claude-multiacc 1.0.4 → 1.0.6

package/tests/run-tests.sh

@@ -57,6 +57,16 @@ if [ -f "$ctl" ] && grep -qx "fail:$acct" "$ctl" 2>/dev/null; then
   echo "API Error: 429 rate limit exceeded" >&2
   exit 1
 fi
+if [ -f "$ctl" ] && grep -qx "authfail:$acct" "$ctl" 2>/dev/null; then
+  # the exact failure a dead OAuth grant produces
+  echo "Failed to authenticate: OAuth session expired and could not be refreshed" >&2
+  exit 1
+fi
+if [ -f "$ctl" ] && grep -qx "orgfail:$acct" "$ctl" 2>/dev/null; then
+  # the exact failure an org-disabled account produces (authenticates, cannot infer)
+  echo "Your organization has disabled Claude subscription access for Claude Code · Use an Anthropic API key instead, or ask your admin to enable access"
+  exit 1
+fi
 for a in "$@"; do
   case "$a" in
     --exit7) echo "ordinary failure, not auth related" >&2; exit 7 ;;
@@ -75,6 +85,9 @@ export CLAUDE_MULTIACC_NO_SYNC=1
 # Fixtures are local file:// URLs with no rate limit, so the anti-429 fetch throttle
 # is off by default here; the throttle test re-enables it explicitly.
 export CLAUDE_MULTIACC_MIN_FETCH=0
+# The oauth token endpoint must NEVER be hit for real from tests: default to a missing
+# file:// fixture (refresh fails fast, offline); the refresh tests override per-case.
+export CLAUDE_MULTIACC_TOKEN_URL="file://$WORK/token-endpoint-missing.json"
 
 now="$(date +%s)"
 
@@ -257,6 +270,191 @@ case "$out" in *CFG=acct-02*) t_ok "garbled marker treated as active (excluded)"
   || t_fail "garbled marker deleted" "shim destroyed a possibly-mid-write marker"
 rm -f "$ACC"/acct-*/.limited "$ACC"/acct-*/limits.json
 
+# ---- 9c. DEAD LOGINS are never selected --------------------------------------
+# Regression: an account whose refresh token had expired stayed "valid" (it has a
+# .credentials.json), so the shim kept picking it and every run died with
+# "Failed to authenticate: OAuth session expired and could not be refreshed".
+HEALTHY_CREDS='{"claudeAiOauth":{"accessToken":"sk-ant-oat01-live","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999,"scopes":["user:inference"]}}'
+DEAD_CREDS='{"claudeAiOauth":{"accessToken":"sk-ant-oat01-dead","refreshToken":"r","expiresAt":1000000000000,"refreshTokenExpiresAt":1000000000000}}'
+printf '%s' "$DEAD_CREDS" > "$ACC/acct-01/.credentials.json"
+all2=1
+for _ in $(seq 1 12); do
+  out="$(claude 2>&1)"
+  case "$out" in *CFG=acct-02*) ;; *) all2=0 ;; esac
+done
+[ "$all2" = "1" ] && t_ok "expired refresh token excluded from selection" \
+  || t_fail "expired login excluded" "the dead account was still selected"
+grep -q "skipped-expired: acct-01" "$ACC/selection.log" \
+  && t_ok "skipped-expired logged" || t_fail "skipped-expired log" "no line in selection.log"
+
+# ...and a dead login is not even the all-limited fallback: degraded beats down, but
+# dead is DOWN — a limit-marked account that can still authenticate wins.
+printf '%s\nx\n' "$((now+3600))" > "$ACC/acct-02/.limited"
+out="$(claude 2>&1)"
+check "limited-but-alive beats a dead login in the fallback" "CFG=acct-02" "$out"
+rm -f "$ACC/acct-02/.limited"
+
+# no refreshToken at all + expired access token = dead too (looped: with a single run a
+# random tie-break would let a broken implementation pass half the time)
+printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-x","expiresAt":1000000000000}}' > "$ACC/acct-01/.credentials.json"
+all2=1
+for _ in $(seq 1 12); do
+  out="$(claude 2>&1)"
+  case "$out" in *CFG=acct-02*) ;; *) all2=0 ;; esac
+done
+[ "$all2" = "1" ] && t_ok "credential with no refresh token is dead" \
+  || t_fail "no-refresh-token dead" "the dead account was selected"
+
+# expired ACCESS token with a live refresh token is NOT dead (claude refreshes it)
+printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-stale","refreshToken":"r","expiresAt":1000000000000,"refreshTokenExpiresAt":9999999999999}}' > "$ACC/acct-01/.credentials.json"
+rm -f "$ACC/acct-02/.credentials.json"    # acct-01 is the only candidate
+out="$(claude 2>&1)"
+check "stale access token + live refresh token stays selectable" "CFG=acct-01" "$out"
+printf '%s' "$HEALTHY_CREDS" > "$ACC/acct-02/.credentials.json"
+
+# a dead credential beside a portable token still authenticates — via the token
+printf '%s' "$DEAD_CREDS" > "$ACC/acct-01/.credentials.json"
+printf '%s' "$DEAD_CREDS" > "$ACC/acct-02/.credentials.json"
+printf 'sk-ant-oat01-rescue-token' > "$ACC/acct-01/server.token"
+out="$(claude 2>&1)"
+check "dead creds + portable token still authenticate" "TOK=sk-ant-oat01-rescue-token" "$out"
+rm -f "$ACC/acct-01/server.token"
+
+# every account dead => stock passthrough. The reason lands in selection.log; the
+# stderr hint is terminal-only, so a service-spawned `claude -p` stays byte-clean.
+out="$(claude 2>&1)"
+check "all logins dead -> stock passthrough" "CFG=none" "$out"
+case "$out" in *claude-multiacc:*) t_fail "all-dead stderr" "wrote a notice to a non-tty stderr" ;;
+  *) t_ok "all logins dead -> no stderr noise for services" ;; esac
+grep -q "all-expired: falling back" "$ACC/selection.log" \
+  && t_ok "all logins dead -> logged with the fix" || t_fail "all-dead log" "no all-expired line"
+printf '%s' "$HEALTHY_CREDS" > "$ACC/acct-01/.credentials.json"
+printf '%s' "$HEALTHY_CREDS" > "$ACC/acct-02/.credentials.json"
+
+# ---- 9d. the .expired marker: excludes, and self-heals on a newer credential ----
+printf '%s\nreason=auth-error marked_at=now detail=test\n' "$now" > "$ACC/acct-01/.expired"
+touch -t 202001010101 "$ACC/acct-01/.credentials.json"   # credential OLDER than the marker
+all2=1
+for _ in $(seq 1 10); do
+  out="$(claude 2>&1)"
+  case "$out" in *CFG=acct-02*) ;; *) all2=0 ;; esac
+done
+[ "$all2" = "1" ] && t_ok ".expired marker excludes the account" \
+  || t_fail ".expired marker" "marked account was still selected"
+touch -t 202001010101 "$ACC/acct-01/.expired"            # credential now NEWER than the marker
+touch "$ACC/acct-01/.credentials.json"
+out="$(claude 2>&1)"                                     # any selection pass re-evaluates it
+[ ! -f "$ACC/acct-01/.expired" ] && t_ok "a newer credential clears the .expired marker" \
+  || t_fail ".expired self-heal" "marker survived a re-login"
+rm -f "$ACC/acct-01/.expired"
+
+# ---- 9e. an auth failure parks the account (not a 10-minute cooldown) ----------
+# Rate limits heal on their own; a dead grant does not — so it gets .expired, and the
+# run still completes on another account.
+printf '{"fetched_at":%s,"max_percent":1,"weekly_percent":1,"session_percent":1,"buckets":[]}' "$now" > "$ACC/acct-01/limits.json"
+printf '{"fetched_at":%s,"max_percent":50,"weekly_percent":50,"session_percent":50,"buckets":[]}' "$now" > "$ACC/acct-02/limits.json"
+echo "authfail:acct-01" > "$FAKE_CTL"
+out="$(claude -p hello < /dev/null 2>/dev/null)"
+rc=$?
+{ [ "$rc" = "0" ] && case "$out" in *CFG=acct-02*) true ;; *) false ;; esac; } \
+  && t_ok "auth failure retries onto a healthy account" \
+  || t_fail "auth failure retry" "rc=$rc out=$out"
+[ -f "$ACC/acct-01/.expired" ] && t_ok "auth failure writes .expired" \
+  || t_fail "auth failure marker" ".expired missing"
+[ ! -f "$ACC/acct-01/.limited" ] && t_ok "auth failure is not treated as a rate limit" \
+  || t_fail "auth failure marker" "got a 10-minute .limited cooldown instead"
+# The shim's park is a GUESS from one run, so it carries its own expiry: once the soft
+# window passes the account returns to the pool with no external help.
+grep -q "soft_until=" "$ACC/acct-01/.expired" \
+  && t_ok "a shim-written park carries a soft expiry" \
+  || t_fail "soft park" "no soft_until in the shim-written marker"
+printf '%s\nreason=auth-error soft_until=%s detail=elapsed\n' "$((now-7200))" "$((now-10))" > "$ACC/acct-01/.expired"
+touch -t 202001010101 "$ACC/acct-01/.credentials.json"
+out="$(CLAUDE_ACCOUNT='' claude 2>&1)"
+[ ! -f "$ACC/acct-01/.expired" ] && t_ok "an elapsed soft park releases the account" \
+  || t_fail "soft park expiry" "the account stayed parked past soft_until"
+touch "$ACC/acct-01/.credentials.json"
+rm -f "$FAKE_CTL" "$ACC/acct-01/.expired" "$ACC"/acct-*/limits.json
+
+# ...and the park is NOT triggered by the model merely talking about auth. This is the
+# hot path for `claude -p`: the grep also sees the model's own answer on stdout.
+cat > "$FAKEBIN/claude-chatty" <<'EOF'
+#!/usr/bin/env bash
+echo "Your nginx returns 403 Forbidden. Please run: nginx -t to check the config."
+echo "hook failed" >&2
+exit 2
+EOF
+chmod +x "$FAKEBIN/claude-chatty"
+mv "$FAKEBIN/claude" "$FAKEBIN/claude.real"; mv "$FAKEBIN/claude-chatty" "$FAKEBIN/claude"
+claude -p "why does nginx 403" < /dev/null >/dev/null 2>&1
+mv "$FAKEBIN/claude" "$FAKEBIN/claude-chatty"; mv "$FAKEBIN/claude.real" "$FAKEBIN/claude"
+if [ -f "$ACC/acct-01/.expired" ] || [ -f "$ACC/acct-02/.expired" ]; then
+  t_fail "answer text must not park an account" "the model mentioning 403/'please run' parked an account"
+else
+  t_ok "a model answer mentioning 403 does not park an account"
+fi
+rm -f "$ACC"/acct-*/.limited "$ACC"/acct-*/.expired
+
+# ---- 9f. org-disabled accounts are parked too ---------------------------------
+# "Your organization has disabled Claude subscription access for Claude Code" is not an
+# auth failure (the credential is perfectly valid) and not a rate limit — but the
+# account fails EVERY call, so it must leave the pool. A re-login cannot fix it.
+printf '{"fetched_at":%s,"max_percent":1,"weekly_percent":1,"session_percent":1,"buckets":[]}' "$now" > "$ACC/acct-01/limits.json"
+printf '{"fetched_at":%s,"max_percent":50,"weekly_percent":50,"session_percent":50,"buckets":[]}' "$now" > "$ACC/acct-02/limits.json"
+echo "orgfail:acct-01" > "$FAKE_CTL"
+out="$(claude -p hello < /dev/null 2>/dev/null)"
+rc=$?
+{ [ "$rc" = "0" ] && case "$out" in *CFG=acct-02*) true ;; *) false ;; esac; } \
+  && t_ok "org-disabled account retries onto a healthy one" \
+  || t_fail "org-block retry" "rc=$rc out=$out"
+grep -q "reason=org-blocked" "$ACC/acct-01/.expired" 2>/dev/null \
+  && t_ok "org-disabled account is parked as org-blocked" \
+  || t_fail "org-block marker" "no reason=org-blocked marker"
+rm -f "$FAKE_CTL" "$ACC"/acct-*/limits.json
+# it stays out of the pool...
+all2=1
+for _ in $(seq 1 10); do
+  out="$(claude 2>&1)"
+  case "$out" in *CFG=acct-02*) ;; *) all2=0 ;; esac
+done
+[ "$all2" = "1" ] && t_ok "org-blocked account excluded from selection" \
+  || t_fail "org-block exclusion" "the blocked account was still selected"
+# ...and a park for an ORG BLOCK survives a credential rewrite. The token refresher
+# rewrites .credentials.json every few hours; treating that as "the account recovered"
+# handed blocked accounts straight back to the pool and runs kept failing with
+# "Your organization has disabled Claude subscription access".
+touch "$ACC/acct-01/.credentials.json"          # credential now NEWER than the marker
+all2=1
+for _ in $(seq 1 10); do
+  out="$(claude 2>&1)"
+  case "$out" in *CFG=acct-02*) ;; *) all2=0 ;; esac
+done
+[ "$all2" = "1" ] && t_ok "an org block survives a credential refresh" \
+  || t_fail "org-block stickiness" "a rewritten credential un-parked a blocked account"
+[ -f "$ACC/acct-01/.expired" ] && t_ok "the org-block marker is not deleted by a refresh" \
+  || t_fail "org-block stickiness" "marker removed by a credential rewrite"
+# a CREDENTIAL park still self-heals on a newer credential (unchanged behavior)
+printf '%s\nreason=auth-error detail=test\n' "$((now-100))" > "$ACC/acct-01/.expired"
+touch -t 202001010101 "$ACC/acct-01/.expired"    # marker older than the credential
+touch "$ACC/acct-01/.credentials.json"
+claude >/dev/null 2>&1
+[ ! -f "$ACC/acct-01/.expired" ] && t_ok "a credential park still clears on a newer credential" \
+  || t_fail "credential park" "marker survived a fresh credential"
+printf '%s\nreason=org-blocked detail=test\n' "$((now-100))" > "$ACC/acct-01/.expired"
+# `expired` explains it and points at the same fix as any other dead login
+out="$(claude-accounts expired 2>&1)"
+check "expired labels an org-blocked account" "BLOCKED" "$out"
+check "expired explains the org block" "organization has disabled" "$out"
+check "expired points org blocks at relogin" "relogin acct-01" "$out"
+out="$(claude-accounts list 2>&1)"
+check "list flags org-blocked accounts" "ORG-BLOCKED" "$out"
+# relogin targets them like any other dead login
+out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=a@test claude-accounts relogin --yes 2>&1)"
+check "relogin targets org-blocked accounts" "acct-01 login saved" "$out"
+[ ! -f "$ACC/acct-01/.expired" ] && t_ok "a successful re-login clears an org block" \
+  || t_fail "org-block relogin" "marker survived the re-login"
+rm -f "$ACC/acct-01/.expired"
+
 # ---- 10. token-only account exports CLAUDE_CODE_OAUTH_TOKEN ------------------
 mkdir -p "$ACC/acct-03"
 printf 'sk-ant-oat01-tok-for-03' > "$ACC/acct-03/server.token"
@@ -443,6 +641,84 @@ check "login --token saves a portable token" "acct-08 token saved" "$out"
 [ -s "$ACC/acct-08/server.token" ] && t_ok "login --token writes server.token" || t_fail "login token" "missing"
 claude-accounts remove acct-08 --yes >/dev/null 2>&1
 
+# ---- 15f2. expired: the re-login worklist, and relogin fixes it ----------------------
+# `expired` must agree with the shim exactly: what it lists is what selection skips.
+printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-dead","refreshToken":"r","expiresAt":1000000000000,"refreshTokenExpiresAt":1000000000000}}' > "$ACC/acct-01/.credentials.json"
+out="$(claude-accounts expired 2>&1)"
+rc=$?
+check "expired lists the dead account" "acct-01" "$out"
+check "expired explains why" "refresh token expired" "$out"
+check "expired prints the fix" "claude-accounts relogin acct-01" "$out"
+[ "$rc" = "1" ] && t_ok "expired exits 1 when a login needs a human" || t_fail "expired rc" "rc=$rc"
+out="$(claude-accounts expired --quiet 2>&1)"
+[ "$out" = "acct-01" ] && t_ok "expired --quiet prints bare ids" || t_fail "expired --quiet" "got: $out"
+out="$(claude-accounts list 2>&1)"
+check "list flags the dead login" "EXPIRED-LOGIN" "$out"
+out="$(claude-accounts status 2>&1)"
+check "status marks it unselectable" "LOGIN EXPIRED" "$out"
+# relogin with no arguments targets exactly that worklist
+out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=a@test claude-accounts relogin --yes 2>&1)"
+rc=$?
+check "relogin re-authenticates the expired account" "acct-01 login saved" "$out"
+check "relogin reports what it did" "re-authenticated 1 of 1" "$out"
+[ "$rc" = "0" ] && t_ok "relogin exits 0 when every account recovered" || t_fail "relogin rc" "rc=$rc"
+out="$(claude-accounts expired 2>&1)"
+rc=$?
+check "expired is clean after relogin" "can authenticate" "$out"
+[ "$rc" = "0" ] && t_ok "expired exits 0 on a healthy pool" || t_fail "expired rc (healthy)" "rc=$rc"
+out="$(claude 2>&1)"
+case "$out" in *CFG=acct-0*) t_ok "re-authenticated account is selectable again" ;;
+  *) t_fail "post-relogin selection" "got: $out" ;; esac
+# a stale .expired marker must not survive a successful login
+printf '%s\nreason=auth-error detail=test\n' "$now" > "$ACC/acct-01/.expired"
+touch -t 202001010101 "$ACC/acct-01/.credentials.json"
+CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=a@test claude-accounts relogin acct-01 --yes >/dev/null 2>&1
+[ ! -f "$ACC/acct-01/.expired" ] && t_ok "login clears the dead-auth marker" \
+  || t_fail "login marker clear" ".expired survived a successful login"
+# explicit ids are validated
+out="$(claude-accounts relogin acct-99 --yes 2>&1)"
+rc=$?
+check "relogin rejects an unknown account" "unknown account" "$out"
+[ "$rc" != "0" ] && t_ok "unknown relogin target exits nonzero" || t_fail "relogin unknown rc" "rc=0"
+
+# ---- 15f3. a re-login that did NOT work must not be reported as fixed -----------------
+# The target already HAS a (dead) .credentials.json, so "the file exists" proves nothing:
+# an aborted sign-in would otherwise clear the dead-auth marker and hand the account back.
+printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-dead","refreshToken":"r","expiresAt":1000000000000,"refreshTokenExpiresAt":1000000000000}}' > "$ACC/acct-01/.credentials.json"
+printf '%s\nreason=refresh-token-expired detail=test\n' "$now" > "$ACC/acct-01/.expired"
+touch -t 202001010101 "$ACC/acct-01/.credentials.json"
+out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_LOGIN_FAIL=1 FAKE_EMAIL=a@test claude-accounts relogin acct-01 --yes 2>&1)"
+rc=$?
+check "aborted re-login is reported as a failure" "login failed or aborted" "$out"
+[ "$rc" != "0" ] && t_ok "aborted relogin exits nonzero" || t_fail "aborted relogin rc" "rc=0"
+[ -f "$ACC/acct-01/.expired" ] && t_ok "aborted re-login leaves the account parked" \
+  || t_fail "aborted relogin" "the dead-auth marker was cleared by a failed sign-in"
+out="$(claude-accounts expired --quiet 2>&1)"
+check "the account is still on the worklist after a failed re-login" "acct-01" "$out"
+# a real re-login then fixes it
+out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=a@test claude-accounts relogin acct-01 --yes 2>&1)"
+check "a working re-login is reported as fixed" "re-authenticated 1 of 1" "$out"
+[ ! -f "$ACC/acct-01/.expired" ] && t_ok "a working re-login clears the park" \
+  || t_fail "relogin clear" "marker survived a successful sign-in"
+
+# ---- 15f4. audit robustness: bad data must never read as a healthy pool ---------------
+# a non-numeric expiry must not crash the audit (it would blank the worklist silently)
+cp "$ACC/acct-01/.credentials.json" "$WORK/creds.bak"
+printf '{"claudeAiOauth":{"accessToken":"a","refreshToken":"r","expiresAt":"soon","refreshTokenExpiresAt":[]}}' > "$ACC/acct-01/.credentials.json"
+out="$(claude-accounts expired 2>&1)"
+rc=$?
+case "$out" in *Traceback*) t_fail "audit survives a weird credential" "python traceback" ;;
+  *) t_ok "a non-numeric expiry does not crash the audit" ;; esac
+out="$(claude-accounts list 2>&1)"
+check "list survives a weird credential" "acct-01" "$out"
+# a truncated (mid-write) credential is judged the SAME way the shim judges it
+printf '{"claudeAiOauth":{"accessToken":"live","refreshToken":"rt","expiresAt":9999999999999,' > "$ACC/acct-01/.credentials.json"
+out="$(claude-accounts expired --quiet 2>&1)"
+case "$out" in *acct-01*) t_fail "audit agrees with the shim on a truncated credential" \
+    "audit calls it dead while the shim still selects it" ;;
+  *) t_ok "a truncated credential is judged like the shim judges it" ;; esac
+cp "$WORK/creds.bak" "$ACC/acct-01/.credentials.json"
+
 # ---- 15g. parallel adds (different terminals) get distinct ids, no lock-busy error ----
 ( CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=par1@test claude-accounts add >"$WORK/p1.out" 2>&1 ) &
 pA=$!
@@ -618,15 +894,192 @@ d = json.load(open('$ACC/acct-01/limits.json'))
 sys.exit(0 if 'retry_after' not in d and 'backoff' not in d else 1)" \
   && t_ok "successful fetch clears backoff state" || t_fail "backoff cleared" "retry_after/backoff persisted"
 
-# ---- 16b. expired-bearer account skipped gracefully (fail open) -----------------
+# ---- 16b. expired-bearer account: oauth refresh attempted; fail-open when it fails ----
 mkdir -p "$ACC/acct-05"
-printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-old","refreshToken":"r","expiresAt":1000,"refreshTokenExpiresAt":9999999999999}}' > "$ACC/acct-05/.credentials.json"
+printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-old","refreshToken":"sk-ant-ort01-oldrefresh","expiresAt":1000,"refreshTokenExpiresAt":9999999999999}}' > "$ACC/acct-05/.credentials.json"
 claude-accounts import e@test --id acct-05 --no-sync >/dev/null 2>&1
 out="$(CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits 2>&1)"
 rc=$?
+check "failed oauth refresh logged with backoff" "acct-05: oauth refresh failed" "$out"
 check "expired bearer logged, not fatal" "acct-05: no fresh bearer" "$out"
 [ "$rc" = "0" ] && t_ok "limits exits 0 with expired-bearer account" || t_fail "limits exit code" "rc=$rc"
 [ ! -f "$ACC/acct-05/limits.json" ] && t_ok "no limits.json fabricated for expired account" || t_fail "expired acct limits.json" "unexpectedly written"
+[ -f "$ACC/acct-05/.oauth-refresh.json" ] && t_ok "refresh failure recorded in .oauth-refresh.json" || t_fail "refresh backoff file" "missing"
+
+# ---- 16b2. refresh backoff honored: even a now-working endpoint is not retried early --
+cat > "$WORK/token-ok.json" <<'EOF'
+{"access_token":"sk-ant-oat01-refreshednew","refresh_token":"sk-ant-ort01-rotatednew","expires_in":28800,"refresh_token_expires_in":2592000}
+EOF
+out="$(CLAUDE_MULTIACC_TOKEN_URL="file://$WORK/token-ok.json" CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits 2>&1)"
+check "refresh backoff honored (no early retry)" "acct-05: no fresh bearer" "$out"
+grep -q "sk-ant-oat01-refreshednew" "$ACC/acct-05/.credentials.json" \
+  && t_fail "backoff prevented refresh" "credentials rewritten inside the backoff window" \
+  || t_ok "no refresh inside the backoff window"
+
+# ---- 16b3. --force bypasses refresh backoff: rotated credential persisted + fetch ok --
+out="$(CLAUDE_MULTIACC_TOKEN_URL="file://$WORK/token-ok.json" CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force 2>&1)"
+check "--force refreshes the expired oauth token" "acct-05: oauth access token refreshed" "$out"
+check "refreshed account fetches telemetry" "acct-05: ok" "$out"
+python3 - "$ACC/acct-05/.credentials.json" <<'EOF'
+import json, os, stat, sys, time
+p = sys.argv[1]
+o = json.load(open(p))['claudeAiOauth']
+assert o['accessToken'] == 'sk-ant-oat01-refreshednew', o['accessToken']
+assert o['refreshToken'] == 'sk-ant-ort01-rotatednew', 'refresh token was not rotated'
+assert o['expiresAt'] / 1000.0 > time.time() + 3600, 'expiresAt not advanced'
+assert o['refreshTokenExpiresAt'] / 1000.0 > time.time() + 86400, 'refreshTokenExpiresAt not advanced'
+mode = stat.S_IMODE(os.stat(p).st_mode)
+assert mode == 0o600, oct(mode)
+EOF
+[ $? -eq 0 ] && t_ok "rotated credential persisted with 0600" || t_fail "credential rotation" "see assertions above"
+[ ! -f "$ACC/acct-05/.oauth-refresh.json" ] && t_ok "successful refresh clears the backoff file" || t_fail "refresh backoff clear" "file still present"
+[ -f "$ACC/acct-05/limits.json" ] && t_ok "telemetry written right after refresh" || t_fail "limits.json after refresh" "missing"
+grep -qE "sk-ant-ort01|sk-ant-oat01-refreshednew" "$ACC/limits.log" \
+  && t_fail "limits.log leaks no tokens" "a token leaked into limits.log" \
+  || t_ok "limits.log leaks no tokens"
+
+# ---- 16b4. steady state: fresh data means no refresh and no fetch (quiet skip) --------
+out="$(CLAUDE_MULTIACC_MIN_FETCH=45 CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits 2>&1)"
+printf '%s' "$out" | grep -q "acct-05" \
+  && t_fail "fresh account skipped silently" "unexpected acct-05 output: $out" \
+  || t_ok "fresh account skipped silently (no refresh, no fetch)"
+
+# ---- 16b5. an EXPIRED refresh token is never sent: clear re-login message -------------
+printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-old","refreshToken":"sk-ant-ort01-dead","expiresAt":1000,"refreshTokenExpiresAt":1000}}' > "$ACC/acct-05/.credentials.json"
+rm -f "$ACC/acct-05/limits.json" "$ACC/acct-05/.oauth-refresh.json"
+out="$(CLAUDE_MULTIACC_TOKEN_URL="file://$WORK/token-ok.json" CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits 2>&1)"
+check "expired refresh token => re-login message" "re-login needed" "$out"
+grep -q "sk-ant-oat01-refreshednew" "$ACC/acct-05/.credentials.json" \
+  && t_fail "dead refresh token never used" "credentials rewritten from a dead refresh token" \
+  || t_ok "dead refresh token never used"
+# ...and the account is PARKED, so the shim stops handing work to a login that cannot work
+grep -q "reason=refresh-token-expired" "$ACC/acct-05/.expired" 2>/dev/null \
+  && t_ok "limits parks an account with a dead refresh token" \
+  || t_fail "limits .expired marker" "no .expired written for a dead refresh token"
+# a later successful fetch (fresh login, or a token bearer) unparks it
+printf 'sk-ant-oat01-portable-unpark' > "$ACC/acct-05/server.token"
+rm -f "$ACC/acct-05/limits.json"
+out="$(CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force 2>&1)"
+[ ! -f "$ACC/acct-05/.expired" ] && t_ok "a successful usage fetch clears the dead-auth marker" \
+  || t_fail "unpark on success" ".expired survived a successful authenticated fetch"
+# ...but an ORG-BLOCKED account authenticates fine — telemetry proves nothing about it,
+# so its marker must survive a successful fetch (only a real call or re-login lifts it).
+printf '%s\nreason=org-blocked marked_at=now detail=test\n' "$now" > "$ACC/acct-05/.expired"
+rm -f "$ACC/acct-05/limits.json"
+out="$(CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force 2>&1)"
+[ -f "$ACC/acct-05/.expired" ] && t_ok "a usage fetch does not unpark an org-blocked account" \
+  || t_fail "org-block unpark" "telemetry cleared an org block it cannot observe"
+rm -f "$ACC/acct-05/.expired" "$ACC/acct-05/server.token"
+
+# ---- 16b6. RECENTLY-expired token is left alone (a live session owns it) --------------
+# The 5-min REFRESH_MIN_EXPIRED gate is the rotation-safety core: a token that expired
+# moments ago may be mid-refresh by a live claude session; grants must not race it.
+# Not even --force may bypass this.
+recent_ms="$(python3 -c 'import time; print(int((time.time()-100)*1000))')"
+printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-recent","refreshToken":"sk-ant-ort01-live","expiresAt":%s,"refreshTokenExpiresAt":9999999999999}}' "$recent_ms" > "$ACC/acct-05/.credentials.json"
+rm -f "$ACC/acct-05/limits.json" "$ACC/acct-05/.oauth-refresh.json"
+out="$(CLAUDE_MULTIACC_TOKEN_URL="file://$WORK/token-ok.json" CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force 2>&1)"
+check "recently-expired token is not refreshed (even --force)" "acct-05: no fresh bearer" "$out"
+grep -q "sk-ant-oat01-recent" "$ACC/acct-05/.credentials.json" \
+  && t_ok "recently-expired credential left untouched" \
+  || t_fail "REFRESH_MIN_EXPIRED gate" "credential was rewritten within the 5-min grace window"
+[ ! -f "$ACC/acct-05/.oauth-refresh.json" ] && t_ok "no backoff recorded for a gated (skipped) refresh" \
+  || t_fail "gated refresh backoff" ".oauth-refresh.json written despite the gate"
+
+# ---- 16b7. server.token accounts are NEVER oauth-refreshed (token bearer wins) ---------
+printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-old","refreshToken":"sk-ant-ort01-x","expiresAt":1000,"refreshTokenExpiresAt":9999999999999}}' > "$ACC/acct-05/.credentials.json"
+printf 'sk-ant-oat01-portable-token-05' > "$ACC/acct-05/server.token"
+rm -f "$ACC/acct-05/limits.json" "$ACC/acct-05/.oauth-refresh.json"
+out="$(CLAUDE_MULTIACC_TOKEN_URL="file://$WORK/token-ok.json" CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force 2>&1)"
+check "token-bearer account fetches without refresh" "acct-05: ok" "$out"
+grep -q "sk-ant-oat01-refreshednew" "$ACC/acct-05/.credentials.json" \
+  && t_fail "server.token exempts oauth refresh" "oauth creds were rotated despite a portable token" \
+  || t_ok "server.token account never oauth-refreshed (grant not run)"
+python3 -c "import json,sys; sys.exit(0 if json.load(open('$ACC/acct-05/limits.json'))['source']=='token' else 1)" \
+  && t_ok "telemetry fetched via the portable token" || t_fail "token bearer source" "source != token"
+rm -f "$ACC/acct-05/server.token"
+
+# ---- 16b9. a 4xx from the TOKEN endpoint must not park the whole pool -----------------
+# Every account hits the same endpoint with the same client id, so a provider incident,
+# a WAF page or a client-id change 4xxs ALL of them at once. Only OAuth's own
+# invalid_grant (or a repeated refusal of this one account) is proof of a dead grant.
+srv_script="$WORK/token-server.py"
+cat > "$srv_script" <<'EOF'
+import http.server, json, sys, threading
+class H(http.server.BaseHTTPRequestHandler):
+    def log_message(self, *a): pass
+    def _send(self, code, body):
+        raw = body.encode()
+        self.send_response(code)
+        self.send_header('Content-Type', 'application/json')
+        self.send_header('Content-Length', str(len(raw)))
+        self.end_headers()
+        self.wfile.write(raw)
+    def do_POST(self):
+        try:
+            self.rfile.read(int(self.headers.get('Content-Length') or 0))
+        except Exception:
+            pass
+        if self.path == '/invalid-grant':
+            self._send(400, json.dumps({'error': 'invalid_grant'}))
+        else:
+            self._send(400, '<html>gateway says no</html>')
+srv = http.server.HTTPServer(('127.0.0.1', 0), H)
+print(srv.server_address[1], flush=True)
+srv.serve_forever()
+EOF
+port=""
+python3 "$srv_script" > "$WORK/token-port" 2>/dev/null &
+srv_pid=$!
+for _ in $(seq 1 20); do
+  port="$(head -1 "$WORK/token-port" 2>/dev/null)"
+  case "$port" in ''|*[!0-9]*) port=""; sleep 0.2 ;; *) break ;; esac
+done
+if [ -z "$port" ]; then
+  kill "$srv_pid" 2>/dev/null; wait "$srv_pid" 2>/dev/null || true
+  t_ok "token-endpoint 4xx tests skipped (cannot bind a loopback port here)"
+else
+  dead_acct="$ACC/acct-05"
+  mk_stale_creds() {
+    printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-old","refreshToken":"sk-ant-ort01-x","expiresAt":1000,"refreshTokenExpiresAt":9999999999999}}' > "$dead_acct/.credentials.json"
+    rm -f "$dead_acct/limits.json" "$dead_acct/.oauth-refresh.json" "$dead_acct/.expired"
+  }
+  # a NON-invalid_grant 400 (provider incident): back off, do NOT park
+  mk_stale_creds
+  out="$(CLAUDE_MULTIACC_TOKEN_URL="http://127.0.0.1:$port/boom" CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force 2>&1)"
+  [ ! -f "$dead_acct/.expired" ] && t_ok "one opaque 4xx from the token endpoint does not park an account" \
+    || t_fail "token 4xx park" "a single non-invalid_grant 400 parked the account"
+  [ -f "$dead_acct/.oauth-refresh.json" ] && t_ok "an opaque 4xx still records a backoff" \
+    || t_fail "token 4xx backoff" "no .oauth-refresh.json written"
+  # ...but a repeatedly-refused account IS parked (3rd strike)
+  CLAUDE_MULTIACC_TOKEN_URL="http://127.0.0.1:$port/boom" CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force >/dev/null 2>&1
+  CLAUDE_MULTIACC_TOKEN_URL="http://127.0.0.1:$port/boom" CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force >/dev/null 2>&1
+  [ -f "$dead_acct/.expired" ] && t_ok "a repeatedly-refused grant is parked on the third strike" \
+    || t_fail "token 4xx strikes" "still not parked after three refusals"
+  # invalid_grant is proof on the FIRST refusal
+  mk_stale_creds
+  out="$(CLAUDE_MULTIACC_TOKEN_URL="http://127.0.0.1:$port/invalid-grant" CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force 2>&1)"
+  grep -q "invalid_grant" "$dead_acct/.expired" 2>/dev/null \
+    && t_ok "invalid_grant parks the account immediately" \
+    || t_fail "invalid_grant park" "no marker for an explicit invalid_grant"
+  kill "$srv_pid" 2>/dev/null; wait "$srv_pid" 2>/dev/null || true
+  rm -f "$dead_acct/.expired" "$dead_acct/.oauth-refresh.json"
+fi
+
+# ---- 16b8. malformed claudeAiOauth (null) degrades that account ONLY (fail open) -------
+# {"claudeAiOauth": null} is valid JSON from an interrupted/reset credential write; it
+# must not abort the refresher — accounts AFTER it in the manifest must still be fetched.
+# acct-01 is first in the manifest, so corrupting it exercises the loop guarantee.
+cp "$ACC/acct-01/.credentials.json" "$WORK/acct01-creds.bak"
+printf '{"claudeAiOauth": null}' > "$ACC/acct-01/.credentials.json"
+rm -f "$ACC/acct-01/limits.json" "$ACC/acct-01/.oauth-refresh.json" "$ACC/acct-02/limits.json"
+out="$(CLAUDE_MULTIACC_TOKEN_URL="file://$WORK/token-ok.json" CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "null claudeAiOauth exits 0 (fail open)" || t_fail "null claudeAiOauth rc" "rc=$rc: $out"
+check "null claudeAiOauth degrades only that account" "acct-01: no fresh bearer" "$out"
+[ -f "$ACC/acct-02/limits.json" ] && t_ok "accounts after a malformed one still refresh" \
+  || t_fail "fail-open loop guarantee" "acct-02 was starved by acct-01's malformed creds"
+cp "$WORK/acct01-creds.bak" "$ACC/acct-01/.credentials.json"
 claude-accounts remove acct-05 --yes >/dev/null 2>&1
 
 # ---- 16c. codex-review: security hardening -----------------------------------------
@@ -690,6 +1143,59 @@ check "import rejects an API key as token" "not a subscription setup-token" "$ou
 out="$(printf 'sk-ant-api03-ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ' | claude-accounts mint acct-01 --paste 2>&1)"
 check "mint --paste rejects an API key" "not a subscription setup-token" "$out"
 
+# ---- 17b. verify authenticates the way the SHIM would ---------------------------------
+# A dead credential next to a live portable token: the shim runs that account with the
+# TOKEN, so verify must too — testing it with the dead credential would fail a healthy
+# account and park it.
+printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-dead","refreshToken":"r","expiresAt":1000000000000,"refreshTokenExpiresAt":1000000000000}}' > "$ACC/acct-01/.credentials.json"
+printf 'sk-ant-oat01-token-for-01' > "$ACC/acct-01/server.token"
+rm -f "$ACC/acct-01/.expired"
+out="$(claude-accounts verify 2>&1)"
+case "$out" in *"acct-01 a@test: PASS"*) t_ok "verify uses the portable token when the credential is dead" ;;
+  *) t_fail "verify token fallback" "expected acct-01 PASS, got: $(printf '%s' "$out" | grep acct-01)" ;; esac
+[ ! -f "$ACC/acct-01/.expired" ] && t_ok "verify does not park an account its token can run" \
+  || t_fail "verify token fallback" "healthy token-auth account was parked"
+rm -f "$ACC/acct-01/server.token"
+printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-test01","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999}}' > "$ACC/acct-01/.credentials.json"
+
+# ---- 17c. audit: machine vocabulary (home=server vs machine_kind=linux) ---------------
+# `import --home` says mac|server; machine_kind() says mac|linux. If those are compared
+# raw, an un-authenticated account ON the server reads as "the grant lives elsewhere"
+# and silently drops off the re-login worklist.
+mkdir -p "$ACC/acct-06"
+python3 - "$ACC/accounts.json" <<'EOF'
+import json, sys
+doc = json.load(open(sys.argv[1]))
+doc['accounts'] = [a for a in doc['accounts'] if a['id'] != 'acct-06']
+doc['accounts'].append({'id': 'acct-06', 'email': 'srv@test', 'home': 'server'})
+doc['accounts'].sort(key=lambda a: a['id'])
+json.dump(doc, open(sys.argv[1], 'w'), indent=2)
+EOF
+out="$(python3 "$REPO_DIR/lib/audit.py" "$ACC" linux | awk -F'\t' '$1=="acct-06"{print $4}')"
+[ "$out" = "missing" ] && t_ok "home=server on the server means NO LOGIN, not 'elsewhere'" \
+  || t_fail "home vocabulary" "expected missing on linux, got: $out"
+out="$(python3 "$REPO_DIR/lib/audit.py" "$ACC" mac | awk -F'\t' '$1=="acct-06"{print $4}')"
+[ "$out" = "remote" ] && t_ok "home=server on the Mac is correctly 'elsewhere'" \
+  || t_fail "home vocabulary" "expected remote on mac, got: $out"
+python3 - "$ACC/accounts.json" <<'EOF'
+import json, sys
+doc = json.load(open(sys.argv[1]))
+doc['accounts'] = [a for a in doc['accounts'] if a['id'] != 'acct-06']
+json.dump(doc, open(sys.argv[1], 'w'), indent=2)
+EOF
+rm -rf "$ACC/acct-06"
+
+# ---- 17d. an empty pool is never rendered as "all clear" ------------------------------
+emptypool="$WORK/emptypool"
+mkdir -p "$emptypool/tmp"
+printf '{"version":1,"threshold":90,"accounts":[]}' > "$emptypool/accounts.json"
+out="$(CLAUDE_ACCOUNTS_DIR="$emptypool" claude-accounts expired 2>&1)"
+rc=$?
+check "expired on an empty pool says so" "No accounts registered yet" "$out"
+[ "$rc" = "0" ] && t_ok "empty pool exits 0" || t_fail "empty pool rc" "rc=$rc"
+case "$out" in *"NO LOGIN"*) t_fail "empty pool phantom row" "invented an account from a blank line" ;;
+  *) t_ok "empty pool invents no phantom account" ;; esac
+
 out="$(claude-accounts verify --quick 2>&1)"
 check "verify --quick passes oauth accounts" "acct-01 a@test: OK" "$out"
 check "verify --quick counts" "0 failure(s)" "$out"