claude-multiacc 2.0.11 → 2.0.12

package/bin/claude-accounts

@@ -909,10 +909,13 @@ ceremony_token_check() { # $1 = token
 commit_ceremony_token() {
   local d="$1" tok="$2" id="$3" rc=0
   ceremony_token_check "$tok" || rc=$?
+  # A short capture is a wrapped one unless Claude itself has just answered with it:
+  # the length alone convicts it, so an inconclusive probe (429, network) must not let
+  # it through as merely "unverified" — that is the exact token the fleet then rejects.
+  if [ "$rc" -ne 0 ] && [ "${#tok}" -lt "$SETUP_TOKEN_FULL_LEN" ]; then
+    die "the captured token is ${#tok} characters and a complete setup-token is $SETUP_TOKEN_FULL_LEN (${CEREMONY_CHECK_DETAIL:-not proven by a real call}): the sign-in terminal wrapped it and only its first line was captured. Nothing saved for $id. Mint again from a terminal at least $CEREMONY_TTY_MIN_COLS columns wide, or from an updated panel."
+  fi
   if [ "$rc" -eq 1 ]; then
-    if [ "${#tok}" -lt "$SETUP_TOKEN_FULL_LEN" ]; then
-      die "Claude rejected the captured token (${CEREMONY_CHECK_DETAIL:-401}) — it is ${#tok} characters and a complete setup-token is $SETUP_TOKEN_FULL_LEN: the sign-in terminal wrapped it and only its first line was captured. Nothing saved for $id. Mint again from a terminal at least $CEREMONY_TTY_MIN_COLS columns wide, or from an updated panel."
-    fi
     die "Claude rejected the captured token (${CEREMONY_CHECK_DETAIL:-401}) — nothing saved for $id; sign in again as the right account and retry"
   fi
   ( umask 077; printf '%s' "$tok" > "$d/server.token" )

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.11",
+  "version": "2.0.12",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -104,6 +104,10 @@ case "${CLAUDE_CODE_OAUTH_TOKEN:-}" in
   sk-ant-oat01-WWW*)
     # The wrapped fixture above: only the COMPLETE token (with its tail) authenticates;
     # its 79-character first line is what Claude answered 401 to, fleet-wide.
+    if [ -n "${FAKE_PROBE_FLAKY:-}" ]; then
+      # Not an auth verdict at all — the API is busy. The probe is inconclusive.
+      echo "API Error: 529 Overloaded" >&2; exit 1
+    fi
     case "$CLAUDE_CODE_OAUTH_TOKEN" in
       *TAILOK) : ;;
       *) echo "Failed to authenticate. API Error: 401 OAuth access token is invalid." >&2; exit 1 ;;
@@ -1308,8 +1312,31 @@ check "the refusal names the truncation" "79 characters" "$out"
 check "the refusal names the cause" "terminal wrapped it" "$out"
 [ "$(cat "$ACC/acct-04/server.token")" = "$orig" ] && t_ok "a refused capture leaves the old token in place" \
   || t_fail "refused capture" "server.token was overwritten"
+# An INCONCLUSIVE probe (the API is busy) must not let a wrapped capture through as
+# merely "unverified": its length alone convicts it, and that is the exact token the
+# fleet then rejects on every Mac.
+out="$(FAKE_TOKEN_FULL=1 FAKE_TOKEN_WRAP=1 FAKE_PROBE_FLAKY=1 claude-accounts mint acct-04 2>&1 </dev/null)"
+rc=$?
+[ "$rc" != "0" ] && t_ok "a wrapped capture is refused even when the probe is inconclusive" \
+  || t_fail "wrapped+inconclusive rc" "rc=0"
+check "the inconclusive refusal still names the cause" "terminal wrapped it" "$out"
+[ "$(cat "$ACC/acct-04/server.token")" = "$orig" ] && t_ok "an unproven fragment saves nothing" \
+  || t_fail "unproven fragment" "server.token was overwritten"
+# …while a COMPLETE token the probe cannot reach right now is saved as UNVERIFIED — the
+# shim proves it on first use — rather than blocking the operator on a busy API.
+out="$(FAKE_TOKEN_FULL=1 FAKE_PROBE_FLAKY=1 claude-accounts mint acct-04 2>&1 </dev/null)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "a complete token survives an inconclusive probe" || t_fail "complete+inconclusive rc" "rc=$rc: $(printf '%s' "$out" | tail -c 200)"
+check "the inconclusive save says so" "saved as UNVERIFIED" "$out"
+[ "$(tr -d '[:space:]' < "$ACC/acct-04/server.token" | wc -c | tr -d ' ')" = "108" ] \
+  && t_ok "the complete token was saved" || t_fail "complete token save" "wrong length"
+[ ! -f "$ACC/acct-04/.server-token-verified" ] && t_ok "an unproven save records no proof" \
+  || t_fail "unproven proof marker" "marker present"
+printf '%s' "$orig" > "$ACC/acct-04/server.token"
 # A pasted token gets the same proof: a revoked one is refused, not saved.
-out="$(printf 'sk-ant-oat01-REVOKEDREVOKEDREVOKEDREVOKEDREVOKEDREVOKEDREVOKED' | claude-accounts mint acct-04 --paste 2>&1)"
+# (A complete-length token, so the verdict is the rejection itself and not the
+# length rule that catches wrapped fragments first.)
+out="$(printf 'sk-ant-oat01-REVOKED%s' "$(printf '%88s' '' | tr ' ' R)" | claude-accounts mint acct-04 --paste 2>&1)"
 rc=$?
 [ "$rc" != "0" ] && t_ok "mint --paste refuses a token Claude rejects" || t_fail "paste rejected rc" "rc=0"
 check "the paste refusal says Claude rejected it" "Claude rejected the captured token" "$out"