claude-multiacc 1.0.14 → 1.0.16

package/bin/claude-accounts

@@ -267,6 +267,25 @@ sys.path = [sys.argv[3]] + [p for p in sys.path if p not in ('', '.')]
 from audit import audit_account   # noqa: E402  (shared with the shim's rule)
 machine = sys.argv[4]
 now = time.time()
+# Must match the shim's window (bin/claude), or status would call data "fresh" that
+# selection has already stopped ranking on. Same fallback as the shim for a garbled
+# override: a bad env var must never be the thing that stops status from printing.
+try:
+    STALE_AFTER = int(os.environ.get('CLAUDE_MULTIACC_STALE_AFTER') or 3600)
+except ValueError:
+    STALE_AFTER = 3600
+if STALE_AFTER <= 0:
+    STALE_AFTER = 3600
+
+def telem_fetched_at(aid):
+    """Epoch of aid's last SUCCESSFUL usage fetch, or 0. Never raises: this file is
+    hand-editable and syncs between machines, and one corrupt copy must not stop
+    status from printing the pool-wide verdict it exists to show."""
+    try:
+        v = json.load(open(os.path.join(root, aid, 'limits.json'))).get('fetched_at', 0)
+    except Exception:
+        return 0
+    return v if isinstance(v, (int, float)) and not isinstance(v, bool) and v > 0 else 0
 
 def last_pick(aid):
     path = os.path.join(root, 'selection.log')
@@ -288,12 +307,15 @@ print(f"server    : {doc.get('server','-')}  (root: {doc.get('server_root','-')}
 print(f"threshold : {doc.get('threshold', 90)}% (any bucket at/above => account excluded)")
 print()
 needs_login = []
+selectable_ids = []
 for a in doc.get('accounts', []):
     aid = a['id']
     d = os.path.join(root, aid)
     st = audit_account(root, a, machine=machine)
     if st['state'] in ('expired', 'blocked', 'missing'):
         needs_login.append(aid)
+    else:
+        selectable_ids.append(aid)
     banner = {'ok': '', 'remote': '  [not logged in here — grant lives elsewhere]',
               'missing': '  ** NO LOGIN — claude-accounts relogin %s **' % aid,
               'expired': '  ** LOGIN EXPIRED — claude-accounts relogin %s **' % aid,
@@ -325,9 +347,33 @@ for a in doc.get('accounts', []):
     if os.path.isfile(lpath):
         try:
             lim = json.load(open(lpath))
-            age = int(now - lim.get('fetched_at', 0))
+            if not isinstance(lim, dict):
+                raise ValueError('not an object')
+            fetched = telem_fetched_at(aid)
+            age = int(now - fetched) if fetched else None
             parts = [f"{b['name']}={b['percent']}%" for b in lim.get('buckets', [])]
-            print(f"  limits      : {'  '.join(parts) or '(none)'}  [{age}s old, max {lim.get('max_percent')}%]")
+            if age is None:
+                shown = 'never fetched'
+            elif age >= 86400:
+                shown = f'{age // 86400}d {age % 86400 // 3600}h old'
+            elif age >= 3600:
+                shown = f'{age // 3600}h {age % 3600 // 60}m old'
+            else:
+                shown = f'{age}s old'
+            # Loud, because stale numbers do not look stale: they look like a healthy
+            # account sitting at 2%. Past the ranking window the shim ignores them
+            # entirely and picks at random, so the reading below is decoration.
+            stale = age is None or age > STALE_AFTER
+            flag = '  << STALE — NOT USED FOR RANKING' if stale else ''
+            print(f"  limits      : {'  '.join(parts) or '(none)'}  [{shown}, max {lim.get('max_percent')}%]{flag}")
+            err = lim.get('last_error')
+            if isinstance(err, str) and err:
+                when = lim.get('last_error_at')
+                ago = f' ({int(now - when)}s ago)' if isinstance(when, (int, float)) else ''
+                print(f"  telemetry   : last fetch FAILED{ago}: {err}")
+                retry = lim.get('retry_after', 0)
+                if isinstance(retry, (int, float)) and retry > now:
+                    print(f"                retrying in {int(retry - now)}s")
         except Exception as e:
             print(f"  limits      : unreadable ({e})")
     else:
@@ -349,6 +395,40 @@ for a in doc.get('accounts', []):
 if needs_login:
     print(f"{len(needs_login)} account(s) are EXCLUDED from selection: {', '.join(needs_login)}")
     print("What each one needs: claude-accounts expired")
+# Pool-wide verdict. Per-account ages are easy to skim past; "the pool is picking at
+# random" is not. This is the line that would have caught an eleven-day outage on the
+# first day someone ran status.
+# The verdict comes from lib/report.py so this text, `--json`, and the shim's own
+# ranking can never drift apart — a status that disagrees with selection is worse than
+# no status at all.
+try:
+    from report import telemetry_state, build   # noqa: E402
+    doc_rows = build(root, 'claude', machine, 'status')['accounts']
+    verdict = telemetry_state(doc_rows, now)
+except Exception as e:
+    verdict = 'unknown'
+    verdict_err = str(e)[:200]
+if verdict == 'unknown':
+    # Silence here would recreate the observability half of the incident: a blind pool
+    # that says nothing. Say the verdict could not be computed, and why.
+    print(f"RANKING STATE UNKNOWN: could not compute the pool-wide telemetry verdict "
+          f"({verdict_err}). Check the per-account ages above by hand.")
+elif verdict == 'blind':
+    print("RANKING IS BLIND: no account has usage telemetry inside the "
+          f"{STALE_AFTER}s window, and the last readings are too old to mean anything, "
+          "so every account scores the same and `claude` picks at RANDOM — including "
+          "accounts that are nearly out of weekly headroom.")
+    print("  why : see the 'telemetry' lines above (a setup token cannot read the usage "
+          "endpoint — it has no user:profile scope; only an OAuth login on this machine can)")
+    print("  fix : claude-accounts limits --force   # then, if it still fails:")
+    print("        claude-accounts login <acct-NN>  # per account, on THIS machine")
+elif verdict == 'degraded':
+    print("RANKING IS DEGRADED: no account has telemetry inside the "
+          f"{STALE_AFTER}s window, so `claude` is ranking on the last readings whose "
+          "weekly bucket has not reset yet. Better than random, but it cannot see usage "
+          "since those readings were taken.")
+    print("  fix : claude-accounts limits --force   # then, if it still fails:")
+    print("        claude-accounts login <acct-NN>  # per account, on THIS machine")
 PYEOF
 }
 
@@ -1016,7 +1096,7 @@ cmd_limits() {
   [ "$threshold" -gt 90 ] && threshold=90
   [ "$threshold" -lt 1 ] && threshold=90
   "$PYBIN" - "$ACC_ROOT" "$threshold" "$quiet" "$USAGE_URL" "$force" <<'PYEOF' 2>>"$ACC_ROOT/limits.log"
-import json, os, sys, time, urllib.request
+import hashlib, json, os, sys, time, urllib.request
 
 root, threshold, quiet, url, force = sys.argv[1], int(sys.argv[2]), sys.argv[3] == '1', sys.argv[4], sys.argv[5] == '1'
 now = time.time()
@@ -1037,6 +1117,13 @@ CLIENT_ID = os.environ.get('CLAUDE_MULTIACC_CLIENT_ID',
 REFRESH_MIN_EXPIRED = 300
 REFRESH_FAIL_BACKOFF = 600     # transient (network/5xx/429): retry in 10 min
 REFRESH_DENIED_BACKOFF = 21600  # 4xx = grant likely revoked: 6h; re-login needed anyway
+# A usage fetch the server says will never succeed (x-should-retry: false — e.g. the
+# 403 "does not meet scope requirement user:profile" that a setup token ALWAYS gets)
+# is not a hiccup to retry every pass. Retrying it is what manufactured the 429s that
+# then hid the real cause for days, so a definitive refusal parks for 6h and says
+# exactly which ceremony fixes it.
+USAGE_DENIED_BACKOFF = 21600
+USAGE_FAIL_BACKOFF = 900       # anything else non-2xx: 15 min, doubling to 30
 
 def say(msg):
     if not quiet:
@@ -1058,6 +1145,15 @@ def parse_iso(s):
 # 4xx from the refresh endpoint), never for a transient network/5xx/429 hiccup.
 def mark_expired(d, slug, detail=''):
     mpath = os.path.join(d, '.expired')
+    # An org-blocked marker is the strongest statement there is about an account and
+    # only `verify` or a re-login may lift it (see clear_expired). Overwriting its
+    # REASON with a weaker one is how it gets lifted by accident: the next successful
+    # fetch sees a reason clear_expired is willing to drop, and the block vanishes.
+    try:
+        if 'reason=org-blocked' in open(mpath, errors='replace').read():
+            return
+    except OSError:
+        pass
     try:
         with open(mpath + '.tmp', 'w') as f:
             f.write(f'{int(now)}\n')
@@ -1089,6 +1185,39 @@ try:
 except Exception as e:
     sys.exit(f'cannot read manifest: {e}')
 
+def token_digest(path):
+    """Stable, non-secret identifier for a credential file's CONTENTS. Used to
+    remember which setup token this endpoint refused, so a re-minted one still gets a
+    try while the refused one is never spent again. Truncated: this only has to
+    distinguish credentials, and a full hash of a secret is not something to write
+    into a file that syncs between machines."""
+    try:
+        with open(path, 'rb') as f:
+            return hashlib.sha256(f.read()).hexdigest()[:16]
+    except OSError:
+        return None
+
+
+def park_dead_grant(aid, d, slug, detail):
+    """Park an account whose OAuth grant is dead — UNLESS it also has a portable setup
+    token, in which case the grant being dead proves nothing about the account: the
+    token still authenticates every real call. Parking it would take a perfectly
+    working account out of the pool over a credential the pool does not need for work,
+    only for telemetry. (The shim's auth_dead() checks the .expired marker BEFORE
+    server.token, so a marker written here really would remove it.)"""
+    try:
+        portable = os.path.getsize(os.path.join(d, 'server.token')) > 0
+    except OSError:
+        portable = False
+    if portable:
+        say(f'{aid}: OAuth grant is dead ({slug}) but its setup token still works — '
+            f'staying in the pool. TELEMETRY is dead for it until it has an OAuth login '
+            f'here: claude-accounts login {aid}')
+        return
+    mark_expired(d, slug, detail)
+    say(f'{aid}: {detail} — re-login needed (claude-accounts relogin {aid})')
+
+
 def refresh_oauth(aid, d, cpath):
     """Refresh a long-expired OAuth access token via the refresh-token grant and
     persist the ROTATED credential atomically (0600). Returns the new bearer, or
@@ -1105,20 +1234,22 @@ def refresh_oauth(aid, d, cpath):
             return None
     except Exception:
         return None
-    if not o.get('accessToken'):
-        return None
+    # NB: no "must have an accessToken" gate. A credential whose access token was
+    # cleared but whose REFRESH token is alive is exactly the shape a grant is supposed
+    # to recover from; requiring the dead half to be present meant such an account could
+    # never come back, and (with a setup token beside it) went dark for telemetry
+    # forever. The expiresAt gate below is what protects a live session's credential.
     if not o.get('refreshToken'):
-        mark_expired(d, 'no-refresh-token',
-                     'credential has no refresh token and its access token expired')
+        park_dead_grant(aid, d, 'no-refresh-token',
+                        'credential has no refresh token and its access token expired')
         return None
     if o.get('expiresAt', 0) / 1000.0 > now - REFRESH_MIN_EXPIRED:
         return None  # not expired long enough to prove no live session owns it
     if o.get('refreshTokenExpiresAt', 0) / 1000.0 <= now:
         # Nothing can revive this account: park it so the shim stops selecting it
         # (every run under it would fail with "OAuth session expired").
-        mark_expired(d, 'refresh-token-expired',
-                     'the refresh token itself expired; only a re-login can fix it')
-        say(f'{aid}: refresh token expired — re-login needed (claude-accounts relogin {aid})')
+        park_dead_grant(aid, d, 'refresh-token-expired',
+                        'the refresh token itself expired; only a re-login can fix it')
         return None
     if not force:
         try:
@@ -1138,6 +1269,7 @@ def refresh_oauth(aid, d, cpath):
             pass
         say(f'{aid}: oauth refresh failed ({why}); backing off {wait}s; limits left as-is')
 
+    started_with = o['refreshToken']
     body = json.dumps({'grant_type': 'refresh_token',
                        'refresh_token': o['refreshToken'],
                        'client_id': CLIENT_ID}).encode()
@@ -1166,11 +1298,11 @@ def refresh_oauth(aid, d, cpath):
             except Exception:
                 pass
             if 'invalid_grant' in body:
-                mark_expired(d, f'refresh-denied-http-{e.code}',
-                             'the refresh grant was refused as invalid_grant (revoked or rotated away)')
+                park_dead_grant(aid, d, f'refresh-denied-http-{e.code}',
+                                'the refresh grant was refused as invalid_grant (revoked or rotated away)')
             elif denials >= 3:
-                mark_expired(d, f'refresh-denied-http-{e.code}',
-                             f'the refresh grant was refused {denials} times in a row')
+                park_dead_grant(aid, d, f'refresh-denied-http-{e.code}',
+                                f'the refresh grant was refused {denials} times in a row')
             back_off(REFRESH_DENIED_BACKOFF,
                      f'HTTP {e.code} — refresh token may be revoked; re-login needed',
                      denials=denials)
@@ -1198,10 +1330,26 @@ def refresh_oauth(aid, d, cpath):
     if data.get('refresh_token_expires_in'):
         o['refreshTokenExpiresAt'] = int((now + float(data['refresh_token_expires_in'])) * 1000)
     doc['claudeAiOauth'] = o
+    # CHECK-AND-SET. The grant rotates, and a live claude session refreshes the same
+    # file. REFRESH_MIN_EXPIRED makes that unlikely, not impossible — and losing the
+    # race by overwriting means the session's newer credential is destroyed. If the
+    # on-disk refresh token is no longer the one this grant was issued against, the
+    # other writer won: keep its result, discard ours.
+    try:
+        with open(cpath) as f:
+            disk = json.load(f).get('claudeAiOauth', {})
+        if isinstance(disk, dict) and disk.get('refreshToken') != started_with:
+            say(f'{aid}: credential was refreshed by something else mid-flight — '
+                f'keeping the newer one on disk')
+            return None
+    except Exception:
+        pass
     try:
         fd = os.open(cpath + '.tmp', os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
         with os.fdopen(fd, 'w') as f:
             json.dump(doc, f)
+            f.flush()
+            os.fsync(f.fileno())
         os.replace(cpath + '.tmp', cpath)
     except Exception as e:
         say(f'{aid}: token refreshed but credentials NOT persisted ({e}) — re-login may be needed')
@@ -1233,18 +1381,43 @@ for acct in manifest.get('accounts', []):
             prev = json.load(open(lpath))
         except Exception:
             prev = {}
+    # Valid JSON is not the same as a usable document: `[]`, `null` and `"broken"` all
+    # parse, and every prev.get() below would then raise OUTSIDE the try — killing the
+    # loop and starving every account after this one of telemetry. One corrupt file
+    # must cost exactly one account.
+    if not isinstance(prev, dict):
+        prev = {}
+
+    def num(key, default=0):
+        """A field of the wrong type is the same as an absent one. limits.json is
+        hand-editable, syncs between machines, and is written by more than one
+        version of this tool at once."""
+        v = prev.get(key, default)
+        return v if isinstance(v, (int, float)) and not isinstance(v, bool) else default
+
     if not force:
-        age = now - prev.get('fetched_at', 0)
+        age = now - num('fetched_at')
         if age < MIN_FETCH_INTERVAL:
             continue
-        retry_at = prev.get('retry_after', 0)
+        retry_at = num('retry_after')
         if retry_at > now:
-            say(f'{aid}: backing off after 429 ({int(retry_at - now)}s left); limits left as-is')
+            # Name the ACTUAL error. Reporting every park as a 429 is what let an
+            # unauthorized account read as merely rate-limited for eleven days.
+            why = prev.get('last_error')
+            why = why if isinstance(why, str) and why else 'a failed fetch'
+            say(f'{aid}: backing off after {why} ({int(retry_at - now)}s left); limits left as-is')
             continue
 
+    # BEARER ORDER MATTERS, and it is not the obvious one. A setup token authenticates
+    # inference forever but is minted WITHOUT the user:profile scope this endpoint
+    # requires, so it can only ever produce a 403 here. Trying it before the OAuth
+    # refresh grant — which is what this did — killed telemetry for accounts whose
+    # refresh token was still perfectly good, purely because a server.token sat beside
+    # it. OAuth first, refresh second, token only as a genuine last resort.
     bearer = None
     source = None
     cpath = os.path.join(d, '.credentials.json')
+    tpath = os.path.join(d, 'server.token')
     if os.path.isfile(cpath):
         try:
             c = json.load(open(cpath)).get('claudeAiOauth', {})
@@ -1252,11 +1425,6 @@ for acct in manifest.get('accounts', []):
                 bearer, source = c['accessToken'], 'oauth'
         except Exception:
             pass
-    tpath = os.path.join(d, 'server.token')
-    if not bearer and os.path.isfile(tpath):
-        t = open(tpath).read().strip()
-        if t:
-            bearer, source = t, 'token'
     if not bearer and os.path.isfile(cpath):
         # Hard fail-open guard: NOTHING a single account's refresh does may abort
         # the loop — every account after it would silently starve of telemetry.
@@ -1267,6 +1435,25 @@ for acct in manifest.get('accounts', []):
             tok = None
         if tok:
             bearer, source = tok, 'oauth'
+    if not bearer and os.path.isfile(tpath):
+        # Once this endpoint has refused THIS token file for lacking a scope, asking
+        # again is guaranteed to fail and only spends the account's hourly budget —
+        # which is how a permanent authorization problem disguised itself as a rate
+        # limit. Keyed on the file's mtime, so re-minting the token retries it.
+        # Keyed on a non-secret digest of the token itself, not its mtime: `sync`
+        # pushes tokens with rsync -a (mtimes preserved) and two different tokens can
+        # land on the same whole second, either of which would skip a credential that
+        # was never actually refused.
+        denied_digest = prev.get('token_scope_denied')
+        tdigest = token_digest(tpath)
+        if not force and tdigest and denied_digest == tdigest:
+            say(f'{aid}: setup token cannot read usage (no user:profile scope) and there '
+                f'is no OAuth login here — telemetry stays dark until: '
+                f'claude-accounts login {aid}')
+            continue
+        t = open(tpath).read().strip()
+        if t:
+            bearer, source = t, 'token'
     if not bearer:
         # Fail OPEN: no usable bearer => leave existing state; never block work on telemetry.
         say(f'{aid}: no fresh bearer (expired oauth and/or no token); limits left as-is')
@@ -1282,6 +1469,24 @@ for acct in manifest.get('accounts', []):
         resp = urllib.request.urlopen(req, timeout=15)
         data = json.loads(resp.read().decode())
     except urllib.error.HTTPError as e:
+        body = ''
+        try:
+            body = e.read().decode('utf-8', 'replace')[:400]
+        except Exception:
+            pass
+
+        def park(wait, note):
+            """Record a failed fetch WITHOUT inventing freshness: fetched_at is left
+            exactly as it was, so a parked account still reads as stale everywhere."""
+            prev['retry_after'] = int(now + wait)
+            prev['backoff'] = wait
+            prev['last_error'] = note
+            prev['last_error_at'] = int(now)
+            tmp = lpath + '.tmp'
+            with open(tmp, 'w') as f:
+                json.dump(prev, f, indent=1)
+            os.replace(tmp, lpath)
+
         if e.code == 429:
             # Respect Retry-After; otherwise exponential backoff capped at 30 min.
             try:
@@ -1289,19 +1494,69 @@ for acct in manifest.get('accounts', []):
             except (TypeError, ValueError):
                 wait = 0
             if wait <= 0:
-                wait = min(1800, max(120, int(prev.get('backoff', 60)) * 2))
+                wait = min(1800, max(120, int(num('backoff', 60)) * 2))
+            park(wait, f'HTTP 429 (rate limited, source={source})')
+            say(f'{aid}: rate limited (429); backing off {wait}s; failing open')
+        else:
+            # EVERY non-2xx now backs off. Before this only a 429 did, so a permanent
+            # refusal was re-issued on every scheduled pass from every machine in the
+            # fleet — and those retries are what earned the 429s that made an
+            # unauthorized account look merely rate-limited. Telemetry then sat frozen
+            # while the shim ranked the whole pool NEUTRAL, i.e. picked at random.
+            denied = (str(e.headers.get('x-should-retry') or '').lower() == 'false'
+                      or 'scope requirement' in body)
+            # A setup token can NEVER grow the user:profile scope, so that refusal is
+            # permanent and parks for hours. Any other "do not retry" may well be a
+            # policy or endpoint issue someone fixes in minutes — park it for an hour,
+            # not six, so recovery does not wait on a human running --force.
+            scope_denied = denied and 'scope requirement' in body
+            if scope_denied:
+                wait = USAGE_DENIED_BACKOFF
+            elif denied:
+                wait = USAGE_DENIED_BACKOFF // 6
+            else:
+                wait = min(1800, max(USAGE_FAIL_BACKOFF,
+                                     int(num('backoff', USAGE_FAIL_BACKOFF // 2)) * 2))
+            if scope_denied and source == 'token':
+                # Remember WHICH token was refused, so this credential is never spent
+                # on this endpoint again — but a freshly minted one still gets a try.
+                tdigest = token_digest(tpath)
+                if tdigest:
+                    prev['token_scope_denied'] = tdigest
+            park(wait, f'HTTP {e.code} (source={source})'
+                       + (' — permanent, server said do not retry' if denied else ''))
+            if scope_denied and source == 'token':
+                # The exact shape of this outage: a setup token is minted WITHOUT the
+                # user:profile scope the usage endpoint requires, so an account whose
+                # OAuth grant lapsed keeps working for inference and goes permanently
+                # dark for telemetry. Only a sign-in ON THIS MACHINE restores it.
+                say(f'{aid}: usage endpoint refuses the setup token (HTTP {e.code} — a '
+                    f'setup token has no user:profile scope). Telemetry is DEAD for this '
+                    f'account until it has an OAuth login here: claude-accounts login {aid}. '
+                    f'Backing off {wait}s.')
+            elif denied:
+                say(f'{aid}: usage fetch refused for good (HTTP {e.code}, source={source}); '
+                    f'backing off {wait}s — re-login needed: claude-accounts login {aid}')
+            else:
+                say(f'{aid}: usage fetch failed (HTTP {e.code}); backing off {wait}s; failing open')
+        continue
+    except Exception as e:
+        # Network/parse trouble is transient by nature, but it still must not be retried
+        # every 5 minutes forever — that is how a fleet talks itself into a 429.
+        wait = min(1800, max(USAGE_FAIL_BACKOFF,
+                             int(num('backoff', USAGE_FAIL_BACKOFF // 2)) * 2))
+        try:
             prev['retry_after'] = int(now + wait)
             prev['backoff'] = wait
+            prev['last_error'] = str(e)[:200]
+            prev['last_error_at'] = int(now)
             tmp = lpath + '.tmp'
             with open(tmp, 'w') as f:
                 json.dump(prev, f, indent=1)
             os.replace(tmp, lpath)
-            say(f'{aid}: rate limited (429); backing off {wait}s; failing open')
-        else:
-            say(f'{aid}: usage fetch failed (HTTP {e.code}); failing open')
-        continue
-    except Exception as e:
-        say(f'{aid}: usage fetch failed ({e}); failing open')
+        except Exception:
+            pass
+        say(f'{aid}: usage fetch failed ({e}); backing off {wait}s; failing open')
         continue
 
     def pct_of(v):
@@ -1387,8 +1642,21 @@ for acct in manifest.get('accounts', []):
     session = [b['percent'] for b in buckets if b['group'] == 'session']
     weeklyp = max(weekly) if weekly else maxp
     sessionp = max(session) if session else 0
+    # How long weekly_percent keeps meaning something. A weekly bucket only ever RISES
+    # until its reset, so before that moment a stale percent is still a valid lower
+    # bound and the shim can rank on it when nothing fresher exists; after it, the
+    # number describes a week that is over and says nothing at all. Recording the
+    # horizon here keeps the shim from having to parse buckets[] on every invocation.
+    # It must come from the bucket weekly_percent actually CAME FROM: a low monthly
+    # bucket resetting in an hour says nothing about an 80% weekly one that resets in
+    # five days, and taking the minimum over all of them would throw the 80% away.
+    wresets = [int(b['resets_epoch']) for b in buckets
+               if b['group'] != 'session' and b['percent'] == weeklyp
+               and isinstance(b.get('resets_epoch'), int)]
     out = {'fetched_at': int(now), 'source': source, 'max_percent': maxp,
-           'weekly_percent': weeklyp, 'session_percent': sessionp, 'buckets': buckets}
+           'weekly_percent': weeklyp, 'session_percent': sessionp,
+           'weekly_resets_epoch': min(wresets) if wresets else 0,
+           'buckets': buckets}
     tmp = lpath + '.tmp'
     with open(tmp, 'w') as f:
         json.dump(out, f, indent=1)
@@ -1483,6 +1751,14 @@ def mark_expired(d, slug, detail=''):
     """Park an account the shim must stop selecting. Verify is the strongest signal
     there is — a real inference call that came back 'not authenticated'."""
     mpath = os.path.join(d, '.expired')
+    # Same rule as the limits path: an org block outranks every other reason and only
+    # a PASSING verify or a re-login may lift it. Rewriting its reason with a weaker
+    # one is how it gets lifted by accident later.
+    try:
+        if 'reason=org-blocked' in open(mpath, errors='replace').read():
+            return
+    except OSError:
+        pass
     try:
         with open(mpath + '.tmp', 'w') as f:
             f.write(f'{int(time.time())}\n')

package/install.sh

@@ -71,6 +71,27 @@ case "$ACC_ROOT$CODEX_ACC_ROOT" in
 "*) echo "pool root contains a character that cannot be scheduled safely: $ACC_ROOT / $CODEX_ACC_ROOT" >&2; exit 1 ;;
 esac
 
+# A pool root under a temp directory is by definition gone tomorrow, but the launchd
+# agent or crontab line naming it is not: it keeps firing forever against a path that
+# no longer exists, one leaked set per run. That is how a Mac collected 57 orphaned
+# agent sets and a server 4 stray cron blocks. EITHER root disqualifies the whole set,
+# because one install writes agents for both providers: the leaked sets above named a
+# temp CLAUDE root and the REAL codex pool, so they went right on polling a live usage
+# endpoint every five minutes. Install the binaries for such a root; never schedule it.
+ephemeral_root() { # $1 = a pool root
+  case "$1" in
+    /tmp/*|/private/tmp/*|/var/tmp/*|/private/var/tmp/*|/var/folders/*|/private/var/folders/*)
+      return 0 ;;
+    *) return 1 ;;
+  esac
+}
+if [ "$NO_SCHEDULE" != "1" ] && { ephemeral_root "$ACC_ROOT" || ephemeral_root "$CODEX_ACC_ROOT"; }; then
+  NO_SCHEDULE=1
+  echo "  note: a pool root is under a temp directory (claude: $ACC_ROOT, codex: $CODEX_ACC_ROOT)" >&2
+  echo "        — installing WITHOUT schedulers, which would outlive it." >&2
+  echo "        Pass --no-schedule to silence this." >&2
+fi
+
 LABEL="com.claude-multiacc${INSTANCE:+.$INSTANCE}"
 MARK_BEGIN="# >>> claude-multiacc >>>"
 MARK_END="# <<< claude-multiacc <<<"
@@ -150,7 +171,7 @@ mac_schedule_install() {
     <string>limits</string>
     <string>--quiet</string>
   </array>
-$(plist_env_block)  <key>StartInterval</key><integer>300</integer>
+$(plist_env_block)  <key>StartInterval</key><integer>900</integer>
   <key>RunAtLoad</key><true/>
   <key>StandardOutPath</key><string>/dev/null</string>
   <key>StandardErrorPath</key><string>/dev/null</string>
@@ -239,7 +260,7 @@ EOF
   launchctl load -w "$PLIST_CODEX_LIMITS" 2>/dev/null || true
   launchctl load -w "$PLIST_CODEX_HEALTH" 2>/dev/null || true
   [ "${CLAUDE_MULTIACC_AUTOUPDATE:-1}" = "1" ] && launchctl load -w "$PLIST_UPDATE" 2>/dev/null || true
-  echo "  launchd: limits refresh every 5m (claude + codex) + weekly health checks + daily auto-update"
+  echo "  launchd: limits refresh (claude 15m / codex 5m) + weekly health checks + daily auto-update"
 }
 
 mac_schedule_remove() {
@@ -262,7 +283,7 @@ linux_schedule_install() {
   env="$(cron_env_prefix)"
   { crontab -l 2>/dev/null | cron_strip_ours; } > "$tmp"
   {
-    echo "*/5 * * * * $env$REPO_DIR/bin/claude-accounts limits --quiet >/dev/null 2>&1 $CRON_TAG"
+    echo "*/15 * * * * $env$REPO_DIR/bin/claude-accounts limits --quiet >/dev/null 2>&1 $CRON_TAG"
     echo "*/5 * * * * $env$REPO_DIR/bin/codex-accounts limits --quiet >/dev/null 2>&1 $CRON_TAG"
     echo "17 9 * * 1 $env$REPO_DIR/bin/claude-accounts health >/dev/null 2>&1 $CRON_TAG"
     echo "37 9 * * 1 $env$REPO_DIR/bin/codex-accounts health >/dev/null 2>&1 $CRON_TAG"
@@ -271,7 +292,7 @@ linux_schedule_install() {
   } >> "$tmp"
   crontab "$tmp"
   rm -f "$tmp"
-  echo "  cron: limits refresh every 5m (claude + codex) + weekly health checks + daily auto-update"
+  echo "  cron: limits refresh (claude 15m / codex 5m) + weekly health checks + daily auto-update"
 }
 
 linux_schedule_remove() {