claude-multiacc 1.0.0

package/bin/claude

@@ -0,0 +1,359 @@
+#!/usr/bin/env bash
+# claude-multiacc-shim — PATH-shadows the real `claude` binary; never replaces or edits it.
+# Every invocation runs under a randomly picked subscription account with limit headroom.
+# Self-contained on purpose: no sourcing, so a broken repo file can never break `claude`.
+# Selection: CLAUDE_CONFIG_DIR/CLAUDE_CODE_OAUTH_TOKEN passthrough > CLAUDE_ACCOUNT pin >
+# random among limit-eligible accounts > least-utilized fallback (degraded beats down).
+
+set -u
+
+# ${HOME:-} guards: with HOME stripped (env -i, some cron/systemd units) the shim
+# must still fail OPEN into plain passthrough, never abort on an unbound variable.
+ACC_ROOT="${CLAUDE_ACCOUNTS_DIR:-${HOME:-/nonexistent}/.claude-accounts}"
+MANIFEST="$ACC_ROOT/accounts.json"
+
+canon_path() {
+  local p="$1" t i=0 d b
+  case "$p" in /*) ;; *) p="$PWD/$p" ;; esac
+  while [ -L "$p" ] && [ "$i" -lt 40 ]; do
+    t="$(readlink "$p")" || break
+    case "$t" in /*) p="$t" ;; *) p="$(dirname "$p")/$t" ;; esac
+    i=$((i+1))
+  done
+  d="$(cd "$(dirname "$p")" 2>/dev/null && pwd -P)" || { printf '%s\n' "$p"; return 0; }
+  b="$(basename "$p")"
+  if [ "$d" = "/" ]; then printf '/%s\n' "$b"; else printf '%s/%s\n' "$d" "$b"; fi
+}
+
+is_shim_file() { head -c 300 "$1" 2>/dev/null | grep -q claude-multiacc-shim; }
+
+SELF="$(canon_path "$0")"
+SELF_DIR="$(dirname "$SELF")"
+
+find_real() {
+  local cand c d
+  local oldifs="$IFS"
+  IFS=':'; set -f
+  # shellcheck disable=SC2086
+  set -- $PATH
+  IFS="$oldifs"; set +f
+  for d in "$@"; do
+    [ -n "$d" ] || continue
+    cand="$d/claude"
+    [ -f "$cand" ] && [ -x "$cand" ] || continue
+    c="$(canon_path "$cand")"
+    [ "$c" = "$SELF" ] && continue
+    case "$c" in "$ACC_ROOT"/*) continue ;; esac
+    is_shim_file "$c" && continue
+    printf '%s\n' "$cand"; return 0
+  done
+  # Fallbacks: resolved dynamically at exec time, so `claude update`/reinstalls keep working.
+  for cand in "${HOME:-/nonexistent}/.local/bin/claude" /usr/local/bin/claude /opt/homebrew/bin/claude /usr/bin/claude; do
+    [ -f "$cand" ] && [ -x "$cand" ] || continue
+    c="$(canon_path "$cand")"
+    [ "$c" = "$SELF" ] && continue
+    is_shim_file "$c" && continue
+    printf '%s\n' "$cand"; return 0
+  done
+  return 1
+}
+
+REAL="$(find_real)" || {
+  printf 'claude-multiacc shim: real claude binary not found (PATH or fallback locations)\n' >&2
+  exit 127
+}
+
+# Fast passthrough: caller pinned a config dir or token, addon disabled, recursion
+# guard, or no account data yet. Byte-identical behavior to stock claude.
+if [ -n "${CLAUDE_CONFIG_DIR:-}" ] || [ -n "${CLAUDE_CODE_OAUTH_TOKEN:-}" ] \
+  || [ "${CLAUDE_MULTIACC_DISABLE:-0}" = "1" ] || [ -n "${CLAUDE_SHIM_ACTIVE:-}" ] \
+  || [ ! -f "$MANIFEST" ]; then
+  exec "$REAL" "$@"
+fi
+
+now="$(date +%s)"
+
+# Threshold used by the telemetry backstop below; the manifest is the source of
+# truth, but a corrupt/unreadable manifest must never break selection => plain
+# sed with a safe default, never a JSON parse.
+if [ -z "${CLAUDE_MULTIACC_THRESHOLD:-}" ]; then
+  CLAUDE_MULTIACC_THRESHOLD="$(sed -n 's/.*"threshold"[^0-9]*\([0-9][0-9]*\).*/\1/p' "$MANIFEST" 2>/dev/null | head -1)"
+  case "$CLAUDE_MULTIACC_THRESHOLD" in ''|*[!0-9]*) CLAUDE_MULTIACC_THRESHOLD=90 ;; esac
+fi
+
+if [ "$(uname -s)" = "Darwin" ]; then
+  file_mtime() { stat -f %m "$1" 2>/dev/null || echo 0; }
+else
+  file_mtime() { stat -c %Y "$1" 2>/dev/null || echo 0; }
+fi
+
+sel_log() {
+  printf '%s %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$*" >> "$ACC_ROOT/selection.log" 2>/dev/null || true
+}
+
+marker_active() { # true if $1/.limited is still in force; clears cleanly-expired markers
+  local m="$1/.limited" reset=""
+  [ -f "$m" ] || return 1
+  IFS= read -r reset < "$m" 2>/dev/null || reset=""
+  case "$reset" in
+    ''|*[!0-9]*)
+      # Empty/partial/garbled marker — e.g. read during a concurrent rewrite.
+      # Treat as ACTIVE and never delete: deleting here could destroy a marker
+      # another process is mid-write. The next limits refresh rewrites or clears it.
+      return 0 ;;
+  esac
+  if [ "$now" -ge "$reset" ]; then
+    rm -f "$m" 2>/dev/null
+    return 1
+  fi
+  return 0
+}
+
+STALE_AFTER=900
+
+fresh_field() { # fresh_field <acct dir> <json key> -> integer if telemetry fresh, else fail
+  local f="$1/limits.json" fetched v
+  [ -f "$f" ] || return 1
+  fetched="$(sed -n 's/.*"fetched_at"[^0-9]*\([0-9][0-9]*\).*/\1/p' "$f" 2>/dev/null | head -1)"
+  case "$fetched" in ''|*[!0-9]*) return 1 ;; esac
+  [ $((now - fetched)) -le "$STALE_AFTER" ] || return 1
+  v="$(sed -n "s/.*\"$2\"[^0-9]*\([0-9][0-9]*\).*/\1/p" "$f" 2>/dev/null | head -1)"
+  case "$v" in ''|*[!0-9]*) return 1 ;; esac
+  printf '%s\n' "$v"
+}
+
+# RANKING score — lower is better (more headroom). Weekly headroom dominates: a weekly
+# bucket only refills on the account's fixed weekly reset (days away), while the 5h
+# session bucket self-heals, so session is a mild tiebreaker only. (Anthropic's docs
+# confirm this reset asymmetry — an account whose only near-full bucket is the cheap
+# session one must NOT rank behind one burning durable weekly headroom.)
+#   score = weekly%*1000 + session%      weekly,session in [0,100]
+# Stale/unreadable telemetry ranks NEUTRAL (weekly 50, session 50), never "free".
+sel_score_of() { # $1 = acct dir
+  local w s
+  w="$(fresh_field "$1" weekly_percent)" || w="$(fresh_field "$1" max_percent)" || w=50
+  s="$(fresh_field "$1" session_percent)" || s=50
+  printf '%s\n' $((w * 1000 + s))
+}
+
+# Peak of ALL buckets (session included) — the EXCLUSION signal. Stale/unknown => 50.
+util_of() {
+  local v
+  v="$(fresh_field "$1" max_percent)" || v=50
+  printf '%s\n' "$v"
+}
+
+# Backstop for a lost/failed marker write: fresh telemetry with ANY bucket at/over the
+# threshold excludes the account even if .limited is missing (a full session bucket
+# really blocks now; its marker just expires soon). Stale/unreadable => not over
+# (fail open — telemetry must never invent exclusions).
+over_threshold() { # $1 = acct dir
+  local v
+  v="$(fresh_field "$1" max_percent)" || return 1
+  [ "$v" -ge "${CLAUDE_MULTIACC_THRESHOLD:-90}" ]
+}
+
+# An empty credentials file is NOT auth (an interrupted write must not make a
+# dead account selectable and turn a working stock run into an auth failure).
+has_auth() { [ -s "$1/.credentials.json" ] || [ -s "$1/server.token" ]; }
+
+# Explicit pin wins over everything — markers, and even missing auth: the
+# add/login ceremony pins to a dir that has no credentials yet, and the login
+# must land exactly there, never in a randomly selected account's dir.
+if [ -n "${CLAUDE_ACCOUNT:-}" ]; then
+  d="$ACC_ROOT/$CLAUDE_ACCOUNT"
+  if [ -d "$d" ]; then
+    sel_log "$CLAUDE_ACCOUNT pinned pwd=$PWD"
+    export CLAUDE_CONFIG_DIR="$d"
+    export CLAUDE_SHIM_ACTIVE=1
+    if [ ! -f "$d/.credentials.json" ] && [ -s "$d/server.token" ]; then
+      CLAUDE_CODE_OAUTH_TOKEN="$(tr -d '[:space:]' < "$d/server.token")"
+      export CLAUDE_CODE_OAUTH_TOKEN
+    fi
+    exec "$REAL" "$@"
+  fi
+  sel_log "pin-invalid account=$CLAUDE_ACCOUNT (no such dir; random fallback)"
+fi
+
+valid=()
+eligible=()
+for d in "$ACC_ROOT"/acct-*; do
+  [ -d "$d" ] || continue
+  has_auth "$d" || continue
+  valid+=("$d")
+  marker_active "$d" && continue
+  over_threshold "$d" && continue
+  eligible+=("$d")
+done
+
+# No usable accounts => stock behavior (fail open, never block work).
+[ "${#valid[@]}" -gt 0 ] || exec "$REAL" "$@"
+
+# Pick the account with the MOST headroom (lowest ranking score = most weekly headroom,
+# session as tiebreaker). Ties break randomly so equally-idle accounts still spread load.
+# Sets PICK_DIR/PICK_SCORE as globals — it must never touch "$@", which holds the
+# user's claude arguments.
+PICK_DIR=""
+PICK_SCORE=""
+pick_best() { # args: candidate dirs
+  local d v best="" bestv=1000000 ties=1
+  for d in "$@"; do
+    v="$(sel_score_of "$d")"
+    if [ "$v" -lt "$bestv" ]; then
+      bestv="$v"; best="$d"; ties=1
+    elif [ "$v" -eq "$bestv" ]; then
+      ties=$((ties + 1))
+      [ $((RANDOM % ties)) -eq 0 ] && best="$d"   # reservoir-sample among equals
+    fi
+  done
+  PICK_DIR="$best"
+  PICK_SCORE="$bestv"
+}
+
+if [ "${#eligible[@]}" -gt 0 ]; then
+  if [ "${CLAUDE_SHIM_SELECT:-headroom}" = "random" ]; then
+    PICK_DIR="${eligible[$((RANDOM % ${#eligible[@]}))]}"
+  else
+    pick_best "${eligible[@]}"
+  fi
+else
+  # Every account is limit-marked: degraded service beats a hard failure (100% rule).
+  pick_best "${valid[@]}"
+  sel_log "all-limited fallback=$(basename "$PICK_DIR") weekly=$(fresh_field "$PICK_DIR" weekly_percent || echo '?')%"
+fi
+pick="$PICK_DIR"
+
+# Opportunistic limits refresh: non-blocking, throttled, backgrounded.
+kick="$ACC_ROOT/.limits-kick"
+stale=0
+for d in "${valid[@]}"; do
+  f="$d/limits.json"
+  if [ ! -f "$f" ] || [ $((now - $(file_mtime "$f"))) -gt 180 ]; then stale=1; break; fi
+done
+if [ "$stale" = 1 ] && [ -x "$SELF_DIR/claude-accounts" ]; then
+  last=0
+  [ -f "$kick" ] && last="$(file_mtime "$kick")"
+  if [ $((now - last)) -gt 120 ]; then
+    : > "$kick" 2>/dev/null || true
+    ( "$SELF_DIR/claude-accounts" limits --quiet >/dev/null 2>&1 & ) >/dev/null 2>&1
+  fi
+fi
+
+acct="$(basename "$pick")"
+sel_log "$acct weekly=$(fresh_field "$pick" weekly_percent || echo '?')% session=$(fresh_field "$pick" session_percent || echo '?')% pwd=$PWD"
+
+acct_token() { # $1 = acct dir; prints token if dir is token-auth (no local creds)
+  if [ ! -f "$1/.credentials.json" ] && [ -s "$1/server.token" ]; then
+    tr -d '[:space:]' < "$1/server.token"
+  fi
+}
+
+export CLAUDE_SHIM_ACTIVE=1
+
+# Auto-retry applies only to -p/--print runs with an alternative account available,
+# and only when stdin is finite (tty, regular file, or char device like /dev/null).
+# A service-spawned pipe that never EOFs must take the plain exec path, or the
+# stdin pre-buffering below would hang the call.
+wants_retry=0
+if [ "${CLAUDE_SHIM_RETRY:-1}" != "0" ] && [ "${#eligible[@]}" -ge 2 ]; then
+  for a in "$@"; do
+    case "$a" in -p|--print) wants_retry=1; break ;; esac
+  done
+  if [ "$wants_retry" = "1" ]; then
+    # A TTY cannot be buffered or replayed: `claude -p` with no prompt argument reads
+    # the terminal, and the retry path would hand it /dev/null. Plain exec instead —
+    # stdin is inherited untouched. A pipe that never EOFs would hang the pre-buffer,
+    # so only finite stdin (regular file, /dev/null-style char device) takes the retry
+    # path; everything else execs directly.
+    if [ -t 0 ]; then
+      wants_retry=0
+    elif [ -f /dev/fd/0 ] || [ -c /dev/fd/0 ]; then
+      :
+    else
+      wants_retry=0
+    fi
+  fi
+fi
+
+if [ "$wants_retry" = "0" ]; then
+  export CLAUDE_CONFIG_DIR="$pick"
+  tok="$(acct_token "$pick")"
+  [ -n "$tok" ] && export CLAUDE_CODE_OAUTH_TOKEN="$tok"
+  exec "$REAL" "$@"
+fi
+
+# Retry path: buffer stdio so a retried call never double-emits partial output.
+mkdir -p "$ACC_ROOT/tmp" 2>/dev/null || true
+tmpd="$(mktemp -d "$ACC_ROOT/tmp/shim.XXXXXX" 2>/dev/null)" || {
+  export CLAUDE_CONFIG_DIR="$pick"
+  tok="$(acct_token "$pick")"
+  [ -n "$tok" ] && export CLAUDE_CODE_OAUTH_TOKEN="$tok"
+  exec "$REAL" "$@"
+}
+trap 'rm -rf "$tmpd"' EXIT
+
+# The output buffers must be writable BEFORE the run: if redirection failed at exec
+# time (disk full), the real binary would never launch and the shim would exit
+# nonzero — a hard failure. Verify now, fall back to plain exec if we cannot.
+if ! : > "$tmpd/out" 2>/dev/null || ! : > "$tmpd/err" 2>/dev/null; then
+  export CLAUDE_CONFIG_DIR="$pick"
+  tok="$(acct_token "$pick")"
+  [ -n "$tok" ] && export CLAUDE_CODE_OAUTH_TOKEN="$tok"
+  exec "$REAL" "$@"
+fi
+
+stdin_file=""
+if [ ! -t 0 ]; then
+  stdin_file="$tmpd/in"
+  # If buffering fails midway (disk full) stdin is already partly consumed and cannot
+  # be rewound — keep whatever landed rather than silently substituting /dev/null.
+  cat > "$stdin_file" 2>/dev/null || [ -s "$stdin_file" ] || stdin_file=""
+fi
+
+ERRPAT='rate[ _-]?limit|usage limit|limit (reached|exceeded)|overloaded|"?529"?|401|403|unauthorized|authentication[_ ]error|invalid[_ ](bearer|token|api key)|token (expired|revoked|invalid)|oauth.*(error|expired|invalid)|credit balance'
+
+attempt=1
+cur="$pick"
+rc=0
+while :; do
+  tok="$(acct_token "$cur")"
+  if [ -n "$stdin_file" ]; then exec 3< "$stdin_file"; else exec 3< /dev/null; fi
+  if [ -n "$tok" ]; then
+    CLAUDE_CONFIG_DIR="$cur" CLAUDE_CODE_OAUTH_TOKEN="$tok" "$REAL" "$@" <&3 > "$tmpd/out" 2> "$tmpd/err"
+  else
+    CLAUDE_CONFIG_DIR="$cur" "$REAL" "$@" <&3 > "$tmpd/out" 2> "$tmpd/err"
+  fi
+  rc=$?
+  exec 3<&-
+  if [ "$rc" -ne 0 ] && [ "$attempt" -eq 1 ] \
+    && grep -qiE "$ERRPAT" "$tmpd/out" "$tmpd/err" 2>/dev/null; then
+    # Atomic marker write: a reader must never observe a half-written .limited
+    # (it would parse as garbage and, before, could be deleted as "expired").
+    {
+      echo $((now + 600))
+      echo "bucket=error-cooldown percent=? marked_at=$(date -u +%Y-%m-%dT%H:%M:%SZ) reason=error-cooldown"
+    } > "$cur/.limited.$$" 2>/dev/null \
+      && mv -f "$cur/.limited.$$" "$cur/.limited" 2>/dev/null \
+      || rm -f "$cur/.limited.$$" 2>/dev/null || true
+    next=""
+    n="${#eligible[@]}"
+    start=$((RANDOM % n))
+    i=0
+    while [ "$i" -lt "$n" ]; do
+      c="${eligible[$(((start + i) % n))]}"
+      if [ "$c" != "$cur" ]; then next="$c"; break; fi
+      i=$((i+1))
+    done
+    if [ -n "$next" ]; then
+      sel_log "retry from=$(basename "$cur") to=$(basename "$next") rc=$rc"
+      cur="$next"
+      attempt=2
+      continue
+    fi
+  fi
+  break
+done
+
+cat "$tmpd/out"
+cat "$tmpd/err" >&2
+exit "$rc"