claude-multiacc 1.0.17 → 1.0.19

package/bin/claude

@@ -999,25 +999,70 @@ fi
 # the pool on its own — the shim's guess must never outlive the evidence for it.
 PARK_AUTH='failed to authenticate|oauth (session|token)[a-z ]{0,20}(expired|invalid|revoked)|could not be refreshed|invalid api key|authentication_error|invalid bearer token|please run /login|run /login to'
 PARK_ORG='organization has disabled|subscription access[a-z ]{0,20}disabl|disabled claude subscription|ask your admin to enable|not authorized to use claude code'
-LIMITPAT='rate[ _-]?limit|usage limit|limit (reached|exceeded)|overloaded|"?529"?|credit balance'
+# A usage limit can be scoped to ONE MODEL: "You've reached your Fable 5 limit.
+# Switch to another model, or manage usage credits..." — the account still has
+# capacity for every other model, and the endpoint says so in the message itself.
+#
+# This phrasing matched NOTHING below: "reached your <model> limit" is not "limit
+# reached", and "usage credits" is not "credit balance". So on 2026-08-24, when
+# every account crossed that scoped bucket inside one hour, the shim did not even
+# enter its retry branch — every task died in under a second having done no work,
+# and the pool looked healthy the whole time.
+MODEL_LIMITPAT="reached your [^.]{0,40} limit|switch to another model"
+LIMITPAT='rate[ _-]?limit|usage limit|limit (reached|exceeded)|overloaded|"?529"?|credit balance'"|$MODEL_LIMITPAT"
 ERRPAT="$LIMITPAT|$PARK_AUTH|$PARK_ORG"'|401|403|unauthorized|authentication[_ ]error|invalid[_ ](bearer|token|api key)|token (expired|revoked|invalid)|oauth.*(error|expired|invalid)'
+# Deliberately a full id, not an alias: the whole point of pinning --model is that
+# an unpinned run inherits whatever the operator was last using.
+FALLBACK_MODEL="${CLAUDE_MULTIACC_FALLBACK_MODEL:-claude-opus-5}"
+
+# Read the --model the caller pinned (both spellings). Empty = unpinned.
+argv_model() {
+  local i=0 n="${#ARGV[@]}"
+  while [ "$i" -lt "$n" ]; do
+    case "${ARGV[$i]}" in
+      --model) i=$((i+1)); [ "$i" -lt "$n" ] && printf '%s\n' "${ARGV[$i]}"; return 0 ;;
+      --model=*) printf '%s\n' "${ARGV[$i]#--model=}"; return 0 ;;
+    esac
+    i=$((i+1))
+  done
+  return 0
+}
+
+# Rewrite ARGV onto a different model, preserving the caller's spelling. An
+# unpinned run gets the flag appended rather than left to inherit.
+argv_set_model() { # $1 = model id
+  local i=0 n="${#ARGV[@]}" found=0
+  ARGV_FB=()
+  while [ "$i" -lt "$n" ]; do
+    case "${ARGV[$i]}" in
+      --model)   ARGV_FB+=("--model" "$1");   i=$((i+2)); found=1; continue ;;
+      --model=*) ARGV_FB+=("--model=$1");     i=$((i+1)); found=1; continue ;;
+    esac
+    ARGV_FB+=("${ARGV[$i]}"); i=$((i+1))
+  done
+  [ "$found" = 0 ] && ARGV_FB+=("--model" "$1")
+}
+
 PARK_SOFT_AUTH=3600      # 1h: a mis-parked healthy account is back within the hour
 PARK_SOFT_ORG=21600      # 6h: an org policy will not change in minutes
 
 attempt=1
 cur="$pick"
 rc=0
+rotated=0          # at most one account rotation, exactly as before
+model_fb_used=0    # ...and at most one model fallback after it
+ARGV=("$@")
 while :; do
   tok="$(acct_token "$cur")"
   if [ -n "$stdin_file" ]; then exec 3< "$stdin_file"; else exec 3< /dev/null; fi
   if [ -n "$tok" ]; then
-    CLAUDE_CONFIG_DIR="$cur" CLAUDE_CODE_OAUTH_TOKEN="$tok" "$REAL" "$@" <&3 > "$tmpd/out" 2> "$tmpd/err"
+    CLAUDE_CONFIG_DIR="$cur" CLAUDE_CODE_OAUTH_TOKEN="$tok" "$REAL" "${ARGV[@]}" <&3 > "$tmpd/out" 2> "$tmpd/err"
   else
-    CLAUDE_CONFIG_DIR="$cur" "$REAL" "$@" <&3 > "$tmpd/out" 2> "$tmpd/err"
+    CLAUDE_CONFIG_DIR="$cur" "$REAL" "${ARGV[@]}" <&3 > "$tmpd/out" 2> "$tmpd/err"
   fi
   rc=$?
   exec 3<&-
-  if [ "$rc" -ne 0 ] && [ "$attempt" -eq 1 ] \
+  if [ "$rc" -ne 0 ] && { [ "$rotated" = 0 ] || [ "$model_fb_used" = 0 ]; } \
     && grep -qiE "$ERRPAT" "$tmpd/out" "$tmpd/err" 2>/dev/null; then
     # Atomic marker writes: a reader must never observe a half-written marker
     # (it would parse as garbage and, before, could be deleted as "expired").
@@ -1036,6 +1081,11 @@ while :; do
       park_detail="run failed to authenticate"
       park_soft=$((now + PARK_SOFT_AUTH))
     fi
+    # An account that ran out of ONE model has not run out. Cooling it down would
+    # take a perfectly usable account out of the pool for every other model too —
+    # and if the whole pool shares the bucket, cool the ENTIRE pool down at once.
+    model_scoped=0
+    grep -qiE "$MODEL_LIMITPAT" "$tmpd/out" "$tmpd/err" 2>/dev/null && model_scoped=1
     if [ -n "$park_reason" ]; then
       {
         echo "$now"
@@ -1044,7 +1094,7 @@ while :; do
         && mv -f "$cur/.expired.$$" "$cur/.expired" 2>/dev/null \
         || rm -f "$cur/.expired.$$" 2>/dev/null || true
       sel_log "$(basename "$cur") parked ($park_reason until $park_soft) — see: claude-accounts expired"
-    else
+    elif [ "$model_scoped" = 0 ]; then
       {
         echo $((now + 600))
         echo "bucket=error-cooldown percent=? marked_at=$(date -u +%Y-%m-%dT%H:%M:%SZ) reason=error-cooldown"
@@ -1061,15 +1111,32 @@ while :; do
       if [ "$c" != "$cur" ]; then next="$c"; break; fi
       i=$((i+1))
     done
-    if [ -n "$next" ]; then
+    if [ -n "$next" ] && [ "$rotated" = 0 ]; then
       sel_log "retry from=$(basename "$cur") to=$(basename "$next") rc=$rc"
       cur="$next"
       # The account that actually serves the work is the one the next run should rotate
       # away from — not the one that bounced.
       remember_pick "$cur"
+      rotated=1
       attempt=2
       continue
     fi
+    # Another ACCOUNT could not help. If what ran out was one MODEL, the pool still
+    # has capacity — switch to it rather than failing a task that has done no work.
+    # Last resort by design: a healthy account must still serve the model the caller
+    # pinned, so this only fires once rotation has already been tried and refused.
+    if [ "$model_fb_used" = 0 ] \
+      && grep -qiE "$MODEL_LIMITPAT" "$tmpd/out" "$tmpd/err" 2>/dev/null; then
+      cm="$(argv_model)"
+      if [ "$cm" != "$FALLBACK_MODEL" ]; then
+        argv_set_model "$FALLBACK_MODEL"
+        ARGV=("${ARGV_FB[@]}")
+        model_fb_used=1
+        attempt=2
+        sel_log "model fallback ${cm:-<unpinned>} -> $FALLBACK_MODEL on $(basename "$cur") (scoped limit)"
+        continue
+      fi
+    fi
   fi
   break
 done

package/bin/claude-accounts

@@ -1111,6 +1111,85 @@ cmd_relogin() {
   [ -z "$failed" ]
 }
 
+# Hand freshly fetched telemetry to every machine that cannot fetch its own.
+#
+# Only ONE machine in a pool can read the usage endpoint: it needs an OAuth grant
+# carrying the user:profile scope, and a setup token is minted WITHOUT it. Every
+# other machine fetches, is refused, and therefore knows nothing about which
+# accounts are drained. gas-mini ranked its whole pool BLIND for 5.7 hours and
+# handed two tasks to an account sitting at 100% — its newest telemetry had arrived
+# at 16:38 on a mutation-triggered sync, and nothing refreshed it afterwards.
+#
+# So distribution rides the REFRESH rather than the mutation: whoever can fetch
+# hands the answer to everyone who cannot, every pass. One rsync per target carries
+# every account (a few KB). Strictly best effort with hard timeouts and BatchMode —
+# a peer that is asleep, rebooting or off the tailnet must never fail a refresh, and
+# must never hang the 15-minute job long enough to collide with the next one.
+# The push is DETACHED. A refresh that waits on ssh is a refresh that blocks the
+# 15-minute job for as long as a sleeping peer takes to time out, and telemetry
+# that arrives late is the whole problem we are fixing — delaying the NEXT fetch to
+# deliver this one trades the fault for itself. It also made four time-window tests
+# fail, which is the same defect wearing a smaller hat: seconds spent here move
+# every deadline downstream.
+#
+# One at a time: the lock means a slow or unreachable target can never stack pushes
+# up faster than they drain.
+limits_distribute() {
+  sync_is_replica && return 0
+  command -v rsync >/dev/null 2>&1 || return 0
+  [ "${CLAUDE_MULTIACC_NO_DISTRIBUTE:-0}" = "1" ] && return 0
+  ( limits_distribute_now >/dev/null 2>&1 & ) >/dev/null 2>&1
+  return 0
+}
+
+limits_distribute_now() {
+  local lock="$ACC_ROOT/tmp/limits-push.lock"
+  mkdir -p "$ACC_ROOT/tmp" 2>/dev/null || return 0
+  mkdir "$lock" 2>/dev/null || return 0
+  trap 'rmdir "$lock" 2>/dev/null || true' EXIT
+  local server sroot list id d
+  list="$ACC_ROOT/tmp/limits-push.$$"
+  mkdir -p "$ACC_ROOT/tmp" 2>/dev/null || return 0
+  : > "$list" 2>/dev/null || return 0
+  for id in $(account_ids); do
+    d="$ACC_ROOT/$id"
+    [ -f "$d/limits.json" ] && printf '%s/limits.json\n' "$id" >> "$list"
+    # A marker is pushed but never un-pushed: the shim expires a cleanly-reset
+    # .limited on its own, so a stale one costs an account some eligibility and
+    # never grants any. Erring toward exclusion is the safe direction here.
+    [ -f "$d/.limited" ] && printf '%s/.limited\n' "$id" >> "$list"
+  done
+  if [ ! -s "$list" ]; then rm -f "$list"; return 0; fi
+
+  server="$(sync_target)"
+  sroot="$(sync_target_root)"
+  if [ -n "$server" ] && ! sync_target_is_local "$server" \
+     && valid_ssh_target "$server" && valid_remote_path "$sroot"; then
+    limits_push_to "$server" "$sroot" "$list"
+  fi
+  # Peers are the OTHER Macs — the ones actually running tasks, and so the ones
+  # whose selection goes blind without this.
+  manifest_peers | while IFS="$(printf '\t')" read -r pt pr pp; do
+    [ "$pt" = "MALFORMED" ] && continue
+    [ -n "$pt" ] && [ -n "$pr" ] || continue
+    valid_ssh_target "$pt" || continue
+    valid_remote_path "$pr" || continue
+    limits_push_to "$pt" "$pr" "$list"
+  done
+  rm -f "$list"
+  rmdir "$lock" 2>/dev/null || true
+  trap - EXIT
+  return 0
+}
+
+limits_push_to() { # $1 target, $2 remote root, $3 file list
+  rsync -az --timeout=20 \
+    -e 'ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new' \
+    --files-from="$3" "$ACC_ROOT/" "$1:$2/" >>"$ACC_ROOT/sync.log" 2>&1 \
+    || log_to sync.log "limits push to $1 failed (telemetry there will age)"
+  return 0
+}
+
 cmd_limits() {
   require_manifest
   local quiet=0 force=0 json=0
@@ -1766,6 +1845,9 @@ PYEOF
   # lock while a consumer reads its output.
   limits_lock_release
   trap - EXIT
+  # Whoever just refreshed is the only machine that CAN — pass it on before the
+  # report, so a blind peer stops picking drained accounts within one cycle.
+  limits_distribute
   # The refresher fails open per account; a NON-zero status means the pass itself
   # broke (unreadable manifest, dead python). Report the state anyway — stale data
   # beats silence — but hand the caller the failure, exactly as before --json existed.
@@ -2124,6 +2206,13 @@ cmd_post_sync() {
   cmd_verify --quick
 }
 
+# Version of the copy at $1, read from its package.json on disk — the only answer
+# that describes what will actually execute.
+pkg_version_at() {
+  [ -f "$1/package.json" ] || return 0
+  sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$1/package.json" | head -1
+}
+
 cmd_self_update() {
   # Update the addon in place. npm global install => npm i -g @latest (its postinstall
   # re-runs install.sh). git checkout => git pull + ./install.sh. Anything else is a
@@ -2135,16 +2224,32 @@ cmd_self_update() {
   case "$REPO_DIR" in
     */node_modules/claude-multiacc|*/node_modules/claude-multiacc/*)
       command -v npm >/dev/null 2>&1 || { ulog "self-update: npm not found; skipping"; return 0; }
-      local cur lat
-      cur="$(npm ls -g --depth=0 claude-multiacc 2>/dev/null | sed -n 's/.*claude-multiacc@//p' | head -1)"
+      local cur lat prefix after
+      # Update THE COPY THAT IS RUNNING, not whichever one the ambient npm prefix
+      # happens to point at. my-mini had two global installs — homebrew's on PATH and
+      # nvm's under `npm root -g` — and self-update kept upgrading the nvm one and
+      # reporting success while every `claude` invocation ran the stale homebrew copy.
+      # It sat eleven versions behind for weeks and said "already latest" throughout.
+      # A deploy nobody runs is not a deploy, and one that announces success is worse
+      # than one that fails.
+      prefix="${REPO_DIR%/lib/node_modules/claude-multiacc*}"
+      cur="$(pkg_version_at "$REPO_DIR")"
       lat="$(npm view claude-multiacc version 2>/dev/null)"
       if [ -n "$lat" ] && [ "$cur" = "$lat" ]; then
         ulog "self-update: already latest ($cur)"
         return 0
       fi
-      ulog "self-update: npm $cur -> ${lat:-latest}"
-      if npm install -g claude-multiacc@latest >>"$ACC_ROOT/update.log" 2>&1; then
-        ulog "self-update: npm update ok"
+      ulog "self-update: npm $cur -> ${lat:-latest} (prefix $prefix)"
+      if npm install -g --prefix "$prefix" claude-multiacc@latest \
+           >>"$ACC_ROOT/update.log" 2>&1; then
+        # Verify by re-reading the file on disk. npm reporting success says nothing
+        # about which tree it wrote to.
+        after="$(pkg_version_at "$REPO_DIR")"
+        if [ -n "$lat" ] && [ "$after" != "$lat" ]; then
+          ulog "self-update: npm reported success but $REPO_DIR is still $after, not $lat — this install is NOT being updated"
+          return 1
+        fi
+        ulog "self-update: npm update ok ($after)"
       else
         ulog "self-update: npm update FAILED (see update.log)"
         return 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "1.0.17",
+  "version": "1.0.19",
   "description": "Multi-account addon for Claude Code and OpenAI Codex CLI: every claude / claude -p and every codex / codex exec runs under a randomly-picked subscription account with the most usage headroom. Mirrors to a deploy server. No API keys.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -88,6 +88,15 @@ if [ -f "$ctl" ] && grep -qx "orgfail:$acct" "$ctl" 2>/dev/null; then
   echo "Your organization has disabled Claude subscription access for Claude Code · Use an Anthropic API key instead, or ask your admin to enable access"
   exit 1
 fi
+# A limit scoped to ONE MODEL, on EVERY account: rotating cannot help, only
+# switching model can. Satisfied the moment the run carries the fallback model.
+if [ -f "$ctl" ] && grep -qx "modellimit" "$ctl" 2>/dev/null; then
+  case " $* " in
+    *" claude-opus-5 "*|*"--model=claude-opus-5"*) : ;;
+    *) echo "You've reached your Fable 5 limit. Switch to another model, or manage usage credits at claude.ai/settings/usage to continue." >&2
+       exit 1 ;;
+  esac
+fi
 for a in "$@"; do
   case "$a" in
     --exit7) echo "ordinary failure, not auth related" >&2; exit 7 ;;
@@ -110,7 +119,7 @@ if [ -n "${FAKE_SESSION_ID:-}" ] && [ -n "${CLAUDE_CONFIG_DIR:-}" ]; then
   sleep "${FAKE_SESSION_HOLD:-4}"
   rm -f "$CLAUDE_CONFIG_DIR/sessions/$$.json"
 fi
-echo "CFG=$acct TOK=${CLAUDE_CODE_OAUTH_TOKEN:-none}"
+echo "CFG=$acct TOK=${CLAUDE_CODE_OAUTH_TOKEN:-none} ARGS=$*"
 EOF
 chmod +x "$FAKEBIN/claude"
 
@@ -562,6 +571,36 @@ done
 [ -f "$ACC/acct-01/.limited" ] && t_ok "failed account got error-cooldown marker" || t_fail "cooldown marker" "missing"
 rm -f "$FAKE_CTL" "$ACC/acct-01/.limited"
 
+# ---- 12a. every account out of ONE model: switch model, do not fail ----------
+# 2026-08-24: all four accounts crossed the Fable weekly bucket inside an hour and
+# every task died in under a second having done no work. Rotating accounts cannot
+# fix a limit scoped to a model — the endpoint says so itself ("Switch to another
+# model"). The pool still had capacity for every other model.
+rm -f "$ACC"/acct-*/.limited
+echo "modellimit" > "$FAKE_CTL"
+out="$(claude -p --model claude-fable-5 hello < /dev/null 2>/dev/null)"
+rc=$?
+case "$out" in
+  *"ARGS="*"claude-opus-5"*) t_ok "a model-scoped limit falls back to another model" ;;
+  *) t_fail "model fallback" "rc=$rc out=$out" ;;
+esac
+[ "$rc" = "0" ] && t_ok "...and the task succeeds instead of failing" \
+  || t_fail "model fallback rc" "rc=$rc"
+grep -q "model fallback" "$ACC/selection.log" 2>/dev/null \
+  && t_ok "the model switch is recorded in the selection log" \
+  || t_fail "model fallback log" "nothing logged"
+
+# The pinned model is the caller's choice and must survive a recoverable failure:
+# fall back only once ROTATION has been tried and could not help.
+rm -f "$ACC"/acct-*/.limited; : > "$ACC/selection.log"
+echo "fail:acct-01" > "$FAKE_CTL"
+out="$(claude -p --model claude-fable-5 hello < /dev/null 2>/dev/null)"
+case "$out" in
+  *"claude-fable-5"*) t_ok "an ordinary rate limit rotates account and KEEPS the model" ;;
+  *) t_fail "model preserved" "out=$out" ;;
+esac
+rm -f "$FAKE_CTL" "$ACC"/acct-*/.limited
+
 # ---- 12b. pipe stdin skips retry buffering but passes bytes through -----------
 out="$(printf 'pipe-data' | claude -p --echo-stdin 2>/dev/null)"
 [ "$out" = "pipe-data" ] && t_ok "pipe stdin passes through (no retry buffering)" || t_fail "pipe stdin passthrough" "got: $out"