claude-multiacc 1.0.16 → 1.0.18

package/README.md

@@ -435,6 +435,26 @@ Use `--token` when you specifically want one account usable on the server via th
 sync (the ~1-year inference-only token that mirrors over). For everyday adds, the default
 full login is smoother. `status` warns when a token nears end of life; re-run `login`.
 
+### A setup token has no identity — name the account yourself
+
+A setup token is minted with scope `user:inference` **alone**, so `claude auth status`
+answers `{loggedIn, authMethod, apiProvider}` and no email — only an OAuth login reports
+`email`/`orgId`/`subscriptionType`. Nothing on this side can therefore learn which account
+approved a `setup-token` grant, and no future check will change that.
+
+What follows, and what the CLI does about it:
+
+- **`add <email> --token` requires the email** — there is nothing to read the account back
+  from. It registers under the name you gave and says so; naming no email is refused
+  outright rather than registering an anonymous slot.
+- **`mint <acct-NN>` names the account in its prompt** (`approve in a browser signed in as
+  …`) and warns afterwards that the identity is unverifiable. Approving in a window signed
+  into a *different* account silently binds that account's subscription to the slot —
+  every machine then runs it under the wrong name. Sign in to the right account **first**,
+  in a fresh private window, then paste the link.
+- `login <acct-NN> --token` compares against the manifest when an identity is readable
+  (it is not, today) and otherwise says what it is trusting.
+
 Both accounts currently in the pool are live and verified: acct-01 (support@gowalkae.com,
 Mac) and acct-02 (hasan@gowalkqa.com, server) — each adopted from its machine's existing
 login, so each runs on the machine that holds its credential.

package/bin/claude

@@ -999,25 +999,70 @@ fi
 # the pool on its own — the shim's guess must never outlive the evidence for it.
 PARK_AUTH='failed to authenticate|oauth (session|token)[a-z ]{0,20}(expired|invalid|revoked)|could not be refreshed|invalid api key|authentication_error|invalid bearer token|please run /login|run /login to'
 PARK_ORG='organization has disabled|subscription access[a-z ]{0,20}disabl|disabled claude subscription|ask your admin to enable|not authorized to use claude code'
-LIMITPAT='rate[ _-]?limit|usage limit|limit (reached|exceeded)|overloaded|"?529"?|credit balance'
+# A usage limit can be scoped to ONE MODEL: "You've reached your Fable 5 limit.
+# Switch to another model, or manage usage credits..." — the account still has
+# capacity for every other model, and the endpoint says so in the message itself.
+#
+# This phrasing matched NOTHING below: "reached your <model> limit" is not "limit
+# reached", and "usage credits" is not "credit balance". So on 2026-08-24, when
+# every account crossed that scoped bucket inside one hour, the shim did not even
+# enter its retry branch — every task died in under a second having done no work,
+# and the pool looked healthy the whole time.
+MODEL_LIMITPAT="reached your [^.]{0,40} limit|switch to another model"
+LIMITPAT='rate[ _-]?limit|usage limit|limit (reached|exceeded)|overloaded|"?529"?|credit balance'"|$MODEL_LIMITPAT"
 ERRPAT="$LIMITPAT|$PARK_AUTH|$PARK_ORG"'|401|403|unauthorized|authentication[_ ]error|invalid[_ ](bearer|token|api key)|token (expired|revoked|invalid)|oauth.*(error|expired|invalid)'
+# Deliberately a full id, not an alias: the whole point of pinning --model is that
+# an unpinned run inherits whatever the operator was last using.
+FALLBACK_MODEL="${CLAUDE_MULTIACC_FALLBACK_MODEL:-claude-opus-5}"
+
+# Read the --model the caller pinned (both spellings). Empty = unpinned.
+argv_model() {
+  local i=0 n="${#ARGV[@]}"
+  while [ "$i" -lt "$n" ]; do
+    case "${ARGV[$i]}" in
+      --model) i=$((i+1)); [ "$i" -lt "$n" ] && printf '%s\n' "${ARGV[$i]}"; return 0 ;;
+      --model=*) printf '%s\n' "${ARGV[$i]#--model=}"; return 0 ;;
+    esac
+    i=$((i+1))
+  done
+  return 0
+}
+
+# Rewrite ARGV onto a different model, preserving the caller's spelling. An
+# unpinned run gets the flag appended rather than left to inherit.
+argv_set_model() { # $1 = model id
+  local i=0 n="${#ARGV[@]}" found=0
+  ARGV_FB=()
+  while [ "$i" -lt "$n" ]; do
+    case "${ARGV[$i]}" in
+      --model)   ARGV_FB+=("--model" "$1");   i=$((i+2)); found=1; continue ;;
+      --model=*) ARGV_FB+=("--model=$1");     i=$((i+1)); found=1; continue ;;
+    esac
+    ARGV_FB+=("${ARGV[$i]}"); i=$((i+1))
+  done
+  [ "$found" = 0 ] && ARGV_FB+=("--model" "$1")
+}
+
 PARK_SOFT_AUTH=3600      # 1h: a mis-parked healthy account is back within the hour
 PARK_SOFT_ORG=21600      # 6h: an org policy will not change in minutes
 
 attempt=1
 cur="$pick"
 rc=0
+rotated=0          # at most one account rotation, exactly as before
+model_fb_used=0    # ...and at most one model fallback after it
+ARGV=("$@")
 while :; do
   tok="$(acct_token "$cur")"
   if [ -n "$stdin_file" ]; then exec 3< "$stdin_file"; else exec 3< /dev/null; fi
   if [ -n "$tok" ]; then
-    CLAUDE_CONFIG_DIR="$cur" CLAUDE_CODE_OAUTH_TOKEN="$tok" "$REAL" "$@" <&3 > "$tmpd/out" 2> "$tmpd/err"
+    CLAUDE_CONFIG_DIR="$cur" CLAUDE_CODE_OAUTH_TOKEN="$tok" "$REAL" "${ARGV[@]}" <&3 > "$tmpd/out" 2> "$tmpd/err"
   else
-    CLAUDE_CONFIG_DIR="$cur" "$REAL" "$@" <&3 > "$tmpd/out" 2> "$tmpd/err"
+    CLAUDE_CONFIG_DIR="$cur" "$REAL" "${ARGV[@]}" <&3 > "$tmpd/out" 2> "$tmpd/err"
   fi
   rc=$?
   exec 3<&-
-  if [ "$rc" -ne 0 ] && [ "$attempt" -eq 1 ] \
+  if [ "$rc" -ne 0 ] && { [ "$rotated" = 0 ] || [ "$model_fb_used" = 0 ]; } \
     && grep -qiE "$ERRPAT" "$tmpd/out" "$tmpd/err" 2>/dev/null; then
     # Atomic marker writes: a reader must never observe a half-written marker
     # (it would parse as garbage and, before, could be deleted as "expired").
@@ -1036,6 +1081,11 @@ while :; do
       park_detail="run failed to authenticate"
       park_soft=$((now + PARK_SOFT_AUTH))
     fi
+    # An account that ran out of ONE model has not run out. Cooling it down would
+    # take a perfectly usable account out of the pool for every other model too —
+    # and if the whole pool shares the bucket, cool the ENTIRE pool down at once.
+    model_scoped=0
+    grep -qiE "$MODEL_LIMITPAT" "$tmpd/out" "$tmpd/err" 2>/dev/null && model_scoped=1
     if [ -n "$park_reason" ]; then
       {
         echo "$now"
@@ -1044,7 +1094,7 @@ while :; do
         && mv -f "$cur/.expired.$$" "$cur/.expired" 2>/dev/null \
         || rm -f "$cur/.expired.$$" 2>/dev/null || true
       sel_log "$(basename "$cur") parked ($park_reason until $park_soft) — see: claude-accounts expired"
-    else
+    elif [ "$model_scoped" = 0 ]; then
       {
         echo $((now + 600))
         echo "bucket=error-cooldown percent=? marked_at=$(date -u +%Y-%m-%dT%H:%M:%SZ) reason=error-cooldown"
@@ -1061,15 +1111,32 @@ while :; do
       if [ "$c" != "$cur" ]; then next="$c"; break; fi
       i=$((i+1))
     done
-    if [ -n "$next" ]; then
+    if [ -n "$next" ] && [ "$rotated" = 0 ]; then
       sel_log "retry from=$(basename "$cur") to=$(basename "$next") rc=$rc"
       cur="$next"
       # The account that actually serves the work is the one the next run should rotate
       # away from — not the one that bounced.
       remember_pick "$cur"
+      rotated=1
       attempt=2
       continue
     fi
+    # Another ACCOUNT could not help. If what ran out was one MODEL, the pool still
+    # has capacity — switch to it rather than failing a task that has done no work.
+    # Last resort by design: a healthy account must still serve the model the caller
+    # pinned, so this only fires once rotation has already been tried and refused.
+    if [ "$model_fb_used" = 0 ] \
+      && grep -qiE "$MODEL_LIMITPAT" "$tmpd/out" "$tmpd/err" 2>/dev/null; then
+      cm="$(argv_model)"
+      if [ "$cm" != "$FALLBACK_MODEL" ]; then
+        argv_set_model "$FALLBACK_MODEL"
+        ARGV=("${ARGV_FB[@]}")
+        model_fb_used=1
+        attempt=2
+        sel_log "model fallback ${cm:-<unpinned>} -> $FALLBACK_MODEL on $(basename "$cur") (scoped limit)"
+        continue
+      fi
+    fi
   fi
   break
 done

package/bin/claude-accounts

@@ -461,6 +461,13 @@ cmd_add() {
       return 0
     fi
   fi
+  # A setup token reports no identity, so an unnamed --token add can never attribute the
+  # account. Refuse BEFORE the ceremony: running it first would mint a real 1-year grant
+  # on the account's behalf and then throw the token away, leaving a live credential
+  # issued for nothing.
+  if [ "$token" = "1" ] && [ -z "$email" ]; then
+    die "a setup token carries no identity, so the account cannot be read back — name it: claude-accounts add <email> --token"
+  fi
   if [ ! -t 0 ] && [ -z "${CLAUDE_MULTIACC_FORCE_TTY:-}" ]; then
     die "add is interactive (it completes sign-in before registering) — run it from a terminal"
   fi
@@ -498,7 +505,14 @@ cmd_add() {
     got="$(config_dir_email "$d")"
   fi
   if [ -z "$got" ]; then
-    if [ -n "$email" ] && [ "$force" = "1" ]; then
+    if [ "$token" = "1" ] && [ -n "$email" ]; then
+      # A setup token NEVER reports an identity (see token_email) — that is the grant's
+      # design, not a read that failed, so demanding --force here demanded a ceremony
+      # nobody can perform: it made the documented `add <email> --token` path die every
+      # single time. The named email is all there is; say so plainly and register it.
+      warn "a setup token carries no identity — registering as $email, the account you were asked to approve as"
+      got="$email"
+    elif [ -n "$email" ] && [ "$force" = "1" ]; then
       warn "identity unverified — registering as $email because --force was given"
       got="$email"
     else
@@ -523,10 +537,18 @@ cmd_add() {
   mutate_unlock
   RESERVED_DIR=""            # committed — the trap must not delete it now
   trap - EXIT INT TERM
-  log_to ops.log "add $id $got (auth-verified)"
+  # Only the full-login path actually READ the identity back. Saying "verified" for a
+  # setup token would relaunder the very assumption this flow just warned about.
+  local verdict="sign-in verified"
+  if [ "$token" = "1" ]; then
+    verdict="identity unverifiable — trusted as the name you gave"
+    log_to ops.log "add $id $got (token; identity unverifiable)"
+  else
+    log_to ops.log "add $id $got (auth-verified)"
+  fi
   auto_sync
   cat <<EOF
-Registered $id for $got (sign-in verified) — usable immediately.
+Registered $id for $got ($verdict) — usable immediately.
 Optional:
   claude-accounts verify       # confirm the 100% matrix
 EOF
@@ -783,7 +805,23 @@ TIP
   }
 }
 
-token_email() { # $1 = token; prints the authenticated email (best effort)
+account_email() { # $1 = acct id; prints the email the manifest holds for it
+  "$PYBIN" - "$MANIFEST" "$1" <<'PYEOF'
+import json, sys
+for a in json.load(open(sys.argv[1])).get('accounts', []):
+    if a['id'] == sys.argv[2]:
+        print(a.get('email', ''))
+        break
+PYEOF
+}
+
+token_email() { # $1 = token; prints the authenticated email — EMPTY for a setup token
+  # A setup token is minted with scope user:inference ALONE, so `claude auth status`
+  # answers {loggedIn, authMethod, apiProvider} and nothing else; an OAuth login also
+  # answers email/orgId/subscriptionType. There is therefore no way to learn which
+  # account approved a setup-token grant. Callers must read "" as "unknowable by
+  # design" — never as a transient failure worth retrying — and guard the ceremony by
+  # NAMING the expected account up front instead.
   local real
   real="$(find_real_claude "$_self")" || { echo ""; return 0; }
   CLAUDE_CODE_OAUTH_TOKEN="$1" CLAUDE_SHIM_ACTIVE=1 "$real" auth status 2>/dev/null | "$PYBIN" -c '
@@ -838,30 +876,55 @@ TIP
 }
 
 cmd_mint() {
+  # The minted token is the ONLY credential that reaches the server and every peer, so a
+  # mint under the wrong browser session hands this slot another account's subscription —
+  # and nothing downstream can notice (a setup token reports no identity, see
+  # token_email). Naming the expected account before the ceremony opens is the only guard
+  # that exists; the old prompt said "THIS account" and named nobody.
   require_manifest
-  local id="${1:-}" paste="${2:-}"
+  local id="" paste=0
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --paste) paste=1; shift ;;
+      --*) die "unknown option: $1" ;;
+      *) if [ -z "$id" ]; then id="$1"; shift
+         else die "unexpected argument: $1 (usage: claude-accounts mint <acct-NN> [--paste])"; fi ;;
+    esac
+  done
   [ -n "$id" ] || die "usage: claude-accounts mint <acct-NN> [--paste]"
   valid_acct_id "$id" || die "not a valid account id: $id"
+  # A bare directory is NOT enough: removed accounts and killed `add` runs leave acct-NN
+  # dirs behind (this Mac carries nine), and minting into one binds a live token to a slot
+  # the manifest cannot name — which is exactly the unattributable state this guards.
+  account_ids | grep -qx "$id" \
+    || die "unknown account: $id — mint binds a token to a REGISTERED account ('claude-accounts list' shows them)"
   local d="$ACC_ROOT/$id"
-  [ -d "$d" ] || die "unknown account dir: $d"
-  local tok=""
-  if [ "$paste" = "--paste" ]; then
-    printf 'Paste the sk-ant-oat... token: '
+  seed_account_dir "$d"
+  local email tok="" got
+  email="$(account_email "$id")"
+  [ -n "$email" ] || die "$id has no email in the manifest — refusing to mint a token nobody could attribute"
+  if [ "$paste" = "1" ]; then
+    printf 'Paste the sk-ant-oat... token for %s (%s): ' "$id" "${email:-unknown email}"
     read -r tok
     tok="$(printf '%s' "$tok" | tr -d '[:space:]')"
   else
-    echo "Running 'claude setup-token' for $id — approve in a browser signed into THIS account."
+    echo "Running 'claude setup-token' for $id — approve in a browser signed in as ${email:-THIS account}."
     run_token_ceremony "$d" || die "no token captured — mint failed"
     tok="$CEREMONY_TOKEN"
   fi
   [ -n "$tok" ] || die "no token captured — mint failed"
   valid_subscription_token "$tok" \
     || die "that is not a subscription setup-token (sk-ant-oat...). API keys are not supported."
+  got="$(token_email "$tok")"
+  if [ -n "$got" ] && [ -n "$email" ] && [ "$got" != "$email" ]; then
+    die "that token authenticates as $got but $id is $email — nothing saved"
+  fi
   ( umask 077; printf '%s' "$tok" > "$d/server.token" )
   chmod 600 "$d/server.token"
   clear_auth_markers "$d"
   log_to ops.log "mint $id"
   echo "Token saved to $d/server.token"
+  [ -n "$got" ] || warn "a setup token carries no identity — $id now runs whichever account approved that grant${email:+, trusted to be $email}"
   auto_sync
 }
 
@@ -884,14 +947,7 @@ cmd_login() {
   account_ids | grep -qx "$id" || die "unknown account: $id"
   local d="$ACC_ROOT/$id" email got
   seed_account_dir "$d"
-  email="$("$PYBIN" - "$MANIFEST" "$id" <<'PYEOF'
-import json, sys
-for a in json.load(open(sys.argv[1])).get('accounts', []):
-    if a['id'] == sys.argv[2]:
-        print(a.get('email', ''))
-        break
-PYEOF
-)"
+  email="$(account_email "$id")"
   echo "Sign in as $email for $id."
   if [ "$token" = "1" ]; then
     run_token_ceremony "$d" || die "sign-in failed or aborted — nothing changed"
@@ -902,6 +958,7 @@ PYEOF
     ( umask 077; printf '%s' "$CEREMONY_TOKEN" > "$d/server.token" )
     chmod 600 "$d/server.token"
     clear_auth_markers "$d"
+    [ -n "$got" ] || warn "a setup token carries no identity — $id is trusted to hold $email because that is who you approved as"
     echo "$id token saved (portable — works on Mac and server)."
   else
     run_login_ceremony "$d" "$email" \
@@ -1054,6 +1111,85 @@ cmd_relogin() {
   [ -z "$failed" ]
 }
 
+# Hand freshly fetched telemetry to every machine that cannot fetch its own.
+#
+# Only ONE machine in a pool can read the usage endpoint: it needs an OAuth grant
+# carrying the user:profile scope, and a setup token is minted WITHOUT it. Every
+# other machine fetches, is refused, and therefore knows nothing about which
+# accounts are drained. gas-mini ranked its whole pool BLIND for 5.7 hours and
+# handed two tasks to an account sitting at 100% — its newest telemetry had arrived
+# at 16:38 on a mutation-triggered sync, and nothing refreshed it afterwards.
+#
+# So distribution rides the REFRESH rather than the mutation: whoever can fetch
+# hands the answer to everyone who cannot, every pass. One rsync per target carries
+# every account (a few KB). Strictly best effort with hard timeouts and BatchMode —
+# a peer that is asleep, rebooting or off the tailnet must never fail a refresh, and
+# must never hang the 15-minute job long enough to collide with the next one.
+# The push is DETACHED. A refresh that waits on ssh is a refresh that blocks the
+# 15-minute job for as long as a sleeping peer takes to time out, and telemetry
+# that arrives late is the whole problem we are fixing — delaying the NEXT fetch to
+# deliver this one trades the fault for itself. It also made four time-window tests
+# fail, which is the same defect wearing a smaller hat: seconds spent here move
+# every deadline downstream.
+#
+# One at a time: the lock means a slow or unreachable target can never stack pushes
+# up faster than they drain.
+limits_distribute() {
+  sync_is_replica && return 0
+  command -v rsync >/dev/null 2>&1 || return 0
+  [ "${CLAUDE_MULTIACC_NO_DISTRIBUTE:-0}" = "1" ] && return 0
+  ( limits_distribute_now >/dev/null 2>&1 & ) >/dev/null 2>&1
+  return 0
+}
+
+limits_distribute_now() {
+  local lock="$ACC_ROOT/tmp/limits-push.lock"
+  mkdir -p "$ACC_ROOT/tmp" 2>/dev/null || return 0
+  mkdir "$lock" 2>/dev/null || return 0
+  trap 'rmdir "$lock" 2>/dev/null || true' EXIT
+  local server sroot list id d
+  list="$ACC_ROOT/tmp/limits-push.$$"
+  mkdir -p "$ACC_ROOT/tmp" 2>/dev/null || return 0
+  : > "$list" 2>/dev/null || return 0
+  for id in $(account_ids); do
+    d="$ACC_ROOT/$id"
+    [ -f "$d/limits.json" ] && printf '%s/limits.json\n' "$id" >> "$list"
+    # A marker is pushed but never un-pushed: the shim expires a cleanly-reset
+    # .limited on its own, so a stale one costs an account some eligibility and
+    # never grants any. Erring toward exclusion is the safe direction here.
+    [ -f "$d/.limited" ] && printf '%s/.limited\n' "$id" >> "$list"
+  done
+  if [ ! -s "$list" ]; then rm -f "$list"; return 0; fi
+
+  server="$(sync_target)"
+  sroot="$(sync_target_root)"
+  if [ -n "$server" ] && ! sync_target_is_local "$server" \
+     && valid_ssh_target "$server" && valid_remote_path "$sroot"; then
+    limits_push_to "$server" "$sroot" "$list"
+  fi
+  # Peers are the OTHER Macs — the ones actually running tasks, and so the ones
+  # whose selection goes blind without this.
+  manifest_peers | while IFS="$(printf '\t')" read -r pt pr pp; do
+    [ "$pt" = "MALFORMED" ] && continue
+    [ -n "$pt" ] && [ -n "$pr" ] || continue
+    valid_ssh_target "$pt" || continue
+    valid_remote_path "$pr" || continue
+    limits_push_to "$pt" "$pr" "$list"
+  done
+  rm -f "$list"
+  rmdir "$lock" 2>/dev/null || true
+  trap - EXIT
+  return 0
+}
+
+limits_push_to() { # $1 target, $2 remote root, $3 file list
+  rsync -az --timeout=20 \
+    -e 'ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new' \
+    --files-from="$3" "$ACC_ROOT/" "$1:$2/" >>"$ACC_ROOT/sync.log" 2>&1 \
+    || log_to sync.log "limits push to $1 failed (telemetry there will age)"
+  return 0
+}
+
 cmd_limits() {
   require_manifest
   local quiet=0 force=0 json=0
@@ -1709,6 +1845,9 @@ PYEOF
   # lock while a consumer reads its output.
   limits_lock_release
   trap - EXIT
+  # Whoever just refreshed is the only machine that CAN — pass it on before the
+  # report, so a blind peer stops picking drained accounts within one cycle.
+  limits_distribute
   # The refresher fails open per account; a NON-zero status means the pass itself
   # broke (unreadable manifest, dead python). Report the state anyway — stale data
   # beats silence — but hand the caller the failure, exactly as before --json existed.
@@ -2126,6 +2265,20 @@ cmd_health() {
   return $rc
 }
 
+# Every KNOWN subcommand answers `--help`/`-h` with the usage text and exit 0. This is not
+# a nicety: app-robot's runner probes for a verb with `<verb> --help` and reads a non-zero
+# exit as "this build predates the verb", which silently parked panel-to-Mac credential
+# distribution for as long as the arg loops rejected the flag. An UNKNOWN verb must still
+# FAIL, or the probe stops meaning what it says — so this list must hold exactly the verbs
+# the dispatcher below implements, and a test pins that both ways.
+_KNOWN_VERBS="list status add import export-credential export-cred import-credential import-cred adopt dedupe remove mint login expired relogin re-login sync verify limits post-sync health self-update"
+case " $_KNOWN_VERBS " in
+  *" ${1:-help} "*)
+    for _arg in "$@"; do
+      case "$_arg" in --help|-h) usage; exit 0 ;; esac
+    done ;;
+esac
+
 case "${1:-help}" in
   list) shift; cmd_list "$@" ;;
   status) shift; cmd_status "$@" ;;

package/bin/codex-accounts

@@ -1935,6 +1935,20 @@ PYEOF
   echo "codex account pool: $ACC_ROOT (manifest ready)"
 }
 
+# Every KNOWN subcommand answers `--help`/`-h` with the usage text and exit 0. This is not
+# a nicety: app-robot's runner probes for a verb with `<verb> --help` and reads a non-zero
+# exit as "this build predates the verb", which silently parked panel-to-Mac credential
+# distribution for as long as the arg loops rejected the flag. An UNKNOWN verb must still
+# FAIL, or the probe stops meaning what it says — so this list must hold exactly the verbs
+# the dispatcher below implements, and a test pins that both ways.
+_KNOWN_VERBS="list status add import export-credential export-cred import-credential import-cred adopt dedupe remove login expired relogin re-login sync verify limits post-sync health self-update init-pool"
+case " $_KNOWN_VERBS " in
+  *" ${1:-help} "*)
+    for _arg in "$@"; do
+      case "$_arg" in --help|-h) usage; exit 0 ;; esac
+    done ;;
+esac
+
 case "${1:-help}" in
   list) shift; cmd_list "$@" ;;
   status) shift; cmd_status "$@" ;;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "1.0.16",
+  "version": "1.0.18",
   "description": "Multi-account addon for Claude Code and OpenAI Codex CLI: every claude / claude -p and every codex / codex exec runs under a randomly-picked subscription account with the most usage headroom. Mirrors to a deploy server. No API keys.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -43,6 +43,14 @@ cat > "$FAKEBIN/claude" <<'EOF'
 # fake real claude for tests (not a multiacc shim)
 if [ "${1:-}" = "auth" ] && [ "${2:-}" = "status" ]; then
   if [ -n "${FAKE_AUTH_FAIL:-}" ]; then echo '{"loggedIn": false}'; exit 0; fi
+  # A setup token is minted with scope user:inference ALONE, so the real CLI answers
+  # {loggedIn, authMethod, apiProvider} and NO email — only an OAuth login (config dir)
+  # reports one. The fake used to hand an email to both, which is precisely why every
+  # --token identity path passed here and died in the field.
+  if [ -n "${CLAUDE_CODE_OAUTH_TOKEN:-}" ] && [ -z "${CLAUDE_CONFIG_DIR:-}" ]; then
+    echo '{"loggedIn": true, "authMethod": "oauth_token", "apiProvider": "firstParty"}'
+    exit 0
+  fi
   printf '{"loggedIn": true, "email": "%s"}\n' "${FAKE_EMAIL:-fake@test}"
   exit 0
 fi
@@ -80,6 +88,15 @@ if [ -f "$ctl" ] && grep -qx "orgfail:$acct" "$ctl" 2>/dev/null; then
   echo "Your organization has disabled Claude subscription access for Claude Code · Use an Anthropic API key instead, or ask your admin to enable access"
   exit 1
 fi
+# A limit scoped to ONE MODEL, on EVERY account: rotating cannot help, only
+# switching model can. Satisfied the moment the run carries the fallback model.
+if [ -f "$ctl" ] && grep -qx "modellimit" "$ctl" 2>/dev/null; then
+  case " $* " in
+    *" claude-opus-5 "*|*"--model=claude-opus-5"*) : ;;
+    *) echo "You've reached your Fable 5 limit. Switch to another model, or manage usage credits at claude.ai/settings/usage to continue." >&2
+       exit 1 ;;
+  esac
+fi
 for a in "$@"; do
   case "$a" in
     --exit7) echo "ordinary failure, not auth related" >&2; exit 7 ;;
@@ -102,7 +119,7 @@ if [ -n "${FAKE_SESSION_ID:-}" ] && [ -n "${CLAUDE_CONFIG_DIR:-}" ]; then
   sleep "${FAKE_SESSION_HOLD:-4}"
   rm -f "$CLAUDE_CONFIG_DIR/sessions/$$.json"
 fi
-echo "CFG=$acct TOK=${CLAUDE_CODE_OAUTH_TOKEN:-none}"
+echo "CFG=$acct TOK=${CLAUDE_CODE_OAUTH_TOKEN:-none} ARGS=$*"
 EOF
 chmod +x "$FAKEBIN/claude"
 
@@ -554,6 +571,36 @@ done
 [ -f "$ACC/acct-01/.limited" ] && t_ok "failed account got error-cooldown marker" || t_fail "cooldown marker" "missing"
 rm -f "$FAKE_CTL" "$ACC/acct-01/.limited"
 
+# ---- 12a. every account out of ONE model: switch model, do not fail ----------
+# 2026-08-24: all four accounts crossed the Fable weekly bucket inside an hour and
+# every task died in under a second having done no work. Rotating accounts cannot
+# fix a limit scoped to a model — the endpoint says so itself ("Switch to another
+# model"). The pool still had capacity for every other model.
+rm -f "$ACC"/acct-*/.limited
+echo "modellimit" > "$FAKE_CTL"
+out="$(claude -p --model claude-fable-5 hello < /dev/null 2>/dev/null)"
+rc=$?
+case "$out" in
+  *"ARGS="*"claude-opus-5"*) t_ok "a model-scoped limit falls back to another model" ;;
+  *) t_fail "model fallback" "rc=$rc out=$out" ;;
+esac
+[ "$rc" = "0" ] && t_ok "...and the task succeeds instead of failing" \
+  || t_fail "model fallback rc" "rc=$rc"
+grep -q "model fallback" "$ACC/selection.log" 2>/dev/null \
+  && t_ok "the model switch is recorded in the selection log" \
+  || t_fail "model fallback log" "nothing logged"
+
+# The pinned model is the caller's choice and must survive a recoverable failure:
+# fall back only once ROTATION has been tried and could not help.
+rm -f "$ACC"/acct-*/.limited; : > "$ACC/selection.log"
+echo "fail:acct-01" > "$FAKE_CTL"
+out="$(claude -p --model claude-fable-5 hello < /dev/null 2>/dev/null)"
+case "$out" in
+  *"claude-fable-5"*) t_ok "an ordinary rate limit rotates account and KEEPS the model" ;;
+  *) t_fail "model preserved" "out=$out" ;;
+esac
+rm -f "$FAKE_CTL" "$ACC"/acct-*/.limited
+
 # ---- 12b. pipe stdin skips retry buffering but passes bytes through -----------
 out="$(printf 'pipe-data' | claude -p --echo-stdin 2>/dev/null)"
 [ "$out" = "pipe-data" ] && t_ok "pipe stdin passes through (no retry buffering)" || t_fail "pipe stdin passthrough" "got: $out"
@@ -1002,6 +1049,16 @@ claude-accounts remove acct-04 --yes >/dev/null 2>&1
 # ---- 15c1. add --token: portable setup-token instead of creds ------------------------
 out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=tok@test claude-accounts add tok@test --token 2>&1)"
 check "add --token registers via portable token" "Registered acct-04 for tok@test" "$out"
+check "add --token says the identity cannot be verified" "a setup token carries no identity" "$out"
+case "$out" in
+  *"sign-in verified"*) t_fail "add --token must not claim a verified sign-in" "it says 'sign-in verified' for an identity nothing can read" ;;
+  *) t_ok "add --token does not claim a verified sign-in" ;;
+esac
+case "$(grep 'add acct-04 tok@test' "$ACC/ops.log" 2>/dev/null)" in
+  *auth-verified*) t_fail "ops.log must not record --token as auth-verified" "the audit trail would relaunder the assumption" ;;
+  *"identity unverifiable"*) t_ok "ops.log records the --token add as unverifiable" ;;
+  *) t_fail "ops.log line for the --token add" "not found" ;;
+esac
 [ -s "$ACC/acct-04/server.token" ] && t_ok "add --token writes server.token" || t_fail "add --token" "missing"
 out="$(CLAUDE_ACCOUNT=acct-04 claude 2>&1)"
 check "token account exports CLAUDE_CODE_OAUTH_TOKEN" "TOK=sk-ant-oat01-FAKE" "$out"
@@ -3872,6 +3929,74 @@ assert any('manifest' in w for w in d['warnings']), d['warnings']
   && t_ok "limits --json still emits a document (with a warning) when the pool is broken" \
   || t_fail "limits --json on a broken pool" "no usable document"
 
+# ---- 46. a setup token has no identity: the --token paths must not pretend --------
+# Regression for two field failures on 2026-08-24: `add <email> --token` died every time
+# with "identity could not be read back" (it demanded --force for a ceremony that cannot
+# exist), and `mint` named no account at all — so approving in the wrong browser session
+# silently pinned another account's subscription to the slot, undetectably.
+out="$(CLAUDE_MULTIACC_FORCE_TTY=1 claude-accounts add --token 2>&1)"
+rc=$?
+check "add --token with no email refuses precisely" "name it: claude-accounts add <email> --token" "$out"
+[ "$rc" != "0" ] && t_ok "add --token with no email exits nonzero" || t_fail "add --token no email" "exited 0"
+[ ! -d "$ACC/acct-04" ] && t_ok "refused --token add leaves no dir behind" || t_fail "add --token cleanup" "dir left"
+# ...and it must refuse BEFORE the ceremony: minting a real 1-year grant only to discard
+# it would leave a live credential issued for nothing.
+case "$out" in
+  *"sign-in link"*) t_fail "add --token refuses before the ceremony" "setup-token already ran for an account it cannot name" ;;
+  *) t_ok "add --token with no email never opens the ceremony" ;;
+esac
+
+# mint must refuse a bare acct-NN directory the manifest does not know: removed accounts
+# and killed `add` runs leave those behind, and a token bound to one is unattributable.
+mkdir -p "$ACC/acct-77"
+out="$(printf 'sk-ant-oat01-ORPHANORPHANORPHANORPHANORPHANORPHAN\n' \
+  | claude-accounts mint acct-77 --paste 2>&1)"
+check "mint refuses an unregistered account dir" "unknown account: acct-77" "$out"
+[ ! -s "$ACC/acct-77/server.token" ] && t_ok "no token is written into an orphan dir" \
+  || t_fail "mint orphan dir" "server.token was written to an unregistered slot"
+rm -rf "$ACC/acct-77"
+
+# mint must NAME the account it is about to bind a token to (the only guard there is).
+printf 'sk-ant-oat01-MINTNAMEDMINTNAMEDMINTNAMEDMINTNAMEDMINTNAMED\n' \
+  | claude-accounts mint acct-01 --paste > "$WORK/mint-named.out" 2>&1
+out="$(cat "$WORK/mint-named.out")"
+check "mint --paste names the account in its prompt" "for acct-01" "$out"
+check "mint warns that a setup token carries no identity" "carries no identity" "$out"
+
+# ---- 47. every known verb answers --help with exit 0 (app-robot probes with it) ----
+# app-robot's runner asks `<verb> --help` to decide whether a Mac's build has the verb;
+# a non-zero exit reads as "too old" and parked panel-to-Mac credential distribution.
+# _KNOWN_VERBS must hold EXACTLY what the dispatcher implements. A verb missing from it
+# hides a real verb from the probe; a verb listed but unimplemented makes --help answer 0
+# for something that does not exist, which is how the probe stops meaning anything. The
+# first cut of this gate got both wrong (mint listed in codex, init-pool in claude), so
+# the parity is checked from the source, both directions, for both binaries.
+for _bin in claude-accounts codex-accounts; do
+  _src="$REPO_DIR/bin/$_bin"
+  _dispatch="$(grep -oE '^  [a-z0-9|_-]+\) shift; cmd_' "$_src" | sed -e 's/) shift; cmd_//' -e 's/^  //' | tr '|\n' '  ')"
+  _gate="$(grep -m1 '^_KNOWN_VERBS=' "$_src" | sed -e 's/^_KNOWN_VERBS="//' -e 's/"$//')"
+  _parity=1
+  for _v in $_dispatch; do
+    case " $_gate " in
+      *" $_v "*) ;;
+      *) _parity=0; t_fail "$_bin: dispatcher has '$_v', _KNOWN_VERBS does not" "app-robot's probe would read the verb as absent" ;;
+    esac
+    "$_bin" "$_v" --help >/dev/null 2>&1
+    [ "$?" = "0" ] && t_ok "$_bin $_v --help exits 0" \
+      || t_fail "$_bin $_v --help" "non-zero exit — app-robot would read the verb as missing"
+  done
+  for _v in $_gate; do
+    case " $_dispatch " in
+      *" $_v "*) ;;
+      *) _parity=0; t_fail "$_bin: _KNOWN_VERBS lists '$_v', the dispatcher does not implement it" "--help would answer 0 for a verb that does not exist" ;;
+    esac
+  done
+  [ "$_parity" = "1" ] && t_ok "$_bin: the help gate and the dispatcher list the same verbs"
+  "$_bin" frobnicate --help >/dev/null 2>&1
+  [ "$?" != "0" ] && t_ok "$_bin: an UNKNOWN verb still fails --help (the probe keeps its meaning)" \
+    || t_fail "$_bin unknown verb --help" "exited 0 — the probe would accept a verb that does not exist"
+done
+
 # ---- summary ---------------------------------------------------------------------
 echo
 echo "passed: $PASS  failed: $FAIL"