claude-multiacc 2.0.34 → 2.0.36

package/lib/common.sh

@@ -36,7 +36,9 @@ else
   ACC_ROOT="${CLAUDE_ACCOUNTS_ROOT:-${CLAUDE_ACCOUNTS_DIR:-$HOME/.claude-accounts}}"
   DEFAULT_ACC_ROOT="$HOME/.claude-accounts"
   DEFAULT_SERVER_ROOT="/root/.claude-accounts"
-  USAGE_URL="${CLAUDE_MULTIACC_USAGE_URL:-https://api.anthropic.com/api/oauth/usage}"
+  # `?cedar_ember=1&skip_spend=1` is Claude Code's own /limit-reset read: the same
+  # usage payload plus the limit-reset status block (lib/claude_reset.py), in ONE call.
+  USAGE_URL="${CLAUDE_MULTIACC_USAGE_URL:-https://api.anthropic.com/api/oauth/usage?cedar_ember=1&skip_spend=1}"
   AUDIT_PY="$LIB_DIR/audit.py"
   PROVIDER_CLI="claude-accounts"
   SYNC_TARGET_ENV="${CLAUDE_MULTIACC_SYNC_TARGET:-${MULTIACC_SYNC_TARGET:-}}"

package/lib/report.py

@@ -47,6 +47,7 @@ import time
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 import keychain  # noqa: E402
 from audit import token_verified  # noqa: E402
+from claude_reset import marker_superseded, record_from  # noqa: E402
 
 SCHEMA = 'claude-multiacc/pool.v1'
 
@@ -246,6 +247,12 @@ def _usage(d, stale_after):
     reset_stamp = _iso(lim.get('reset_credits_fetched_at'))
     if type(reset_count) is int and 0 <= reset_count <= 1_000_000 and reset_stamp:
         out.update(reset_credits_available=reset_count, reset_credits_fetched_at=reset_stamp)
+    # A confirmed limit reset (claude): when it happened and which limit types it refilled.
+    # Every park written before it for one of those windows is lifted — here, in the shim,
+    # and (from this field) in the app-robot panel. Emitted only while the writer carries it.
+    record = record_from(lim, time.time())
+    if record:
+        out.update(reset_redeemed_at=_iso(record[0]), reset_cleared=list(record[1]))
     try:
         out['age_seconds'] = max(0, int(time.time() - float(fetched)))
     except (TypeError, ValueError):
@@ -368,6 +375,17 @@ def _account_row(root, a, aid, d, provider, jwt_claims, audit_account, now, kind
         cclass, cdetail = _claude_credentials(d)
     reset_epoch, marker_detail = _marker(os.path.join(d, '.limited'))
     limited = reset_epoch > now or (reset_epoch == 0 and os.path.isfile(os.path.join(d, '.limited')))
+    if limited and provider == 'claude':
+        # The shim's reset_supersedes_marker: a park from before a confirmed limit reset,
+        # for a window it refilled, no longer binds — even as a stale copy on a peer.
+        try:
+            with open(os.path.join(d, '.limited'), errors='replace') as handle:
+                text = handle.read(4096)
+            if marker_superseded(text, record_from(_load_json(os.path.join(d, 'limits.json')),
+                                                   time.time())):
+                limited = False
+        except OSError:
+            pass
     status = st['state']
     if status == 'ok':
         status = 'limited' if limited else 'active'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.34",
+  "version": "2.0.36",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -2271,6 +2271,107 @@ grep -q "acct-01 client limit cleared by newer telemetry (5%)" "$ND/selection.lo
   && t_ok "the five_hour recovery still logs the reading it acted on" \
   || t_fail "five_hour client marker" "selection.log: $(tail -2 "$ND/selection.log" 2>/dev/null | tr '\n' ' ')"
 
+# ---- 16-limit-reset-fleet. a confirmed limit reset lifts every OLDER park, fleet-wide --
+# The writer that redeemed a reset deletes its own marker, but peers are pushed `.limited`
+# files and never their deletion, and the panel re-writes its verdicts: so the reset
+# travels in limits.json (reset_redeemed_at + reset_cleared) and the shim lifts any park
+# written at or before it for a window it refilled — even a client:seven_day one, which
+# no telemetry may lift. A park written AFTER the reset, or for a window the reset did
+# not refill, stays exactly as it was.
+lr_doc() { # lr_doc <redeemed_at epoch> <cleared csv> -> a post-reset limits.json (stale)
+  printf '{"fetched_at":0,"source":"oauth","reset_redeemed_at":%s,"reset_cleared":"%s","buckets":[]}' "$1" "$2"
+}
+# The ND pool is shared with the blocks below: save what this block overwrites.
+for lr_f in acct-01/limits.json acct-02/limits.json acct-01/.limited acct-01/.client-limit-cleared; do
+  rm -f "$WORK/lr-save.${lr_f//\//_}"
+  [ -f "$ND/$lr_f" ] && cp -p "$ND/$lr_f" "$WORK/lr-save.${lr_f//\//_}"
+done
+lr_now="$(date +%s)"
+lr_at=$((lr_now - 600))
+lr_before="$(date -u -r $((lr_at - 3600)) +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -d "@$((lr_at - 3600))" +%Y-%m-%dT%H:%M:%SZ)"
+lr_after="$(date -u -r $((lr_at + 60)) +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -d "@$((lr_at + 60))" +%Y-%m-%dT%H:%M:%SZ)"
+lr_doc "$lr_at" "five_hour,seven_day,seven_day_overage_included" > "$ND/acct-01/limits.json"
+ndl 45 10 45 > "$ND/acct-02/limits.json"
+printf '%s\nbucket=client:seven_day percent=100 marked_at=%s reason=client-rate-limit\n' \
+  "$((lr_now + 345600))" "$lr_before" > "$ND/acct-01/.limited"
+rm -f "$ND"/acct-0*/.client-limit-cleared "$ND/.pick-seq" "$ND"/acct-0*/.last-pick
+: > "$ND/selection.log"
+CLAUDE_ACCOUNTS_ROOT="$ND" claude >/dev/null 2>&1
+[ ! -f "$ND/acct-01/.limited" ] \
+  && t_ok "a client:seven_day park older than a confirmed limit reset is lifted" \
+  || t_fail "limit reset lift" "marker kept: $(sed -n 2p "$ND/acct-01/.limited")"
+grep -q "acct-01 marker lifted — written before a confirmed limit reset" "$ND/selection.log" \
+  && t_ok "the lift is logged" || t_fail "limit reset lift" "selection.log: $(tail -2 "$ND/selection.log" | tr '\n' ' ')"
+# the panel's own shapes: a stream weekly_all park, and a bucket-less panel:observed one
+for lr_bucket in weekly_all panel:observed weekly_scoped:Fable session; do
+  printf '%s\nbucket=%s percent=100 marked_at=%s reason=client-rate-limit source=stream\n' \
+    "$((lr_now + 345600))" "$lr_bucket" "$lr_before" > "$ND/acct-01/.limited"
+  CLAUDE_ACCOUNTS_ROOT="$ND" claude >/dev/null 2>&1
+  [ ! -f "$ND/acct-01/.limited" ] \
+    && t_ok "an older $lr_bucket park is lifted by the reset" \
+    || t_fail "limit reset lift" "$lr_bucket kept"
+done
+printf '%s\nbucket=client:seven_day percent=100 marked_at=%s reason=client-rate-limit\n' \
+  "$((lr_now + 345600))" "$lr_after" > "$ND/acct-01/.limited"
+CLAUDE_ACCOUNTS_ROOT="$ND" claude >/dev/null 2>&1
+[ -f "$ND/acct-01/.limited" ] \
+  && t_ok "a park written AFTER the reset stands" || t_fail "limit reset lift" "a post-reset park was lifted"
+printf '%s\nbucket=client:seven_day_opus percent=100 marked_at=%s reason=client-rate-limit\n' \
+  "$((lr_now + 345600))" "$lr_before" > "$ND/acct-01/.limited"
+CLAUDE_ACCOUNTS_ROOT="$ND" claude >/dev/null 2>&1
+[ -f "$ND/acct-01/.limited" ] \
+  && t_ok "a park for a window the reset did not refill stands" \
+  || t_fail "limit reset lift" "seven_day_opus was lifted by a reset that did not clear it"
+# an expired record (older than eight days) lifts nothing
+lr_doc "$((lr_now - 9 * 86400))" "five_hour,seven_day" > "$ND/acct-01/limits.json"
+printf '%s\nbucket=client:seven_day percent=100 marked_at=2020-01-01T00:00:00Z reason=client-rate-limit\n' \
+  "$((lr_now + 345600))" > "$ND/acct-01/.limited"
+CLAUDE_ACCOUNTS_ROOT="$ND" claude >/dev/null 2>&1
+[ -f "$ND/acct-01/.limited" ] \
+  && t_ok "an expired reset record lifts nothing" || t_fail "limit reset lift" "an expired record lifted a park"
+# the report agrees with the shim: a superseded park is not `limited`
+lr_doc "$lr_at" "five_hour,seven_day,seven_day_overage_included" > "$ND/acct-01/limits.json"
+printf '%s\nbucket=weekly_all percent=95 marked_at=%s reason=client-rate-limit source=stream\n' \
+  "$((lr_now + 345600))" "$lr_before" > "$ND/acct-01/.limited"
+lr_json="$(CLAUDE_ACCOUNTS_ROOT="$ND" claude-accounts list --json 2>/dev/null)"
+printf '%s' "$lr_json" | python3 -c '
+import json, sys
+row = next(a for a in json.load(sys.stdin)["accounts"] if a["id"] == "acct-01")
+assert row["limited"] is False and row["status"] != "limited", row
+assert row["usage"]["reset_cleared"] == ["five_hour", "seven_day", "seven_day_overage_included"], row["usage"]
+assert row["usage"]["reset_redeemed_at"].endswith("Z"), row["usage"]
+' && t_ok "list --json reports a superseded park as not limited, with the reset record" \
+  || t_fail "limit reset report" "$(printf '%s' "$lr_json" | head -c 400)"
+lr_text="$(CLAUDE_ACCOUNTS_ROOT="$ND" claude-accounts list 2>/dev/null | grep '^acct-01')"
+case "$lr_text" in
+  *LIMITED*) t_fail "limit reset report" "text list still says: $lr_text" ;;
+  *) t_ok "the text list agrees: a superseded park is not LIMITED" ;;
+esac
+lr_status="$(CLAUDE_ACCOUNTS_ROOT="$ND" CLAUDE_MULTIACC_PATH_PROBE=0 claude-accounts status 2>/dev/null)"
+check "status says the park was lifted by the reset" "lifted — written before a confirmed limit reset" "$lr_status"
+# ...and the transcript scan cannot re-create a park from a rejection the reset answered,
+# on a machine that never saw the source's local watermark (a peer): the record is enough.
+lr_iso() { date -u -r "$1" +%Y-%m-%dT%H:%M:%S.000Z 2>/dev/null || date -u -d "@$1" +%Y-%m-%dT%H:%M:%S.000Z; }
+rm -f "$ND"/acct-0*/.limited "$ND"/acct-0*/.client-limit-cleared "$ND"/acct-0*/.client-scan
+lr_doc "$((lr_now - 60))" "five_hour,seven_day,seven_day_overage_included" > "$ND/acct-01/limits.json"
+mkclientlimit "$ND/acct-01" "5d1c7a42-1f4e-4c55-9c3e-0d2f6a8b9e10" "$((lr_now + 3600))" "$(lr_iso $((lr_now - 300)))"
+CLAUDE_ACCOUNTS_ROOT="$ND" claude >/dev/null 2>&1
+[ ! -f "$ND/acct-01/.limited" ] \
+  && t_ok "a rejection the reset answered cannot re-park the account from the transcript" \
+  || t_fail "limit reset watermark" "the scan re-created: $(sed -n 2p "$ND/acct-01/.limited")"
+rm -f "$ND"/acct-0*/.client-scan
+mkclientlimit "$ND/acct-01" "5d1c7a42-1f4e-4c55-9c3e-0d2f6a8b9e10" "$((lr_now + 3600))" "$(lr_iso $((lr_now - 20)))"
+CLAUDE_ACCOUNTS_ROOT="$ND" claude >/dev/null 2>&1
+[ -f "$ND/acct-01/.limited" ] \
+  && t_ok "a rejection AFTER the reset still parks the account" \
+  || t_fail "limit reset watermark" "a post-reset rejection was ignored"
+rm -rf "$ND/acct-01/projects" "$ND/acct-01/.sessions-index"
+rm -f "$ND"/acct-0*/.limited "$ND"/acct-0*/.client-limit-cleared "$ND"/acct-0*/.client-scan
+for lr_f in acct-01/limits.json acct-02/limits.json acct-01/.limited acct-01/.client-limit-cleared; do
+  rm -f "$ND/$lr_f"
+  [ -f "$WORK/lr-save.${lr_f//\//_}" ] && cp -p "$WORK/lr-save.${lr_f//\//_}" "$ND/$lr_f"
+done
+
 # ---- 16-nodata-shorten. an offender pass must never SHORTEN a weekly client marker ---
 # The writer's offenders branch used to overwrite `.limited` unconditionally: a session
 # bucket crossing the threshold (+1h reset) replaced a client:seven_day marker four days
@@ -2539,6 +2640,76 @@ EOF
 [ $? -eq 0 ] && t_ok "an all-zero payload still writes no session_percent (2026-09-04 holds)" \
   || t_fail "allzero still unknown" "see $ND/acct-01/limits.json"
 
+# ---- 16-idle-marker. an INFERRED session 0 may rank, but it may never unpark ---------
+# 2026-09-22, the second half of the same day: with idle accounts ranking again, the
+# operator's `claude --resume` landed on acct-14 and was rejected inside a minute.
+# selection.log: "acct-14 client limit cleared by newer telemetry (0%)" one second before
+# the pick, and "LIMITED by its own session (five_hour)" 54s after it. acct-14 held a
+# client:five_hour marker from a REAL 429, and its telemetry — fetched at 13:04:16Z,
+# WHILE the client was being rejected — still reported the session bucket `percent: 0,
+# resets_at: null`. So a silent session bucket does NOT prove an idle account: the
+# endpoint may simply never report the 5h window. Recovery has to be MEASURED. The
+# clearing rule read max_percent, which is the WEEKLY peak when the session bucket is
+# silent — the cross-signal borrow the aggregation itself refuses to make.
+mk_client_marker() { # mk_client_marker <acct dir> <bucket> <age seconds> <reset in>
+  python3 - "$1" "$2" "$3" "$4" <<'PJ'
+import sys, time, os
+d, bucket, age, ahead = sys.argv[1], sys.argv[2], int(sys.argv[3]), int(sys.argv[4])
+now = int(time.time())
+marked = time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime(now - age))
+with open(os.path.join(d, '.limited'), 'w') as f:
+    f.write(f'{now + ahead}\n'
+            f'bucket=client:{bucket} percent=100 marked_at={marked} '
+            f'reason=client-rate-limit\n')
+PJ
+}
+# the acct-14 shape: a live 5h rejection, and telemetry whose session bucket is silent
+mk_client_marker "$ND/acct-01" five_hour 1200 7200
+ndlimits "$WORK/usage-weekly-only.json" --quiet >/dev/null
+{ [ -f "$ND/acct-01/.limited" ] \
+  && python3 -c "import json,sys; d=json.load(open('$ND/acct-01/limits.json')); sys.exit(0 if d.get('session_inferred') is True and d['session_percent'] == 0 else 1)"; } \
+  && t_ok "an inferred session 0 cannot clear a client:five_hour marker (writer)" \
+  || t_fail "inferred unpark (writer)" "marker gone, or session_inferred not recorded"
+
+# ...and the SHIM must agree, because it is the shim that logged the clear before the
+# bad pick. The rival is WORSE on weekly and must still take every launch.
+ndl 60 10 60 > "$ND/acct-02/limits.json"
+rm -f "$ND/.pick-seq" "$ND"/acct-0*/.last-pick "$ND/acct-02/.limited"
+: > "$ND/selection.log"
+nd_park_hits=0
+for _ in $(seq 1 6); do
+  case "$(CLAUDE_ACCOUNTS_ROOT="$ND" claude 2>&1)" in *CFG=acct-01*) nd_park_hits=$((nd_park_hits+1)) ;; esac
+done
+{ [ "$nd_park_hits" = "0" ] && [ -f "$ND/acct-01/.limited" ] \
+  && ! grep -q "cleared by newer telemetry" "$ND/selection.log"; } \
+  && t_ok "the shim never unparks a 5h marker on an inferred reading (0 of 6 picks)" \
+  || t_fail "inferred unpark (shim)" \
+     "the parked account took $nd_park_hits of 6; $(tail -1 "$ND/selection.log" 2>/dev/null)"
+
+# The #22 behaviour that must SURVIVE: a MEASURED low session reading still clears a 5h
+# marker. That window self-heals in hours, which is why #22 (2026-09-03) had to clear it
+# — this fix narrows the evidence, it does not park an account until its reset.
+mk_client_marker "$ND/acct-01" five_hour 1200 7200
+cat > "$WORK/usage-measured-session.json" <<'EOF'
+{"limits":[
+  {"kind":"session","group":"session","percent":5,"resets_at":"2099-01-01T00:00:00+00:00","scope":null},
+  {"kind":"weekly_all","group":"weekly","percent":37,"resets_at":"2099-01-05T00:00:00+00:00","scope":null}
+]}
+EOF
+ndlimits "$WORK/usage-measured-session.json" --quiet >/dev/null
+{ [ ! -f "$ND/acct-01/.limited" ] \
+  && python3 -c "import json,sys; d=json.load(open('$ND/acct-01/limits.json')); sys.exit(0 if 'session_inferred' not in d and d['session_percent'] == 5 else 1)"; } \
+  && t_ok "a MEASURED low session reading still clears a five_hour marker (#22 holds)" \
+  || t_fail "measured recovery" "see $ND/acct-01/.limited"
+
+# A WEEKLY marker is untouched by any of this — it was already un-clearable.
+mk_client_marker "$ND/acct-01" seven_day 1200 7200
+ndlimits "$WORK/usage-measured-session.json" --quiet >/dev/null
+[ -f "$ND/acct-01/.limited" ] \
+  && t_ok "a weekly marker still outlives even a measured reading (2026-09-04 holds)" \
+  || t_fail "weekly marker cleared" "see $ND/acct-01"
+rm -f "$ND"/acct-0*/.limited "$ND"/acct-0*/.client-limit-cleared
+
 # ---- 16-nodata-blind. a fresh timestamp is not a usable reading ---------------------
 # The third face of the same defect: blindness was judged on fetched_at alone, so a pool
 # of freshly-written no_data documents looked FRESH — selection.log carried no
@@ -5990,6 +6161,34 @@ for k in ('max_percent', 'weekly_percent', 'session_percent'):
 EOF
 [ $? -eq 0 ] && t_ok "codex: an all-zero payload still writes no session_percent (2026-09-04 holds)" \
   || t_fail "codex allzero still unknown" "see $CD/acct-01/limits.json"
+
+# ...and the same guard one window down: an INFERRED session 0 may rank, never unpark.
+# codex reports no window at all for a closed one, so silence is its NORMAL shape and
+# says nothing about a 429 the client actually received. codex's only telemetry-driven
+# clear lives here in `limits` (the shim has none — marker_active waits for the reset),
+# so this is the single place the rule has to hold.
+mk_client_marker "$CD/acct-01" 5h 1200 7200
+cdlimits "$WORK/cx-usage-weekly-only.json" --quiet >/dev/null
+{ [ -f "$CD/acct-01/.limited" ] \
+  && python3 -c "import json,sys; d=json.load(open('$CD/acct-01/limits.json')); sys.exit(0 if d.get('session_inferred') is True and d['session_percent'] == 0 else 1)"; } \
+  && t_ok "codex: an inferred session 0 cannot clear a client:5h marker" \
+  || t_fail "codex inferred unpark" "marker gone, or session_inferred not recorded"
+
+# ...while a MEASURED short-window reading still clears it (#22 holds on codex too).
+mk_client_marker "$CD/acct-01" 5h 1200 7200
+cat > "$WORK/cx-usage-measured-session.json" <<EOF
+{"email":"nd@cx","plan_type":"pro",
+ "rate_limit":{"allowed":true,"limit_reached":false,
+   "primary_window":{"used_percent":5,"limit_window_seconds":18000,"reset_at":$((now+9000))},
+   "secondary_window":{"used_percent":37,"limit_window_seconds":604800,"reset_at":$((now+90000))}},
+ "additional_rate_limits":[]}
+EOF
+cdlimits "$WORK/cx-usage-measured-session.json" --quiet >/dev/null
+{ [ ! -f "$CD/acct-01/.limited" ] \
+  && python3 -c "import json,sys; d=json.load(open('$CD/acct-01/limits.json')); sys.exit(0 if 'session_inferred' not in d and d['session_percent'] == 5 else 1)"; } \
+  && t_ok "codex: a MEASURED low session reading still clears a 5h marker (#22 holds)" \
+  || t_fail "codex measured recovery" "see $CD/acct-01/.limited"
+rm -f "$CD"/acct-0*/.limited "$CD"/acct-0*/.client-limit-cleared
 rm -f "$CD"/acct-0*/.limited
 
 # ---- C14. oauth refresh via the token endpoint --------------------------------------
@@ -7102,6 +7301,13 @@ if CODEX_MULTIACC_AUTO_RESET=1 python3 -m unittest discover -s "$REPO_DIR/tests"
 else
   t_fail "codex automatic reset suite" "see unittest output above"
 fi
+# ...and its claude twin: the cedar_ember status rides on the usage response, the claim
+# is idempotent across the fleet, and a confirmed reset lifts even a weekly client park.
+if CLAUDE_MULTIACC_AUTO_RESET=1 python3 -m unittest discover -s "$REPO_DIR/tests" -p 'test_claude_reset*.py'; then
+  t_ok "claude: automatic limit-reset integration suite"
+else
+  t_fail "claude automatic reset suite" "see unittest output above"
+fi
 
 # ---- summary ---------------------------------------------------------------------
 echo