claude-multiacc 1.0.5 → 1.0.7

package/bin/claude-accounts

@@ -1,7 +1,11 @@
 #!/usr/bin/env bash
 # claude-accounts — manage the claude-multiacc account pool.
 # Subcommands: list status add import remove mint sync verify limits post-sync health
+#              expired relogin
 set -u
+# lib/audit.py is imported by several subcommands; keep the install tree free of
+# __pycache__ (it may be root-owned, read-only, or an npm global prefix).
+export PYTHONDONTWRITEBYTECODE=1
 
 _self="$0"
 while [ -L "$_self" ]; do
@@ -29,6 +33,14 @@ USAGE
       recent sign-in — use it when you want the account usable on the server too).
   claude-accounts login <acct-NN> [--token] [--force]
       complete/refresh auth for an existing account (full login, or --token)
+  claude-accounts expired [--quiet]
+      which accounts CANNOT authenticate (expired refresh token, revoked grant, no
+      login on this machine) and why. These are excluded from selection — `claude`
+      never runs under them. Exits 1 when any account needs a human. --quiet prints
+      bare ids for scripts.
+  claude-accounts relogin [acct-NN ...] [--all] [--token] [--yes]
+      sign in again, one account at a time. With no arguments it re-authenticates
+      exactly what `expired` lists; --all covers every account. Syncs once at the end.
   claude-accounts import <email> [opts]     register an account, optionally with credentials
       --id acct-NN          explicit id (default: next free)
       --home mac|server     which machine owns the OAuth grant (default: this one)
@@ -136,10 +148,13 @@ auto_sync() { # best effort after mutations, Mac only, loud on failure
 
 cmd_list() {
   require_manifest
-  "$PYBIN" - "$MANIFEST" "$ACC_ROOT" <<'PYEOF'
+  "$PYBIN" - "$MANIFEST" "$ACC_ROOT" "$LIB_DIR" "$(machine_kind)" <<'PYEOF'
 import json, os, re, sys
 doc = json.load(open(sys.argv[1]))
 root = sys.argv[2]
+sys.path = [sys.argv[3]] + [p for p in sys.path if p not in ('', '.')]
+from audit import audit_account   # noqa: E402  (shared with the shim's rule)
+machine = sys.argv[4]
 # Only render well-formed ids — a hand-edited manifest must not surface a traversal id.
 accounts = [a for a in doc.get('accounts', [])
             if isinstance(a, dict) and re.fullmatch(r'acct-\d{2}', str(a.get('id', '')))]
@@ -153,7 +168,24 @@ for a in accounts:
     if os.path.getsize(os.path.join(d, 'server.token')) > 0 if os.path.isfile(os.path.join(d, 'server.token')) else False:
         auth.append('token')
     limited = os.path.isfile(os.path.join(d, '.limited'))
-    print(f"{a['id']}  {a['email']:<28} home={a.get('home','?'):<7} auth={'+'.join(auth) or 'NONE':<11} {'LIMITED' if limited else ''}")
+    st = audit_account(root, a, machine=machine)
+    flags = []
+    if st['state'] == 'expired':
+        flags.append('EXPIRED-LOGIN')
+    elif st['state'] == 'blocked':
+        flags.append('ORG-BLOCKED')
+    elif st['state'] == 'missing':
+        flags.append('NO-LOGIN')
+    if limited:
+        flags.append('LIMITED')
+    print(f"{a['id']}  {a['email']:<28} home={a.get('home','?'):<7} "
+          f"auth={'+'.join(auth) or 'NONE':<11} {' '.join(flags)}")
+bad = [a for a in accounts
+       if audit_account(root, a, machine=machine)['state']
+       in ('expired', 'blocked', 'missing')]
+if bad:
+    print()
+    print(f"{len(bad)} account(s) are NOT usable — details: claude-accounts expired")
 seen = {}
 for a in accounts:
     seen.setdefault(a.get('email', '').lower(), []).append(a['id'])
@@ -167,10 +199,13 @@ PYEOF
 
 cmd_status() {
   require_manifest
-  "$PYBIN" - "$MANIFEST" "$ACC_ROOT" <<'PYEOF'
+  "$PYBIN" - "$MANIFEST" "$ACC_ROOT" "$LIB_DIR" "$(machine_kind)" <<'PYEOF'
 import json, os, sys, time
 doc = json.load(open(sys.argv[1]))
 root = sys.argv[2]
+sys.path = [sys.argv[3]] + [p for p in sys.path if p not in ('', '.')]
+from audit import audit_account   # noqa: E402  (shared with the shim's rule)
+machine = sys.argv[4]
 now = time.time()
 
 def last_pick(aid):
@@ -192,10 +227,20 @@ print(f"pool root : {root}")
 print(f"server    : {doc.get('server','-')}  (root: {doc.get('server_root','-')})")
 print(f"threshold : {doc.get('threshold', 90)}% (any bucket at/above => account excluded)")
 print()
+needs_login = []
 for a in doc.get('accounts', []):
     aid = a['id']
     d = os.path.join(root, aid)
-    print(f"{aid}  {a['email']}  [home={a.get('home','?')}]")
+    st = audit_account(root, a, machine=machine)
+    if st['state'] in ('expired', 'blocked', 'missing'):
+        needs_login.append(aid)
+    banner = {'ok': '', 'remote': '  [not logged in here — grant lives elsewhere]',
+              'missing': '  ** NO LOGIN — claude-accounts relogin %s **' % aid,
+              'expired': '  ** LOGIN EXPIRED — claude-accounts relogin %s **' % aid,
+              'blocked': '  ** ORG BLOCKED — Claude Code disabled for this account **',
+              }[st['state']]
+    print(f"{aid}  {a['email']}  [home={a.get('home','?')}]{banner}")
+    print(f"  selectable  : {'yes' if st['state'] == 'ok' else 'NO — ' + st['reason']}")
     cpath = os.path.join(d, '.credentials.json')
     if os.path.isfile(cpath):
         try:
@@ -241,6 +286,9 @@ for a in doc.get('accounts', []):
         print("  marker      : none (eligible)")
     print(f"  last picked : {last_pick(aid)}")
     print()
+if needs_login:
+    print(f"{len(needs_login)} account(s) are EXCLUDED from selection: {', '.join(needs_login)}")
+    print("What each one needs: claude-accounts expired")
 PYEOF
 }
 
@@ -331,6 +379,7 @@ cmd_add() {
     warn "signed in as $got (you named $email) — registering the account that actually authenticated"
   fi
   manifest_add_account "$id" "$got" "$(machine_kind)"
+  clear_auth_markers "$d"
   mutate_unlock
   RESERVED_DIR=""            # committed — the trap must not delete it now
   trap - EXIT INT TERM
@@ -640,7 +689,12 @@ TIP
   else
     CLAUDE_CONFIG_DIR="$d" CLAUDE_SHIM_ACTIVE=1 "$real" auth login --claudeai || true
   fi
-  [ -f "$d/.credentials.json" ]
+  # Success is a credential that can AUTHENTICATE — not merely a file that exists.
+  # Re-login targets already have a (dead) .credentials.json on disk, so a bare
+  # existence test would call an aborted sign-in a success, clear the dead-auth
+  # marker, and hand the account straight back to the pool.
+  [ -f "$d/.credentials.json" ] || return 1
+  creds_alive "$d"
 }
 
 cmd_mint() {
@@ -665,6 +719,7 @@ cmd_mint() {
     || die "that is not a subscription setup-token (sk-ant-oat...). API keys are not supported."
   ( umask 077; printf '%s' "$tok" > "$d/server.token" )
   chmod 600 "$d/server.token"
+  clear_auth_markers "$d"
   log_to ops.log "mint $id"
   echo "Token saved to $d/server.token"
   auto_sync
@@ -706,19 +761,159 @@ PYEOF
     fi
     ( umask 077; printf '%s' "$CEREMONY_TOKEN" > "$d/server.token" )
     chmod 600 "$d/server.token"
+    clear_auth_markers "$d"
     echo "$id token saved (portable — works on Mac and server)."
   else
-    run_login_ceremony "$d" "$email" || die "login failed or aborted — nothing changed"
+    run_login_ceremony "$d" "$email" \
+      || die "login failed or aborted (no working credential landed) — nothing changed"
     got="$(config_dir_email "$d")"
     if [ -n "$got" ] && [ "$got" != "$email" ] && [ "$force" != "1" ]; then
       die "you signed in as $got but $id is $email — nothing saved (use --force to override)"
     fi
+    if [ -z "$got" ] && [ "$force" != "1" ]; then
+      die "signed in, but the account identity could not be read back — refusing to call $id fixed (retry, or pass --force)"
+    fi
+    clear_auth_markers "$d"
     echo "$id login saved (.credentials.json, this machine, auto-refreshing)."
   fi
   log_to ops.log "login $id verified=${got:-unverified} mode=$([ "$token" = 1 ] && echo token || echo login)"
   auto_sync
 }
 
+cmd_expired() {
+  # Which accounts CANNOT authenticate right now — the pool's re-login worklist.
+  # Same rule the shim selects by (lib/audit.py), so what is listed here is exactly
+  # what is excluded from selection.
+  require_manifest
+  local quiet=0
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --quiet|--ids) quiet=1; shift ;;   # ids only, for scripts
+      *) die "unknown option: $1 (usage: claude-accounts expired [--quiet])" ;;
+    esac
+  done
+  local rows bad
+  rows="$(account_audit)" || die "the account audit failed — cannot say which logins are dead"
+  if [ -z "$rows" ]; then
+    # No rows at all: either the pool is genuinely empty, or the manifest lost its
+    # accounts. Never render that as "all clear".
+    if [ -z "$(account_ids)" ]; then
+      echo "No accounts registered yet — add one with: claude-accounts add"
+      return 0
+    fi
+    die "the manifest lists accounts but none could be audited — check $MANIFEST"
+  fi
+  bad="$(printf '%s\n' "$rows" | awk -F'\t' 'NF >= 4 && $1 != "" && ($4 == "expired" || $4 == "blocked" || $4 == "missing") { print $1 }')"
+  if [ "$quiet" = "1" ]; then
+    [ -n "$bad" ] || return 0
+    printf '%s\n' "$bad"
+    return 1
+  fi
+  printf '%s\n' "$rows" | awk -F'\t' '
+    BEGIN { bad = 0; ok = 0; remote = 0; relogin = 0 }
+    NF < 4 || $1 == "" { next }          # never invent an account from a blank line
+    $4 == "ok"     { ok++; next }
+    $4 == "remote" { remote++; rem = rem sprintf("  %-9s %-28s %s\n", $1, $2, $6); next }
+    {
+      bad++
+      relogin++
+      printf "  %-9s %-28s %-9s %s\n", $1, $2, $5, $6
+      printf "  %-9s %-28s %-9s fix: %s\n", "", "", "", $7
+    }
+    END {
+      if (bad == 0) printf "All %d account(s) with a login on this machine can authenticate.\n", ok
+      else printf "\n%d account(s) cannot be used, %d fine.\n", bad, ok
+      if (remote > 0) {
+        printf "\nNot logged in here on purpose (another machine owns the grant):\n"
+        printf "%s", rem
+      }
+      if (relogin > 0) {
+        printf "\nRe-authenticate them:\n"
+        printf "  claude-accounts relogin            # every account that needs it\n"
+        printf "  claude-accounts relogin acct-NN    # just one\n"
+      }
+    }'
+  # Exit 1 when something needs a human, so cron/health checks can alert on it.
+  [ -z "$bad" ]
+}
+
+cmd_relogin() {
+  # Re-authenticate accounts whose login died. With no arguments it targets exactly
+  # what `expired` lists; ids (or --all) override that. Runs the same verified login
+  # ceremony as `login`, one account at a time, and syncs ONCE at the end.
+  require_manifest
+  local all=0 yes=0 token=0 ids=""
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --all) all=1; shift ;;
+      --yes|-y) yes=1; shift ;;
+      --token) token=1; shift ;;
+      --*) die "unknown option: $1" ;;
+      *)
+        valid_acct_id "$1" || die "not a valid account id: $1"
+        account_ids | grep -qx "$1" || die "unknown account: $1"
+        ids="$ids $1"; shift ;;
+    esac
+  done
+  if [ -n "$ids" ] && [ "$all" = "1" ]; then
+    die "give account ids OR --all, not both"
+  fi
+  if [ -z "$ids" ]; then
+    if [ "$all" = "1" ]; then
+      ids="$(account_ids | tr '\n' ' ')"
+    else
+      # Only what a sign-in can actually fix — org-blocked accounts are listed by
+      # `expired` but signing into them again would fail exactly the same way.
+      # A FAILED audit must not read as "nothing to do".
+      account_audit >/dev/null || die "the account audit failed — refusing to guess what needs a re-login"
+      ids="$(accounts_needing_login | tr '\n' ' ')"
+    fi
+  fi
+  ids="$(printf '%s' "$ids" | tr -s ' ' | sed 's/^ //; s/ $//')"
+  if [ -z "$ids" ]; then
+    echo "Nothing to re-authenticate — every account on this machine can be used."
+    return 0
+  fi
+  local count rows
+  count="$(printf '%s\n' "$ids" | tr ' ' '\n' | grep -c .)"
+  rows="$(account_audit)"
+  echo "Accounts to re-authenticate ($count):"
+  local id
+  for id in $ids; do
+    printf '  %s  %s\n' "$id" \
+      "$(printf '%s\n' "$rows" | awk -F'\t' -v i="$id" '$1 == i { print $2 "  (" $5 ")" }')"
+  done
+  if [ "$yes" != "1" ]; then
+    if [ ! -t 0 ]; then
+      die "relogin is interactive (each account needs a browser sign-in) — run it from a terminal, or pass --yes"
+    fi
+    printf 'Sign in to each of them now? [y/N] '
+    read -r ans
+    case "$ans" in y|Y|yes) ;; *) echo "aborted"; return 1 ;; esac
+  fi
+  # One sync at the end instead of one per account: each auto_sync is an ssh round trip.
+  local prev_no_sync="${CLAUDE_MULTIACC_NO_SYNC:-0}" failed="" done_ok=0
+  export CLAUDE_MULTIACC_NO_SYNC=1
+  for id in $ids; do
+    echo
+    echo "=== $id ==============================================================="
+    if [ "$token" = "1" ]; then
+      ( cmd_login "$id" --token ) && done_ok=$((done_ok + 1)) || failed="$failed $id"
+    else
+      ( cmd_login "$id" ) && done_ok=$((done_ok + 1)) || failed="$failed $id"
+    fi
+  done
+  export CLAUDE_MULTIACC_NO_SYNC="$prev_no_sync"
+  [ "$prev_no_sync" = "0" ] && unset CLAUDE_MULTIACC_NO_SYNC
+  echo
+  echo "re-authenticated $done_ok of $count account(s)."
+  if [ -n "$failed" ]; then
+    warn "still failing:$failed (re-run: claude-accounts relogin$failed)"
+  fi
+  [ "$done_ok" -gt 0 ] && auto_sync
+  [ -z "$failed" ]
+}
+
 cmd_limits() {
   require_manifest
   local quiet=0 force=0
@@ -791,6 +986,37 @@ def parse_iso(s):
     except Exception:
         return None
 
+# `.expired` — the persistent "this account cannot authenticate" marker the shim
+# honors. Written only for a PROVEN dead grant (expired/absent refresh token, or a
+# 4xx from the refresh endpoint), never for a transient network/5xx/429 hiccup.
+def mark_expired(d, slug, detail=''):
+    mpath = os.path.join(d, '.expired')
+    try:
+        with open(mpath + '.tmp', 'w') as f:
+            f.write(f'{int(now)}\n')
+            f.write(f"reason={slug} marked_at="
+                    f"{time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())} detail={detail}\n")
+        os.replace(mpath + '.tmp', mpath)
+    except Exception:
+        pass
+
+def clear_expired(d):
+    """A usage fetch that succeeded PROVES the bearer works — drop any dead-auth mark.
+    EXCEPT an org-blocked one: those accounts authenticate perfectly (telemetry works),
+    they are just barred from Claude Code inference, so telemetry says nothing about
+    them. Only a passing `verify` (a real call) or a re-login lifts that."""
+    mpath = os.path.join(d, '.expired')
+    try:
+        if 'reason=org-blocked' in open(mpath, errors='replace').read():
+            return False
+    except OSError:
+        return False
+    try:
+        os.remove(mpath)
+        return True
+    except OSError:
+        return False
+
 try:
     manifest = json.load(open(os.path.join(root, 'accounts.json')))
 except Exception as e:
@@ -812,12 +1038,20 @@ def refresh_oauth(aid, d, cpath):
             return None
     except Exception:
         return None
-    if not o.get('refreshToken') or not o.get('accessToken'):
+    if not o.get('accessToken'):
+        return None
+    if not o.get('refreshToken'):
+        mark_expired(d, 'no-refresh-token',
+                     'credential has no refresh token and its access token expired')
         return None
     if o.get('expiresAt', 0) / 1000.0 > now - REFRESH_MIN_EXPIRED:
         return None  # not expired long enough to prove no live session owns it
     if o.get('refreshTokenExpiresAt', 0) / 1000.0 <= now:
-        say(f'{aid}: refresh token expired — re-login needed (claude-accounts login {aid})')
+        # Nothing can revive this account: park it so the shim stops selecting it
+        # (every run under it would fail with "OAuth session expired").
+        mark_expired(d, 'refresh-token-expired',
+                     'the refresh token itself expired; only a re-login can fix it')
+        say(f'{aid}: refresh token expired — re-login needed (claude-accounts relogin {aid})')
         return None
     if not force:
         try:
@@ -826,10 +1060,11 @@ def refresh_oauth(aid, d, cpath):
         except Exception:
             pass
 
-    def back_off(wait, why):
+    def back_off(wait, why, denials=0):
         try:
             with open(spath + '.tmp', 'w') as f:
                 json.dump({'retry_after': int(now + wait), 'error': why,
+                           'denials': denials,
                            'at': time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())}, f)
             os.replace(spath + '.tmp', spath)
         except Exception:
@@ -847,8 +1082,31 @@ def refresh_oauth(aid, d, cpath):
         data = json.loads(urllib.request.urlopen(req, timeout=30).read().decode())
     except urllib.error.HTTPError as e:
         if e.code in (400, 401, 403):
+            # A 4xx from the TOKEN endpoint is only proof of a dead grant when the
+            # server says so (OAuth's invalid_grant). Everything else 4xx — a bad
+            # client_id, an endpoint change, a WAF page, a provider incident — would
+            # hit EVERY account at once, so it must never park the whole pool on the
+            # first try: back off, and only park after this account has been refused
+            # repeatedly.
+            body = ''
+            try:
+                body = e.read().decode('utf-8', 'replace')[:400]
+            except Exception:
+                pass
+            denials = 1
+            try:
+                denials = int(json.load(open(spath)).get('denials', 0)) + 1
+            except Exception:
+                pass
+            if 'invalid_grant' in body:
+                mark_expired(d, f'refresh-denied-http-{e.code}',
+                             'the refresh grant was refused as invalid_grant (revoked or rotated away)')
+            elif denials >= 3:
+                mark_expired(d, f'refresh-denied-http-{e.code}',
+                             f'the refresh grant was refused {denials} times in a row')
             back_off(REFRESH_DENIED_BACKOFF,
-                     f'HTTP {e.code} — refresh token may be revoked; re-login needed')
+                     f'HTTP {e.code} — refresh token may be revoked; re-login needed',
+                     denials=denials)
         else:
             back_off(REFRESH_FAIL_BACKOFF, f'HTTP {e.code}')
         return None
@@ -885,6 +1143,9 @@ def refresh_oauth(aid, d, cpath):
         os.remove(spath)
     except OSError:
         pass
+    # The grant answered: whatever parked this account before, it authenticates now.
+    if clear_expired(d):
+        say(f'{aid}: dead-auth marker cleared (refresh grant works again)')
     say(f'{aid}: oauth access token refreshed via refresh-token grant')
     return tok
 
@@ -1065,6 +1326,9 @@ for acct in manifest.get('accounts', []):
     with open(tmp, 'w') as f:
         json.dump(out, f, indent=1)
     os.replace(tmp, lpath)
+    # The fetch went through with this account's own bearer => its auth is alive.
+    if clear_expired(d):
+        say(f'{aid}: dead-auth marker cleared (authenticated successfully)')
     offenders = [b for b in buckets if b['percent'] >= threshold]
     mpath = os.path.join(d, '.limited')
     if offenders:
@@ -1107,15 +1371,40 @@ cmd_verify() {
   if [ "$quick" = "0" ]; then
     real="$(find_real_claude "$_self")" || die "real claude binary not found"
   fi
-  "$PYBIN" - "$ACC_ROOT" "$quick" "$real" <<'PYEOF'
-import json, os, subprocess, sys, time
+  "$PYBIN" - "$ACC_ROOT" "$quick" "$real" "$LIB_DIR" "$(machine_kind)" <<'PYEOF'
+import json, os, re, subprocess, sys, time
 
 root, quick, real = sys.argv[1], sys.argv[2] == '1', sys.argv[3]
+sys.path = [sys.argv[4]] + [p for p in sys.path if p not in ('', '.')]
+from audit import audit_account, creds_state   # noqa: E402  (shared with the shim's rule)
+machine = sys.argv[5]
 now = time.time()
 manifest = json.load(open(os.path.join(root, 'accounts.json')))
 failures = 0
 tested = 0
 
+# Same failure vocabulary the shim retries on (bin/claude: AUTHPAT / ORGPAT).
+AUTH_ERR = re.compile(
+    r'401|403|unauthorized|authentication[_ ]error|invalid[_ ](bearer|token|api key)'
+    r'|token (expired|revoked|invalid)|oauth.*(error|expired|invalid)|session expired'
+    r'|could not be refreshed|please (run|sign in|log ?in)|re-?authenticate', re.I)
+ORG_ERR = re.compile(
+    r'organization has disabled|subscription access.*disabl|disabled claude subscription'
+    r'|ask your admin to enable|not authorized to use claude code', re.I)
+
+def mark_expired(d, slug, detail=''):
+    """Park an account the shim must stop selecting. Verify is the strongest signal
+    there is — a real inference call that came back 'not authenticated'."""
+    mpath = os.path.join(d, '.expired')
+    try:
+        with open(mpath + '.tmp', 'w') as f:
+            f.write(f'{int(time.time())}\n')
+            f.write(f"reason={slug} marked_at="
+                    f"{time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())} detail={detail}\n")
+        os.replace(mpath + '.tmp', mpath)
+    except Exception:
+        pass
+
 for acct in manifest.get('accounts', []):
     aid = acct['id']
     d = os.path.join(root, aid)
@@ -1131,8 +1420,11 @@ for acct in manifest.get('accounts', []):
         try:
             c = json.load(open(cpath)).get('claudeAiOauth', {})
             rexp = c.get('refreshTokenExpiresAt', 0) / 1000.0
-            if rexp and rexp < now:
-                print(f'{aid} {acct["email"]}: FAIL (refresh token expired — re-login)')
+            if rexp and rexp < now and not has_token:
+                mark_expired(d, 'refresh-token-expired',
+                             'the refresh token itself expired; only a re-login can fix it')
+                print(f'{aid} {acct["email"]}: FAIL (refresh token expired — '
+                      f'run: claude-accounts relogin {aid})')
                 failures += 1
                 continue
         except Exception as e:
@@ -1140,8 +1432,16 @@ for acct in manifest.get('accounts', []):
             failures += 1
             continue
     if quick:
+        # Quick mode must agree with what the shim will actually do — presence of a
+        # credential file is not proof it can authenticate.
+        st = audit_account(root, acct, machine=machine)
         kind = 'oauth' if has_creds else 'token'
-        print(f'{aid} {acct["email"]}: OK (quick, {kind} present)')
+        if st['state'] == 'ok':
+            print(f'{aid} {acct["email"]}: OK (quick, {kind} present)')
+        else:
+            print(f'{aid} {acct["email"]}: FAIL ({st["label"]} — {st["reason"]})'
+                  + (f'; fix: {st["fix"]}' if st['fix'] else ''))
+            failures += 1
         continue
     env = dict(os.environ)
     env['CLAUDE_CONFIG_DIR'] = d
@@ -1149,7 +1449,10 @@ for acct in manifest.get('accounts', []):
     env.pop('CLAUDE_CODE_OAUTH_TOKEN', None)
     env.pop('CLAUDE_ACCOUNT', None)
     env['CLAUDE_SHIM_ACTIVE'] = '1'
-    if not has_creds:
+    # Mirror the shim's acct_token(): a portable token is what actually authenticates
+    # whenever there is no credential OR the credential beside it is dead. Testing such
+    # an account with the dead credential would fail it — and park a healthy account.
+    if has_token and (not has_creds or creds_state(cpath, now)[0] != 'ok'):
         env['CLAUDE_CODE_OAUTH_TOKEN'] = open(tpath).read().strip()
     t0 = time.time()
     try:
@@ -1163,10 +1466,28 @@ for acct in manifest.get('accounts', []):
     dt = time.time() - t0
     out = (r.stdout or '').strip()
     if r.returncode == 0 and 'ok' in out.lower():
+        # A real call succeeded: this account is definitively alive.
+        try:
+            os.remove(os.path.join(d, '.expired'))
+        except OSError:
+            pass
         print(f'{aid} {acct["email"]}: PASS ({dt:.1f}s) -> {out[:60]!r}')
     else:
         err = (r.stderr or '').strip()[:200]
-        print(f'{aid} {acct["email"]}: FAIL rc={r.returncode} out={out[:120]!r} err={err!r}')
+        hint = ''
+        if ORG_ERR.search(out) or ORG_ERR.search(err):
+            # Not an auth problem: the account authenticates fine, its organization
+            # has simply turned Claude Code subscription access off. Park it — a
+            # re-login changes nothing — and say what actually helps.
+            mark_expired(d, 'org-blocked',
+                         "the account's organization has disabled Claude Code access")
+            hint = (f' — ORG BLOCKED, excluded from the pool; '
+                    f'try: claude-accounts relogin {aid}')
+        elif AUTH_ERR.search(out) or AUTH_ERR.search(err):
+            mark_expired(d, 'auth-error', 'a real call came back not-authenticated')
+            hint = f' — login is dead, run: claude-accounts relogin {aid}'
+        print(f'{aid} {acct["email"]}: FAIL rc={r.returncode} '
+              f'out={out[:120]!r} err={err!r}{hint}')
         failures += 1
 
 print()
@@ -1225,8 +1546,12 @@ PYEOF
     ssh -o BatchMode=yes "$server" "mkdir -p '$sroot/$id'" >>"$ACC_ROOT/sync.log" 2>&1 \
       || fail "mkdir $id failed"
     if [ -s "$d/server.token" ]; then
-      rsync -az --chmod=F600 "$d/server.token" "$server:$sroot/$id/" >>"$ACC_ROOT/sync.log" 2>&1 \
+      # NB: no --chmod — macOS 26 ships openrsync, which rejects it (the push would
+      # fail outright). The mode is fixed with an explicit remote chmod instead.
+      rsync -az "$d/server.token" "$server:$sroot/$id/" >>"$ACC_ROOT/sync.log" 2>&1 \
         || fail "token push for $id failed"
+      ssh -o BatchMode=yes "$server" "chmod 600 '$sroot/$id/server.token'" \
+        >>"$ACC_ROOT/sync.log" 2>&1 || fail "token chmod for $id failed"
     fi
     local seed
     for seed in .claude.json settings.json; do
@@ -1355,6 +1680,8 @@ case "${1:-help}" in
   remove) shift; cmd_remove "$@" ;;
   mint) shift; cmd_mint "$@" ;;
   login) shift; cmd_login "$@" ;;
+  expired) shift; cmd_expired "$@" ;;
+  relogin|re-login) shift; cmd_relogin "$@" ;;
   sync) shift; cmd_sync "$@" ;;
   verify) shift; cmd_verify "$@" ;;
   limits) shift; cmd_limits "$@" ;;