claude-multiacc 2.0.42 → 2.0.44

package/README.md

@@ -126,7 +126,7 @@ later.
 **Unusable accounts are excluded, not rotated into.** An account that cannot serve a
 request is dropped from selection before anything else is considered — it is not eligible
 as the all-limited fallback either, because a limit-marked account is *degraded* while
-this one is *down*, and handing work to it guarantees a hard failure. Two kinds:
+this one is *down*, and handing work to it guarantees a hard failure. Reported states include:
 
 - **Dead login** (`EXPIRED`) — refresh token expired, grant revoked, or a real call that
   came back *"OAuth session expired and could not be refreshed"*. Fixed by
@@ -135,6 +135,11 @@ this one is *down*, and handing work to it guarantees a hard failure. Two kinds:
   prove inference works. Before a portable token carries its first real command on a
   machine, the shim privately verifies it. A 401 parks that exact account and reselects,
   so direct, TUI, and `--resume` calls do not expose the rejected token's failure.
+- **Wrong token organization** (`TOKEN INVALID`) — an authenticated API response identifies
+  a different organization from the slot's saved OAuth profile. The shim excludes that
+  portable token, including on retries; a healthy local OAuth login remains usable.
+  Replace it with `claude-accounts login acct-NN --token` and sync. See
+  [token identity checks and recovery](docs/claude-token-identity.md).
 - **Org-blocked** (`BLOCKED`) — the account authenticates fine, but the run comes back
   *"Your organization has disabled Claude subscription access for Claude Code"*. Handled
   like any other dead login (`claude-accounts relogin` re-issues the grant and normally
@@ -274,6 +279,17 @@ account's `.credentials.json` (0600), or its macOS Keychain item.
 > login made over ssh migrates into the Keychain the first time a GUI-session process
 > refreshes its token — the pool reads both places (`lib/keychain.py`), and an account
 > that must work from everywhere should carry a portable token (`claude-accounts mint`).
+> The item's **account name** is the client's `$USER` — and a client started without USER
+> files it under `unknown`, beside the older item, where the next client never looks. So
+> `claude-accounts`/`codex-accounts` and the shim fill `USER`/`LOGNAME` from `id -un` when
+> the caller's env has none, and the pool judges only the item under that canonical name —
+> the one the client reads (one `security` call per lookup). A login found only under
+> another name counts nowhere until the scheduled limits pass moves it under the canonical
+> name. A token refresh writes back under the canonical name and drops the siblings it
+> made stale (the same grant, a dead one) but keeps another live grant; a sign-in whose
+> identity checked out prunes every sibling; `remove` deletes every item.
+> `python3 lib/keychain.py prune <acct dir>` prunes by hand (only when the canonical item
+> is a live login; it never writes).
 > Override: `CLAUDE_MULTIACC_KEYCHAIN=0` disables the lookup. This is what keeps idle accounts' telemetry fresh so they win
 selection over busy accounts; without it, stale telemetry ranks neutral and a truly-idle
 account would lose to a busy-but-fresh one. Refresh failures fail open and back off via

package/bin/claude

@@ -12,6 +12,17 @@
 
 set -u
 
+# Claude Code names its macOS Keychain item after $USER, and under Bun a client with no
+# USER calls the user "unknown" — so a caller whose env lacks it (app-robot's panel
+# ceremony, 2026-09-24) gets a login filed under a name the next client never reads
+# (lib/keychain.py). Every client this shim starts, passthrough included, inherits a
+# real name; lib/common.sh does the same for claude-accounts.
+if [ -z "${USER:-}" ]; then
+  USER="$(id -un 2>/dev/null || true)"
+  if [ -n "$USER" ]; then export USER; else unset USER; fi
+fi
+if [ -z "${LOGNAME:-}" ] && [ -n "${USER:-}" ]; then export LOGNAME="$USER"; fi
+
 # ${HOME:-} guards: with HOME stripped (env -i, some cron/systemd units) the shim
 # must still fail OPEN into plain passthrough, never abort on an unbound variable.
 # CLAUDE_ACCOUNTS_ROOT scopes the pool to one app-robot instance; CLAUDE_ACCOUNTS_DIR
@@ -177,7 +188,8 @@ mcp_nested_mirror() {
 }
 
 # Fast passthrough: caller pinned a config dir or token, addon disabled, recursion
-# guard, or no account data yet. Byte-identical behavior to stock claude.
+# guard, or no account data yet. Byte-identical behavior to stock claude (a USER the
+# caller left out is filled at the top — see there).
 if [ -n "${CLAUDE_CONFIG_DIR:-}" ] || [ -n "${CLAUDE_CODE_OAUTH_TOKEN:-}" ] \
   || [ "${CLAUDE_MULTIACC_DISABLE:-0}" = "1" ] || [ -n "${CLAUDE_SHIM_ACTIVE:-}" ] \
   || [ ! -f "$MANIFEST" ]; then
@@ -216,6 +228,11 @@ case "${CLAUDE_MULTIACC_KEYCHAIN:-}" in
   *) if [ "$(uname -s)" = "Darwin" ]; then KC_ON=1; else KC_ON=0; fi ;;
 esac
 if [ "$KC_ON" = "1" ] && ! command -v security >/dev/null 2>&1; then KC_ON=0; fi
+# The client reads ONLY the item under its own account name — $USER (filled above),
+# anything outside [A-Za-z0-9._-] becoming "claude-code-user" — so that one item is what
+# this shim judges: a sibling under another name is invisible to the client it launches.
+KC_ACCOUNT="${USER:-}"
+case "$KC_ACCOUNT" in ''|*[!A-Za-z0-9._-]*) KC_ACCOUNT=claude-code-user ;; esac
 kc_service() { # $1 = acct dir -> the keychain service name the client uses for it
   local h=""
   if command -v shasum >/dev/null 2>&1; then h="$(printf '%s' "$1" | shasum -a 256 2>/dev/null)"
@@ -230,7 +247,7 @@ kc_lookup() { # $1 = acct dir; sets KC_JSON; rc 0 readable, 1 none, 2 exists but
   [ "$KC_ON" = "1" ] || { KC_JSON=""; return 1; }
   if [ "$KC_MEMO_DIR" = "$1" ]; then return "$KC_MEMO_RC"; fi
   local out rc
-  out="$(security find-generic-password -s "$(kc_service "$1")" -w 2>/dev/null)"; rc=$?
+  out="$(security find-generic-password -a "$KC_ACCOUNT" -s "$(kc_service "$1")" -w 2>/dev/null)"; rc=$?
   KC_MEMO_DIR="$1"; KC_JSON=""; KC_MEMO_RC=1
   case "$rc" in
     0) case "$out" in *claudeAiOauth*) KC_JSON="$out"; KC_MEMO_RC=0 ;; esac ;;
@@ -242,7 +259,7 @@ kc_mtime() { # $1 = acct dir -> epoch of the item's last write (0 when none); at
              # are readable even when the secret is locked, so a marker still self-heals
   [ "$KC_ON" = "1" ] || { echo 0; return 0; }
   local stamp
-  stamp="$(security find-generic-password -s "$(kc_service "$1")" 2>/dev/null \
+  stamp="$(security find-generic-password -a "$KC_ACCOUNT" -s "$(kc_service "$1")" 2>/dev/null \
     | LC_ALL=C sed -n 's/.*"mdat"<timedate>=0x[0-9A-Fa-f]*  *"\([0-9]\{14\}\)Z.*/\1/p' | head -1)"
   case "$stamp" in
     [0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9])
@@ -1629,6 +1646,12 @@ expired_marked() { # $1 = acct dir
 # OAuth credential beside it is dead — the token is exported instead.
 auth_dead() { # $1 = acct dir
   expired_marked "$1" && return 0
+  if [ -s "$1/server.token" ] && { ! has_oauth "$1" || creds_dead "$1"; }; then
+    case ":${CLAUDE_MULTIACC_PREFLIGHT_SKIP:-}:" in *":${1##*/}:"*) return 0 ;; esac
+    if [ -f "$1/.server-token-identity.json" ]; then
+      [ "$(token_identity_state cached "$1")" = mismatch ] && return 0
+    fi
+  fi
   [ -s "$1/server.token" ] && return 1
   creds_dead "$1"
 }
@@ -1641,10 +1664,21 @@ acct_token() { # $1 = acct dir; prints token if the dir must authenticate by tok
   fi
 }
 
-# A setup-token has no identity or readable expiry, and `claude auth status` only
-# checks its shape. Test each token once on this machine with a real inference before
-# allowing it to carry a user's command. This closes the direct/TUI/--resume gap where
-# a revoked token exposed one 401 and was only parked on the following invocation.
+# auth status cannot identify a setup-token, but authenticated API response headers
+# name its organization, even on a quota rejection. Check that binding independently
+# of the old inference proof: a token can answer OK while spending another account.
+token_identity_state() { # $1 check|cached, $2 account dir, $3 exact token for check
+  local helper="$SELF_DIR/../lib/claude_token_identity.py" py="${CLAUDE_MULTIACC_PYTHON:-python3}"
+  [ -r "$helper" ] || return 0
+  if [ "$1" = check ]; then
+    printf '%s' "${3:-}" | "$py" "$helper" check "$2" --token-stdin --real "$REAL" --format state 2>/dev/null
+  else
+    "$py" "$helper" cached "$2" --format state 2>/dev/null
+  fi
+}
+
+# Test authentication independently; organization matching cannot prove a token is
+# still valid. The token and identity receipts are both bound to its exact digest.
 token_digest() { # $1 token; prints a non-secret sha256 digest
   local h=""
   if command -v shasum >/dev/null 2>&1; then
@@ -1655,8 +1689,16 @@ token_digest() { # $1 token; prints a non-secret sha256 digest
   printf '%s' "$h" | cut -d ' ' -f1
 }
 
-token_preflight() { # $1 acct dir, $2 setup-token; rc 1 only for proven invalid auth
+TOKEN_PREFLIGHT_FAILURE=""
+token_preflight() { # $1 acct dir, $2 setup-token; rc 1 only for proven unusable auth
   local d="$1" tok="$2" digest marker tmpd token_auth_pat rc=0
+  TOKEN_PREFLIGHT_FAILURE="invalid portable OAuth token (401)"
+  if [ "$(token_identity_state check "$d" "$tok")" = mismatch ]; then
+    TOKEN_PREFLIGHT_FAILURE="portable setup-token for a different organization; run: "
+    TOKEN_PREFLIGHT_FAILURE="${TOKEN_PREFLIGHT_FAILURE}claude-accounts login ${d##*/} --token"
+    sel_log "${d##*/} skipped (setup-token identity mismatch)"
+    return 1
+  fi
   digest="$(token_digest "$tok")"
   [ -n "$digest" ] || return 0
   marker="$d/.server-token-verified"
@@ -1706,8 +1748,8 @@ if [ -n "${CLAUDE_ACCOUNT:-}" ]; then
     tok="$(acct_token "$d")"
     if [ -n "$tok" ]; then
       if ! token_preflight "$d" "$tok"; then
-        printf 'claude-multiacc: pinned account %s has an invalid portable OAuth token (401)\n' \
-          "$CLAUDE_ACCOUNT" >&2
+        printf 'claude-multiacc: pinned account %s has a %s\n' \
+          "$CLAUDE_ACCOUNT" "$TOKEN_PREFLIGHT_FAILURE" >&2
         exit 1
       fi
       export CLAUDE_CODE_OAUTH_TOKEN="$tok"
@@ -2041,13 +2083,22 @@ if [ -n "$tok" ] && ! token_preflight "$pick" "$tok"; then
   num_ok "$preflight_depth" || preflight_depth=0
   if [ "$preflight_depth" -lt 64 ]; then
     export CLAUDE_MULTIACC_PREFLIGHT_DEPTH=$((preflight_depth + 1))
+    # Persistence can fail on a read-only pool. Exclude this token for the re-entry
+    # anyway, and never fall through into a token the preflight just rejected.
+    preflight_skip="${CLAUDE_MULTIACC_PREFLIGHT_SKIP:+$CLAUDE_MULTIACC_PREFLIGHT_SKIP:}"
+    export CLAUDE_MULTIACC_PREFLIGHT_SKIP="${preflight_skip}${pick##*/}"
     # An auto-resume chain survives the re-entry (see ---- auto-resume ----). '|' is
     # outside every chain field's charset, so it separates them unambiguously.
     [ -n "$AR_CHAIN" ] && export CLAUDE_MULTIACC_AR_CARRY="$AR_DEPTH|$AR_AVOID|$AR_HIST|$AR_CHAIN"
     exec "$SELF" "$@"
   fi
+  printf 'claude-multiacc: portable token preflight retry limit reached\n' >&2
+  exit 1
 fi
-unset CLAUDE_MULTIACC_PREFLIGHT_DEPTH
+unset CLAUDE_MULTIACC_PREFLIGHT_DEPTH CLAUDE_MULTIACC_PREFLIGHT_SKIP
+# Use the exact token that passed preflight. A concurrent mint/sync may replace the
+# file before exec; rereading it here would run an unchecked credential.
+PICK_TOKEN="$tok"
 
 # The picked account may be eligible only because its exhausted bucket belongs to a
 # model this run did not ask for. Handing it the default model anyway would open the
@@ -2148,7 +2199,7 @@ export CLAUDE_SHIM_ACTIVE=1
 # mirrored to every other one (exits inside); anything else falls through to exec.
 if [ "${1:-}" = "mcp" ] || { [ "${1:-}" = "--model" ] && [ "${3:-}" = "mcp" ]; }; then
   export CLAUDE_CONFIG_DIR="$pick"
-  tok="$(acct_token "$pick")"
+  tok="$PICK_TOKEN"
   [ -n "$tok" ] && export CLAUDE_CODE_OAUTH_TOKEN="$tok"
   mcp_mirror_run "$pick" "$@" || true
 fi
@@ -2180,7 +2231,7 @@ fi
 
 if [ "$wants_retry" = "0" ]; then
   export CLAUDE_CONFIG_DIR="$pick"
-  tok="$(acct_token "$pick")"
+  tok="$PICK_TOKEN"
   [ -n "$tok" ] && export CLAUDE_CODE_OAUTH_TOKEN="$tok"
   sel_capture_session "$pick"
   ar_trust "$pick"
@@ -2192,7 +2243,7 @@ fi
 mkdir -p "$ACC_ROOT/tmp" 2>/dev/null || true
 tmpd="$(mktemp -d "$ACC_ROOT/tmp/shim.XXXXXX" 2>/dev/null)" || {
   export CLAUDE_CONFIG_DIR="$pick"
-  tok="$(acct_token "$pick")"
+  tok="$PICK_TOKEN"
   [ -n "$tok" ] && export CLAUDE_CODE_OAUTH_TOKEN="$tok"
   sel_capture_session "$pick"
   exec "$REAL" "$@"
@@ -2204,7 +2255,7 @@ trap 'rm -rf "$tmpd"' EXIT
 # nonzero — a hard failure. Verify now, fall back to plain exec if we cannot.
 if ! : > "$tmpd/out" 2>/dev/null || ! : > "$tmpd/err" 2>/dev/null; then
   export CLAUDE_CONFIG_DIR="$pick"
-  tok="$(acct_token "$pick")"
+  tok="$PICK_TOKEN"
   [ -n "$tok" ] && export CLAUDE_CODE_OAUTH_TOKEN="$tok"
   sel_capture_session "$pick"
   exec "$REAL" "$@"
@@ -2289,6 +2340,7 @@ stream_reported_error() {
 
 attempt=1
 cur="$pick"
+cur_token="$PICK_TOKEN"
 rc=0
 stream_err=0       # the run exited 0 but the stream said otherwise
 rotated=0          # at most one account rotation, exactly as before
@@ -2298,7 +2350,7 @@ while :; do
   # Per ATTEMPT: a stream error seen on an earlier account must never decide the
   # exit status of a later one that failed for its own, real reason.
   stream_err=0
-  tok="$(acct_token "$cur")"
+  tok="$cur_token"
   if [ -n "$stdin_file" ]; then exec 3< "$stdin_file"; else exec 3< /dev/null; fi
   if [ -n "$tok" ]; then
     CLAUDE_CONFIG_DIR="$cur" CLAUDE_CODE_OAUTH_TOKEN="$tok" "$REAL" "${ARGV[@]}" <&3 > "$tmpd/out" 2> "$tmpd/err"
@@ -2374,14 +2426,22 @@ while :; do
     n="${#eligible[@]}"
     start=$((RANDOM % n))
     i=0
-    while [ "$i" -lt "$n" ]; do
+    while [ "$rotated" = 0 ] && [ "$i" -lt "$n" ]; do
       c="${eligible[$(((start + i) % n))]}"
-      if [ "$c" != "$cur" ]; then next="$c"; break; fi
+      if [ "$c" != "$cur" ] && ! auth_dead "$c"; then
+        candidate_token="$(acct_token "$c")"
+        if [ -z "$candidate_token" ] || token_preflight "$c" "$candidate_token"; then
+          next="$c"
+          next_token="$candidate_token"
+          break
+        fi
+      fi
       i=$((i+1))
     done
     if [ -n "$next" ] && [ "$rotated" = 0 ]; then
       sel_log "retry from=$(basename "$cur") to=$(basename "$next") rc=$rc"
       cur="$next"
+      cur_token="$next_token"
       # The account that actually serves the work is the one the next run should rotate
       # away from — not the one that bounced.
       remember_pick "$cur"

package/bin/claude-accounts

@@ -635,7 +635,7 @@ cmd_add() {
     # Portable setup-token variant (works on Mac AND server; needs a recent sign-in).
     echo "Preparing $id for $elabel (portable token) — NOTHING is registered until sign-in completes."
     run_token_ceremony "$d" || die "sign-in failed or aborted — nothing was created${CEREMONY_LAST_WORDS:+ — the client said: $CEREMONY_LAST_WORDS}${CEREMONY_TRANSCRIPT:+ (transcript: $CEREMONY_TRANSCRIPT)}"
-    commit_ceremony_token "$d" "$CEREMONY_TOKEN" "$id"
+    commit_ceremony_token "$d" "$CEREMONY_TOKEN" "$id" captured "$email"
     got="$(token_email "$CEREMONY_TOKEN")"
   else
     # Default: full Claude Code login (full scopes, no long-lived-token step-up).
@@ -678,6 +678,8 @@ cmd_add() {
   mutate_unlock
   RESERVED_DIR=""            # committed — the trap must not delete it now
   trap - EXIT INT TERM
+  # Registered under the identity it read back: leave one Keychain item for the dir.
+  [ "$token" = "1" ] || keychain_prune "$d"
   # Only the full-login path actually READ the identity back. Saying "verified" for a
   # setup token would relaunder the very assumption this flow just warned about.
   local verdict="sign-in verified"
@@ -747,6 +749,12 @@ cmd_import() {
   fi
   local d="$ACC_ROOT/$id"
   seed_account_dir "$d"
+  if [ -n "$tok" ]; then
+    ceremony_token_identity "$d" "$tok" "$email"
+    if [ "$CEREMONY_IDENTITY_STATE" = "mismatch" ]; then
+      die "the token's organization does not match $id — nothing imported; mint a token for the named account"
+    fi
+  fi
   if [ -n "$creds" ]; then
     case "$mode" in
       copy) cp "$creds" "$d/.credentials.json" ;;
@@ -784,9 +792,10 @@ def has_auth(aid):
     if (os.path.isfile(c) and os.path.getsize(c) > 0) or (os.path.isfile(t) and os.path.getsize(t) > 0):
         return True
     # A login the client moved into the macOS Keychain still counts — deduping must
-    # not throw away the one duplicate that actually holds the grant.
+    # not throw away the one duplicate that actually holds the grant, even one filed
+    # under a name its client no longer reads (the limits pass moves those back).
     try:
-        return keychain.probe(d)['state'] in ('present', 'locked', 'corrupt')
+        return keychain.probe(d, legacy=True)['state'] in ('present', 'locked', 'corrupt')
     except Exception:
         return False
 by_email = {}
@@ -1030,11 +1039,27 @@ ceremony_token_check() { # $1 = token
   esac
 }
 
-# The ONE place a ceremony's token is written: only after ceremony_token_check, so a
-# token Claude rejects is never saved, uploaded, or distributed. $1 = acct dir,
+# A candidate must not replace the current token's identity receipt until it is saved.
+CEREMONY_IDENTITY_STATE="unknown"
+ceremony_token_identity() { # $1 = account dir, $2 = candidate token, $3 = optional named email
+  local d="$1" tok="$2" email="${3:-}" real
+  real="$(find_real_claude "$_self")" || real=""
+  set -- check "$d" --token-stdin --real "$real" --format state --no-store
+  [ -z "$email" ] || set -- "$@" --expected-email "$email"
+  CEREMONY_IDENTITY_STATE="$(printf '%s' "$tok" \
+    | "$PYBIN" "$LIB_DIR/claude_token_identity.py" "$@" 2>/dev/null)"
+  [ -n "$CEREMONY_IDENTITY_STATE" ] || CEREMONY_IDENTITY_STATE="unknown"
+}
+
+# The ONE place a ceremony's token is written: only after organization and auth checks,
+# so a known wrong-organization or rejected token is never saved or distributed. $1 = acct dir,
 # $2 = token, $3 = acct id (messages only).
 commit_ceremony_token() {
   local d="$1" tok="$2" id="$3" src="${4:-captured}" rc=0
+  ceremony_token_identity "$d" "$tok" "${5:-}"
+  if [ "$CEREMONY_IDENTITY_STATE" = "mismatch" ]; then
+    die "the token's organization does not match $id — nothing saved; sign in as the named account and mint again"
+  fi
   ceremony_token_check "$tok" || rc=$?
   # A short token is an incomplete one unless Claude itself has just answered with it:
   # the length alone convicts it, so an inconclusive probe (429, network) must not let
@@ -1052,6 +1077,7 @@ commit_ceremony_token() {
   fi
   ( umask 077; printf '%s' "$tok" > "$d/server.token" )
   chmod 600 "$d/server.token"
+  [ "$CEREMONY_IDENTITY_STATE" != "match" ] || echo "Token organization matches the account's saved OAuth profile."
   if [ "$rc" -eq 0 ]; then
     record_token_verified "$d" "$tok"
     echo "Token verified by a real inference."
@@ -1228,10 +1254,9 @@ TIP
 
 cmd_mint() {
   # The minted token is the ONLY credential that reaches the server and every peer, so a
-  # mint under the wrong browser session hands this slot another account's subscription —
-  # and nothing downstream can notice (a setup token reports no identity, see
-  # token_email). Naming the expected account before the ceremony opens is the only guard
-  # that exists; the old prompt said "THIS account" and named nobody.
+  # mint under the wrong browser session can hand this slot another subscription. Name the
+  # expected account before the ceremony and verify the token's response organization
+  # against its saved OAuth profile before accepting it. The token cannot report an email.
   require_manifest
   local id="" paste=0
   while [ $# -gt 0 ]; do
@@ -1276,7 +1301,9 @@ cmd_mint() {
   clear_auth_markers "$d"
   log_to ops.log "mint $id"
   echo "Token saved to $d/server.token"
-  [ -n "$got" ] || warn "a setup token carries no identity — $id now runs whichever account approved that grant${email:+, trusted to be $email}"
+  if [ -z "$got" ] && [ "$CEREMONY_IDENTITY_STATE" != "match" ]; then
+    warn "the token's organization could not be checked — $id is trusted to hold ${email:-the named account}"
+  fi
   auto_sync
 }
 
@@ -1311,7 +1338,9 @@ cmd_login() {
     fi
     commit_ceremony_token "$d" "$CEREMONY_TOKEN" "$id"
     clear_auth_markers "$d"
-    [ -n "$got" ] || warn "a setup token carries no identity — $id is trusted to hold $email because that is who you approved as"
+    if [ -z "$got" ] && [ "$CEREMONY_IDENTITY_STATE" != "match" ]; then
+      warn "the token's organization could not be checked — $id is trusted to hold $email as requested"
+    fi
     echo "$id token saved (portable — works on Mac and server)."
   else
     run_login_ceremony "$d" "$email" \
@@ -1323,6 +1352,9 @@ cmd_login() {
     if [ -z "$got" ] && [ "$force" != "1" ]; then
       die "signed in, but the account identity could not be read back — refusing to call $id fixed (retry, or pass --force)"
     fi
+    # Only now, with the identity confirmed, may the stale Keychain items go: a sign-in
+    # as the wrong account (died above) must leave every item as it was.
+    keychain_prune "$d"
     clear_auth_markers "$d" keep-token-park
     if [ -s "$d/.credentials.json" ]; then
       echo "$id login saved (.credentials.json, this machine, auto-refreshing)."
@@ -1540,6 +1572,26 @@ os.execv(sys.argv[1], [sys.argv[1], "limits-distribute-now"])
   return 0
 }
 
+token_identities_check() {
+  # A source may always use Keychain OAuth locally while its peers use setup tokens.
+  # Prove those tokens before distributing telemetry, even if nobody launched them here.
+  local id d real
+  real="$(find_real_claude "$_self")" || real=""
+  for id in $(account_ids); do
+    d="$ACC_ROOT/$id"
+    [ -s "$d/server.token" ] || continue
+    "$PYBIN" "$LIB_DIR/claude_token_identity.py" check "$d" --real "$real" >/dev/null 2>&1 || true
+  done
+}
+
+token_identity_receipt() { # Unknown results must never overwrite a peer's proven mismatch.
+  local verdict
+  [ -f "$1/.server-token-identity.json" ] || return 1
+  verdict="$("$PYBIN" "$LIB_DIR/claude_token_identity.py" cached "$1" 2>/dev/null)"
+  printf '%s' "$verdict" | grep -q '"cached": true' || return 1
+  printf '%s' "$verdict" | grep -qE '"state": "(match|mismatch)"'
+}
+
 limits_distribute_now() {
   local lock="$ACC_ROOT/tmp/limits-push.lock"
   mkdir -p "$ACC_ROOT/tmp" 2>/dev/null || return 0
@@ -1564,6 +1616,7 @@ limits_distribute_now() {
   list="$ACC_ROOT/tmp/limits-push.$$"
   mkdir -p "$ACC_ROOT/tmp" 2>/dev/null || return 0
   : > "$list" 2>/dev/null || return 0
+  token_identities_check
   for id in $(account_ids); do
     d="$ACC_ROOT/$id"
     [ -f "$d/limits.json" ] && printf '%s/limits.json\n' "$id" >> "$list"
@@ -1571,6 +1624,7 @@ limits_distribute_now() {
     # .limited on its own, so a stale one costs an account some eligibility and
     # never grants any. Erring toward exclusion is the safe direction here.
     [ -f "$d/.limited" ] && printf '%s/.limited\n' "$id" >> "$list"
+    token_identity_receipt "$d" && printf '%s/.server-token-identity.json\n' "$id" >> "$list"
   done
   # The MCP registry rides along: a server the shim mirrored from a stock `claude mcp
   # add` reaches every peer within one limits cadence, with no explicit sync. The
@@ -1859,36 +1913,49 @@ class FileStore:
 
 class KeychainStore:
     """The same credential, held in the macOS Keychain by the client itself (see
-    lib/keychain.py). Read and written in place — NEVER copied out to a file: a file
-    beside a Keychain item is a second copy of a ROTATING refresh grant, and the
-    client reads the Keychain first, so the two would drift apart and strand one."""
+    lib/keychain.py). Read from the item the client reads (the canonical name; this
+    pass alone also accepts the legacy first match, which oauth_store moves) and written
+    back under the canonical name, which also drops the siblings holding the grant the
+    refresh started from — NEVER copied out to a file: a file beside a Keychain item is
+    a second copy of a ROTATING refresh grant, and the client reads the Keychain first,
+    so the two would drift apart and strand one."""
     kind = 'keychain'
 
     def __init__(self, d, probe):
         self.d = d
-        self.account = probe.get('account')
+        self.grant = None
+        self.moved = False
 
     def read(self):
-        p = keychain.probe(self.d)
+        p = keychain.probe(self.d, legacy=True)
         if p['state'] != 'present':
             raise ValueError(f'keychain credential {p["state"]}')
+        grant = p['doc']['claudeAiOauth'].get('refreshToken')
+        self.grant = grant if isinstance(grant, str) else None
         return p['doc']
 
     def write(self, doc):
-        if not keychain.write(self.d, doc, account=self.account):
+        if not keychain.write(self.d, doc, supersedes=self.grant):
             raise OSError('keychain write refused')
 
 
 def oauth_store(d):
     """Where <d>'s OAuth login lives for THIS process: a FileStore, a KeychainStore,
     the string 'locked' (Keychain item exists but this session cannot open it), or
-    None. The file wins when both exist — same rule as lib/audit.oauth_login."""
+    None. The file wins when both exist — same rule as lib/audit.oauth_login.
+
+    A Keychain login found only under a name its client no longer reads (a USER-less
+    sign-in's "unknown", lib/keychain.py) is moved under the canonical name here, once:
+    until then the client, the shim and the audit all see no login."""
     cpath = os.path.join(d, '.credentials.json')
     if os.path.isfile(cpath):
         return FileStore(cpath)
-    p = keychain.probe(d)
+    p = keychain.probe(d, legacy=True)
     if p['state'] == 'present':
-        return KeychainStore(d, p)
+        store = KeychainStore(d, p)
+        if p['account'] != p['canonical']:
+            store.moved = keychain.write(d, p['doc'])
+        return store
     if p['state'] == 'locked':
         return 'locked'
     return None
@@ -2096,6 +2163,9 @@ for acct in manifest.get('accounts', []):
     except Exception as e:
         say(f'{aid}: could not locate the oauth credential ({str(e)[:120]}); failing open')
         store = None
+    if getattr(store, 'moved', False):
+        say(f'{aid}: Keychain login moved under {keychain.canonical_account()}, '
+            f'the name its client reads')
     locked = store == 'locked'
     if locked:
         store = None
@@ -2720,6 +2790,8 @@ root, quick, real = sys.argv[1], sys.argv[2] == '1', sys.argv[3]
 sys.path = [sys.argv[4]] + [p for p in sys.path if p not in ('', '.')]
 from audit import audit_account, creds_state, creds_doc_state   # noqa: E402  (shared with the shim's rule)
 import keychain  # noqa: E402
+from claude_token_identity import check_identity  # noqa: E402
+from claude_reset import cli_version  # noqa: E402
 machine = sys.argv[5]
 now = time.time()
 manifest = json.load(open(os.path.join(root, 'accounts.json')))
@@ -2784,6 +2856,9 @@ for acct in manifest.get('accounts', []):
         # The login may be in the macOS Keychain (lib/keychain.py). A Keychain this
         # session cannot open is not a failure of the ACCOUNT: the real call below
         # would fail for the session, not the grant, so it is a skip with a reason.
+        # Only the canonical item counts — the one the client below reads; testing an
+        # item under another name would run the client on a login it cannot see and
+        # park an account its token serves.
         kc = keychain.probe(d)
         if kc['state'] == 'present':
             has_creds, cred_doc = True, kc['doc']
@@ -2837,6 +2912,15 @@ for acct in manifest.get('accounts', []):
         env['CLAUDE_CODE_OAUTH_TOKEN'] = open(tpath).read().strip()
     t0 = time.time()
     uses_token = 'CLAUDE_CODE_OAUTH_TOKEN' in env
+    identity = {'state': 'unknown'}
+    if has_token:
+        portable = env['CLAUDE_CODE_OAUTH_TOKEN'] if uses_token else open(tpath).read().strip()
+        identity = check_identity(d, portable, version=cli_version(real))
+        if uses_token and identity['state'] == 'mismatch':
+            print(f'{aid} {acct["email"]}: FAIL (portable setup-token belongs to a different '
+                  f'organization — run: claude-accounts login {aid} --token)')
+            failures += 1
+            continue
     try:
         r = subprocess.run([real, '-p', '--output-format', 'text', '--max-turns', '1'],
                            env=env, capture_output=True, text=True, timeout=240,
@@ -2864,7 +2948,7 @@ for acct in manifest.get('accounts', []):
                 pass
         if uses_token:
             try:
-                digest = hashlib.sha256(open(tpath, 'rb').read().strip()).hexdigest()
+                digest = hashlib.sha256(env['CLAUDE_CODE_OAUTH_TOKEN'].encode()).hexdigest()
                 temp = os.path.join(d, '.server-token-verified.tmp')
                 with open(temp, 'w') as f:
                     f.write(digest + '\n')
@@ -2873,6 +2957,9 @@ for acct in manifest.get('accounts', []):
             except OSError:
                 pass
         print(f'{aid} {acct["email"]}: PASS ({dt:.1f}s) -> {out[:60]!r}')
+        if not uses_token and identity['state'] == 'mismatch':
+            print(f'  portable setup-token belongs to a different organization; OAuth login passed; '
+                  f'replace the token with: claude-accounts login {aid} --token')
     else:
         raw = (r.stderr or '').strip()
         err = raw[:200]
@@ -2960,7 +3047,8 @@ sync_push_target() {
     done
     # Advisory limit state for accounts the target may lack a bearer for.
     local extra
-    for extra in limits.json .limited; do
+    for extra in limits.json .limited .server-token-identity.json; do
+      if [ "$extra" = .server-token-identity.json ]; then token_identity_receipt "$d" || continue; fi
       if [ -f "$d/$extra" ]; then
         rsync -az "$d/$extra" "$server:$sroot/$id/" >>"$ACC_ROOT/sync.log" 2>&1 || true
       fi
@@ -3053,6 +3141,7 @@ cmd_sync() {
     sync_is_replica && role="replica"
     log_to sync.log "sync (local-only, role=$role): no server target${no_server:+ (--no-server)}"
     local_pool_fixup
+    [ "$role" != source ] || token_identities_check
     if [ "$role" = "replica" ]; then
       echo "sync ok (local-only, and this pool is a sync replica — nothing pushed either way)"
     else
@@ -3102,6 +3191,7 @@ EOF
     fail "manifest has zero accounts — refusing to blank the target pools (use 'sync --allow-empty' if that is really intended)"
   fi
 
+  token_identities_check
   sync_push_target "$server" "$sroot" "$srepo"
   local npeers=0
   if [ -n "$peers" ]; then

package/docs/ACCOUNT_OPERATIONS.md

@@ -73,6 +73,11 @@ auto-refreshing login — `.credentials.json`, or on macOS the login Keychain wh
 the session can open it (Claude Code migrates the file into the Keychain on the first
 refresh from a keychain-capable session; ssh sessions then see the account as
 `KEYCHAIN LOCKED` and cannot run it, while the Mac's own session uses it normally).
+The Keychain item is named after `$USER`; the CLI fills it from `id -un` when the caller's
+env has none (a USER-less client files its login under `unknown`, where the next client
+never reads it). The pool judges only the item under that name, as the client does; a
+login found only under another name is moved there by the next limits pass, and a
+sign-in whose identity matched leaves exactly one item, under that name.
 That credential is **machine-local** (never synced),
 which is what keeps two machines from invalidating each other's refresh token — so an
 account you `add` on the Mac runs on the Mac, and you `add` it on the server (over SSH) if