claude-multiacc 1.0.0

package/bin/claude-accounts

@@ -0,0 +1,1127 @@
+#!/usr/bin/env bash
+# claude-accounts — manage the claude-multiacc account pool.
+# Subcommands: list status add import remove mint sync verify limits post-sync health
+set -u
+
+_self="$0"
+while [ -L "$_self" ]; do
+  _t="$(readlink "$_self")"
+  case "$_t" in /*) _self="$_t" ;; *) _self="$(dirname "$_self")/$_t" ;; esac
+done
+BIN_DIR="$(cd "$(dirname "$_self")" && pwd -P)"
+REPO_DIR="$(dirname "$BIN_DIR")"
+# shellcheck source=lib/common.sh
+. "$REPO_DIR/lib/common.sh"
+
+usage() {
+  cat <<'EOF'
+claude-accounts — multi-account pool manager for claude-multiacc
+
+USAGE
+  claude-accounts list                      brief account list
+  claude-accounts status                    full health: auth, per-bucket limits, markers
+  claude-accounts add <email> [--force|--tui]
+      login-FIRST: shows a sign-in link, you paste the browser code back, and the
+      account is registered only after auth is verified. Duplicate emails refused
+      (--force overrides). --tui uses interactive /login for full OAuth creds.
+  claude-accounts login <acct-NN> [--force]  complete/refresh auth for an existing
+                                             account (same link+code flow)
+  claude-accounts import <email> [opts]     register an account, optionally with credentials
+      --id acct-NN          explicit id (default: next free)
+      --home mac|server     which machine owns the OAuth grant (default: this one)
+      --creds PATH          existing .credentials.json to adopt
+      --mode copy|move|link how to adopt --creds (default copy)
+      --token-file PATH|-   long-lived token for server use (- reads stdin)
+      --no-sync             skip the automatic server sync
+  claude-accounts adopt <acct-NN>           make acct-NN THIS machine's existing
+                                            default ~/.claude login (dir symlink —
+                                            single credential file, no grant fork)
+  claude-accounts remove <acct-NN> [--yes]  delete account (propagates to server)
+  claude-accounts mint <acct-NN>            mint server token via `claude setup-token`
+      --paste               paste an already-minted token instead of running setup-token
+  claude-accounts sync                      push manifest+tokens to the server (Mac only)
+  claude-accounts verify [--quick]          auth matrix; full mode runs `-p "reply OK"` per account
+  claude-accounts limits [--quiet] [--force]
+      refresh usage buckets, apply >=90% markers. Skips accounts fetched in the
+      last 45s and honors 429 backoff; --force ignores both.
+  claude-accounts health                    limits + full verify; logs to health.log
+  claude-accounts self-update               update the addon (npm i -g @latest, or git
+                                            pull + reinstall); logs to update.log
+  claude-accounts post-sync                 (server side) seed dirs, fix perms, quick verify
+
+ENV
+  CLAUDE_ACCOUNTS_DIR   override ~/.claude-accounts
+  CLAUDE_ACCOUNT        pin the shim to one account
+  CLAUDE_SHIM_RETRY=0   disable -p auto-retry
+  CLAUDE_MULTIACC_DISABLE=1  bypass the shim entirely
+EOF
+}
+
+require_manifest() { [ -f "$MANIFEST" ] || die "no manifest at $MANIFEST — run install.sh first"; }
+
+next_id() {
+  local n=1 id
+  while :; do
+    id="$(printf 'acct-%02d' "$n")"
+    if [ ! -d "$ACC_ROOT/$id" ] && ! account_ids | grep -qx "$id"; then
+      printf '%s\n' "$id"
+      return 0
+    fi
+    n=$((n+1))
+    [ "$n" -gt 99 ] && die "no free account slot"
+  done
+}
+
+manifest_add_account() { # id email home
+  "$PYBIN" - "$MANIFEST" "$1" "$2" "$3" <<'PYEOF'
+import json, sys, time
+path, aid, email, home = sys.argv[1:5]
+doc = json.load(open(path))
+accounts = [a for a in doc.get('accounts', []) if a['id'] != aid]
+accounts.append({
+    'id': aid,
+    'email': email,
+    'home': home,
+    'added_at': time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime()),
+})
+accounts.sort(key=lambda a: a['id'])
+doc['accounts'] = accounts
+import os
+with open(path + '.tmp', 'w') as f:
+    json.dump(doc, f, indent=2)
+    f.write('\n')
+os.replace(path + '.tmp', path)
+PYEOF
+}
+
+email_owner() { # prints the id that owns <email>, empty if unregistered
+  [ -f "$MANIFEST" ] || return 0
+  "$PYBIN" - "$MANIFEST" "$1" <<'PYEOF' 2>/dev/null
+import json, sys
+for a in json.load(open(sys.argv[1])).get('accounts', []):
+    if a.get('email', '').lower() == sys.argv[2].lower():
+        print(a['id'])
+        break
+PYEOF
+}
+
+manifest_del_account() { # id
+  "$PYBIN" - "$MANIFEST" "$1" <<'PYEOF'
+import json, sys
+path, aid = sys.argv[1:3]
+doc = json.load(open(path))
+doc['accounts'] = [a for a in doc.get('accounts', []) if a['id'] != aid]
+import os
+with open(path + '.tmp', 'w') as f:
+    json.dump(doc, f, indent=2)
+    f.write('\n')
+os.replace(path + '.tmp', path)
+PYEOF
+}
+
+auto_sync() { # best effort after mutations, Mac only, loud on failure
+  [ "$(machine_kind)" = "mac" ] || return 0
+  [ "${CLAUDE_MULTIACC_NO_SYNC:-0}" = "1" ] && return 0
+  # subshell: cmd_sync exits on failure and must not take the CLI down with it
+  ( cmd_sync ) || warn "server sync failed — run 'claude-accounts sync' manually"
+}
+
+cmd_list() {
+  require_manifest
+  "$PYBIN" - "$MANIFEST" "$ACC_ROOT" <<'PYEOF'
+import json, os, re, sys
+doc = json.load(open(sys.argv[1]))
+root = sys.argv[2]
+# Only render well-formed ids — a hand-edited manifest must not surface a traversal id.
+accounts = [a for a in doc.get('accounts', [])
+            if isinstance(a, dict) and re.fullmatch(r'acct-\d{2}', str(a.get('id', '')))]
+if not accounts:
+    print('(no accounts yet)')
+for a in accounts:
+    d = os.path.join(root, a['id'])
+    auth = []
+    if os.path.isfile(os.path.join(d, '.credentials.json')):
+        auth.append('oauth')
+    if os.path.getsize(os.path.join(d, 'server.token')) > 0 if os.path.isfile(os.path.join(d, 'server.token')) else False:
+        auth.append('token')
+    limited = os.path.isfile(os.path.join(d, '.limited'))
+    print(f"{a['id']}  {a['email']:<28} home={a.get('home','?'):<7} auth={'+'.join(auth) or 'NONE':<11} {'LIMITED' if limited else ''}")
+PYEOF
+}
+
+cmd_status() {
+  require_manifest
+  "$PYBIN" - "$MANIFEST" "$ACC_ROOT" <<'PYEOF'
+import json, os, sys, time
+doc = json.load(open(sys.argv[1]))
+root = sys.argv[2]
+now = time.time()
+
+def last_pick(aid):
+    path = os.path.join(root, 'selection.log')
+    if not os.path.isfile(path):
+        return '-'
+    last = '-'
+    try:
+        with open(path, errors='replace') as f:
+            for line in f:
+                parts = line.split()
+                if len(parts) >= 2 and parts[1] == aid:
+                    last = parts[0]
+    except Exception:
+        pass
+    return last
+
+print(f"pool root : {root}")
+print(f"server    : {doc.get('server','-')}  (root: {doc.get('server_root','-')})")
+print(f"threshold : {doc.get('threshold', 90)}% (any bucket at/above => account excluded)")
+print()
+for a in doc.get('accounts', []):
+    aid = a['id']
+    d = os.path.join(root, aid)
+    print(f"{aid}  {a['email']}  [home={a.get('home','?')}]")
+    cpath = os.path.join(d, '.credentials.json')
+    if os.path.isfile(cpath):
+        try:
+            c = json.load(open(cpath)).get('claudeAiOauth', {})
+            exp = c.get('expiresAt', 0) / 1000.0
+            rexp = c.get('refreshTokenExpiresAt', 0) / 1000.0
+            state = 'fresh' if exp > now else 'stale (auto-refreshes on use)'
+            rstate = 'ok' if rexp > now else 'EXPIRED — re-login needed'
+            print(f"  oauth creds : {state}; refresh token {rstate} (until {time.strftime('%Y-%m-%d', time.gmtime(rexp)) if rexp else '?'})")
+        except Exception as e:
+            print(f"  oauth creds : unreadable ({e})")
+    else:
+        print("  oauth creds : none on this machine")
+    tpath = os.path.join(d, 'server.token')
+    if os.path.isfile(tpath) and os.path.getsize(tpath) > 0:
+        age_d = int((now - os.path.getmtime(tpath)) / 86400)
+        note = ' — NEARING 1y LIFETIME, re-mint soon' if age_d > 330 else ''
+        print(f"  server token: present (minted ~{age_d}d ago){note}")
+    else:
+        print("  server token: none")
+    lpath = os.path.join(d, 'limits.json')
+    if os.path.isfile(lpath):
+        try:
+            lim = json.load(open(lpath))
+            age = int(now - lim.get('fetched_at', 0))
+            parts = [f"{b['name']}={b['percent']}%" for b in lim.get('buckets', [])]
+            print(f"  limits      : {'  '.join(parts) or '(none)'}  [{age}s old, max {lim.get('max_percent')}%]")
+        except Exception as e:
+            print(f"  limits      : unreadable ({e})")
+    else:
+        print("  limits      : never fetched")
+    mpath = os.path.join(d, '.limited')
+    if os.path.isfile(mpath):
+        try:
+            lines = open(mpath).read().splitlines()
+            reset = int(lines[0]) if lines and lines[0].isdigit() else 0
+            detail = lines[1] if len(lines) > 1 else ''
+            mins = max(0, int((reset - now) / 60))
+            print(f"  marker      : LIMITED ({detail}) — clears in ~{mins}m")
+        except Exception:
+            print("  marker      : LIMITED (unreadable marker)")
+    else:
+        print("  marker      : none (eligible)")
+    print(f"  last picked : {last_pick(aid)}")
+    print()
+PYEOF
+}
+
+cmd_add() {
+  # Login-FIRST: the account is registered (and synced) only after /login
+  # succeeded in the new dir and the authenticated email has been verified.
+  # An aborted or failed login leaves zero traces.
+  require_manifest
+  local email="${1:-}"
+  [ -n "$email" ] || die "usage: claude-accounts add <email> [--force]"
+  shift
+  local force=0 tui=0
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --force) force=1; shift ;;
+      --tui) tui=1; shift ;;
+      *) die "unknown option: $1" ;;
+    esac
+  done
+  # One account per email, always: a duplicate is never useful and silently splits the
+  # pool. There is no --force escape hatch here (use `login <acct-NN>` to re-auth).
+  local owner
+  owner="$(email_owner "$email")"
+  if [ -n "$owner" ]; then
+    die "$email is already registered as $owner — nothing created (run 'claude-accounts login $owner' to re-authenticate it)"
+  fi
+  if [ ! -t 0 ] && [ -z "${CLAUDE_MULTIACC_FORCE_TTY:-}" ]; then
+    die "add is interactive (it completes sign-in before registering) — run it from a terminal"
+  fi
+  # Serialize the whole check->allocate->authenticate->register sequence: two concurrent
+  # adds must not race the duplicate check, collide on an id, or clobber the manifest.
+  local lock="$ACC_ROOT/.locks/mutate"
+  mkdir -p "$ACC_ROOT/.locks"
+  if ! mkdir "$lock" 2>/dev/null; then
+    if [ $(( $(epoch_now) - $(file_mtime "$lock") )) -gt 900 ]; then
+      rm -rf "$lock"; mkdir "$lock" 2>/dev/null || die "cannot acquire the account lock"
+    else
+      die "another claude-accounts add/login is in progress — try again when it finishes"
+    fi
+  fi
+  # shellcheck disable=SC2064
+  trap "rm -rf '$lock'" EXIT
+  local real
+  real="$(find_real_claude "$_self")" || die "real claude binary not found"
+  local id d got
+  id="$(next_id)"
+  d="$ACC_ROOT/$id"
+  seed_account_dir "$d"
+  if [ "$tui" = "1" ]; then
+    # Full-OAuth variant: interactive /login in the new dir (auto-refreshing creds).
+    cat <<EOF
+Preparing $id for $email — NOTHING is registered until login succeeds.
+An interactive claude session opens now with no account. In ONE incognito
+window signed into $email:
+  1. type /login  (press c to copy the URL into the incognito window)
+  2. /status must show $email
+  3. exit the session (/exit or ctrl+d) to finish registration
+EOF
+    CLAUDE_CONFIG_DIR="$d" CLAUDE_SHIM_ACTIVE=1 "$real" || true
+    if [ ! -f "$d/.credentials.json" ]; then
+      rm -rf "${ACC_ROOT:?}/${id:?}"
+      die "no login detected — nothing was created"
+    fi
+    got="$(CLAUDE_CONFIG_DIR="$d" CLAUDE_SHIM_ACTIVE=1 "$real" auth status 2>/dev/null | "$PYBIN" -c '
+import json, sys
+try:
+    doc = json.loads(sys.stdin.read())
+    print(doc.get("email", "") if doc.get("loggedIn") else "")
+except Exception:
+    print("")')"
+    if [ -z "$got" ]; then
+      rm -rf "${ACC_ROOT:?}/${id:?}"
+      die "login could not be verified — nothing was created"
+    fi
+  else
+    # Default: sign-in link -> user pastes the code back here -> token captured.
+    # The token works on BOTH machines (no refresh rotation, ~1y lifetime).
+    echo "Preparing $id for $email — NOTHING is registered until sign-in completes."
+    if ! run_token_ceremony "$d"; then
+      rm -rf "${ACC_ROOT:?}/${id:?}"
+      die "sign-in failed or aborted — nothing was created"
+    fi
+    ( umask 077; printf '%s' "$CEREMONY_TOKEN" > "$d/server.token" )
+    chmod 600 "$d/server.token"
+    got="$(token_email "$CEREMONY_TOKEN")"
+    if [ -z "$got" ]; then
+      # Authentication produced a token, but we could not confirm WHICH account it
+      # belongs to. Registering on the claimed email could silently create a duplicate
+      # or mislabel the account, so refuse — the requirement is verified auth, not
+      # merely successful auth. --force accepts the claimed email deliberately.
+      if [ "$force" != "1" ]; then
+        rm -rf "${ACC_ROOT:?}/${id:?}"
+        die "signed in, but the account identity could not be verified — nothing was created (retry, or use --force to trust '$email')"
+      fi
+      warn "identity unverified — registering as $email because --force was given"
+      got="$email"
+    fi
+  fi
+  if [ "$got" != "$email" ]; then
+    owner="$(email_owner "$got")"
+    if [ -n "$owner" ]; then
+      rm -rf "${ACC_ROOT:?}/${id:?}"
+      die "you signed in as $got, which is already registered as $owner — nothing was created"
+    fi
+    warn "signed in as $got (expected $email) — registering the account that actually authenticated"
+    email="$got"
+  fi
+  manifest_add_account "$id" "$email" "$(machine_kind)"
+  log_to ops.log "add $id $email (auth-verified)"
+  auto_sync
+  cat <<EOF
+Registered $id for $email (sign-in verified) — usable immediately.
+Optional:
+  claude-accounts verify       # confirm the 100% matrix
+EOF
+}
+
+cmd_import() {
+  require_manifest
+  local email="${1:-}"
+  [ -n "$email" ] || die "usage: claude-accounts import <email> [--id acct-NN] [--home mac|server] [--creds PATH] [--mode copy|move|link] [--token-file PATH|-] [--no-sync]"
+  shift
+  local id="" home="" creds="" mode="copy" token_file="" no_sync=0 force=0
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --id) id="$2"; shift 2 ;;
+      --home) home="$2"; shift 2 ;;
+      --creds) creds="$2"; shift 2 ;;
+      --mode) mode="$2"; shift 2 ;;
+      --token-file) token_file="$2"; shift 2 ;;
+      --no-sync) no_sync=1; shift ;;
+      --force) force=1; shift ;;
+      *) die "unknown option: $1" ;;
+    esac
+  done
+  [ -n "$id" ] || id="$(next_id)"
+  [ -n "$home" ] || home="$(machine_kind)"
+  case "$id" in acct-[0-9][0-9]) ;; *) die "id must look like acct-NN" ;; esac
+  local owner
+  owner="$(email_owner "$email")"
+  if [ -n "$owner" ] && [ "$owner" != "$id" ] && [ "$force" != "1" ]; then
+    die "$email is already registered as $owner — use --id $owner to update it, or --force to register a duplicate"
+  fi
+  # Validate ALL inputs before creating anything, so a bad token/creds path leaves no
+  # half-made account dir behind.
+  [ -n "$creds" ] && { [ -f "$creds" ] || die "credentials file not found: $creds"; }
+  case "$mode" in copy|move|link) ;; *) die "mode must be copy|move|link" ;; esac
+  local tok=""
+  if [ -n "$token_file" ]; then
+    if [ "$token_file" = "-" ]; then
+      tok="$(tr -d '[:space:]')"
+    else
+      [ -f "$token_file" ] || die "token file not found: $token_file"
+      tok="$(tr -d '[:space:]' < "$token_file")"
+    fi
+    valid_subscription_token "$tok" \
+      || die "not a subscription setup-token (sk-ant-oat...). API keys are not supported."
+  fi
+  local d="$ACC_ROOT/$id"
+  seed_account_dir "$d"
+  if [ -n "$creds" ]; then
+    case "$mode" in
+      copy) cp "$creds" "$d/.credentials.json" ;;
+      move) mv "$creds" "$d/.credentials.json" ;;
+      link) ln -sf "$(canon_path "$creds")" "$d/.credentials.json" ;;
+    esac
+    chmod 600 "$d/.credentials.json" 2>/dev/null || true
+  fi
+  if [ -n "$tok" ]; then
+    ( umask 077; printf '%s' "$tok" > "$d/server.token" )
+    chmod 600 "$d/server.token"
+  fi
+  manifest_add_account "$id" "$email" "$home"
+  log_to ops.log "import $id $email home=$home creds=${creds:+yes} mode=$mode token=${token_file:+yes}"
+  echo "Imported $id ($email, home=$home)."
+  [ "$no_sync" = "1" ] || auto_sync
+}
+
+cmd_adopt() {
+  # Make <acct-NN> THIS machine's existing default login (~/.claude) without
+  # forking its OAuth grant: the account dir becomes a symlink to ~/.claude, so
+  # there is exactly one credential file no matter which path refreshes it.
+  require_manifest
+  local id="${1:-}"
+  [ -n "$id" ] || die "usage: claude-accounts adopt <acct-NN>"
+  valid_acct_id "$id" || die "not a valid account id: $id"
+  account_ids | grep -qx "$id" || die "unknown account: $id (import it first)"
+  local d="$ACC_ROOT/$id" default="$HOME/.claude"
+  [ -f "$default/.credentials.json" ] || die "no default login at $default to adopt"
+  # Seed the config-dir state file inside ~/.claude (CLAUDE_CONFIG_DIR mode reads
+  # <dir>/.claude.json, while default mode uses ~/.claude.json at HOME level).
+  if [ ! -f "$default/.claude.json" ] && [ -f "$HOME/.claude.json" ]; then
+    "$PYBIN" - "$HOME/.claude.json" "$default/.claude.json" <<'PYEOF'
+import json, sys
+doc = json.load(open(sys.argv[1]))
+for k in ('oauthAccount', 'userID'):
+    doc.pop(k, None)
+import os
+with open(sys.argv[2] + '.tmp', 'w') as f:
+    json.dump(doc, f)
+os.replace(sys.argv[2] + '.tmp', sys.argv[2])
+PYEOF
+  fi
+  if [ -L "$d" ]; then
+    echo "$id already adopted ($(readlink "$d"))"
+    return 0
+  fi
+  if [ -d "$d" ]; then
+    [ -f "$d/.credentials.json" ] && die "$id already has its own credentials — refusing to replace with adopt"
+    rm -rf "${ACC_ROOT:?}/${id:?}"
+  fi
+  ln -s "$default" "$d"
+  log_to ops.log "adopt $id -> $default"
+  echo "$id now runs the default $default login (symlinked, single credential file)."
+}
+
+cmd_remove() {
+  require_manifest
+  local id="${1:-}" yes="${2:-}"
+  [ -n "$id" ] || die "usage: claude-accounts remove <acct-NN> [--yes]"
+  valid_acct_id "$id" || die "not a valid account id: $id"
+  account_ids | grep -qx "$id" || die "unknown account: $id"
+  if [ "$yes" != "--yes" ]; then
+    printf 'Remove %s and propagate deletion to the server? [y/N] ' "$id"
+    read -r ans
+    case "$ans" in y|Y|yes) ;; *) echo "aborted"; return 1 ;; esac
+  fi
+  if [ -L "$ACC_ROOT/$id" ]; then
+    rm -f "${ACC_ROOT:?}/${id:?}"   # adopted account: remove the symlink, never the target
+  else
+    rm -rf "${ACC_ROOT:?}/${id:?}"
+  fi
+  manifest_del_account "$id"
+  log_to ops.log "remove $id"
+  auto_sync
+  echo "Removed $id."
+}
+
+# Interactive sign-in ceremony: runs `claude setup-token` attached to the user's
+# terminal — it prints a clickable sign-in link, the user completes OAuth in a
+# browser and pastes the code back HERE, and the resulting long-lived token is
+# captured. Sets CEREMONY_TOKEN on success (no stdout capture: the UI must stay
+# visible and interactive).
+# A subscription setup-token, and nothing else. API keys (sk-ant-api...) are rejected
+# everywhere: this addon is subscription-only by design (spec requirement).
+valid_subscription_token() {
+  case "$1" in
+    sk-ant-oat[0-9][0-9]-*) [ "${#1}" -ge 50 ] ;;
+    *) return 1 ;;
+  esac
+}
+
+CEREMONY_TOKEN=""
+run_token_ceremony() { # $1 = config dir
+  CEREMONY_TOKEN=""
+  local d="$1" real cap old_umask
+  real="$(find_real_claude "$_self")" || { warn "real claude binary not found"; return 1; }
+  mkdir -p "$ACC_ROOT/tmp"
+  cap="$ACC_ROOT/tmp/mint.$$.log"
+  old_umask="$(umask)"
+  umask 077   # the capture file briefly holds the raw token (removed inline below).
+  # NB: no EXIT trap here — cmd_add owns the EXIT trap for its mutation lock, and a
+  # second EXIT trap would clobber it and leak the lock.
+  echo "A sign-in link will appear below — open it in a browser signed into the"
+  echo "RIGHT account, approve, then paste the code back here."
+  if [ -t 0 ]; then
+    if [ "$(machine_kind)" = "mac" ]; then
+      script -q "$cap" env CLAUDE_CONFIG_DIR="$d" CLAUDE_SHIM_ACTIVE=1 "$real" setup-token
+    else
+      script -q -c "CLAUDE_CONFIG_DIR='$d' CLAUDE_SHIM_ACTIVE=1 '$real' setup-token" "$cap"
+    fi
+  else
+    # Headless (tests / piped code): capture into the 0600 file only. Never tee the
+    # raw token to stdout — a redirected run would write the secret to a plain log.
+    CLAUDE_CONFIG_DIR="$d" CLAUDE_SHIM_ACTIVE=1 "$real" setup-token > "$cap" 2>&1
+    sed -E 's/sk-ant-oat[0-9]{2}-[A-Za-z0-9_-]*/sk-ant-oat**-<redacted>/g' "$cap"
+  fi
+  umask "$old_umask"
+  CEREMONY_TOKEN="$(grep -aoE 'sk-ant-oat[0-9]{2}-[A-Za-z0-9_-]{40,}' "$cap" | tail -1)"
+  rm -f "$cap"
+  [ -n "$CEREMONY_TOKEN" ] || return 1
+  valid_subscription_token "$CEREMONY_TOKEN" || {
+    CEREMONY_TOKEN=""
+    warn "captured credential is not a subscription setup-token"
+    return 1
+  }
+}
+
+token_email() { # $1 = token; prints the authenticated email (best effort)
+  local real
+  real="$(find_real_claude "$_self")" || { echo ""; return 0; }
+  CLAUDE_CODE_OAUTH_TOKEN="$1" CLAUDE_SHIM_ACTIVE=1 "$real" auth status 2>/dev/null | "$PYBIN" -c '
+import json, sys
+try:
+    doc = json.loads(sys.stdin.read())
+    print(doc.get("email", "") if doc.get("loggedIn") else "")
+except Exception:
+    print("")'
+}
+
+cmd_mint() {
+  require_manifest
+  local id="${1:-}" paste="${2:-}"
+  [ -n "$id" ] || die "usage: claude-accounts mint <acct-NN> [--paste]"
+  valid_acct_id "$id" || die "not a valid account id: $id"
+  local d="$ACC_ROOT/$id"
+  [ -d "$d" ] || die "unknown account dir: $d"
+  local tok=""
+  if [ "$paste" = "--paste" ]; then
+    printf 'Paste the sk-ant-oat... token: '
+    read -r tok
+    tok="$(printf '%s' "$tok" | tr -d '[:space:]')"
+  else
+    echo "Running 'claude setup-token' for $id — approve in a browser signed into THIS account."
+    run_token_ceremony "$d" || die "no token captured — mint failed"
+    tok="$CEREMONY_TOKEN"
+  fi
+  [ -n "$tok" ] || die "no token captured — mint failed"
+  valid_subscription_token "$tok" \
+    || die "that is not a subscription setup-token (sk-ant-oat...). API keys are not supported."
+  ( umask 077; printf '%s' "$tok" > "$d/server.token" )
+  chmod 600 "$d/server.token"
+  log_to ops.log "mint $id"
+  echo "Token saved to $d/server.token"
+  auto_sync
+}
+
+cmd_login() {
+  # Complete (or refresh) auth for an EXISTING account: sign-in link -> paste
+  # code -> token saved. Verifies the authenticated email matches the manifest.
+  require_manifest
+  local id="${1:-}" force="${2:-}"
+  [ -n "$id" ] || die "usage: claude-accounts login <acct-NN> [--force]"
+  valid_acct_id "$id" || die "not a valid account id: $id"
+  account_ids | grep -qx "$id" || die "unknown account: $id"
+  local d="$ACC_ROOT/$id" email got
+  seed_account_dir "$d"
+  email="$("$PYBIN" - "$MANIFEST" "$id" <<'PYEOF'
+import json, sys
+for a in json.load(open(sys.argv[1])).get('accounts', []):
+    if a['id'] == sys.argv[2]:
+        print(a.get('email', ''))
+        break
+PYEOF
+)"
+  echo "Sign in as $email for $id."
+  run_token_ceremony "$d" || die "sign-in failed or aborted — nothing changed"
+  got="$(token_email "$CEREMONY_TOKEN")"
+  if [ -n "$got" ] && [ "$got" != "$email" ] && [ "$force" != "--force" ]; then
+    die "you signed in as $got but $id is $email — nothing saved (use --force to override)"
+  fi
+  printf '%s' "$CEREMONY_TOKEN" > "$d/server.token"
+  chmod 600 "$d/server.token"
+  log_to ops.log "login $id verified=${got:-unverified}"
+  echo "$id auth saved (token, works on Mac and server)."
+  echo "Optional, for auto-refreshing OAuth creds on this machine instead:"
+  echo "  CLAUDE_ACCOUNT=$id claude   # then /login"
+  auto_sync
+}
+
+cmd_limits() {
+  require_manifest
+  local quiet=0 force=0
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --quiet) quiet=1; shift ;;
+      --force) force=1; shift ;;   # ignore freshness/backoff (manual override)
+      *) die "unknown option: $1" ;;
+    esac
+  done
+  local lock="$ACC_ROOT/.locks/limits"
+  mkdir -p "$ACC_ROOT/.locks"
+  if ! mkdir "$lock" 2>/dev/null; then
+    local age=$(( $(epoch_now) - $(file_mtime "$lock") ))
+    if [ "$age" -lt 120 ]; then
+      [ "$quiet" = "1" ] || echo "another limits refresh is running; skipping"
+      return 0
+    fi
+    rm -rf "$lock"
+    mkdir "$lock" 2>/dev/null || return 0
+  fi
+  # shellcheck disable=SC2064
+  trap "rm -rf '$lock'" EXIT
+  rotate_log limits.log
+  # Expired-bearer self-heal: on a quiet machine nothing refreshes OAuth creds,
+  # which would silently stall limits telemetry (fail-open keeps selection working,
+  # but data goes stale). `claude auth status` refreshes creds without inference.
+  local real="" d
+  real="$(find_real_claude "$_self" 2>/dev/null)" || real=""
+  if [ -n "$real" ]; then
+    for d in "$ACC_ROOT"/acct-*; do
+      [ -d "$d" ] || continue
+      [ -f "$d/.credentials.json" ] || continue
+      [ -s "$d/server.token" ] && continue
+      if "$PYBIN" -c '
+import json, sys, time
+c = json.load(open(sys.argv[1])).get("claudeAiOauth", {})
+sys.exit(0 if c.get("expiresAt", 0) / 1000.0 <= time.time() + 60 else 1)' "$d/.credentials.json" 2>/dev/null; then
+        CLAUDE_CONFIG_DIR="$d" CLAUDE_SHIM_ACTIVE=1 "$real" auth status >/dev/null 2>&1 || true
+      fi
+    done
+  fi
+  # The >=90% exclusion rule is a hard requirement: the manifest may tighten it but
+  # never loosen it, or an account could sit at 95% and still be selected.
+  local threshold
+  threshold="$(manifest_get threshold 90)"
+  case "$threshold" in ''|*[!0-9]*) threshold=90 ;; esac
+  [ "$threshold" -gt 90 ] && threshold=90
+  [ "$threshold" -lt 1 ] && threshold=90
+  "$PYBIN" - "$ACC_ROOT" "$threshold" "$quiet" "$USAGE_URL" "$force" <<'PYEOF' 2>>"$ACC_ROOT/limits.log"
+import json, os, sys, time, urllib.request
+
+root, threshold, quiet, url, force = sys.argv[1], int(sys.argv[2]), sys.argv[3] == '1', sys.argv[4], sys.argv[5] == '1'
+now = time.time()
+# Don't re-fetch an account whose data is younger than this (endpoint rate-limits).
+MIN_FETCH_INTERVAL = int(os.environ.get('CLAUDE_MULTIACC_MIN_FETCH', '45'))
+
+def say(msg):
+    if not quiet:
+        print(msg)
+    with open(os.path.join(root, 'limits.log'), 'a') as f:
+        f.write(time.strftime('%Y-%m-%dT%H:%M:%SZ ', time.gmtime()) + msg + '\n')
+
+def parse_iso(s):
+    if not s:
+        return None
+    import datetime
+    try:
+        return datetime.datetime.fromisoformat(s.replace('Z', '+00:00')).timestamp()
+    except Exception:
+        return None
+
+try:
+    manifest = json.load(open(os.path.join(root, 'accounts.json')))
+except Exception as e:
+    sys.exit(f'cannot read manifest: {e}')
+
+for acct in manifest.get('accounts', []):
+    aid = acct['id']
+    d = os.path.join(root, aid)
+    if not os.path.isdir(d):
+        continue
+    bearer = None
+    source = None
+    cpath = os.path.join(d, '.credentials.json')
+    if os.path.isfile(cpath):
+        try:
+            c = json.load(open(cpath)).get('claudeAiOauth', {})
+            if c.get('accessToken') and c.get('expiresAt', 0) / 1000.0 > now + 60:
+                bearer, source = c['accessToken'], 'oauth'
+        except Exception:
+            pass
+    tpath = os.path.join(d, 'server.token')
+    if not bearer and os.path.isfile(tpath):
+        t = open(tpath).read().strip()
+        if t:
+            bearer, source = t, 'token'
+    if not bearer:
+        # Fail OPEN: no usable bearer => leave existing state; never block work on telemetry.
+        say(f'{aid}: no fresh bearer (expired oauth and/or no token); limits left as-is')
+        continue
+
+    # The usage endpoint rate-limits per account. Several callers can fire at once
+    # (60s cron + the shim's opportunistic kick + a manual run), so skip a fetch when
+    # this account's data is already fresh, and honor any backoff a 429 set earlier.
+    lpath = os.path.join(d, 'limits.json')
+    prev = {}
+    if os.path.isfile(lpath):
+        try:
+            prev = json.load(open(lpath))
+        except Exception:
+            prev = {}
+    if not force:
+        age = now - prev.get('fetched_at', 0)
+        if age < MIN_FETCH_INTERVAL:
+            continue
+        retry_at = prev.get('retry_after', 0)
+        if retry_at > now:
+            say(f'{aid}: backing off after 429 ({int(retry_at - now)}s left); limits left as-is')
+            continue
+
+    req = urllib.request.Request(url, headers={
+        'Authorization': 'Bearer ' + bearer,
+        'anthropic-beta': 'oauth-2025-04-20',
+        'Content-Type': 'application/json',
+        'User-Agent': 'claude-multiacc/1.0',
+    })
+    try:
+        resp = urllib.request.urlopen(req, timeout=15)
+        data = json.loads(resp.read().decode())
+    except urllib.error.HTTPError as e:
+        if e.code == 429:
+            # Respect Retry-After; otherwise exponential backoff capped at 30 min.
+            try:
+                wait = int(e.headers.get('Retry-After') or 0)
+            except (TypeError, ValueError):
+                wait = 0
+            if wait <= 0:
+                wait = min(1800, max(120, int(prev.get('backoff', 60)) * 2))
+            prev['retry_after'] = int(now + wait)
+            prev['backoff'] = wait
+            tmp = lpath + '.tmp'
+            with open(tmp, 'w') as f:
+                json.dump(prev, f, indent=1)
+            os.replace(tmp, lpath)
+            say(f'{aid}: rate limited (429); backing off {wait}s; failing open')
+        else:
+            say(f'{aid}: usage fetch failed (HTTP {e.code}); failing open')
+        continue
+    except Exception as e:
+        say(f'{aid}: usage fetch failed ({e}); failing open')
+        continue
+
+    def pct_of(v):
+        try:
+            return max(0, min(100, int(round(float(v)))))
+        except (TypeError, ValueError):
+            return None
+
+    def classify_group(kind):
+        # session (5h, self-healing) vs weekly (multi-day, expensive) vs monthly.
+        # Unknown durable buckets default to 'weekly' so they are never under-weighted.
+        k = kind.lower()
+        if k.startswith('session') or k in ('five_hour', 'fivehour', '5h'):
+            return 'session'
+        if 'month' in k:
+            return 'monthly'
+        return 'weekly'
+
+    # Shape-agnostic bucket extraction: every entry in limits[] becomes a bucket
+    # named kind[:model]. If Anthropic drops the per-model (Fable) separation,
+    # renames kinds, or reshapes scope, whatever buckets remain are still tracked
+    # and the >=90% rule keeps working. Entries we cannot parse are skipped, and
+    # any per-account surprise degrades that account only (fail open), never the run.
+    buckets = []
+    try:
+        for lim in (data.get('limits') or []):
+            if not isinstance(lim, dict):
+                continue
+            pct = pct_of(lim.get('percent'))
+            if pct is None:
+                continue
+            kind = str(lim.get('kind') or 'unknown')
+            name = kind
+            scope = lim.get('scope') or {}
+            model = None
+            if isinstance(scope, dict):
+                m = scope.get('model')
+                if isinstance(m, dict):
+                    model = m.get('display_name') or m.get('id')
+            if model:
+                name = f'{name}:{model}'
+            resets = lim.get('resets_at')
+            buckets.append({
+                'name': name,
+                'kind': kind,
+                'group': str(lim.get('group') or classify_group(kind)),
+                'percent': pct,
+                'resets_at': resets,
+                'resets_epoch': int(parse_iso(resets) or now + 3600),
+            })
+        if not buckets:
+            # Fallback for a payload with no limits[] array: scan EVERY top-level object
+            # carrying a utilization, so per-model buckets (seven_day_opus,
+            # seven_day_fable, ...) are picked up too — not just five_hour/seven_day.
+            # Missing one would let an exhausted model bucket go unnoticed.
+            for k, b in sorted(data.items()):
+                if not isinstance(b, dict) or k == 'extra_usage':
+                    continue
+                pct = pct_of(b.get('utilization'))
+                if pct is None:
+                    continue
+                buckets.append({
+                    'name': k,
+                    'kind': k,
+                    'group': classify_group(k),
+                    'percent': pct,
+                    'resets_at': b.get('resets_at'),
+                    'resets_epoch': int(parse_iso(b.get('resets_at')) or now + 3600),
+                })
+    except Exception as e:
+        say(f'{aid}: unexpected usage payload shape ({e}); failing open')
+        continue
+    # Successful fetch: fresh buckets replace everything, backoff state is dropped.
+    # THREE selection signals, per the documented reset asymmetry:
+    #   max_percent    — peak of ALL buckets; drives >=90% EXCLUSION (a full session
+    #                    bucket really does block, but its marker expires in ~5h).
+    #   weekly_percent — peak of the durable (weekly/monthly) buckets; the PRIMARY
+    #                    ranking signal, because weekly headroom only returns on the
+    #                    account's fixed weekly reset (days away).
+    #   session_percent— peak of the self-healing 5h bucket; a soft tiebreaker only.
+    maxp = max([b['percent'] for b in buckets] or [0])
+    weekly = [b['percent'] for b in buckets if b['group'] != 'session']
+    session = [b['percent'] for b in buckets if b['group'] == 'session']
+    weeklyp = max(weekly) if weekly else maxp
+    sessionp = max(session) if session else 0
+    out = {'fetched_at': int(now), 'source': source, 'max_percent': maxp,
+           'weekly_percent': weeklyp, 'session_percent': sessionp, 'buckets': buckets}
+    tmp = lpath + '.tmp'
+    with open(tmp, 'w') as f:
+        json.dump(out, f, indent=1)
+    os.replace(tmp, lpath)
+    offenders = [b for b in buckets if b['percent'] >= threshold]
+    mpath = os.path.join(d, '.limited')
+    if offenders:
+        worst = max(offenders, key=lambda b: b['percent'])
+        reset_epoch = max(int(b['resets_epoch']) for b in offenders)
+        # Atomic: a concurrent shim must never read a half-written marker.
+        with open(mpath + '.tmp', 'w') as f:
+            f.write(f'{reset_epoch}\n')
+            f.write(f"bucket={worst['name']} percent={worst['percent']} "
+                    f"marked_at={time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())} "
+                    f"reason=limits resets_at={worst['resets_at']}\n")
+        os.replace(mpath + '.tmp', mpath)
+        say(f"{aid}: LIMITED {worst['name']} at {worst['percent']}% (resets {worst['resets_at']})")
+    else:
+        if os.path.exists(mpath):
+            # A shim-written error-cooldown marker outlives a clean limits pass:
+            # the account failed a real call moments ago; give the cooldown its window.
+            keep = False
+            try:
+                txt = open(mpath).read()
+                first = txt.splitlines()[0] if txt else ''
+                if 'reason=error-cooldown' in txt and first.isdigit() and int(first) > now:
+                    keep = True
+            except Exception:
+                pass
+            if not keep:
+                os.remove(mpath)
+                say(f'{aid}: marker cleared (max {maxp}%)')
+        if not quiet:
+            detail = '  '.join(f"{b['name']}={b['percent']}%" for b in buckets)
+            print(f'{aid}: ok  {detail}')
+PYEOF
+}
+
+cmd_verify() {
+  require_manifest
+  local quick=0
+  [ "${1:-}" = "--quick" ] && quick=1
+  local real=""
+  if [ "$quick" = "0" ]; then
+    real="$(find_real_claude "$_self")" || die "real claude binary not found"
+  fi
+  "$PYBIN" - "$ACC_ROOT" "$quick" "$real" <<'PYEOF'
+import json, os, subprocess, sys, time
+
+root, quick, real = sys.argv[1], sys.argv[2] == '1', sys.argv[3]
+now = time.time()
+manifest = json.load(open(os.path.join(root, 'accounts.json')))
+failures = 0
+tested = 0
+
+for acct in manifest.get('accounts', []):
+    aid = acct['id']
+    d = os.path.join(root, aid)
+    cpath = os.path.join(d, '.credentials.json')
+    tpath = os.path.join(d, 'server.token')
+    has_creds = os.path.isfile(cpath)
+    has_token = os.path.isfile(tpath) and os.path.getsize(tpath) > 0
+    if not has_creds and not has_token:
+        print(f'{aid} {acct["email"]}: SKIP (no auth on this machine)')
+        continue
+    tested += 1
+    if has_creds:
+        try:
+            c = json.load(open(cpath)).get('claudeAiOauth', {})
+            rexp = c.get('refreshTokenExpiresAt', 0) / 1000.0
+            if rexp and rexp < now:
+                print(f'{aid} {acct["email"]}: FAIL (refresh token expired — re-login)')
+                failures += 1
+                continue
+        except Exception as e:
+            print(f'{aid} {acct["email"]}: FAIL (unreadable credentials: {e})')
+            failures += 1
+            continue
+    if quick:
+        kind = 'oauth' if has_creds else 'token'
+        print(f'{aid} {acct["email"]}: OK (quick, {kind} present)')
+        continue
+    env = dict(os.environ)
+    env['CLAUDE_CONFIG_DIR'] = d
+    env.pop('ANTHROPIC_API_KEY', None)
+    env.pop('CLAUDE_CODE_OAUTH_TOKEN', None)
+    env.pop('CLAUDE_ACCOUNT', None)
+    env['CLAUDE_SHIM_ACTIVE'] = '1'
+    if not has_creds:
+        env['CLAUDE_CODE_OAUTH_TOKEN'] = open(tpath).read().strip()
+    t0 = time.time()
+    try:
+        r = subprocess.run([real, '-p', 'Reply with exactly: OK'],
+                           env=env, capture_output=True, text=True, timeout=240,
+                           stdin=subprocess.DEVNULL, cwd=root)
+    except subprocess.TimeoutExpired:
+        print(f'{aid} {acct["email"]}: FAIL (timeout after 240s)')
+        failures += 1
+        continue
+    dt = time.time() - t0
+    out = (r.stdout or '').strip()
+    if r.returncode == 0 and 'ok' in out.lower():
+        print(f'{aid} {acct["email"]}: PASS ({dt:.1f}s) -> {out[:60]!r}')
+    else:
+        err = (r.stderr or '').strip()[:200]
+        print(f'{aid} {acct["email"]}: FAIL rc={r.returncode} out={out[:120]!r} err={err!r}')
+        failures += 1
+
+print()
+print(f'verified {tested} account(s), {failures} failure(s)')
+sys.exit(1 if failures else 0)
+PYEOF
+}
+
+cmd_sync() {
+  require_manifest
+  [ "$(machine_kind)" = "mac" ] || die "sync runs on the Mac (source of truth), not the server"
+  local allow_empty=0
+  [ "${1:-}" = "--allow-empty" ] && allow_empty=1
+  local server sroot srepo rc=0
+  server="$(manifest_get server "$DEFAULT_SERVER")"
+  sroot="$(manifest_get server_root "$DEFAULT_SERVER_ROOT")"
+  srepo="$(manifest_get server_repo "$DEFAULT_SERVER_REPO")"
+  # These land inside a remote shell command — anything but a plain target/path is a
+  # command-injection vector from a corrupted or hand-edited manifest.
+  valid_ssh_target "$server" || die "manifest 'server' is not a plain user@host: $server"
+  valid_remote_path "$sroot" || die "manifest 'server_root' is not a plain absolute path: $sroot"
+  valid_remote_path "$srepo" || die "manifest 'server_repo' is not a plain absolute path: $srepo"
+  rotate_log sync.log
+  slog() { log_to sync.log "$*"; }
+  fail() { slog "FAIL: $*"; printf 'claude-accounts sync: FAILED: %s\n' "$*" >&2; exit 1; }
+  slog "sync start -> $server:$sroot"
+
+  # Hard validation before anything destructive: a corrupt or accountless manifest must
+  # never be pushed (it would blank the server's pool), and must never make the removal
+  # loop below wipe the server's credentials. Emptying the pool on purpose is possible
+  # via `sync --allow-empty`, so this can never happen by accident.
+  "$PYBIN" - "$MANIFEST" <<'PYEOF' 2>/dev/null || fail "manifest is not valid JSON or has no well-formed accounts — refusing to sync"
+import json, re, sys
+doc = json.load(open(sys.argv[1]))
+accounts = doc.get('accounts')
+if not isinstance(accounts, list):
+    sys.exit(1)
+for a in accounts:
+    if not isinstance(a, dict) or not re.fullmatch(r'acct-\d{2}', str(a.get('id', ''))) \
+       or not str(a.get('email', '')).strip():
+        sys.exit(1)
+PYEOF
+  if [ -z "$(account_ids)" ] && [ "$allow_empty" != "1" ]; then
+    fail "manifest has zero accounts — refusing to blank the server pool (use 'sync --allow-empty' if that is really intended)"
+  fi
+
+  ssh -o BatchMode=yes -o ConnectTimeout=10 "$server" "mkdir -p '$sroot'" >>"$ACC_ROOT/sync.log" 2>&1 \
+    || fail "cannot reach $server"
+  rsync -az "$MANIFEST" "$server:$sroot/accounts.json" >>"$ACC_ROOT/sync.log" 2>&1 \
+    || fail "manifest push failed"
+
+  local id d
+  for id in $(account_ids); do
+    d="$ACC_ROOT/$id"
+    [ -d "$d" ] || continue
+    ssh -o BatchMode=yes "$server" "mkdir -p '$sroot/$id'" >>"$ACC_ROOT/sync.log" 2>&1 \
+      || fail "mkdir $id failed"
+    if [ -s "$d/server.token" ]; then
+      rsync -az --chmod=F600 "$d/server.token" "$server:$sroot/$id/" >>"$ACC_ROOT/sync.log" 2>&1 \
+        || fail "token push for $id failed"
+    fi
+    local seed
+    for seed in .claude.json settings.json; do
+      if [ -f "$d/$seed" ]; then
+        rsync -az --ignore-existing "$d/$seed" "$server:$sroot/$id/" >>"$ACC_ROOT/sync.log" 2>&1 \
+          || fail "seed push for $id/$seed failed"
+      fi
+    done
+    # Advisory limit state for accounts the server may lack a bearer for.
+    local extra
+    for extra in limits.json .limited; do
+      if [ -f "$d/$extra" ]; then
+        rsync -az "$d/$extra" "$server:$sroot/$id/" >>"$ACC_ROOT/sync.log" 2>&1 || true
+      fi
+    done
+  done
+
+  # Removal propagation: any server acct dir not in the manifest gets deleted.
+  # Safety: an EMPTY id list (parse error, or a truly emptied pool) never deletes —
+  # wiping every server credential must be an explicit manual act, not a side effect.
+  local ids_list ids_spaced
+  ids_list="$(account_ids)"
+  if [ -z "$ids_list" ]; then
+    slog "removal propagation skipped: empty account list (safety guard)"
+  else
+    ids_spaced=" $(printf '%s' "$ids_list" | tr '\n' ' ') "
+    ssh -o BatchMode=yes "$server" "cd '$sroot' 2>/dev/null || exit 0
+for dd in acct-*; do
+  [ -d \"\$dd\" ] || continue
+  case '$ids_spaced' in
+    *\" \$dd \"*) ;;
+    *) rm -rf -- \"\$dd\" ;;
+  esac
+done" >>"$ACC_ROOT/sync.log" 2>&1 || fail "removal propagation failed"
+  fi
+
+  # Post-sync hook: server seeds dirs and re-runs its quick verification matrix.
+  ssh -o BatchMode=yes "$server" "[ -x '$srepo/bin/claude-accounts' ] && '$srepo/bin/claude-accounts' post-sync" \
+    >>"$ACC_ROOT/sync.log" 2>&1 || slog "post-sync hook not available yet (server not bootstrapped?)"
+
+  slog "sync ok"
+  echo "sync ok -> $server:$sroot"
+  return $rc
+}
+
+cmd_post_sync() {
+  require_manifest
+  local id d
+  for id in $(account_ids); do
+    d="$ACC_ROOT/$id"
+    seed_account_dir "$d"
+    [ -f "$d/server.token" ] && chmod 600 "$d/server.token" 2>/dev/null
+    [ -f "$d/.credentials.json" ] && chmod 600 "$d/.credentials.json" 2>/dev/null
+  done
+  log_to sync.log "post-sync: seeded $(account_ids | wc -l | tr -d ' ') account dirs"
+  ( cmd_limits --quiet ) || true   # subshell: release the limits lock before verify
+  cmd_verify --quick
+}
+
+cmd_self_update() {
+  # Update the addon in place. npm global install => npm i -g @latest (its postinstall
+  # re-runs install.sh). git checkout => git pull + ./install.sh. Anything else is a
+  # no-op with a hint. Best-effort and fully logged; never disrupts a running claude.
+  local quiet=0
+  [ "${1:-}" = "--quiet" ] && quiet=1
+  rotate_log update.log
+  ulog() { log_to update.log "$*"; [ "$quiet" = "1" ] || echo "$*"; }
+  case "$REPO_DIR" in
+    */node_modules/claude-multiacc|*/node_modules/claude-multiacc/*)
+      command -v npm >/dev/null 2>&1 || { ulog "self-update: npm not found; skipping"; return 0; }
+      local cur lat
+      cur="$(npm ls -g --depth=0 claude-multiacc 2>/dev/null | sed -n 's/.*claude-multiacc@//p' | head -1)"
+      lat="$(npm view claude-multiacc version 2>/dev/null)"
+      if [ -n "$lat" ] && [ "$cur" = "$lat" ]; then
+        ulog "self-update: already latest ($cur)"
+        return 0
+      fi
+      ulog "self-update: npm $cur -> ${lat:-latest}"
+      if npm install -g claude-multiacc@latest >>"$ACC_ROOT/update.log" 2>&1; then
+        ulog "self-update: npm update ok"
+      else
+        ulog "self-update: npm update FAILED (see update.log)"
+        return 1
+      fi
+      ;;
+    *)
+      if [ -d "$REPO_DIR/.git" ] && command -v git >/dev/null 2>&1; then
+        ulog "self-update: git pull in $REPO_DIR"
+        if git -C "$REPO_DIR" pull --ff-only >>"$ACC_ROOT/update.log" 2>&1; then
+          "$REPO_DIR/install.sh" >>"$ACC_ROOT/update.log" 2>&1 \
+            && ulog "self-update: git update + reinstall ok" \
+            || { ulog "self-update: reinstall FAILED"; return 1; }
+        else
+          ulog "self-update: git pull FAILED (local changes? see update.log)"
+          return 1
+        fi
+      else
+        ulog "self-update: not an npm or git install ($REPO_DIR) — update manually"
+      fi
+      ;;
+  esac
+}
+
+cmd_health() {
+  require_manifest
+  rotate_log health.log
+  local out rc=0
+  # verify first: its real claude runs refresh any expired OAuth creds, so the
+  # limits pass that follows always has fresh bearers.
+  out="$( { echo "== verify =="; cmd_verify; echo; echo "== limits =="; cmd_limits; } 2>&1 )" || rc=1
+  printf '%s\n' "$out"
+  printf '%s health rc=%s\n%s\n' "$(ts_utc)" "$rc" "$out" >> "$ACC_ROOT/health.log"
+  if [ "$rc" -ne 0 ] && [ "$(machine_kind)" = "mac" ]; then
+    osascript -e 'display notification "claude-multiacc health check FAILED — run claude-accounts status" with title "claude-multiacc"' 2>/dev/null || true
+  fi
+  return $rc
+}
+
+case "${1:-help}" in
+  list) shift; cmd_list "$@" ;;
+  status) shift; cmd_status "$@" ;;
+  add) shift; cmd_add "$@" ;;
+  import) shift; cmd_import "$@" ;;
+  adopt) shift; cmd_adopt "$@" ;;
+  remove) shift; cmd_remove "$@" ;;
+  mint) shift; cmd_mint "$@" ;;
+  login) shift; cmd_login "$@" ;;
+  sync) shift; cmd_sync "$@" ;;
+  verify) shift; cmd_verify "$@" ;;
+  limits) shift; cmd_limits "$@" ;;
+  post-sync) shift; cmd_post_sync "$@" ;;
+  health) shift; cmd_health "$@" ;;
+  self-update) shift; cmd_self_update "$@" ;;
+  help|--help|-h) usage ;;
+  *) usage; exit 1 ;;
+esac