claude-multiacc 2.0.43 → 2.0.44

package/README.md

@@ -126,7 +126,7 @@ later.
 **Unusable accounts are excluded, not rotated into.** An account that cannot serve a
 request is dropped from selection before anything else is considered — it is not eligible
 as the all-limited fallback either, because a limit-marked account is *degraded* while
-this one is *down*, and handing work to it guarantees a hard failure. Two kinds:
+this one is *down*, and handing work to it guarantees a hard failure. Reported states include:
 
 - **Dead login** (`EXPIRED`) — refresh token expired, grant revoked, or a real call that
   came back *"OAuth session expired and could not be refreshed"*. Fixed by
@@ -135,6 +135,11 @@ this one is *down*, and handing work to it guarantees a hard failure. Two kinds:
   prove inference works. Before a portable token carries its first real command on a
   machine, the shim privately verifies it. A 401 parks that exact account and reselects,
   so direct, TUI, and `--resume` calls do not expose the rejected token's failure.
+- **Wrong token organization** (`TOKEN INVALID`) — an authenticated API response identifies
+  a different organization from the slot's saved OAuth profile. The shim excludes that
+  portable token, including on retries; a healthy local OAuth login remains usable.
+  Replace it with `claude-accounts login acct-NN --token` and sync. See
+  [token identity checks and recovery](docs/claude-token-identity.md).
 - **Org-blocked** (`BLOCKED`) — the account authenticates fine, but the run comes back
   *"Your organization has disabled Claude subscription access for Claude Code"*. Handled
   like any other dead login (`claude-accounts relogin` re-issues the grant and normally

package/bin/claude

@@ -1646,6 +1646,12 @@ expired_marked() { # $1 = acct dir
 # OAuth credential beside it is dead — the token is exported instead.
 auth_dead() { # $1 = acct dir
   expired_marked "$1" && return 0
+  if [ -s "$1/server.token" ] && { ! has_oauth "$1" || creds_dead "$1"; }; then
+    case ":${CLAUDE_MULTIACC_PREFLIGHT_SKIP:-}:" in *":${1##*/}:"*) return 0 ;; esac
+    if [ -f "$1/.server-token-identity.json" ]; then
+      [ "$(token_identity_state cached "$1")" = mismatch ] && return 0
+    fi
+  fi
   [ -s "$1/server.token" ] && return 1
   creds_dead "$1"
 }
@@ -1658,10 +1664,21 @@ acct_token() { # $1 = acct dir; prints token if the dir must authenticate by tok
   fi
 }
 
-# A setup-token has no identity or readable expiry, and `claude auth status` only
-# checks its shape. Test each token once on this machine with a real inference before
-# allowing it to carry a user's command. This closes the direct/TUI/--resume gap where
-# a revoked token exposed one 401 and was only parked on the following invocation.
+# auth status cannot identify a setup-token, but authenticated API response headers
+# name its organization, even on a quota rejection. Check that binding independently
+# of the old inference proof: a token can answer OK while spending another account.
+token_identity_state() { # $1 check|cached, $2 account dir, $3 exact token for check
+  local helper="$SELF_DIR/../lib/claude_token_identity.py" py="${CLAUDE_MULTIACC_PYTHON:-python3}"
+  [ -r "$helper" ] || return 0
+  if [ "$1" = check ]; then
+    printf '%s' "${3:-}" | "$py" "$helper" check "$2" --token-stdin --real "$REAL" --format state 2>/dev/null
+  else
+    "$py" "$helper" cached "$2" --format state 2>/dev/null
+  fi
+}
+
+# Test authentication independently; organization matching cannot prove a token is
+# still valid. The token and identity receipts are both bound to its exact digest.
 token_digest() { # $1 token; prints a non-secret sha256 digest
   local h=""
   if command -v shasum >/dev/null 2>&1; then
@@ -1672,8 +1689,16 @@ token_digest() { # $1 token; prints a non-secret sha256 digest
   printf '%s' "$h" | cut -d ' ' -f1
 }
 
-token_preflight() { # $1 acct dir, $2 setup-token; rc 1 only for proven invalid auth
+TOKEN_PREFLIGHT_FAILURE=""
+token_preflight() { # $1 acct dir, $2 setup-token; rc 1 only for proven unusable auth
   local d="$1" tok="$2" digest marker tmpd token_auth_pat rc=0
+  TOKEN_PREFLIGHT_FAILURE="invalid portable OAuth token (401)"
+  if [ "$(token_identity_state check "$d" "$tok")" = mismatch ]; then
+    TOKEN_PREFLIGHT_FAILURE="portable setup-token for a different organization; run: "
+    TOKEN_PREFLIGHT_FAILURE="${TOKEN_PREFLIGHT_FAILURE}claude-accounts login ${d##*/} --token"
+    sel_log "${d##*/} skipped (setup-token identity mismatch)"
+    return 1
+  fi
   digest="$(token_digest "$tok")"
   [ -n "$digest" ] || return 0
   marker="$d/.server-token-verified"
@@ -1723,8 +1748,8 @@ if [ -n "${CLAUDE_ACCOUNT:-}" ]; then
     tok="$(acct_token "$d")"
     if [ -n "$tok" ]; then
       if ! token_preflight "$d" "$tok"; then
-        printf 'claude-multiacc: pinned account %s has an invalid portable OAuth token (401)\n' \
-          "$CLAUDE_ACCOUNT" >&2
+        printf 'claude-multiacc: pinned account %s has a %s\n' \
+          "$CLAUDE_ACCOUNT" "$TOKEN_PREFLIGHT_FAILURE" >&2
         exit 1
       fi
       export CLAUDE_CODE_OAUTH_TOKEN="$tok"
@@ -2058,13 +2083,22 @@ if [ -n "$tok" ] && ! token_preflight "$pick" "$tok"; then
   num_ok "$preflight_depth" || preflight_depth=0
   if [ "$preflight_depth" -lt 64 ]; then
     export CLAUDE_MULTIACC_PREFLIGHT_DEPTH=$((preflight_depth + 1))
+    # Persistence can fail on a read-only pool. Exclude this token for the re-entry
+    # anyway, and never fall through into a token the preflight just rejected.
+    preflight_skip="${CLAUDE_MULTIACC_PREFLIGHT_SKIP:+$CLAUDE_MULTIACC_PREFLIGHT_SKIP:}"
+    export CLAUDE_MULTIACC_PREFLIGHT_SKIP="${preflight_skip}${pick##*/}"
     # An auto-resume chain survives the re-entry (see ---- auto-resume ----). '|' is
     # outside every chain field's charset, so it separates them unambiguously.
     [ -n "$AR_CHAIN" ] && export CLAUDE_MULTIACC_AR_CARRY="$AR_DEPTH|$AR_AVOID|$AR_HIST|$AR_CHAIN"
     exec "$SELF" "$@"
   fi
+  printf 'claude-multiacc: portable token preflight retry limit reached\n' >&2
+  exit 1
 fi
-unset CLAUDE_MULTIACC_PREFLIGHT_DEPTH
+unset CLAUDE_MULTIACC_PREFLIGHT_DEPTH CLAUDE_MULTIACC_PREFLIGHT_SKIP
+# Use the exact token that passed preflight. A concurrent mint/sync may replace the
+# file before exec; rereading it here would run an unchecked credential.
+PICK_TOKEN="$tok"
 
 # The picked account may be eligible only because its exhausted bucket belongs to a
 # model this run did not ask for. Handing it the default model anyway would open the
@@ -2165,7 +2199,7 @@ export CLAUDE_SHIM_ACTIVE=1
 # mirrored to every other one (exits inside); anything else falls through to exec.
 if [ "${1:-}" = "mcp" ] || { [ "${1:-}" = "--model" ] && [ "${3:-}" = "mcp" ]; }; then
   export CLAUDE_CONFIG_DIR="$pick"
-  tok="$(acct_token "$pick")"
+  tok="$PICK_TOKEN"
   [ -n "$tok" ] && export CLAUDE_CODE_OAUTH_TOKEN="$tok"
   mcp_mirror_run "$pick" "$@" || true
 fi
@@ -2197,7 +2231,7 @@ fi
 
 if [ "$wants_retry" = "0" ]; then
   export CLAUDE_CONFIG_DIR="$pick"
-  tok="$(acct_token "$pick")"
+  tok="$PICK_TOKEN"
   [ -n "$tok" ] && export CLAUDE_CODE_OAUTH_TOKEN="$tok"
   sel_capture_session "$pick"
   ar_trust "$pick"
@@ -2209,7 +2243,7 @@ fi
 mkdir -p "$ACC_ROOT/tmp" 2>/dev/null || true
 tmpd="$(mktemp -d "$ACC_ROOT/tmp/shim.XXXXXX" 2>/dev/null)" || {
   export CLAUDE_CONFIG_DIR="$pick"
-  tok="$(acct_token "$pick")"
+  tok="$PICK_TOKEN"
   [ -n "$tok" ] && export CLAUDE_CODE_OAUTH_TOKEN="$tok"
   sel_capture_session "$pick"
   exec "$REAL" "$@"
@@ -2221,7 +2255,7 @@ trap 'rm -rf "$tmpd"' EXIT
 # nonzero — a hard failure. Verify now, fall back to plain exec if we cannot.
 if ! : > "$tmpd/out" 2>/dev/null || ! : > "$tmpd/err" 2>/dev/null; then
   export CLAUDE_CONFIG_DIR="$pick"
-  tok="$(acct_token "$pick")"
+  tok="$PICK_TOKEN"
   [ -n "$tok" ] && export CLAUDE_CODE_OAUTH_TOKEN="$tok"
   sel_capture_session "$pick"
   exec "$REAL" "$@"
@@ -2306,6 +2340,7 @@ stream_reported_error() {
 
 attempt=1
 cur="$pick"
+cur_token="$PICK_TOKEN"
 rc=0
 stream_err=0       # the run exited 0 but the stream said otherwise
 rotated=0          # at most one account rotation, exactly as before
@@ -2315,7 +2350,7 @@ while :; do
   # Per ATTEMPT: a stream error seen on an earlier account must never decide the
   # exit status of a later one that failed for its own, real reason.
   stream_err=0
-  tok="$(acct_token "$cur")"
+  tok="$cur_token"
   if [ -n "$stdin_file" ]; then exec 3< "$stdin_file"; else exec 3< /dev/null; fi
   if [ -n "$tok" ]; then
     CLAUDE_CONFIG_DIR="$cur" CLAUDE_CODE_OAUTH_TOKEN="$tok" "$REAL" "${ARGV[@]}" <&3 > "$tmpd/out" 2> "$tmpd/err"
@@ -2391,14 +2426,22 @@ while :; do
     n="${#eligible[@]}"
     start=$((RANDOM % n))
     i=0
-    while [ "$i" -lt "$n" ]; do
+    while [ "$rotated" = 0 ] && [ "$i" -lt "$n" ]; do
       c="${eligible[$(((start + i) % n))]}"
-      if [ "$c" != "$cur" ]; then next="$c"; break; fi
+      if [ "$c" != "$cur" ] && ! auth_dead "$c"; then
+        candidate_token="$(acct_token "$c")"
+        if [ -z "$candidate_token" ] || token_preflight "$c" "$candidate_token"; then
+          next="$c"
+          next_token="$candidate_token"
+          break
+        fi
+      fi
       i=$((i+1))
     done
     if [ -n "$next" ] && [ "$rotated" = 0 ]; then
       sel_log "retry from=$(basename "$cur") to=$(basename "$next") rc=$rc"
       cur="$next"
+      cur_token="$next_token"
       # The account that actually serves the work is the one the next run should rotate
       # away from — not the one that bounced.
       remember_pick "$cur"

package/bin/claude-accounts

@@ -635,7 +635,7 @@ cmd_add() {
     # Portable setup-token variant (works on Mac AND server; needs a recent sign-in).
     echo "Preparing $id for $elabel (portable token) — NOTHING is registered until sign-in completes."
     run_token_ceremony "$d" || die "sign-in failed or aborted — nothing was created${CEREMONY_LAST_WORDS:+ — the client said: $CEREMONY_LAST_WORDS}${CEREMONY_TRANSCRIPT:+ (transcript: $CEREMONY_TRANSCRIPT)}"
-    commit_ceremony_token "$d" "$CEREMONY_TOKEN" "$id"
+    commit_ceremony_token "$d" "$CEREMONY_TOKEN" "$id" captured "$email"
     got="$(token_email "$CEREMONY_TOKEN")"
   else
     # Default: full Claude Code login (full scopes, no long-lived-token step-up).
@@ -749,6 +749,12 @@ cmd_import() {
   fi
   local d="$ACC_ROOT/$id"
   seed_account_dir "$d"
+  if [ -n "$tok" ]; then
+    ceremony_token_identity "$d" "$tok" "$email"
+    if [ "$CEREMONY_IDENTITY_STATE" = "mismatch" ]; then
+      die "the token's organization does not match $id — nothing imported; mint a token for the named account"
+    fi
+  fi
   if [ -n "$creds" ]; then
     case "$mode" in
       copy) cp "$creds" "$d/.credentials.json" ;;
@@ -1033,11 +1039,27 @@ ceremony_token_check() { # $1 = token
   esac
 }
 
-# The ONE place a ceremony's token is written: only after ceremony_token_check, so a
-# token Claude rejects is never saved, uploaded, or distributed. $1 = acct dir,
+# A candidate must not replace the current token's identity receipt until it is saved.
+CEREMONY_IDENTITY_STATE="unknown"
+ceremony_token_identity() { # $1 = account dir, $2 = candidate token, $3 = optional named email
+  local d="$1" tok="$2" email="${3:-}" real
+  real="$(find_real_claude "$_self")" || real=""
+  set -- check "$d" --token-stdin --real "$real" --format state --no-store
+  [ -z "$email" ] || set -- "$@" --expected-email "$email"
+  CEREMONY_IDENTITY_STATE="$(printf '%s' "$tok" \
+    | "$PYBIN" "$LIB_DIR/claude_token_identity.py" "$@" 2>/dev/null)"
+  [ -n "$CEREMONY_IDENTITY_STATE" ] || CEREMONY_IDENTITY_STATE="unknown"
+}
+
+# The ONE place a ceremony's token is written: only after organization and auth checks,
+# so a known wrong-organization or rejected token is never saved or distributed. $1 = acct dir,
 # $2 = token, $3 = acct id (messages only).
 commit_ceremony_token() {
   local d="$1" tok="$2" id="$3" src="${4:-captured}" rc=0
+  ceremony_token_identity "$d" "$tok" "${5:-}"
+  if [ "$CEREMONY_IDENTITY_STATE" = "mismatch" ]; then
+    die "the token's organization does not match $id — nothing saved; sign in as the named account and mint again"
+  fi
   ceremony_token_check "$tok" || rc=$?
   # A short token is an incomplete one unless Claude itself has just answered with it:
   # the length alone convicts it, so an inconclusive probe (429, network) must not let
@@ -1055,6 +1077,7 @@ commit_ceremony_token() {
   fi
   ( umask 077; printf '%s' "$tok" > "$d/server.token" )
   chmod 600 "$d/server.token"
+  [ "$CEREMONY_IDENTITY_STATE" != "match" ] || echo "Token organization matches the account's saved OAuth profile."
   if [ "$rc" -eq 0 ]; then
     record_token_verified "$d" "$tok"
     echo "Token verified by a real inference."
@@ -1231,10 +1254,9 @@ TIP
 
 cmd_mint() {
   # The minted token is the ONLY credential that reaches the server and every peer, so a
-  # mint under the wrong browser session hands this slot another account's subscription —
-  # and nothing downstream can notice (a setup token reports no identity, see
-  # token_email). Naming the expected account before the ceremony opens is the only guard
-  # that exists; the old prompt said "THIS account" and named nobody.
+  # mint under the wrong browser session can hand this slot another subscription. Name the
+  # expected account before the ceremony and verify the token's response organization
+  # against its saved OAuth profile before accepting it. The token cannot report an email.
   require_manifest
   local id="" paste=0
   while [ $# -gt 0 ]; do
@@ -1279,7 +1301,9 @@ cmd_mint() {
   clear_auth_markers "$d"
   log_to ops.log "mint $id"
   echo "Token saved to $d/server.token"
-  [ -n "$got" ] || warn "a setup token carries no identity — $id now runs whichever account approved that grant${email:+, trusted to be $email}"
+  if [ -z "$got" ] && [ "$CEREMONY_IDENTITY_STATE" != "match" ]; then
+    warn "the token's organization could not be checked — $id is trusted to hold ${email:-the named account}"
+  fi
   auto_sync
 }
 
@@ -1314,7 +1338,9 @@ cmd_login() {
     fi
     commit_ceremony_token "$d" "$CEREMONY_TOKEN" "$id"
     clear_auth_markers "$d"
-    [ -n "$got" ] || warn "a setup token carries no identity — $id is trusted to hold $email because that is who you approved as"
+    if [ -z "$got" ] && [ "$CEREMONY_IDENTITY_STATE" != "match" ]; then
+      warn "the token's organization could not be checked — $id is trusted to hold $email as requested"
+    fi
     echo "$id token saved (portable — works on Mac and server)."
   else
     run_login_ceremony "$d" "$email" \
@@ -1546,6 +1572,26 @@ os.execv(sys.argv[1], [sys.argv[1], "limits-distribute-now"])
   return 0
 }
 
+token_identities_check() {
+  # A source may always use Keychain OAuth locally while its peers use setup tokens.
+  # Prove those tokens before distributing telemetry, even if nobody launched them here.
+  local id d real
+  real="$(find_real_claude "$_self")" || real=""
+  for id in $(account_ids); do
+    d="$ACC_ROOT/$id"
+    [ -s "$d/server.token" ] || continue
+    "$PYBIN" "$LIB_DIR/claude_token_identity.py" check "$d" --real "$real" >/dev/null 2>&1 || true
+  done
+}
+
+token_identity_receipt() { # Unknown results must never overwrite a peer's proven mismatch.
+  local verdict
+  [ -f "$1/.server-token-identity.json" ] || return 1
+  verdict="$("$PYBIN" "$LIB_DIR/claude_token_identity.py" cached "$1" 2>/dev/null)"
+  printf '%s' "$verdict" | grep -q '"cached": true' || return 1
+  printf '%s' "$verdict" | grep -qE '"state": "(match|mismatch)"'
+}
+
 limits_distribute_now() {
   local lock="$ACC_ROOT/tmp/limits-push.lock"
   mkdir -p "$ACC_ROOT/tmp" 2>/dev/null || return 0
@@ -1570,6 +1616,7 @@ limits_distribute_now() {
   list="$ACC_ROOT/tmp/limits-push.$$"
   mkdir -p "$ACC_ROOT/tmp" 2>/dev/null || return 0
   : > "$list" 2>/dev/null || return 0
+  token_identities_check
   for id in $(account_ids); do
     d="$ACC_ROOT/$id"
     [ -f "$d/limits.json" ] && printf '%s/limits.json\n' "$id" >> "$list"
@@ -1577,6 +1624,7 @@ limits_distribute_now() {
     # .limited on its own, so a stale one costs an account some eligibility and
     # never grants any. Erring toward exclusion is the safe direction here.
     [ -f "$d/.limited" ] && printf '%s/.limited\n' "$id" >> "$list"
+    token_identity_receipt "$d" && printf '%s/.server-token-identity.json\n' "$id" >> "$list"
   done
   # The MCP registry rides along: a server the shim mirrored from a stock `claude mcp
   # add` reaches every peer within one limits cadence, with no explicit sync. The
@@ -2742,6 +2790,8 @@ root, quick, real = sys.argv[1], sys.argv[2] == '1', sys.argv[3]
 sys.path = [sys.argv[4]] + [p for p in sys.path if p not in ('', '.')]
 from audit import audit_account, creds_state, creds_doc_state   # noqa: E402  (shared with the shim's rule)
 import keychain  # noqa: E402
+from claude_token_identity import check_identity  # noqa: E402
+from claude_reset import cli_version  # noqa: E402
 machine = sys.argv[5]
 now = time.time()
 manifest = json.load(open(os.path.join(root, 'accounts.json')))
@@ -2862,6 +2912,15 @@ for acct in manifest.get('accounts', []):
         env['CLAUDE_CODE_OAUTH_TOKEN'] = open(tpath).read().strip()
     t0 = time.time()
     uses_token = 'CLAUDE_CODE_OAUTH_TOKEN' in env
+    identity = {'state': 'unknown'}
+    if has_token:
+        portable = env['CLAUDE_CODE_OAUTH_TOKEN'] if uses_token else open(tpath).read().strip()
+        identity = check_identity(d, portable, version=cli_version(real))
+        if uses_token and identity['state'] == 'mismatch':
+            print(f'{aid} {acct["email"]}: FAIL (portable setup-token belongs to a different '
+                  f'organization — run: claude-accounts login {aid} --token)')
+            failures += 1
+            continue
     try:
         r = subprocess.run([real, '-p', '--output-format', 'text', '--max-turns', '1'],
                            env=env, capture_output=True, text=True, timeout=240,
@@ -2889,7 +2948,7 @@ for acct in manifest.get('accounts', []):
                 pass
         if uses_token:
             try:
-                digest = hashlib.sha256(open(tpath, 'rb').read().strip()).hexdigest()
+                digest = hashlib.sha256(env['CLAUDE_CODE_OAUTH_TOKEN'].encode()).hexdigest()
                 temp = os.path.join(d, '.server-token-verified.tmp')
                 with open(temp, 'w') as f:
                     f.write(digest + '\n')
@@ -2898,6 +2957,9 @@ for acct in manifest.get('accounts', []):
             except OSError:
                 pass
         print(f'{aid} {acct["email"]}: PASS ({dt:.1f}s) -> {out[:60]!r}')
+        if not uses_token and identity['state'] == 'mismatch':
+            print(f'  portable setup-token belongs to a different organization; OAuth login passed; '
+                  f'replace the token with: claude-accounts login {aid} --token')
     else:
         raw = (r.stderr or '').strip()
         err = raw[:200]
@@ -2985,7 +3047,8 @@ sync_push_target() {
     done
     # Advisory limit state for accounts the target may lack a bearer for.
     local extra
-    for extra in limits.json .limited; do
+    for extra in limits.json .limited .server-token-identity.json; do
+      if [ "$extra" = .server-token-identity.json ]; then token_identity_receipt "$d" || continue; fi
       if [ -f "$d/$extra" ]; then
         rsync -az "$d/$extra" "$server:$sroot/$id/" >>"$ACC_ROOT/sync.log" 2>&1 || true
       fi
@@ -3078,6 +3141,7 @@ cmd_sync() {
     sync_is_replica && role="replica"
     log_to sync.log "sync (local-only, role=$role): no server target${no_server:+ (--no-server)}"
     local_pool_fixup
+    [ "$role" != source ] || token_identities_check
     if [ "$role" = "replica" ]; then
       echo "sync ok (local-only, and this pool is a sync replica — nothing pushed either way)"
     else
@@ -3127,6 +3191,7 @@ EOF
     fail "manifest has zero accounts — refusing to blank the target pools (use 'sync --allow-empty' if that is really intended)"
   fi
 
+  token_identities_check
   sync_push_target "$server" "$sroot" "$srepo"
   local npeers=0
   if [ -n "$peers" ]; then

package/docs/claude-token-identity.md

@@ -0,0 +1,147 @@
+# Claude setup-token identity and telemetry
+
+A pool slot's telemetry and its execution credential must describe the same
+organization. Otherwise the selector can correctly rank an empty account and launch
+Claude against another account's exhausted subscription.
+
+## Session 23: the confirmed cause
+
+The September 2026 investigation compared the actual `server.token` credentials with
+their slots' saved OAuth profiles. Authenticated responses identified acct-14's token
+as belonging to acct-18's organization, and acct-13's token as belonging to acct-15's
+organization. The complete pool audit also found acct-19's token belonged to acct-16's
+organization. Anthropic returned `anthropic-organization-id` even on HTTP 429, allowing
+the comparison without exposing tokens or relying on an inference succeeding.
+
+The scheduled OAuth usage response really reported 0% for acct-13 and acct-14. The
+native CLI instead reported 94% weekly usage for acct-13's portable token and a weekly
+rejection for acct-14's. Those measurements described different organizations. Changing
+the weekly band, treating every zero as unknown, or overwriting OAuth usage with the
+token's usage would hide the credential mismatch and could exclude healthy accounts.
+
+The existing `.server-token-verified` file only proved that the exact token had once
+completed an inference. It could therefore bless a working token from the wrong
+organization indefinitely. A successful response of `OK` is still useful evidence of
+authentication; it is not evidence that a token belongs to the configured slot.
+
+## The identity check
+
+`lib/claude_token_identity.py` sends a small inference request and compares its
+`anthropic-organization-id` response header with
+`<account>/.claude.json` → `oauthAccount.organizationUuid`. This uses no usage GET and
+does not change the telemetry polling cadence. Response bodies and credentials are
+never written into the receipt or diagnostic output. Redirects are refused.
+
+The independent `<account>/.server-token-identity.json` receipt records the exact
+token digest, expected and observed organizations, account id, manifest email, verdict,
+and check time. A match or mismatch remains reusable only while those bindings agree.
+Replacing a token or changing its configured identity requires a new check. Updating
+the same token's timestamp, refreshing OAuth, redeeming a limit reset, or clearing
+ordinary auth/limit markers cannot invalidate a proven mismatch.
+
+The shim checks identity before accepting the old `.server-token-verified` shortcut,
+including retry candidates, and executes the exact token it checked. Concurrent checks
+share an account lock so a delayed inconclusive result cannot replace proven identity.
+A cached mismatch removes a candidate when execution would use its portable token;
+healthy local OAuth may still use that slot. Explicit account pins also reject a known
+wrong-organization token. Full `claude-accounts verify` performs the identity check,
+and token ceremonies and imports reject a known mismatch before saving a candidate.
+An inconclusive candidate check must not overwrite the current token's receipt.
+
+Source sync and telemetry distribution check every portable token, even when local
+OAuth works. Full verification likewise checks both credentials and reports them
+separately. Sync distributes only current, confirmed identity receipts alongside the
+token and telemetry; uncertainty cannot overwrite a peer's proven mismatch. A replica
+without a saved OAuth profile can use the receipt's expected organization only when
+its token digest and manifest binding still match. A changed local OAuth profile takes
+precedence and invalidates an outdated receipt; an unrelated receipt cannot establish
+the expectation for a newly created slot.
+
+## Recovery
+
+Replace the misfiled token by running the supported ceremony on the source machine:
+
+```bash
+claude-accounts login acct-NN --token
+claude-accounts verify
+claude-accounts sync
+```
+
+Approve the ceremony in a browser signed into the named account. A different token
+invalidates the previous receipt and is checked against the saved expected organization.
+Do not clear a mismatch by deleting markers or touching `server.token`: neither repairs
+the credential. A valid local OAuth login can keep that machine's slot usable while its
+portable token is replaced. Peers that depend on the bad token remain excluded.
+
+The plugin does not automatically reassign a token to a different slot. The observed
+organization does not prove which human account minted it, and moving credentials
+could silently change the intended account mapping.
+
+## What the check proves
+
+The response header proves organization, not email, user identity, subscription seat,
+remaining quota, or continuing authentication. Users sharing an organization cannot
+be distinguished by this header. Keep the normal authentication preflight and quota
+selection policy independent.
+
+Setup tokens lack `user:profile`; `claude auth status` therefore reports no email for
+them. An empty token email must not make the supported `add <email> --token` path require
+`--force`, and the test CLI must not invent an email for token authentication. Name the
+expected account before every ceremony.
+
+No expected organization, a missing/malformed header, or a network failure produces an
+inconclusive result. Execution retains its existing fallback behavior rather than
+parking an account on uncertainty; inconclusive network checks back off for one minute.
+Consequently the guard prevents a proved organization mismatch. It cannot promise
+identity verification where Anthropic or the local account profile supplies no evidence.
+
+## Telemetry rules that remain necessary
+
+Portable setup tokens can run inference but cannot call the usage endpoint. A polling
+source needs working OAuth logins; token-only peers receive `limits.json` through sync.
+Use `claude-accounts status` to find `RANKING IS BLIND` or `<< STALE`, and repair source
+OAuth with `claude-accounts login acct-NN` without `--token`. The usage endpoint has
+returned an approximately hourly budget with `Retry-After: 3600`; retrying its permanent
+scope rejection more frequently creates rate limits rather than telemetry.
+
+Earlier fixes addressed separate missing-data and marker-recovery cases. They must
+remain intact after adding identity validation:
+
+- A weekly 0% bucket without a reset carries no informative weekly answer. Aggregate
+  only informative buckets, separately for each signal. Ignore an empty model bucket
+  beside informative ones; retain a measured zero with a real reset.
+- If the entire payload is uninformative, write `no_data: true` without percentage
+  fields. Ranking and BLIND detection require both weekly and session signals; a recent
+  timestamp alone must not hide missing data.
+- An otherwise informative payload may have no open five-hour window. Both writers
+  synthesize session 0% with `session_inferred: true` so idle accounts can rank. This
+  exception never invents weekly usage or turns a wholly empty payload into data.
+- An inferred session zero cannot clear a client five-hour rejection. Only a measured
+  low reading of that window can recover it before its reset. Never substitute the
+  weekly `max_percent`. Claude must enforce this in both shim and writer; Codex's
+  telemetry recovery exists only in its writer.
+- A client weekly rejection survives later telemetry until its reset, except when the
+  reset protocol confirms an applicable redemption. Marker names must preserve the
+  provider's actual window: Claude `client:seven_day`; Codex `client:7d` or `client:5h`
+  according to rollout window minutes.
+
+The earlier observations of zero OAuth usage alongside client rejections did not
+establish that both credentials belonged to the same organization. Session 23 supplies
+direct evidence of that missing assumption. Identity validation addresses it without
+weakening the conservative recovery rules or changing the 50% session gate and
+30-point weekly peer band.
+
+## Verification boundaries
+
+Regression coverage must exercise the shim and account commands, not just compare
+helper return values. Include old auth proofs, explicit pins, fallback selection,
+unchanged token timestamps, replacement tokens, healthy OAuth beside a bad token,
+receipt persistence through telemetry/reset cleanup, missing headers, and replica
+bindings. Full verification must fail a wrong-organization token even if a fake native
+CLI would answer `OK`.
+
+Real checks should compare the exact token's response organization with its configured
+slot, then launch an independently selected account through the updated shim. Use
+minimal prompts with tools disabled and keep tokens and raw account identifiers out
+of task logs. Passing those checks establishes the tested behavior; it does not remove
+the inconclusive and shared-organization limitations described above.

package/lib/audit.py

@@ -39,6 +39,7 @@ import time
 # helper sits beside it either way.
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 import keychain  # noqa: E402
+from claude_token_identity import cached_identity  # noqa: E402
 
 VALID_ID = re.compile(r'acct-\d{2}')
 
@@ -249,6 +250,8 @@ def _fix_for(state, aid):
 
 def _token_verified(d, tpath):
     """Whether this exact setup-token passed an inference on this machine."""
+    if cached_identity(d)['state'] == 'mismatch':
+        return False
     try:
         digest = hashlib.sha256(open(tpath, 'rb').read().strip()).hexdigest()
         saved = open(os.path.join(d, '.server-token-verified')).read().strip()
@@ -305,6 +308,13 @@ def audit_account(root, acct, now=None, machine=None, require_verified_token=Fal
         return done(row)
     login = oauth_login(d, now)
     row['store'] = login['store']
+    if has_token and cached_identity(d)['state'] == 'mismatch':
+        if login['state'] != 'ok':
+            row['state'] = 'token-invalid'
+            row['reason'] = 'portable setup-token belongs to a different organization'
+            return done(row)
+        row['reason'] = f"{login['reason']}; portable setup-token identity mismatch, using the local login"
+        return done(row)
     if login['state'] in ('ok', 'expired'):
         state, reason = login['state'], login['reason']
         if state == 'ok' or has_token: