@askalf/dario 6.0.38 → 6.0.39

package/dist/accounts.d.ts

@@ -15,7 +15,26 @@ export interface AccountCredentials {
      * on a fresh grant.
      */
     organizationId?: string;
+    /**
+     * The Anthropic account uuid this grant belongs to, from the OAuth profile
+     * (`fetchOAuthProfile`) at grant time — or, for a record from before this
+     * field, on its next token refresh. THE fact that says whether two aliases
+     * are one subscription (dario#1244, #1263); everything else was inference.
+     */
+    accountId?: string;
+    /** Email on that account. Masked on every listing (`maskEmail`); stored whole. */
+    accountEmail?: string;
+    /** `organization.organization_type` / `rate_limit_tier` / `seat_tier` from the same profile. */
+    organizationType?: string;
+    rateLimitTier?: string;
+    seatTier?: string;
+    /**
+     * Where `deviceId`/`accountUuid` came from: the machine's Claude Code identity,
+     * or generated for this alias. Absent on records written before this field.
+     */
+    identityFrom?: IdentitySource;
 }
+export type IdentitySource = 'claude-code' | 'generated';
 export declare function listAccountAliases(): Promise<string[]>;
 export declare function loadAccount(alias: string): Promise<AccountCredentials | null>;
 export declare function loadAllAccounts(): Promise<AccountCredentials[]>;
@@ -37,8 +56,76 @@ export declare function detectClaudeIdentity(): Promise<{
     deviceId: string;
     accountUuid: string;
 } | null>;
+/**
+ * The OAuth profile behind an access token. This is what an Anthropic
+ * subscription token can say about itself, and dario never asked (#1263):
+ * the account uuid, its email, the organization uuid and tier fields. Probed
+ * 2026-09-08 with a live token — `account.uuid`, `account.email`,
+ * `organization.uuid`, `organization.rate_limit_tier`, `organization.seat_tier`
+ * are all present. Read-only, one GET, and it is the one fact that settles
+ * "are these two aliases the same subscription" without guessing.
+ */
+export declare const OAUTH_PROFILE_URL = "https://api.anthropic.com/api/oauth/profile";
+export interface OAuthProfile {
+    accountId: string;
+    accountEmail?: string;
+    organizationId?: string;
+    organizationType?: string;
+    rateLimitTier?: string;
+    seatTier?: string;
+}
+/**
+ * Fetch the profile for `accessToken`. Null on ANY failure — a non-2xx, a
+ * timeout, a body without an account uuid — because identity is a nicety
+ * layered on a grant that already succeeded; a profile outage must never
+ * turn a working login into a failed one.
+ */
+export declare function fetchOAuthProfile(accessToken: string, fetchImpl?: typeof fetch): Promise<OAuthProfile | null>;
+/** The record fields a profile fills in; nothing when there is no profile. */
+export declare function profileFields(profile: OAuthProfile | null): Partial<AccountCredentials>;
+/**
+ * Which client identity a NEW alias presents in `metadata.user_id`.
+ *
+ * Every add path used to copy the machine's Claude Code identity into every
+ * alias when one was installed. On a machine running a pool of colleagues'
+ * tokens that meant 18 different OAuth accounts all presenting ONE
+ * `device_id`/`account_uuid` (dario#1244, 2026-09-08) — and Anthropic ties what
+ * it sees to that identity (doctor-core.ts, identity drift: the bearer is
+ * cross-validated against it). The startup banner says as much: "requests
+ * may be billed as Extra Usage" without one.
+ *
+ * Rule: the local Claude Code identity belongs to the account it was granted
+ * to. A new alias takes it only when no other alias holds it, or when the
+ * holder is PROVEN to be the same account (same OAuth `accountId`). Otherwise
+ * the alias gets its own — the same fresh identity a machine without Claude
+ * Code has always produced, which the fleet box runs every seat on.
+ */
+export declare function chooseClientIdentity(existing: readonly AccountCredentials[], profile: OAuthProfile | null, local?: {
+    deviceId: string;
+    accountUuid: string;
+} | null): Promise<{
+    deviceId: string;
+    accountUuid: string;
+    identityFrom: IdentitySource;
+}>;
+/**
+ * Give each named alias its own client identity (`dario accounts identity
+ * --fresh`). Tokens, organization and account identity are untouched — only
+ * `deviceId`/`accountUuid` change, and the running proxy presents the new pair on
+ * the seat's next request (pool.add takes a changed on-disk identity).
+ * Returns the aliases rewritten; an unknown alias is skipped, not an error.
+ */
+export declare function regenerateClientIdentity(aliases: readonly string[]): Promise<string[]>;
 /** Refresh an account's OAuth token using dario's auto-detected CC OAuth config. */
 export declare function refreshAccountToken(creds: AccountCredentials): Promise<AccountCredentials>;
+/**
+ * Fill in `accountId` (and the profile's other fields) on a record that predates
+ * them, from one profile GET; saves and returns the record, unchanged when
+ * nothing could be learned. Kept OUT of the token refresh itself so the
+ * refresh stays a single, sequenced token exchange — a caller with a mocked
+ * or injected fetch sees exactly the calls it always did (dario#1263).
+ */
+export declare function backfillIdentity(creds: AccountCredentials, fetchImpl?: typeof fetch): Promise<AccountCredentials>;
 /** Test-only — inspect the in-flight map. Production code has no business peeking. */
 export declare function _accountRefreshesInFlightSizeForTest(): number;
 /**

package/dist/accounts.js

@@ -135,6 +135,125 @@ export async function detectClaudeIdentity() {
     }
     return null;
 }
+/**
+ * The OAuth profile behind an access token. This is what an Anthropic
+ * subscription token can say about itself, and dario never asked (#1263):
+ * the account uuid, its email, the organization uuid and tier fields. Probed
+ * 2026-09-08 with a live token — `account.uuid`, `account.email`,
+ * `organization.uuid`, `organization.rate_limit_tier`, `organization.seat_tier`
+ * are all present. Read-only, one GET, and it is the one fact that settles
+ * "are these two aliases the same subscription" without guessing.
+ */
+export const OAUTH_PROFILE_URL = 'https://api.anthropic.com/api/oauth/profile';
+/**
+ * Fetch the profile for `accessToken`. Null on ANY failure — a non-2xx, a
+ * timeout, a body without an account uuid — because identity is a nicety
+ * layered on a grant that already succeeded; a profile outage must never
+ * turn a working login into a failed one.
+ */
+export async function fetchOAuthProfile(accessToken, fetchImpl = fetch) {
+    try {
+        const res = await fetchImpl(OAUTH_PROFILE_URL, {
+            method: 'GET',
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                Accept: 'application/json',
+                'anthropic-beta': 'oauth-2025-04-20',
+            },
+            signal: AbortSignal.timeout(8_000),
+        });
+        if (!res.ok)
+            return null;
+        const data = await res.json();
+        const uuid = data.account?.uuid;
+        if (typeof uuid !== 'string' || uuid.length === 0)
+            return null;
+        const str = (v) => (typeof v === 'string' && v.length > 0 ? v : undefined);
+        const profile = { accountId: uuid };
+        const email = str(data.account?.email);
+        if (email)
+            profile.accountEmail = email;
+        const org = str(data.organization?.uuid);
+        if (org)
+            profile.organizationId = org;
+        const orgType = str(data.organization?.organization_type);
+        if (orgType)
+            profile.organizationType = orgType;
+        const tier = str(data.organization?.rate_limit_tier);
+        if (tier)
+            profile.rateLimitTier = tier;
+        const seat = str(data.organization?.seat_tier);
+        if (seat)
+            profile.seatTier = seat;
+        return profile;
+    }
+    catch {
+        return null;
+    }
+}
+/** The record fields a profile fills in; nothing when there is no profile. */
+export function profileFields(profile) {
+    if (!profile)
+        return {};
+    const out = { accountId: profile.accountId };
+    if (profile.accountEmail)
+        out.accountEmail = profile.accountEmail;
+    if (profile.organizationId)
+        out.organizationId = profile.organizationId;
+    if (profile.organizationType)
+        out.organizationType = profile.organizationType;
+    if (profile.rateLimitTier)
+        out.rateLimitTier = profile.rateLimitTier;
+    if (profile.seatTier)
+        out.seatTier = profile.seatTier;
+    return out;
+}
+/**
+ * Which client identity a NEW alias presents in `metadata.user_id`.
+ *
+ * Every add path used to copy the machine's Claude Code identity into every
+ * alias when one was installed. On a machine running a pool of colleagues'
+ * tokens that meant 18 different OAuth accounts all presenting ONE
+ * `device_id`/`account_uuid` (dario#1244, 2026-09-08) — and Anthropic ties what
+ * it sees to that identity (doctor-core.ts, identity drift: the bearer is
+ * cross-validated against it). The startup banner says as much: "requests
+ * may be billed as Extra Usage" without one.
+ *
+ * Rule: the local Claude Code identity belongs to the account it was granted
+ * to. A new alias takes it only when no other alias holds it, or when the
+ * holder is PROVEN to be the same account (same OAuth `accountId`). Otherwise
+ * the alias gets its own — the same fresh identity a machine without Claude
+ * Code has always produced, which the fleet box runs every seat on.
+ */
+export async function chooseClientIdentity(existing, profile, local) {
+    const cc = local === undefined ? await detectClaudeIdentity() : local;
+    if (cc && (cc.deviceId || cc.accountUuid)) {
+        const holder = existing.find((a) => a.deviceId === cc.deviceId && a.accountUuid === cc.accountUuid);
+        const sameAccount = holder !== undefined && profile !== null
+            && typeof holder.accountId === 'string' && holder.accountId === profile.accountId;
+        if (!holder || sameAccount)
+            return { deviceId: cc.deviceId, accountUuid: cc.accountUuid, identityFrom: 'claude-code' };
+    }
+    return { deviceId: randomUUID(), accountUuid: randomUUID(), identityFrom: 'generated' };
+}
+/**
+ * Give each named alias its own client identity (`dario accounts identity
+ * --fresh`). Tokens, organization and account identity are untouched — only
+ * `deviceId`/`accountUuid` change, and the running proxy presents the new pair on
+ * the seat's next request (pool.add takes a changed on-disk identity).
+ * Returns the aliases rewritten; an unknown alias is skipped, not an error.
+ */
+export async function regenerateClientIdentity(aliases) {
+    const done = [];
+    for (const alias of aliases) {
+        const acc = await loadAccount(alias);
+        if (!acc)
+            continue;
+        await saveAccount({ ...acc, deviceId: randomUUID(), accountUuid: randomUUID(), identityFrom: 'generated' });
+        done.push(alias);
+    }
+    return done;
+}
 // Per-alias single-flight map: if a refresh is in flight for an alias,
 // concurrent callers share the same promise instead of issuing parallel
 // refresh_token requests. The pool's 15-min background timer is the only
@@ -290,6 +409,23 @@ async function doRefreshAccountToken(creds) {
     await saveAccount(updated);
     return updated;
 }
+/**
+ * Fill in `accountId` (and the profile's other fields) on a record that predates
+ * them, from one profile GET; saves and returns the record, unchanged when
+ * nothing could be learned. Kept OUT of the token refresh itself so the
+ * refresh stays a single, sequenced token exchange — a caller with a mocked
+ * or injected fetch sees exactly the calls it always did (dario#1263).
+ */
+export async function backfillIdentity(creds, fetchImpl = fetch) {
+    if (creds.accountId)
+        return creds;
+    const profile = await fetchOAuthProfile(creds.accessToken, fetchImpl);
+    if (!profile)
+        return creds;
+    const updated = { ...creds, ...profileFields(profile) };
+    await saveAccount(updated);
+    return updated;
+}
 /** Test-only — inspect the in-flight map. Production code has no business peeking. */
 export function _accountRefreshesInFlightSizeForTest() {
     return accountRefreshesInFlight.size;
@@ -373,11 +509,11 @@ export async function addAccountViaOAuth(alias) {
                     throw new Error(`Token exchange failed (${tokenRes.status}): ${redactSecrets(body.slice(0, 200))}`);
                 }
                 const tokens = await tokenRes.json();
-                // Prefer CC identity if installed; otherwise generate fresh IDs.
-                const identity = (await detectClaudeIdentity()) ?? {
-                    deviceId: randomUUID(),
-                    accountUuid: randomUUID(),
-                };
+                // Who this token is (one GET, never fatal), then which client identity
+                // the alias presents — see chooseClientIdentity.
+                const profile = await fetchOAuthProfile(tokens.access_token);
+                const others = (await loadAllAccounts()).filter((a) => a.alias !== alias);
+                const identity = await chooseClientIdentity(others, profile);
                 const creds = {
                     alias,
                     accessToken: tokens.access_token,
@@ -386,7 +522,9 @@ export async function addAccountViaOAuth(alias) {
                     scopes: tokens.scope?.split(' ') ?? cfg.scopes.split(' '),
                     deviceId: identity.deviceId,
                     accountUuid: identity.accountUuid,
+                    identityFrom: identity.identityFrom,
                     grantedAt: Date.now(),
+                    ...profileFields(profile),
                 };
                 await saveAccount(creds);
                 resolve(creds);
@@ -510,10 +648,9 @@ export async function completeAddAccount(alias, code, codeVerifier, state) {
         throw new Error(`Token exchange failed (${tokenRes.status}): ${redactSecrets(body.slice(0, 200))}`);
     }
     const tokens = await tokenRes.json();
-    const identity = (await detectClaudeIdentity()) ?? {
-        deviceId: randomUUID(),
-        accountUuid: randomUUID(),
-    };
+    const profile = await fetchOAuthProfile(tokens.access_token);
+    const others = (await loadAllAccounts()).filter((a) => a.alias !== alias);
+    const identity = await chooseClientIdentity(others, profile);
     const creds = {
         alias,
         accessToken: tokens.access_token,
@@ -522,7 +659,9 @@ export async function completeAddAccount(alias, code, codeVerifier, state) {
         scopes: tokens.scope?.split(' ') ?? cfg.scopes.split(' '),
         deviceId: identity.deviceId,
         accountUuid: identity.accountUuid,
+        identityFrom: identity.identityFrom,
         grantedAt: Date.now(),
+        ...profileFields(profile),
     };
     await saveAccount(creds);
     return creds;
@@ -583,12 +722,10 @@ export async function addAccountFromKeychain(alias, target) {
     if (!oauth?.accessToken || !oauth?.refreshToken) {
         throw new KeychainImportError(`Keychain entry "${chosen.target}" is missing accessToken/refreshToken — re-authenticate Claude Code.`, 'empty');
     }
-    // Same identity preference as addAccountViaOAuth — prefer CC identity if
-    // installed; otherwise generate fresh IDs.
-    const identity = (await detectClaudeIdentity()) ?? {
-        deviceId: randomUUID(),
-        accountUuid: randomUUID(),
-    };
+    // Same profile-and-policy as addAccountViaOAuth — see chooseClientIdentity.
+    const profile = await fetchOAuthProfile(oauth.accessToken);
+    const others = (await loadAllAccounts()).filter((a) => a.alias !== alias);
+    const identity = await chooseClientIdentity(others, profile);
     const creds = {
         alias,
         accessToken: oauth.accessToken,
@@ -597,7 +734,9 @@ export async function addAccountFromKeychain(alias, target) {
         scopes: oauth.scopes ?? ['user:inference'],
         deviceId: identity.deviceId,
         accountUuid: identity.accountUuid,
+        identityFrom: identity.identityFrom,
         grantedAt: oauth.grantedAt,
+        ...profileFields(profile),
     };
     await saveAccount(creds);
     return creds;
@@ -645,10 +784,12 @@ export async function ensureLoginCredentialsInPool(alias = MIGRATED_LOGIN_ALIAS)
     const tok = creds?.claudeAiOauth;
     if (!tok?.accessToken || !tok?.refreshToken)
         return null;
-    const identity = (await detectClaudeIdentity()) ?? {
-        deviceId: randomUUID(),
-        accountUuid: randomUUID(),
-    };
+    // The login seat IS the machine's Claude Code account, so its identity is
+    // the local one when there is one — the policy in chooseClientIdentity
+    // exists for the OTHER aliases.
+    const cc = await detectClaudeIdentity();
+    const identity = cc ?? { deviceId: randomUUID(), accountUuid: randomUUID() };
+    const profile = await fetchOAuthProfile(tok.accessToken);
     await saveAccount({
         alias,
         accessToken: tok.accessToken,
@@ -657,7 +798,9 @@ export async function ensureLoginCredentialsInPool(alias = MIGRATED_LOGIN_ALIAS)
         scopes: tok.scopes ?? [],
         deviceId: identity.deviceId,
         accountUuid: identity.accountUuid,
+        identityFrom: cc ? 'claude-code' : 'generated',
         grantedAt: tok.grantedAt,
+        ...profileFields(profile),
     });
     return alias;
 }

package/dist/admin-api.d.ts

@@ -115,8 +115,21 @@ export interface AdminAccountLive {
     lastRejectedAt: number | null;
     /** Organization observed on this seat's responses, or `null` if none yet (dario#1244). */
     organizationId: string | null;
-    /** Other aliases whose last reading names the same live window — one subscription under several aliases. */
+    /**
+     * Other aliases that are the SAME Anthropic account (same OAuth account
+     * uuid) — one subscription under several aliases (dario#1244). Kept under
+     * its original name for readers of the older payload; `sameAccountAs` is the
+     * same list. Until 6.0.38 this was inferred from a shared reset second,
+     * which Anthropic's 20-minute reset grid makes meaningless (dario#1263).
+     */
     sharesWindowWith: string[];
+    sameAccountAs?: string[];
+    /** OAuth account uuid behind the seat's token, or null until identified. */
+    accountId?: string | null;
+    /** Masked email on that account, or null. */
+    accountEmail?: string | null;
+    rateLimitTier?: string | null;
+    seatTier?: string | null;
     /** Peer instance whose reading this seat currently carries (shared pool state), or `null` for this instance's own. */
     readingFrom: string | null;
     /**

package/dist/admin-api.js

@@ -1,3 +1,4 @@
+import { maskEmail } from './pool.js';
 import { timingSafeEqual } from 'node:crypto';
 import { startAddAccount, completeAddAccount, removeAccount, listAccountAliases, loadAccount, } from './accounts.js';
 import { parseManualPaste } from './oauth.js';
@@ -362,6 +363,10 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
                     // From the record (written with the seat's last token refresh), so
                     // it is known without a live pool entry.
                     organization_id: r.organizationId ?? null,
+                    // Identity from the record (grant-time OAuth profile); the live
+                    // block below repeats it when the seat is in the running pool.
+                    account_id: r.accountId ?? null,
+                    account_email: maskEmail(r.accountEmail),
                     // Inline the running pool's live status when this account is in it.
                     ...(l ? {
                         util5h: l.util5h,
@@ -375,6 +380,11 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
                         reset_in_ms: l.resetInMs ?? null,
                         ...(l.organizationId ? { organization_id: l.organizationId } : {}),
                         shares_window_with: l.sharesWindowWith ?? [],
+                        same_account_as: l.sameAccountAs ?? l.sharesWindowWith ?? [],
+                        ...(l.accountId ? { account_id: l.accountId } : {}),
+                        ...(l.accountEmail ? { account_email: l.accountEmail } : {}),
+                        ...(l.rateLimitTier ? { rate_limit_tier: l.rateLimitTier } : {}),
+                        ...(l.seatTier ? { seat_tier: l.seatTier } : {}),
                         reading_from: l.readingFrom ?? null,
                         claim: l.claim,
                         status: l.status,

package/dist/cli.d.ts

@@ -130,6 +130,9 @@ export interface LiveSeat {
     organizationId?: string | null;
     sharesWindowWith?: string[];
     grantedAt?: number | null;
+    sameAccountAs?: string[];
+    accountId?: string | null;
+    accountEmail?: string | null;
 }
 export interface LivePayload {
     mode?: string;
@@ -165,3 +168,11 @@ export declare function formatLiveAccountsListing(payload: LivePayload, port: nu
  * guard from #137 (v3.31.15).
  */
 export declare function isMainEntry(argv1: string | undefined | null, moduleHref: string, realpath?: (p: string) => string): boolean;
+/**
+ * `dario accounts identity` — which client identity each seat presents in
+ * `metadata.user_id`, where it came from, and which seats share one across
+ * DIFFERENT accounts (dario#1244, 2026-09-08). `--fresh <alias>...` / `--all`
+ * rewrites the named seats' identity; the running proxy presents the new one
+ * on each seat's next request, no restart.
+ */
+export declare function runAccountsIdentity(args: string[]): Promise<void>;

package/dist/cli.js

@@ -17,6 +17,8 @@
 // just want `parsePositiveIntEnv`) doesn't trigger a Bun relaunch or any
 // other startup side effect.
 import { unlink } from 'node:fs/promises';
+import { loadAllAccounts as loadAllAccountsForIdentity, regenerateClientIdentity } from './accounts.js';
+import { maskEmail } from './pool.js';
 import { realpathSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
@@ -915,7 +917,7 @@ export function formatLiveAccountsListing(payload, port, now) {
     lines.push('  ────────────────');
     lines.push('');
     const windows = typeof payload.distinctWindows === 'number' ? payload.distinctWindows : seats.length;
-    lines.push(`  Pool of ${seats.length} (${seats.length === 1 ? '1 seat' : seats.length + ' seats'} on ${windows} distinct window${windows === 1 ? '' : 's'})`);
+    lines.push(`  Pool of ${seats.length} (${seats.length === 1 ? '1 seat' : seats.length + ' seats'} on ${windows} distinct account${windows === 1 ? '' : 's'})`);
     lines.push('');
     for (const s of seats) {
         const alias = typeof s.alias === 'string' ? s.alias : '(unnamed)';
@@ -932,7 +934,11 @@ export function formatLiveAccountsListing(payload, port, now) {
             `429s ${num(s.rejectedCount)}`,
             ...(next ? [next] : []),
             typeof s.organizationId === 'string' && s.organizationId ? `org ${s.organizationId.slice(0, 8)}…` : 'org not yet observed',
-            ...(Array.isArray(s.sharesWindowWith) && s.sharesWindowWith.length > 0 ? [`shares its window with ${s.sharesWindowWith.join(', ')}`] : []),
+            ...(typeof s.accountEmail === 'string' && s.accountEmail ? [`account ${s.accountEmail}`] : []),
+            ...((() => {
+                const same = Array.isArray(s.sameAccountAs) ? s.sameAccountAs : Array.isArray(s.sharesWindowWith) ? s.sharesWindowWith : [];
+                return same.length > 0 ? [`same account as ${same.join(', ')}`] : [];
+            })()),
         ];
         lines.push(`    ${''.padEnd(20)} ${facts.join('  ·  ')}`);
         lines.push(`    ${''.padEnd(20)} ${describeGrantAge(grantAge(typeof s.grantedAt === 'number' ? s.grantedAt : undefined, now))}`);
@@ -1232,8 +1238,12 @@ async function accounts() {
         }
         return;
     }
+    if (sub === 'identity') {
+        await runAccountsIdentity(args);
+        return;
+    }
     console.error(`[dario] Unknown accounts subcommand: ${sub}`);
-    console.error('Usage: dario accounts [list|add <alias>|check <alias>|remove <alias>]');
+    console.error('Usage: dario accounts [list|add <alias>|check <alias>|remove <alias>|identity [--fresh <alias>...|--all]]');
     process.exit(1);
 }
 /**
@@ -2571,3 +2581,70 @@ if (isDirectEntry) {
         process.exit(1);
     });
 }
+/**
+ * `dario accounts identity` — which client identity each seat presents in
+ * `metadata.user_id`, where it came from, and which seats share one across
+ * DIFFERENT accounts (dario#1244, 2026-09-08). `--fresh <alias>...` / `--all`
+ * rewrites the named seats' identity; the running proxy presents the new one
+ * on each seat's next request, no restart.
+ */
+export async function runAccountsIdentity(args) {
+    const fresh = args.includes('--fresh');
+    const all = args.includes('--all');
+    const named = args.slice(2).filter((a) => !a.startsWith('--'));
+    const accounts = await loadAllAccountsForIdentity();
+    if (fresh) {
+        const targets = all ? accounts.map((a) => a.alias) : named;
+        if (targets.length === 0) {
+            console.error('');
+            console.error('  Usage: dario accounts identity --fresh <alias> [<alias>...]   or   --fresh --all');
+            console.error('');
+            process.exit(1);
+        }
+        const done = await regenerateClientIdentity(targets);
+        for (const alias of done)
+            console.log(`[dario] "${alias}": fresh client identity written — the running proxy presents it on the seat's next request.`);
+        const missing = targets.filter((t) => !done.includes(t));
+        for (const alias of missing)
+            console.error(`[dario] No account "${alias}" found.`);
+        if (missing.length > 0)
+            process.exit(1);
+        return;
+    }
+    console.log('');
+    console.log('  dario — Client identity per seat');
+    console.log('  ────────────────');
+    console.log('');
+    const byIdentity = new Map();
+    for (const a of accounts) {
+        const k = `${a.deviceId}|${a.accountUuid}`;
+        const list = byIdentity.get(k);
+        if (list)
+            list.push(a.alias);
+        else
+            byIdentity.set(k, [a.alias]);
+    }
+    for (const a of accounts) {
+        const source = a.identityFrom ?? (a.deviceId ? 'unrecorded' : 'none');
+        const who = a.accountEmail ? maskEmail(a.accountEmail) : a.accountId ? `${a.accountId.slice(0, 8)}…` : 'not yet identified';
+        const shared = (byIdentity.get(`${a.deviceId}|${a.accountUuid}`) ?? []).filter((x) => x !== a.alias);
+        const sharedNote = shared.length > 0 ? `  ·  same client identity as ${shared.join(', ')}` : '';
+        console.log(`    ${a.alias.padEnd(20)} identity ${source.padEnd(11)} device ${(a.deviceId || '(empty)').slice(0, 8)}…  account ${who}${sharedNote}`);
+    }
+    const spanning = [...byIdentity.values()].filter((aliases) => {
+        if (aliases.length < 2)
+            return false;
+        const ids = new Set(aliases.map((al) => accounts.find((a) => a.alias === al)?.accountId));
+        return ids.size > 1 || ids.has(undefined);
+    });
+    console.log('');
+    if (spanning.length > 0) {
+        console.log(`  ⚠ ${spanning.length} client identit${spanning.length === 1 ? 'y is' : 'ies are'} shared across different (or unidentified) accounts.`);
+        console.log('    Anthropic ties usage and limits to the identity it sees. Give each seat its own:');
+        console.log(`      dario accounts identity --fresh ${spanning.flat().join(' ')}`);
+    }
+    else {
+        console.log('  OK every seat presents its own client identity, or shares one only with the same account.');
+    }
+    console.log('');
+}

package/dist/doctor-core.d.ts

@@ -156,6 +156,40 @@ export interface OrganizationsInput {
  * until at least two seats have been observed.
  */
 export declare function checkOrganizations(input: OrganizationsInput): Check[];
+export interface AccountIdentityInput {
+    accounts: Array<{
+        alias: string;
+        accountId?: string;
+        accountEmail?: string;
+    }>;
+}
+/**
+ * The Accounts doctor row (dario#1244, #1263): how many distinct Anthropic
+ * accounts the pool's seats are, from the OAuth account uuid each record
+ * carries — the fact, not an inference from reset seconds. Two seats with one
+ * uuid ARE one subscription under two aliases; a seat without one is not yet
+ * identified (its next token refresh fills it in) and is never guessed at.
+ */
+export declare function checkAccountIdentity(input: AccountIdentityInput): Check[];
+export interface SharedClientIdentityInput {
+    accounts: Array<{
+        alias: string;
+        deviceId: string;
+        accountUuid: string;
+        accountId?: string;
+        identityFrom?: string;
+    }>;
+}
+/**
+ * The Client identity doctor row (dario#1244, 2026-09-08). Every `accounts add`
+ * used to copy the machine's Claude Code identity into the new alias, so a
+ * pool of colleagues' tokens on one machine presented ONE `device_id` /
+ * `account_uuid` in `metadata.user_id` across every OAuth account it held.
+ * Anthropic ties what it sees to that identity (see checkIdentityDrift).
+ * Seats that are genuinely the same account may share it; seats that are
+ * different accounts, or not yet identified, must not.
+ */
+export declare function checkSharedClientIdentity(input: SharedClientIdentityInput): Check[];
 export declare function checkIdentityDrift(input: IdentityDriftInput): Check[];
 export declare function probeNpmLatestCC(): string | null;
 /**