claude-multiacc 1.0.4 → 1.0.6

package/lib/audit.py

@@ -0,0 +1,239 @@
+"""Shared account-auth audit — the ONE place that decides whether an account's login
+still works, so `expired`, `relogin`, `list` and `status` can never disagree with the
+shim's selection rule (bin/claude: creds_dead / expired_marked / auth_dead).
+
+States:
+  ok       usable right now (live OAuth credential, or a portable server.token)
+  expired  has auth material that CANNOT authenticate — needs `claude-accounts relogin`
+  blocked  authenticates, but its organization has disabled Claude Code subscription
+           access — a re-login cannot fix it, so it needs an admin (or removal)
+  missing  no auth on this machine, and this machine is supposed to own the grant
+  remote   no auth here, but the manifest says another machine owns it (informational)
+
+Only 'ok' accounts are selectable; everything else is excluded by the shim.
+
+Run directly for a TSV dump:  python3 lib/audit.py <acc-root> [mac|linux]
+Columns: id, email, home, state, label, reason, fix
+"""
+
+import json
+import os
+import re
+import sys
+import time
+
+VALID_ID = re.compile(r'acct-\d{2}')
+
+
+def _mtime(path):
+    try:
+        return os.path.getmtime(path)
+    except OSError:
+        return 0.0
+
+
+def _nonempty(path):
+    try:
+        return os.path.getsize(path) > 0
+    except OSError:
+        return False
+
+
+def marker_reason(mpath):
+    """Second line of a marker file, as a human string ('' when absent/unreadable)."""
+    try:
+        lines = open(mpath, errors='replace').read().splitlines()
+    except OSError:
+        return ''
+    return lines[1].strip() if len(lines) > 1 else ''
+
+
+def marker_slug(detail):
+    """The reason=<slug> field of a marker line ('' when absent)."""
+    m = re.search(r'reason=([A-Za-z0-9._-]+)', detail or '')
+    return m.group(1) if m else ''
+
+
+def expired_marked(d, now=None):
+    """True when <d>/.expired is still in force. Mirrors the shim exactly:
+    a CREDENTIAL-scoped park clears as soon as a newer credential lands (re-login, or a
+    refresh by another process); a POLICY park (org-blocked) does not, because a token
+    refresh says nothing about whether the org re-enabled Claude Code. Either kind also
+    expires at its own soft_until when the shim wrote it from a single failed run."""
+    now = time.time() if now is None else now
+    mpath = os.path.join(d, '.expired')
+    if not os.path.isfile(mpath):
+        return False
+    detail = marker_reason(mpath)
+    if marker_slug(detail) != 'org-blocked':
+        mt = _mtime(mpath)
+        for name in ('.credentials.json', 'server.token'):
+            p = os.path.join(d, name)
+            if os.path.isfile(p) and _mtime(p) > mt:
+                return False
+    m = re.search(r'soft_until=(\d+)', detail)
+    if m and int(m.group(1)) <= now:
+        return False
+    return True
+
+
+def _ms(value):
+    """Milliseconds field -> seconds. Anything non-numeric reads as 0 (absent) rather
+    than raising: one weird credential must never take down the whole audit."""
+    try:
+        return float(value or 0) / 1000.0
+    except (TypeError, ValueError):
+        return 0.0
+
+
+def _scrape(cpath):
+    """The shim's rule for a credential JSON cannot parse: sed out the numbers and the
+    presence of a refresh token (bin/claude: cred_num / creds_dead). Used so a
+    half-written file is judged the same way on both sides — audit.py must never call
+    an account dead that the shim is happily selecting."""
+    try:
+        txt = open(cpath, errors='replace').read()
+    except OSError:
+        return None
+    def num(key):
+        m = re.search(r'"%s"\s*:\s*(\d+)' % key, txt)
+        return float(m.group(1)) / 1000.0 if m else 0.0
+    return {'exp': num('expiresAt'), 'rexp': num('refreshTokenExpiresAt'),
+            'has_refresh': bool(re.search(r'"refreshToken"\s*:\s*"[^"]', txt))}
+
+
+def creds_state(cpath, now):
+    """(state, reason) for an on-disk .credentials.json."""
+    scraped = None
+    try:
+        doc = json.load(open(cpath))
+        o = doc.get('claudeAiOauth', {})
+        if not isinstance(o, dict):
+            raise ValueError('claudeAiOauth is not an object')
+        exp, rexp = _ms(o.get('expiresAt')), _ms(o.get('refreshTokenExpiresAt'))
+        has_refresh = bool(o.get('refreshToken'))
+    except Exception as e:
+        # Unparseable (truncated / mid-write): fall back to the shim's lenient scrape so
+        # both sides agree. Only if that finds nothing usable is the account called dead.
+        scraped = _scrape(cpath)
+        if not scraped:
+            return 'expired', f'credentials unreadable ({str(e)[:60]})'
+        exp, rexp, has_refresh = scraped['exp'], scraped['rexp'], scraped['has_refresh']
+        if exp <= now and not (has_refresh and (not rexp or rexp > now)):
+            return 'expired', f'credentials unreadable ({str(e)[:60]})'
+        return 'ok', 'credentials unreadable but carry a live token — left in the pool'
+    if exp > now:
+        return 'ok', 'oauth credential valid'
+    if not has_refresh:
+        return 'expired', 'access token expired and there is no refresh token'
+    if rexp and rexp <= now:
+        days = max(0, int((now - rexp) / 86400))
+        when = time.strftime('%Y-%m-%d', time.gmtime(rexp))
+        return 'expired', f'refresh token expired {when} ({days}d ago)'
+    return 'ok', 'access token stale but auto-refreshes'
+
+
+LABELS = {'ok': 'OK', 'expired': 'EXPIRED', 'blocked': 'BLOCKED',
+          'missing': 'NO LOGIN', 'remote': 'ELSEWHERE'}
+
+# `import --home` speaks mac|server; machine_kind() speaks mac|linux. Same two boxes,
+# two vocabularies — normalize, or an un-authenticated account on the very machine that
+# owns it would be filed as "lives elsewhere" and silently drop off the worklist.
+_MACHINE_ALIASES = {'mac': 'mac', 'macos': 'mac', 'darwin': 'mac', 'osx': 'mac',
+                    'server': 'linux', 'linux': 'linux', 'ubuntu': 'linux',
+                    'debian': 'linux', 'remote': 'linux'}
+
+
+def _norm_machine(name):
+    return _MACHINE_ALIASES.get(str(name or '').strip().lower(), '')
+
+
+def _elsewhere(home, machine):
+    """True only when the manifest names a DIFFERENT machine as the grant's owner.
+    An unknown/blank home is never treated as 'elsewhere' — that would hide a real gap."""
+    h, m = _norm_machine(home), _norm_machine(machine)
+    return bool(h) and bool(m) and h != m
+
+
+def _fix_for(state, aid):
+    if state == 'blocked':
+        # A fresh sign-in re-issues the grant and in practice clears this, so it is
+        # handled like any other dead login. If it comes back BLOCKED after a re-login,
+        # the org really has Claude Code switched off and an admin has to enable it.
+        return (f'claude-accounts relogin {aid}   '
+                f'(if it stays BLOCKED, an admin must enable Claude Code for it)')
+    if state in ('expired', 'missing'):
+        return f'claude-accounts relogin {aid}'
+    return ''
+
+
+def audit_account(root, acct, now=None, machine=None):
+    now = time.time() if now is None else now
+    aid = acct.get('id', '')
+    d = os.path.join(root, aid)
+    cpath = os.path.join(d, '.credentials.json')
+    tpath = os.path.join(d, 'server.token')
+    has_creds = _nonempty(cpath)
+    has_token = _nonempty(tpath)
+    home = acct.get('home', '?')
+    row = {'id': aid, 'email': acct.get('email', ''), 'home': home,
+           'state': 'ok', 'reason': ''}
+
+    def done(r):
+        r['label'] = LABELS.get(r['state'], r['state'].upper())
+        r['fix'] = _fix_for(r['state'], aid)
+        return r
+
+    if expired_marked(d, now=now):
+        detail = marker_reason(os.path.join(d, '.expired'))
+        slug = marker_slug(detail)
+        if slug == 'org-blocked':
+            row['state'] = 'blocked'
+            row['reason'] = ('this account\'s organization has disabled Claude Code '
+                             'subscription access (a re-login cannot fix it)')
+        else:
+            row['state'] = 'expired'
+            row['reason'] = f'marked dead by the pool ({detail or "authentication failed"})'
+        return done(row)
+    if has_creds:
+        state, reason = creds_state(cpath, now)
+        if state == 'ok' or has_token:
+            # A portable token authenticates on its own, so a dead credential beside it
+            # is not fatal — same rule the shim applies.
+            row['state'] = 'ok'
+            row['reason'] = reason if state == 'ok' else f'{reason}; using server.token'
+        else:
+            row['state'], row['reason'] = 'expired', reason
+        return done(row)
+    if has_token:
+        age = int((now - _mtime(tpath)) / 86400)
+        row['reason'] = f'server.token present (minted ~{age}d ago)'
+        return done(row)
+    if machine and _elsewhere(home, machine):
+        row['state'] = 'remote'
+        row['reason'] = f'no auth here — the grant lives on the {home} machine'
+    else:
+        row['state'] = 'missing'
+        row['reason'] = 'no credentials on this machine'
+    return done(row)
+
+
+def audit_all(root, machine=None, now=None):
+    try:
+        doc = json.load(open(os.path.join(root, 'accounts.json')))
+    except Exception:
+        return []
+    out = []
+    for a in doc.get('accounts', []):
+        if isinstance(a, dict) and VALID_ID.fullmatch(str(a.get('id', ''))):
+            out.append(audit_account(root, a, now=now, machine=machine))
+    return out
+
+
+if __name__ == '__main__':
+    root = sys.argv[1]
+    machine = sys.argv[2] if len(sys.argv) > 2 else None
+    for r in audit_all(root, machine=machine):
+        # Tabs are the field separator, so no field may contain one.
+        print('\t'.join(str(r[k]).replace('\t', ' ')
+                        for k in ('id', 'email', 'home', 'state', 'label', 'reason', 'fix')))

package/lib/common.sh

@@ -11,6 +11,9 @@ DEFAULT_SERVER_ROOT="/root/.claude-accounts"
 DEFAULT_SERVER_REPO="/root/claude-multiacc"
 USAGE_URL="${CLAUDE_MULTIACC_USAGE_URL:-https://api.anthropic.com/api/oauth/usage}"
 
+LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd -P)"
+AUDIT_PY="$LIB_DIR/audit.py"
+
 ts_utc() { date -u +%Y-%m-%dT%H:%M:%SZ; }
 epoch_now() { date +%s; }
 
@@ -136,6 +139,75 @@ has_local_auth() { # $1 = acct dir
   [ -f "$1/.credentials.json" ] || [ -s "$1/server.token" ]
 }
 
+# ---- expired-login bookkeeping -------------------------------------------------
+# `.expired` is the persistent "this account cannot authenticate" marker the shim
+# honors (bin/claude: expired_marked). Two lines: marked-at epoch, then details.
+# It is deliberately NOT time-boxed like `.limited`: dead auth only heals through a
+# re-login, a credential refresh, or a usage fetch that proves the bearer works.
+mark_expired() { # mark_expired <acct dir> <reason-slug> [detail]
+  local d="$1" slug="$2" detail="${3:-}"
+  [ -d "$d" ] || return 0
+  {
+    epoch_now
+    printf 'reason=%s marked_at=%s detail=%s\n' "$slug" "$(ts_utc)" "$detail"
+  } > "$d/.expired.$$" 2>/dev/null \
+    && mv -f "$d/.expired.$$" "$d/.expired" 2>/dev/null \
+    || rm -f "$d/.expired.$$" 2>/dev/null || true
+}
+
+# Called wherever fresh auth lands (login/add/mint, successful usage fetch): the
+# account is provably alive again, so both the dead-auth marker and any refresh
+# backoff must go, or it would stay parked until the next re-login.
+clear_auth_markers() { # $1 = acct dir
+  rm -f "$1/.expired" "$1/.oauth-refresh.json" 2>/dev/null || true
+}
+
+# TSV rows: id, email, home, state (ok|expired|blocked|missing|remote), label, reason, fix.
+# Fails LOUD (nonzero, message on stderr): callers decide policy from these rows, and a
+# silently empty audit reads exactly like a perfectly healthy pool.
+account_audit() {
+  local out rc err="$ACC_ROOT/tmp/audit.$$.err"
+  mkdir -p "$ACC_ROOT/tmp" 2>/dev/null || true
+  # stderr goes to a file, never into the rows — a stray warning must not become a
+  # bogus account line.
+  out="$("$PYBIN" "$AUDIT_PY" "$ACC_ROOT" "$(machine_kind)" 2>"$err")"
+  rc=$?
+  if [ "$rc" -ne 0 ]; then
+    printf 'claude-accounts: cannot audit accounts (%s)\n' "$(tail -1 "$err" 2>/dev/null)" >&2
+    rm -f "$err" 2>/dev/null
+    return 1
+  fi
+  rm -f "$err" 2>/dev/null
+  [ -n "$out" ] && printf '%s\n' "$out"
+  return 0
+}
+
+# Ids the shim will NOT select — everything a human has to look at.
+accounts_unusable() {
+  account_audit \
+    | awk -F'\t' 'NF >= 4 && $1 != "" && ($4 == "expired" || $4 == "blocked" || $4 == "missing") { print $1 }'
+}
+
+# Ids a re-login should be pointed at. Org-blocked accounts are included: a fresh
+# sign-in re-issues the grant and in practice clears the block, so they are handled
+# exactly like any other dead login rather than being left for someone to notice.
+accounts_needing_login() {
+  account_audit \
+    | awk -F'\t' 'NF >= 4 && $1 != "" && ($4 == "expired" || $4 == "blocked" || $4 == "missing") { print $1 }'
+}
+
+# True when <acct dir>'s credential can authenticate right now (audit.py's rule).
+creds_alive() { # $1 = acct dir
+  [ -s "$1/.credentials.json" ] || return 1
+  "$PYBIN" - "$AUDIT_PY" "$1/.credentials.json" <<'PYEOF' 2>/dev/null
+import importlib.util, sys, time
+spec = importlib.util.spec_from_file_location('audit', sys.argv[1])
+mod = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(mod)
+sys.exit(0 if mod.creds_state(sys.argv[2], time.time())[0] == 'ok' else 1)
+PYEOF
+}
+
 manifest_init() { # manifest_init [server-target]
   mkdir -p "$ACC_ROOT/tmp"
   chmod 700 "$ACC_ROOT"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "description": "Multi-account addon for Claude Code: every claude / claude -p runs under a randomly-picked subscription account with the most usage headroom. Mirrors to a deploy server. No API keys.",
   "type": "module",
   "bin": {