claude-multiacc 2.0.47 → 2.0.48

package/docs/ACCOUNT_OPERATIONS.md

@@ -279,7 +279,7 @@ providers (`lib/report.py`), so a consumer writes one parser:
     "portable": true,
     "credentials": {"oauth": true, "token": true, "oauth_expires_at": "…Z",
                     "oauth_refresh_expires_at": "…Z", "token_minted_at": "…Z",
-                    "token_age_days": 39},
+                    "token_age_days": 39, "org_access_verified_at": 1790765000.125},
     "limited": false, "limit_reset_at": null, "limit_detail": null,
     "usage": {"fetched_at": "…Z", "age_seconds": 41, "source": "oauth",
               // a null percent = that signal had no informative bucket; all three
@@ -306,6 +306,12 @@ A consumer that only distinguishes *usable / parked / needs-a-human* can read
 without the limit overlay. `limited` follows the shim's marker rule exactly — a marker
 whose reset time has passed does not count, an unreadable one does.
 
+Claude's optional `credentials.org_access_verified_at` is a Unix timestamp from the
+last real verification that passed the organisation access gate (a successful inference
+or a genuine usage-limit refusal). Missing or invalid proof is omitted. Consumers can
+use newer proof to lift an older organisation hold; a later refusal still keeps the
+account blocked. Usage telemetry, login and token verification alone are not recovery proof.
+
 A percent field is **null** when that signal had no informative bucket to aggregate. The
 writers keep the signals separate: `weekly_percent` comes from informative weekly buckets,
 `session_percent` from informative session ones, and each is omitted on its own when its

package/lib/claude_client_error.py

@@ -11,11 +11,29 @@ import argparse
 from datetime import datetime
 import json
 import math
+from pathlib import Path
 import sys
+import time
 
 ERRORS = {"authentication_failed": "auth", "oauth_org_not_allowed": "org-blocked"}
 
 
+def org_access_verified_at(account_dir, now=None):
+    """Read a bounded proof that this account's organization gate allowed inference."""
+    try:
+        with (Path(account_dir) / ".client-org-cleared").open("rb") as handle:
+            raw = handle.read(65)
+        if len(raw) > 64:
+            return None
+        stamp = float(raw.strip())
+        reference = time.time() if now is None else float(now)
+    except (OSError, ValueError, TypeError, OverflowError):
+        return None
+    if not math.isfinite(stamp) or not math.isfinite(reference) or not 0 < stamp <= reference + 300:
+        return None
+    return stamp
+
+
 def iso_epoch(value):
     """Return an aware ISO timestamp's epoch, or None when it cannot prove timing."""
     if not isinstance(value, str) or "T" not in value or any(c.isspace() for c in value):

package/lib/report.py

@@ -47,6 +47,7 @@ import time
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 import keychain  # noqa: E402
 from audit import creds_doc_state, token_verified  # noqa: E402
+from claude_client_error import org_access_verified_at  # noqa: E402
 from claude_reset import marker_superseded, record_from  # noqa: E402
 
 SCHEMA = 'claude-multiacc/pool.v1'
@@ -178,6 +179,9 @@ def _claude_credentials(d):
               # True once THIS exact token passed a real inference on this machine
               # (.server-token-verified); False = present but never proven here.
               'token_verified': token_verified(d, tpath) if has_token else None}
+    proof = org_access_verified_at(d)
+    if proof is not None:
+        detail['org_access_verified_at'] = proof
     o = None
     if has_oauth:
         detail['oauth_store'] = 'file'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.47",
+  "version": "2.0.48",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -9303,6 +9303,12 @@ else
   t_fail "claude persistent organization-block suite" "see unittest output above"
 fi
 
+if python3 "$REPO_DIR/tests/test_claude_org_report.py"; then
+  t_ok "claude: organization recovery report contract suite"
+else
+  t_fail "claude organization recovery report suite" "see unittest output above"
+fi
+
 # ---- summary ---------------------------------------------------------------------
 echo
 echo "passed: $PASS  failed: $FAIL"

package/tests/test_claude_client_error.py

@@ -7,6 +7,7 @@ import json
 from pathlib import Path
 import subprocess
 import sys
+import tempfile
 import unittest
 
 REPO = Path(__file__).resolve().parents[1]
@@ -114,6 +115,33 @@ class ClaudeClientErrorTests(unittest.TestCase):
                 result = subprocess.run(command + args, input=json.dumps(record), text=True, capture_output=True)
                 self.assertEqual((result.returncode, result.stdout, result.stderr), (1, "", ""))
 
+    def test_org_access_proof_returns_exact_stamp_with_clock_slack(self):
+        now = 1800000000.25
+        with tempfile.TemporaryDirectory(prefix="multiacc-client-org-proof-") as directory:
+            marker = Path(directory) / ".client-org-cleared"
+            for stamp in (now - 123.125, now, now + 0.125, now + 300):
+                with self.subTest(stamp=stamp):
+                    marker.write_text(f" {stamp}\n")
+                    self.assertEqual(errors.org_access_verified_at(directory, now), stamp)
+            marker.write_text(str(now).ljust(64))
+            self.assertEqual(errors.org_access_verified_at(directory, now), now)
+            stamp = errors.time.time() - 10
+            marker.write_text(repr(stamp))
+            self.assertEqual(errors.org_access_verified_at(directory), stamp)
+
+    def test_org_access_proof_ignores_missing_invalid_or_oversized_values(self):
+        now = 1800000000.25
+        with tempfile.TemporaryDirectory(prefix="multiacc-client-org-proof-") as directory:
+            marker = Path(directory) / ".client-org-cleared"
+            self.assertIsNone(errors.org_access_verified_at(directory, now))
+            invalid = [b"", b" ", b"NaN", b"Infinity", b"-Infinity", b"-10", b"0", b"true", b"false",
+                       b"True", b"null", b"{}", b"[]", b'"1800000000"', b"\xff", b"1" + b" " * 64,
+                       str(now + 300.001).encode()]
+            for raw in invalid:
+                with self.subTest(raw=raw):
+                    marker.write_bytes(raw)
+                    self.assertIsNone(errors.org_access_verified_at(directory, now))
+
 
 if __name__ == "__main__":
     unittest.main()

package/tests/test_claude_org_report.py

@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+"""The report publishes recovery proof without overriding a newer refusal."""
+
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import time
+import unittest
+
+REPO = Path(__file__).resolve().parents[1]
+
+
+class OrgReportTests(unittest.TestCase):
+    def setUp(self):
+        self.work = tempfile.TemporaryDirectory(prefix="multiacc-org-report-")
+        self.addCleanup(self.work.cleanup)
+        self.root = Path(self.work.name)
+        self.account = self.root / "acct-01"
+        self.account.mkdir()
+        self.now = time.time()
+        (self.root / "accounts.json").write_text(json.dumps({"version": 1, "server": "none",
+            "accounts": [{"id": "acct-01", "email": "fixture@example.invalid", "home": "mac"}]}))
+        (self.account / ".credentials.json").write_text(json.dumps({"claudeAiOauth": {
+            "accessToken": "synthetic", "refreshToken": "synthetic",
+            "expiresAt": (self.now + 86400) * 1000,
+            "refreshTokenExpiresAt": (self.now + 864000) * 1000}}))
+
+    def row(self, kind, provider="claude"):
+        result = subprocess.run([sys.executable, str(REPO / "lib/report.py"),
+            str(self.root), provider, "mac", kind], capture_output=True, text=True,
+            env={**os.environ, "CLAUDE_MULTIACC_KEYCHAIN": "0", "PYTHONDONTWRITEBYTECODE": "1"},
+            timeout=10, check=True)
+        self.assertEqual(result.stderr, "")
+        document = json.loads(result.stdout)
+        self.assertEqual(document["schema"], "claude-multiacc/pool.v1")
+        return document["accounts"][0]
+
+    def test_all_report_verbs_publish_proof_and_preserve_later_org_block(self):
+        stamp = self.now - 5.125
+        (self.account / ".client-org-cleared").write_text(repr(stamp))
+        for kind in ("list", "status", "limits"):
+            with self.subTest(kind=kind):
+                row = self.row(kind)
+                self.assertEqual(row["credentials"]["org_access_verified_at"], stamp)
+                self.assertEqual(row["status"], "active")
+                (self.account / ".expired").write_text(f"{int(self.now)}\nreason=org-blocked\n")
+                row = self.row(kind)
+                self.assertEqual(row["credentials"]["org_access_verified_at"], stamp)
+                self.assertEqual(row["status"], "blocked")
+                self.assertFalse(row["selectable"])
+                (self.account / ".expired").unlink()
+
+    def test_invalid_missing_and_other_provider_proofs_are_omitted(self):
+        marker = self.account / ".client-org-cleared"
+        self.assertNotIn("org_access_verified_at", self.row("list")["credentials"])
+        for text in ("NaN", "-1", str(self.now + 3600), "1" * 65):
+            with self.subTest(text=text):
+                marker.write_text(text)
+                self.assertNotIn("org_access_verified_at", self.row("status")["credentials"])
+        marker.write_text(repr(self.now))
+        self.assertNotIn("org_access_verified_at", self.row("list", "codex")["credentials"])
+
+
+if __name__ == "__main__":
+    unittest.main()