claude-multiacc 1.0.4 → 1.0.6

package/bin/claude-accounts

@@ -1,7 +1,11 @@
 #!/usr/bin/env bash
 # claude-accounts — manage the claude-multiacc account pool.
 # Subcommands: list status add import remove mint sync verify limits post-sync health
+#              expired relogin
 set -u
+# lib/audit.py is imported by several subcommands; keep the install tree free of
+# __pycache__ (it may be root-owned, read-only, or an npm global prefix).
+export PYTHONDONTWRITEBYTECODE=1
 
 _self="$0"
 while [ -L "$_self" ]; do
@@ -29,6 +33,14 @@ USAGE
       recent sign-in — use it when you want the account usable on the server too).
   claude-accounts login <acct-NN> [--token] [--force]
       complete/refresh auth for an existing account (full login, or --token)
+  claude-accounts expired [--quiet]
+      which accounts CANNOT authenticate (expired refresh token, revoked grant, no
+      login on this machine) and why. These are excluded from selection — `claude`
+      never runs under them. Exits 1 when any account needs a human. --quiet prints
+      bare ids for scripts.
+  claude-accounts relogin [acct-NN ...] [--all] [--token] [--yes]
+      sign in again, one account at a time. With no arguments it re-authenticates
+      exactly what `expired` lists; --all covers every account. Syncs once at the end.
   claude-accounts import <email> [opts]     register an account, optionally with credentials
       --id acct-NN          explicit id (default: next free)
       --home mac|server     which machine owns the OAuth grant (default: this one)
@@ -47,8 +59,11 @@ USAGE
   claude-accounts sync                      push manifest+tokens to the server (Mac only)
   claude-accounts verify [--quick]          auth matrix; full mode runs `-p "reply OK"` per account
   claude-accounts limits [--quiet] [--force]
-      refresh usage buckets, apply >=90% markers. Skips accounts fetched in the
-      last 45s and honors 429 backoff; --force ignores both.
+      refresh usage buckets, apply >=90% markers. Auto-refreshes long-expired
+      OAuth access tokens via the refresh-token grant (rotated credential is
+      persisted), so idle accounts keep fresh telemetry and stay selectable.
+      Skips accounts fetched in the last 45s and honors 429/refresh backoff;
+      --force ignores all three.
   claude-accounts health                    limits + full verify; logs to health.log
   claude-accounts self-update               update the addon (npm i -g @latest, or git
                                             pull + reinstall); logs to update.log
@@ -133,10 +148,13 @@ auto_sync() { # best effort after mutations, Mac only, loud on failure
 
 cmd_list() {
   require_manifest
-  "$PYBIN" - "$MANIFEST" "$ACC_ROOT" <<'PYEOF'
+  "$PYBIN" - "$MANIFEST" "$ACC_ROOT" "$LIB_DIR" "$(machine_kind)" <<'PYEOF'
 import json, os, re, sys
 doc = json.load(open(sys.argv[1]))
 root = sys.argv[2]
+sys.path = [sys.argv[3]] + [p for p in sys.path if p not in ('', '.')]
+from audit import audit_account   # noqa: E402  (shared with the shim's rule)
+machine = sys.argv[4]
 # Only render well-formed ids — a hand-edited manifest must not surface a traversal id.
 accounts = [a for a in doc.get('accounts', [])
             if isinstance(a, dict) and re.fullmatch(r'acct-\d{2}', str(a.get('id', '')))]
@@ -150,7 +168,24 @@ for a in accounts:
     if os.path.getsize(os.path.join(d, 'server.token')) > 0 if os.path.isfile(os.path.join(d, 'server.token')) else False:
         auth.append('token')
     limited = os.path.isfile(os.path.join(d, '.limited'))
-    print(f"{a['id']}  {a['email']:<28} home={a.get('home','?'):<7} auth={'+'.join(auth) or 'NONE':<11} {'LIMITED' if limited else ''}")
+    st = audit_account(root, a, machine=machine)
+    flags = []
+    if st['state'] == 'expired':
+        flags.append('EXPIRED-LOGIN')
+    elif st['state'] == 'blocked':
+        flags.append('ORG-BLOCKED')
+    elif st['state'] == 'missing':
+        flags.append('NO-LOGIN')
+    if limited:
+        flags.append('LIMITED')
+    print(f"{a['id']}  {a['email']:<28} home={a.get('home','?'):<7} "
+          f"auth={'+'.join(auth) or 'NONE':<11} {' '.join(flags)}")
+bad = [a for a in accounts
+       if audit_account(root, a, machine=machine)['state']
+       in ('expired', 'blocked', 'missing')]
+if bad:
+    print()
+    print(f"{len(bad)} account(s) are NOT usable — details: claude-accounts expired")
 seen = {}
 for a in accounts:
     seen.setdefault(a.get('email', '').lower(), []).append(a['id'])
@@ -164,10 +199,13 @@ PYEOF
 
 cmd_status() {
   require_manifest
-  "$PYBIN" - "$MANIFEST" "$ACC_ROOT" <<'PYEOF'
+  "$PYBIN" - "$MANIFEST" "$ACC_ROOT" "$LIB_DIR" "$(machine_kind)" <<'PYEOF'
 import json, os, sys, time
 doc = json.load(open(sys.argv[1]))
 root = sys.argv[2]
+sys.path = [sys.argv[3]] + [p for p in sys.path if p not in ('', '.')]
+from audit import audit_account   # noqa: E402  (shared with the shim's rule)
+machine = sys.argv[4]
 now = time.time()
 
 def last_pick(aid):
@@ -189,10 +227,20 @@ print(f"pool root : {root}")
 print(f"server    : {doc.get('server','-')}  (root: {doc.get('server_root','-')})")
 print(f"threshold : {doc.get('threshold', 90)}% (any bucket at/above => account excluded)")
 print()
+needs_login = []
 for a in doc.get('accounts', []):
     aid = a['id']
     d = os.path.join(root, aid)
-    print(f"{aid}  {a['email']}  [home={a.get('home','?')}]")
+    st = audit_account(root, a, machine=machine)
+    if st['state'] in ('expired', 'blocked', 'missing'):
+        needs_login.append(aid)
+    banner = {'ok': '', 'remote': '  [not logged in here — grant lives elsewhere]',
+              'missing': '  ** NO LOGIN — claude-accounts relogin %s **' % aid,
+              'expired': '  ** LOGIN EXPIRED — claude-accounts relogin %s **' % aid,
+              'blocked': '  ** ORG BLOCKED — Claude Code disabled for this account **',
+              }[st['state']]
+    print(f"{aid}  {a['email']}  [home={a.get('home','?')}]{banner}")
+    print(f"  selectable  : {'yes' if st['state'] == 'ok' else 'NO — ' + st['reason']}")
     cpath = os.path.join(d, '.credentials.json')
     if os.path.isfile(cpath):
         try:
@@ -238,6 +286,9 @@ for a in doc.get('accounts', []):
         print("  marker      : none (eligible)")
     print(f"  last picked : {last_pick(aid)}")
     print()
+if needs_login:
+    print(f"{len(needs_login)} account(s) are EXCLUDED from selection: {', '.join(needs_login)}")
+    print("What each one needs: claude-accounts expired")
 PYEOF
 }
 
@@ -328,6 +379,7 @@ cmd_add() {
     warn "signed in as $got (you named $email) — registering the account that actually authenticated"
   fi
   manifest_add_account "$id" "$got" "$(machine_kind)"
+  clear_auth_markers "$d"
   mutate_unlock
   RESERVED_DIR=""            # committed — the trap must not delete it now
   trap - EXIT INT TERM
@@ -637,7 +689,12 @@ TIP
   else
     CLAUDE_CONFIG_DIR="$d" CLAUDE_SHIM_ACTIVE=1 "$real" auth login --claudeai || true
   fi
-  [ -f "$d/.credentials.json" ]
+  # Success is a credential that can AUTHENTICATE — not merely a file that exists.
+  # Re-login targets already have a (dead) .credentials.json on disk, so a bare
+  # existence test would call an aborted sign-in a success, clear the dead-auth
+  # marker, and hand the account straight back to the pool.
+  [ -f "$d/.credentials.json" ] || return 1
+  creds_alive "$d"
 }
 
 cmd_mint() {
@@ -662,6 +719,7 @@ cmd_mint() {
     || die "that is not a subscription setup-token (sk-ant-oat...). API keys are not supported."
   ( umask 077; printf '%s' "$tok" > "$d/server.token" )
   chmod 600 "$d/server.token"
+  clear_auth_markers "$d"
   log_to ops.log "mint $id"
   echo "Token saved to $d/server.token"
   auto_sync
@@ -703,19 +761,159 @@ PYEOF
     fi
     ( umask 077; printf '%s' "$CEREMONY_TOKEN" > "$d/server.token" )
     chmod 600 "$d/server.token"
+    clear_auth_markers "$d"
     echo "$id token saved (portable — works on Mac and server)."
   else
-    run_login_ceremony "$d" "$email" || die "login failed or aborted — nothing changed"
+    run_login_ceremony "$d" "$email" \
+      || die "login failed or aborted (no working credential landed) — nothing changed"
     got="$(config_dir_email "$d")"
     if [ -n "$got" ] && [ "$got" != "$email" ] && [ "$force" != "1" ]; then
       die "you signed in as $got but $id is $email — nothing saved (use --force to override)"
     fi
+    if [ -z "$got" ] && [ "$force" != "1" ]; then
+      die "signed in, but the account identity could not be read back — refusing to call $id fixed (retry, or pass --force)"
+    fi
+    clear_auth_markers "$d"
     echo "$id login saved (.credentials.json, this machine, auto-refreshing)."
   fi
   log_to ops.log "login $id verified=${got:-unverified} mode=$([ "$token" = 1 ] && echo token || echo login)"
   auto_sync
 }
 
+cmd_expired() {
+  # Which accounts CANNOT authenticate right now — the pool's re-login worklist.
+  # Same rule the shim selects by (lib/audit.py), so what is listed here is exactly
+  # what is excluded from selection.
+  require_manifest
+  local quiet=0
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --quiet|--ids) quiet=1; shift ;;   # ids only, for scripts
+      *) die "unknown option: $1 (usage: claude-accounts expired [--quiet])" ;;
+    esac
+  done
+  local rows bad
+  rows="$(account_audit)" || die "the account audit failed — cannot say which logins are dead"
+  if [ -z "$rows" ]; then
+    # No rows at all: either the pool is genuinely empty, or the manifest lost its
+    # accounts. Never render that as "all clear".
+    if [ -z "$(account_ids)" ]; then
+      echo "No accounts registered yet — add one with: claude-accounts add"
+      return 0
+    fi
+    die "the manifest lists accounts but none could be audited — check $MANIFEST"
+  fi
+  bad="$(printf '%s\n' "$rows" | awk -F'\t' 'NF >= 4 && $1 != "" && ($4 == "expired" || $4 == "blocked" || $4 == "missing") { print $1 }')"
+  if [ "$quiet" = "1" ]; then
+    [ -n "$bad" ] || return 0
+    printf '%s\n' "$bad"
+    return 1
+  fi
+  printf '%s\n' "$rows" | awk -F'\t' '
+    BEGIN { bad = 0; ok = 0; remote = 0; relogin = 0 }
+    NF < 4 || $1 == "" { next }          # never invent an account from a blank line
+    $4 == "ok"     { ok++; next }
+    $4 == "remote" { remote++; rem = rem sprintf("  %-9s %-28s %s\n", $1, $2, $6); next }
+    {
+      bad++
+      relogin++
+      printf "  %-9s %-28s %-9s %s\n", $1, $2, $5, $6
+      printf "  %-9s %-28s %-9s fix: %s\n", "", "", "", $7
+    }
+    END {
+      if (bad == 0) printf "All %d account(s) with a login on this machine can authenticate.\n", ok
+      else printf "\n%d account(s) cannot be used, %d fine.\n", bad, ok
+      if (remote > 0) {
+        printf "\nNot logged in here on purpose (another machine owns the grant):\n"
+        printf "%s", rem
+      }
+      if (relogin > 0) {
+        printf "\nRe-authenticate them:\n"
+        printf "  claude-accounts relogin            # every account that needs it\n"
+        printf "  claude-accounts relogin acct-NN    # just one\n"
+      }
+    }'
+  # Exit 1 when something needs a human, so cron/health checks can alert on it.
+  [ -z "$bad" ]
+}
+
+cmd_relogin() {
+  # Re-authenticate accounts whose login died. With no arguments it targets exactly
+  # what `expired` lists; ids (or --all) override that. Runs the same verified login
+  # ceremony as `login`, one account at a time, and syncs ONCE at the end.
+  require_manifest
+  local all=0 yes=0 token=0 ids=""
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --all) all=1; shift ;;
+      --yes|-y) yes=1; shift ;;
+      --token) token=1; shift ;;
+      --*) die "unknown option: $1" ;;
+      *)
+        valid_acct_id "$1" || die "not a valid account id: $1"
+        account_ids | grep -qx "$1" || die "unknown account: $1"
+        ids="$ids $1"; shift ;;
+    esac
+  done
+  if [ -n "$ids" ] && [ "$all" = "1" ]; then
+    die "give account ids OR --all, not both"
+  fi
+  if [ -z "$ids" ]; then
+    if [ "$all" = "1" ]; then
+      ids="$(account_ids | tr '\n' ' ')"
+    else
+      # Only what a sign-in can actually fix — org-blocked accounts are listed by
+      # `expired` but signing into them again would fail exactly the same way.
+      # A FAILED audit must not read as "nothing to do".
+      account_audit >/dev/null || die "the account audit failed — refusing to guess what needs a re-login"
+      ids="$(accounts_needing_login | tr '\n' ' ')"
+    fi
+  fi
+  ids="$(printf '%s' "$ids" | tr -s ' ' | sed 's/^ //; s/ $//')"
+  if [ -z "$ids" ]; then
+    echo "Nothing to re-authenticate — every account on this machine can be used."
+    return 0
+  fi
+  local count rows
+  count="$(printf '%s\n' "$ids" | tr ' ' '\n' | grep -c .)"
+  rows="$(account_audit)"
+  echo "Accounts to re-authenticate ($count):"
+  local id
+  for id in $ids; do
+    printf '  %s  %s\n' "$id" \
+      "$(printf '%s\n' "$rows" | awk -F'\t' -v i="$id" '$1 == i { print $2 "  (" $5 ")" }')"
+  done
+  if [ "$yes" != "1" ]; then
+    if [ ! -t 0 ]; then
+      die "relogin is interactive (each account needs a browser sign-in) — run it from a terminal, or pass --yes"
+    fi
+    printf 'Sign in to each of them now? [y/N] '
+    read -r ans
+    case "$ans" in y|Y|yes) ;; *) echo "aborted"; return 1 ;; esac
+  fi
+  # One sync at the end instead of one per account: each auto_sync is an ssh round trip.
+  local prev_no_sync="${CLAUDE_MULTIACC_NO_SYNC:-0}" failed="" done_ok=0
+  export CLAUDE_MULTIACC_NO_SYNC=1
+  for id in $ids; do
+    echo
+    echo "=== $id ==============================================================="
+    if [ "$token" = "1" ]; then
+      ( cmd_login "$id" --token ) && done_ok=$((done_ok + 1)) || failed="$failed $id"
+    else
+      ( cmd_login "$id" ) && done_ok=$((done_ok + 1)) || failed="$failed $id"
+    fi
+  done
+  export CLAUDE_MULTIACC_NO_SYNC="$prev_no_sync"
+  [ "$prev_no_sync" = "0" ] && unset CLAUDE_MULTIACC_NO_SYNC
+  echo
+  echo "re-authenticated $done_ok of $count account(s)."
+  if [ -n "$failed" ]; then
+    warn "still failing:$failed (re-run: claude-accounts relogin$failed)"
+  fi
+  [ "$done_ok" -gt 0 ] && auto_sync
+  [ -z "$failed" ]
+}
+
 cmd_limits() {
   require_manifest
   local quiet=0 force=0
@@ -740,24 +938,9 @@ cmd_limits() {
   # shellcheck disable=SC2064
   trap "rm -rf '$lock'" EXIT
   rotate_log limits.log
-  # Expired-bearer self-heal: on a quiet machine nothing refreshes OAuth creds,
-  # which would silently stall limits telemetry (fail-open keeps selection working,
-  # but data goes stale). `claude auth status` refreshes creds without inference.
-  local real="" d
-  real="$(find_real_claude "$_self" 2>/dev/null)" || real=""
-  if [ -n "$real" ]; then
-    for d in "$ACC_ROOT"/acct-*; do
-      [ -d "$d" ] || continue
-      [ -f "$d/.credentials.json" ] || continue
-      [ -s "$d/server.token" ] && continue
-      if "$PYBIN" -c '
-import json, sys, time
-c = json.load(open(sys.argv[1])).get("claudeAiOauth", {})
-sys.exit(0 if c.get("expiresAt", 0) / 1000.0 <= time.time() + 60 else 1)' "$d/.credentials.json" 2>/dev/null; then
-        CLAUDE_CONFIG_DIR="$d" CLAUDE_SHIM_ACTIVE=1 "$real" auth status >/dev/null 2>&1 || true
-      fi
-    done
-  fi
+  # NB: expired OAuth access tokens are refreshed inside the Python below via the
+  # refresh-token grant. (`claude auth status` was tried for this and does NOT
+  # refresh credentials — it only reports the on-disk state.)
   # The >=90% exclusion rule is a hard requirement: the manifest may tighten it but
   # never loosen it, or an account could sit at 95% and still be selected.
   local threshold
@@ -773,6 +956,21 @@ now = time.time()
 # Don't re-fetch an account whose data is younger than this (endpoint rate-limits).
 MIN_FETCH_INTERVAL = int(os.environ.get('CLAUDE_MULTIACC_MIN_FETCH', '45'))
 
+# OAuth refresh-token grant — the same endpoint + public client id Claude Code
+# itself uses to keep .credentials.json alive. An account that sits idle past its
+# access-token TTL would otherwise drop out of telemetry forever (stale data ranks
+# neutral, so truly-idle accounts lose selection to busy-but-fresh ones).
+TOKEN_URL = os.environ.get('CLAUDE_MULTIACC_TOKEN_URL',
+                           'https://console.anthropic.com/v1/oauth/token')
+CLIENT_ID = os.environ.get('CLAUDE_MULTIACC_CLIENT_ID',
+                           '9d1c250a-e61b-44d9-88ed-5944d1962f5e')
+# Only refresh a token that has been expired for a while: a LIVE session refreshes
+# its own credential within moments of expiry, so a long-expired one proves no
+# other writer is active (refresh tokens rotate; two racing refreshers strand one).
+REFRESH_MIN_EXPIRED = 300
+REFRESH_FAIL_BACKOFF = 600     # transient (network/5xx/429): retry in 10 min
+REFRESH_DENIED_BACKOFF = 21600  # 4xx = grant likely revoked: 6h; re-login needed anyway
+
 def say(msg):
     if not quiet:
         print(msg)
@@ -788,39 +986,179 @@ def parse_iso(s):
     except Exception:
         return None
 
+# `.expired` — the persistent "this account cannot authenticate" marker the shim
+# honors. Written only for a PROVEN dead grant (expired/absent refresh token, or a
+# 4xx from the refresh endpoint), never for a transient network/5xx/429 hiccup.
+def mark_expired(d, slug, detail=''):
+    mpath = os.path.join(d, '.expired')
+    try:
+        with open(mpath + '.tmp', 'w') as f:
+            f.write(f'{int(now)}\n')
+            f.write(f"reason={slug} marked_at="
+                    f"{time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())} detail={detail}\n")
+        os.replace(mpath + '.tmp', mpath)
+    except Exception:
+        pass
+
+def clear_expired(d):
+    """A usage fetch that succeeded PROVES the bearer works — drop any dead-auth mark.
+    EXCEPT an org-blocked one: those accounts authenticate perfectly (telemetry works),
+    they are just barred from Claude Code inference, so telemetry says nothing about
+    them. Only a passing `verify` (a real call) or a re-login lifts that."""
+    mpath = os.path.join(d, '.expired')
+    try:
+        if 'reason=org-blocked' in open(mpath, errors='replace').read():
+            return False
+    except OSError:
+        return False
+    try:
+        os.remove(mpath)
+        return True
+    except OSError:
+        return False
+
 try:
     manifest = json.load(open(os.path.join(root, 'accounts.json')))
 except Exception as e:
     sys.exit(f'cannot read manifest: {e}')
 
+def refresh_oauth(aid, d, cpath):
+    """Refresh a long-expired OAuth access token via the refresh-token grant and
+    persist the ROTATED credential atomically (0600). Returns the new bearer, or
+    None (fail open: the on-disk credential is never touched on failure).
+    Failures back off via <dir>/.oauth-refresh.json — a side file, NOT limits.json,
+    because telemetry state must only ever reflect real usage fetches."""
+    spath = os.path.join(d, '.oauth-refresh.json')
+    try:
+        doc = json.load(open(cpath))
+        o = doc.get('claudeAiOauth', {})
+        # Present-but-null/non-object claudeAiOauth (interrupted or reset credential
+        # write) must degrade THIS account only, like every other malformed input.
+        if not isinstance(doc, dict) or not isinstance(o, dict):
+            return None
+    except Exception:
+        return None
+    if not o.get('accessToken'):
+        return None
+    if not o.get('refreshToken'):
+        mark_expired(d, 'no-refresh-token',
+                     'credential has no refresh token and its access token expired')
+        return None
+    if o.get('expiresAt', 0) / 1000.0 > now - REFRESH_MIN_EXPIRED:
+        return None  # not expired long enough to prove no live session owns it
+    if o.get('refreshTokenExpiresAt', 0) / 1000.0 <= now:
+        # Nothing can revive this account: park it so the shim stops selecting it
+        # (every run under it would fail with "OAuth session expired").
+        mark_expired(d, 'refresh-token-expired',
+                     'the refresh token itself expired; only a re-login can fix it')
+        say(f'{aid}: refresh token expired — re-login needed (claude-accounts relogin {aid})')
+        return None
+    if not force:
+        try:
+            if json.load(open(spath)).get('retry_after', 0) > now:
+                return None  # earlier refresh failure still backing off
+        except Exception:
+            pass
+
+    def back_off(wait, why, denials=0):
+        try:
+            with open(spath + '.tmp', 'w') as f:
+                json.dump({'retry_after': int(now + wait), 'error': why,
+                           'denials': denials,
+                           'at': time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())}, f)
+            os.replace(spath + '.tmp', spath)
+        except Exception:
+            pass
+        say(f'{aid}: oauth refresh failed ({why}); backing off {wait}s; limits left as-is')
+
+    body = json.dumps({'grant_type': 'refresh_token',
+                       'refresh_token': o['refreshToken'],
+                       'client_id': CLIENT_ID}).encode()
+    req = urllib.request.Request(TOKEN_URL, data=body, headers={
+        'Content-Type': 'application/json',
+        'User-Agent': 'claude-multiacc/1.0',
+    })
+    try:
+        data = json.loads(urllib.request.urlopen(req, timeout=30).read().decode())
+    except urllib.error.HTTPError as e:
+        if e.code in (400, 401, 403):
+            # A 4xx from the TOKEN endpoint is only proof of a dead grant when the
+            # server says so (OAuth's invalid_grant). Everything else 4xx — a bad
+            # client_id, an endpoint change, a WAF page, a provider incident — would
+            # hit EVERY account at once, so it must never park the whole pool on the
+            # first try: back off, and only park after this account has been refused
+            # repeatedly.
+            body = ''
+            try:
+                body = e.read().decode('utf-8', 'replace')[:400]
+            except Exception:
+                pass
+            denials = 1
+            try:
+                denials = int(json.load(open(spath)).get('denials', 0)) + 1
+            except Exception:
+                pass
+            if 'invalid_grant' in body:
+                mark_expired(d, f'refresh-denied-http-{e.code}',
+                             'the refresh grant was refused as invalid_grant (revoked or rotated away)')
+            elif denials >= 3:
+                mark_expired(d, f'refresh-denied-http-{e.code}',
+                             f'the refresh grant was refused {denials} times in a row')
+            back_off(REFRESH_DENIED_BACKOFF,
+                     f'HTTP {e.code} — refresh token may be revoked; re-login needed',
+                     denials=denials)
+        else:
+            back_off(REFRESH_FAIL_BACKOFF, f'HTTP {e.code}')
+        return None
+    except Exception as e:
+        back_off(REFRESH_FAIL_BACKOFF, str(e)[:200])
+        return None
+    tok = data.get('access_token') if isinstance(data, dict) else None
+    if not tok:
+        back_off(REFRESH_DENIED_BACKOFF, 'no access_token in response')
+        return None
+    o['accessToken'] = tok
+    # The grant ROTATES the refresh token: persist it (and both expiries) or the
+    # account is stranded — hence atomic write, and a loud message if it fails.
+    if data.get('refresh_token'):
+        o['refreshToken'] = data['refresh_token']
+    if data.get('expires_in'):
+        o['expiresAt'] = int((now + float(data['expires_in'])) * 1000)
+    else:
+        # No expires_in in the response: assume a conservative 1h. Leaving the old
+        # (past) expiresAt would make every later pass re-run the grant in a loop.
+        o['expiresAt'] = int((now + 3600) * 1000)
+    if data.get('refresh_token_expires_in'):
+        o['refreshTokenExpiresAt'] = int((now + float(data['refresh_token_expires_in'])) * 1000)
+    doc['claudeAiOauth'] = o
+    try:
+        fd = os.open(cpath + '.tmp', os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+        with os.fdopen(fd, 'w') as f:
+            json.dump(doc, f)
+        os.replace(cpath + '.tmp', cpath)
+    except Exception as e:
+        say(f'{aid}: token refreshed but credentials NOT persisted ({e}) — re-login may be needed')
+        return None
+    try:
+        os.remove(spath)
+    except OSError:
+        pass
+    # The grant answered: whatever parked this account before, it authenticates now.
+    if clear_expired(d):
+        say(f'{aid}: dead-auth marker cleared (refresh grant works again)')
+    say(f'{aid}: oauth access token refreshed via refresh-token grant')
+    return tok
+
 for acct in manifest.get('accounts', []):
     aid = acct['id']
     d = os.path.join(root, aid)
     if not os.path.isdir(d):
         continue
-    bearer = None
-    source = None
-    cpath = os.path.join(d, '.credentials.json')
-    if os.path.isfile(cpath):
-        try:
-            c = json.load(open(cpath)).get('claudeAiOauth', {})
-            if c.get('accessToken') and c.get('expiresAt', 0) / 1000.0 > now + 60:
-                bearer, source = c['accessToken'], 'oauth'
-        except Exception:
-            pass
-    tpath = os.path.join(d, 'server.token')
-    if not bearer and os.path.isfile(tpath):
-        t = open(tpath).read().strip()
-        if t:
-            bearer, source = t, 'token'
-    if not bearer:
-        # Fail OPEN: no usable bearer => leave existing state; never block work on telemetry.
-        say(f'{aid}: no fresh bearer (expired oauth and/or no token); limits left as-is')
-        continue
 
     # The usage endpoint rate-limits per account. Several callers can fire at once
     # (60s cron + the shim's opportunistic kick + a manual run), so skip a fetch when
     # this account's data is already fresh, and honor any backoff a 429 set earlier.
+    # Checked FIRST so a skipped account never burns an oauth refresh for nothing.
     lpath = os.path.join(d, 'limits.json')
     prev = {}
     if os.path.isfile(lpath):
@@ -837,6 +1175,36 @@ for acct in manifest.get('accounts', []):
             say(f'{aid}: backing off after 429 ({int(retry_at - now)}s left); limits left as-is')
             continue
 
+    bearer = None
+    source = None
+    cpath = os.path.join(d, '.credentials.json')
+    if os.path.isfile(cpath):
+        try:
+            c = json.load(open(cpath)).get('claudeAiOauth', {})
+            if c.get('accessToken') and c.get('expiresAt', 0) / 1000.0 > now + 60:
+                bearer, source = c['accessToken'], 'oauth'
+        except Exception:
+            pass
+    tpath = os.path.join(d, 'server.token')
+    if not bearer and os.path.isfile(tpath):
+        t = open(tpath).read().strip()
+        if t:
+            bearer, source = t, 'token'
+    if not bearer and os.path.isfile(cpath):
+        # Hard fail-open guard: NOTHING a single account's refresh does may abort
+        # the loop — every account after it would silently starve of telemetry.
+        try:
+            tok = refresh_oauth(aid, d, cpath)
+        except Exception as e:
+            say(f'{aid}: oauth refresh failed unexpectedly ({str(e)[:200]}); failing open')
+            tok = None
+        if tok:
+            bearer, source = tok, 'oauth'
+    if not bearer:
+        # Fail OPEN: no usable bearer => leave existing state; never block work on telemetry.
+        say(f'{aid}: no fresh bearer (expired oauth and/or no token); limits left as-is')
+        continue
+
     req = urllib.request.Request(url, headers={
         'Authorization': 'Bearer ' + bearer,
         'anthropic-beta': 'oauth-2025-04-20',
@@ -958,6 +1326,9 @@ for acct in manifest.get('accounts', []):
     with open(tmp, 'w') as f:
         json.dump(out, f, indent=1)
     os.replace(tmp, lpath)
+    # The fetch went through with this account's own bearer => its auth is alive.
+    if clear_expired(d):
+        say(f'{aid}: dead-auth marker cleared (authenticated successfully)')
     offenders = [b for b in buckets if b['percent'] >= threshold]
     mpath = os.path.join(d, '.limited')
     if offenders:
@@ -1000,15 +1371,40 @@ cmd_verify() {
   if [ "$quick" = "0" ]; then
     real="$(find_real_claude "$_self")" || die "real claude binary not found"
   fi
-  "$PYBIN" - "$ACC_ROOT" "$quick" "$real" <<'PYEOF'
-import json, os, subprocess, sys, time
+  "$PYBIN" - "$ACC_ROOT" "$quick" "$real" "$LIB_DIR" "$(machine_kind)" <<'PYEOF'
+import json, os, re, subprocess, sys, time
 
 root, quick, real = sys.argv[1], sys.argv[2] == '1', sys.argv[3]
+sys.path = [sys.argv[4]] + [p for p in sys.path if p not in ('', '.')]
+from audit import audit_account, creds_state   # noqa: E402  (shared with the shim's rule)
+machine = sys.argv[5]
 now = time.time()
 manifest = json.load(open(os.path.join(root, 'accounts.json')))
 failures = 0
 tested = 0
 
+# Same failure vocabulary the shim retries on (bin/claude: AUTHPAT / ORGPAT).
+AUTH_ERR = re.compile(
+    r'401|403|unauthorized|authentication[_ ]error|invalid[_ ](bearer|token|api key)'
+    r'|token (expired|revoked|invalid)|oauth.*(error|expired|invalid)|session expired'
+    r'|could not be refreshed|please (run|sign in|log ?in)|re-?authenticate', re.I)
+ORG_ERR = re.compile(
+    r'organization has disabled|subscription access.*disabl|disabled claude subscription'
+    r'|ask your admin to enable|not authorized to use claude code', re.I)
+
+def mark_expired(d, slug, detail=''):
+    """Park an account the shim must stop selecting. Verify is the strongest signal
+    there is — a real inference call that came back 'not authenticated'."""
+    mpath = os.path.join(d, '.expired')
+    try:
+        with open(mpath + '.tmp', 'w') as f:
+            f.write(f'{int(time.time())}\n')
+            f.write(f"reason={slug} marked_at="
+                    f"{time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())} detail={detail}\n")
+        os.replace(mpath + '.tmp', mpath)
+    except Exception:
+        pass
+
 for acct in manifest.get('accounts', []):
     aid = acct['id']
     d = os.path.join(root, aid)
@@ -1024,8 +1420,11 @@ for acct in manifest.get('accounts', []):
         try:
             c = json.load(open(cpath)).get('claudeAiOauth', {})
             rexp = c.get('refreshTokenExpiresAt', 0) / 1000.0
-            if rexp and rexp < now:
-                print(f'{aid} {acct["email"]}: FAIL (refresh token expired — re-login)')
+            if rexp and rexp < now and not has_token:
+                mark_expired(d, 'refresh-token-expired',
+                             'the refresh token itself expired; only a re-login can fix it')
+                print(f'{aid} {acct["email"]}: FAIL (refresh token expired — '
+                      f'run: claude-accounts relogin {aid})')
                 failures += 1
                 continue
         except Exception as e:
@@ -1033,8 +1432,16 @@ for acct in manifest.get('accounts', []):
             failures += 1
             continue
     if quick:
+        # Quick mode must agree with what the shim will actually do — presence of a
+        # credential file is not proof it can authenticate.
+        st = audit_account(root, acct, machine=machine)
         kind = 'oauth' if has_creds else 'token'
-        print(f'{aid} {acct["email"]}: OK (quick, {kind} present)')
+        if st['state'] == 'ok':
+            print(f'{aid} {acct["email"]}: OK (quick, {kind} present)')
+        else:
+            print(f'{aid} {acct["email"]}: FAIL ({st["label"]} — {st["reason"]})'
+                  + (f'; fix: {st["fix"]}' if st['fix'] else ''))
+            failures += 1
         continue
     env = dict(os.environ)
     env['CLAUDE_CONFIG_DIR'] = d
@@ -1042,7 +1449,10 @@ for acct in manifest.get('accounts', []):
     env.pop('CLAUDE_CODE_OAUTH_TOKEN', None)
     env.pop('CLAUDE_ACCOUNT', None)
     env['CLAUDE_SHIM_ACTIVE'] = '1'
-    if not has_creds:
+    # Mirror the shim's acct_token(): a portable token is what actually authenticates
+    # whenever there is no credential OR the credential beside it is dead. Testing such
+    # an account with the dead credential would fail it — and park a healthy account.
+    if has_token and (not has_creds or creds_state(cpath, now)[0] != 'ok'):
         env['CLAUDE_CODE_OAUTH_TOKEN'] = open(tpath).read().strip()
     t0 = time.time()
     try:
@@ -1056,10 +1466,28 @@ for acct in manifest.get('accounts', []):
     dt = time.time() - t0
     out = (r.stdout or '').strip()
     if r.returncode == 0 and 'ok' in out.lower():
+        # A real call succeeded: this account is definitively alive.
+        try:
+            os.remove(os.path.join(d, '.expired'))
+        except OSError:
+            pass
         print(f'{aid} {acct["email"]}: PASS ({dt:.1f}s) -> {out[:60]!r}')
     else:
         err = (r.stderr or '').strip()[:200]
-        print(f'{aid} {acct["email"]}: FAIL rc={r.returncode} out={out[:120]!r} err={err!r}')
+        hint = ''
+        if ORG_ERR.search(out) or ORG_ERR.search(err):
+            # Not an auth problem: the account authenticates fine, its organization
+            # has simply turned Claude Code subscription access off. Park it — a
+            # re-login changes nothing — and say what actually helps.
+            mark_expired(d, 'org-blocked',
+                         "the account's organization has disabled Claude Code access")
+            hint = (f' — ORG BLOCKED, excluded from the pool; '
+                    f'try: claude-accounts relogin {aid}')
+        elif AUTH_ERR.search(out) or AUTH_ERR.search(err):
+            mark_expired(d, 'auth-error', 'a real call came back not-authenticated')
+            hint = f' — login is dead, run: claude-accounts relogin {aid}'
+        print(f'{aid} {acct["email"]}: FAIL rc={r.returncode} '
+              f'out={out[:120]!r} err={err!r}{hint}')
         failures += 1
 
 print()
@@ -1118,8 +1546,12 @@ PYEOF
     ssh -o BatchMode=yes "$server" "mkdir -p '$sroot/$id'" >>"$ACC_ROOT/sync.log" 2>&1 \
       || fail "mkdir $id failed"
     if [ -s "$d/server.token" ]; then
-      rsync -az --chmod=F600 "$d/server.token" "$server:$sroot/$id/" >>"$ACC_ROOT/sync.log" 2>&1 \
+      # NB: no --chmod — macOS 26 ships openrsync, which rejects it (the push would
+      # fail outright). The mode is fixed with an explicit remote chmod instead.
+      rsync -az "$d/server.token" "$server:$sroot/$id/" >>"$ACC_ROOT/sync.log" 2>&1 \
         || fail "token push for $id failed"
+      ssh -o BatchMode=yes "$server" "chmod 600 '$sroot/$id/server.token'" \
+        >>"$ACC_ROOT/sync.log" 2>&1 || fail "token chmod for $id failed"
     fi
     local seed
     for seed in .claude.json settings.json; do
@@ -1248,6 +1680,8 @@ case "${1:-help}" in
   remove) shift; cmd_remove "$@" ;;
   mint) shift; cmd_mint "$@" ;;
   login) shift; cmd_login "$@" ;;
+  expired) shift; cmd_expired "$@" ;;
+  relogin|re-login) shift; cmd_relogin "$@" ;;
   sync) shift; cmd_sync "$@" ;;
   verify) shift; cmd_verify "$@" ;;
   limits) shift; cmd_limits "$@" ;;