch. Normal explicitly
+uses the standard tier, even when an account's configuration defaults to Fast.
+The setting also works with `CODEX_ACCOUNT` and `CODEX_HOME` pins. Explicit native
+`-c service_tier=...` overrides take precedence. Claude has no corresponding option.
+
+```bash
+CODEX_SPEED=fast codex
+CODEX_SPEED=ultrafast codex exec -m gpt-6.1-sol 'Review the changed code'
+codex-accounts speed --account-dir ~/.codex-accounts/acct-18 --model gpt-6.1-sol --speed ultrafast --json
+```
+
+The shim reads **the selected account's** native model catalog, never an e-mail or
+a plan-name guess. Ultrafast falls back to Fast when that account/model does not
+advertise it. Every Ultrafast launch verifies the native account's `model/list`
+with no inference, so even a copied cache cannot grant another account access;
+an inconclusive read falls back to Fast.
+Catalog probes use a temporary SQLite index, preserving the account's normal
+session-index work. The inspection command above uses the same native check for
+Ultrafast.
+
+Quota retries resolve the speed again for the next account. Automatic quota
+resumes carry the speed recorded in the session history. For those resumes and
+explicit speed requests on a named session UUID, the shim applies the resolved
+tier through native `thread/resume` before launching the resumed CLI: Codex
+currently restores its saved tier ahead of process configuration. That
+preparation sends no turn and preserves the conversation. A failed preparation
+stops the launch instead of silently selecting another speed.
+
+App-server callers may supply `CODEX_SPEED_MODEL` when their model is chosen over
+RPC. Read the resolved `config.service_tier` with native `config/read` and pass it
+as `serviceTier` on `thread/start`, `thread/resume`, and `turn/start`; otherwise
+saved thread settings can override the process configuration.
+
+The [official speed documentation](https://learn.chatgpt.com/docs/agent-configuration/speed)
+describes Fast's higher usage and Ultrafast access for Pro $500 and eligible
+Enterprise/Edu plans. Actual account/model capabilities remain authoritative.
+
 ## Spendable Codex credits
 
 The existing authenticated usage GET also supplies the account's spendable Codex

package/lib/autoresume.py

@@ -1214,6 +1214,14 @@ def codex_effort_ok(val):
         and EFFORT_VALUE_RE.match(val[len(CODEX_EFFORT_KEY):]) is not None
 
 
+def codex_speed_ok(val):
+    """Only known speed choices, never arbitrary config, may cross a relaunch."""
+    if val == "features.fast_mode=true":
+        return True
+    return isinstance(val, str) and re.fullmatch(
+        r'''service_tier=(?:default|fast|priority|ultrafast|"(?:default|fast|priority|ultrafast)"|'(?:default|fast|priority|ultrafast)')''', val) is not None
+
+
 def codex_argv_parse(argv):
     """The argv shapes a codex relaunch can rebuild (mirrors bin/codex's ar_argv_ok) ->
     (kept options, resume target or None), or None for anything else."""
@@ -1231,7 +1239,7 @@ def codex_argv_parse(argv):
             kept += [arg, expected]
             i += 1
         elif arg in ("-m", "--model", "-c"):
-            value_ok = codex_effort_ok if arg == "-c" else _value_ok
+            value_ok = (lambda value: codex_effort_ok(value) or codex_speed_ok(value)) if arg == "-c" else _value_ok
             if i + 1 >= len(argv) or not value_ok(argv[i + 1]):
                 return None
             kept += [arg, argv[i + 1]]
@@ -1315,7 +1323,11 @@ def settings_argv(provider, settings):
     (anything else counts as unknown). [] when nothing is known."""
     effort = settings.get("effort") if isinstance(settings, dict) else None
     effort = effort if isinstance(effort, str) and EFFORT_VALUE_RE.match(effort) else None
-    return settings_flags(provider, history_model(settings), effort)
+    flags = settings_flags(provider, history_model(settings), effort)
+    if provider == "codex" and isinstance(settings, dict) and settings.get("speed") in ("normal", "fast", "ultrafast"):
+        flags += ["-c", "service_tier=" + {"normal": "default", "fast": "fast",
+                                           "ultrafast": "ultrafast"}[settings["speed"]]]
+    return flags
 
 
 def argv_settings(provider, argv):
@@ -1336,6 +1348,10 @@ def argv_settings(provider, argv):
         elif provider == "codex" and arg == "-c" and codex_effort_ok(val):
             found["effort"] = val[len(CODEX_EFFORT_KEY):]
             i += 1
+        elif provider == "codex" and arg == "-c" and val.startswith("service_tier=") and codex_speed_ok(val):
+            from codex_speed import speed
+            found["speed"] = speed(val.split("=", 1)[1].strip("\"'"))
+            i += 1
         i += 1
     return found
 
@@ -1355,14 +1371,16 @@ def claude_model_left(launch, served):
     return family is not None and family != launch
 
 
-def without_settings(kept, model, effort):
+def without_settings(kept, model, effort, speed=False):
     """``kept`` without its model options (-m V, --model V, --model=V) when ``model`` and its
     effort options (--effort V, codex's -c model_reasoning_effort=V) when ``effort``. Both
     parsers refuse a value that starts with "-", so no value is ever taken for an option."""
     out, i = [], 0
     while i < len(kept):
         arg = kept[i]
-        if (model and arg in ("-m", "--model")) or (effort and arg in ("--effort", "-c")):
+        val = kept[i + 1] if i + 1 < len(kept) else ""
+        if ((model and arg in ("-m", "--model")) or (effort and arg == "--effort")
+                or (arg == "-c" and ((effort and codex_effort_ok(val)) or (speed and codex_speed_ok(val))))):
             i += 2
             continue
         if not (model and arg.startswith("--model=")):
@@ -1407,10 +1425,12 @@ def relaunch_argv(provider, argv, sid, cls, prompt=None, settings=None, detail=N
         left = claude_model_left(argv_settings("claude", kept).get("model"), settings.get("model"))
         settings = {"effort": settings.get("effort")}
     flags = settings_argv(provider, settings)
-    model, effort = left or "--model" in flags or "-m" in flags, "--effort" in flags or "-c" in flags
-    if provider == "codex" and not flags and history_model(settings):
+    model = left or "--model" in flags or "-m" in flags
+    effort = "--effort" in flags or any(codex_effort_ok(value) for value in flags)
+    speed = provider == "codex" and settings.get("speed") in ("normal", "fast", "ultrafast")
+    if provider == "codex" and not model and history_model(settings):
         model = effort = True  # no launch -m or -c alone: neither, and the thread restores both
-    return head + without_settings(kept, model, effort) + flags + tail
+    return head + without_settings(kept, model, effort, speed) + flags + tail
 
 
 # ---- relaunch / state files ---------------------------------------------------------
@@ -2721,7 +2741,7 @@ class Watcher:
         try:
             found = session_settings(self.provider, self.transcript)
             self.served_model = history_model(found)
-            if not found.get("model") and not found.get("effort"):
+            if not found.get("model") and not found.get("effort") and not found.get("speed"):
                 return None
             # The catalog only clamps an effort to the model and supplies Codex's default
             # one: this pool's copy and caches, the other pool's only when the chain named it.