@dst-justin/relay 2.0.0

package/relay

@@ -0,0 +1,815 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────
+# relay v2 — multi-account switcher for Claude Code
+#   !relay          account menu + usage
+#   !relay 2        switch by index
+#   !relay work     switch by name
+# compatible with macOS bash 3.2 / Linux / WSL
+# ─────────────────────────────────────────────────────────────────────
+set -u
+
+RELAY_DIR="${HOME}/.claude-relay"
+CREDS_STORE="${RELAY_DIR}/credentials"
+META_STORE="${RELAY_DIR}/meta"
+CURRENT_FILE="${RELAY_DIR}/current"
+CLAUDE_DIR="${HOME}/.claude"
+CLAUDE_JSON="${HOME}/.claude.json"
+REAL_CLAUDE=$(command -v claude 2>/dev/null || echo "")
+# macOS: /usr/bin/python3 uses the system TLS stack (correct certs);
+# /usr/local/bin/python3 (Homebrew/standalone) often lacks bundled certs → SSL failures
+if [[ "$(uname)" == "Darwin" ]] && [[ -x "/usr/bin/python3" ]]; then
+  PY="/usr/bin/python3"
+else
+  PY=$(command -v python3 || command -v python || echo "")
+fi
+
+# Credential helpers — macOS Keychain or Linux file fallback
+# Claude Code on macOS: Keychain service "Claude Code-credentials"
+# Claude Code on Linux: ~/.claude/.credentials.json
+CC_KC_SVC="Claude Code-credentials"
+LINUX_CREDS="${CLAUDE_DIR}/.credentials.json"
+
+kc_read() {
+  if [[ "$(uname)" == "Darwin" ]]; then
+    security find-generic-password -s "${CC_KC_SVC}" -a "$(whoami)" -w 2>/dev/null
+  else
+    [[ -f "${LINUX_CREDS}" ]] && cat "${LINUX_CREDS}" || echo ""
+  fi
+}
+
+kc_write() {
+  local content="$1"
+  if [[ "$(uname)" == "Darwin" ]]; then
+    local user; user=$(whoami)
+    security delete-generic-password -s "${CC_KC_SVC}" -a "${user}" >/dev/null 2>&1 || true
+    security add-generic-password -s "${CC_KC_SVC}" -a "${user}" -w "${content}" >/dev/null 2>&1
+  else
+    printf '%s' "${content}" > "${LINUX_CREDS}"
+    chmod 600 "${LINUX_CREDS}"
+  fi
+}
+
+R=$'\033[0m'; B=$'\033[1m'; D=$'\033[2m'
+CY=$'\033[36m'; GR=$'\033[32m'; YL=$'\033[33m'; RD=$'\033[31m'; MG=$'\033[35m'
+
+log()  { printf "  ${CY}→${R} %s\n" "$*"; }
+ok()   { printf "  ${GR}✓${R} %s\n" "$*"; }
+warn() { printf "  ${YL}⚠${R} %s\n" "$*"; }
+err()  { printf "  ${RD}✗${R} %s\n" "$*" >&2; }
+hdr()  { printf "\n${B}${MG}  %s${R}\n  ${D}─────────────────────────────────────${R}\n" "$*"; }
+
+mkdir -p "${CREDS_STORE}" "${META_STORE}" "${CLAUDE_DIR}"
+chmod 700 "${RELAY_DIR}" "${CREDS_STORE}" 2>/dev/null || true
+
+[[ -z "${PY}" ]] && { err "python3 is required"; exit 1; }
+
+current_name()   { [[ -f "${CURRENT_FILE}" ]] && cat "${CURRENT_FILE}" || echo ""; }
+account_creds()  { echo "${CREDS_STORE}/$1.json"; }
+account_meta()   { echo "${META_STORE}/$1"; }
+account_exists() { [[ -f "$(account_creds "$1")" ]]; }
+
+# list accounts sorted, one per line (bash 3.2 compatible)
+list_account_names() {
+  local f
+  for f in "${CREDS_STORE}"/*.json; do
+    [[ -f "${f}" ]] || continue
+    basename "${f}" .json
+  done | sort
+}
+
+account_by_index() {
+  local idx="$1" i=1 name
+  while IFS= read -r name; do
+    [[ "${i}" -eq "${idx}" ]] && { echo "${name}"; return 0; }
+    i=$((i+1))
+  done < <(list_account_names)
+  return 1
+}
+
+# read the logged-in email from ~/.claude.json (written by Claude Code after login)
+grab_email_from_claude_json() {
+  [[ -f "${CLAUDE_JSON}" ]] || { echo ""; return; }
+  "${PY}" - "${CLAUDE_JSON}" 2>/dev/null <<'EOF'
+import json, sys
+try:
+    d = json.load(open(sys.argv[1]))
+    acct = d.get('oauthAccount') or {}
+    print(acct.get('emailAddress') or '')
+except: print('')
+EOF
+}
+
+get_meta_email() {
+  local f; f=$(account_meta "$1")
+  [[ -f "${f}" ]] && cat "${f}" || echo "—"
+}
+
+save_meta_email() {
+  local name="$1"
+  local email
+  email=$(grab_email_from_claude_json)
+  [[ -n "${email}" ]] && echo "${email}" > "$(account_meta "${name}")"
+}
+
+require_account() {
+  account_exists "$1" && return 0
+  return 1
+}
+
+require_claude() {
+  [[ -n "${REAL_CLAUDE}" ]] && return 0
+  err "claude not found — install it with: npm i -g @anthropic-ai/claude-code"
+  exit 1
+}
+
+# ══════════════════════════════════════════════════════════════════
+# Python core: parallel usage fetch + table rendering
+# args: <mode: quick|full> <creds_dir> <meta_dir> <current_name> [--no-usage]
+# ══════════════════════════════════════════════════════════════════
+render_table() {
+  "${PY}" - "$@" <<'EOF'
+import sys, os, json, glob, datetime, urllib.request, urllib.error, urllib.parse, platform, subprocess
+from concurrent.futures import ThreadPoolExecutor, as_completed
+
+mode, creds_dir, meta_dir, current = sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4]
+no_usage = '--no-usage' in sys.argv
+relay_dir = os.path.dirname(creds_dir)
+cache_file = os.path.join(relay_dir, 'usage_cache.json')
+CACHE_TTL = 120  # seconds
+
+R='\033[0m'; B='\033[1m'; D='\033[2m'
+CY='\033[36m'; GR='\033[32m'; YL='\033[33m'; RD='\033[31m'; MG='\033[35m'
+
+def color(u): return GR if u < 50 else (YL if u < 80 else RD)
+
+def bar(u, w=10):
+    f = round(u/100*w)
+    return color(u) + '[' + '█'*f + '░'*(w-f) + ']' + R
+
+def reset_in(iso):
+    try:
+        ts = datetime.datetime.fromisoformat(iso.replace('Z','+00:00'))
+        s = (ts - datetime.datetime.now(datetime.timezone.utc)).total_seconds()
+        if s <= 0: return 'resetting'
+        h, rem = divmod(int(s), 3600)
+        return f'{h}h{rem//60:02d}m'
+    except Exception:
+        return '—'
+
+names = sorted(os.path.basename(p)[:-5] for p in glob.glob(os.path.join(creds_dir, '*.json')))
+if not names:
+    print(f'  \033[33m⚠\033[0m No accounts yet. Run: {B}relay add <name>{R}')
+    sys.exit(0)
+
+def get_email(name):
+    p = os.path.join(meta_dir, name)
+    try:
+        return open(p).read().strip() or '—'
+    except Exception:
+        return '—'
+
+def update_live_creds(content):
+    if platform.system() == 'Darwin':
+        user = subprocess.run(['whoami'], capture_output=True, text=True).stdout.strip()
+        svc = 'Claude Code-credentials'
+        subprocess.run(['security', 'delete-generic-password', '-s', svc, '-a', user], capture_output=True)
+        subprocess.run(['security', 'add-generic-password', '-s', svc, '-a', user, '-w', content], capture_output=True)
+    else:
+        live = os.path.join(os.path.expanduser('~'), '.claude', '.credentials.json')
+        with open(live, 'w') as f: f.write(content)
+        os.chmod(live, 0o600)
+
+def try_refresh(name, cred_path):
+    try:
+        d = json.load(open(cred_path))
+        oauth = d.get('claudeAiOauth') or {}
+        refresh_tok = oauth.get('refreshToken', '')
+        if not refresh_tok:
+            return None
+        params = urllib.parse.urlencode({'grant_type': 'refresh_token', 'refresh_token': refresh_tok}).encode()
+        req = urllib.request.Request(
+            'https://api.anthropic.com/token',
+            data=params,
+            headers={'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'relay/2.0'})
+        with urllib.request.urlopen(req, timeout=10) as r:
+            resp = json.loads(r.read())
+        oauth['accessToken'] = resp['access_token']
+        if 'refresh_token' in resp:
+            oauth['refreshToken'] = resp['refresh_token']
+        expires_in = resp.get('expires_in', 3600)
+        oauth['expiresAt'] = int(datetime.datetime.now(datetime.timezone.utc).timestamp() * 1000) + expires_in * 1000
+        d['claudeAiOauth'] = oauth
+        content = json.dumps(d)
+        with open(cred_path, 'w') as f: f.write(content)
+        os.chmod(cred_path, 0o600)
+        if name == current:
+            update_live_creds(content)
+        return oauth['accessToken']
+    except Exception:
+        return None
+
+_cache = None
+def load_cache():
+    global _cache
+    if _cache is not None:
+        return _cache
+    try:
+        _cache = json.load(open(cache_file))
+    except Exception:
+        _cache = {}
+    return _cache
+
+def save_cache(c):
+    try:
+        with open(cache_file, 'w') as f: json.dump(c, f)
+    except Exception:
+        pass
+
+def fetch(name):
+    cred_path = os.path.join(creds_dir, name + '.json')
+    try:
+        d = json.load(open(cred_path))
+        oauth = d.get('claudeAiOauth') or {}
+        tok = oauth.get('accessToken', '')
+        if not tok:
+            return name, None
+
+        # Short-circuit: token is locally known to be expired
+        expires_at_ms = oauth.get('expiresAt', 0)
+        now_ms = datetime.datetime.now(datetime.timezone.utc).timestamp() * 1000
+        if expires_at_ms and now_ms > expires_at_ms:
+            return name, 'expired'
+
+        # Check cache
+        c = load_cache()
+        entry = c.get(name)
+        if entry and now_ms / 1000 - entry.get('ts', 0) < CACHE_TTL:
+            return name, entry.get('data')
+
+        req = urllib.request.Request(
+            'https://api.anthropic.com/api/oauth/usage',
+            headers={'Authorization': 'Bearer ' + tok, 'User-Agent': 'relay/2.0'})
+        with urllib.request.urlopen(req, timeout=6) as r:
+            data = json.loads(r.read())
+        c[name] = {'ts': now_ms / 1000, 'data': data}
+        save_cache(c)
+        return name, data
+    except urllib.error.HTTPError as e:
+        if e.code == 401:
+            return name, 'expired'
+        return name, None
+    except Exception:
+        return name, None
+
+usage = {}
+if not no_usage:
+    sys.stderr.write('  \033[2mfetching usage...\033[0m\r')
+    sys.stderr.flush()
+    with ThreadPoolExecutor(max_workers=min(len(names), 6)) as ex:
+        for fut in as_completed([ex.submit(fetch, n) for n in names]):
+            n, d = fut.result()
+            usage[n] = d
+    sys.stderr.write(' ' * 30 + '\r')
+    sys.stderr.flush()
+
+def u5_str(d):
+    if d == 'expired': return f'{YL}⚠ token expired{R}'
+    if not d: return '—'
+    fh = d.get('five_hour') or {}
+    u = int(fh.get('utilization', 0) or 0)
+    t = reset_in(fh.get('resets_at', ''))
+    c = color(u)
+    return f'{bar(u)} {c}{u:3d}%{R} {D}({t}){R}'
+
+def u7_str(d, name=''):
+    if d == 'expired': return f'{YL}relay refresh {name}{R}' if name else f'{YL}relay refresh <name>{R}'
+    if not d: return '—'
+    sd = d.get('seven_day') or {}
+    u = sd.get('utilization')
+    if u is None: return '—'
+    u = int(u)
+    c = color(u)
+    f = round(u/100*8)
+    return f'{c}[' + '█'*f + '░'*(8-f) + f']{R} {c}{u}%{R}'
+
+if mode == 'quick':
+    print(f'\n  {B}{MG}relay{R} {D}— switch account{R}')
+    print(f'  {D}' + '─'*45 + R)
+    for i, name in enumerate(names, 1):
+        cur = name == current
+        marker = f'{GR}{B}●{R}' if cur else f'{D}{i}{R}'
+        ncol = GR + B if cur else B
+        email = get_email(name)
+        u = u5_str(usage.get(name)) if not no_usage else ''
+        print(f'  {marker}  {ncol}{name:<12}{R}  {D}{email:<26}{R}  {u}')
+    print()
+    print(f'  {D}switch:{R} {CY}!relay <index or name>{R}   {D}details:{R} {CY}!relay status{R}')
+    print()
+else:
+    print(f'  {B}{"#":<3}{"account":<13} {"email":<28} {"5hr usage":<34} 7d usage{R}')
+    print(f'  {D}' + '─'*88 + R)
+    for i, name in enumerate(names, 1):
+        cur = name == current
+        marker = f'{GR}●{R}' if cur else ' '
+        ncol = GR + B if cur else B
+        email = get_email(name)
+        d = usage.get(name)
+        u5 = u5_str(d) if not no_usage else '—'
+        u7 = u7_str(d, name) if not no_usage else '—'
+        # ANSI codes don't consume display width — pad manually for alignment
+        print(f'  {marker} {D}{i:<2}{R}{ncol}{name:<12}{R} {email:<28} {u5:<52} {u7}')
+    print()
+    n_warn = sum(1 for d in usage.values() if isinstance(d, dict) and (d.get('five_hour') or {}).get('utilization', 0) >= 80)
+    if n_warn:
+        print(f'  {RD}⚠ {n_warn} account(s) above 80% usage{R}')
+EOF
+}
+
+# ══════════════════════════════════════════════════════════════════
+# Core switch logic
+# ══════════════════════════════════════════════════════════════════
+do_switch() {
+  local name="$1"
+  local current; current=$(current_name)
+
+  if [[ "${current}" == "${name}" ]]; then
+    ok "Already on account '${B}${name}${R}'"
+    return 0
+  fi
+
+  # Back up the current account's live token before switching
+  # (Claude Code refreshes tokens in-place; the snapshot may be stale)
+  if [[ -n "${current}" ]] && account_exists "${current}"; then
+    local live; live=$(kc_read 2>/dev/null)
+    [[ -n "${live}" ]] && printf '%s' "${live}" > "$(account_creds "${current}")"
+  fi
+
+  echo "${name}" > "${CURRENT_FILE}"
+
+  # Write the target account's credentials into the store Claude Code reads
+  local content; content=$(cat "$(account_creds "${name}")")
+  kc_write "${content}" || warn "Credential write failed — switch may not take effect"
+
+  local email; email=$(get_meta_email "${name}")
+  printf "\n  ${GR}${B}✓ switched → %s${R}  ${D}%s${R}\n" "${name}" "${email}"
+  printf "  ${D}Restart claude to apply. Resume last session: ${CY}claude -c${R}\n\n"
+}
+
+# ══════════════════════════════════════════════════════════════════
+# Commands
+# ══════════════════════════════════════════════════════════════════
+
+# Sync the current account's token from credential store to its snapshot file
+# before displaying usage — prevents showing stale/expired tokens as "—"
+_sync_current_creds() {
+  local cur; cur=$(current_name)
+  [[ -z "${cur}" ]] || ! account_exists "${cur}" && return
+  local live; live=$(kc_read 2>/dev/null)
+  [[ -n "${live}" ]] && printf '%s' "${live}" > "$(account_creds "${cur}")"
+}
+
+cmd_quick() { _sync_current_creds; render_table quick "${CREDS_STORE}" "${META_STORE}" "$(current_name)" "$@"; }
+
+cmd_list() {
+  hdr "Account List"
+  _sync_current_creds
+  render_table full "${CREDS_STORE}" "${META_STORE}" "$(current_name)" "$@"
+  echo ""
+  ok "Inside Claude Code: ${CY}!relay <index>${R} to switch"
+}
+
+cmd_status() {
+  _sync_current_creds
+  local current; current=$(current_name)
+  hdr "Current Status"
+  if [[ -z "${current}" ]]; then
+    warn "No account set (using system default)"
+  elif ! account_exists "${current}"; then
+    warn "Recorded account '${current}' no longer exists"
+  else
+    "${PY}" - "$(account_creds "${current}")" "${current}" "$(get_meta_email "${current}")" <<'EOF'
+import json, sys, datetime, urllib.request
+
+creds_path, name, email = sys.argv[1], sys.argv[2], sys.argv[3]
+R='\033[0m'; B='\033[1m'; D='\033[2m'
+GR='\033[32m'; YL='\033[33m'; RD='\033[31m'; CY='\033[36m'
+
+print(f'  {B}Account:{R} {GR}{B}{name}{R}')
+print(f'  {B}Email:{R}   {email}')
+
+try:
+    d = json.load(open(creds_path))
+    tok = (d.get('claudeAiOauth') or {}).get('accessToken', '')
+    if not tok:
+        print(f'\n  {YL}⚠ No access token — please log in again{R}'); sys.exit(0)
+    req = urllib.request.Request(
+        'https://api.anthropic.com/api/oauth/usage',
+        headers={'Authorization': 'Bearer ' + tok, 'User-Agent': 'relay/2.0'})
+    with urllib.request.urlopen(req, timeout=8) as r:
+        u = json.loads(r.read())
+except Exception as e:
+    print(f'\n  {RD}✗ Usage query failed: {e}{R}'); sys.exit(0)
+
+def color(x): return GR if x < 50 else (YL if x < 80 else RD)
+def bar(x, w=24):
+    f = round(x/100*w); return '█'*f + '░'*(w-f)
+def til(iso):
+    try:
+        ts = datetime.datetime.fromisoformat(iso.replace('Z','+00:00'))
+        s = (ts - datetime.datetime.now(datetime.timezone.utc)).total_seconds()
+        if s <= 0: return 'resetting now'
+        h, rem = divmod(int(s), 3600)
+        return f'resets in {h}h {rem//60:02d}m'
+    except Exception: return '—'
+
+fh = u.get('five_hour') or {}
+u5 = int(fh.get('utilization', 0) or 0)
+c5 = color(u5)
+print(f'\n  {B}5hr usage:{R}')
+print(f'    {c5}[{bar(u5)}]{R} {c5}{B}{u5}%{R}')
+print(f'    {D}{til(fh.get("resets_at",""))}{R}')
+
+sd = u.get('seven_day') or {}
+if sd and sd.get('utilization') is not None:
+    u7 = int(sd['utilization']); c7 = color(u7)
+    print(f'\n  {B}7d usage:{R}')
+    print(f'    {c7}[{bar(u7)}]{R} {c7}{u7}%{R}')
+    if sd.get('resets_at'):
+        print(f'    {D}{til(sd["resets_at"])}{R}')
+
+print()
+if u5 >= 90:   print(f'  {RD}{B}⚠  Approaching limit — consider switching: !relay <other>{R}')
+elif u5 >= 70: print(f'  {YL}⚡ Usage is high — watch for rate limits{R}')
+else:          print(f'  {GR}✓  Usage is normal{R}')
+EOF
+  fi
+  local n=0
+  [[ -d "${CLAUDE_DIR}/projects" ]] && \
+    n=$(find "${CLAUDE_DIR}/projects" -name "*.jsonl" 2>/dev/null | wc -l | tr -d ' ')
+  printf "\n  ${B}Sessions:${R} %s (shared across all accounts in ~/.claude/projects/)\n" "${n}"
+}
+
+cmd_add() {
+  local name="${1:-}"
+  [[ -z "${name}" ]] && { err "usage: relay add <name>"; exit 1; }
+  case "${name}" in
+    *[!a-zA-Z0-9_-]*) err "name must contain only letters, numbers, underscores, or hyphens"; exit 1 ;;
+  esac
+  require_claude
+  if account_exists "${name}"; then
+    warn "Account '${name}' already exists"
+    log "To re-login: ${B}relay add-force ${name}${R}"
+    return 0
+  fi
+
+  hdr "Add account: ${name}"
+  warn "Complete the browser login then return to this terminal"
+  echo ""
+
+  # Record the token before login to detect whether a real new login occurred
+  local tok_before; tok_before=$(kc_read 2>/dev/null | \
+    "${PY}" -c "import json,sys; d=json.load(sys.stdin); print((d.get('claudeAiOauth') or {}).get('accessToken',''))" 2>/dev/null || echo "")
+
+  "${REAL_CLAUDE}" /login || true
+
+  local kc_creds tok_after
+  kc_creds=$(kc_read 2>/dev/null)
+  tok_after=$(printf '%s' "${kc_creds}" | \
+    "${PY}" -c "import json,sys; d=json.load(sys.stdin); print((d.get('claudeAiOauth') or {}).get('accessToken',''))" 2>/dev/null || echo "")
+
+  if [[ -z "${kc_creds}" ]]; then
+    err "No credentials found after login"
+    log "If login succeeded, run: ${B}relay save ${name}${R}"
+    exit 1
+  fi
+
+  if [[ -n "${tok_before}" ]] && [[ "${tok_before}" == "${tok_after}" ]]; then
+    err "Login did not complete (token unchanged)"
+    warn "Run relay add from a regular Terminal — browser login is not available inside Claude Code"
+    log "To save the current account under a new name: ${B}relay save ${name}${R}"
+    exit 1
+  fi
+
+  printf '%s' "${kc_creds}" > "$(account_creds "${name}")"
+  chmod 600 "$(account_creds "${name}")"
+  save_meta_email "${name}"
+  echo "${name}" > "${CURRENT_FILE}"
+  ok "Account '${B}${name}${R}' added  ${D}$(get_meta_email "${name}")${R}"
+}
+
+cmd_save() {
+  local name="${1:-}"
+  [[ -z "${name}" ]] && { err "usage: relay save <name>"; exit 1; }
+  hdr "Save current account as: ${name}"
+
+  local saved=0
+  local kc; kc=$(kc_read 2>/dev/null)
+  if [[ -n "${kc}" ]]; then
+    printf '%s' "${kc}" > "$(account_creds "${name}")"
+    chmod 600 "$(account_creds "${name}")"
+    if [[ "$(uname)" == "Darwin" ]]; then ok "Saved from Keychain"
+    else ok "Saved from ~/.claude/.credentials.json"
+    fi
+    saved=1
+  fi
+  [[ ${saved} -eq 0 ]] && { err "No credentials found — log in first with: claude /login"; exit 1; }
+
+  save_meta_email "${name}"
+  echo "${name}" > "${CURRENT_FILE}"
+  ok "Account '${B}${name}${R}' saved  ${D}$(get_meta_email "${name}")${R}"
+}
+
+cmd_refresh() {
+  local name="${1:-}"
+  [[ -z "${name}" ]] && { err "usage: relay refresh <name>"; exit 1; }
+  account_exists "${name}" || { err "Account '${name}' not found"; exit 1; }
+  require_claude
+  hdr "Refresh account: ${name}"
+  warn "Complete the browser login then return to this terminal"
+  echo ""
+
+  local tok_before; tok_before=$(kc_read 2>/dev/null | \
+    "${PY}" -c "import json,sys; d=json.load(sys.stdin); print((d.get('claudeAiOauth') or {}).get('accessToken',''))" 2>/dev/null || echo "")
+
+  "${REAL_CLAUDE}" /login || true
+
+  local kc_creds tok_after
+  kc_creds=$(kc_read 2>/dev/null)
+  tok_after=$(printf '%s' "${kc_creds}" | \
+    "${PY}" -c "import json,sys; d=json.load(sys.stdin); print((d.get('claudeAiOauth') or {}).get('accessToken',''))" 2>/dev/null || echo "")
+
+  if [[ -z "${kc_creds}" ]]; then
+    err "No credentials found after login"
+    exit 1
+  fi
+
+  if [[ -n "${tok_before}" ]] && [[ "${tok_before}" == "${tok_after}" ]]; then
+    err "Login did not complete (token unchanged)"
+    warn "Run relay refresh from a regular Terminal — browser login is not available inside Claude Code"
+    exit 1
+  fi
+
+  printf '%s' "${kc_creds}" > "$(account_creds "${name}")"
+  chmod 600 "$(account_creds "${name}")"
+  save_meta_email "${name}"
+  echo "${name}" > "${CURRENT_FILE}"
+  ok "Account '${B}${name}${R}' refreshed  ${D}$(get_meta_email "${name}")${R}"
+}
+
+cmd_remove() {
+  local name="${1:-}"
+  [[ -z "${name}" ]] && { err "usage: relay remove <name>"; exit 1; }
+  account_exists "${name}" || { err "Account '${name}' not found"; exit 1; }
+  printf "\n  ${YL}Delete '${B}${name}${R}${YL}'? (y/N) ${R}"
+  read -r c
+  [[ "${c}" = "y" || "${c}" = "Y" ]] || { log "cancelled"; return 0; }
+  rm -f "$(account_creds "${name}")" "$(account_meta "${name}")"
+  [[ "$(current_name)" == "${name}" ]] && rm -f "${CURRENT_FILE}"
+  ok "Deleted '${name}' (sessions are unaffected)"
+}
+
+cmd_sessions() {
+  hdr "Sessions (shared across all accounts)"
+  local base="${CLAUDE_DIR}/projects"
+  [[ -d "${base}" ]] || { warn "No sessions found"; return 0; }
+  "${PY}" - "${base}" <<'EOF'
+import os, sys, glob, datetime
+base = sys.argv[1]
+R='\033[0m'; B='\033[1m'; D='\033[2m'; CY='\033[36m'; GR='\033[32m'
+total = 0
+for proj in sorted(os.listdir(base)):
+    pdir = os.path.join(base, proj)
+    if not os.path.isdir(pdir): continue
+    files = sorted(glob.glob(os.path.join(pdir, '*.jsonl')),
+                   key=os.path.getmtime, reverse=True)
+    if not files: continue
+    print(f'\n  {D}{proj}{R}')
+    for i, f in enumerate(files):
+        sid = os.path.basename(f)[:-6]
+        ts = datetime.datetime.fromtimestamp(os.path.getmtime(f)).strftime('%m/%d %H:%M')
+        sz = os.path.getsize(f)
+        szs = f'{sz/1048576:.1f}M' if sz > 1048576 else f'{sz//1024}K'
+        mark = f'  {GR}← latest{R}' if total == 0 and i == 0 else ''
+        print(f'  {CY}{sid:<40}{R} {ts:<12} {szs}{mark}')
+        total += 1
+print()
+print(f'  {total} session(s)' if total else '  No sessions found')
+EOF
+  log "${CY}claude -c${R} resume last  ${D}|${R}  ${CY}claude -r${R} pick one  ${D}|${R}  ${CY}claude --resume <id>${R}"
+}
+
+cmd_install() {
+  local script_path; script_path="$(cd "$(dirname "$0")" && pwd)/$(basename "$0")"
+  local target="/usr/local/bin/relay"
+
+  hdr "Install relay"
+
+  if ln -sf "${script_path}" "${target}" 2>/dev/null; then
+    ok "Installed at ${target}"
+    log "Run ${CY}relay help${R} to verify"
+  elif sudo ln -sf "${script_path}" "${target}" 2>/dev/null; then
+    ok "Installed at ${target} (via sudo)"
+  else
+    warn "Cannot write to /usr/local/bin — installing to ~/bin instead"
+    mkdir -p "${HOME}/bin"
+    ln -sf "${script_path}" "${HOME}/bin/relay"
+    ok "Installed at ${HOME}/bin/relay"
+    echo ""
+    warn "Make sure ~/bin is in your PATH (.zshrc / .bashrc):"
+    printf "  ${CY}echo 'export PATH=\"\$HOME/bin:\$PATH\"' >> ~/.zshrc && source ~/.zshrc${R}\n"
+  fi
+
+  echo ""
+  hdr "First-time setup"
+  printf "  ${B}1. Add your first account${R}\n"
+  printf "  ${CY}relay add personal${R}   ${D}# opens browser login${R}\n\n"
+  printf "  ${B}2. (optional) Add more accounts${R}\n"
+  printf "  ${CY}relay add work${R}\n"
+  printf "  ${CY}relay add backup${R}\n\n"
+  printf "  ${B}3. Switch inside Claude Code${R}\n"
+  printf "  ${CY}!relay${R}        ${D}# menu + usage${R}\n"
+  printf "  ${CY}!relay 2${R}      ${D}# switch to account #2${R}\n"
+  printf "  ${CY}!relay work${R}   ${D}# switch to named account${R}\n\n"
+}
+
+cmd_rename() {
+  local old="${1:-}" new="${2:-}"
+  [[ -z "${old}" || -z "${new}" ]] && { err "usage: relay rename <old-name> <new-name>"; exit 1; }
+  case "${new}" in
+    *[!a-zA-Z0-9_-]*) err "name must contain only letters, numbers, underscores, or hyphens"; exit 1 ;;
+  esac
+  account_exists "${old}" || { err "Account '${old}' not found"; exit 1; }
+  account_exists "${new}" && { err "Account '${new}' already exists"; exit 1; }
+
+  mv "$(account_creds "${old}")" "$(account_creds "${new}")"
+  [[ -f "$(account_meta "${old}")" ]] && mv "$(account_meta "${old}")" "$(account_meta "${new}")"
+  [[ "$(current_name)" == "${old}" ]] && echo "${new}" > "${CURRENT_FILE}"
+  ok "Renamed '${B}${old}${R}' → '${B}${new}${R}'"
+}
+
+_script_dir() {
+  # Resolve symlinks so we find package.json even when installed via npm/symlink
+  local src="$0"
+  while [[ -L "${src}" ]]; do src=$(readlink "${src}"); done
+  cd "$(dirname "${src}")" && pwd -P
+}
+
+_read_version() {
+  local pkg; pkg="$(_script_dir)/package.json"
+  [[ -f "${pkg}" ]] && \
+    "${PY}" -c "import json; print(json.load(open('${pkg}'))['version'])" 2>/dev/null \
+    || echo "unknown"
+}
+
+cmd_version() {
+  printf "relay %s\n" "$(_read_version)"
+}
+
+cmd_update() {
+  hdr "Update relay"
+
+  local current; current=$(_read_version)
+  log "Current version: ${B}${current}${R}"
+
+  # Check latest GitHub release
+  local latest
+  latest=$("${PY}" - 2>/dev/null <<'PYEOF'
+import urllib.request, json, sys
+try:
+    req = urllib.request.Request(
+        'https://api.github.com/repos/darkstar1227/relay/releases/latest',
+        headers={'User-Agent': 'relay-update'})
+    with urllib.request.urlopen(req, timeout=6) as r:
+        print(json.loads(r.read())['tag_name'].lstrip('v'))
+except Exception as e:
+    sys.exit(1)
+PYEOF
+)
+
+  if [[ -z "${latest}" ]]; then
+    warn "Could not reach GitHub — skipping version check"
+  elif [[ "${current}" == "${latest}" ]]; then
+    ok "Already up to date (${current})"; return 0
+  else
+    log "Latest available: ${B}${latest}${R}"
+  fi
+
+  local relay_dir; relay_dir=$(_script_dir)
+  local npm_cmd; npm_cmd=$(command -v npm 2>/dev/null)
+  if [[ -n "${npm_cmd}" ]]; then
+    log "Installing via npm..."
+    npm install -g @dst-justin/relay@latest
+    ok "Updated to $(_read_version)"
+  elif [[ -d "${relay_dir}/.git" ]]; then
+    log "npm not found — updating via git..."
+    git -C "${relay_dir}" pull
+  else
+    err "Cannot update: npm not found and no .git directory"
+    log "Install via npm: ${CY}npm install -g @dst-justin/relay@latest${R}"
+  fi
+}
+
+cmd_uninstall() {
+  hdr "Uninstall relay"
+  warn "This will remove the relay command and all account credential data"
+  printf "\n  ${YL}Continue? (y/N) ${R}"
+  read -r c
+  [[ "${c}" = "y" || "${c}" = "Y" ]] || { log "cancelled"; return 0; }
+
+  local removed=0
+  for p in "/usr/local/bin/relay" "${HOME}/bin/relay"; do
+    if [[ -L "${p}" || -f "${p}" ]]; then
+      rm -f "${p}" 2>/dev/null || sudo rm -f "${p}" 2>/dev/null || warn "Could not remove ${p} (try sudo)"
+      ok "Removed ${p}"
+      removed=1
+    fi
+  done
+  [[ ${removed} -eq 0 ]] && warn "No installed relay command found (delete the script file manually)"
+
+  if [[ -d "${RELAY_DIR}" ]]; then
+    rm -rf "${RELAY_DIR}"
+    ok "Removed ${RELAY_DIR} (all account data)"
+  fi
+
+  printf "\n  ${GR}relay has been fully removed.${R}\n\n"
+}
+
+cmd_help() {
+  printf "\n${B}${CY}  relay${R} ${D}%s — multi-account switcher for Claude Code${R}\n\n" "$(_read_version)"
+  printf "  ${B}Inside Claude Code (prefix with !)${R}\n"
+  printf "  %-32s %s\n" "  !relay"           "account menu + 5hr usage"
+  printf "  %-32s %s\n" "  !relay 2"         "switch to account #2"
+  printf "  %-32s %s\n" "  !relay work"      "switch to named account"
+  printf "  %-32s %s\n" "  !relay status"    "detailed usage for current account"
+  echo ""
+  printf "  ${B}Account management${R}\n"
+  printf "  %-32s %s\n" "  relay add <name>"         "add account via browser login"
+  printf "  %-32s %s\n" "  relay add-force <name>"   "force re-login for existing account"
+  printf "  %-32s %s\n" "  relay refresh <name>"     "re-login to refresh an expired token"
+  printf "  %-32s %s\n" "  relay save <name>"        "save current login state"
+  printf "  %-32s %s\n" "  relay rename <old> <new>" "rename an account"
+  printf "  %-32s %s\n" "  relay list"               "full list with weekly usage"
+  printf "  %-32s %s\n" "  relay list --no-usage"    "list without querying API"
+  printf "  %-32s %s\n" "  relay remove <name>"      "delete an account"
+  printf "  %-32s %s\n" "  relay sessions"           "show all sessions"
+  printf "  %-32s %s\n" "  relay version"             "show current version"
+  printf "  %-32s %s\n" "  relay update"              "update to latest version"
+  printf "  %-32s %s\n" "  relay uninstall"          "remove relay and all account data"
+  echo ""
+  printf "  ${D}switches the OAuth credential (macOS Keychain / Linux ~/.claude/.credentials.json); sessions are shared${R}\n"
+  printf "  ${D}after switching: claude -c to resume, claude --resume <id> for a specific session${R}\n\n"
+}
+
+# ══════════════════════════════════════════════════════════════════
+# Dispatch — single entry point, no fall-through
+# ══════════════════════════════════════════════════════════════════
+CMD="${1:-}"
+[[ $# -gt 0 ]] && shift
+
+case "${CMD}" in
+  "")               cmd_quick "$@" ;;
+  add)              cmd_add "$@" ;;
+  add-force)
+    [[ -n "${1:-}" ]] && rm -f "$(account_creds "$1")" "$(account_meta "$1")"
+    cmd_add "$@" ;;
+  save)             cmd_save "$@" ;;
+  refresh)          cmd_refresh "$@" ;;
+  switch|sw|use)
+    if [[ -z "${1:-}" ]]; then cmd_quick
+    elif [[ "${1}" =~ ^[0-9]+$ ]]; then
+      name=$(account_by_index "$1") || { err "No account at index $1"; cmd_quick --no-usage; exit 1; }
+      do_switch "${name}"
+    else
+      account_exists "$1" || { err "Account '$1' not found"; cmd_quick --no-usage; exit 1; }
+      do_switch "$1"
+    fi ;;
+  list|ls)          cmd_list "$@" ;;
+  status|st)        cmd_status ;;
+  remove|rm|del)    cmd_remove "$@" ;;
+  rename|mv)        cmd_rename "$@" ;;
+  sessions|sess)    cmd_sessions ;;
+  version|--version|-V) cmd_version ;;
+  update)           cmd_update ;;
+  install)          cmd_install ;;
+  uninstall)        cmd_uninstall ;;
+  continue|cont|c)
+    if [[ -n "${1:-}" ]]; then
+      account_exists "$1" && do_switch "$1"
+    fi
+    require_claude
+    exec "${REAL_CLAUDE}" --continue ;;
+  help|--help|-h)   cmd_help ;;
+  *)
+    # numeric → switch by index; name → switch by name; else → error
+    if [[ "${CMD}" =~ ^[0-9]+$ ]]; then
+      name=$(account_by_index "${CMD}") || { err "No account at index ${CMD}"; cmd_quick --no-usage; exit 1; }
+      do_switch "${name}"
+    elif account_exists "${CMD}"; then
+      do_switch "${CMD}"
+    else
+      err "Unknown command or account: ${CMD}"
+      cmd_quick --no-usage
+      printf "  ${D}Run ${CY}relay help${R}${D} for usage${R}\n\n"
+      exit 1
+    fi ;;
+esac