claude-multiacc 1.0.3 → 1.0.4

package/bin/claude-accounts

@@ -40,6 +40,8 @@ USAGE
                                             default ~/.claude login (dir symlink —
                                             single credential file, no grant fork)
   claude-accounts remove <acct-NN> [--yes]  delete account (propagates to server)
+  claude-accounts dedupe [--yes]            remove any account registered twice
+                                            (same email), keeping one per email
   claude-accounts mint <acct-NN>            mint server token via `claude setup-token`
       --paste               paste an already-minted token instead of running setup-token
   claude-accounts sync                      push manifest+tokens to the server (Mac only)
@@ -149,6 +151,14 @@ for a in accounts:
         auth.append('token')
     limited = os.path.isfile(os.path.join(d, '.limited'))
     print(f"{a['id']}  {a['email']:<28} home={a.get('home','?'):<7} auth={'+'.join(auth) or 'NONE':<11} {'LIMITED' if limited else ''}")
+seen = {}
+for a in accounts:
+    seen.setdefault(a.get('email', '').lower(), []).append(a['id'])
+dups = {e: ids for e, ids in seen.items() if len(ids) > 1}
+if dups:
+    print()
+    for e, ids in dups.items():
+        print(f"WARNING: {e} is registered {len(ids)}x ({', '.join(ids)}) — run 'claude-accounts dedupe'")
 PYEOF
 }
 
@@ -249,89 +259,94 @@ cmd_add() {
         else die "unexpected argument: $1 (usage: claude-accounts add [email] [--token] [--force])"; fi ;;
     esac
   done
-  # If an email was named, fast-fail on a duplicate now. If not, we learn (and dedup)
-  # the real email from the sign-in below — one account per email either way.
+  # If an email was named and it's already in the pool, SKIP before any sign-in — no
+  # duplicate is ever created. (A graceful skip, exit 0: adding an existing account is
+  # a no-op, not an error. Re-auth an existing account with 'login'.)
   local owner
   if [ -n "$email" ]; then
     owner="$(email_owner "$email")"
-    [ -n "$owner" ] && die "$email is already registered as $owner — nothing created (run 'claude-accounts login $owner' to re-authenticate it)"
+    if [ -n "$owner" ]; then
+      echo "$email is already added as $owner — skipping (nothing to do; run 'claude-accounts login $owner' to re-authenticate it)."
+      return 0
+    fi
   fi
   if [ ! -t 0 ] && [ -z "${CLAUDE_MULTIACC_FORCE_TTY:-}" ]; then
     die "add is interactive (it completes sign-in before registering) — run it from a terminal"
   fi
-  # Serialize the whole check->allocate->authenticate->register sequence: two concurrent
-  # adds must not race the duplicate check, collide on an id, or clobber the manifest.
-  local lock="$ACC_ROOT/.locks/mutate"
-  mkdir -p "$ACC_ROOT/.locks"
-  if ! mkdir "$lock" 2>/dev/null; then
-    if [ $(( $(epoch_now) - $(file_mtime "$lock") )) -gt 900 ]; then
-      rm -rf "$lock"; mkdir "$lock" 2>/dev/null || die "cannot acquire the account lock"
-    else
-      die "another claude-accounts add/login is in progress — try again when it finishes"
-    fi
-  fi
-  # shellcheck disable=SC2064
-  trap "rm -rf '$lock'" EXIT
   local real
   real="$(find_real_claude "$_self")" || die "real claude binary not found"
+
+  # Reserve a unique id under a BRIEF lock (creating the dir claims the id, so a parallel
+  # add gets the next one). The long browser sign-in below runs WITHOUT the lock, so
+  # several `add` in different terminals proceed in parallel. RESERVED_DIR drives a trap
+  # that removes the half-made dir on any failure/abort BEFORE registration.
   local id d got elabel
   elabel="${email:-the account you sign in as}"
+  RESERVED_DIR=""
+  trap 'add_cleanup_reserved; exit 130' INT TERM
+  trap 'add_cleanup_reserved' EXIT
+  mutate_lock || die "could not acquire the account lock (another op is stuck?) — try again"
   id="$(next_id)"
   d="$ACC_ROOT/$id"
   seed_account_dir "$d"
+  RESERVED_DIR="$d"
+  mutate_unlock
+
   if [ "$token" = "1" ]; then
     # Portable setup-token variant (works on Mac AND server; needs a recent sign-in).
     echo "Preparing $id for $elabel (portable token) — NOTHING is registered until sign-in completes."
-    if ! run_token_ceremony "$d"; then
-      rm -rf "${ACC_ROOT:?}/${id:?}"
-      die "sign-in failed or aborted — nothing was created"
-    fi
+    run_token_ceremony "$d" || die "sign-in failed or aborted — nothing was created"
     ( umask 077; printf '%s' "$CEREMONY_TOKEN" > "$d/server.token" )
     chmod 600 "$d/server.token"
     got="$(token_email "$CEREMONY_TOKEN")"
   else
-    # Default: full Claude Code login (the flow that just works — full scopes, no
-    # long-lived-token step-up). Writes auto-refreshing .credentials.json, valid on
-    # THIS machine (creds are never synced, so no cross-machine refresh races).
+    # Default: full Claude Code login (full scopes, no long-lived-token step-up).
+    # Writes auto-refreshing .credentials.json, valid on THIS machine.
     echo "Preparing $id for $elabel — NOTHING is registered until login completes."
-    if ! run_login_ceremony "$d" "$email"; then
-      rm -rf "${ACC_ROOT:?}/${id:?}"
-      die "login failed or aborted — nothing was created"
-    fi
+    run_login_ceremony "$d" "$email" || die "login failed or aborted — nothing was created"
     got="$(config_dir_email "$d")"
   fi
   if [ -z "$got" ]; then
-    # Signed in, but we could not read back WHICH account. Without a verified email we
-    # cannot label or dedup the account, so refuse — unless an email was named AND
-    # --force was given (then we trust the named email).
     if [ -n "$email" ] && [ "$force" = "1" ]; then
       warn "identity unverified — registering as $email because --force was given"
       got="$email"
     else
-      rm -rf "${ACC_ROOT:?}/${id:?}"
       die "signed in, but the account identity could not be read back — nothing was created (retry; or 'add <email> --force' to trust a named email)"
     fi
   fi
-  # `got` is now the authoritative signed-in email. Dedup against it, warn on mismatch.
+  # Dedup + register under a BRIEF lock, re-reading the manifest (a parallel add may have
+  # registered the same email meanwhile — the loser skips gracefully). This is the
+  # guarantee that a code pasted for an already-added account never yields a second entry.
+  mutate_lock || die "could not acquire the account lock — try again"
   owner="$(email_owner "$got")"
   if [ -n "$owner" ]; then
-    rm -rf "${ACC_ROOT:?}/${id:?}"
-    die "you signed in as $got, which is already registered as $owner — nothing was created"
+    mutate_unlock
+    echo "$got is already added as $owner — skipping (nothing added)."
+    return 0   # RESERVED_DIR still set -> trap removes the temp dir
   fi
   if [ -n "$email" ] && [ "$got" != "$email" ]; then
     warn "signed in as $got (you named $email) — registering the account that actually authenticated"
   fi
-  email="$got"
-  manifest_add_account "$id" "$email" "$(machine_kind)"
-  log_to ops.log "add $id $email (auth-verified)"
+  manifest_add_account "$id" "$got" "$(machine_kind)"
+  mutate_unlock
+  RESERVED_DIR=""            # committed — the trap must not delete it now
+  trap - EXIT INT TERM
+  log_to ops.log "add $id $got (auth-verified)"
   auto_sync
   cat <<EOF
-Registered $id for $email (sign-in verified) — usable immediately.
+Registered $id for $got (sign-in verified) — usable immediately.
 Optional:
   claude-accounts verify       # confirm the 100% matrix
 EOF
 }
 
+add_cleanup_reserved() {
+  # EXIT trap for cmd_add: remove a reserved-but-uncommitted account dir (and, in case
+  # we died mid-critical-section, release the lock).
+  [ -n "${RESERVED_DIR:-}" ] && rm -rf "$RESERVED_DIR" 2>/dev/null
+  mutate_unlock 2>/dev/null || true
+}
+
 cmd_import() {
   require_manifest
   local email="${1:-}"
@@ -393,6 +408,70 @@ cmd_import() {
   [ "$no_sync" = "1" ] || auto_sync
 }
 
+# Prints duplicate account ids to REMOVE, one per line: for every email that appears
+# more than once, keep exactly one (prefer an account that has auth on this machine,
+# then the lowest id) and list the rest. Empty output => pool is already clean.
+dup_ids_to_remove() {
+  [ -f "$MANIFEST" ] || return 0
+  "$PYBIN" - "$MANIFEST" "$ACC_ROOT" <<'PYEOF' 2>/dev/null
+import json, os, re, sys
+manifest, root = sys.argv[1], sys.argv[2]
+accts = [a for a in json.load(open(manifest)).get('accounts', [])
+         if isinstance(a, dict) and re.fullmatch(r'acct-\d{2}', str(a.get('id', '')))]
+def has_auth(aid):
+    d = os.path.join(root, aid)
+    c = os.path.join(d, '.credentials.json')
+    t = os.path.join(d, 'server.token')
+    return (os.path.isfile(c) and os.path.getsize(c) > 0) or (os.path.isfile(t) and os.path.getsize(t) > 0)
+by_email = {}
+for a in accts:
+    by_email.setdefault(a.get('email', '').lower(), []).append(a['id'])
+for email, ids in by_email.items():
+    if len(ids) < 2:
+        continue
+    # keep: authed first, then lowest id
+    keep = sorted(ids, key=lambda i: (not has_auth(i), i))[0]
+    for i in ids:
+        if i != keep:
+            print(i)
+PYEOF
+}
+
+cmd_dedupe() {
+  require_manifest
+  local yes=0
+  [ "${1:-}" = "--yes" ] && yes=1
+  local dups
+  dups="$(dup_ids_to_remove)"
+  if [ -z "$dups" ]; then
+    echo "No duplicate accounts — every email appears once."
+    return 0
+  fi
+  echo "Duplicate accounts (same email registered more than once):"
+  local id email
+  for id in $dups; do
+    email="$("$PYBIN" - "$MANIFEST" "$id" <<'PYEOF'
+import json, sys
+for a in json.load(open(sys.argv[1])).get('accounts', []):
+    if a.get('id') == sys.argv[2]: print(a.get('email', '')); break
+PYEOF
+)"
+    echo "  will remove $id ($email)"
+  done
+  if [ "$yes" != "1" ]; then
+    printf 'Remove these duplicates (keeps one per email)? [y/N] '
+    read -r ans
+    case "$ans" in y|Y|yes) ;; *) echo "aborted"; return 1 ;; esac
+  fi
+  for id in $dups; do
+    if [ -L "$ACC_ROOT/$id" ]; then rm -f "${ACC_ROOT:?}/${id:?}"; else rm -rf "${ACC_ROOT:?}/${id:?}"; fi
+    manifest_del_account "$id"
+    log_to ops.log "dedupe removed $id"
+  done
+  echo "Removed $(printf '%s\n' "$dups" | grep -c .) duplicate account(s)."
+  auto_sync
+}
+
 cmd_adopt() {
   # Make <acct-NN> THIS machine's existing default login (~/.claude) without
   # forking its OAuth grant: the account dir becomes a symlink to ~/.claude, so
@@ -1165,6 +1244,7 @@ case "${1:-help}" in
   add) shift; cmd_add "$@" ;;
   import) shift; cmd_import "$@" ;;
   adopt) shift; cmd_adopt "$@" ;;
+  dedupe) shift; cmd_dedupe "$@" ;;
   remove) shift; cmd_remove "$@" ;;
   mint) shift; cmd_mint "$@" ;;
   login) shift; cmd_login "$@" ;;

package/lib/common.sh

@@ -188,6 +188,34 @@ PYEOF
   fi
 }
 
+# Short-lived mutation lock: serialize only the brief critical sections (id reservation,
+# manifest write), NOT long interactive work like a browser sign-in — so several
+# `add`/`login` in different terminals run in parallel and only briefly wait on each other.
+# Held for milliseconds; a lock older than 30s is assumed abandoned (holder died) and reclaimed.
+MUTATE_LOCK_HELD=0
+mutate_lock() {
+  local lock="$ACC_ROOT/.locks/mutate" tries=0
+  mkdir -p "$ACC_ROOT/.locks" 2>/dev/null
+  while ! mkdir "$lock" 2>/dev/null; do
+    if [ $(( $(epoch_now) - $(file_mtime "$lock") )) -gt 30 ]; then
+      rm -rf "$lock" 2>/dev/null
+      continue
+    fi
+    tries=$((tries + 1))
+    [ "$tries" -gt 600 ] && return 1   # ~60s ceiling; contention should clear in ms
+    sleep 0.1
+  done
+  MUTATE_LOCK_HELD=1
+  return 0
+}
+# Only removes the lock dir when THIS process holds it — so a normal release, or a
+# cleanup trap firing after release, can never delete a lock a parallel process just took.
+mutate_unlock() {
+  [ "${MUTATE_LOCK_HELD:-0}" = 1 ] || return 0
+  rm -rf "$ACC_ROOT/.locks/mutate" 2>/dev/null
+  MUTATE_LOCK_HELD=0
+}
+
 rotate_log() { # keep logs bounded: rotate_log <file-in-acc-root> (keeps last ~256KB)
   local f="$ACC_ROOT/$1"
   [ -f "$f" ] || return 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "Multi-account addon for Claude Code: every claude / claude -p runs under a randomly-picked subscription account with the most usage headroom. Mirrors to a deploy server. No API keys.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -353,11 +353,13 @@ check "remove account" "Removed acct-04" "$out"
 [ ! -d "$ACC/acct-04" ] && t_ok "remove deleted dir" || t_fail "remove deleted dir" "dir still there"
 
 # ---- 15b. duplicate-email guards ------------------------------------------------
+# add of a named, already-present email => graceful SKIP before any sign-in (exit 0)
 out="$(claude-accounts add a@test 2>&1)"
 rc=$?
-check "add refuses duplicate email" "already registered as acct-01" "$out"
-[ "$rc" != "0" ] && t_ok "duplicate add exits nonzero" || t_fail "duplicate add rc" "rc=0"
+check "add skips a duplicate email with a message" "already added as acct-01 — skipping" "$out"
+[ "$rc" = "0" ] && t_ok "duplicate add exits 0 (graceful skip)" || t_fail "duplicate add rc" "rc=$rc"
 [ ! -d "$ACC/acct-04" ] && t_ok "duplicate add created nothing" || t_fail "duplicate add" "dir created"
+# import stays strict (it's the lower-level command): refuses a duplicate
 out="$(claude-accounts import a@test --id acct-09 --no-sync 2>&1)"
 rc=$?
 check "import refuses duplicate email" "already registered as acct-01" "$out"
@@ -391,8 +393,8 @@ claude-accounts remove acct-04 --yes >/dev/null 2>&1
 # add with no email, but the signed-in email is already registered => refuse + clean up
 out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=a@test claude-accounts add 2>&1)"
 rc=$?
-check "email-less add refuses a duplicate signed-in email" "already registered as acct-01" "$out"
-[ "$rc" != "0" ] && t_ok "email-less duplicate exits nonzero" || t_fail "email-less dup rc" "rc=0"
+check "email-less add skips a duplicate signed-in email" "a@test is already added as acct-01 — skipping" "$out"
+[ "$rc" = "0" ] && t_ok "email-less duplicate skip exits 0" || t_fail "email-less dup rc" "rc=$rc"
 [ ! -d "$ACC/acct-04" ] && t_ok "email-less duplicate cleaned up" || t_fail "email-less dup cleanup" "dir left"
 # add with no email but identity can't be read back => refuse (can't label the account)
 out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_AUTH_FAIL=1 claude-accounts add 2>&1)"
@@ -422,7 +424,8 @@ check "aborted --token add detected" "sign-in failed or aborted" "$out"
 # ---- 15e. sign-in as an already-registered email is rejected + cleaned ---------------
 out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=a@test claude-accounts add brand@test 2>&1)"
 rc=$?
-check "wrong-account sign-in rejected" "already registered as acct-01" "$out"
+check "wrong-account sign-in skips (already added)" "a@test is already added as acct-01 — skipping" "$out"
+[ "$rc" = "0" ] && t_ok "wrong-account skip exits 0" || t_fail "wrong-account rc" "rc=$rc"
 [ ! -d "$ACC/acct-04" ] && t_ok "wrong-account sign-in cleaned up" || t_fail "wrong-account cleanup" "dir left behind"
 
 # ---- 15f. login command completes auth for an existing auth-less account -------------
@@ -440,6 +443,62 @@ check "login --token saves a portable token" "acct-08 token saved" "$out"
 [ -s "$ACC/acct-08/server.token" ] && t_ok "login --token writes server.token" || t_fail "login token" "missing"
 claude-accounts remove acct-08 --yes >/dev/null 2>&1
 
+# ---- 15g. parallel adds (different terminals) get distinct ids, no lock-busy error ----
+( CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=par1@test claude-accounts add >"$WORK/p1.out" 2>&1 ) &
+pA=$!
+( CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=par2@test claude-accounts add >"$WORK/p2.out" 2>&1 ) &
+pB=$!
+wait "$pA"; wait "$pB"
+both="$(cat "$WORK/p1.out" "$WORK/p2.out" 2>/dev/null)"
+printf '%s' "$both" | grep -q "in progress" \
+  && t_fail "parallel add: no lock-busy error" "got the 'another add in progress' error" \
+  || t_ok "parallel add: neither reports 'another add in progress'"
+regA="$(claude-accounts list 2>&1 | grep par1@test | awk '{print $1}')"
+regB="$(claude-accounts list 2>&1 | grep par2@test | awk '{print $1}')"
+{ [ -n "$regA" ] && [ -n "$regB" ] && [ "$regA" != "$regB" ]; } \
+  && t_ok "parallel add: both registered on distinct ids ($regA, $regB)" \
+  || t_fail "parallel add ids" "regA=$regA regB=$regB"
+# and no duplicate/second entry crept in for either email
+{ [ "$(claude-accounts list 2>&1 | grep -c par1@test)" = "1" ] && [ "$(claude-accounts list 2>&1 | grep -c par2@test)" = "1" ]; } \
+  && t_ok "parallel add: exactly one entry per email" || t_fail "parallel add dup" "duplicate created"
+[ -n "$regA" ] && claude-accounts remove "$regA" --yes >/dev/null 2>&1
+[ -n "$regB" ] && claude-accounts remove "$regB" --yes >/dev/null 2>&1
+
+# ---- 15h. two parallel adds signing into the SAME email: exactly one wins ------------
+( CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=same@test claude-accounts add >"$WORK/s1.out" 2>&1 ) &
+sA=$!
+( CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=same@test claude-accounts add >"$WORK/s2.out" 2>&1 ) &
+sB=$!
+wait "$sA"; wait "$sB"
+n="$(claude-accounts list 2>&1 | grep -c same@test)"
+[ "$n" = "1" ] && t_ok "same-email parallel add: exactly one registered (other skipped)" \
+  || t_fail "same-email parallel add" "count=$n (expected 1)"
+cat "$WORK/s1.out" "$WORK/s2.out" 2>/dev/null | grep -q "already added as\|skipping" \
+  && t_ok "same-email parallel add: loser skipped gracefully" || t_fail "same-email skip msg" "no skip message"
+regS="$(claude-accounts list 2>&1 | grep same@test | awk '{print $1}')"
+[ -n "$regS" ] && claude-accounts remove "$regS" --yes >/dev/null 2>&1
+
+# ---- 15i. dedupe removes accounts registered twice (keeps one per email) --------------
+out="$(claude-accounts dedupe 2>&1)"
+check "dedupe on a clean pool is a no-op" "No duplicate accounts" "$out"
+# manufacture a duplicate directly in the manifest (a pre-fix leftover) + a dir for it
+claude-accounts import twin@test --id acct-06 --creds "$WORK/import-creds.json" --mode copy --no-sync >/dev/null 2>&1
+python3 - "$ACC/accounts.json" <<'EOF'
+import json, os, sys
+d = json.load(open(sys.argv[1]))
+d['accounts'].append({'id': 'acct-07', 'email': 'twin@test', 'home': 'mac'})
+json.dump(d, open(sys.argv[1] + '.tmp', 'w'), indent=2); os.replace(sys.argv[1] + '.tmp', sys.argv[1])
+EOF
+mkdir -p "$ACC/acct-07"
+out="$(claude-accounts list 2>&1)"
+check "list warns about a duplicate email" "twin@test is registered 2x" "$out"
+out="$(claude-accounts dedupe --yes 2>&1)"
+check "dedupe reports removal" "Removed 1 duplicate" "$out"
+[ "$(claude-accounts list 2>&1 | grep -c twin@test)" = "1" ] && t_ok "dedupe keeps exactly one per email" || t_fail "dedupe count" "not 1"
+# it kept the authed one (acct-06 has creds), removed the bare acct-07
+claude-accounts list 2>&1 | grep -q "acct-06.*twin@test" && t_ok "dedupe kept the authenticated account" || t_fail "dedupe keep-authed" "kept the wrong one"
+claude-accounts remove acct-06 --yes >/dev/null 2>&1
+
 # ---- 16. CLI: limits marking via fixture endpoint ------------------------------
 cat > "$WORK/usage-high.json" <<'EOF'
 {"limits":[