claude-multiacc 2.0.10 → 2.0.11

package/bin/claude-accounts

@@ -508,8 +508,7 @@ cmd_add() {
     # Portable setup-token variant (works on Mac AND server; needs a recent sign-in).
     echo "Preparing $id for $elabel (portable token) — NOTHING is registered until sign-in completes."
     run_token_ceremony "$d" || die "sign-in failed or aborted — nothing was created"
-    ( umask 077; printf '%s' "$CEREMONY_TOKEN" > "$d/server.token" )
-    chmod 600 "$d/server.token"
+    commit_ceremony_token "$d" "$CEREMONY_TOKEN" "$id"
     got="$(token_email "$CEREMONY_TOKEN")"
   else
     # Default: full Claude Code login (full scopes, no long-lived-token step-up).
@@ -571,7 +570,9 @@ EOF
 
 add_cleanup_reserved() {
   # EXIT trap for cmd_add: remove a reserved-but-uncommitted account dir (and, in case
-  # we died mid-critical-section, release the lock).
+  # we died mid-critical-section, release the lock). A ceremony interrupted mid-way
+  # must also hand the terminal back at its own width.
+  restore_ceremony_tty 2>/dev/null || true
   [ -n "${RESERVED_DIR:-}" ] && rm -rf "$RESERVED_DIR" 2>/dev/null
   mutate_unlock 2>/dev/null || true
 }
@@ -794,6 +795,137 @@ valid_subscription_token() {
   esac
 }
 
+# A complete subscription setup-token is 108 characters (sk-ant-oat01- + 95). The
+# ceremony scrapes it from a terminal transcript, and the client's TUI HARD-WRAPS at
+# the pty's width — an unsized pty (the panel's) renders as 80 columns. Every
+# panel-driven mint of 2026-08-28 therefore saved the first 79 characters of a
+# 108-character token; the fleet rejected all seven with 401 while the minting Mac,
+# still holding its OAuth login, looked healthy. Two guards, belt and braces: the
+# terminal is widened for the ceremony, and the capture must pass a real inference
+# before it is saved anywhere.
+SETUP_TOKEN_FULL_LEN=108
+CEREMONY_TTY_MIN_COLS=160
+CEREMONY_TTY_COLS=400
+CEREMONY_TTY_ORIG=""
+
+widen_ceremony_tty() {
+  CEREMONY_TTY_ORIG=""
+  [ -t 0 ] || return 0
+  local size rows cols
+  size="$(stty size 2>/dev/null)" || return 0
+  rows="${size%% *}"; cols="${size##* }"
+  case "$cols" in ''|*[!0-9]*) return 0 ;; esac
+  case "$rows" in ''|*[!0-9]*) rows=0 ;; esac
+  [ "$cols" -ge "$CEREMONY_TTY_MIN_COLS" ] && return 0
+  CEREMONY_TTY_ORIG="$rows $cols"
+  # `script` copies stdin's window size to the pty it opens for the client, so
+  # widening here is what the client sees. A zero row count is an unsized pty too.
+  stty cols "$CEREMONY_TTY_COLS" rows "$([ "$rows" -gt 0 ] && echo "$rows" || echo 50)" 2>/dev/null \
+    || CEREMONY_TTY_ORIG=""
+}
+
+restore_ceremony_tty() {
+  [ -n "$CEREMONY_TTY_ORIG" ] || return 0
+  stty rows "${CEREMONY_TTY_ORIG%% *}" cols "${CEREMONY_TTY_ORIG##* }" 2>/dev/null || true
+  CEREMONY_TTY_ORIG=""
+}
+
+token_digest() { # $1 token; prints a non-secret sha256 digest (same as the shim's)
+  local h=""
+  if command -v shasum >/dev/null 2>&1; then
+    h="$(printf '%s' "$1" | shasum -a 256 2>/dev/null)"
+  elif command -v sha256sum >/dev/null 2>&1; then
+    h="$(printf '%s' "$1" | sha256sum 2>/dev/null)"
+  fi
+  printf '%s' "$h" | cut -d ' ' -f1
+}
+
+record_token_verified() { # $1 acct dir, $2 token — the shim's own proof marker (token_preflight)
+  local digest
+  digest="$(token_digest "$2")"
+  [ -n "$digest" ] || return 0
+  { umask 077; printf '%s\n' "$digest" > "$1/.server-token-verified.$$"; } 2>/dev/null \
+    && mv -f "$1/.server-token-verified.$$" "$1/.server-token-verified" 2>/dev/null \
+    || rm -f "$1/.server-token-verified.$$" 2>/dev/null || true
+}
+
+# Prove a captured token with ONE real inference before it is saved. rc 0 = Claude
+# answered with it; rc 1 = Claude REJECTED it (401: revoked, wrong account's grant,
+# or captured incomplete); rc 2 = inconclusive (network, 429, timeout). The probe runs
+# in an EMPTY config dir: the account dir may hold an OAuth login the client would
+# silently prefer, and this must exercise the captured token and nothing else. The
+# token travels by environment, never argv.
+CEREMONY_CHECK_DETAIL=""
+ceremony_probe() { # $1 = real claude, $2 = empty config dir; token in CEREMONY_TOKEN_UNDER_TEST
+  "$PYBIN" - "$1" "$2" "$ACC_ROOT" <<'PYEOF'
+import os, re, subprocess, sys
+real, cfg, root = sys.argv[1], sys.argv[2], sys.argv[3]
+env = {k: v for k, v in os.environ.items()
+       if k not in ('ANTHROPIC_API_KEY', 'CLAUDE_ACCOUNT', 'CEREMONY_TOKEN_UNDER_TEST')}
+env['CLAUDE_CONFIG_DIR'] = cfg
+env['CLAUDE_CODE_OAUTH_TOKEN'] = os.environ['CEREMONY_TOKEN_UNDER_TEST']
+env['CLAUDE_SHIM_ACTIVE'] = '1'
+# The shim's own vocabulary for a rejected token (bin/claude token_preflight).
+AUTH = re.compile(r'failed to authenticate|oauth (access )?token is invalid|oauth session expired'
+                  r'|please run /login|invalid bearer token|authentication_error|\b401\b', re.I)
+try:
+    r = subprocess.run([real, '-p', '--output-format', 'text', '--max-turns', '1'],
+                       env=env, capture_output=True, text=True, timeout=180,
+                       input='Reply with exactly: OK\n', cwd=root)
+except subprocess.TimeoutExpired:
+    print('inconclusive\ttimed out after 180s'); sys.exit(0)
+except OSError as exc:
+    print(f'inconclusive\t{exc}'); sys.exit(0)
+out, err = (r.stdout or '').strip(), (r.stderr or '').strip()
+if r.returncode == 0 and 'ok' in out.lower():
+    print('ok\t'); sys.exit(0)
+if AUTH.search(out) or AUTH.search(err):
+    print('rejected\t' + (err or out)[:160].replace('\n', ' ')); sys.exit(0)
+print('inconclusive\t' + f'rc={r.returncode} ' + (err or out)[:160].replace('\n', ' '))
+PYEOF
+}
+
+ceremony_token_check() { # $1 = token
+  local tok="$1" real tmpd verdict
+  CEREMONY_CHECK_DETAIL=""
+  real="$(find_real_claude "$_self")" || { CEREMONY_CHECK_DETAIL="real claude binary not found"; return 2; }
+  mkdir -p "$ACC_ROOT/tmp" 2>/dev/null || true
+  tmpd="$(mktemp -d "$ACC_ROOT/tmp/mint-check.XXXXXX" 2>/dev/null)" \
+    || { CEREMONY_CHECK_DETAIL="cannot create a scratch config dir"; return 2; }
+  chmod 700 "$tmpd" 2>/dev/null || true
+  verdict="$(CEREMONY_TOKEN_UNDER_TEST="$tok" ceremony_probe "$real" "$tmpd")"
+  rm -rf "$tmpd" 2>/dev/null || true
+  case "$verdict" in
+    ok*) return 0 ;;
+    rejected*) CEREMONY_CHECK_DETAIL="${verdict#rejected	}"; return 1 ;;
+    inconclusive*) CEREMONY_CHECK_DETAIL="${verdict#inconclusive	}"; return 2 ;;
+    *) CEREMONY_CHECK_DETAIL="no verdict"; return 2 ;;
+  esac
+}
+
+# The ONE place a ceremony's token is written: only after ceremony_token_check, so a
+# token Claude rejects is never saved, uploaded, or distributed. $1 = acct dir,
+# $2 = token, $3 = acct id (messages only).
+commit_ceremony_token() {
+  local d="$1" tok="$2" id="$3" rc=0
+  ceremony_token_check "$tok" || rc=$?
+  if [ "$rc" -eq 1 ]; then
+    if [ "${#tok}" -lt "$SETUP_TOKEN_FULL_LEN" ]; then
+      die "Claude rejected the captured token (${CEREMONY_CHECK_DETAIL:-401}) — it is ${#tok} characters and a complete setup-token is $SETUP_TOKEN_FULL_LEN: the sign-in terminal wrapped it and only its first line was captured. Nothing saved for $id. Mint again from a terminal at least $CEREMONY_TTY_MIN_COLS columns wide, or from an updated panel."
+    fi
+    die "Claude rejected the captured token (${CEREMONY_CHECK_DETAIL:-401}) — nothing saved for $id; sign in again as the right account and retry"
+  fi
+  ( umask 077; printf '%s' "$tok" > "$d/server.token" )
+  chmod 600 "$d/server.token"
+  if [ "$rc" -eq 0 ]; then
+    record_token_verified "$d" "$tok"
+    echo "Token verified by a real inference."
+  else
+    rm -f "$d/.server-token-verified" 2>/dev/null || true
+    warn "the token could not be verified right now (${CEREMONY_CHECK_DETAIL:-no answer}) — saved as UNVERIFIED; the shim proves it on first use, or run: claude-accounts verify"
+  fi
+}
+
 CEREMONY_TOKEN=""
 run_token_ceremony() { # $1 = config dir
   CEREMONY_TOKEN=""
@@ -817,11 +949,16 @@ If you do see "Sign in again to continue", that is Claude's security step, not a
 error — just sign in to that account and approve; the code still appears.
 TIP
   if [ -t 0 ]; then
+    # The client's TUI hard-wraps at the pty's width, and the token is scraped from
+    # the transcript below — see SETUP_TOKEN_FULL_LEN for the 79-character tokens
+    # this produced. `script` copies the (widened) window size to the client's pty.
+    widen_ceremony_tty
     if [ "$(machine_kind)" = "mac" ]; then
       script -q "$cap" env CLAUDE_CONFIG_DIR="$d" CLAUDE_SHIM_ACTIVE=1 "$real" setup-token
     else
       script -q -c "CLAUDE_CONFIG_DIR='$d' CLAUDE_SHIM_ACTIVE=1 '$real' setup-token" "$cap"
     fi
+    restore_ceremony_tty
   else
     # Headless (tests / piped code): capture into the 0600 file only. Never tee the
     # raw token to stdout — a redirected run would write the secret to a plain log.
@@ -829,7 +966,10 @@ TIP
     sed -E 's/sk-ant-oat[0-9]{2}-[A-Za-z0-9_-]*/sk-ant-oat**-<redacted>/g' "$cap"
   fi
   umask "$old_umask"
-  CEREMONY_TOKEN="$(grep -aoE 'sk-ant-oat[0-9]{2}-[A-Za-z0-9_-]{40,}' "$cap" | tail -1)"
+  # The LONGEST match, not the last: a TUI repaints its frame many times, and a
+  # frame rendered while the terminal was still narrow holds a wrapped fragment.
+  CEREMONY_TOKEN="$(grep -aoE 'sk-ant-oat[0-9]{2}-[A-Za-z0-9_-]{40,}' "$cap" \
+    | awk '{ if (length($0) > length(best)) best = $0 } END { if (best != "") print best }')"
   rm -f "$cap"
   [ -n "$CEREMONY_TOKEN" ] || return 1
   valid_subscription_token "$CEREMONY_TOKEN" || {
@@ -941,6 +1081,8 @@ cmd_mint() {
   local email tok="" got
   email="$(account_email "$id")"
   [ -n "$email" ] || die "$id has no email in the manifest — refusing to mint a token nobody could attribute"
+  trap 'restore_ceremony_tty; exit 130' INT TERM
+  trap 'restore_ceremony_tty' EXIT
   if [ "$paste" = "1" ]; then
     printf 'Paste the sk-ant-oat... token for %s (%s): ' "$id" "${email:-unknown email}"
     read -r tok
@@ -957,8 +1099,7 @@ cmd_mint() {
   if [ -n "$got" ] && [ -n "$email" ] && [ "$got" != "$email" ]; then
     die "that token authenticates as $got but $id is $email — nothing saved"
   fi
-  ( umask 077; printf '%s' "$tok" > "$d/server.token" )
-  chmod 600 "$d/server.token"
+  commit_ceremony_token "$d" "$tok" "$id"
   clear_auth_markers "$d"
   log_to ops.log "mint $id"
   echo "Token saved to $d/server.token"
@@ -988,13 +1129,14 @@ cmd_login() {
   email="$(account_email "$id")"
   echo "Sign in as $email for $id."
   if [ "$token" = "1" ]; then
+    trap 'restore_ceremony_tty; exit 130' INT TERM
+    trap 'restore_ceremony_tty' EXIT
     run_token_ceremony "$d" || die "sign-in failed or aborted — nothing changed"
     got="$(token_email "$CEREMONY_TOKEN")"
     if [ -n "$got" ] && [ "$got" != "$email" ] && [ "$force" != "1" ]; then
       die "you signed in as $got but $id is $email — nothing saved (use --force to override)"
     fi
-    ( umask 077; printf '%s' "$CEREMONY_TOKEN" > "$d/server.token" )
-    chmod 600 "$d/server.token"
+    commit_ceremony_token "$d" "$CEREMONY_TOKEN" "$id"
     clear_auth_markers "$d"
     [ -n "$got" ] || warn "a setup token carries no identity — $id is trusted to hold $email because that is who you approved as"
     echo "$id token saved (portable — works on Mac and server)."

package/lib/audit.py

@@ -248,6 +248,12 @@ def _token_verified(d, tpath):
         return False
 
 
+# The report (`list --json`) tells the panel the same thing per Mac: a Mac reads
+# "active" for any token FILE it can see, and only this says whether a real call
+# ever succeeded with it here.
+token_verified = _token_verified
+
+
 def audit_account(root, acct, now=None, machine=None, require_verified_token=False):
     now = time.time() if now is None else now
     aid = acct.get('id', '')

package/lib/report.py

@@ -46,6 +46,7 @@ import time
 
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 import keychain  # noqa: E402
+from audit import token_verified  # noqa: E402
 
 SCHEMA = 'claude-multiacc/pool.v1'
 
@@ -172,7 +173,10 @@ def _claude_credentials(d):
     has_token = _size(tpath) > 0
     detail = {'oauth': has_oauth, 'token': has_token, 'oauth_store': None, 'keychain': None,
               'oauth_expires_at': None, 'oauth_refresh_expires_at': None,
-              'token_minted_at': None, 'token_age_days': None}
+              'token_minted_at': None, 'token_age_days': None,
+              # True once THIS exact token passed a real inference on this machine
+              # (.server-token-verified); False = present but never proven here.
+              'token_verified': token_verified(d, tpath) if has_token else None}
     o = None
     if has_oauth:
         detail['oauth_store'] = 'file'
@@ -347,6 +351,9 @@ def _account_row(root, a, aid, d, provider, jwt_claims, audit_account, now, kind
         'credential_class': cclass,
         'portable': cclass == 'portable',
         'credentials': cdetail,
+        # Flat copy for heartbeat consumers: a portable token this Mac has proven
+        # (True), holds unproven (False), or does not hold (None).
+        'token_verified': cdetail.get('token_verified') if provider == 'claude' else None,
         'limited': bool(limited),
         'limit_reset_at': _iso(reset_epoch) if limited and reset_epoch else None,
         'limit_reset_epoch': reset_epoch if limited and reset_epoch else None,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.10",
+  "version": "2.0.11",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -74,6 +74,19 @@ fi
 if [ "${1:-}" = "setup-token" ]; then
   echo "Open this sign-in link: https://claude.ai/oauth/authorize?fake=1"
   [ -n "${FAKE_TOKEN_FAIL:-}" ] && { echo "sign-in aborted" >&2; exit 1; }
+  if [ -n "${FAKE_TOKEN_FULL:-}" ]; then
+    # The real client's shape: a 108-character token that the TUI HARD-WRAPS at the
+    # terminal's width — an unsized pty (0 columns) renders as 80, and a 79-character
+    # first line is exactly what every panel mint of 2026-08-28 saved.
+    tok="sk-ant-oat01-$(printf '%66s' '' | tr ' ' W)$(printf '%23s' '' | tr ' ' T)TAILOK"
+    cols="$(stty size 2>/dev/null | awk '{print $2}')"
+    if [ -n "${FAKE_TOKEN_WRAP:-}" ] || { [ -n "$cols" ] && [ "$cols" -lt 108 ]; }; then
+      printf ' %s\n%s\n' "${tok:0:79}" "${tok:79}"
+    else
+      printf ' %s\n' "$tok"
+    fi
+    exit 0
+  fi
   echo "Your token: sk-ant-oat01-FAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKE"
   exit 0
 fi
@@ -88,6 +101,13 @@ case "${CLAUDE_CODE_OAUTH_TOKEN:-}" in
   *REVOKED*)
     echo "Please run /login · API Error: 401 OAuth access token is invalid." >&2
     exit 1 ;;
+  sk-ant-oat01-WWW*)
+    # The wrapped fixture above: only the COMPLETE token (with its tail) authenticates;
+    # its 79-character first line is what Claude answered 401 to, fleet-wide.
+    case "$CLAUDE_CODE_OAUTH_TOKEN" in
+      *TAILOK) : ;;
+      *) echo "Failed to authenticate. API Error: 401 OAuth access token is invalid." >&2; exit 1 ;;
+    esac ;;
 esac
 case " $* " in
   *" -p --output-format text --max-turns 1 "*) echo "OK"; exit 0 ;;
@@ -1263,6 +1283,86 @@ esac
 [ -s "$ACC/acct-04/server.token" ] && t_ok "add --token writes server.token" || t_fail "add --token" "missing"
 out="$(CLAUDE_ACCOUNT=acct-04 claude 2>&1)"
 check "token account exports CLAUDE_CODE_OAUTH_TOKEN" "TOK=sk-ant-oat01-FAKE" "$out"
+
+# ---- 15c1a. a ceremony's token is PROVEN before it is saved --------------------------
+# add --token above ran the inference probe: the exact token is on record as verified
+# on this machine, so the audit never calls a fresh mint UNVERIFIED — and the panel
+# can tell a proven token from one a Mac merely holds.
+[ -f "$ACC/acct-04/.server-token-verified" ] \
+  && t_ok "add --token proves the token with a real inference before saving" \
+  || t_fail "add --token verification marker" ".server-token-verified missing"
+out="$(claude-accounts list --json 2>/dev/null | python3 -c '
+import json, sys
+rows = {a["id"]: a for a in json.load(sys.stdin)["accounts"]}
+print(rows["acct-04"].get("token_verified"))')"
+[ "$out" = "True" ] && t_ok "list --json reports the token as verified here" \
+  || t_fail "list --json token_verified" "expected True, got: $out"
+# The 2026-08-28 shape: the client's TUI wrapped the 108-character token at 80 columns
+# and only its 79-character first line was captured. Claude rejects the fragment; the
+# mint must refuse to save it and say WHY (seven fleet-wide 401s were the old answer).
+orig="$(cat "$ACC/acct-04/server.token")"
+out="$(FAKE_TOKEN_FULL=1 FAKE_TOKEN_WRAP=1 claude-accounts mint acct-04 2>&1 </dev/null)"
+rc=$?
+[ "$rc" != "0" ] && t_ok "a wrapped (79-char) token capture is refused" || t_fail "wrapped token rc" "rc=0"
+check "the refusal names the truncation" "79 characters" "$out"
+check "the refusal names the cause" "terminal wrapped it" "$out"
+[ "$(cat "$ACC/acct-04/server.token")" = "$orig" ] && t_ok "a refused capture leaves the old token in place" \
+  || t_fail "refused capture" "server.token was overwritten"
+# A pasted token gets the same proof: a revoked one is refused, not saved.
+out="$(printf 'sk-ant-oat01-REVOKEDREVOKEDREVOKEDREVOKEDREVOKEDREVOKEDREVOKED' | claude-accounts mint acct-04 --paste 2>&1)"
+rc=$?
+[ "$rc" != "0" ] && t_ok "mint --paste refuses a token Claude rejects" || t_fail "paste rejected rc" "rc=0"
+check "the paste refusal says Claude rejected it" "Claude rejected the captured token" "$out"
+[ "$(cat "$ACC/acct-04/server.token")" = "$orig" ] && t_ok "a rejected paste saves nothing" \
+  || t_fail "rejected paste" "server.token was overwritten"
+
+# ---- 15c1b. the ceremony widens an unsized pty, so the whole token is captured ------
+# The panel drives the ceremony over a pty it never sized (0x0 -> the TUI renders 80
+# columns wide). Run the mint under exactly such a pty: the fake wraps its token
+# whenever the terminal is narrower than the token, so only a widened terminal yields
+# all 108 characters — and the capture must then pass the inference probe.
+cat > "$WORK/pty-run.py" <<'EOF'
+import os, pty, select, sys
+pid, fd = pty.fork()          # a fresh pty: 0 rows, 0 columns, like the panel's
+if pid == 0:
+    os.execvp(sys.argv[1], sys.argv[1:])
+buf = b''
+while True:
+    try:
+        ready, _, _ = select.select([fd], [], [], 60)
+        if not ready:
+            break
+        chunk = os.read(fd, 4096)
+    except OSError:
+        break
+    if not chunk:
+        break
+    buf += chunk
+_, status = os.waitpid(pid, 0)
+sys.stdout.write(buf.decode('utf-8', 'ignore'))
+sys.exit(os.WEXITSTATUS(status) if os.WIFEXITED(status) else 1)
+EOF
+size="$(python3 "$WORK/pty-run.py" stty size | tr -d '\r' | tail -1)"
+[ "$size" = "0 0" ] && t_ok "the test pty really is unsized (the panel's shape)" \
+  || t_fail "test pty size" "expected '0 0', got '$size'"
+if command -v script >/dev/null 2>&1; then
+  out="$(FAKE_TOKEN_FULL=1 python3 "$WORK/pty-run.py" claude-accounts mint acct-04 2>&1)"
+  rc=$?
+  [ "$rc" = "0" ] && t_ok "mint under an unsized pty succeeds" \
+    || t_fail "unsized-pty mint rc" "rc=$rc: $(printf '%s' "$out" | tail -c 300)"
+  n="$(tr -d '[:space:]' < "$ACC/acct-04/server.token" | wc -c | tr -d ' ')"
+  [ "$n" = "108" ] && t_ok "the unsized pty is widened: all 108 characters captured" \
+    || t_fail "unsized-pty capture" "saved $n characters"
+  check "the widened-pty mint verifies its token" "Token verified by a real inference" "$out"
+  case "$(tr -d '[:space:]' < "$ACC/acct-04/server.token")" in
+    *TAILOK) t_ok "the saved token is the complete one" ;;
+    *) t_fail "saved token" "tail missing" ;;
+  esac
+  [ -f "$ACC/acct-04/.server-token-verified" ] && t_ok "the widened-pty mint records its proof" \
+    || t_fail "widened-pty proof" "marker missing"
+else
+  printf 'skip unsized-pty mint (no script(1) here)\n'
+fi
 claude-accounts remove acct-04 --yes >/dev/null 2>&1
 
 # ---- 15c0. add with NO email: derives it from the verified sign-in -------------------