claude-multiacc 2.0.41 → 2.0.43

package/README.md

@@ -160,7 +160,9 @@ fails open into stock `claude`, and logs why to `selection.log`.
 The shim prints nothing, logs `timestamp account cwd` (never prompt text) to
 `selection.log`, and `exec`s the real binary — stdin/stdout/exit codes pass through
 byte-identically. If anything is missing (no manifest, no accounts, unreadable state,
-even an unset `HOME`) it fails **open** into plain passthrough.
+even an unset `HOME`) it fails **open** into plain passthrough. In tmux, an interactive
+launch also starts a detached [auto-resume](#auto-resume) watcher just before that `exec`;
+the `exec` itself does not change.
 
 **Limit-aware marking.** `claude-accounts limits` (every 15 min via launchd on the Mac,
 cron on the server, plus an opportunistic non-blocking kick from the shim when data is
@@ -272,6 +274,17 @@ account's `.credentials.json` (0600), or its macOS Keychain item.
 > login made over ssh migrates into the Keychain the first time a GUI-session process
 > refreshes its token — the pool reads both places (`lib/keychain.py`), and an account
 > that must work from everywhere should carry a portable token (`claude-accounts mint`).
+> The item's **account name** is the client's `$USER` — and a client started without USER
+> files it under `unknown`, beside the older item, where the next client never looks. So
+> `claude-accounts`/`codex-accounts` and the shim fill `USER`/`LOGNAME` from `id -un` when
+> the caller's env has none, and the pool judges only the item under that canonical name —
+> the one the client reads (one `security` call per lookup). A login found only under
+> another name counts nowhere until the scheduled limits pass moves it under the canonical
+> name. A token refresh writes back under the canonical name and drops the siblings it
+> made stale (the same grant, a dead one) but keeps another live grant; a sign-in whose
+> identity checked out prunes every sibling; `remove` deletes every item.
+> `python3 lib/keychain.py prune <acct dir>` prunes by hand (only when the canonical item
+> is a live login; it never writes).
 > Override: `CLAUDE_MULTIACC_KEYCHAIN=0` disables the lookup. This is what keeps idle accounts' telemetry fresh so they win
 selection over busy accounts; without it, stale telemetry ranks neutral and a truly-idle
 account would lose to a busy-but-fresh one. Refresh failures fail open and back off via
@@ -394,6 +407,45 @@ also sees the model's own answer: a `-p` run that merely *mentions* a 403 must n
 an account, and if one slips through it returns to the pool by itself. Output is buffered so a retried call
 never double-emits. Only engages when stdin is finite (tty / regular file / `/dev/null`)
 and ≥2 accounts are eligible; service-spawned pipes take the plain exec path untouched.
+Interactive sessions are not retried this way. They get auto-resume, described next.
+
+## Auto-resume
+
+An interactive `claude` or `codex` session in **tmux** can stop on a usage limit, a failed
+login, an API error or (claude) a crash. It is then **resumed automatically, same session
+id**, on another pooled account with headroom. There is no `/exit`, no `--resume` and no
+"continue" to type. It covers the everyday launches:
+
+- `claude --dangerously-skip-permissions`, `--resume <id>` and `--model …`;
+- `codex --dangerously-bypass-approvals-and-sandbox` and `codex resume …`.
+
+Every other launch, including `-p` and `codex exec`, runs exactly as before.
+
+**How it works.**
+
+- **Launch.** The shim's `exec` is unchanged. Just before it, a detached watcher starts
+  (`lib/autoresume.py`, which needs `python3`). It reads that run's transcript (codex: its
+  rollout).
+- **Probe.** Once an error settles, the watcher asks the shim, in probe mode, whether
+  another account has headroom. If none does, it **holds** and touches nothing, and
+  Claude's own "continuing automatically at …" carries on.
+- **Relaunch.** Otherwise it stops the TUI with SIGTERM and waits for the pane's shell
+  prompt. It then types a one-line relaunch of the shim into that **shell**. It never
+  sends a keystroke to the TUI, whose limit menu can add funds or spend the one-shot
+  `/limit-reset`.
+- **Resume.** The relaunched shim parks the old account with the usual markers, then runs
+  normal selection minus the account it just left. The session resumes with a short
+  prompt telling the model it was restarted and should continue.
+
+Every step appends an `autoresume <event>` line to `selection.log`.
+
+```bash
+touch ~/.claude-accounts/autoresume.off   # claude pool off, already-running sessions included
+touch ~/.codex-accounts/autoresume.off    # codex pool off
+CLAUDE_MULTIACC_AUTORESUME=0 claude       # one launch (CODEX_MULTIACC_AUTORESUME=0 codex)
+```
+
+See [auto-resume: error classes, gates, budgets, logs and limitations](docs/AUTORESUME.md).
 
 ## MCP servers for every account
 
@@ -404,7 +456,7 @@ account, and a stock `claude mcp add` lands in **one random account**. That is h
 now owns a **registry**, `<pool>/mcp-servers.json`, that is reconciled into every account:
 
 ```bash
-claude-accounts mcp add appinspire-mcp -- npx -y appinspire-mcp@latest serve   # both pools
+claude-accounts mcp add docs-search -- node /path/docs-search.mjs serve     # both pools
 claude-accounts mcp add --provider claude local-dev -e KEY=v -- node /path/server.mjs serve
 claude-accounts mcp add --scope project --project "$HOME/design-lab/run1" appinspire -e APPINSPIRE_LIBRARY_DIR="$HOME/.appinspire-mcp/library" -- node "$HOME/appinspire-mcp/bin/appinspire-mcp.mjs" serve
 claude-accounts mcp remove adspower-local-api    # retire EVERYWHERE: every account, every project entry
@@ -441,6 +493,12 @@ claude-accounts mcp apply                        # re-apply now (repair drift)
   from **inside** a pooled session (an agent's Bash tool, `npx appinspire-mcp install` run by
   an agent): the session's config dir is a pool account, so the same mirror applies. A
   config dir outside the pool is plain passthrough.
+- **Runner-managed servers**: on app-robot fleet Macs the runner publishes `appinspire-mcp` into
+  each Mac's machine-local overlay with that Mac's own paths. Never `mcp add` it to the synced
+  registry (directly, through a mirrored `claude|codex mcp add`, or via `appinspire-mcp install`):
+  the synced entry wins and every Mac launches one machine's Node and package paths. Never
+  `mcp remove` it either: the tombstone deletes the managed entry on every Mac. Drop a stray
+  registry entry without a tombstone, then `mcp apply` and `sync`.
 - **Replicas**: on a pool whose `sync-role` file says `replica`, `add`/`remove` and the
   shim's mirror land in the machine-local overlay (owner `local`) instead of the synced
   registry, because the source's next push would overwrite them. Make registry changes on

package/bin/claude

@@ -12,6 +12,17 @@
 
 set -u
 
+# Claude Code names its macOS Keychain item after $USER, and under Bun a client with no
+# USER calls the user "unknown" — so a caller whose env lacks it (app-robot's panel
+# ceremony, 2026-09-24) gets a login filed under a name the next client never reads
+# (lib/keychain.py). Every client this shim starts, passthrough included, inherits a
+# real name; lib/common.sh does the same for claude-accounts.
+if [ -z "${USER:-}" ]; then
+  USER="$(id -un 2>/dev/null || true)"
+  if [ -n "$USER" ]; then export USER; else unset USER; fi
+fi
+if [ -z "${LOGNAME:-}" ] && [ -n "${USER:-}" ]; then export LOGNAME="$USER"; fi
+
 # ${HOME:-} guards: with HOME stripped (env -i, some cron/systemd units) the shim
 # must still fail OPEN into plain passthrough, never abort on an unbound variable.
 # CLAUDE_ACCOUNTS_ROOT scopes the pool to one app-robot instance; CLAUDE_ACCOUNTS_DIR
@@ -177,10 +188,14 @@ mcp_nested_mirror() {
 }
 
 # Fast passthrough: caller pinned a config dir or token, addon disabled, recursion
-# guard, or no account data yet. Byte-identical behavior to stock claude.
+# guard, or no account data yet. Byte-identical behavior to stock claude (a USER the
+# caller left out is filled at the top — see there).
 if [ -n "${CLAUDE_CONFIG_DIR:-}" ] || [ -n "${CLAUDE_CODE_OAUTH_TOKEN:-}" ] \
   || [ "${CLAUDE_MULTIACC_DISABLE:-0}" = "1" ] || [ -n "${CLAUDE_SHIM_ACTIVE:-}" ] \
   || [ ! -f "$MANIFEST" ]; then
+  # An auto-resume probe asks who WOULD be picked and must never start a client; a
+  # passthrough has no pool pick to report (see ---- auto-resume ----).
+  [ "${CLAUDE_MULTIACC_AR_PROBE:-}" = "1" ] && { printf 'pick= tier=none\n'; exit 3; }
   mcp_nested_mirror "$@" || true
   exec "$REAL" "$@"
 fi
@@ -213,6 +228,11 @@ case "${CLAUDE_MULTIACC_KEYCHAIN:-}" in
   *) if [ "$(uname -s)" = "Darwin" ]; then KC_ON=1; else KC_ON=0; fi ;;
 esac
 if [ "$KC_ON" = "1" ] && ! command -v security >/dev/null 2>&1; then KC_ON=0; fi
+# The client reads ONLY the item under its own account name — $USER (filled above),
+# anything outside [A-Za-z0-9._-] becoming "claude-code-user" — so that one item is what
+# this shim judges: a sibling under another name is invisible to the client it launches.
+KC_ACCOUNT="${USER:-}"
+case "$KC_ACCOUNT" in ''|*[!A-Za-z0-9._-]*) KC_ACCOUNT=claude-code-user ;; esac
 kc_service() { # $1 = acct dir -> the keychain service name the client uses for it
   local h=""
   if command -v shasum >/dev/null 2>&1; then h="$(printf '%s' "$1" | shasum -a 256 2>/dev/null)"
@@ -227,7 +247,7 @@ kc_lookup() { # $1 = acct dir; sets KC_JSON; rc 0 readable, 1 none, 2 exists but
   [ "$KC_ON" = "1" ] || { KC_JSON=""; return 1; }
   if [ "$KC_MEMO_DIR" = "$1" ]; then return "$KC_MEMO_RC"; fi
   local out rc
-  out="$(security find-generic-password -s "$(kc_service "$1")" -w 2>/dev/null)"; rc=$?
+  out="$(security find-generic-password -a "$KC_ACCOUNT" -s "$(kc_service "$1")" -w 2>/dev/null)"; rc=$?
   KC_MEMO_DIR="$1"; KC_JSON=""; KC_MEMO_RC=1
   case "$rc" in
     0) case "$out" in *claudeAiOauth*) KC_JSON="$out"; KC_MEMO_RC=0 ;; esac ;;
@@ -239,7 +259,7 @@ kc_mtime() { # $1 = acct dir -> epoch of the item's last write (0 when none); at
              # are readable even when the secret is locked, so a marker still self-heals
   [ "$KC_ON" = "1" ] || { echo 0; return 0; }
   local stamp
-  stamp="$(security find-generic-password -s "$(kc_service "$1")" 2>/dev/null \
+  stamp="$(security find-generic-password -a "$KC_ACCOUNT" -s "$(kc_service "$1")" 2>/dev/null \
     | LC_ALL=C sed -n 's/.*"mdat"<timedate>=0x[0-9A-Fa-f]*  *"\([0-9]\{14\}\)Z.*/\1/p' | head -1)"
   case "$stamp" in
     [0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9])
@@ -262,6 +282,379 @@ sel_log() {
   printf '%s %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$*" 2>/dev/null >> "$ACC_ROOT/selection.log" || true
 }
 
+# ---- auto-resume ----------------------------------------------------------------
+# An interactive session that stops on a usage limit, a failed login, an API error or a
+# crash is resumed — same session id, no keystroke — on another pooled account. The TUI
+# at a limit does not exit; it idles on "continuing automatically at <reset>", which can
+# be days away. The shim's share of the job is small on purpose and never blocks:
+#   - the plain interactive exec stays byte-identical; just before it, a detached watcher
+#     (lib/autoresume.py) is spawned for the pid the client is about to become;
+#   - when the watcher moves a session it stops the client, writes a single-use relaunch
+#     file and types ` CLAUDE_MULTIACC_AR=<token>:<sid> [CLAUDE_ACCOUNTS_ROOT=<root>] <this
+#     shim's path>` into the pane's SHELL — never into the TUI, whose limit menu can "Add
+#     funds" or spend the one-shot /limit-reset — and that command lands HERE: the token
+#     names the file, which holds the verdict to mark on the old account BEFORE selection,
+#     the argv to resume with, and the chain state (depth/avoid/hist) the next watcher
+#     carries on; the pool root is typed only when it is not the default one;
+#   - a probe run (CLAUDE_MULTIACC_AR_PROBE=1) is how the watcher asks "who would be
+#     picked now?" — the real candidate loop, then `pick=<acct> tier=<t>` and exit, so the
+#     watcher only kills a session there is somewhere to move to.
+# Everything fails OPEN: a missing python, a non-tmux terminal or an argv this code does
+# not recognise all mean "exec exactly as before, unsupervised". The one exception is a
+# typed relaunch whose token is gone: it names the session to resume and exits 2, because
+# its own (empty) argv would start a fresh session in the stopped one's place.
+# Tokens and relaunch/state files live in $ACC_ROOT/tmp/autoresume; the watcher prunes.
+AR_DIR="$ACC_ROOT/tmp/autoresume"
+AR_PROBE=0
+[ "${CLAUDE_MULTIACC_AR_PROBE:-}" = "1" ] && AR_PROBE=1
+AR_DEPTH=0        # relaunches so far in this chain (the watcher caps it)
+AR_AVOID=""       # acct-NN:<until epoch>,... — accounts this chain just left
+AR_HIST=""        # class:epoch,... — the watcher's hourly budgets
+AR_CHAIN=""       # opaque chain id, minted and read by the watcher
+AR_LOADED=0
+AR_ARGV=()
+AR_ORIG_ARGV=()
+AR_R_CLASS="" AR_R_ACCT="" AR_R_RESET="" AR_R_RTYPE="" AR_R_MARKED="" AR_R_SID=""
+AR_TRUST=0        # this run continues a relaunch: its cwd is trusted in the picked account
+AR_PY=""
+
+# A chain field copied from a file (or the probe's env) into the next state file: one
+# line, a narrow charset, bounded. Anything else is dropped — the chain restarts, and
+# nothing but the watcher's budgets depends on it.
+ar_field_ok() { # $1 value
+  [ "${#1}" -le 2048 ] || return 1
+  case "$1" in *[!A-Za-z0-9:,._-]*) return 1 ;; esac
+  return 0
+}
+# The probe gets the watcher's AVOID list from its env; a normal run only ever takes it
+# from a relaunch file.
+[ "$AR_PROBE" = 1 ] && ar_field_ok "${CLAUDE_MULTIACC_AR_AVOID:-}" \
+  && AR_AVOID="${CLAUDE_MULTIACC_AR_AVOID:-}"
+
+# Load a relaunch token. Runs BEFORE RUN_MODEL reads argv below (the relaunch argv may
+# carry --model) and before anything else consults $PWD. sess_id_ok and the markers are
+# defined further down, so the id class is spelled inline and the verdict is applied
+# later, by ar_relaunch_apply, still ahead of any selection.
+ar_relaunch_load() { # $1 token -> 0 with AR_ARGV and the AR_R_*/chain fields set
+  local tok="$1" rf af line k v n=0 a="" ok=0 ver="" prov="" sid="" cwd=""
+  local cls="" acct="" reset="" rtype="" marked="" depth=0 avoid="" hist="" chain=""
+  # Alphanumerics only: the token becomes part of a path, so no '/' and no '..'.
+  case "$tok" in *[!A-Za-z0-9]*) return 1 ;; esac
+  [ "${#tok}" -ge 8 ] && [ "${#tok}" -le 64 ] || return 1
+  rf="$AR_DIR/r-$tok.relaunch"
+  af="$AR_DIR/r-$tok.argv"
+  # -f before every read: a FIFO planted under that name would block the read forever,
+  # a hang before exec. Unknown keys are ignored; known ones are validated one by one.
+  if [ -f "$rf" ]; then
+    while IFS= read -r line || [ -n "$line" ]; do
+      n=$((n + 1)); [ "$n" -le 64 ] || break
+      case "$line" in *=*) ;; *) line=""; continue ;; esac
+      k="${line%%=*}"; v="${line#*=}"; line=""
+      case "$k" in
+        v) ver="$v" ;;
+        provider) prov="$v" ;;
+        class) case "$v" in ''|*[!a-z_]*) ;; *) cls="$v" ;; esac ;;
+        acct) case "$v" in acct-*[!0-9]*|acct-) ;; acct-*) acct="$v" ;; esac ;;
+        reset) num_ok "$v" && reset="$v" ;;
+        rtype) case "$v" in five_hour|seven_day) rtype="$v" ;; esac ;;
+        marked) case "$v" in ''|*[!0-9TZ:.+-]*) ;; *) marked="$v" ;; esac ;;
+        sid) case "$v" in ''|-*|*[!0-9a-fA-F-]*) ;; *) sid="$v" ;; esac ;;
+        cwd) case "$v" in /*) cwd="$v" ;; esac ;;
+        depth) num_ok "$v" && depth="$v" ;;
+        avoid) ar_field_ok "$v" && avoid="$v" ;;
+        hist) ar_field_ok "$v" && hist="$v" ;;
+        chain) ar_field_ok "$v" && [ "${#v}" -le 64 ] && chain="$v" ;;
+      esac
+    done < "$rf"
+    if [ "$ver" = 1 ] && [ "$prov" = claude ] && [ -f "$af" ] \
+      && [ $((now - $(file_mtime "$rf"))) -le 600 ]; then
+      AR_ARGV=()
+      while IFS= read -r -d '' a; do
+        AR_ARGV+=("$a"); a=""
+        [ "${#AR_ARGV[@]}" -lt 512 ] || break
+      done < "$af"
+      # A writer that omits the final NUL still means its last element.
+      [ -n "$a" ] && AR_ARGV+=("$a")
+      [ "${#AR_ARGV[@]}" -gt 0 ] && ok=1
+    fi
+  fi
+  # Single use, whatever the outcome: a token is never honoured twice.
+  rm -f "$rf" "$af" 2>/dev/null
+  if [ "$ok" != 1 ]; then
+    AR_ARGV=()
+    AR_R_SID="$sid"
+    return 1
+  fi
+  AR_LOADED=1
+  AR_R_CLASS="$cls"; AR_R_ACCT="$acct"; AR_R_RESET="$reset"; AR_R_RTYPE="$rtype"
+  AR_R_MARKED="$marked"
+  AR_DEPTH="$depth"; AR_HIST="$hist"; AR_CHAIN="$chain"; AR_AVOID="$avoid"
+  # The pane's shell sits wherever the session was launched, but the session's own cwd is
+  # what --resume looks the transcript up by. Everything already resolved against the old
+  # directory (a relative pool root or PATH entry) has to survive the cd.
+  if [ -n "$cwd" ] && [ -d "$cwd" ] && [ "$cwd" != "$PWD" ]; then
+    case "$ACC_ROOT" in /*) ;; *) ACC_ROOT="$PWD/$ACC_ROOT"; MANIFEST="$ACC_ROOT/accounts.json"; AR_DIR="$ACC_ROOT/tmp/autoresume" ;; esac
+    case "$REAL" in /*) ;; *) REAL="$PWD/$REAL" ;; esac
+    cd -- "$cwd" 2>/dev/null || true
+  fi
+  return 0
+}
+
+# A typed relaunch whose token cannot be honoured (missing, expired, malformed). The
+# watcher has already stopped the session and the typed line carries no argv of its own,
+# so running on would open a FRESH session in its place: say how to get it back, and stop.
+ar_token_dead() { # $1 session id (the token's, else the file's) or empty
+  local sid="$1"
+  case "$sid" in
+    ''|-*|*[!0123456789abcdefABCDEF-]*) sid="" ;;
+    *-*) [ "${#sid}" -le 64 ] || sid="" ;;
+    *) sid="" ;;
+  esac
+  sel_log "autoresume expired sid=${sid:--}"
+  if [ -n "$sid" ]; then
+    printf 'claude-multiacc: auto-resume could not continue automatically (the resume token expired). Resume with: claude --resume %s\n' "$sid" >&2
+  else
+    printf 'claude-multiacc: auto-resume could not continue automatically (the resume token expired).\n' >&2
+  fi
+  exit 2
+}
+
+# The verdict the watcher saw, written through the SAME writers the transcript scans use
+# (never shortening a longer park), so the old account is out of the pool before this
+# very selection runs — and for every other launch too. Other classes (model-scoped,
+# transient, blocked, crash) leave no marker: the watcher's AVOID list covers them.
+ar_relaunch_apply() {
+  local d=""
+  [ "$AR_LOADED" = 1 ] || return 0
+  [ -n "$AR_R_ACCT" ] && [ -d "$ACC_ROOT/$AR_R_ACCT" ] && d="$ACC_ROOT/$AR_R_ACCT"
+  if [ -n "$d" ]; then
+    case "$AR_R_CLASS" in
+      quota)
+        if num_ok "$AR_R_RESET" && [ "$AR_R_RESET" -gt "$now" ] && [ -n "$AR_R_RTYPE" ]; then
+          mark_client_limit "$d" "$AR_R_RESET" "$AR_R_RTYPE" "$AR_R_MARKED"
+        fi ;;
+      auth) mark_client_auth_dead "$d" ;;
+    esac
+  fi
+  # Field 2 is the word `autoresume`, never an account id: lib/report.py and the
+  # *-accounts tools read an acct-NN in field 2 as a pick.
+  sel_log "autoresume relaunch chain=${AR_CHAIN:--} from=${AR_R_ACCT:--}" \
+    "class=${AR_R_CLASS:--} depth=$AR_DEPTH"
+  return 0
+}
+
+# AVOID: accounts this chain just left, each until its own epoch. Filters `eligible` only
+# — never `valid` — so a pool with nowhere else to go still reaches the all-limited
+# fallback exactly as before. Builtins only: this runs once per candidate.
+ar_avoided() { # $1 acct dir
+  local rest e id until
+  [ -n "$AR_AVOID" ] || return 1
+  rest="$AR_AVOID,"
+  while [ -n "$rest" ]; do
+    e="${rest%%,*}"; rest="${rest#*,}"
+    id="${e%%:*}"; until="${e#*:}"
+    [ "$id" = "${1##*/}" ] || continue
+    num_ok "$until" && [ "$until" -gt "$now" ] && return 0
+  done
+  return 1
+}
+
+# Probe answer, and the end of a probe run. `none` (exit 3) means nothing would be picked
+# at all; otherwise the tier says which cut the pick came from.
+ar_probe_exit() { # $1 = none, or empty to derive the tier from the selection just made
+  local t="${1:-}"
+  if [ -z "$t" ]; then
+    if [ "${#eligible[@]}" -gt 0 ]; then t=eligible
+    elif [ "${#soft[@]}" -gt 0 ]; then t=soft
+    else t=hard; fi
+  fi
+  if [ "$t" = none ] || [ -z "${pick:-}" ]; then
+    printf 'pick= tier=none\n'
+    exit 3
+  fi
+  printf 'pick=%s tier=%s\n' "${pick##*/}" "$t"
+  exit 0
+}
+
+# The watcher only understands sessions it can resume faithfully: an interactive TUI with
+# these flags and at most one prompt. A single word may be a subcommand (`claude doctor`,
+# `claude mcp …`), so a positional counts as a prompt only when it contains a space.
+# Anything else — -p, --fork-session, a bare --resume picker — runs unsupervised.
+ar_argv_ok() { # args: the session's argv
+  local a want="" pos=0
+  for a in "$@"; do
+    if [ -n "$want" ]; then
+      case "$want" in
+        uuid) sess_id_ok "$a" || return 1
+              case "$a" in *-*) ;; *) return 1 ;; esac ;;
+        *) case "$a" in ''|-*) return 1 ;; esac ;;
+      esac
+      want=""
+      continue
+    fi
+    case "$a" in
+      --dangerously-skip-permissions|--allow-dangerously-skip-permissions|-c|--continue) ;;
+      -r|--resume) want=uuid ;;
+      --resume=*) a="${a#--resume=}"
+                  sess_id_ok "$a" || return 1
+                  case "$a" in *-*) ;; *) return 1 ;; esac ;;
+      --model|--effort|--permission-mode) want=value ;;
+      --model=*) [ -n "${a#--model=}" ] || return 1 ;;
+      -*) return 1 ;;
+      *' '*) pos=$((pos + 1)); [ "$pos" -le 1 ] || return 1 ;;
+      *) return 1 ;;
+    esac
+  done
+  [ -z "$want" ]
+}
+
+# The relaunch line is typed into the pane's shell unquoted — this shim's own path, and the
+# pool root when it is not the default — so only paths that never need quoting qualify.
+# Spelled out, never ranges: under a UTF-8 locale bash matches `[a-z]` by collation.
+ar_path_ok() { # $1 absolute path
+  case "$1" in
+    /*) ;;
+    *) return 1 ;;
+  esac
+  case "$1" in
+    *[!ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789/._+-]*) return 1 ;;
+  esac
+  return 0
+}
+
+# A python the watcher can run on. /usr/bin/python3 on a Mac without developer tools is a
+# stub that pops an "install the command line tools" dialog and fails — only trusted when
+# what it forwards to is there. File tests only: xcode-select itself would be a fork.
+ar_python() {
+  local py="${CLAUDE_MULTIACC_PYTHON:-}"
+  if [ -n "$py" ] && [ -f "$py" ] && [ -x "$py" ]; then AR_PY="$py"; return 0; fi
+  py="$(command -v python3 2>/dev/null)" || return 1
+  case "$py" in /*) ;; *) return 1 ;; esac
+  if [ "$py" = /usr/bin/python3 ]; then
+    case "${OSTYPE:-}" in
+      darwin*)
+        [ -x /Library/Developer/CommandLineTools/usr/bin/python3 ] \
+          || [ -x /var/db/xcode_select_link/usr/bin/python3 ] \
+          || [ -x "${DEVELOPER_DIR:-/nonexistent}/usr/bin/python3" ] \
+          || return 1 ;;
+    esac
+  fi
+  AR_PY="$py"
+}
+
+ar_start_watcher() { # $1 provider, $2 picked acct dir
+  local prov="$1" dir="$2" lib st tmp launched root nl=$'\n'
+  # Kill switches: the env for one shell, the file for the whole pool (the watcher
+  # re-reads the file every tick, so it also stops sessions already running).
+  case "${CLAUDE_MULTIACC_AUTORESUME:-1}" in 0|false|no|off) return 1 ;; esac
+  [ -e "$ACC_ROOT/autoresume.off" ] && return 1
+  # A pin is the caller overriding selection. A valid one execs long before this; an
+  # invalid one fell through to a random pick, and moving that session is not ours to do.
+  [ -z "${CLAUDE_ACCOUNT:-}" ] || return 1
+  if [ "${CLAUDE_MULTIACC_AR_TEST_TTY:-}" != 1 ]; then
+    [ -t 0 ] && [ -t 1 ] || return 1
+  fi
+  # The relaunch is typed into the pane's shell: no tmux, nothing to type into.
+  [ -n "${TMUX:-}" ] && [ -n "${TMUX_PANE:-}" ] || return 1
+  ar_argv_ok ${AR_ORIG_ARGV[@]+"${AR_ORIG_ARGV[@]}"} || return 1
+  ar_python || return 1
+  lib="$SELF_DIR/../lib/autoresume.py"
+  [ -f "$lib" ] || return 1
+  # The state file is key=value lines; a value with a newline cannot be carried.
+  case "$PWD$dir$ACC_ROOT$SELF$TMUX$TMUX_PANE" in *"$nl"*) return 1 ;; esac
+  # The watcher and the relaunch run elsewhere: hand them absolute pool paths.
+  root="$ACC_ROOT"
+  case "$root" in /*) ;; *) root="$PWD/$root"; dir="$PWD/$dir" ;; esac
+  ar_path_ok "$SELF" && ar_path_ok "$root" || return 1
+  [ -d "$AR_DIR" ] || mkdir -p "$AR_DIR" 2>/dev/null || return 1
+  # The ORIGINAL argv (before the fallback-model pin): the watcher rebuilds the relaunch
+  # from it, and the relaunch re-runs selection, which pins again for the NEW pick.
+  if [ "${#AR_ORIG_ARGV[@]}" -gt 0 ]; then
+    printf '%s\0' "${AR_ORIG_ARGV[@]}" 2>/dev/null > "$AR_DIR/$$.argv" || return 1
+  else
+    : 2>/dev/null > "$AR_DIR/$$.argv" || return 1
+  fi
+  launched="$(date +%s)"
+  num_ok "$launched" || launched="$now"
+  # $$ is the pid the client keeps across exec — the name of its sessions/<pid>.json.
+  # Written atomically: the watcher must never parse half a state file.
+  st="$AR_DIR/$$.state"
+  tmp="$AR_DIR/.$$.state.tmp"
+  printf '%s\n' "v=1" "provider=$prov" "pid=$$" "ppid=$PPID" "acct=${dir##*/}" \
+    "acct_dir=$dir" "cwd=$PWD" "launched=$launched" "tmux=$TMUX" "pane=$TMUX_PANE" \
+    "self=$SELF" "acc_root=$root" "depth=$AR_DEPTH" "avoid=$AR_AVOID" \
+    "hist=$AR_HIST" "chain=$AR_CHAIN" 2>/dev/null > "$tmp" \
+    && mv -f "$tmp" "$st" 2>/dev/null \
+    || { rm -f "$tmp" 2>/dev/null; return 1; }
+  # Detached and never waited for; the watcher setsid()s itself at once. It inherits
+  # this environment on purpose (the probe strips the account-specific part).
+  ( trap '' INT QUIT HUP TSTP
+    exec "$AR_PY" -I "$lib" watch --state "$st" </dev/null >/dev/null 2>&1 &
+  ) >/dev/null 2>&1
+  return 0
+}
+
+# A relaunch may land on an account that never opened this directory, and Claude asks "Is
+# this a project you trust?" there even under --dangerously-skip-permissions: a dialog
+# nobody is watching would stall the resumed session. So the relaunch (and only it) marks
+# its cwd trusted in the picked account's .claude.json. Bounded file work, every failure
+# ignored; a probe never gets here.
+ar_trust() { # $1 picked acct dir
+  [ "$AR_TRUST" = 1 ] || return 0
+  [ -f "$1/.claude.json" ] || return 0
+  ar_python || return 0
+  "$AR_PY" -I "$SELF_DIR/../lib/autoresume.py" trust --acct-dir "$1" --cwd "$PWD" \
+    </dev/null >/dev/null 2>&1 || true
+  return 0
+}
+
+# Called right before the plain interactive exec. Whatever the gate decided, the TUI
+# never sees an auto-resume variable (a nested `claude` must not inherit a probe flag).
+ar_spawn_watcher() { # $1 provider, $2 picked acct dir
+  local rc=0 v
+  ar_start_watcher "$@" || rc=$?
+  for v in ${!CLAUDE_MULTIACC_AR_*}; do unset "$v"; done
+  unset CLAUDE_MULTIACC_AR
+  return "$rc"
+}
+
+# The relaunch entry itself: CLAUDE_MULTIACC_AR=<token>[:<session id>]. The id rides along
+# so a token that cannot be honoured can still name the session. A probe never consumes a
+# token: that belongs to the relaunch.
+if [ -n "${CLAUDE_MULTIACC_AR+x}" ]; then
+  ar_tok="$CLAUDE_MULTIACC_AR"
+  unset CLAUDE_MULTIACC_AR
+  if [ "$AR_PROBE" != 1 ] && [ -n "$ar_tok" ]; then
+    ar_sid=""
+    case "$ar_tok" in *:*) ar_sid="${ar_tok#*:}"; ar_tok="${ar_tok%%:*}" ;; esac
+    ar_relaunch_load "$ar_tok" || ar_token_dead "${ar_sid:-$AR_R_SID}"
+    set -- "${AR_ARGV[@]}"
+    AR_TRUST=1
+    unset ar_sid
+  fi
+  unset ar_tok
+fi
+# The token preflight below can prove the pick's token dead and re-enter this shim with
+# `exec "$SELF"`. A relaunch has spent its token by then, so it hands its chain (depth,
+# the accounts it left, its budgets) over in the environment — without it the re-entered
+# selection could land right back on the account the session just left. Only such a
+# re-entry (PREFLIGHT_DEPTH set) may use it, and never a probe or a fresh token.
+if [ -n "${CLAUDE_MULTIACC_AR_CARRY+x}" ]; then
+  ar_c="$CLAUDE_MULTIACC_AR_CARRY"
+  unset CLAUDE_MULTIACC_AR_CARRY
+  if [ "$AR_PROBE" != 1 ] && [ "$AR_LOADED" != 1 ] && [ -n "${CLAUDE_MULTIACC_PREFLIGHT_DEPTH:-}" ]; then
+    ar_d="${ar_c%%|*}"; ar_c="${ar_c#*|}"
+    ar_a="${ar_c%%|*}"; ar_c="${ar_c#*|}"
+    ar_h="${ar_c%%|*}"; ar_c="${ar_c#*|}"
+    if num_ok "$ar_d" && ar_field_ok "$ar_a" && ar_field_ok "$ar_h" && ar_field_ok "$ar_c" \
+      && [ "${#ar_c}" -le 64 ]; then
+      AR_DEPTH="$ar_d"; AR_AVOID="$ar_a"; AR_HIST="$ar_h"; AR_CHAIN="$ar_c"; AR_TRUST=1
+    fi
+  fi
+  unset ar_c ar_d ar_a ar_h
+fi
+AR_ORIG_ARGV=(${1+"$@"})
+
 # ---- model-scoped limits ------------------------------------------------------
 # A usage bucket can be scoped to ONE MODEL ("weekly_scoped:Fable"), and such a bucket
 # says nothing about the account's ability to serve a DIFFERENT model. The limits
@@ -1310,12 +1703,16 @@ token_preflight() { # $1 acct dir, $2 setup-token; rc 1 only for proven invalid
   return 0
 }
 
+# A relaunch marks the account it left before anything reads the pool (auto-resume).
+ar_relaunch_apply
+
 # Explicit pin wins over everything — markers, and even missing auth: the
 # add/login ceremony pins to a dir that has no credentials yet, and the login
 # must land exactly there, never in a randomly selected account's dir.
 if [ -n "${CLAUDE_ACCOUNT:-}" ]; then
   d="$ACC_ROOT/$CLAUDE_ACCOUNT"
   if [ -d "$d" ]; then
+    [ "$AR_PROBE" = 1 ] && ar_probe_exit none
     sel_log "$CLAUDE_ACCOUNT pinned pwd=$PWD"
     export CLAUDE_CONFIG_DIR="$d"
     export CLAUDE_SHIM_ACTIVE=1
@@ -1379,6 +1776,7 @@ for d in "$ACC_ROOT"/acct-*; do
     continue
   fi
   over_threshold "$d" && continue
+  ar_avoided "$d" && continue
   eligible+=("$d")
 done
 
@@ -1403,6 +1801,7 @@ fi
 # No usable accounts => stock behavior (fail open, never block work), but say WHY when
 # the pool is merely un-authenticated: this is the one case the user can actually fix.
 if [ "${#valid[@]}" -eq 0 ]; then
+  [ "$AR_PROBE" = 1 ] && ar_probe_exit none
   if [ "${#expired[@]}" -gt 0 ]; then
     sel_log "all-expired: falling back to the default login (see: claude-accounts expired)"
     # Terminal only: a service-spawned `claude -p` must keep its stderr byte-clean, and
@@ -1611,7 +2010,8 @@ else
         PICK_DIR="$d"; best_reset="$r"
       fi
     done
-    sel_log "all-limited fallback=$(basename "$PICK_DIR") all-exhausted resets_in=$((best_reset > now ? best_reset - now : 0))s"
+    [ "$AR_PROBE" = 1 ] \
+      || sel_log "all-limited fallback=$(basename "$PICK_DIR") all-exhausted resets_in=$((best_reset > now ? best_reset - now : 0))s"
     # Every candidate rejects right now, so this pick WILL fail: say so on a terminal
     # instead of letting the operator read the client's bare limit error as a bad
     # choice by the pool (2026-08-29). Throttled, and never on a service's stderr.
@@ -1632,7 +2032,8 @@ else
   # Report the number this fallback ACTUALLY ranked on. Asking fresh_field here printed
   # `weekly=?%` even when the pick was made on a perfectly good stale reading, so anyone
   # reading only this event concluded the choice had no usage input at all.
-  if [ "${#soft[@]}" -gt 0 ]; then
+  # (A probe picks nothing: its fallback lines would read as picks that never ran.)
+  if [ "${#soft[@]}" -gt 0 ] && [ "$AR_PROBE" != 1 ]; then
     if [ "$degraded" = 1 ]; then
       sel_log "all-limited fallback=$(basename "$PICK_DIR") weekly=$(stale_weekly "$PICK_DIR" || echo '?')% ranking=DEGRADED"
     elif [ "$blind" = 1 ]; then
@@ -1643,6 +2044,9 @@ else
   fi
 fi
 pick="$PICK_DIR"
+# An auto-resume probe ends here: before the token preflight (a real inference), the
+# model pin, remember_pick, the limits kick and the pick line — it chose nothing.
+[ "$AR_PROBE" = 1 ] && ar_probe_exit
 
 # The preflight can prove the selected token dead without exposing its 401 to the
 # caller. Re-enter selection so the new .expired marker is applied and another
@@ -1654,6 +2058,9 @@ if [ -n "$tok" ] && ! token_preflight "$pick" "$tok"; then
   num_ok "$preflight_depth" || preflight_depth=0
   if [ "$preflight_depth" -lt 64 ]; then
     export CLAUDE_MULTIACC_PREFLIGHT_DEPTH=$((preflight_depth + 1))
+    # An auto-resume chain survives the re-entry (see ---- auto-resume ----). '|' is
+    # outside every chain field's charset, so it separates them unambiguously.
+    [ -n "$AR_CHAIN" ] && export CLAUDE_MULTIACC_AR_CARRY="$AR_DEPTH|$AR_AVOID|$AR_HIST|$AR_CHAIN"
     exec "$SELF" "$@"
   fi
 fi
@@ -1793,6 +2200,8 @@ if [ "$wants_retry" = "0" ]; then
   tok="$(acct_token "$pick")"
   [ -n "$tok" ] && export CLAUDE_CODE_OAUTH_TOKEN="$tok"
   sel_capture_session "$pick"
+  ar_trust "$pick"
+  ar_spawn_watcher claude "$pick" || true
   exec "$REAL" "$@"
 fi