claude-multiacc 2.0.28 → 2.0.29

package/bin/claude-accounts

@@ -2482,6 +2482,21 @@ AUTH_ERR = re.compile(
 ORG_ERR = re.compile(
     r'organization has disabled|subscription access.*disabl|disabled claude subscription'
     r'|ask your admin to enable|not authorized to use claude code', re.I)
+# EXCULPATORY, tested FIRST — the twin of BROKEN_CLI in bin/codex-accounts, and
+# it matters MORE here: AUTH_ERR above matches a bare `401` or `403`, so any
+# machine fault whose output happens to contain those three digits parks a live
+# login. `mark_expired` writes no `soft_until`, so that verdict is permanent
+# until a person clears it. These patterns say the CLI never reached the API,
+# which is a fact about the machine and never about the login.
+# See health.log 2026-08-24: `env: node: No such file or directory` failed
+# every account in one pass.
+BROKEN_CLI = re.compile(
+    r'missing optional dependency|unsupported (platform|target triple):'
+    r'|cannot find module|ERR_MODULE_NOT_FOUND|ERR_DLOPEN_FAILED'
+    r'|env: node: no such file or directory|node: command not found'
+    r'|spawn .{0,80}(ENOENT|EACCES|EPERM)|^dyld\[[0-9]+\]:'
+    r'|cannot execute binary file|bad CPU type in executable|exec format error',
+    re.I | re.M)
 
 def mark_expired(d, slug, detail=''):
     """Park an account the shim must stop selecting. Verify is the strongest signal
@@ -2607,9 +2622,16 @@ for acct in manifest.get('accounts', []):
                 pass
         print(f'{aid} {acct["email"]}: PASS ({dt:.1f}s) -> {out[:60]!r}')
     else:
-        err = (r.stderr or '').strip()[:200]
+        raw = (r.stderr or '').strip()
+        err = raw[:200]
         hint = ''
-        if ORG_ERR.search(out) or ORG_ERR.search(err):
+        # STDERR only, and the WHOLE of it: stdout is the model's own answer,
+        # and a session that merely discusses "Cannot find module" must not be
+        # able to excuse a real dead login.
+        if BROKEN_CLI.search(raw):
+            hint = (' — the Claude CLI cannot run on this machine; not a login '
+                    'problem, nothing was parked')
+        elif ORG_ERR.search(out) or ORG_ERR.search(err):
             # Not an auth problem: the account authenticates fine, its organization
             # has simply turned Claude Code subscription access off. Park it — a
             # re-login changes nothing — and say what actually helps.

package/bin/codex-accounts

@@ -1768,6 +1768,30 @@ ORG_ERR = re.compile(
     r'disabled by (your )?(workspace )?admin|admin (has )?disabled'
     r'|(workspace|organization) has disabled (codex|chatgpt)'
     r'|codex.{0,20}disabled for (your|this) (workspace|organization)', re.I)
+# EXCULPATORY, and therefore tested FIRST. These say the CLI never reached the
+# API at all — a missing native package, a missing node, an unrunnable binary —
+# so they are facts about this MACHINE, not about the login. Parking on one
+# converts an indeterminate probe into "this login is dead", and that verdict
+# does not self-heal: `mark_expired` here writes no `soft_until`, so the shim
+# reads it as proven dead and keeps it, while the panel refuses to re-import
+# the token until its fingerprint changes.
+#
+# Not hypothetical. health.log 2026-08-24T06:37:02Z: all four accounts
+# `FAIL rc=127 err='env: node: No such file or directory'` — one broken PATH
+# reddened the entire matrix, and it escaped parking only because that exact
+# string happens not to match AUTH_ERR. `Missing optional dependency
+# @openai/codex-<platform>` (my-mini, 2026-09-10) is the same class.
+#
+# Keep it NARROW. It must never contain a word a genuine auth failure uses
+# ("permission denied", "forbidden", a bare "not found"), or a real dead login
+# would be excused as a broken machine. Widen only with a test.
+BROKEN_CLI = re.compile(
+    r'missing optional dependency|unsupported (platform|target triple):'
+    r'|cannot find module|ERR_MODULE_NOT_FOUND|ERR_DLOPEN_FAILED'
+    r'|env: node: no such file or directory|node: command not found'
+    r'|spawn .{0,80}(ENOENT|EACCES|EPERM)|^dyld\[[0-9]+\]:'
+    r'|cannot execute binary file|bad CPU type in executable|exec format error',
+    re.I | re.M)
 
 def mark_expired(d, slug, detail=''):
     """Park an account the shim must stop selecting. Verify is the strongest signal
@@ -1845,9 +1869,16 @@ for acct in manifest.get('accounts', []):
             pass
         print(f'{aid} {acct["email"]}: PASS ({dt:.1f}s) -> {(last or out)[:60]!r}')
     else:
-        err = (r.stderr or '').strip()[:200]
+        raw = (r.stderr or '').strip()
+        err = raw[:200]
         hint = ''
-        if ORG_ERR.search(out) or ORG_ERR.search(err):
+        # STDERR only, and the WHOLE of it: stdout is the model's own answer,
+        # and a session that merely discusses "Cannot find module" must not be
+        # able to excuse a real dead login.
+        if BROKEN_CLI.search(raw):
+            hint = (' — the Codex CLI cannot run on this machine; not a login '
+                    'problem, nothing was parked')
+        elif ORG_ERR.search(out) or ORG_ERR.search(err):
             # Not an auth problem: the account authenticates fine, a workspace admin
             # has simply turned Codex access off. Park it — a re-login changes
             # nothing — and say what actually helps.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.28",
+  "version": "2.0.29",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -136,6 +136,15 @@ case "${CLAUDE_CODE_OAUTH_TOKEN:-}" in
       *) echo "Failed to authenticate. API Error: 401 OAuth access token is invalid." >&2; exit 1 ;;
     esac ;;
 esac
+if [ -f "$ctl" ] && grep -qx "brokencli:$acct" "$ctl" 2>/dev/null; then
+  # An infrastructure fault, not a login verdict: the CLI never reached the API.
+  # Verbatim from my-mini, 2026-09-10. Note it carries no auth vocabulary at all
+  # — the danger is that AUTH_ERR matches a bare `401`, and a node stack frame
+  # or a version string can contain one.
+  echo "Error: Missing optional dependency @openai/codex-darwin-arm64. Reinstall Codex: npm install -g @openai/codex@latest" >&2
+  echo "    at findCodexExecutable (file:///opt/homebrew/lib/node_modules/@openai/codex/bin/codex.js:107:9)" >&2
+  exit 1
+fi
 case " $* " in
   *" -p --output-format text --max-turns 1 "*) echo "OK"; exit 0 ;;
 esac
@@ -3898,6 +3907,27 @@ check "import rejects an API key as token" "not a subscription setup-token" "$ou
 out="$(printf 'sk-ant-api03-ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ' | claude-accounts mint acct-01 --paste 2>&1)"
 check "mint --paste rejects an API key" "not a subscription setup-token" "$out"
 
+# ---- 17a2. a CLI that cannot run is not a dead login ----------------------------------
+# health.log 2026-08-24T06:37:02Z: all four accounts FAIL rc=127
+# err='env: node: No such file or directory'. One broken PATH reddened the whole
+# verify matrix, and it escaped parking only because that string happens not to
+# match AUTH_ERR — which matches a bare `401`, so a node stack frame carrying one
+# is enough. `mark_expired` writes no soft stamp, so such a park is permanent,
+# and the panel then refuses to re-import the token until its fingerprint changes.
+rm -f "$ACC/acct-01/.expired"
+printf 'brokencli:acct-01\n' > "$WORK/ctl-brokencli"
+out="$(FAKE_CTL="$WORK/ctl-brokencli" claude-accounts verify 2>&1)"
+check "a broken CLI is reported as a machine fault" "cannot run on this machine" "$out"
+check "a broken CLI still fails the account" "acct-01" "$out"
+[ ! -f "$ACC/acct-01/.expired" ] \
+  && t_ok "a broken CLI never parks a live login" \
+  || t_fail "broken CLI parking" "verify parked an account over an infrastructure fault"
+case "$out" in
+  *"login is dead"*) t_fail "broken CLI wording" "verify blamed the login for a machine fault" ;;
+  *) t_ok "a broken CLI is not called a dead login" ;;
+esac
+rm -f "$WORK/ctl-brokencli"
+
 # ---- 17b. verify authenticates the way the SHIM would ---------------------------------
 # A dead credential next to a live portable token: the shim runs that account with the
 # TOKEN, so verify must too — testing it with the dead credential would fail a healthy