claude-multiacc 2.0.13 → 2.0.15

package/bin/claude-accounts

@@ -507,7 +507,7 @@ cmd_add() {
   if [ "$token" = "1" ]; then
     # Portable setup-token variant (works on Mac AND server; needs a recent sign-in).
     echo "Preparing $id for $elabel (portable token) — NOTHING is registered until sign-in completes."
-    run_token_ceremony "$d" || die "sign-in failed or aborted — nothing was created"
+    run_token_ceremony "$d" || die "sign-in failed or aborted — nothing was created${CEREMONY_LAST_WORDS:+ — the client said: $CEREMONY_LAST_WORDS}${CEREMONY_TRANSCRIPT:+ (transcript: $CEREMONY_TRANSCRIPT)}"
     commit_ceremony_token "$d" "$CEREMONY_TOKEN" "$id"
     got="$(token_email "$CEREMONY_TOKEN")"
   else
@@ -934,9 +934,85 @@ commit_ceremony_token() {
   fi
 }
 
+# When a ceremony ends without a token, the CLIENT said why — "Your account is on
+# hold", a policy refusal, a subscription it could not find — and that sentence is
+# the only thing that lets anyone fix it. It used to vanish with the capture file,
+# leaving "no token captured" (operator, 2026-08-29). The last visible lines are
+# kept (ANSI-stripped, spinners/logo/URL/prompt dropped, any sk-ant-… redacted) and
+# the whole redacted transcript is written beside the pool for a closer look.
+CEREMONY_LAST_WORDS=""
+CEREMONY_TRANSCRIPT=""
+ceremony_debrief() { # $1 = capture file, $2 = redacted transcript to write; prints the last words
+  "$PYBIN" - "$1" "$2" <<'PYEOF'
+import os, re, sys
+raw = open(sys.argv[1], 'rb').read().decode('utf-8', 'ignore')
+txt = re.sub(r'\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)', '', raw)          # OSC (hyperlink payloads)
+txt = re.sub(r'\x1b\[[0-9;?<>=]*[A-Za-z]', '', txt)                   # CSI, private modes too ([>4m, [<u)
+txt = re.sub(r'\x1b[()][A-Z0-9]|\x1b[78=>]|[\x0e\x0f]', '', txt)      # charset, save/restore cursor, SI/SO
+txt = txt.replace('\r', '\n')
+lines = []
+flat = re.sub(r'\s+', '', txt)
+api_key = bool(re.search(r'sk-ant-api\d{2}-', flat)) and not re.search(r'sk-ant-oat\d{2}-', flat)
+txt = re.sub(r'sk-ant-[A-Za-z0-9]+-[A-Za-z0-9_-]+', 'sk-ant-***', txt)
+for ln in txt.splitlines():
+    ln = ln.strip()
+    if not ln or re.fullmatch(r'[\W_]+', ln):          # spinner frames, logo art
+        continue
+    if 'https://' in ln or re.search(r'Paste\s*code\s*here', ln):   # the sign-in link, the paste prompt
+        continue
+    if lines and lines[-1] == ln:
+        continue
+    lines.append(ln)
+if api_key:
+    # Said LAST, so it is what the operator reads: the client minted an API key, not a
+    # subscription token — the browser session was signed into a Console org.
+    lines.append('the client minted an API KEY (sk-ant-api…), not a subscription setup-token: '
+                 'the browser session belongs to a Console / API-billing organization — sign in '
+                 'as the subscription account and try again')
+try:
+    fd = os.open(sys.argv[2], os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, 'w') as f:
+        f.write('\n'.join(lines) + '\n')
+except OSError:
+    pass
+print(' | '.join(lines[-3:])[:400])
+PYEOF
+}
+
+# The token, out of the transcript. The client's renderer places WORDS with cursor
+# moves instead of spaces and can emit a long token as positioned, styled segments;
+# a narrow terminal wraps it. A raw-bytes grep therefore missed a perfectly good token
+# on 2026-08-29 ("no token captured" after "token created successfully"). Every
+# terminal escape is stripped first, and the token block the client prints (between
+# "Your OAuth token …:" and "Store this token securely") is joined across spaces and
+# line breaks before matching, so neither placement nor wrapping can split it. The
+# real inference in commit_ceremony_token then proves whatever came out.
+ceremony_extract() { # $1 = capture file -> the setup-token, or nothing
+  "$PYBIN" - "$1" <<'PYEOF'
+import re, sys
+raw = open(sys.argv[1], 'rb').read().decode('utf-8', 'ignore')
+txt = re.sub(r'\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)', '', raw)          # OSC (hyperlink payloads)
+txt = re.sub(r'\x1b\[[0-9;?<>=]*[A-Za-z]', '', txt)                   # CSI, private modes too ([>4m, [<u)
+txt = re.sub(r'\x1b[()][A-Z0-9]|\x1b[78=>]|[\x0e\x0f]', '', txt)      # charset, save/restore cursor, SI/SO
+pat = re.compile(r'sk-ant-oat\d{2}-[A-Za-z0-9_-]{40,}')
+cands = []
+for m in re.finditer(r'Your\s*OAuth\s*token[^\n]{0,80}?:', txt):
+    block = txt[m.end(): m.end() + 4000]
+    stop = re.search(r'Store\s*this\s*token', block)
+    if stop:
+        block = block[: stop.start()]
+    cands += pat.findall(re.sub(r'\s+', '', block))
+cands += pat.findall(txt)
+cands += pat.findall(re.sub(r'[ \t]+', '', txt))
+print(max(cands, key=len) if cands else '')
+PYEOF
+}
+
 CEREMONY_TOKEN=""
 run_token_ceremony() { # $1 = config dir
   CEREMONY_TOKEN=""
+  CEREMONY_LAST_WORDS=""
+  CEREMONY_TRANSCRIPT=""
   local d="$1" real cap old_umask
   real="$(find_real_claude "$_self")" || { warn "real claude binary not found"; return 1; }
   mkdir -p "$ACC_ROOT/tmp"
@@ -971,15 +1047,28 @@ TIP
     # Headless (tests / piped code): capture into the 0600 file only. Never tee the
     # raw token to stdout — a redirected run would write the secret to a plain log.
     CLAUDE_CONFIG_DIR="$d" CLAUDE_SHIM_ACTIVE=1 "$real" setup-token > "$cap" 2>&1
-    sed -E 's/sk-ant-oat[0-9]{2}-[A-Za-z0-9_-]*/sk-ant-oat**-<redacted>/g' "$cap"
+    # Every credential shape, not just setup-tokens: a Console session mints an API key.
+    sed -E 's/sk-ant-[A-Za-z0-9]+-[A-Za-z0-9_-]*/sk-ant-***-<redacted>/g' "$cap"
   fi
   umask "$old_umask"
-  # The LONGEST match, not the last: a TUI repaints its frame many times, and a
-  # frame rendered while the terminal was still narrow holds a wrapped fragment.
-  CEREMONY_TOKEN="$(grep -aoE 'sk-ant-oat[0-9]{2}-[A-Za-z0-9_-]{40,}' "$cap" \
-    | awk '{ if (length($0) > length(best)) best = $0 } END { if (best != "") print best }')"
+  CEREMONY_TOKEN="$(ceremony_extract "$cap" 2>/dev/null)"
+  if [ -z "$CEREMONY_TOKEN" ]; then
+    local stamp rawkeep
+    stamp="$(date -u +%Y%m%dT%H%M%SZ)"
+    CEREMONY_TRANSCRIPT="$ACC_ROOT/tmp/mint-failed.$stamp.log"
+    rawkeep="$ACC_ROOT/tmp/mint-failed.$stamp.raw"
+    CEREMONY_LAST_WORDS="$(ceremony_debrief "$cap" "$CEREMONY_TRANSCRIPT" 2>/dev/null)"
+    [ -s "$CEREMONY_TRANSCRIPT" ] || CEREMONY_TRANSCRIPT=""
+    # The raw bytes are the only record of what the renderer actually emitted, and may
+    # hold a token this extractor did not recognise: kept 0600 beside the pool, like
+    # the tokens themselves, so the next unknown shape can be read instead of guessed.
+    ( umask 077; cp "$cap" "$rawkeep" ) 2>/dev/null || true
+    rm -f "$cap"
+    [ -n "$CEREMONY_LAST_WORDS" ] && warn "the sign-in ended without a token — the client said: $CEREMONY_LAST_WORDS"
+    [ -n "$CEREMONY_TRANSCRIPT" ] && warn "redacted transcript kept at $CEREMONY_TRANSCRIPT"
+    return 1
+  fi
   rm -f "$cap"
-  [ -n "$CEREMONY_TOKEN" ] || return 1
   valid_subscription_token "$CEREMONY_TOKEN" || {
     CEREMONY_TOKEN=""
     warn "captured credential is not a subscription setup-token"
@@ -1097,7 +1186,7 @@ cmd_mint() {
     tok="$(printf '%s' "$tok" | tr -d '[:space:]')"
   else
     echo "Running 'claude setup-token' for $id — approve in a browser signed in as ${email:-THIS account}."
-    run_token_ceremony "$d" || die "no token captured — mint failed"
+    run_token_ceremony "$d" || die "no token captured — mint failed${CEREMONY_LAST_WORDS:+ — the client said: $CEREMONY_LAST_WORDS}${CEREMONY_TRANSCRIPT:+ (transcript: $CEREMONY_TRANSCRIPT)}"
     tok="$CEREMONY_TOKEN"
   fi
   [ -n "$tok" ] || die "no token captured — mint failed"
@@ -1139,7 +1228,7 @@ cmd_login() {
   if [ "$token" = "1" ]; then
     trap 'restore_ceremony_tty; exit 130' INT TERM
     trap 'restore_ceremony_tty' EXIT
-    run_token_ceremony "$d" || die "sign-in failed or aborted — nothing changed"
+    run_token_ceremony "$d" || die "sign-in failed or aborted — nothing changed${CEREMONY_LAST_WORDS:+ — the client said: $CEREMONY_LAST_WORDS}${CEREMONY_TRANSCRIPT:+ (transcript: $CEREMONY_TRANSCRIPT)}"
     got="$(token_email "$CEREMONY_TOKEN")"
     if [ -n "$got" ] && [ "$got" != "$email" ] && [ "$force" != "1" ]; then
       die "you signed in as $got but $id is $email — nothing saved (use --force to override)"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.13",
+  "version": "2.0.15",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -73,18 +73,31 @@ if [ "${1:-}" = "auth" ] && [ "${2:-}" = "login" ]; then
 fi
 if [ "${1:-}" = "setup-token" ]; then
   echo "Open this sign-in link: https://claude.ai/oauth/authorize?fake=1"
-  [ -n "${FAKE_TOKEN_FAIL:-}" ] && { echo "sign-in aborted" >&2; exit 1; }
+  [ -n "${FAKE_TOKEN_FAIL:-}" ] && { echo "${FAKE_TOKEN_FAIL_MSG:-sign-in aborted}" >&2; exit 1; }
   if [ -n "${FAKE_TOKEN_FULL:-}" ]; then
-    # The real client's shape: a 108-character token that the TUI HARD-WRAPS at the
-    # terminal's width — an unsized pty (0 columns) renders as 80, and a 79-character
-    # first line is exactly what every panel mint of 2026-08-28 saved.
+    # The real client's shape (2.1.251): a success line, the token on its own line
+    # between "Your OAuth token …:" and "Store this token securely", 108 characters.
+    # The renderer HARD-WRAPS it at the terminal's width (an unsized pty renders as 80
+    # — the 79-character first line every panel mint of 2026-08-28 saved), and even at
+    # 400 columns emits it as cursor-positioned, styled segments (my-mini, 2026-08-29).
     tok="sk-ant-oat01-$(printf '%66s' '' | tr ' ' W)$(printf '%23s' '' | tr ' ' T)TAILOK"
     cols="$(stty size 2>/dev/null | awk '{print $2}')"
-    if [ -n "${FAKE_TOKEN_WRAP:-}" ] || { [ -n "$cols" ] && [ "$cols" -lt 108 ]; }; then
+    printf 'Long-lived authentication token created successfully!\n'
+    printf 'Your\033[5GOAuth\033[11Gtoken\033[17G(valid\033[24Gfor\033[28G1\033[30Gyear):\n'
+    if [ -n "${FAKE_TOKEN_SPLIT:-}" ]; then
+      printf '\033[2G%s\033[38;5;246m\033[15G%s\033[39m\033[60G%s\033[0m\r\n' "${tok:0:13}" "${tok:13:45}" "${tok:58}"
+    elif [ -n "${FAKE_TOKEN_WRAP:-}" ] || { [ -n "$cols" ] && [ "$cols" -lt 108 ]; }; then
       printf ' %s\n%s\n' "${tok:0:79}" "${tok:79}"
     else
       printf ' %s\n' "$tok"
     fi
+    printf 'Store\033[7Gthis\033[12Gtoken\033[18Gsecurely.\n'
+    exit 0
+  fi
+  if [ -n "${FAKE_TOKEN_APIKEY:-}" ]; then
+    # A browser session signed into a Console (API-billing) org: the client mints an
+    # API key, which is not a subscription token and must not be saved.
+    printf 'Your OAuth token (valid for 1 year):\nsk-ant-api03-%s\nStore this token securely.\n' "$(printf '%80s' '' | tr ' ' K)"
     exit 0
   fi
   echo "Your token: sk-ant-oat01-FAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKE"
@@ -1383,25 +1396,54 @@ rows = {a["id"]: a for a in json.load(sys.stdin)["accounts"]}
 print(rows["acct-04"].get("token_verified"))')"
 [ "$out" = "True" ] && t_ok "list --json reports the token as verified here" \
   || t_fail "list --json token_verified" "expected True, got: $out"
-# The 2026-08-28 shape: the client's TUI wrapped the 108-character token at 80 columns
-# and only its 79-character first line was captured. Claude rejects the fragment; the
-# mint must refuse to save it and say WHY (seven fleet-wide 401s were the old answer).
+# The 2026-08-28 shape: the client's TUI wrapped the 108-character token at 80 columns.
+# The token block is joined across the break, so the capture is WHOLE — and proven.
 orig="$(cat "$ACC/acct-04/server.token")"
 out="$(FAKE_TOKEN_FULL=1 FAKE_TOKEN_WRAP=1 claude-accounts mint acct-04 2>&1 </dev/null)"
 rc=$?
-[ "$rc" != "0" ] && t_ok "a wrapped (79-char) token capture is refused" || t_fail "wrapped token rc" "rc=0"
-check "the refusal names the truncation" "79 characters" "$out"
-check "the refusal names the cause" "terminal wrapped it" "$out"
-[ "$(cat "$ACC/acct-04/server.token")" = "$orig" ] && t_ok "a refused capture leaves the old token in place" \
-  || t_fail "refused capture" "server.token was overwritten"
-# An INCONCLUSIVE probe (the API is busy) must not let a wrapped capture through as
-# merely "unverified": its length alone convicts it, and that is the exact token the
-# fleet then rejects on every Mac.
-out="$(FAKE_TOKEN_FULL=1 FAKE_TOKEN_WRAP=1 FAKE_PROBE_FLAKY=1 claude-accounts mint acct-04 2>&1 </dev/null)"
+[ "$rc" = "0" ] && t_ok "a wrapped token is reassembled from the transcript" || t_fail "wrapped token rc" "rc=$rc: $(printf '%s' "$out" | tail -c 200)"
+case "$(tr -d '[:space:]' < "$ACC/acct-04/server.token")" in
+  *TAILOK) [ "$(tr -d '[:space:]' < "$ACC/acct-04/server.token" | wc -c | tr -d ' ')" = "108" ] \
+    && t_ok "the reassembled token is the complete one" || t_fail "reassembled token" "wrong length" ;;
+  *) t_fail "reassembled token" "tail missing" ;;
+esac
+printf '%s' "$orig" > "$ACC/acct-04/server.token"; rm -f "$ACC/acct-04/.server-token-verified"
+# The 2026-08-29 shape: at 400 columns the renderer emits the token as cursor-positioned,
+# styled segments — a raw-bytes grep saw no token at all right after "token created
+# successfully". Stripped and joined, it is whole.
+out="$(FAKE_TOKEN_FULL=1 FAKE_TOKEN_SPLIT=1 claude-accounts mint acct-04 2>&1 </dev/null)"
 rc=$?
-[ "$rc" != "0" ] && t_ok "a wrapped capture is refused even when the probe is inconclusive" \
-  || t_fail "wrapped+inconclusive rc" "rc=0"
-check "the inconclusive refusal still names the cause" "terminal wrapped it" "$out"
+[ "$rc" = "0" ] && t_ok "a token the renderer split into positioned segments is captured" \
+  || t_fail "split token rc" "rc=$rc: $(printf '%s' "$out" | tail -c 200)"
+case "$(tr -d '[:space:]' < "$ACC/acct-04/server.token")" in
+  sk-ant-oat01-WWW*TAILOK) t_ok "the split token was joined correctly" ;;
+  *) t_fail "split token" "unexpected content" ;;
+esac
+[ -f "$ACC/acct-04/.server-token-verified" ] && t_ok "the joined token was proven by a real call" \
+  || t_fail "split token proof" "marker missing"
+printf '%s' "$orig" > "$ACC/acct-04/server.token"; rm -f "$ACC/acct-04/.server-token-verified"
+# A browser session on a Console (API-billing) org: the client mints an API KEY. Not a
+# subscription token — refused, with the cause named and the raw capture kept.
+before_raw="$(ls "$ACC"/tmp/mint-failed.*.raw 2>/dev/null | wc -l | tr -d ' ')"
+out="$(FAKE_TOKEN_APIKEY=1 claude-accounts mint acct-04 2>&1 </dev/null)"
+rc=$?
+[ "$rc" != "0" ] && t_ok "an API key minted by a Console session is refused" || t_fail "apikey rc" "rc=0"
+check "the API-key refusal names the cause" "API KEY" "$out"
+check "the API-key refusal points at the org" "Console" "$out"
+case "$out" in *sk-ant-api03-K*) t_fail "the API key never reaches the operator's screen" "leaked" ;; *) t_ok "the API key never reaches the operator's screen" ;; esac
+[ "$(cat "$ACC/acct-04/server.token")" = "$orig" ] && t_ok "an API key is never saved as the token" \
+  || t_fail "apikey save" "server.token was overwritten"
+[ "$(ls "$ACC"/tmp/mint-failed.*.raw 2>/dev/null | wc -l | tr -d ' ')" -gt "$before_raw" ] \
+  && t_ok "the raw capture is kept for a closer look" || t_fail "raw capture" "no .raw kept"
+[ "$(python3 -c 'import os, sys; print(oct(os.stat(sys.argv[1]).st_mode & 0o777))' "$(ls -t "$ACC"/tmp/mint-failed.*.raw | head -1)")" = "0o600" ] \
+  && t_ok "the raw capture is private" || t_fail "raw capture mode" "not 0600"
+# A 79-character FRAGMENT that really is all there is (a paste from a narrow terminal)
+# with a probe that cannot decide: refused, and it says why.
+out="$(printf 'sk-ant-oat01-%s' "$(printf '%66s' '' | tr ' ' W)" | FAKE_PROBE_FLAKY=1 claude-accounts mint acct-04 --paste 2>&1)"
+rc=$?
+[ "$rc" != "0" ] && t_ok "a bare fragment is refused even when the probe is inconclusive" \
+  || t_fail "fragment+inconclusive rc" "rc=0"
+check "the fragment refusal names the truncation" "79 characters" "$out"
 [ "$(cat "$ACC/acct-04/server.token")" = "$orig" ] && t_ok "an unproven fragment saves nothing" \
   || t_fail "unproven fragment" "server.token was overwritten"
 # …while a COMPLETE token the probe cannot reach right now is saved as UNVERIFIED — the
@@ -1415,6 +1457,24 @@ check "the inconclusive save says so" "saved as UNVERIFIED" "$out"
 [ ! -f "$ACC/acct-04/.server-token-verified" ] && t_ok "an unproven save records no proof" \
   || t_fail "unproven proof marker" "marker present"
 printf '%s' "$orig" > "$ACC/acct-04/server.token"
+# The client ended the ceremony without a token and said why: that sentence must
+# reach the operator (the panel shows the mint's own error line), and the redacted
+# transcript must be kept for a closer look — "no token captured" alone left an
+# operator with nothing to act on (2026-08-29).
+out="$(FAKE_TOKEN_FAIL=1 FAKE_TOKEN_FAIL_MSG="Your account is on hold. You can close this window." claude-accounts mint acct-04 2>&1 </dev/null)"
+rc=$?
+[ "$rc" != "0" ] && t_ok "a ceremony that ends without a token fails the mint" || t_fail "no-token mint rc" "rc=0"
+check "the mint error carries the client's last words" "the client said: Your account is on hold" "$out"
+check "the mint error names the kept transcript" "transcript: $ACC/tmp/mint-failed." "$out"
+tr="$(printf '%s' "$out" | sed -n 's/.*transcript: \([^)]*\)).*/\1/p' | head -1)"
+[ -n "$tr" ] && [ -s "$tr" ] && t_ok "the redacted transcript exists" || t_fail "transcript file" "missing: '$tr'"
+grep -q 'Your account is on hold' "$tr" 2>/dev/null && t_ok "the transcript holds the client's words" \
+  || t_fail "transcript content" "message missing"
+# (python, not stat: GNU stat reads -f as "file system" and answers something else)
+[ "$(python3 -c 'import os, sys; print(oct(os.stat(sys.argv[1]).st_mode & 0o777))' "$tr")" = "0o600" ] \
+  && t_ok "the transcript is private" || t_fail "transcript mode" "not 0600"
+[ "$(cat "$ACC/acct-04/server.token")" = "$orig" ] && t_ok "a ceremony without a token saves nothing" \
+  || t_fail "no-token save" "server.token was overwritten"
 # A pasted token gets the same proof: a revoked one is refused, not saved.
 # (A complete-length token, so the verdict is the rejection itself and not the
 # length rule that catches wrapped fragments first.)