claude-multiacc 1.0.0 → 1.0.1

package/README.md

@@ -163,16 +163,23 @@ acct-01 = the Mac's login, acct-02 = the server's login (adopted server-side).
 ### Add a fresh account (~1 min, one browser sign-in)
 
 ```bash
+claude-accounts add               # no email needed — it's read back from the sign-in
+# or name it explicitly (fast-fails on a duplicate before sign-in):
 claude-accounts add new@example.com
 ```
 
-It prints a **clickable sign-in link**. Open it in a browser signed into that account,
-approve, and paste the code back into the same prompt. The account is registered **only
-after the sign-in is verified** — an aborted or failed sign-in leaves nothing behind, and
-a duplicate email is refused outright (`--force` overrides). The captured token has a
-~1-year lifetime, is inference-only, and does not rotate → it works on the Mac **and**
-the server with no cross-machine refresh races, so the account is usable everywhere the
-moment `add` returns.
+It prints a **clickable sign-in link**. Open it in a browser signed into the account you
+want to add, approve, and paste the code back into the same prompt. The sign-in screen
+asks only for *"Contribute to your Claude subscription usage"* (`user:inference` scope) —
+that's intentional: the token can run `claude` / `claude -p` and nothing else, and it
+draws on the subscription, never API credits.
+
+You don't have to pass the email — the command reads the authenticated address back from
+the account and registers under that. The account is registered **only after the sign-in
+is verified** — an aborted or failed sign-in leaves nothing behind, and a duplicate email
+is refused. The captured token has a ~1-year lifetime, is inference-only, and does not
+rotate → it works on the Mac **and** the server with no cross-machine refresh races, so
+the account is usable everywhere the moment `add` returns.
 
 ```bash
 claude-accounts login acct-NN     # re-run the same flow for an existing account

package/bin/claude-accounts

@@ -20,10 +20,11 @@ claude-accounts — multi-account pool manager for claude-multiacc
 USAGE
   claude-accounts list                      brief account list
   claude-accounts status                    full health: auth, per-bucket limits, markers
-  claude-accounts add <email> [--force|--tui]
+  claude-accounts add [email] [--force|--tui]
       login-FIRST: shows a sign-in link, you paste the browser code back, and the
-      account is registered only after auth is verified. Duplicate emails refused
-      (--force overrides). --tui uses interactive /login for full OAuth creds.
+      account is registered only after auth is verified. The email is OPTIONAL — omit
+      it and it's read back from whoever you sign in as. Duplicate emails refused.
+      --tui uses interactive /login for full OAuth creds instead of a setup-token.
   claude-accounts login <acct-NN> [--force]  complete/refresh auth for an existing
                                              account (same link+code flow)
   claude-accounts import <email> [opts]     register an account, optionally with credentials
@@ -229,27 +230,28 @@ PYEOF
 }
 
 cmd_add() {
-  # Login-FIRST: the account is registered (and synced) only after /login
-  # succeeded in the new dir and the authenticated email has been verified.
-  # An aborted or failed login leaves zero traces.
+  # Login-FIRST: the account is registered (and synced) only after sign-in succeeds
+  # and the authenticated email is read back from the account itself. The email
+  # argument is OPTIONAL — omit it and it's derived from whoever you sign in as.
+  # An aborted or failed sign-in leaves zero traces.
   require_manifest
-  local email="${1:-}"
-  [ -n "$email" ] || die "usage: claude-accounts add <email> [--force]"
-  shift
-  local force=0 tui=0
+  local email="" force=0 tui=0
   while [ $# -gt 0 ]; do
     case "$1" in
       --force) force=1; shift ;;
       --tui) tui=1; shift ;;
-      *) die "unknown option: $1" ;;
+      --*) die "unknown option: $1" ;;
+      *)
+        if [ -z "$email" ]; then email="$1"; shift
+        else die "unexpected argument: $1 (usage: claude-accounts add [email] [--tui] [--force])"; fi ;;
     esac
   done
-  # One account per email, always: a duplicate is never useful and silently splits the
-  # pool. There is no --force escape hatch here (use `login <acct-NN>` to re-auth).
+  # If an email was named, fast-fail on a duplicate now. If not, we learn (and dedup)
+  # the real email from the sign-in below — one account per email either way.
   local owner
-  owner="$(email_owner "$email")"
-  if [ -n "$owner" ]; then
-    die "$email is already registered as $owner — nothing created (run 'claude-accounts login $owner' to re-authenticate it)"
+  if [ -n "$email" ]; then
+    owner="$(email_owner "$email")"
+    [ -n "$owner" ] && die "$email is already registered as $owner — nothing created (run 'claude-accounts login $owner' to re-authenticate it)"
   fi
   if [ ! -t 0 ] && [ -z "${CLAUDE_MULTIACC_FORCE_TTY:-}" ]; then
     die "add is interactive (it completes sign-in before registering) — run it from a terminal"
@@ -269,18 +271,18 @@ cmd_add() {
   trap "rm -rf '$lock'" EXIT
   local real
   real="$(find_real_claude "$_self")" || die "real claude binary not found"
-  local id d got
+  local id d got elabel
+  elabel="${email:-the account you sign in as}"
   id="$(next_id)"
   d="$ACC_ROOT/$id"
   seed_account_dir "$d"
   if [ "$tui" = "1" ]; then
     # Full-OAuth variant: interactive /login in the new dir (auto-refreshing creds).
     cat <<EOF
-Preparing $id for $email — NOTHING is registered until login succeeds.
-An interactive claude session opens now with no account. In ONE incognito
-window signed into $email:
-  1. type /login  (press c to copy the URL into the incognito window)
-  2. /status must show $email
+Preparing $id for $elabel — NOTHING is registered until login succeeds.
+An interactive claude session opens now with no account:
+  1. type /login  (press c to copy the URL into an incognito window)
+  2. /status must show the right email
   3. exit the session (/exit or ctrl+d) to finish registration
 EOF
     CLAUDE_CONFIG_DIR="$d" CLAUDE_SHIM_ACTIVE=1 "$real" || true
@@ -302,7 +304,7 @@ except Exception:
   else
     # Default: sign-in link -> user pastes the code back here -> token captured.
     # The token works on BOTH machines (no refresh rotation, ~1y lifetime).
-    echo "Preparing $id for $email — NOTHING is registered until sign-in completes."
+    echo "Preparing $id for $elabel — NOTHING is registered until sign-in completes."
     if ! run_token_ceremony "$d"; then
       rm -rf "${ACC_ROOT:?}/${id:?}"
       die "sign-in failed or aborted — nothing was created"
@@ -311,27 +313,28 @@ except Exception:
     chmod 600 "$d/server.token"
     got="$(token_email "$CEREMONY_TOKEN")"
     if [ -z "$got" ]; then
-      # Authentication produced a token, but we could not confirm WHICH account it
-      # belongs to. Registering on the claimed email could silently create a duplicate
-      # or mislabel the account, so refuse — the requirement is verified auth, not
-      # merely successful auth. --force accepts the claimed email deliberately.
-      if [ "$force" != "1" ]; then
+      # Signed in, but we could not read back WHICH account. Without a verified email
+      # we cannot label or dedup the account, so refuse — unless an email was named
+      # AND --force was given (then we trust the named email).
+      if [ -n "$email" ] && [ "$force" = "1" ]; then
+        warn "identity unverified — registering as $email because --force was given"
+        got="$email"
+      else
         rm -rf "${ACC_ROOT:?}/${id:?}"
-        die "signed in, but the account identity could not be verified — nothing was created (retry, or use --force to trust '$email')"
+        die "signed in, but the account identity could not be read back — nothing was created (retry; or 'add <email> --force' to trust a named email)"
       fi
-      warn "identity unverified — registering as $email because --force was given"
-      got="$email"
     fi
   fi
-  if [ "$got" != "$email" ]; then
-    owner="$(email_owner "$got")"
-    if [ -n "$owner" ]; then
-      rm -rf "${ACC_ROOT:?}/${id:?}"
-      die "you signed in as $got, which is already registered as $owner — nothing was created"
-    fi
-    warn "signed in as $got (expected $email) — registering the account that actually authenticated"
-    email="$got"
+  # `got` is now the authoritative signed-in email. Dedup against it, warn on mismatch.
+  owner="$(email_owner "$got")"
+  if [ -n "$owner" ]; then
+    rm -rf "${ACC_ROOT:?}/${id:?}"
+    die "you signed in as $got, which is already registered as $owner — nothing was created"
+  fi
+  if [ -n "$email" ] && [ "$got" != "$email" ]; then
+    warn "signed in as $got (you named $email) — registering the account that actually authenticated"
   fi
+  email="$got"
   manifest_add_account "$id" "$email" "$(machine_kind)"
   log_to ops.log "add $id $email (auth-verified)"
   auto_sync

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Multi-account addon for Claude Code: every claude / claude -p runs under a randomly-picked subscription account with the most usage headroom. Mirrors to a deploy server. No API keys.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -29,6 +29,7 @@ cat > "$FAKEBIN/claude" <<'EOF'
 #!/usr/bin/env bash
 # fake real claude for tests (not a multiacc shim)
 if [ "${1:-}" = "auth" ] && [ "${2:-}" = "status" ]; then
+  if [ -n "${FAKE_AUTH_FAIL:-}" ]; then echo '{"loggedIn": false}'; exit 0; fi
   printf '{"loggedIn": true, "email": "%s"}\n' "${FAKE_EMAIL:-fake@test}"
   exit 0
 fi
@@ -366,6 +367,24 @@ out="$(CLAUDE_ACCOUNT=acct-04 claude 2>&1)"
 check "new account usable via pin (token auth)" "TOK=sk-ant-oat01-FAKE" "$out"
 claude-accounts remove acct-04 --yes >/dev/null 2>&1
 
+# ---- 15c0. add with NO email: derives it from the verified sign-in -------------------
+out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=derived@test claude-accounts add 2>&1)"
+check "add without email registers the signed-in address" "Registered acct-04 for derived@test" "$out"
+claude-accounts list 2>&1 | grep -q "derived@test" && t_ok "email-less add lands in the manifest" \
+  || t_fail "email-less add" "derived@test not registered"
+claude-accounts remove acct-04 --yes >/dev/null 2>&1
+# add with no email, but the signed-in email is already registered => refuse + clean up
+out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=a@test claude-accounts add 2>&1)"
+rc=$?
+check "email-less add refuses a duplicate signed-in email" "already registered as acct-01" "$out"
+[ "$rc" != "0" ] && t_ok "email-less duplicate exits nonzero" || t_fail "email-less dup rc" "rc=0"
+[ ! -d "$ACC/acct-04" ] && t_ok "email-less duplicate cleaned up" || t_fail "email-less dup cleanup" "dir left"
+# add with no email but identity can't be read back => refuse (can't label the account)
+out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_AUTH_FAIL=1 claude-accounts add 2>&1)"
+rc=$?
+check "email-less add needs a readable identity" "identity could not be read back" "$out"
+[ ! -d "$ACC/acct-04" ] && t_ok "unverifiable email-less add cleaned up" || t_fail "unverifiable cleanup" "dir left"
+
 # ---- 15c2. --tui variant registers via /login creds --------------------------------
 out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_DO_LOGIN=1 FAKE_EMAIL=tui@test claude-accounts add tui@test --tui 2>&1)"
 check "add --tui registers after verified login" "Registered acct-04 for tui@test" "$out"