claude-multiacc 1.0.15 → 1.0.16

package/bin/claude

@@ -475,6 +475,48 @@ client_limit_scan() { # $1 acct dir
   return 1
 }
 
+# A TUI auth failure cannot use the -p retry path because the client owns the terminal.
+# Harvest the same account-owned transcripts used for quota detection so the next launch
+# parks a rejected setup-token instead of selecting it again.
+client_auth_scan() { # $1 acct dir
+  local idx="$1/.sessions-index" ln id claim p line ts ck ak read_n=0 i
+  local ids=() claims=()
+  [ -f "$idx" ] || return 1
+  while IFS= read -r ln; do
+    id="${ln%% *}"; claim=""
+    case "$ln" in *' '*) claim="${ln#* }" ;; esac
+    sess_id_ok "$id" && { ids+=("$id"); claims+=("$claim"); }
+  done < "$idx"
+  i=$(( ${#ids[@]} - 1 ))
+  while [ "$i" -ge 0 ] && [ "$read_n" -lt "$QUOTA_SCAN_MAX_FILES" ]; do
+    id="${ids[$i]}"; claim="${claims[$i]}"; i=$((i - 1)); read_n=$((read_n + 1))
+    sess_transcript "$1" "$id" || continue
+    p="$SESS_TRANSCRIPT"
+    [ $((now - $(file_mtime "$p"))) -le "$QUOTA_SCAN_MAX_AGE" ] || continue
+    line="$(tail -c "$QUOTA_SCAN_BYTES" "$p" 2>/dev/null \
+      | LC_ALL=C grep -a '"error"[[:space:]]*:[[:space:]]*"authentication_failed"' | tail -1)"
+    [ -n "$line" ] || continue
+    [ -n "$claim" ] || continue
+    ts="$(printf '%s' "$line" | LC_ALL=C sed -n 's/.*"timestamp"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')"
+    ck="$(iso_key "$ts")"; ak="$(iso_key "$claim")"
+    num_ok "$ck" || continue; num_ok "$ak" || continue
+    [ "$ck" -lt "$ak" ] && continue
+    claim_conflicted "$1" "$id" "$claim" && continue
+    return 0
+  done
+  return 1
+}
+
+mark_client_auth_dead() { # $1 acct dir
+  local soft=$((now + 3600)) marked
+  marked="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  { echo "$now"; echo "reason=auth-error soft_until=$soft marked_at=$marked" \
+      "detail=client session failed to authenticate"; } \
+    2>/dev/null > "$1/.expired.$$" && mv -f "$1/.expired.$$" "$1/.expired" 2>/dev/null \
+    || rm -f "$1/.expired.$$" 2>/dev/null || true
+  sel_log "$(basename "$1") parked (auth-error until $soft) — client-reported"
+}
+
 mark_client_limit() { # $1 acct dir, $2 reset epoch, $3 rate limit type
   local m="$1/.limited" cur=""
   # Never shorten a marker that already reaches further out (a weekly park must
@@ -507,11 +549,11 @@ sel_capture_session() { # $1 acct dir
     # stops the moment the run it is watching is gone.
     trap '' INT HUP TERM QUIT
     i=0
-    while [ "$i" -lt 30 ]; do
+    while [ "$i" -lt 600 ]; do
       kill -0 "$pid" 2>/dev/null || break
       sess_index_refresh "$d"
       [ -f "$d/sessions/$pid.json" ] && break
-      sleep 2
+      sleep 0.1
       i=$((i + 1))
     done
     sess_index_refresh "$d"
@@ -638,6 +680,12 @@ for d in "$ACC_ROOT"/acct-*; do
   fi
   valid+=("$d")
   sess_index_refresh "$d"
+  if client_auth_scan "$d"; then
+    mark_client_auth_dead "$d"
+    valid=("${valid[@]:0:${#valid[@]}-1}")
+    expired+=("$d")
+    continue
+  fi
   marker_active "$d" && continue
   # The account's own records are consulted BEFORE telemetry: what the server told a real
   # call is first-hand and carries the real reset, while limits.json can be days stale —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "1.0.15",
+  "version": "1.0.16",
   "description": "Multi-account addon for Claude Code and OpenAI Codex CLI: every claude / claude -p and every codex / codex exec runs under a randomly-picked subscription account with the most usage headroom. Mirrors to a deploy server. No API keys.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -383,6 +383,24 @@ grep -q "all-expired: falling back" "$ACC/selection.log" \
 printf '%s' "$HEALTHY_CREDS" > "$ACC/acct-01/.credentials.json"
 printf '%s' "$HEALTHY_CREDS" > "$ACC/acct-02/.credentials.json"
 
+# A short interactive TUI can report auth failure and exit before the -p retry path can
+# inspect stderr. Its account-owned transcript must park that setup-token on the next run.
+auth_sid="aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
+mkdir -p "$ACC/acct-01/projects/auth-regression"
+printf '%s %s\n' "$auth_sid" '2020-01-01T00:00:00Z' > "$ACC/acct-01/.sessions-index"
+auth_line='{"timestamp":"2026-08-22T20:27:29.985Z","error":"authentication_failed",'
+auth_line="$auth_line\"session_id\":\"$auth_sid\"}"
+printf '%s\n' "$auth_line" \
+  > "$ACC/acct-01/projects/auth-regression/$auth_sid.jsonl"
+out="$(claude 2>&1)"
+check "TUI transcript auth failure excludes rejected account" "CFG=acct-02" "$out"
+grep -q 'reason=auth-error' "$ACC/acct-01/.expired" 2>/dev/null \
+  && t_ok "TUI transcript auth failure writes .expired" \
+  || t_fail "TUI transcript auth marker" "no auth-error marker"
+rm -f "$ACC/acct-01/.expired" "$ACC/acct-01/.sessions-index" \
+  "$ACC/acct-01/projects/auth-regression/$auth_sid.jsonl"
+rmdir "$ACC/acct-01/projects/auth-regression" 2>/dev/null || true
+
 # ---- 9d. the .expired marker: excludes, and self-heals on a newer credential ----
 printf '%s\nreason=auth-error marked_at=now detail=test\n' "$now" > "$ACC/acct-01/.expired"
 touch -t 202001010101 "$ACC/acct-01/.credentials.json"   # credential OLDER than the marker