claude-multiacc 2.0.43 → 2.0.45

package/README.md

@@ -126,7 +126,7 @@ later.
 **Unusable accounts are excluded, not rotated into.** An account that cannot serve a
 request is dropped from selection before anything else is considered — it is not eligible
 as the all-limited fallback either, because a limit-marked account is *degraded* while
-this one is *down*, and handing work to it guarantees a hard failure. Two kinds:
+this one is *down*, and handing work to it guarantees a hard failure. Reported states include:
 
 - **Dead login** (`EXPIRED`) — refresh token expired, grant revoked, or a real call that
   came back *"OAuth session expired and could not be refreshed"*. Fixed by
@@ -135,6 +135,11 @@ this one is *down*, and handing work to it guarantees a hard failure. Two kinds:
   prove inference works. Before a portable token carries its first real command on a
   machine, the shim privately verifies it. A 401 parks that exact account and reselects,
   so direct, TUI, and `--resume` calls do not expose the rejected token's failure.
+- **Wrong token organization** (`TOKEN INVALID`) — an authenticated API response identifies
+  a different organization from the slot's saved OAuth profile. The shim excludes that
+  portable token, including on retries; a healthy local OAuth login remains usable.
+  Replace it with `claude-accounts login acct-NN --token` and sync. See
+  [token identity checks and recovery](docs/claude-token-identity.md).
 - **Org-blocked** (`BLOCKED`) — the account authenticates fine, but the run comes back
   *"Your organization has disabled Claude subscription access for Claude Code"*. Handled
   like any other dead login (`claude-accounts relogin` re-issues the grant and normally
@@ -142,7 +147,13 @@ this one is *down*, and handing work to it guarantees a hard failure. Two kinds:
   Code for that account. Telemetry cannot see this — those accounts' usage endpoint
   answers normally — so only a real call (`verify`, or a `-p` run) detects it, and the
   park deliberately survives credential refreshes (a new access token says nothing about
-  an org policy).
+  an org policy). Every org park carries a 6-hour `soft_until` (a re-observed block
+  renews it), and a `verify` that the **usage limiter** refuses ("You've hit your weekly
+  limit") lifts it at once: the provider checks the org's Claude Code gate before the
+  limiter, so a limit answer proves the org lets the account through (acct-15,
+  2026-09-27: a lapsed subscription paid again stayed BLOCKED until this rule existed).
+  The line still reads `FAIL` — the account cannot work until the limit resets — with a
+  `usage-limited` note saying which park it lifted.
 
 `claude-accounts expired` lists what is excluded and also labels a token-only account
 `UNVERIFIED` until `claude-accounts verify` or the shim's first-use preflight proves it.
@@ -150,11 +161,13 @@ Exclusion self-heals, but only against the evidence it was based on: a **credent
 park (dead login) clears as soon as a newer credential lands — a re-login, or a refresh
 by another process — or when a usage fetch authenticates; a **policy** park (org block)
 ignores both, because a fresh access token says nothing about whether the org re-enabled
-Claude Code, and only a passing real call or a re-login lifts it. Parks the **shim**
-writes from a single failed run additionally carry a `soft_until` stamp and expire on
-their own — the shim's guess never outlives the evidence for it — while parks
-`claude-accounts` writes from proof (an `invalid_grant` refresh response, a failed real
-call) stay until the account works again. If *every* account is unusable the shim still
+Claude Code: only a real call that got past the org gate (a passing `verify`, or one
+refused only by a usage limit), a re-login, or its own 6-hour `soft_until` lifts it.
+Parks the **shim** writes from a single failed run additionally carry a `soft_until`
+stamp and expire on their own — the shim's guess never outlives the evidence for it —
+while parks `claude-accounts` writes from proof of a dead credential (an `invalid_grant`
+refresh response, a real call that failed to authenticate) stay until the account works
+again. If *every* account is unusable the shim still
 fails open into stock `claude`, and logs why to `selection.log`.
 
 The shim prints nothing, logs `timestamp account cwd` (never prompt text) to

package/bin/claude

@@ -1581,8 +1581,10 @@ creds_dead() { # $1 = acct dir
 # A marker written by the SHIM (a guess from one failed run) also carries
 # `soft_until=<epoch>`: once that passes the account returns to the pool by itself, so
 # a misread never costs an account permanently. Markers written by claude-accounts —
-# a refresh grant that answered "revoked", a real verify call — carry no soft_until and
-# stay until the account provably works again.
+# a refresh grant that answered "revoked", a real verify call that failed to
+# authenticate — carry no soft_until and stay until the account provably works again.
+# An org block is the exception: verify's carries the shim's 6 h soft_until too, and a
+# verify the usage limiter refused lifts it (the limiter answers only past the org gate).
 expired_marked() { # $1 = acct dir
   local m="$1/.expired" mt f soft reason
   [ -f "$m" ] || return 1
@@ -1646,6 +1648,12 @@ expired_marked() { # $1 = acct dir
 # OAuth credential beside it is dead — the token is exported instead.
 auth_dead() { # $1 = acct dir
   expired_marked "$1" && return 0
+  if [ -s "$1/server.token" ] && { ! has_oauth "$1" || creds_dead "$1"; }; then
+    case ":${CLAUDE_MULTIACC_PREFLIGHT_SKIP:-}:" in *":${1##*/}:"*) return 0 ;; esac
+    if [ -f "$1/.server-token-identity.json" ]; then
+      [ "$(token_identity_state cached "$1")" = mismatch ] && return 0
+    fi
+  fi
   [ -s "$1/server.token" ] && return 1
   creds_dead "$1"
 }
@@ -1658,10 +1666,21 @@ acct_token() { # $1 = acct dir; prints token if the dir must authenticate by tok
   fi
 }
 
-# A setup-token has no identity or readable expiry, and `claude auth status` only
-# checks its shape. Test each token once on this machine with a real inference before
-# allowing it to carry a user's command. This closes the direct/TUI/--resume gap where
-# a revoked token exposed one 401 and was only parked on the following invocation.
+# auth status cannot identify a setup-token, but authenticated API response headers
+# name its organization, even on a quota rejection. Check that binding independently
+# of the old inference proof: a token can answer OK while spending another account.
+token_identity_state() { # $1 check|cached, $2 account dir, $3 exact token for check
+  local helper="$SELF_DIR/../lib/claude_token_identity.py" py="${CLAUDE_MULTIACC_PYTHON:-python3}"
+  [ -r "$helper" ] || return 0
+  if [ "$1" = check ]; then
+    printf '%s' "${3:-}" | "$py" "$helper" check "$2" --token-stdin --real "$REAL" --format state 2>/dev/null
+  else
+    "$py" "$helper" cached "$2" --format state 2>/dev/null
+  fi
+}
+
+# Test authentication independently; organization matching cannot prove a token is
+# still valid. The token and identity receipts are both bound to its exact digest.
 token_digest() { # $1 token; prints a non-secret sha256 digest
   local h=""
   if command -v shasum >/dev/null 2>&1; then
@@ -1672,8 +1691,16 @@ token_digest() { # $1 token; prints a non-secret sha256 digest
   printf '%s' "$h" | cut -d ' ' -f1
 }
 
-token_preflight() { # $1 acct dir, $2 setup-token; rc 1 only for proven invalid auth
+TOKEN_PREFLIGHT_FAILURE=""
+token_preflight() { # $1 acct dir, $2 setup-token; rc 1 only for proven unusable auth
   local d="$1" tok="$2" digest marker tmpd token_auth_pat rc=0
+  TOKEN_PREFLIGHT_FAILURE="invalid portable OAuth token (401)"
+  if [ "$(token_identity_state check "$d" "$tok")" = mismatch ]; then
+    TOKEN_PREFLIGHT_FAILURE="portable setup-token for a different organization; run: "
+    TOKEN_PREFLIGHT_FAILURE="${TOKEN_PREFLIGHT_FAILURE}claude-accounts login ${d##*/} --token"
+    sel_log "${d##*/} skipped (setup-token identity mismatch)"
+    return 1
+  fi
   digest="$(token_digest "$tok")"
   [ -n "$digest" ] || return 0
   marker="$d/.server-token-verified"
@@ -1723,8 +1750,8 @@ if [ -n "${CLAUDE_ACCOUNT:-}" ]; then
     tok="$(acct_token "$d")"
     if [ -n "$tok" ]; then
       if ! token_preflight "$d" "$tok"; then
-        printf 'claude-multiacc: pinned account %s has an invalid portable OAuth token (401)\n' \
-          "$CLAUDE_ACCOUNT" >&2
+        printf 'claude-multiacc: pinned account %s has a %s\n' \
+          "$CLAUDE_ACCOUNT" "$TOKEN_PREFLIGHT_FAILURE" >&2
         exit 1
       fi
       export CLAUDE_CODE_OAUTH_TOKEN="$tok"
@@ -2058,13 +2085,22 @@ if [ -n "$tok" ] && ! token_preflight "$pick" "$tok"; then
   num_ok "$preflight_depth" || preflight_depth=0
   if [ "$preflight_depth" -lt 64 ]; then
     export CLAUDE_MULTIACC_PREFLIGHT_DEPTH=$((preflight_depth + 1))
+    # Persistence can fail on a read-only pool. Exclude this token for the re-entry
+    # anyway, and never fall through into a token the preflight just rejected.
+    preflight_skip="${CLAUDE_MULTIACC_PREFLIGHT_SKIP:+$CLAUDE_MULTIACC_PREFLIGHT_SKIP:}"
+    export CLAUDE_MULTIACC_PREFLIGHT_SKIP="${preflight_skip}${pick##*/}"
     # An auto-resume chain survives the re-entry (see ---- auto-resume ----). '|' is
     # outside every chain field's charset, so it separates them unambiguously.
     [ -n "$AR_CHAIN" ] && export CLAUDE_MULTIACC_AR_CARRY="$AR_DEPTH|$AR_AVOID|$AR_HIST|$AR_CHAIN"
     exec "$SELF" "$@"
   fi
+  printf 'claude-multiacc: portable token preflight retry limit reached\n' >&2
+  exit 1
 fi
-unset CLAUDE_MULTIACC_PREFLIGHT_DEPTH
+unset CLAUDE_MULTIACC_PREFLIGHT_DEPTH CLAUDE_MULTIACC_PREFLIGHT_SKIP
+# Use the exact token that passed preflight. A concurrent mint/sync may replace the
+# file before exec; rereading it here would run an unchecked credential.
+PICK_TOKEN="$tok"
 
 # The picked account may be eligible only because its exhausted bucket belongs to a
 # model this run did not ask for. Handing it the default model anyway would open the
@@ -2165,7 +2201,7 @@ export CLAUDE_SHIM_ACTIVE=1
 # mirrored to every other one (exits inside); anything else falls through to exec.
 if [ "${1:-}" = "mcp" ] || { [ "${1:-}" = "--model" ] && [ "${3:-}" = "mcp" ]; }; then
   export CLAUDE_CONFIG_DIR="$pick"
-  tok="$(acct_token "$pick")"
+  tok="$PICK_TOKEN"
   [ -n "$tok" ] && export CLAUDE_CODE_OAUTH_TOKEN="$tok"
   mcp_mirror_run "$pick" "$@" || true
 fi
@@ -2197,7 +2233,7 @@ fi
 
 if [ "$wants_retry" = "0" ]; then
   export CLAUDE_CONFIG_DIR="$pick"
-  tok="$(acct_token "$pick")"
+  tok="$PICK_TOKEN"
   [ -n "$tok" ] && export CLAUDE_CODE_OAUTH_TOKEN="$tok"
   sel_capture_session "$pick"
   ar_trust "$pick"
@@ -2209,7 +2245,7 @@ fi
 mkdir -p "$ACC_ROOT/tmp" 2>/dev/null || true
 tmpd="$(mktemp -d "$ACC_ROOT/tmp/shim.XXXXXX" 2>/dev/null)" || {
   export CLAUDE_CONFIG_DIR="$pick"
-  tok="$(acct_token "$pick")"
+  tok="$PICK_TOKEN"
   [ -n "$tok" ] && export CLAUDE_CODE_OAUTH_TOKEN="$tok"
   sel_capture_session "$pick"
   exec "$REAL" "$@"
@@ -2221,7 +2257,7 @@ trap 'rm -rf "$tmpd"' EXIT
 # nonzero — a hard failure. Verify now, fall back to plain exec if we cannot.
 if ! : > "$tmpd/out" 2>/dev/null || ! : > "$tmpd/err" 2>/dev/null; then
   export CLAUDE_CONFIG_DIR="$pick"
-  tok="$(acct_token "$pick")"
+  tok="$PICK_TOKEN"
   [ -n "$tok" ] && export CLAUDE_CODE_OAUTH_TOKEN="$tok"
   sel_capture_session "$pick"
   exec "$REAL" "$@"
@@ -2242,11 +2278,13 @@ fi
 #   PARK_AUTH  — the credential is dead: a cooldown would just re-fail, so the account
 #                is parked until a re-login / a fetch that authenticates clears it.
 #   PARK_ORG   — the account's organization turned Claude Code access off; no re-login
-#                fixes that.
+#                fixes that. "ask your admin to enable ACCESS", never the bare prefix:
+#                the same client ends a 404 model_not_found with "…or ask your admin to
+#                enable this model", which says nothing about the organization.
 # Both shim-written parks carry a soft_until stamp, so even a false positive returns to
 # the pool on its own — the shim's guess must never outlive the evidence for it.
 PARK_AUTH='failed to authenticate|oauth (session|token)[a-z ]{0,20}(expired|invalid|revoked)|could not be refreshed|invalid api key|authentication_error|invalid bearer token|please run /login|run /login to'
-PARK_ORG='organization has disabled|subscription access[a-z ]{0,20}disabl|disabled claude subscription|ask your admin to enable|not authorized to use claude code'
+PARK_ORG='organization has disabled|subscription access[a-z ]{0,20}disabl|disabled claude subscription|ask your admin to enable access|not authorized to use claude code'
 # A usage limit can be scoped to ONE MODEL: "You've reached your Fable 5 limit.
 # Switch to another model, or manage usage credits..." — the account still has
 # capacity for every other model, and the endpoint says so in the message itself.
@@ -2306,6 +2344,7 @@ stream_reported_error() {
 
 attempt=1
 cur="$pick"
+cur_token="$PICK_TOKEN"
 rc=0
 stream_err=0       # the run exited 0 but the stream said otherwise
 rotated=0          # at most one account rotation, exactly as before
@@ -2315,7 +2354,7 @@ while :; do
   # Per ATTEMPT: a stream error seen on an earlier account must never decide the
   # exit status of a later one that failed for its own, real reason.
   stream_err=0
-  tok="$(acct_token "$cur")"
+  tok="$cur_token"
   if [ -n "$stdin_file" ]; then exec 3< "$stdin_file"; else exec 3< /dev/null; fi
   if [ -n "$tok" ]; then
     CLAUDE_CONFIG_DIR="$cur" CLAUDE_CODE_OAUTH_TOKEN="$tok" "$REAL" "${ARGV[@]}" <&3 > "$tmpd/out" 2> "$tmpd/err"
@@ -2391,14 +2430,22 @@ while :; do
     n="${#eligible[@]}"
     start=$((RANDOM % n))
     i=0
-    while [ "$i" -lt "$n" ]; do
+    while [ "$rotated" = 0 ] && [ "$i" -lt "$n" ]; do
       c="${eligible[$(((start + i) % n))]}"
-      if [ "$c" != "$cur" ]; then next="$c"; break; fi
+      if [ "$c" != "$cur" ] && ! auth_dead "$c"; then
+        candidate_token="$(acct_token "$c")"
+        if [ -z "$candidate_token" ] || token_preflight "$c" "$candidate_token"; then
+          next="$c"
+          next_token="$candidate_token"
+          break
+        fi
+      fi
       i=$((i+1))
     done
     if [ -n "$next" ] && [ "$rotated" = 0 ]; then
       sel_log "retry from=$(basename "$cur") to=$(basename "$next") rc=$rc"
       cur="$next"
+      cur_token="$next_token"
       # The account that actually serves the work is the one the next run should rotate
       # away from — not the one that bounced.
       remember_pick "$cur"