claude-multiacc 1.0.18 → 1.0.20

package/bin/claude

@@ -1046,13 +1046,27 @@ argv_set_model() { # $1 = model id
 PARK_SOFT_AUTH=3600      # 1h: a mis-parked healthy account is back within the hour
 PARK_SOFT_ORG=21600      # 6h: an org policy will not change in minutes
 
+# True when the tail of stdout carries a stream-json result marked is_error. Bounded
+# to the tail because that is where the final object lands, and because a task log
+# runs to hundreds of KB of transcript that must not be rescanned per attempt.
+stream_reported_error() {
+  tail -c 8192 "$tmpd/out" 2>/dev/null \
+    | LC_ALL=C grep -qE '"type"[[:space:]]*:[[:space:]]*"result"' 2>/dev/null || return 1
+  tail -c 8192 "$tmpd/out" 2>/dev/null \
+    | LC_ALL=C grep -qE '"is_error"[[:space:]]*:[[:space:]]*true' 2>/dev/null
+}
+
 attempt=1
 cur="$pick"
 rc=0
+stream_err=0       # the run exited 0 but the stream said otherwise
 rotated=0          # at most one account rotation, exactly as before
 model_fb_used=0    # ...and at most one model fallback after it
 ARGV=("$@")
 while :; do
+  # Per ATTEMPT: a stream error seen on an earlier account must never decide the
+  # exit status of a later one that failed for its own, real reason.
+  stream_err=0
   tok="$(acct_token "$cur")"
   if [ -n "$stdin_file" ]; then exec 3< "$stdin_file"; else exec 3< /dev/null; fi
   if [ -n "$tok" ]; then
@@ -1062,6 +1076,17 @@ while :; do
   fi
   rc=$?
   exec 3<&-
+  # A `--output-format stream-json` run reports an API error INSIDE the stream and
+  # still exits 0: the failure arrives as the final result object carrying
+  # "is_error":true, not as a non-zero status. EVERY app-robot task takes that path,
+  # so gating the retry branch on $rc alone meant the pool never rotated and never
+  # fell back for the exact failures it exists for — the shim saw a clean success
+  # every time while the task died in a second having done no work.
+  #
+  # Only the FINAL result counts. A 429 that appears mid-stream and is retried by
+  # the client itself ends in a healthy result, and re-running that would throw away
+  # a completed run.
+  if [ "$rc" -eq 0 ] && stream_reported_error; then rc=1; stream_err=1; fi
   if [ "$rc" -ne 0 ] && { [ "$rotated" = 0 ] || [ "$model_fb_used" = 0 ]; } \
     && grep -qiE "$ERRPAT" "$tmpd/out" "$tmpd/err" 2>/dev/null; then
     # Atomic marker writes: a reader must never observe a half-written marker
@@ -1143,4 +1168,7 @@ done
 
 cat "$tmpd/out"
 cat "$tmpd/err" >&2
+# The exit status belongs to the CLI, not to us: a stream-json caller parses the
+# stream and expects 0 here. We only borrowed rc to decide whether to retry.
+[ "$stream_err" = 1 ] && [ "$rc" = 1 ] && rc=0
 exit "$rc"

package/bin/claude-accounts

@@ -2206,6 +2206,13 @@ cmd_post_sync() {
   cmd_verify --quick
 }
 
+# Version of the copy at $1, read from its package.json on disk — the only answer
+# that describes what will actually execute.
+pkg_version_at() {
+  [ -f "$1/package.json" ] || return 0
+  sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$1/package.json" | head -1
+}
+
 cmd_self_update() {
   # Update the addon in place. npm global install => npm i -g @latest (its postinstall
   # re-runs install.sh). git checkout => git pull + ./install.sh. Anything else is a
@@ -2217,16 +2224,32 @@ cmd_self_update() {
   case "$REPO_DIR" in
     */node_modules/claude-multiacc|*/node_modules/claude-multiacc/*)
       command -v npm >/dev/null 2>&1 || { ulog "self-update: npm not found; skipping"; return 0; }
-      local cur lat
-      cur="$(npm ls -g --depth=0 claude-multiacc 2>/dev/null | sed -n 's/.*claude-multiacc@//p' | head -1)"
+      local cur lat prefix after
+      # Update THE COPY THAT IS RUNNING, not whichever one the ambient npm prefix
+      # happens to point at. my-mini had two global installs — homebrew's on PATH and
+      # nvm's under `npm root -g` — and self-update kept upgrading the nvm one and
+      # reporting success while every `claude` invocation ran the stale homebrew copy.
+      # It sat eleven versions behind for weeks and said "already latest" throughout.
+      # A deploy nobody runs is not a deploy, and one that announces success is worse
+      # than one that fails.
+      prefix="${REPO_DIR%/lib/node_modules/claude-multiacc*}"
+      cur="$(pkg_version_at "$REPO_DIR")"
       lat="$(npm view claude-multiacc version 2>/dev/null)"
       if [ -n "$lat" ] && [ "$cur" = "$lat" ]; then
         ulog "self-update: already latest ($cur)"
         return 0
       fi
-      ulog "self-update: npm $cur -> ${lat:-latest}"
-      if npm install -g claude-multiacc@latest >>"$ACC_ROOT/update.log" 2>&1; then
-        ulog "self-update: npm update ok"
+      ulog "self-update: npm $cur -> ${lat:-latest} (prefix $prefix)"
+      if npm install -g --prefix "$prefix" claude-multiacc@latest \
+           >>"$ACC_ROOT/update.log" 2>&1; then
+        # Verify by re-reading the file on disk. npm reporting success says nothing
+        # about which tree it wrote to.
+        after="$(pkg_version_at "$REPO_DIR")"
+        if [ -n "$lat" ] && [ "$after" != "$lat" ]; then
+          ulog "self-update: npm reported success but $REPO_DIR is still $after, not $lat — this install is NOT being updated"
+          return 1
+        fi
+        ulog "self-update: npm update ok ($after)"
       else
         ulog "self-update: npm update FAILED (see update.log)"
         return 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "1.0.18",
+  "version": "1.0.20",
   "description": "Multi-account addon for Claude Code and OpenAI Codex CLI: every claude / claude -p and every codex / codex exec runs under a randomly-picked subscription account with the most usage headroom. Mirrors to a deploy server. No API keys.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -90,6 +90,17 @@ if [ -f "$ctl" ] && grep -qx "orgfail:$acct" "$ctl" 2>/dev/null; then
 fi
 # A limit scoped to ONE MODEL, on EVERY account: rotating cannot help, only
 # switching model can. Satisfied the moment the run carries the fallback model.
+# The shape every app-robot task actually produces: --output-format stream-json
+# reports the API error INSIDE the stream and exits 0.
+if [ -f "$ctl" ] && grep -qx "streamlimit" "$ctl" 2>/dev/null; then
+  case " $* " in
+    *" claude-opus-5 "*|*"--model=claude-opus-5"*)
+      echo '{"type":"result","subtype":"success","is_error":false,"result":"done"}' ;;
+    *)
+      echo '{"type":"result","subtype":"success","is_error":true,"api_error_status":429,"result":"You'"'"'ve reached your Fable 5 limit. Switch to another model, or manage usage credits to continue."}'
+      exit 0 ;;
+  esac
+fi
 if [ -f "$ctl" ] && grep -qx "modellimit" "$ctl" 2>/dev/null; then
   case " $* " in
     *" claude-opus-5 "*|*"--model=claude-opus-5"*) : ;;
@@ -601,6 +612,31 @@ case "$out" in
 esac
 rm -f "$FAKE_CTL" "$ACC"/acct-*/.limited
 
+# ---- 12a2. an in-stream API error still triggers recovery --------------------
+# With --output-format stream-json the CLI exits 0 and reports the 429 as the final
+# result object. Every app-robot task takes that path, so gating retry on the exit
+# status alone meant the pool never rotated and never fell back for the exact
+# failures it exists for — while the shim recorded a clean success every time.
+rm -f "$ACC"/acct-*/.limited; : > "$ACC/selection.log"
+echo "streamlimit" > "$FAKE_CTL"
+out="$(claude -p --model claude-fable-5 --output-format stream-json hello < /dev/null 2>/dev/null)"
+rc=$?
+case "$out" in
+  *'"is_error":false'*) t_ok "an in-stream API error is recovered, not reported as success" ;;
+  *) t_fail "stream error recovery" "rc=$rc out=$out" ;;
+esac
+[ "$rc" = "0" ] && t_ok "...and the caller still gets exit 0, as the CLI would give" \
+  || t_fail "stream error exit status" "rc=$rc"
+
+# A stream that merely MENTIONS a limit mid-run and then completes must be left alone:
+# re-running it would throw away a finished task.
+rm -f "$FAKE_CTL" "$ACC"/acct-*/.limited; : > "$ACC/selection.log"
+out="$(claude -p --model claude-fable-5 hello < /dev/null 2>/dev/null)"
+grep -q "retry from=" "$ACC/selection.log" 2>/dev/null \
+  && t_fail "spurious retry" "a healthy run was retried" \
+  || t_ok "a healthy run is never retried"
+rm -f "$FAKE_CTL" "$ACC"/acct-*/.limited
+
 # ---- 12b. pipe stdin skips retry buffering but passes bytes through -----------
 out="$(printf 'pipe-data' | claude -p --echo-stdin 2>/dev/null)"
 [ "$out" = "pipe-data" ] && t_ok "pipe stdin passes through (no retry buffering)" || t_fail "pipe stdin passthrough" "got: $out"