claude-multiacc 1.0.0 → 1.0.2

package/README.md

@@ -163,25 +163,37 @@ acct-01 = the Mac's login, acct-02 = the server's login (adopted server-side).
 ### Add a fresh account (~1 min, one browser sign-in)
 
 ```bash
+claude-accounts add               # no email needed — read back from the sign-in
+# or name it explicitly (fast-fails on a duplicate, and pre-fills the login page):
 claude-accounts add new@example.com
 ```
 
-It prints a **clickable sign-in link**. Open it in a browser signed into that account,
-approve, and paste the code back into the same prompt. The account is registered **only
-after the sign-in is verified** — an aborted or failed sign-in leaves nothing behind, and
-a duplicate email is refused outright (`--force` overrides). The captured token has a
-~1-year lifetime, is inference-only, and does not rotate → it works on the Mac **and**
-the server with no cross-machine refresh races, so the account is usable everywhere the
-moment `add` returns.
+This runs the **normal full Claude Code login** — the exact same
+`claude auth login` flow the app itself uses (`claude.com/cai/oauth/authorize`, full
+Claude Code scopes). A browser opens (or a sign-in link is printed); sign in to the
+account you're adding, approve, and if a code is shown, paste it back. It draws on the
+subscription — never API keys.
+
+Using the full login on purpose: it does **not** hit the *"Sign in again to continue"*
+step-up wall that the narrow long-lived-token grant triggers, and it stores an
+auto-refreshing `.credentials.json`. That credential is **machine-local** (never synced),
+which is what keeps two machines from invalidating each other's refresh token — so an
+account you `add` on the Mac runs on the Mac, and you `add` it on the server (over SSH) if
+you want it there too. The account is registered **only after the signed-in email is read
+back**; an aborted login leaves nothing behind, and duplicate emails are refused.
 
 ```bash
-claude-accounts login acct-NN     # re-run the same flow for an existing account
-                                  # (complete missing auth, or refresh an aging token)
-claude-accounts add x@y.com --tui # alternative: interactive /login instead, storing
-                                  # auto-refreshing OAuth creds (that machine only)
+claude-accounts login acct-NN         # complete/refresh an existing account (full login)
+claude-accounts add new@example.com --token   # portable setup-token instead: works on BOTH
+                                              # machines and syncs to the server, but needs a
+                                              # recent sign-in (may show the step-up screen)
+claude-accounts login acct-NN --token         # same, for an existing account
 ```
 
-`status` warns when a token nears end of life; re-run `login` for that account.
+Use `--token` when you specifically want one account usable on the server via the Mac's
+sync (the ~1-year inference-only token that mirrors over). For everyday adds, the default
+full login is smoother. `status` warns when a token nears end of life; re-run `login`.
+
 Both accounts currently in the pool are live and verified: acct-01 (support@gowalkae.com,
 Mac) and acct-02 (hasan@gowalkqa.com, server) — each adopted from its machine's existing
 login, so each runs on the machine that holds its credential.
@@ -248,6 +260,11 @@ repointed via `CLAUDE_BIN=/usr/local/bin/claude` and restarted healthy.
 - **A service bypasses the shim** — it spawns an absolute path. Point its env
   (`CLAUDE_BIN` etc.) at `/usr/local/bin/claude`. Docker-internal `claude` installs
   (e.g. openclaw live-test containers) are out of scope for a host shim.
+- **`add` sign-in says "Sign in again to continue"** — that's Claude's step-up
+  authentication, not a tool error: granting a long-lived token needs a *recent* sign-in.
+  Open a fresh incognito window, sign in to the target account at claude.ai **first**,
+  then paste the link and approve. The approval scope is `user:inference`
+  (*"Contribute to your Claude subscription usage"*) — that's correct and minimal.
 - **Limits look stale** — launchd: `launchctl list | grep claude-multiacc`;
   cron: `crontab -l | grep claude-multiacc`. The shim also kicks a refresh when data
   is >3 min old.

package/bin/claude-accounts

@@ -20,12 +20,15 @@ claude-accounts — multi-account pool manager for claude-multiacc
 USAGE
   claude-accounts list                      brief account list
   claude-accounts status                    full health: auth, per-bucket limits, markers
-  claude-accounts add <email> [--force|--tui]
-      login-FIRST: shows a sign-in link, you paste the browser code back, and the
-      account is registered only after auth is verified. Duplicate emails refused
-      (--force overrides). --tui uses interactive /login for full OAuth creds.
-  claude-accounts login <acct-NN> [--force]  complete/refresh auth for an existing
-                                             account (same link+code flow)
+  claude-accounts add [email] [--token] [--force]
+      login-FIRST: runs the full Claude Code login (`claude auth login` — the normal
+      browser sign-in, no long-lived-token step-up), then registers only after the
+      signed-in email is read back. Email is OPTIONAL (derived from the sign-in).
+      Stores auto-refreshing .credentials.json valid on THIS machine. Duplicates refused.
+      --token instead mints a portable setup-token (works on Mac AND server; needs a
+      recent sign-in — use it when you want the account usable on the server too).
+  claude-accounts login <acct-NN> [--token] [--force]
+      complete/refresh auth for an existing account (full login, or --token)
   claude-accounts import <email> [opts]     register an account, optionally with credentials
       --id acct-NN          explicit id (default: next free)
       --home mac|server     which machine owns the OAuth grant (default: this one)
@@ -229,27 +232,29 @@ PYEOF
 }
 
 cmd_add() {
-  # Login-FIRST: the account is registered (and synced) only after /login
-  # succeeded in the new dir and the authenticated email has been verified.
-  # An aborted or failed login leaves zero traces.
+  # Login-FIRST: the account is registered (and synced) only after sign-in succeeds
+  # and the authenticated email is read back from the account itself. The email
+  # argument is OPTIONAL — omit it and it's derived from whoever you sign in as.
+  # An aborted or failed sign-in leaves zero traces.
   require_manifest
-  local email="${1:-}"
-  [ -n "$email" ] || die "usage: claude-accounts add <email> [--force]"
-  shift
-  local force=0 tui=0
+  local email="" force=0 token=0
   while [ $# -gt 0 ]; do
     case "$1" in
       --force) force=1; shift ;;
-      --tui) tui=1; shift ;;
-      *) die "unknown option: $1" ;;
+      --token) token=1; shift ;;   # portable setup-token instead of full login (server use)
+      --tui) shift ;;              # accepted for compatibility; full login is now the default
+      --*) die "unknown option: $1" ;;
+      *)
+        if [ -z "$email" ]; then email="$1"; shift
+        else die "unexpected argument: $1 (usage: claude-accounts add [email] [--token] [--force])"; fi ;;
     esac
   done
-  # One account per email, always: a duplicate is never useful and silently splits the
-  # pool. There is no --force escape hatch here (use `login <acct-NN>` to re-auth).
+  # If an email was named, fast-fail on a duplicate now. If not, we learn (and dedup)
+  # the real email from the sign-in below — one account per email either way.
   local owner
-  owner="$(email_owner "$email")"
-  if [ -n "$owner" ]; then
-    die "$email is already registered as $owner — nothing created (run 'claude-accounts login $owner' to re-authenticate it)"
+  if [ -n "$email" ]; then
+    owner="$(email_owner "$email")"
+    [ -n "$owner" ] && die "$email is already registered as $owner — nothing created (run 'claude-accounts login $owner' to re-authenticate it)"
   fi
   if [ ! -t 0 ] && [ -z "${CLAUDE_MULTIACC_FORCE_TTY:-}" ]; then
     die "add is interactive (it completes sign-in before registering) — run it from a terminal"
@@ -269,40 +274,14 @@ cmd_add() {
   trap "rm -rf '$lock'" EXIT
   local real
   real="$(find_real_claude "$_self")" || die "real claude binary not found"
-  local id d got
+  local id d got elabel
+  elabel="${email:-the account you sign in as}"
   id="$(next_id)"
   d="$ACC_ROOT/$id"
   seed_account_dir "$d"
-  if [ "$tui" = "1" ]; then
-    # Full-OAuth variant: interactive /login in the new dir (auto-refreshing creds).
-    cat <<EOF
-Preparing $id for $email — NOTHING is registered until login succeeds.
-An interactive claude session opens now with no account. In ONE incognito
-window signed into $email:
-  1. type /login  (press c to copy the URL into the incognito window)
-  2. /status must show $email
-  3. exit the session (/exit or ctrl+d) to finish registration
-EOF
-    CLAUDE_CONFIG_DIR="$d" CLAUDE_SHIM_ACTIVE=1 "$real" || true
-    if [ ! -f "$d/.credentials.json" ]; then
-      rm -rf "${ACC_ROOT:?}/${id:?}"
-      die "no login detected — nothing was created"
-    fi
-    got="$(CLAUDE_CONFIG_DIR="$d" CLAUDE_SHIM_ACTIVE=1 "$real" auth status 2>/dev/null | "$PYBIN" -c '
-import json, sys
-try:
-    doc = json.loads(sys.stdin.read())
-    print(doc.get("email", "") if doc.get("loggedIn") else "")
-except Exception:
-    print("")')"
-    if [ -z "$got" ]; then
-      rm -rf "${ACC_ROOT:?}/${id:?}"
-      die "login could not be verified — nothing was created"
-    fi
-  else
-    # Default: sign-in link -> user pastes the code back here -> token captured.
-    # The token works on BOTH machines (no refresh rotation, ~1y lifetime).
-    echo "Preparing $id for $email — NOTHING is registered until sign-in completes."
+  if [ "$token" = "1" ]; then
+    # Portable setup-token variant (works on Mac AND server; needs a recent sign-in).
+    echo "Preparing $id for $elabel (portable token) — NOTHING is registered until sign-in completes."
     if ! run_token_ceremony "$d"; then
       rm -rf "${ACC_ROOT:?}/${id:?}"
       die "sign-in failed or aborted — nothing was created"
@@ -310,28 +289,39 @@ except Exception:
     ( umask 077; printf '%s' "$CEREMONY_TOKEN" > "$d/server.token" )
     chmod 600 "$d/server.token"
     got="$(token_email "$CEREMONY_TOKEN")"
-    if [ -z "$got" ]; then
-      # Authentication produced a token, but we could not confirm WHICH account it
-      # belongs to. Registering on the claimed email could silently create a duplicate
-      # or mislabel the account, so refuse — the requirement is verified auth, not
-      # merely successful auth. --force accepts the claimed email deliberately.
-      if [ "$force" != "1" ]; then
-        rm -rf "${ACC_ROOT:?}/${id:?}"
-        die "signed in, but the account identity could not be verified — nothing was created (retry, or use --force to trust '$email')"
-      fi
-      warn "identity unverified — registering as $email because --force was given"
-      got="$email"
+  else
+    # Default: full Claude Code login (the flow that just works — full scopes, no
+    # long-lived-token step-up). Writes auto-refreshing .credentials.json, valid on
+    # THIS machine (creds are never synced, so no cross-machine refresh races).
+    echo "Preparing $id for $elabel — NOTHING is registered until login completes."
+    if ! run_login_ceremony "$d" "$email"; then
+      rm -rf "${ACC_ROOT:?}/${id:?}"
+      die "login failed or aborted — nothing was created"
     fi
+    got="$(config_dir_email "$d")"
   fi
-  if [ "$got" != "$email" ]; then
-    owner="$(email_owner "$got")"
-    if [ -n "$owner" ]; then
+  if [ -z "$got" ]; then
+    # Signed in, but we could not read back WHICH account. Without a verified email we
+    # cannot label or dedup the account, so refuse — unless an email was named AND
+    # --force was given (then we trust the named email).
+    if [ -n "$email" ] && [ "$force" = "1" ]; then
+      warn "identity unverified — registering as $email because --force was given"
+      got="$email"
+    else
       rm -rf "${ACC_ROOT:?}/${id:?}"
-      die "you signed in as $got, which is already registered as $owner — nothing was created"
+      die "signed in, but the account identity could not be read back — nothing was created (retry; or 'add <email> --force' to trust a named email)"
     fi
-    warn "signed in as $got (expected $email) — registering the account that actually authenticated"
-    email="$got"
   fi
+  # `got` is now the authoritative signed-in email. Dedup against it, warn on mismatch.
+  owner="$(email_owner "$got")"
+  if [ -n "$owner" ]; then
+    rm -rf "${ACC_ROOT:?}/${id:?}"
+    die "you signed in as $got, which is already registered as $owner — nothing was created"
+  fi
+  if [ -n "$email" ] && [ "$got" != "$email" ]; then
+    warn "signed in as $got (you named $email) — registering the account that actually authenticated"
+  fi
+  email="$got"
   manifest_add_account "$id" "$email" "$(machine_kind)"
   log_to ops.log "add $id $email (auth-verified)"
   auto_sync
@@ -488,8 +478,17 @@ run_token_ceremony() { # $1 = config dir
   umask 077   # the capture file briefly holds the raw token (removed inline below).
   # NB: no EXIT trap here — cmd_add owns the EXIT trap for its mutation lock, and a
   # second EXIT trap would clobber it and leak the lock.
-  echo "A sign-in link will appear below — open it in a browser signed into the"
-  echo "RIGHT account, approve, then paste the code back here."
+  cat <<'TIP'
+A sign-in link will appear below. For a smooth grant (avoids the "Sign in again
+to continue" step-up screen):
+  1. Open a fresh incognito/private window.
+  2. Sign in at claude.ai to the EXACT account you're adding — do this FIRST.
+  3. THEN paste the link below into that same window and approve
+     ("Contribute to your Claude subscription usage" is the correct permission).
+  4. Copy the code it shows and paste it back here.
+If you do see "Sign in again to continue", that is Claude's security step, not an
+error — just sign in to that account and approve; the code still appears.
+TIP
   if [ -t 0 ]; then
     if [ "$(machine_kind)" = "mac" ]; then
       script -q "$cap" env CLAUDE_CONFIG_DIR="$d" CLAUDE_SHIM_ACTIVE=1 "$real" setup-token
@@ -525,6 +524,56 @@ except Exception:
     print("")'
 }
 
+config_dir_email() { # $1 = config dir; prints the logged-in email or empty
+  local real
+  real="$(find_real_claude "$_self")" || { echo ""; return 0; }
+  CLAUDE_CONFIG_DIR="$1" CLAUDE_SHIM_ACTIVE=1 "$real" auth status 2>/dev/null | "$PYBIN" -c '
+import json, sys
+try:
+    doc = json.loads(sys.stdin.read())
+    print(doc.get("email", "") if doc.get("loggedIn") else "")
+except Exception:
+    print("")'
+}
+
+# Full subscription login: `claude auth login --claudeai`, the SAME flow the
+# interactive app uses (claude.com/cai/oauth/authorize, full Claude Code scopes,
+# normal sign-in — no long-lived-token step-up wall). Writes <dir>/.credentials.json
+# (auto-refreshing). Returns success iff the credential landed. $2 = optional email hint.
+run_login_ceremony() { # $1 = config dir, $2 = email hint
+  local d="$1" hint="${2:-}" real
+  real="$(find_real_claude "$_self")" || { warn "real claude binary not found"; return 1; }
+  cat <<'TIP'
+A browser will open (or a sign-in link will be printed) for the FULL Claude Code
+login. Sign in as the account you want to add and approve; if a code is shown,
+paste it back here. This is the normal login — it draws on the subscription, no
+API keys, and refreshes itself over time.
+TIP
+  if [ -t 0 ]; then
+    if [ "$(machine_kind)" = "mac" ]; then
+      if [ -n "$hint" ]; then
+        script -q /dev/null env CLAUDE_CONFIG_DIR="$d" CLAUDE_SHIM_ACTIVE=1 "$real" auth login --claudeai --email "$hint"
+      else
+        script -q /dev/null env CLAUDE_CONFIG_DIR="$d" CLAUDE_SHIM_ACTIVE=1 "$real" auth login --claudeai
+      fi
+    else
+      if [ -n "$hint" ]; then
+        script -q -c "CLAUDE_CONFIG_DIR='$d' CLAUDE_SHIM_ACTIVE=1 '$real' auth login --claudeai --email '$hint'" /dev/null
+      else
+        script -q -c "CLAUDE_CONFIG_DIR='$d' CLAUDE_SHIM_ACTIVE=1 '$real' auth login --claudeai" /dev/null
+      fi
+    fi
+  else
+    # Headless (tests / automation): no PTY.
+    if [ -n "$hint" ]; then
+      CLAUDE_CONFIG_DIR="$d" CLAUDE_SHIM_ACTIVE=1 "$real" auth login --claudeai --email "$hint" || true
+    else
+      CLAUDE_CONFIG_DIR="$d" CLAUDE_SHIM_ACTIVE=1 "$real" auth login --claudeai || true
+    fi
+  fi
+  [ -f "$d/.credentials.json" ]
+}
+
 cmd_mint() {
   require_manifest
   local id="${1:-}" paste="${2:-}"
@@ -553,11 +602,20 @@ cmd_mint() {
 }
 
 cmd_login() {
-  # Complete (or refresh) auth for an EXISTING account: sign-in link -> paste
-  # code -> token saved. Verifies the authenticated email matches the manifest.
+  # Complete (or refresh) auth for an EXISTING account. Default: full Claude Code login
+  # (auto-refreshing .credentials.json, this machine). --token: portable setup-token
+  # (Mac + server). Verifies the signed-in email matches the manifest.
   require_manifest
-  local id="${1:-}" force="${2:-}"
-  [ -n "$id" ] || die "usage: claude-accounts login <acct-NN> [--force]"
+  local id="" force=0 token=0
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --force) force=1; shift ;;
+      --token) token=1; shift ;;
+      --*) die "unknown option: $1" ;;
+      *) if [ -z "$id" ]; then id="$1"; shift; else die "unexpected argument: $1"; fi ;;
+    esac
+  done
+  [ -n "$id" ] || die "usage: claude-accounts login <acct-NN> [--token] [--force]"
   valid_acct_id "$id" || die "not a valid account id: $id"
   account_ids | grep -qx "$id" || die "unknown account: $id"
   local d="$ACC_ROOT/$id" email got
@@ -571,17 +629,24 @@ for a in json.load(open(sys.argv[1])).get('accounts', []):
 PYEOF
 )"
   echo "Sign in as $email for $id."
-  run_token_ceremony "$d" || die "sign-in failed or aborted — nothing changed"
-  got="$(token_email "$CEREMONY_TOKEN")"
-  if [ -n "$got" ] && [ "$got" != "$email" ] && [ "$force" != "--force" ]; then
-    die "you signed in as $got but $id is $email — nothing saved (use --force to override)"
+  if [ "$token" = "1" ]; then
+    run_token_ceremony "$d" || die "sign-in failed or aborted — nothing changed"
+    got="$(token_email "$CEREMONY_TOKEN")"
+    if [ -n "$got" ] && [ "$got" != "$email" ] && [ "$force" != "1" ]; then
+      die "you signed in as $got but $id is $email — nothing saved (use --force to override)"
+    fi
+    ( umask 077; printf '%s' "$CEREMONY_TOKEN" > "$d/server.token" )
+    chmod 600 "$d/server.token"
+    echo "$id token saved (portable — works on Mac and server)."
+  else
+    run_login_ceremony "$d" "$email" || die "login failed or aborted — nothing changed"
+    got="$(config_dir_email "$d")"
+    if [ -n "$got" ] && [ "$got" != "$email" ] && [ "$force" != "1" ]; then
+      die "you signed in as $got but $id is $email — nothing saved (use --force to override)"
+    fi
+    echo "$id login saved (.credentials.json, this machine, auto-refreshing)."
   fi
-  printf '%s' "$CEREMONY_TOKEN" > "$d/server.token"
-  chmod 600 "$d/server.token"
-  log_to ops.log "login $id verified=${got:-unverified}"
-  echo "$id auth saved (token, works on Mac and server)."
-  echo "Optional, for auto-refreshing OAuth creds on this machine instead:"
-  echo "  CLAUDE_ACCOUNT=$id claude   # then /login"
+  log_to ops.log "login $id verified=${got:-unverified} mode=$([ "$token" = 1 ] && echo token || echo login)"
   auto_sync
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Multi-account addon for Claude Code: every claude / claude -p runs under a randomly-picked subscription account with the most usage headroom. Mirrors to a deploy server. No API keys.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -29,9 +29,17 @@ cat > "$FAKEBIN/claude" <<'EOF'
 #!/usr/bin/env bash
 # fake real claude for tests (not a multiacc shim)
 if [ "${1:-}" = "auth" ] && [ "${2:-}" = "status" ]; then
+  if [ -n "${FAKE_AUTH_FAIL:-}" ]; then echo '{"loggedIn": false}'; exit 0; fi
   printf '{"loggedIn": true, "email": "%s"}\n' "${FAKE_EMAIL:-fake@test}"
   exit 0
 fi
+if [ "${1:-}" = "auth" ] && [ "${2:-}" = "login" ]; then
+  [ -n "${FAKE_LOGIN_FAIL:-}" ] && { echo "login aborted" >&2; exit 1; }
+  # simulate a completed full-scope login: write auto-refreshing creds to the config dir
+  printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-login","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999,"scopes":["user:inference"],"subscriptionType":"max"}}' > "${CLAUDE_CONFIG_DIR:-/dev/null}/.credentials.json"
+  echo "Logged in."
+  exit 0
+fi
 if [ "${1:-}" = "setup-token" ]; then
   echo "Open this sign-in link: https://claude.ai/oauth/authorize?fake=1"
   [ -n "${FAKE_TOKEN_FAIL:-}" ] && { echo "sign-in aborted" >&2; exit 1; }
@@ -357,28 +365,59 @@ check "import refuses duplicate email" "already registered as acct-01" "$out"
 out="$(claude-accounts import a@test --id acct-01 --no-sync 2>&1)"
 check "import same-id update allowed" "Imported acct-01" "$out"
 
-# ---- 15c. login-first add (default link+code flow): registers after verified auth --
+# ---- 15c. login-first add (DEFAULT full-login flow): registers after verified auth --
 out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=new@test claude-accounts add new@test 2>&1)"
-check "add shows sign-in link" "sign-in link" "$out"
-check "add registers after verified sign-in" "Registered acct-04 for new@test" "$out"
-[ -s "$ACC/acct-04/server.token" ] && t_ok "token landed in the new dir" || t_fail "add token" "missing"
+check "add registers after verified login" "Registered acct-04 for new@test" "$out"
+[ -f "$ACC/acct-04/.credentials.json" ] && t_ok "default add writes .credentials.json (full login)" || t_fail "add creds" "missing"
+[ ! -f "$ACC/acct-04/server.token" ] && t_ok "default add does NOT mint a setup-token" || t_fail "add token" "unexpected server.token"
+out="$(CLAUDE_ACCOUNT=acct-04 claude 2>&1)"
+check "new account usable via pin (oauth creds)" "CFG=acct-04" "$out"
+claude-accounts remove acct-04 --yes >/dev/null 2>&1
+
+# ---- 15c1. add --token: portable setup-token instead of creds ------------------------
+out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=tok@test claude-accounts add tok@test --token 2>&1)"
+check "add --token registers via portable token" "Registered acct-04 for tok@test" "$out"
+[ -s "$ACC/acct-04/server.token" ] && t_ok "add --token writes server.token" || t_fail "add --token" "missing"
 out="$(CLAUDE_ACCOUNT=acct-04 claude 2>&1)"
-check "new account usable via pin (token auth)" "TOK=sk-ant-oat01-FAKE" "$out"
+check "token account exports CLAUDE_CODE_OAUTH_TOKEN" "TOK=sk-ant-oat01-FAKE" "$out"
 claude-accounts remove acct-04 --yes >/dev/null 2>&1
 
-# ---- 15c2. --tui variant registers via /login creds --------------------------------
-out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_DO_LOGIN=1 FAKE_EMAIL=tui@test claude-accounts add tui@test --tui 2>&1)"
-check "add --tui registers after verified login" "Registered acct-04 for tui@test" "$out"
-[ -f "$ACC/acct-04/.credentials.json" ] && t_ok "tui login creds landed in the new dir" || t_fail "tui creds" "missing"
+# ---- 15c0. add with NO email: derives it from the verified sign-in -------------------
+out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=derived@test claude-accounts add 2>&1)"
+check "add without email registers the signed-in address" "Registered acct-04 for derived@test" "$out"
+claude-accounts list 2>&1 | grep -q "derived@test" && t_ok "email-less add lands in the manifest" \
+  || t_fail "email-less add" "derived@test not registered"
 claude-accounts remove acct-04 --yes >/dev/null 2>&1
+# add with no email, but the signed-in email is already registered => refuse + clean up
+out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=a@test claude-accounts add 2>&1)"
+rc=$?
+check "email-less add refuses a duplicate signed-in email" "already registered as acct-01" "$out"
+[ "$rc" != "0" ] && t_ok "email-less duplicate exits nonzero" || t_fail "email-less dup rc" "rc=0"
+[ ! -d "$ACC/acct-04" ] && t_ok "email-less duplicate cleaned up" || t_fail "email-less dup cleanup" "dir left"
+# add with no email but identity can't be read back => refuse (can't label the account)
+out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_AUTH_FAIL=1 claude-accounts add 2>&1)"
+rc=$?
+check "email-less add needs a readable identity" "identity could not be read back" "$out"
+[ ! -d "$ACC/acct-04" ] && t_ok "unverifiable email-less add cleaned up" || t_fail "unverifiable cleanup" "dir left"
 
-# ---- 15d. aborted sign-in leaves zero traces ----------------------------------------
-out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_TOKEN_FAIL=1 claude-accounts add ghost@test 2>&1)"
+# ---- 15c2. --tui is accepted as a no-op alias (full login is the default now) --------
+out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=tui@test claude-accounts add tui@test --tui 2>&1)"
+check "add --tui still works (alias for default login)" "Registered acct-04 for tui@test" "$out"
+[ -f "$ACC/acct-04/.credentials.json" ] && t_ok "--tui writes creds like the default" || t_fail "tui creds" "missing"
+claude-accounts remove acct-04 --yes >/dev/null 2>&1
+
+# ---- 15d. aborted login leaves zero traces ------------------------------------------
+out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_LOGIN_FAIL=1 claude-accounts add ghost@test 2>&1)"
 rc=$?
-check "aborted sign-in detected" "sign-in failed or aborted" "$out"
+check "aborted login detected" "login failed or aborted" "$out"
 [ "$rc" != "0" ] && t_ok "aborted add exits nonzero" || t_fail "aborted add rc" "rc=0"
 [ ! -d "$ACC/acct-04" ] && t_ok "aborted add cleaned up its dir" || t_fail "aborted add cleanup" "dir left behind"
 claude-accounts list 2>&1 | grep -q ghost@test && t_fail "aborted add not in manifest" "ghost@test registered" || t_ok "aborted add not in manifest"
+# aborted --token path too
+out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_TOKEN_FAIL=1 claude-accounts add ghost2@test --token 2>&1)"
+rc=$?
+check "aborted --token add detected" "sign-in failed or aborted" "$out"
+[ ! -d "$ACC/acct-04" ] && t_ok "aborted --token add cleaned up" || t_fail "aborted token cleanup" "dir left"
 
 # ---- 15e. sign-in as an already-registered email is rejected + cleaned ---------------
 out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=a@test claude-accounts add brand@test 2>&1)"
@@ -389,12 +428,16 @@ check "wrong-account sign-in rejected" "already registered as acct-01" "$out"
 # ---- 15f. login command completes auth for an existing auth-less account -------------
 claude-accounts import pending@test --id acct-08 --no-sync >/dev/null 2>&1
 out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=pending@test claude-accounts login acct-08 2>&1)"
-check "login completes existing account" "acct-08 auth saved" "$out"
-[ -s "$ACC/acct-08/server.token" ] && t_ok "login saved token" || t_fail "login token" "missing"
+check "login completes existing account (full login)" "acct-08 login saved" "$out"
+[ -f "$ACC/acct-08/.credentials.json" ] && t_ok "login writes .credentials.json" || t_fail "login creds" "missing"
 out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=other@test claude-accounts login acct-08 2>&1)"
 rc=$?
 check "login email mismatch refused" "nothing saved" "$out"
 [ "$rc" != "0" ] && t_ok "mismatched login exits nonzero" || t_fail "mismatched login rc" "rc=0"
+# login --token writes a portable token for the same account
+out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=pending@test claude-accounts login acct-08 --token 2>&1)"
+check "login --token saves a portable token" "acct-08 token saved" "$out"
+[ -s "$ACC/acct-08/server.token" ] && t_ok "login --token writes server.token" || t_fail "login token" "missing"
 claude-accounts remove acct-08 --yes >/dev/null 2>&1
 
 # ---- 16. CLI: limits marking via fixture endpoint ------------------------------