claude-multiacc 2.0.42 → 2.0.44

package/docs/claude-token-identity.md

@@ -0,0 +1,147 @@
+# Claude setup-token identity and telemetry
+
+A pool slot's telemetry and its execution credential must describe the same
+organization. Otherwise the selector can correctly rank an empty account and launch
+Claude against another account's exhausted subscription.
+
+## Session 23: the confirmed cause
+
+The September 2026 investigation compared the actual `server.token` credentials with
+their slots' saved OAuth profiles. Authenticated responses identified acct-14's token
+as belonging to acct-18's organization, and acct-13's token as belonging to acct-15's
+organization. The complete pool audit also found acct-19's token belonged to acct-16's
+organization. Anthropic returned `anthropic-organization-id` even on HTTP 429, allowing
+the comparison without exposing tokens or relying on an inference succeeding.
+
+The scheduled OAuth usage response really reported 0% for acct-13 and acct-14. The
+native CLI instead reported 94% weekly usage for acct-13's portable token and a weekly
+rejection for acct-14's. Those measurements described different organizations. Changing
+the weekly band, treating every zero as unknown, or overwriting OAuth usage with the
+token's usage would hide the credential mismatch and could exclude healthy accounts.
+
+The existing `.server-token-verified` file only proved that the exact token had once
+completed an inference. It could therefore bless a working token from the wrong
+organization indefinitely. A successful response of `OK` is still useful evidence of
+authentication; it is not evidence that a token belongs to the configured slot.
+
+## The identity check
+
+`lib/claude_token_identity.py` sends a small inference request and compares its
+`anthropic-organization-id` response header with
+`<account>/.claude.json` → `oauthAccount.organizationUuid`. This uses no usage GET and
+does not change the telemetry polling cadence. Response bodies and credentials are
+never written into the receipt or diagnostic output. Redirects are refused.
+
+The independent `<account>/.server-token-identity.json` receipt records the exact
+token digest, expected and observed organizations, account id, manifest email, verdict,
+and check time. A match or mismatch remains reusable only while those bindings agree.
+Replacing a token or changing its configured identity requires a new check. Updating
+the same token's timestamp, refreshing OAuth, redeeming a limit reset, or clearing
+ordinary auth/limit markers cannot invalidate a proven mismatch.
+
+The shim checks identity before accepting the old `.server-token-verified` shortcut,
+including retry candidates, and executes the exact token it checked. Concurrent checks
+share an account lock so a delayed inconclusive result cannot replace proven identity.
+A cached mismatch removes a candidate when execution would use its portable token;
+healthy local OAuth may still use that slot. Explicit account pins also reject a known
+wrong-organization token. Full `claude-accounts verify` performs the identity check,
+and token ceremonies and imports reject a known mismatch before saving a candidate.
+An inconclusive candidate check must not overwrite the current token's receipt.
+
+Source sync and telemetry distribution check every portable token, even when local
+OAuth works. Full verification likewise checks both credentials and reports them
+separately. Sync distributes only current, confirmed identity receipts alongside the
+token and telemetry; uncertainty cannot overwrite a peer's proven mismatch. A replica
+without a saved OAuth profile can use the receipt's expected organization only when
+its token digest and manifest binding still match. A changed local OAuth profile takes
+precedence and invalidates an outdated receipt; an unrelated receipt cannot establish
+the expectation for a newly created slot.
+
+## Recovery
+
+Replace the misfiled token by running the supported ceremony on the source machine:
+
+```bash
+claude-accounts login acct-NN --token
+claude-accounts verify
+claude-accounts sync
+```
+
+Approve the ceremony in a browser signed into the named account. A different token
+invalidates the previous receipt and is checked against the saved expected organization.
+Do not clear a mismatch by deleting markers or touching `server.token`: neither repairs
+the credential. A valid local OAuth login can keep that machine's slot usable while its
+portable token is replaced. Peers that depend on the bad token remain excluded.
+
+The plugin does not automatically reassign a token to a different slot. The observed
+organization does not prove which human account minted it, and moving credentials
+could silently change the intended account mapping.
+
+## What the check proves
+
+The response header proves organization, not email, user identity, subscription seat,
+remaining quota, or continuing authentication. Users sharing an organization cannot
+be distinguished by this header. Keep the normal authentication preflight and quota
+selection policy independent.
+
+Setup tokens lack `user:profile`; `claude auth status` therefore reports no email for
+them. An empty token email must not make the supported `add <email> --token` path require
+`--force`, and the test CLI must not invent an email for token authentication. Name the
+expected account before every ceremony.
+
+No expected organization, a missing/malformed header, or a network failure produces an
+inconclusive result. Execution retains its existing fallback behavior rather than
+parking an account on uncertainty; inconclusive network checks back off for one minute.
+Consequently the guard prevents a proved organization mismatch. It cannot promise
+identity verification where Anthropic or the local account profile supplies no evidence.
+
+## Telemetry rules that remain necessary
+
+Portable setup tokens can run inference but cannot call the usage endpoint. A polling
+source needs working OAuth logins; token-only peers receive `limits.json` through sync.
+Use `claude-accounts status` to find `RANKING IS BLIND` or `<< STALE`, and repair source
+OAuth with `claude-accounts login acct-NN` without `--token`. The usage endpoint has
+returned an approximately hourly budget with `Retry-After: 3600`; retrying its permanent
+scope rejection more frequently creates rate limits rather than telemetry.
+
+Earlier fixes addressed separate missing-data and marker-recovery cases. They must
+remain intact after adding identity validation:
+
+- A weekly 0% bucket without a reset carries no informative weekly answer. Aggregate
+  only informative buckets, separately for each signal. Ignore an empty model bucket
+  beside informative ones; retain a measured zero with a real reset.
+- If the entire payload is uninformative, write `no_data: true` without percentage
+  fields. Ranking and BLIND detection require both weekly and session signals; a recent
+  timestamp alone must not hide missing data.
+- An otherwise informative payload may have no open five-hour window. Both writers
+  synthesize session 0% with `session_inferred: true` so idle accounts can rank. This
+  exception never invents weekly usage or turns a wholly empty payload into data.
+- An inferred session zero cannot clear a client five-hour rejection. Only a measured
+  low reading of that window can recover it before its reset. Never substitute the
+  weekly `max_percent`. Claude must enforce this in both shim and writer; Codex's
+  telemetry recovery exists only in its writer.
+- A client weekly rejection survives later telemetry until its reset, except when the
+  reset protocol confirms an applicable redemption. Marker names must preserve the
+  provider's actual window: Claude `client:seven_day`; Codex `client:7d` or `client:5h`
+  according to rollout window minutes.
+
+The earlier observations of zero OAuth usage alongside client rejections did not
+establish that both credentials belonged to the same organization. Session 23 supplies
+direct evidence of that missing assumption. Identity validation addresses it without
+weakening the conservative recovery rules or changing the 50% session gate and
+30-point weekly peer band.
+
+## Verification boundaries
+
+Regression coverage must exercise the shim and account commands, not just compare
+helper return values. Include old auth proofs, explicit pins, fallback selection,
+unchanged token timestamps, replacement tokens, healthy OAuth beside a bad token,
+receipt persistence through telemetry/reset cleanup, missing headers, and replica
+bindings. Full verification must fail a wrong-organization token even if a fake native
+CLI would answer `OK`.
+
+Real checks should compare the exact token's response organization with its configured
+slot, then launch an independently selected account through the updated shim. Use
+minimal prompts with tools disabled and keep tokens and raw account identifiers out
+of task logs. Passing those checks establishes the tested behavior; it does not remove
+the inconclusive and shared-organization limitations described above.

package/lib/audit.py

@@ -39,6 +39,7 @@ import time
 # helper sits beside it either way.
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 import keychain  # noqa: E402
+from claude_token_identity import cached_identity  # noqa: E402
 
 VALID_ID = re.compile(r'acct-\d{2}')
 
@@ -249,6 +250,8 @@ def _fix_for(state, aid):
 
 def _token_verified(d, tpath):
     """Whether this exact setup-token passed an inference on this machine."""
+    if cached_identity(d)['state'] == 'mismatch':
+        return False
     try:
         digest = hashlib.sha256(open(tpath, 'rb').read().strip()).hexdigest()
         saved = open(os.path.join(d, '.server-token-verified')).read().strip()
@@ -305,6 +308,13 @@ def audit_account(root, acct, now=None, machine=None, require_verified_token=Fal
         return done(row)
     login = oauth_login(d, now)
     row['store'] = login['store']
+    if has_token and cached_identity(d)['state'] == 'mismatch':
+        if login['state'] != 'ok':
+            row['state'] = 'token-invalid'
+            row['reason'] = 'portable setup-token belongs to a different organization'
+            return done(row)
+        row['reason'] = f"{login['reason']}; portable setup-token identity mismatch, using the local login"
+        return done(row)
     if login['state'] in ('ok', 'expired'):
         state, reason = login['state'], login['reason']
         if state == 'ok' or has_token:

package/lib/claude_token_identity.py

@@ -0,0 +1,233 @@
+#!/usr/bin/env python3
+"""Bind a portable Claude token to its slot using authenticated response headers.
+
+An inference may be quota-rejected and still identify the token's organization.
+This receipt proves organization identity only, never remaining quota or token validity.
+No credentials or response bodies are written to the receipt or diagnostic output.
+"""
+
+from __future__ import annotations
+
+import argparse
+import fcntl
+import hashlib
+import json
+import os
+from pathlib import Path
+import sys
+import tempfile
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+import uuid
+
+from claude_reset import cli_version, user_agent
+
+RECEIPT = ".server-token-identity.json"
+LOCK_FILE = ".server-token-identity.lock"
+ENDPOINT = "https://api.anthropic.com/v1/messages?beta=true"
+MODEL = "claude-haiku-4-5-20251001"
+UNKNOWN_BACKOFF = 60
+TIMEOUT = 10
+
+
+class NoRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        return None
+
+
+def _org(value):
+    try:
+        return str(uuid.UUID(value)) if isinstance(value, str) else ""
+    except ValueError:
+        return ""
+
+
+def _load(path):
+    try:
+        with path.open(encoding="utf-8") as handle:
+            value = json.load(handle)
+        return value if isinstance(value, dict) else {}
+    except (OSError, ValueError):
+        return {}
+
+
+def _context(account_dir, token, now, expected_email=None):
+    account = Path(account_dir)
+    result = {"status": "unknown", "reason": "token_unavailable", "checked_at": now}
+    try:
+        if token is None:
+            with (account / "server.token").open(encoding="utf-8") as handle:
+                token = handle.read(4097)
+        token = token.strip()
+    except (OSError, ValueError, AttributeError):
+        return result, ""
+    if not token.startswith("sk-ant-oat") or len(token) > 4096 or not all(33 <= ord(c) <= 126 for c in token):
+        return dict(result, reason="invalid_token"), ""
+    digest = hashlib.sha256(token.encode()).hexdigest()
+    config = _load(account / ".claude.json")
+    profile = config.get("oauthAccount")
+    profile = profile if isinstance(profile, dict) else {}
+    rows = _load(account.parent / "accounts.json").get("accounts", [])
+    rows = rows if isinstance(rows, list) else []
+    row = next((r for r in rows if isinstance(r, dict) and r.get("id") == account.name), {})
+    email = str(row.get("email") or "").strip().lower()
+    profile_email = str(profile.get("emailAddress") or profile.get("email") or "").strip().lower()
+    result.update(token_digest=digest, account_id=account.name, account_email=email, manifest_bound=bool(row))
+    if expected_email is not None and not (profile_email or email):
+        return dict(result, reason="missing_profile_email"), ""
+    if ((email and profile_email and email != profile_email)
+            or (expected_email is not None and str(expected_email).strip().lower() != (profile_email or email))):
+        return dict(result, status="mismatch", reason="profile_manifest_mismatch"), ""
+    receipt = _load(account / RECEIPT)
+    bound = all(receipt.get(key) == result[key] for key in
+                ("token_digest", "account_id", "account_email", "manifest_bound"))
+    expected = _org(profile.get("organizationUuid"))
+    if not expected and "oauthAccount" not in config and bound and row:
+        expected = _org(receipt.get("expected_org"))
+    if not expected:
+        return dict(result, reason="missing_expected_organization"), ""
+    result.update(expected_org=expected, reason="unchecked")
+    actual, status = _org(receipt.get("actual_org")), receipt.get("status")
+    checked = receipt.get("checked_at")
+    reusable = ((status == "match" and actual == expected)
+                or (status == "mismatch" and actual and actual != expected)
+                or (status == "unknown" and isinstance(checked, (int, float))
+                    and 0 <= now - checked < UNKNOWN_BACKOFF))
+    if bound and receipt.get("expected_org") == expected and reusable:
+        return dict(receipt, cached=True), ""
+    return result, token
+
+
+def _probe(token, endpoint, model, version):
+    try:
+        url = urllib.parse.urlsplit(endpoint)
+    except ValueError:
+        return {"status": "unknown", "actual_org": "", "reason": "invalid_endpoint"}
+    official = url.scheme == "https" and url.netloc == "api.anthropic.com"
+    local = url.scheme == "http" and url.hostname in {"127.0.0.1", "::1", "localhost"}
+    if not (official or local) or url.username or url.password or url.fragment:
+        return {"status": "unknown", "actual_org": "", "reason": "invalid_endpoint"}
+    betas = ["oauth-2025-04-20", "prompt-caching-scope-2026-01-05"]
+    if "haiku" not in model.lower():
+        betas.append("claude-code-20250219")
+    body = {"model": model, "max_tokens": 1, "messages": [{"role": "user", "content": "quota"}]}
+    request = urllib.request.Request(endpoint, data=json.dumps(body).encode(), headers={
+        "Authorization": f"Bearer {token}", "anthropic-version": "2023-06-01",
+        "anthropic-beta": ",".join(betas), "Content-Type": "application/json",
+        "User-Agent": user_agent(version), "x-app": "cli"})
+    opener = urllib.request.build_opener(NoRedirect())
+    try:
+        try:
+            response = opener.open(request, timeout=TIMEOUT)
+        except urllib.error.HTTPError as error:
+            response = error
+        with response:
+            code = response.code
+            values = response.headers.get_all("anthropic-organization-id", [])
+            actual = _org(values[0]) if len(values) == 1 else ""
+        if 300 <= code < 400:
+            return {"status": "unknown", "actual_org": "", "reason": "redirect"}
+        reason = "organization_header" if actual else "missing_organization"
+        if not actual and code in {401, 403}:
+            reason = "auth_failed"
+        return {"actual_org": actual, "http_status": code, "reason": reason}
+    except (OSError, ValueError, urllib.error.URLError):
+        return {"status": "unknown", "actual_org": "", "reason": "request_failed"}
+
+
+def _save(account, receipt):
+    path = None
+    try:
+        fd, path = tempfile.mkstemp(prefix=RECEIPT + ".", dir=account)
+        with os.fdopen(fd, "w", encoding="utf-8") as handle:
+            json.dump(receipt, handle, sort_keys=True)
+            handle.write("\n")
+        os.replace(path, account / RECEIPT)
+    except OSError:
+        pass
+    finally:
+        try:
+            if path:
+                os.unlink(path)
+        except OSError:
+            pass
+
+
+def _result(receipt):
+    result = {"state": receipt.get("status", "unknown"), "cached": receipt.get("cached", False),
+              "token_digest": receipt.get("token_digest", ""), "reason": receipt.get("reason", "unchecked")}
+    if "http_status" in receipt:
+        result["http_status"] = receipt["http_status"]
+    return result
+
+
+def cached_identity(account_dir, token=None, *, now=None):
+    """Return identity already proved for this token and slot, without HTTP."""
+    receipt, _ = _context(account_dir, token, time.time() if now is None else now)
+    return _result(receipt)
+
+
+def check_identity(account_dir, token=None, *, endpoint=None, model=None, version=None, now=None,
+                   persist=True, expected_email=None):
+    """Check this exact token, or only the requested account's server.token file.
+
+    Match/mismatch receipts survive indefinitely because a token cannot change its
+    organization. Changing either the token or configured organization invalidates
+    them; an inconclusive request backs off for one minute. Authentication preflight
+    remains independent, including for an identity-matched but later revoked token.
+    A persistent lock prevents a delayed unknown result from replacing proof written
+    by another launch. Read-only callers still receive independently proved mismatches.
+    """
+    lock = None
+    try:
+        lock = os.fdopen(os.open(Path(account_dir) / LOCK_FILE, os.O_CREAT | os.O_RDWR, 0o600), "w")
+        fcntl.flock(lock, fcntl.LOCK_EX)
+    except OSError:
+        if lock:
+            lock.close()
+        lock = None
+    try:
+        receipt, token = _context(account_dir, token, time.time() if now is None else now, expected_email)
+        if not token:
+            return _result(receipt)
+        endpoint = endpoint or os.environ.get("CLAUDE_MULTIACC_TOKEN_IDENTITY_URL") or ENDPOINT
+        receipt.update(_probe(token, endpoint, model or MODEL, version))
+        actual = receipt["actual_org"]
+        receipt["status"] = ("match" if actual == receipt["expected_org"] else "mismatch") if actual else "unknown"
+        if not lock and not actual:
+            current, _ = _context(account_dir, token, time.time() if now is None else now, expected_email)
+            if current["status"] in {"match", "mismatch"}:
+                return _result(current)
+        if persist and lock:
+            _save(Path(account_dir), receipt)
+        return _result(receipt)
+    finally:
+        if lock:
+            lock.close()
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("command", choices=["check", "cached"])
+    parser.add_argument("account_dir")
+    parser.add_argument("--token-stdin", action="store_true", help="use the exact token read from stdin")
+    parser.add_argument("--real", help="installed Claude executable, used only to learn its version")
+    parser.add_argument("--model", default=MODEL)
+    parser.add_argument("--format", choices=["json", "state"], default="json")
+    parser.add_argument("--no-store", action="store_true", help="check a candidate without replacing the receipt")
+    parser.add_argument("--expected-email", help="named account email for a candidate not yet in the manifest")
+    args = parser.parse_args()
+    token = sys.stdin.read(4097) if args.token_stdin else None
+    if args.command == "cached":
+        result = cached_identity(args.account_dir, token)
+    else:
+        result = check_identity(args.account_dir, token, model=args.model,
+                                version=cli_version(args.real), persist=not args.no_store,
+                                expected_email=args.expected_email)
+    print(result["state"] if args.format == "state" else json.dumps(result, sort_keys=True))
+
+
+if __name__ == "__main__":
+    main()

package/lib/common.sh

@@ -12,6 +12,19 @@
 # shellcheck disable=SC2034
 
 MULTIACC_PROVIDER="${MULTIACC_PROVIDER:-claude}"
+
+# Claude Code names its macOS Keychain item after $USER, and under Bun a client with no
+# USER calls the user "unknown": `claude-accounts login` run from an env without it
+# (app-robot's panel, 2026-09-24) filed the fresh login beside the old item, under a
+# name the next client never reads (lib/keychain.py). So every client these CLIs start
+# inherits a real name, whatever env the caller passed; bin/claude does the same.
+# Harmless for codex and on Linux.
+if [ -z "${USER:-}" ]; then
+  USER="$(id -un 2>/dev/null || true)"
+  if [ -n "$USER" ]; then export USER; else unset USER; fi
+fi
+if [ -z "${LOGNAME:-}" ] && [ -n "${USER:-}" ]; then export LOGNAME="$USER"; fi
+
 PYBIN="${CLAUDE_MULTIACC_PYTHON:-python3}"
 DEFAULT_SERVER="root@138.197.36.107"
 DEFAULT_SERVER_REPO="/root/claude-multiacc"
@@ -428,7 +441,9 @@ EOF
   fi
   local d="$ACC_ROOT/$target_id"
   seed_account_dir "$d"
-  "$PYBIN" "$CREDENTIAL_PY" install "$MULTIACC_PROVIDER" "$stage" "$d" >/dev/null \
+  local identity_cli=""
+  [ "$MULTIACC_PROVIDER" != "claude" ] || identity_cli="$(find_real_claude "${_self:-$0}" 2>/dev/null)" || true
+  "$PYBIN" "$CREDENTIAL_PY" install "$MULTIACC_PROVIDER" "$stage" "$d" "$identity_cli" >/dev/null \
     || fail_locked "could not install the credential into $d — nothing registered"
   manifest_add_account "$target_id" "$bemail" "$home" "$badded" \
     || fail_locked "manifest update failed — $target_id was seeded but NOT registered (re-run import-credential)"
@@ -469,10 +484,20 @@ keychain_state() { # $1 = acct dir -> prints present|locked|absent|corrupt|unava
 keychain_has_login() { # $1 = acct dir: an item EXISTS here (readable or locked)
   case "$(keychain_state "$1")" in present|locked|corrupt) return 0 ;; *) return 1 ;; esac
 }
-keychain_forget() { # $1 = acct dir: drop the item (a removed account must not leave a grant behind)
+keychain_forget() { # $1 = acct dir: drop every item (a removed account must not leave a grant behind)
   [ "$MULTIACC_PROVIDER" = "codex" ] && return 0
   "$PYBIN" "$LIB_DIR/keychain.py" delete "$1" >/dev/null 2>&1 || true
 }
+keychain_prune() { # $1 = acct dir: drop the non-canonical items once the canonical one is a
+                   # live login (lib/keychain.py prune). Quiet, never fails; logs only a change.
+  [ "$MULTIACC_PROVIDER" = "codex" ] && return 0
+  local line
+  line="$("$PYBIN" "$LIB_DIR/keychain.py" prune "$1" 2>/dev/null)" || true
+  case "$line" in
+    pruned:*|failed:*) log_to ops.log "keychain prune $(basename "$1"): $line" ;;
+  esac
+  return 0
+}
 
 # ---- expired-login bookkeeping -------------------------------------------------
 # `.expired` is the persistent "this account cannot authenticate" marker the shim

package/lib/credential.py

@@ -12,7 +12,7 @@ Run (all paths absolute; the blob never passes through argv):
       class, id, email, home, added_at, cred_type. The separator is deliberately NOT
       whitespace: bash collapses runs of IFS whitespace, which would silently shift
       an empty field (a blob with no `home`) into the next one.
-  python3 lib/credential.py install <provider> <blob-file> <dest-dir>
+  python3 lib/credential.py install <provider> <blob-file> <dest-dir> [real-claude]
       writes the credential material into <dest-dir> (0600, atomic); no-op for an
       identity-only blob. Prints the file it wrote (or nothing).
 
@@ -315,7 +315,7 @@ def cmd_inspect(argv):
 
 def cmd_install(argv):
     if len(argv) < 3:
-        die('usage: credential.py install <provider> <blob-file> <dest-dir>')
+        die('usage: credential.py install <provider> <blob-file> <dest-dir> [real-claude]')
     provider, path, dest = argv[0], argv[1], argv[2]
     blob, cclass, _aid, _email, _home, _added, _type = _validate(provider, path)
     if cclass == 'identity':
@@ -325,6 +325,13 @@ def cmd_install(argv):
             f'write a credential through it', 2)
     if not os.path.isdir(dest):
         die(f'destination is not a directory: {dest}')
+    from claude_reset import cli_version
+    from claude_token_identity import check_identity
+    identity = check_identity(dest, blob['credential']['value'].strip(), persist=False,
+                              version=cli_version(argv[3] if len(argv) > 3 else None), expected_email=_email)
+    if identity['state'] == 'mismatch':
+        die('the token organization does not match the destination account — nothing installed; '
+            'mint a token for the named account', 5)
     out = os.path.join(dest, 'server.token')
     _write_secure(out, blob['credential']['value'].strip(), nofollow_dir=True)
     print(out)