claude-multiacc 2.0.13 → 2.0.14

package/bin/claude-accounts

@@ -507,7 +507,7 @@ cmd_add() {
   if [ "$token" = "1" ]; then
     # Portable setup-token variant (works on Mac AND server; needs a recent sign-in).
     echo "Preparing $id for $elabel (portable token) — NOTHING is registered until sign-in completes."
-    run_token_ceremony "$d" || die "sign-in failed or aborted — nothing was created"
+    run_token_ceremony "$d" || die "sign-in failed or aborted — nothing was created${CEREMONY_LAST_WORDS:+ — the client said: $CEREMONY_LAST_WORDS}${CEREMONY_TRANSCRIPT:+ (transcript: $CEREMONY_TRANSCRIPT)}"
     commit_ceremony_token "$d" "$CEREMONY_TOKEN" "$id"
     got="$(token_email "$CEREMONY_TOKEN")"
   else
@@ -934,9 +934,47 @@ commit_ceremony_token() {
   fi
 }
 
+# When a ceremony ends without a token, the CLIENT said why — "Your account is on
+# hold", a policy refusal, a subscription it could not find — and that sentence is
+# the only thing that lets anyone fix it. It used to vanish with the capture file,
+# leaving "no token captured" (operator, 2026-08-29). The last visible lines are
+# kept (ANSI-stripped, spinners/logo/URL/prompt dropped, any sk-ant-… redacted) and
+# the whole redacted transcript is written beside the pool for a closer look.
+CEREMONY_LAST_WORDS=""
+CEREMONY_TRANSCRIPT=""
+ceremony_debrief() { # $1 = capture file, $2 = redacted transcript to write; prints the last words
+  "$PYBIN" - "$1" "$2" <<'PYEOF'
+import os, re, sys
+raw = open(sys.argv[1], 'rb').read().decode('utf-8', 'ignore')
+txt = re.sub(r'\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)', '', raw)      # OSC (hyperlink payloads)
+txt = re.sub(r'\x1b\[[0-9;?]*[A-Za-z]', '', txt)                  # CSI (colour, cursor)
+txt = re.sub(r'\x1b[()][A-Z0-9]', '', txt).replace('\r', '\n')
+txt = re.sub(r'sk-ant-[A-Za-z0-9]+-[A-Za-z0-9_-]+', 'sk-ant-***', txt)
+lines = []
+for ln in txt.splitlines():
+    ln = ln.strip()
+    if not ln or re.fullmatch(r'[\W_]+', ln):          # spinner frames, logo art
+        continue
+    if 'https://' in ln or re.search(r'Paste\s*code\s*here', ln):   # the sign-in link, the paste prompt
+        continue
+    if lines and lines[-1] == ln:
+        continue
+    lines.append(ln)
+try:
+    fd = os.open(sys.argv[2], os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, 'w') as f:
+        f.write('\n'.join(lines) + '\n')
+except OSError:
+    pass
+print(' | '.join(lines[-3:])[:400])
+PYEOF
+}
+
 CEREMONY_TOKEN=""
 run_token_ceremony() { # $1 = config dir
   CEREMONY_TOKEN=""
+  CEREMONY_LAST_WORDS=""
+  CEREMONY_TRANSCRIPT=""
   local d="$1" real cap old_umask
   real="$(find_real_claude "$_self")" || { warn "real claude binary not found"; return 1; }
   mkdir -p "$ACC_ROOT/tmp"
@@ -978,8 +1016,16 @@ TIP
   # frame rendered while the terminal was still narrow holds a wrapped fragment.
   CEREMONY_TOKEN="$(grep -aoE 'sk-ant-oat[0-9]{2}-[A-Za-z0-9_-]{40,}' "$cap" \
     | awk '{ if (length($0) > length(best)) best = $0 } END { if (best != "") print best }')"
+  if [ -z "$CEREMONY_TOKEN" ]; then
+    CEREMONY_TRANSCRIPT="$ACC_ROOT/tmp/mint-failed.$(date -u +%Y%m%dT%H%M%SZ).log"
+    CEREMONY_LAST_WORDS="$(ceremony_debrief "$cap" "$CEREMONY_TRANSCRIPT" 2>/dev/null)"
+    [ -s "$CEREMONY_TRANSCRIPT" ] || CEREMONY_TRANSCRIPT=""
+    rm -f "$cap"
+    [ -n "$CEREMONY_LAST_WORDS" ] && warn "the sign-in ended without a token — the client said: $CEREMONY_LAST_WORDS"
+    [ -n "$CEREMONY_TRANSCRIPT" ] && warn "redacted transcript kept at $CEREMONY_TRANSCRIPT"
+    return 1
+  fi
   rm -f "$cap"
-  [ -n "$CEREMONY_TOKEN" ] || return 1
   valid_subscription_token "$CEREMONY_TOKEN" || {
     CEREMONY_TOKEN=""
     warn "captured credential is not a subscription setup-token"
@@ -1097,7 +1143,7 @@ cmd_mint() {
     tok="$(printf '%s' "$tok" | tr -d '[:space:]')"
   else
     echo "Running 'claude setup-token' for $id — approve in a browser signed in as ${email:-THIS account}."
-    run_token_ceremony "$d" || die "no token captured — mint failed"
+    run_token_ceremony "$d" || die "no token captured — mint failed${CEREMONY_LAST_WORDS:+ — the client said: $CEREMONY_LAST_WORDS}${CEREMONY_TRANSCRIPT:+ (transcript: $CEREMONY_TRANSCRIPT)}"
     tok="$CEREMONY_TOKEN"
   fi
   [ -n "$tok" ] || die "no token captured — mint failed"
@@ -1139,7 +1185,7 @@ cmd_login() {
   if [ "$token" = "1" ]; then
     trap 'restore_ceremony_tty; exit 130' INT TERM
     trap 'restore_ceremony_tty' EXIT
-    run_token_ceremony "$d" || die "sign-in failed or aborted — nothing changed"
+    run_token_ceremony "$d" || die "sign-in failed or aborted — nothing changed${CEREMONY_LAST_WORDS:+ — the client said: $CEREMONY_LAST_WORDS}${CEREMONY_TRANSCRIPT:+ (transcript: $CEREMONY_TRANSCRIPT)}"
     got="$(token_email "$CEREMONY_TOKEN")"
     if [ -n "$got" ] && [ "$got" != "$email" ] && [ "$force" != "1" ]; then
       die "you signed in as $got but $id is $email — nothing saved (use --force to override)"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.13",
+  "version": "2.0.14",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -73,7 +73,7 @@ if [ "${1:-}" = "auth" ] && [ "${2:-}" = "login" ]; then
 fi
 if [ "${1:-}" = "setup-token" ]; then
   echo "Open this sign-in link: https://claude.ai/oauth/authorize?fake=1"
-  [ -n "${FAKE_TOKEN_FAIL:-}" ] && { echo "sign-in aborted" >&2; exit 1; }
+  [ -n "${FAKE_TOKEN_FAIL:-}" ] && { echo "${FAKE_TOKEN_FAIL_MSG:-sign-in aborted}" >&2; exit 1; }
   if [ -n "${FAKE_TOKEN_FULL:-}" ]; then
     # The real client's shape: a 108-character token that the TUI HARD-WRAPS at the
     # terminal's width — an unsized pty (0 columns) renders as 80, and a 79-character
@@ -1415,6 +1415,24 @@ check "the inconclusive save says so" "saved as UNVERIFIED" "$out"
 [ ! -f "$ACC/acct-04/.server-token-verified" ] && t_ok "an unproven save records no proof" \
   || t_fail "unproven proof marker" "marker present"
 printf '%s' "$orig" > "$ACC/acct-04/server.token"
+# The client ended the ceremony without a token and said why: that sentence must
+# reach the operator (the panel shows the mint's own error line), and the redacted
+# transcript must be kept for a closer look — "no token captured" alone left an
+# operator with nothing to act on (2026-08-29).
+out="$(FAKE_TOKEN_FAIL=1 FAKE_TOKEN_FAIL_MSG="Your account is on hold. You can close this window." claude-accounts mint acct-04 2>&1 </dev/null)"
+rc=$?
+[ "$rc" != "0" ] && t_ok "a ceremony that ends without a token fails the mint" || t_fail "no-token mint rc" "rc=0"
+check "the mint error carries the client's last words" "the client said: Your account is on hold" "$out"
+check "the mint error names the kept transcript" "transcript: $ACC/tmp/mint-failed." "$out"
+tr="$(printf '%s' "$out" | sed -n 's/.*transcript: \([^)]*\)).*/\1/p' | head -1)"
+[ -n "$tr" ] && [ -s "$tr" ] && t_ok "the redacted transcript exists" || t_fail "transcript file" "missing: '$tr'"
+grep -q 'Your account is on hold' "$tr" 2>/dev/null && t_ok "the transcript holds the client's words" \
+  || t_fail "transcript content" "message missing"
+# (python, not stat: GNU stat reads -f as "file system" and answers something else)
+[ "$(python3 -c 'import os, sys; print(oct(os.stat(sys.argv[1]).st_mode & 0o777))' "$tr")" = "0o600" ] \
+  && t_ok "the transcript is private" || t_fail "transcript mode" "not 0600"
+[ "$(cat "$ACC/acct-04/server.token")" = "$orig" ] && t_ok "a ceremony without a token saves nothing" \
+  || t_fail "no-token save" "server.token was overwritten"
 # A pasted token gets the same proof: a revoked one is refused, not saved.
 # (A complete-length token, so the verdict is the rejection itself and not the
 # length rule that catches wrapped fragments first.)