claude-multiacc 1.0.19 → 1.0.21

package/README.md

@@ -122,7 +122,7 @@ and backs off on **every** non-2xx, not just a 429 — honoring `Retry-After`, a
 for 6 h on a refusal the server marks `x-should-retry: false`. `limits --force` overrides
 all of it. The cadence is deliberately unhurried: several machines polling the same
 accounts every minute earns a 429 with `Retry-After: 3600`, and telemetry then goes stale
-for an hour at a time — which is exactly when every account starts scoring *neutral* and
+for an hour at a time — which is exactly when every account starts scoring *unknown* and
 the picker loses its ability to tell them apart.
 
 > **The usage endpoint needs an OAuth login, not a setup token.** A portable
@@ -131,7 +131,7 @@ the picker loses its ability to tell them apart.
 > user:profile`: setup tokens are minted without that scope. So an account whose
 > `.credentials.json` grant has lapsed keeps working perfectly while going **permanently
 > dark for telemetry**, and a pool where that happens to every account ranks everything
-> neutral and picks at random. `claude-accounts status` says `RANKING IS BLIND` when the
+> unknown and picks at random. `claude-accounts status` says `RANKING IS BLIND` when the
 > pool is in that state, and the shim prints an hourly warning on a terminal. The fix is
 > a real sign-in on the machine that polls (`claude-accounts login <acct-NN>`); since
 > `limits.json` is one of the things `sync` pushes, only the **source** machine needs it —
@@ -145,7 +145,7 @@ working accounts, while the cutoff declares one unusable, and an account reading
 hour ago may be well past 90% now. When nothing is in-window at all, a stale weekly
 reading is still used **if its bucket has not reset yet** (a weekly bucket only rises
 until then, so the number remains a true lower bound) — logged as `ranking=DEGRADED`.
-Only when even that is unavailable does selection fall back to neutral, logged as
+Only when even that is unavailable does selection rank the account last, logged as
 `ranking=BLIND`.
 
 If an account's OAuth access token has been expired for a while (idle account,

package/bin/claude

@@ -214,17 +214,17 @@ age_human() { # $1 = seconds
 # confirm this reset asymmetry — an account whose only near-full bucket is the cheap
 # session one must NOT rank behind one burning durable weekly headroom.)
 #   score = weekly%*1000 + session%      weekly,session in [0,100]
-# Stale/unreadable telemetry ranks NEUTRAL (weekly 50, session 50), never "free" —
+# Stale/unreadable telemetry ranks LAST (weekly 100, session 100), never "free" —
 # EXCEPT in a blind pool (SEL_DEGRADED=1), where a still-valid stale weekly reading is
-# used instead. Neutral is only the right answer while some other account HAS fresh
-# data to be neutral against; when no account does, neutral is just a coin flip.
+# used instead. Unknown data must never beat a truthful usage reading; when every
+# candidate is unknown, the equal worst-case scores still preserve fail-open selection.
 SEL_DEGRADED=0
 sel_score_of() { # $1 = acct dir
   local w s
   if ! w="$(fresh_field "$1" weekly_percent)" && ! w="$(fresh_field "$1" max_percent)"; then
-    if [ "$SEL_DEGRADED" = 1 ]; then w="$(stale_weekly "$1")" || w=50; else w=50; fi
+    if [ "$SEL_DEGRADED" = 1 ]; then w="$(stale_weekly "$1")" || w=100; else w=100; fi
   fi
-  s="$(fresh_field "$1" session_percent)" || s=50
+  s="$(fresh_field "$1" session_percent)" || s=100
   printf '%s\n' $((w * 1000 + s))
 }
 
@@ -1046,13 +1046,27 @@ argv_set_model() { # $1 = model id
 PARK_SOFT_AUTH=3600      # 1h: a mis-parked healthy account is back within the hour
 PARK_SOFT_ORG=21600      # 6h: an org policy will not change in minutes
 
+# True when the tail of stdout carries a stream-json result marked is_error. Bounded
+# to the tail because that is where the final object lands, and because a task log
+# runs to hundreds of KB of transcript that must not be rescanned per attempt.
+stream_reported_error() {
+  tail -c 8192 "$tmpd/out" 2>/dev/null \
+    | LC_ALL=C grep -qE '"type"[[:space:]]*:[[:space:]]*"result"' 2>/dev/null || return 1
+  tail -c 8192 "$tmpd/out" 2>/dev/null \
+    | LC_ALL=C grep -qE '"is_error"[[:space:]]*:[[:space:]]*true' 2>/dev/null
+}
+
 attempt=1
 cur="$pick"
 rc=0
+stream_err=0       # the run exited 0 but the stream said otherwise
 rotated=0          # at most one account rotation, exactly as before
 model_fb_used=0    # ...and at most one model fallback after it
 ARGV=("$@")
 while :; do
+  # Per ATTEMPT: a stream error seen on an earlier account must never decide the
+  # exit status of a later one that failed for its own, real reason.
+  stream_err=0
   tok="$(acct_token "$cur")"
   if [ -n "$stdin_file" ]; then exec 3< "$stdin_file"; else exec 3< /dev/null; fi
   if [ -n "$tok" ]; then
@@ -1062,6 +1076,17 @@ while :; do
   fi
   rc=$?
   exec 3<&-
+  # A `--output-format stream-json` run reports an API error INSIDE the stream and
+  # still exits 0: the failure arrives as the final result object carrying
+  # "is_error":true, not as a non-zero status. EVERY app-robot task takes that path,
+  # so gating the retry branch on $rc alone meant the pool never rotated and never
+  # fell back for the exact failures it exists for — the shim saw a clean success
+  # every time while the task died in a second having done no work.
+  #
+  # Only the FINAL result counts. A 429 that appears mid-stream and is retried by
+  # the client itself ends in a healthy result, and re-running that would throw away
+  # a completed run.
+  if [ "$rc" -eq 0 ] && stream_reported_error; then rc=1; stream_err=1; fi
   if [ "$rc" -ne 0 ] && { [ "$rotated" = 0 ] || [ "$model_fb_used" = 0 ]; } \
     && grep -qiE "$ERRPAT" "$tmpd/out" "$tmpd/err" 2>/dev/null; then
     # Atomic marker writes: a reader must never observe a half-written marker
@@ -1143,4 +1168,7 @@ done
 
 cat "$tmpd/out"
 cat "$tmpd/err" >&2
+# The exit status belongs to the CLI, not to us: a stream-json caller parses the
+# stream and expects 0 here. We only borrowed rc to decide whether to retry.
+[ "$stream_err" = 1 ] && [ "$rc" = 1 ] && rc=0
 exit "$rc"

package/bin/codex

@@ -144,11 +144,13 @@ fresh_field() { # fresh_field <acct dir> <json key> -> integer if telemetry fres
 # window only refills on its multi-day reset, while the ~5h window self-heals, so
 # session is a mild tiebreaker only (same reset asymmetry as the claude pool).
 #   score = weekly%*1000 + session%      weekly,session in [0,100]
-# Stale/unreadable telemetry ranks NEUTRAL (weekly 50, session 50), never "free".
+# Stale/unreadable telemetry ranks LAST (weekly 100, session 100), never "free".
+# Equal worst-case scores keep an entirely unknown pool selectable, but an unknown
+# account can never beat a candidate with truthful usage telemetry.
 sel_score_of() { # $1 = acct dir
   local w s
-  w="$(fresh_field "$1" weekly_percent)" || w="$(fresh_field "$1" max_percent)" || w=50
-  s="$(fresh_field "$1" session_percent)" || s=50
+  w="$(fresh_field "$1" weekly_percent)" || w="$(fresh_field "$1" max_percent)" || w=100
+  s="$(fresh_field "$1" session_percent)" || s=100
   printf '%s\n' $((w * 1000 + s))
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "1.0.19",
+  "version": "1.0.21",
   "description": "Multi-account addon for Claude Code and OpenAI Codex CLI: every claude / claude -p and every codex / codex exec runs under a randomly-picked subscription account with the most usage headroom. Mirrors to a deploy server. No API keys.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -90,6 +90,17 @@ if [ -f "$ctl" ] && grep -qx "orgfail:$acct" "$ctl" 2>/dev/null; then
 fi
 # A limit scoped to ONE MODEL, on EVERY account: rotating cannot help, only
 # switching model can. Satisfied the moment the run carries the fallback model.
+# The shape every app-robot task actually produces: --output-format stream-json
+# reports the API error INSIDE the stream and exits 0.
+if [ -f "$ctl" ] && grep -qx "streamlimit" "$ctl" 2>/dev/null; then
+  case " $* " in
+    *" claude-opus-5 "*|*"--model=claude-opus-5"*)
+      echo '{"type":"result","subtype":"success","is_error":false,"result":"done"}' ;;
+    *)
+      echo '{"type":"result","subtype":"success","is_error":true,"api_error_status":429,"result":"You'"'"'ve reached your Fable 5 limit. Switch to another model, or manage usage credits to continue."}'
+      exit 0 ;;
+  esac
+fi
 if [ -f "$ctl" ] && grep -qx "modellimit" "$ctl" 2>/dev/null; then
   case " $* " in
     *" claude-opus-5 "*|*"--model=claude-opus-5"*) : ;;
@@ -242,11 +253,30 @@ done
   && t_ok "CLAUDE_SHIM_SELECT=random restores uniform spread" \
   || t_fail "random opt-out" "acct-01=$hits1 acct-02=$hits2"
 
-# stale telemetry is neutral, never assumed free
+# Unknown telemetry ranks behind every truthful reading, never as neutral or free.
 printf '{"fetched_at":1,"weekly_percent":1,"session_percent":1,"max_percent":1,"buckets":[]}' > "$ACC/acct-01/limits.json"
 lj 30 30 30 > "$ACC/acct-02/limits.json"
 out="$(claude 2>&1)"
 check "stale 1% loses to fresh 30% (stale is not trusted)" "CFG=acct-02" "$out"
+lj 88 88 88 > "$ACC/acct-01/limits.json"
+rm -f "$ACC/acct-02/limits.json" "$ACC/.last-pick"
+all1=1
+for _ in $(seq 1 15); do
+  case "$(claude 2>&1)" in *CFG=acct-01*) ;; *) all1=0 ;; esac
+done
+[ "$all1" = "1" ] && t_ok "unknown telemetry never beats a known account at 88%" \
+  || t_fail "unknown telemetry ranking" "the unknown account beat truthful 88% usage"
+rm -f "$ACC/acct-01/limits.json" "$ACC/.last-pick"
+hits1=0; hits2=0
+for _ in $(seq 1 40); do
+  case "$(claude 2>&1)" in
+    *CFG=acct-01*) hits1=$((hits1+1)) ;;
+    *CFG=acct-02*) hits2=$((hits2+1)) ;;
+  esac
+done
+{ [ "$hits1" -gt 0 ] && [ "$hits2" -gt 0 ]; } \
+  && t_ok "an entirely unknown Claude pool still fails open" \
+  || t_fail "unknown Claude pool fail-open" "acct-01=$hits1 acct-02=$hits2"
 rm -f "$ACC"/acct-*/limits.json
 
 # ---- 6. explicit pin -------------------------------------------------------
@@ -601,6 +631,31 @@ case "$out" in
 esac
 rm -f "$FAKE_CTL" "$ACC"/acct-*/.limited
 
+# ---- 12a2. an in-stream API error still triggers recovery --------------------
+# With --output-format stream-json the CLI exits 0 and reports the 429 as the final
+# result object. Every app-robot task takes that path, so gating retry on the exit
+# status alone meant the pool never rotated and never fell back for the exact
+# failures it exists for — while the shim recorded a clean success every time.
+rm -f "$ACC"/acct-*/.limited; : > "$ACC/selection.log"
+echo "streamlimit" > "$FAKE_CTL"
+out="$(claude -p --model claude-fable-5 --output-format stream-json hello < /dev/null 2>/dev/null)"
+rc=$?
+case "$out" in
+  *'"is_error":false'*) t_ok "an in-stream API error is recovered, not reported as success" ;;
+  *) t_fail "stream error recovery" "rc=$rc out=$out" ;;
+esac
+[ "$rc" = "0" ] && t_ok "...and the caller still gets exit 0, as the CLI would give" \
+  || t_fail "stream error exit status" "rc=$rc"
+
+# A stream that merely MENTIONS a limit mid-run and then completes must be left alone:
+# re-running it would throw away a finished task.
+rm -f "$FAKE_CTL" "$ACC"/acct-*/.limited; : > "$ACC/selection.log"
+out="$(claude -p --model claude-fable-5 hello < /dev/null 2>/dev/null)"
+grep -q "retry from=" "$ACC/selection.log" 2>/dev/null \
+  && t_fail "spurious retry" "a healthy run was retried" \
+  || t_ok "a healthy run is never retried"
+rm -f "$FAKE_CTL" "$ACC"/acct-*/.limited
+
 # ---- 12b. pipe stdin skips retry buffering but passes bytes through -----------
 out="$(printf 'pipe-data' | claude -p --echo-stdin 2>/dev/null)"
 [ "$out" = "pipe-data" ] && t_ok "pipe stdin passes through (no retry buffering)" || t_fail "pipe stdin passthrough" "got: $out"
@@ -2489,11 +2544,30 @@ done
 { [ "$hits1" -gt 0 ] && [ "$hits2" -gt 0 ] && [ $((hits1+hits2)) -eq 40 ]; } \
   && t_ok "codex: equal scores spread randomly (acct-01=$hits1 acct-02=$hits2)" \
   || t_fail "codex tie spreading" "acct-01=$hits1 acct-02=$hits2 (want both >0, total 40)"
-# stale telemetry ranks neutral, never free
+# Unknown telemetry ranks behind every truthful reading, never as neutral or free.
 printf '{"fetched_at":1,"weekly_percent":1,"session_percent":1,"max_percent":1,"buckets":[]}' > "$CX/acct-01/limits.json"
 cxlj 30 30 30 > "$CX/acct-02/limits.json"
 out="$(codex 2>&1)"
 check "codex: stale 1% loses to fresh 30%" "CFG=acct-02" "$out"
+cxlj 88 88 88 > "$CX/acct-01/limits.json"
+rm -f "$CX/acct-02/limits.json" "$CX/.last-pick"
+all1=1
+for _ in $(seq 1 15); do
+  case "$(codex 2>&1)" in *CFG=acct-01*) ;; *) all1=0 ;; esac
+done
+[ "$all1" = "1" ] && t_ok "codex: unknown telemetry never beats known 88%" \
+  || t_fail "codex unknown telemetry ranking" "the unknown account beat truthful 88% usage"
+rm -f "$CX/acct-01/limits.json" "$CX/.last-pick"
+hits1=0; hits2=0
+for _ in $(seq 1 40); do
+  case "$(codex 2>&1)" in
+    *CFG=acct-01*) hits1=$((hits1+1)) ;;
+    *CFG=acct-02*) hits2=$((hits2+1)) ;;
+  esac
+done
+{ [ "$hits1" -gt 0 ] && [ "$hits2" -gt 0 ]; } \
+  && t_ok "codex: an entirely unknown pool still fails open" \
+  || t_fail "codex unknown pool fail-open" "acct-01=$hits1 acct-02=$hits2"
 rm -f "$CX"/acct-*/limits.json
 
 # ---- C4. pin -----------------------------------------------------------------------