claude-multiacc 2.0.15 → 2.0.16

package/bin/claude

@@ -160,8 +160,119 @@ sel_log() {
   printf '%s %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$*" 2>/dev/null >> "$ACC_ROOT/selection.log" || true
 }
 
+# ---- model-scoped limits ------------------------------------------------------
+# A usage bucket can be scoped to ONE MODEL ("weekly_scoped:Fable"), and such a bucket
+# says nothing about the account's ability to serve a DIFFERENT model. The limits
+# refresher parks the whole account for it all the same, and the >=90% cutoff reads the
+# peak across every bucket — so on 2026-08-29 acct-02/06/07 sat at Fable 100% with their
+# session buckets at 51/23/25%, were excluded from every selection, and a pool of eleven
+# accounts offered nothing usable: the all-limited fallback handed out a
+# session-exhausted account that rejected the operator's very first request. The retry
+# layer already knew a scoped limit means "switch model, not account" (MODEL_LIMITPAT
+# below); selection has to know it too.
+FALLBACK_MODEL="${CLAUDE_MULTIACC_FALLBACK_MODEL:-claude-opus-5}"
+
+# The model THIS invocation asks for ("" when it pins none), read from the caller's own
+# argv: an explicit --model is never second-guessed, so an account whose Fable bucket is
+# full stays genuinely unusable for `--model claude-fable-5`.
+RUN_MODEL=""
+_sel_next_is_model=0
+for _sel_arg in "$@"; do
+  if [ "$_sel_next_is_model" = 1 ]; then
+    RUN_MODEL="$_sel_arg"; _sel_next_is_model=0; continue
+  fi
+  case "$_sel_arg" in
+    --model) _sel_next_is_model=1 ;;
+    --model=*) RUN_MODEL="${_sel_arg#--model=}" ;;
+  esac
+done
+unset _sel_arg _sel_next_is_model
+
+sel_lc() { printf '%s' "${1:-}" | LC_ALL=C tr 'A-Z' 'a-z'; }
+
+# The model token a `.limited` marker is scoped to ("Fable"); empty when the marker is
+# not model-scoped (session, weekly_all, client:…).
+scoped_tok_of_marker() { # $1 = acct dir
+  local line=""
+  [ -f "$1/.limited" ] && line="$(sed -n 2p "$1/.limited" 2>/dev/null)"
+  case "$line" in
+    *bucket=weekly_scoped:*) line="${line#*bucket=weekly_scoped:}"; printf '%s' "${line%% *}" ;;
+  esac
+}
+
+# Does a bucket scoped to model token $1 constrain THIS run?
+#   pinned to that model    -> yes; the caller asked for exactly it
+#   pinned to another model -> no
+#   unpinned                -> no, PROVIDED the fallback model escapes the bucket. The
+#                              pick path then pins that fallback before exec, so an
+#                              unpinned run never walks into the exhausted model.
+scoped_blocks_run() { # $1 = model token
+  local tok run fb
+  tok="$(sel_lc "$1")"
+  [ -n "$tok" ] || return 1
+  run="$(sel_lc "${RUN_MODEL:-}")"
+  if [ -n "$run" ]; then
+    case "$run" in *"$tok"*) return 0 ;; *) return 1 ;; esac
+  fi
+  fb="$(sel_lc "$FALLBACK_MODEL")"
+  case "$fb" in *"$tok"*) return 0 ;; esac    # nothing left to switch to
+  return 1
+}
+
+# Peak percent over the buckets that constrain THIS run — scoped buckets belonging to
+# other models are skipped. Prints nothing when the reading predates per-bucket
+# telemetry, so the caller falls back to the flat max_percent it used to trust.
+applicable_peak() { # $1 = acct dir
+  local f="$1/limits.json"
+  [ -f "$f" ] || return 1
+  LC_ALL=C tr '{},' '\n\n\n' < "$f" 2>/dev/null \
+    | LC_ALL=C awk -v run="$(sel_lc "${RUN_MODEL:-}")" -v fb="$(sel_lc "$FALLBACK_MODEL")" '
+    function applies(name,   tok) {
+      if (index(name, "weekly_scoped:") != 1) return 1
+      tok = substr(name, 15)
+      if (run != "") return index(run, tok) > 0
+      return index(fb, tok) > 0
+    }
+    /"name"[[:space:]]*:/ {
+      n = $0
+      sub(/.*"name"[[:space:]]*:[[:space:]]*"/, "", n); sub(/".*/, "", n)
+      name = tolower(n); next
+    }
+    /"percent"[[:space:]]*:/ {
+      p = $0
+      sub(/.*"percent"[[:space:]]*:[[:space:]]*/, "", p); sub(/[^0-9].*/, "", p)
+      if (p != "") { seen = 1; if (applies(name) && p + 0 > best) best = p + 0 }
+      next
+    }
+    END { if (seen) print best + 0 }
+  '
+}
+
+# The model token of a scoped bucket that is itself at/over the threshold ("" when
+# none) — what the pick path needs to know to pin the fallback for an unpinned run.
+scoped_over_tok() { # $1 = acct dir
+  local f="$1/limits.json"
+  [ -f "$f" ] || return 0
+  LC_ALL=C tr '{},' '\n\n\n' < "$f" 2>/dev/null \
+    | LC_ALL=C awk -v thr="${CLAUDE_MULTIACC_THRESHOLD:-90}" '
+    /"name"[[:space:]]*:/ {
+      n = $0
+      sub(/.*"name"[[:space:]]*:[[:space:]]*"/, "", n); sub(/".*/, "", n)
+      name = n; next
+    }
+    /"percent"[[:space:]]*:/ {
+      p = $0
+      sub(/.*"percent"[[:space:]]*:[[:space:]]*/, "", p); sub(/[^0-9].*/, "", p)
+      if (p != "" && p + 0 >= thr + 0 && index(tolower(name), "weekly_scoped:") == 1) {
+        print substr(name, 15); exit
+      }
+      next
+    }
+  '
+}
+
 marker_active() { # true if $1/.limited is still in force; clears cleanly-expired markers
-  local m="$1/.limited" reset=""
+  local m="$1/.limited" reset="" tok
   [ -f "$m" ] || return 1
   IFS= read -r reset < "$m" 2>/dev/null || reset=""
   if ! num_ok "$reset"; then
@@ -174,6 +285,11 @@ marker_active() { # true if $1/.limited is still in force; clears cleanly-expire
     rm -f "$m" 2>/dev/null
     return 1
   fi
+  # A park scoped to ONE model does not stop a run that will use another one.
+  tok="$(scoped_tok_of_marker "$1")"
+  if [ -n "$tok" ] && ! scoped_blocks_run "$tok"; then
+    return 1
+  fi
   return 0
 }
 
@@ -305,10 +421,15 @@ limited_percent_of() { # $1 acct dir -> the marked bucket's percent, or -1 (unkn
 # fallback lives on, because "degraded service beats a hard failure" only holds
 # for an account that can actually serve.
 limited_hard_blocked() { # $1 acct dir
-  local m="$1/.limited" line="" p
+  local m="$1/.limited" line="" p tok
   if [ -f "$m" ]; then
     line="$(sed -n 2p "$m" 2>/dev/null)"
     case "$line" in *reason=client-rate-limit*|*reason=error-cooldown*) return 0 ;; esac
+    # Exhausted for ONE model is not exhausted for the model this run will use.
+    tok="$(scoped_tok_of_marker "$1")"
+    if [ -n "$tok" ] && ! scoped_blocks_run "$tok"; then
+      return 1
+    fi
     p="$(limited_percent_of "$1")"
     if [ "$p" -ge 0 ] 2>/dev/null; then
       [ "$p" -ge 100 ]
@@ -335,7 +456,12 @@ util_of() {
 # (fail open — telemetry must never invent exclusions).
 over_threshold() { # $1 = acct dir
   local v
-  v="$(cutoff_field "$1" max_percent)" || return 1
+  within_window "$1" "$EXCLUDE_STALE_AFTER" || return 1
+  # Buckets that constrain THIS run; a reading with no bucket list falls back to the
+  # flat peak, which is what this check always used.
+  v="$(applicable_peak "$1")"
+  [ -n "$v" ] || v="$(cutoff_field "$1" max_percent)" || return 1
+  num_ok "$v" || return 1
   [ "$v" -ge "${CLAUDE_MULTIACC_THRESHOLD:-90}" ]
 }
 
@@ -1083,6 +1209,22 @@ else
       fi
     done
     sel_log "all-limited fallback=$(basename "$PICK_DIR") all-exhausted resets_in=$((best_reset > now ? best_reset - now : 0))s"
+    # Every candidate rejects right now, so this pick WILL fail: say so on a terminal
+    # instead of letting the operator read the client's bare limit error as a bad
+    # choice by the pool (2026-08-29). Throttled, and never on a service's stderr.
+    if [ -t 2 ]; then
+      exn="$ACC_ROOT/.exhausted-notice"
+      exlast=0
+      [ -f "$exn" ] && exlast="$(file_mtime "$exn")"
+      if [ $((now - exlast)) -gt 600 ]; then
+        : 2>/dev/null > "$exn" || true
+        exextra=""
+        [ "${#expired[@]}" -gt 0 ] \
+          && exextra=" ${#expired[@]} further account(s) are unusable — see: claude-accounts expired."
+        printf 'claude-multiacc: every usable account is at a limit right now; %s frees up in %ds and was chosen for that.%s\n' \
+          "$(basename "$PICK_DIR")" "$((best_reset > now ? best_reset - now : 0))" "$exextra" >&2
+      fi
+    fi
   fi
   # Report the number this fallback ACTUALLY ranked on. Asking fresh_field here printed
   # `weekly=?%` even when the pick was made on a perfectly good stale reading, so anyone
@@ -1113,6 +1255,20 @@ if [ -n "$tok" ] && ! token_preflight "$pick" "$tok"; then
   fi
 fi
 unset CLAUDE_MULTIACC_PREFLIGHT_DEPTH
+
+# The picked account may be eligible only because its exhausted bucket belongs to a
+# model this run did not ask for. Handing it the default model anyway would open the
+# session on "You've reached your Fable 5 limit" — the exact failure this selection
+# path exists to avoid (operator, tmux 136) — so the fallback model is pinned once,
+# before exec. An explicit --model is never touched: such a run does not get here.
+if [ -z "$RUN_MODEL" ]; then
+  sel_tok="$(scoped_tok_of_marker "$pick")"
+  [ -n "$sel_tok" ] || sel_tok="$(scoped_over_tok "$pick")"
+  if [ -n "$sel_tok" ] && ! scoped_blocks_run "$sel_tok"; then
+    set -- --model "$FALLBACK_MODEL" "$@"
+    sel_log "$(basename "$pick") -> --model $FALLBACK_MODEL (its $sel_tok bucket is full)"
+  fi
+fi
 # Remember the pick so the NEXT run does not hand back the same account. An explicit
 # CLAUDE_ACCOUNT pin deliberately does not: a pin is a caller overriding selection,
 # not a turn in the rotation.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.15",
+  "version": "2.0.16",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -421,7 +421,8 @@ check "pinned dead-credential account still runs under its token" "TOK=sk-ant-oa
 rm -rf "$ACC/acct-07"
 
 # ---- 7. limited marker excludes account ------------------------------------
-printf '%s\nbucket=weekly_scoped:Fable percent=95 reason=limits\n' "$((now+3600))" > "$ACC/acct-01/.limited"
+# (An account-wide bucket. A MODEL-SCOPED one deliberately does not exclude — 9a4.)
+printf '%s\nbucket=session percent=95 reason=limits\n' "$((now+3600))" > "$ACC/acct-01/.limited"
 all2=1
 for _ in $(seq 1 15); do
   out="$(claude 2>&1)"
@@ -454,7 +455,7 @@ rm -f "$ACC/acct-01/.limited" "$ACC/acct-02/.limited"
 # acct-02: session at 100% — far better weekly (7%), but every request bounces until
 # the reset. Ranking on headroom alone handed out the guaranteed rejection
 # (operator report 2026-08-29: "claude keeps starting on an out-of-limits account").
-printf '%s\nbucket=weekly_scoped:Fable percent=99 marked_at=x reason=limits\n' "$((now+3600))" > "$ACC/acct-01/.limited"
+printf '%s\nbucket=weekly_all percent=99 marked_at=x reason=limits\n' "$((now+3600))" > "$ACC/acct-01/.limited"
 printf '%s\nbucket=session percent=100 marked_at=x reason=limits\n' "$((now+600))" > "$ACC/acct-02/.limited"
 printf '{"fetched_at":%s,"max_percent":99,"weekly_percent":99,"session_percent":10,"buckets":[]}' "$now" > "$ACC/acct-01/limits.json"
 printf '{"fetched_at":%s,"max_percent":100,"weekly_percent":7,"session_percent":100,"buckets":[]}' "$now" > "$ACC/acct-02/limits.json"
@@ -531,6 +532,58 @@ for f in server.token .credentials.json .expired .server-token-verified limits.j
   [ -e "$WORK/bak01/$f" ] && cp -p "$WORK/bak01/$f" "$ACC/acct-01/$f"
 done
 
+# ---- 9a4. a MODEL-scoped limit does not park the whole account ----------------------
+# "weekly_scoped:Fable at 100%" says the account cannot serve Fable — nothing more. It
+# used to park the account outright (and max_percent re-excluded it anyway), so on
+# 2026-08-29 three accounts sitting at Fable 100% with their session buckets at 51/23/25%
+# were invisible to selection, the pool offered nothing, and the fallback handed out a
+# session-exhausted account that rejected the operator's first request.
+rm -rf "$WORK/bak94"; mkdir -p "$WORK/bak94"
+for a in acct-01 acct-02; do
+  for f in .limited limits.json; do
+    [ -e "$ACC/$a/$f" ] && cp -p "$ACC/$a/$f" "$WORK/bak94/$a.$f"
+  done
+done
+# acct-01: only its Fable bucket is spent. acct-02: session spent — dead for every model.
+printf '%s\nbucket=weekly_scoped:Fable percent=100 marked_at=x reason=limits\n' "$((now+3600))" > "$ACC/acct-01/.limited"
+printf '{"fetched_at":%s,"max_percent":100,"weekly_percent":100,"session_percent":12,"buckets":[{"name":"session","percent":12},{"name":"weekly_all","percent":40},{"name":"weekly_scoped:Fable","percent":100}]}' "$now" > "$ACC/acct-01/limits.json"
+printf '%s\nbucket=session percent=100 marked_at=x reason=limits\n' "$((now+600))" > "$ACC/acct-02/.limited"
+printf '{"fetched_at":%s,"max_percent":100,"weekly_percent":30,"session_percent":100,"buckets":[{"name":"session","percent":100},{"name":"weekly_all","percent":30}]}' "$now" > "$ACC/acct-02/limits.json"
+out="$(claude 2>&1)"
+check "a Fable-only park still serves an unpinned run" "CFG=acct-01" "$out"
+check "...and that run is pinned to the fallback model up front" "ARGS=--model claude-opus-5" "$out"
+grep -q 'acct-01 -> --model claude-opus-5 (its Fable bucket is full)' "$ACC/selection.log" \
+  && t_ok "the model pin is logged with its reason" || t_fail "model pin log" "no line in selection.log"
+# A run that ASKS for the exhausted model must not be sent to that account.
+out="$(claude --model claude-fable-5 2>&1)"
+check "a run pinning the exhausted model does not get that account" "CFG=acct-02" "$out"
+# A run that pins another model uses it as-is — never pinned twice.
+out="$(claude --model claude-opus-5 2>&1)"
+check "a run pinning another model gets the Fable-spent account" "CFG=acct-01" "$out"
+case "$out" in
+  *"--model claude-opus-5 --model"*) t_fail "an explicit model is not pinned twice" "double --model" ;;
+  *) t_ok "an explicit model is not pinned twice" ;;
+esac
+# The >=90% cutoff reads the same way: no marker at all, Fable spent in telemetry only.
+rm -f "$ACC/acct-01/.limited"
+out="$(claude 2>&1)"
+check "the cutoff ignores a scoped bucket the run will not use" "CFG=acct-01" "$out"
+out="$(claude --model claude-fable-5 2>&1)"
+check "the cutoff still excludes it for the model that IS spent" "CFG=acct-02" "$out"
+# A reading with no bucket list keeps the old flat behaviour (fail closed at >=90%),
+# with a plainly healthy neighbour so nothing but that exclusion decides the pick.
+printf '{"fetched_at":%s,"max_percent":97,"weekly_percent":97,"session_percent":97}' "$now" > "$ACC/acct-01/limits.json"
+rm -f "$ACC/acct-02/.limited"
+printf '{"fetched_at":%s,"max_percent":20,"weekly_percent":20,"session_percent":20,"buckets":[{"name":"session","percent":20},{"name":"weekly_all","percent":20}]}' "$now" > "$ACC/acct-02/limits.json"
+out="$(claude 2>&1)"
+check "a bucket-less reading still excludes at the flat peak" "CFG=acct-02" "$out"
+for a in acct-01 acct-02; do
+  rm -f "$ACC/$a/.limited" "$ACC/$a/limits.json"
+  for f in .limited limits.json; do
+    [ -e "$WORK/bak94/$a.$f" ] && cp -p "$WORK/bak94/$a.$f" "$ACC/$a/$f"
+  done
+done
+
 # ---- 9b. codex-review regressions: auth/marker/threshold hardening -------------
 # empty .credentials.json must NOT count as auth (interrupted write)
 mkdir -p "$ACC/acct-06"
@@ -4752,7 +4805,7 @@ out="$(CLAUDE_ACCOUNTS_DIR="$KCP" claude-accounts list 2>&1)"
 check "keychain login shown in the plain list" "auth=keychain" "$out"
 
 # 17b. the shim runs under a keychain-only account (file account parked by a limit)
-printf '%s\nbucket=weekly_scoped:Fable percent=95 reason=limits\n' "$((now+3600))" > "$KCP/acct-01/.limited"
+printf '%s\nbucket=session percent=95 reason=limits\n' "$((now+3600))" > "$KCP/acct-01/.limited"
 out="$(CLAUDE_ACCOUNTS_DIR="$KCP" claude 2>&1)"
 check "shim selects the keychain-only account" "CFG=acct-02" "$out"