claude-multiacc 1.0.13 → 1.0.14

package/bin/claude-accounts

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # claude-accounts — manage the claude-multiacc account pool.
 # Subcommands: list status add import remove mint sync verify limits post-sync health
-#              expired relogin
+#              expired relogin export-credential import-credential
 set -u
 # lib/audit.py is imported by several subcommands; keep the install tree free of
 # __pycache__ (it may be root-owned, read-only, or an npm global prefix).
@@ -22,8 +22,8 @@ usage() {
 claude-accounts — multi-account pool manager for claude-multiacc
 
 USAGE
-  claude-accounts list                      brief account list
-  claude-accounts status                    full health: auth, per-bucket limits, markers
+  claude-accounts list [--json]             brief account list (--json: machine-readable)
+  claude-accounts status [--json]           full health: auth, per-bucket limits, markers
   claude-accounts add [email] [--token] [--force]
       login-FIRST: runs the full Claude Code login (`claude auth login` — the normal
       browser sign-in, no long-lived-token step-up), then registers only after the
@@ -51,17 +51,34 @@ USAGE
   claude-accounts adopt <acct-NN>           make acct-NN THIS machine's existing
                                             default ~/.claude login (dir symlink —
                                             single credential file, no grant fork)
+  claude-accounts export-credential <acct-NN> [--out PATH] [--identity-only]
+      print a self-contained JSON blob (credential + identity metadata) for a
+      PORTABLE account, i.e. one with a setup-token. REFUSES a machine-local OAuth
+      credential (exit 3) — those cannot be copied; sign in on the machine that
+      needs them, or run 'mint <acct-NN>' once to make the account portable.
+      --identity-only exports registry metadata with NO credential material.
+      Exit: 0 ok, 3 machine-local, 4 no credential, 5 unusable material.
+  claude-accounts import-credential [acct-NN] [--in PATH|-] [--home mac|server]
+                                    [--force] [--no-sync]
+      install a blob from export-credential (stdin by default): creates the account
+      dir + manifest entry as needed, or refreshes the credential of the account
+      that already owns that email. Non-interactive — this is how a daemon
+      distributes accounts to a machine.
   claude-accounts remove <acct-NN> [--yes]  delete account (propagates to server)
   claude-accounts dedupe [--yes]            remove any account registered twice
                                             (same email), keeping one per email
   claude-accounts mint <acct-NN>            mint server token via `claude setup-token`
       --paste               paste an already-minted token instead of running setup-token
-  claude-accounts sync                      push manifest+tokens to the server AND any
-                                            manifest 'peers' (extra machines). Mac only.
-                                            A pool with a 'sync-role' file saying
+  claude-accounts sync [--no-server]        push manifest+tokens to the sync target AND
+                                            any manifest 'peers' (extra machines). Mac
+                                            only. A pool with a 'sync-role' file saying
                                             'replica' never pushes (it receives).
+                                            --no-server (or a pool whose target is
+                                            'none') keeps sync LOCAL: validate + seed +
+                                            fix perms, push nowhere — for pools a panel
+                                            or runner daemon distributes.
   claude-accounts verify [--quick]          auth matrix; full mode runs `-p "reply OK"` per account
-  claude-accounts limits [--quiet] [--force]
+  claude-accounts limits [--quiet] [--force] [--json]
       refresh usage buckets, apply >=90% markers. Auto-refreshes long-expired
       OAuth access tokens via the refresh-token grant (rotated credential is
       persisted), so idle accounts keep fresh telemetry and stay selectable.
@@ -73,7 +90,12 @@ USAGE
   claude-accounts post-sync                 (server side) seed dirs, fix perms, quick verify
 
 ENV
-  CLAUDE_ACCOUNTS_DIR   override ~/.claude-accounts
+  CLAUDE_ACCOUNTS_ROOT  pool root, overriding ~/.claude-accounts — one isolated pool
+                        per app-robot instance on a shared machine (legacy spelling
+                        CLAUDE_ACCOUNTS_DIR still works)
+  CLAUDE_MULTIACC_SYNC_TARGET  sync target (user@host), overriding the manifest;
+                        'none' = local-only, nothing is pushed anywhere
+  CLAUDE_MULTIACC_SYNC_ROOT / _SYNC_REPO   remote pool root / addon repo for it
   CLAUDE_ACCOUNT        pin the shim to one account
   CLAUDE_SHIM_RETRY=0   disable -p auto-retry
   CLAUDE_MULTIACC_DISABLE=1  bypass the shim entirely
@@ -95,17 +117,19 @@ next_id() {
   done
 }
 
-manifest_add_account() { # id email home
-  "$PYBIN" - "$MANIFEST" "$1" "$2" "$3" <<'PYEOF'
+manifest_add_account() { # id email home [added_at]
+  "$PYBIN" - "$MANIFEST" "$1" "$2" "$3" "${4:-}" <<'PYEOF'
 import json, sys, time
-path, aid, email, home = sys.argv[1:5]
+path, aid, email, home, added_at = sys.argv[1:6]
 doc = json.load(open(path))
 accounts = [a for a in doc.get('accounts', []) if a['id'] != aid]
 accounts.append({
     'id': aid,
     'email': email,
     'home': home,
-    'added_at': time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime()),
+    # An imported account keeps the added_at it was registered with on the machine it
+    # came from, so the same account reads identically across the fleet.
+    'added_at': added_at or time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime()),
 })
 accounts.sort(key=lambda a: a['id'])
 doc['accounts'] = accounts
@@ -128,6 +152,17 @@ for a in json.load(open(sys.argv[1])).get('accounts', []):
 PYEOF
 }
 
+manifest_email_of() { # prints the email registered for <id>, empty if unknown
+  [ -f "$MANIFEST" ] || return 0
+  "$PYBIN" - "$MANIFEST" "$1" <<'PYEOF' 2>/dev/null
+import json, sys
+for a in json.load(open(sys.argv[1])).get('accounts', []):
+    if isinstance(a, dict) and a.get('id') == sys.argv[2]:
+        print(a.get('email', ''))
+        break
+PYEOF
+}
+
 manifest_del_account() { # id
   "$PYBIN" - "$MANIFEST" "$1" <<'PYEOF'
 import json, sys
@@ -143,8 +178,11 @@ PYEOF
 }
 
 auto_sync() { # best effort after mutations, Mac only, loud on failure
-  [ "$(machine_kind)" = "mac" ] || return 0
   [ "${CLAUDE_MULTIACC_NO_SYNC:-0}" = "1" ] && return 0
+  # Local-only pool (target 'none'): there is nothing to push — the panel/runner
+  # daemon distributes accounts — so a mutation must not warn about a missing server.
+  sync_target_is_local "$(sync_target)" && return 0
+  [ "$(machine_kind)" = "mac" ] || return 0
   # A replica pool never pushes (the source machine owns the account set) —
   # silently, so every mutation on a replica does not nag about it.
   sync_is_replica && return 0
@@ -154,6 +192,14 @@ auto_sync() { # best effort after mutations, Mac only, loud on failure
 
 cmd_list() {
   require_manifest
+  local json=0
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --json) json=1; shift ;;
+      *) die "unknown option: $1 (usage: claude-accounts list [--json])" ;;
+    esac
+  done
+  if [ "$json" = "1" ]; then emit_report_json list; return $?; fi
   "$PYBIN" - "$MANIFEST" "$ACC_ROOT" "$LIB_DIR" "$(machine_kind)" <<'PYEOF'
 import json, os, re, sys
 doc = json.load(open(sys.argv[1]))
@@ -205,6 +251,14 @@ PYEOF
 
 cmd_status() {
   require_manifest
+  local json=0
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --json) json=1; shift ;;
+      *) die "unknown option: $1 (usage: claude-accounts status [--json])" ;;
+    esac
+  done
+  if [ "$json" = "1" ]; then emit_report_json status; return $?; fi
   "$PYBIN" - "$MANIFEST" "$ACC_ROOT" "$LIB_DIR" "$(machine_kind)" <<'PYEOF'
 import json, os, sys, time
 doc = json.load(open(sys.argv[1]))
@@ -922,11 +976,12 @@ cmd_relogin() {
 
 cmd_limits() {
   require_manifest
-  local quiet=0 force=0
+  local quiet=0 force=0 json=0
   while [ $# -gt 0 ]; do
     case "$1" in
       --quiet) quiet=1; shift ;;
       --force) force=1; shift ;;   # ignore freshness/backoff (manual override)
+      --json) json=1; quiet=1; shift ;;   # refresh silently, then emit the report
       *) die "unknown option: $1" ;;
     esac
   done
@@ -935,14 +990,20 @@ cmd_limits() {
   if ! mkdir "$lock" 2>/dev/null; then
     local age=$(( $(epoch_now) - $(file_mtime "$lock") ))
     if [ "$age" -lt 120 ]; then
+      # A --json caller still gets the document (built from the state on disk) —
+      # a machine-readable verb must never answer a concurrent run with silence.
+      if [ "$json" = "1" ]; then emit_report_json limits; return $?; fi
       [ "$quiet" = "1" ] || echo "another limits refresh is running; skipping"
       return 0
     fi
     rm -rf "$lock"
-    mkdir "$lock" 2>/dev/null || return 0
+    if ! mkdir "$lock" 2>/dev/null; then
+      if [ "$json" = "1" ]; then emit_report_json limits; return $?; fi
+      return 0
+    fi
   fi
-  # shellcheck disable=SC2064
-  trap "rm -rf '$lock'" EXIT
+  LIMITS_LOCK="$lock"
+  trap limits_lock_release EXIT
   rotate_log limits.log
   # NB: expired OAuth access tokens are refreshed inside the Python below via the
   # refresh-token grant. (`claude auth status` was tried for this and does NOT
@@ -960,7 +1021,7 @@ import json, os, sys, time, urllib.request
 root, threshold, quiet, url, force = sys.argv[1], int(sys.argv[2]), sys.argv[3] == '1', sys.argv[4], sys.argv[5] == '1'
 now = time.time()
 # Don't re-fetch an account whose data is younger than this (endpoint rate-limits).
-MIN_FETCH_INTERVAL = int(os.environ.get('CLAUDE_MULTIACC_MIN_FETCH', '45'))
+MIN_FETCH_INTERVAL = int(os.environ.get('CLAUDE_MULTIACC_MIN_FETCH', '240'))
 
 # OAuth refresh-token grant — the same endpoint + public client id Claude Code
 # itself uses to keep .credentials.json alive. An account that sits idle past its
@@ -1350,13 +1411,21 @@ for acct in manifest.get('accounts', []):
         say(f"{aid}: LIMITED {worst['name']} at {worst['percent']}% (resets {worst['resets_at']})")
     else:
         if os.path.exists(mpath):
-            # A shim-written error-cooldown marker outlives a clean limits pass:
-            # the account failed a real call moments ago; give the cooldown its window.
+            # A shim-written marker outlives a clean limits pass while its own window
+            # is still open:
+            #   error-cooldown     — the account failed a real call moments ago.
+            #   client-rate-limit  — Claude Code itself was REJECTED on this account and
+            #                        recorded the reset the API handed it. That is
+            #                        first-hand evidence; a usage payload that disagrees
+            #                        (different bucket set, cached edge) must not unpark
+            #                        the account early and send work straight back into
+            #                        the 429.
             keep = False
             try:
                 txt = open(mpath).read()
                 first = txt.splitlines()[0] if txt else ''
-                if 'reason=error-cooldown' in txt and first.isdigit() and int(first) > now:
+                if ('reason=error-cooldown' in txt or 'reason=client-rate-limit' in txt) \
+                        and first.isdigit() and int(first) > now:
                     keep = True
             except Exception:
                 pass
@@ -1367,6 +1436,18 @@ for acct in manifest.get('accounts', []):
             detail = '  '.join(f"{b['name']}={b['percent']}%" for b in buckets)
             print(f'{aid}: ok  {detail}')
 PYEOF
+  local refresh_rc=$?
+  # Release the lock BEFORE the report: a --json caller must not hold the refresh
+  # lock while a consumer reads its output.
+  limits_lock_release
+  trap - EXIT
+  # The refresher fails open per account; a NON-zero status means the pass itself
+  # broke (unreadable manifest, dead python). Report the state anyway — stale data
+  # beats silence — but hand the caller the failure, exactly as before --json existed.
+  if [ "$json" = "1" ]; then
+    emit_report_json limits || return $?
+  fi
+  return "$refresh_rc"
 }
 
 cmd_verify() {
@@ -1606,17 +1687,45 @@ sync_is_replica() {
 
 cmd_sync() {
   require_manifest
+  local allow_empty=0 no_server=0
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --allow-empty) allow_empty=1; shift ;;
+      --no-server) no_server=1; shift ;;   # this run pushes nowhere, whatever the manifest says
+      *) die "unknown option: $1 (usage: claude-accounts sync [--no-server] [--allow-empty])" ;;
+    esac
+  done
+  local server sroot srepo
+  server="$(sync_target)"
+  sroot="$(sync_target_root)"
+  srepo="$(sync_target_repo)"
+  # LOCAL-ONLY: no ssh target at all, because a panel/runner daemon distributes this
+  # pool. Validate + fix up locally and stop — the same verb keeps working, it simply
+  # has nowhere to push. (Not Mac-gated: a local pool is legitimate on any host.)
+  # This mode NARROWS the replica rule, it never widens it: a replica pushes nothing,
+  # and a local-only pool pushes nothing whether or not it is a replica. The marker is
+  # still honored and still reported, so a replica can never start pushing by having
+  # its sync target changed.
+  if [ "$no_server" = "1" ] || sync_target_is_local "$server"; then
+    rotate_log sync.log
+    manifest_well_formed || { log_to sync.log "FAIL: manifest malformed (local sync)"; \
+      die "manifest is not valid JSON or has no well-formed accounts — fix $MANIFEST"; }
+    local role="source"
+    sync_is_replica && role="replica"
+    log_to sync.log "sync (local-only, role=$role): no server target${no_server:+ (--no-server)}"
+    local_pool_fixup
+    if [ "$role" = "replica" ]; then
+      echo "sync ok (local-only, and this pool is a sync replica — nothing pushed either way)"
+    else
+      echo "sync ok (local-only: pool at $ACC_ROOT validated and re-seeded; nothing pushed)"
+    fi
+    return 0
+  fi
   [ "$(machine_kind)" = "mac" ] || die "sync runs on the Mac (source of truth), not the server"
   if sync_is_replica; then
     echo "this pool is a sync replica — the source machine pushes here; nothing sent"
     return 0
   fi
-  local allow_empty=0
-  [ "${1:-}" = "--allow-empty" ] && allow_empty=1
-  local server sroot srepo
-  server="$(manifest_get server "$DEFAULT_SERVER")"
-  sroot="$(manifest_get server_root "$DEFAULT_SERVER_ROOT")"
-  srepo="$(manifest_get server_repo "$DEFAULT_SERVER_REPO")"
   # These land inside remote shell commands — anything but a plain target/path is a
   # command-injection vector from a corrupted or hand-edited manifest. EVERY target
   # (primary and peers) is validated before anything is pushed anywhere.
@@ -1648,17 +1757,8 @@ EOF
   # never be pushed (it would blank the target pools), and must never make the removal
   # propagation wipe a target's credentials. Emptying the pool on purpose is possible
   # via `sync --allow-empty`, so this can never happen by accident.
-  "$PYBIN" - "$MANIFEST" <<'PYEOF' 2>/dev/null || fail "manifest is not valid JSON or has no well-formed accounts — refusing to sync"
-import json, re, sys
-doc = json.load(open(sys.argv[1]))
-accounts = doc.get('accounts')
-if not isinstance(accounts, list):
-    sys.exit(1)
-for a in accounts:
-    if not isinstance(a, dict) or not re.fullmatch(r'acct-\d{2}', str(a.get('id', ''))) \
-       or not str(a.get('email', '')).strip():
-        sys.exit(1)
-PYEOF
+  manifest_well_formed \
+    || fail "manifest is not valid JSON or has no well-formed accounts — refusing to sync"
   if [ -z "$(account_ids)" ] && [ "$allow_empty" != "1" ]; then
     fail "manifest has zero accounts — refusing to blank the target pools (use 'sync --allow-empty' if that is really intended)"
   fi
@@ -1685,13 +1785,7 @@ EOF
 
 cmd_post_sync() {
   require_manifest
-  local id d
-  for id in $(account_ids); do
-    d="$ACC_ROOT/$id"
-    seed_account_dir "$d"
-    [ -f "$d/server.token" ] && chmod 600 "$d/server.token" 2>/dev/null
-    [ -f "$d/.credentials.json" ] && chmod 600 "$d/.credentials.json" 2>/dev/null
-  done
+  local_pool_fixup
   log_to sync.log "post-sync: seeded $(account_ids | wc -l | tr -d ' ') account dirs"
   ( cmd_limits --quiet ) || true   # subshell: release the limits lock before verify
   cmd_verify --quick
@@ -1761,6 +1855,8 @@ case "${1:-help}" in
   status) shift; cmd_status "$@" ;;
   add) shift; cmd_add "$@" ;;
   import) shift; cmd_import "$@" ;;
+  export-credential|export-cred) shift; cmd_export_credential "$@" ;;
+  import-credential|import-cred) shift; cmd_import_credential "$@" ;;
   adopt) shift; cmd_adopt "$@" ;;
   dedupe) shift; cmd_dedupe "$@" ;;
   remove) shift; cmd_remove "$@" ;;