claude-multiacc 2.0.47 → 2.0.49

package/README.md

@@ -446,8 +446,8 @@ Every other launch, including `-p` and `codex exec`, runs exactly as before.
   (`lib/autoresume.py`, which needs `python3`). It reads that run's transcript (codex: its
   rollout).
 - **Probe.** Once an error settles, the watcher asks the shim, in probe mode, whether
-  another account has headroom. If none does, it **holds** and touches nothing, and
-  Claude's own "continuing automatically at …" carries on.
+  another account has headroom, including the 90–99% fallback for quota errors. If none
+  does, it **holds** and Claude's own "continuing automatically at …" carries on.
 - **Relaunch.** Otherwise it stops the TUI with SIGTERM and waits for the pane's shell
   prompt. It then types a one-line relaunch of the shim into that **shell**. It never
   sends a keystroke to the TUI, whose limit menu can add funds or spend the one-shot

package/bin/claude

@@ -447,8 +447,8 @@ ar_relaunch_apply() {
   return 0
 }
 
-# AVOID: accounts this chain just left, each until its own epoch. Filters `eligible` only
-# — never `valid` — so a pool with nowhere else to go still reaches the all-limited
+# AVOID: accounts this chain just left, each until its own epoch. Filters `eligible` and
+# the soft fallback, never `valid`, so a pool with nowhere else to go reaches the hard
 # fallback exactly as before. Builtins only: this runs once per candidate.
 ar_avoided() { # $1 acct dir
   local rest e id until
@@ -2038,7 +2038,7 @@ else
   soft=()
   hard=()
   for d in "${valid[@]}"; do
-    if limited_hard_blocked "$d"; then hard+=("$d"); else soft+=("$d"); fi
+    if ar_avoided "$d" || limited_hard_blocked "$d"; then hard+=("$d"); else soft+=("$d"); fi
   done
   if [ "${#soft[@]}" -gt 0 ]; then
     assess_telemetry "${soft[@]}"

package/bin/codex

@@ -1157,7 +1157,7 @@ for d in "$ACC_ROOT"/acct-*; do
   fi
   over_threshold "$d" && continue
   # An auto-resume relaunch (or its probe) skips the account the session just left until
-  # the reset it was handed. `eligible` only: the all-limited fallback still sees it.
+  # the reset it was handed. The soft fallback also skips it; the hard fallback still sees it.
   ar_avoided "$d" && continue
   eligible+=("$d")
 done
@@ -1318,7 +1318,7 @@ else
   soft=()
   hard=()
   for d in "${valid[@]}"; do
-    if limited_hard_blocked "$d"; then hard+=("$d"); else soft+=("$d"); fi
+    if ar_avoided "$d" || limited_hard_blocked "$d"; then hard+=("$d"); else soft+=("$d"); fi
   done
   # A probe only ASKS: the fallback lines below would claim a pick nobody launched.
   if [ "${#soft[@]}" -gt 0 ]; then

package/docs/ACCOUNT_OPERATIONS.md

@@ -279,7 +279,7 @@ providers (`lib/report.py`), so a consumer writes one parser:
     "portable": true,
     "credentials": {"oauth": true, "token": true, "oauth_expires_at": "…Z",
                     "oauth_refresh_expires_at": "…Z", "token_minted_at": "…Z",
-                    "token_age_days": 39},
+                    "token_age_days": 39, "org_access_verified_at": 1790765000.125},
     "limited": false, "limit_reset_at": null, "limit_detail": null,
     "usage": {"fetched_at": "…Z", "age_seconds": 41, "source": "oauth",
               // a null percent = that signal had no informative bucket; all three
@@ -306,6 +306,12 @@ A consumer that only distinguishes *usable / parked / needs-a-human* can read
 without the limit overlay. `limited` follows the shim's marker rule exactly — a marker
 whose reset time has passed does not count, an unreadable one does.
 
+Claude's optional `credentials.org_access_verified_at` is a Unix timestamp from the
+last real verification that passed the organisation access gate (a successful inference
+or a genuine usage-limit refusal). Missing or invalid proof is omitted. Consumers can
+use newer proof to lift an older organisation hold; a later refusal still keeps the
+account blocked. Usage telemetry, login and token verification alone are not recovery proof.
+
 A percent field is **null** when that signal had no informative bucket to aggregate. The
 writers keep the signals separate: `weekly_percent` comes from informative weekly buckets,
 `session_percent` from informative session ones, and each is omitted on its own when its

package/docs/AUTORESUME.md

@@ -83,9 +83,12 @@ shell:   runs the shim again → token → marker on the old account → normal
 4. **It asks before it acts.** The watcher runs the shim in *probe mode*
    (`CLAUDE_MULTIACC_AR_PROBE=1`). This is the same candidate loop and the same argv the
    relaunch will use. It prints `pick=acct-NN tier=…` and never execs.
-   - **Limit, login and refusal errors** probe with the current account excluded. They
-     rotate only when the probe finds an **unlimited account other than the current
-     one**.
+   - **Usage-limit errors** probe with the current account excluded. They prefer an
+     account below the pool's exclusion threshold (90% by default), then accept a
+     different `soft` fallback with remaining quota. An account at 90–99% can still
+     serve; an exhausted account or one with an active client rejection cannot.
+   - **Login, refusal and model-limit errors** still require a different account below
+     the exclusion threshold.
    - **Otherwise the watcher holds.** Nothing is stopped, and Claude's own "continuing
      automatically" keeps running. The probe repeats every 60 s for as long as the error
      stands.
@@ -296,9 +299,9 @@ CLAUDE_MULTIACC_AR_PROBE=1 CLAUDE_MULTIACC_AR_AVOID=acct-07:1790000000 claude
 ```
 
 - **`tier`** is one of:
-  - `eligible`: an unlimited account;
-  - `soft`: only the all-limited fallback;
-  - `hard`: only exhausted accounts are left;
+  - `eligible`: an account below the pool's exclusion threshold;
+  - `soft`: only the fallback with remaining quota, excluding accounts the chain avoids;
+  - `hard`: only exhausted accounts or accounts the chain avoids are left;
   - `none`: nothing is usable; exit 3.
 - **`resets_at`** (codex only): a `soft` or `hard` answer may end with
   ` resets_at=<epoch>`, when that tier's reset is known. For `hard` it is the soonest

package/docs/VERIFICATION.md

@@ -5,7 +5,7 @@
 ```bash
 tests/run-tests.sh            # sandboxed compatibility tests, no quota
 python3 tests/test_selector.py # unified selector contract
-python3 tests/test_autoresume.py # auto-resume classifier/relaunch unit tests (also run by run-tests.sh)
+python3 -m unittest discover -s tests -p 'test_autoresume*.py' # watchers and fallback probes (also in run-tests.sh)
 npm run test:commands         # packed npm commands; run npm install --ignore-scripts first
 claude-accounts verify        # real matrix: `claude -p "reply OK"` per authed account
 claude-accounts verify --quick # auth presence/expiry only, no inference

package/lib/autoresume.py

@@ -55,6 +55,10 @@ import tempfile
 import time
 import traceback
 
+# -I omits the script directory; load only helpers from this installation.
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from autoresume_probe import ACCT_RE, ROTATE, parse_probe, probe_allows, probe_env
+
 # ---- vocabulary ---------------------------------------------------------------------
 
 PROVIDERS = ("claude", "codex")
@@ -79,10 +83,6 @@ REASONS = {
     "crash": "the previous process exited unexpectedly",
 }
 
-# Classes that MOVE the session to a different account (the probe must offer an eligible
-# one that is not the current account). transient/crash may land on the same account.
-ROTATE = ("quota", "auth", "blocked", "model")
-
 # How long the chain keeps away from the account it is leaving. quota uses the server's
 # own reset instead (QUOTA_FALLBACK when it named none that is still ahead).
 AVOID_SECONDS = {"auth": 3600, "blocked": 6 * 3600, "model": 5 * 3600}
@@ -110,7 +110,6 @@ CODEX_CANCEL = ("user_message", "task_started", "turn_aborted")
 SHELLS = ("zsh", "bash", "sh", "dash", "ksh")
 
 TOKEN_ALPHABET = string.ascii_letters + string.digits
-ACCT_RE = re.compile(r"^acct-[A-Za-z0-9._-]{1,64}$")
 PANE_RE = re.compile(r"^%[0-9]{1,9}$")
 CHAIN_RE = re.compile(r"^[A-Za-z0-9]{1,64}$")
 TOKEN_RE = re.compile(r"^[A-Za-z0-9]{8,64}$")
@@ -1100,50 +1099,6 @@ def notice_argv(sock, pane, provider, sid, sticky=True):
                     "claude-multiacc: auto-resume failed — run: " + resume_hint(provider, sid))
 
 
-# ---- probe --------------------------------------------------------------------------
-
-PROBE_DROP = {
-    "claude": ("CLAUDE_CONFIG_DIR", "CLAUDE_CODE_OAUTH_TOKEN", "CLAUDE_SHIM_ACTIVE",
-               "CLAUDE_ACCOUNT", "CLAUDE_MULTIACC_AR"),
-    "codex": ("CODEX_HOME", "CODEX_SHIM_ACTIVE", "CODEX_ACCOUNT", "CODEX_MULTIACC_AR"),
-}
-
-
-def probe_env(environ, provider, avoid):
-    """The watcher inherited the picked account's exports; the probe must select from
-    scratch, so they go, and probe mode + the AVOID list come in."""
-    env = {k: v for k, v in environ.items() if k not in PROBE_DROP[provider]}
-    up = provider.upper()
-    env[up + "_MULTIACC_AR_PROBE"] = "1"
-    env[up + "_MULTIACC_AR_AVOID"] = avoid or ""
-    return env
-
-
-def parse_probe(out):
-    """The probe's ``pick=<acct> tier=<eligible|soft|hard|none>`` -> (pick, tier).
-
-    Trailing ``key=value`` fields (the codex shim's ``resets_at=<epoch>``) are accepted
-    and ignored here."""
-    pick, tier = "", ""
-    for line in (out or "").split("\n"):
-        m = re.match(r"^pick=(\S*) tier=(\S+)(?:\s+\w+=\S*)*\s*$", line.strip())
-        if m:
-            pick, tier = m.group(1), m.group(2)
-    if pick and not ACCT_RE.match(pick):
-        return "", ""
-    if tier not in ("eligible", "soft", "hard", "none"):
-        return "", ""
-    return pick, tier
-
-
-def probe_allows(cls, pick, tier, current):
-    """Rotate classes need an ELIGIBLE account that is not the one being left (holding
-    beats landing on a soft/hard fallback); transient/crash may retry anywhere usable."""
-    if cls in ROTATE:
-        return tier == "eligible" and bool(pick) and pick != current
-    return tier in ("eligible", "soft") and bool(pick)
-
-
 # ---- side effects -------------------------------------------------------------------
 
 def descendants(table, pid):

package/lib/autoresume_probe.py

@@ -0,0 +1,50 @@
+"""Probe environment, wire response and restart eligibility shared by both watchers."""
+
+import re
+
+
+ACCT_RE = re.compile(r"^acct-[A-Za-z0-9._-]{1,64}$")
+# These errors require a different account; transient/crash may retry the same one.
+ROTATE = ("quota", "auth", "blocked", "model")
+PROBE_DROP = {
+    "claude": ("CLAUDE_CONFIG_DIR", "CLAUDE_CODE_OAUTH_TOKEN", "CLAUDE_SHIM_ACTIVE",
+               "CLAUDE_ACCOUNT", "CLAUDE_MULTIACC_AR"),
+    "codex": ("CODEX_HOME", "CODEX_SHIM_ACTIVE", "CODEX_ACCOUNT", "CODEX_MULTIACC_AR"),
+}
+
+
+def probe_env(environ, provider, avoid):
+    """Remove the watched account's exports so the shim selects from the whole pool."""
+    env = {k: v for k, v in environ.items() if k not in PROBE_DROP[provider]}
+    up = provider.upper()
+    env[up + "_MULTIACC_AR_PROBE"] = "1"
+    env[up + "_MULTIACC_AR_AVOID"] = avoid or ""
+    return env
+
+
+def parse_probe(out):
+    """Read pick/tier, accepting trailing fields such as Codex's resets_at epoch."""
+    pick, tier = "", ""
+    for line in (out or "").split("\n"):
+        match = re.match(r"^pick=(\S*) tier=(\S+)(?:\s+\w+=\S*)*\s*$", line.strip())
+        if match:
+            pick, tier = match.group(1), match.group(2)
+    if pick and not ACCT_RE.match(pick):
+        return "", ""
+    if tier not in ("eligible", "soft", "hard", "none"):
+        return "", ""
+    return pick, tier
+
+
+def probe_allows(cls, pick, tier, current):
+    """Quota rotations may use remaining quota, as an ordinary shim launch already does.
+
+    The shim excludes chain-avoided accounts from soft fallback, and treats exhausted
+    accounts and observed client rejections as hard. Other rotation classes keep their
+    below-threshold requirement; transient/crash may retry anywhere still usable.
+    """
+    if cls == "quota":
+        return tier in ("eligible", "soft") and bool(pick) and pick != current
+    if cls in ROTATE:
+        return tier == "eligible" and bool(pick) and pick != current
+    return tier in ("eligible", "soft") and bool(pick)

package/lib/claude_client_error.py

@@ -11,11 +11,29 @@ import argparse
 from datetime import datetime
 import json
 import math
+from pathlib import Path
 import sys
+import time
 
 ERRORS = {"authentication_failed": "auth", "oauth_org_not_allowed": "org-blocked"}
 
 
+def org_access_verified_at(account_dir, now=None):
+    """Read a bounded proof that this account's organization gate allowed inference."""
+    try:
+        with (Path(account_dir) / ".client-org-cleared").open("rb") as handle:
+            raw = handle.read(65)
+        if len(raw) > 64:
+            return None
+        stamp = float(raw.strip())
+        reference = time.time() if now is None else float(now)
+    except (OSError, ValueError, TypeError, OverflowError):
+        return None
+    if not math.isfinite(stamp) or not math.isfinite(reference) or not 0 < stamp <= reference + 300:
+        return None
+    return stamp
+
+
 def iso_epoch(value):
     """Return an aware ISO timestamp's epoch, or None when it cannot prove timing."""
     if not isinstance(value, str) or "T" not in value or any(c.isspace() for c in value):

package/lib/report.py

@@ -47,6 +47,7 @@ import time
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 import keychain  # noqa: E402
 from audit import creds_doc_state, token_verified  # noqa: E402
+from claude_client_error import org_access_verified_at  # noqa: E402
 from claude_reset import marker_superseded, record_from  # noqa: E402
 
 SCHEMA = 'claude-multiacc/pool.v1'
@@ -178,6 +179,9 @@ def _claude_credentials(d):
               # True once THIS exact token passed a real inference on this machine
               # (.server-token-verified); False = present but never proven here.
               'token_verified': token_verified(d, tpath) if has_token else None}
+    proof = org_access_verified_at(d)
+    if proof is not None:
+        detail['org_access_verified_at'] = proof
     o = None
     if has_oauth:
         detail['oauth_store'] = 'file'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.47",
+  "version": "2.0.49",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -8773,8 +8773,8 @@ done
 out="$(cd "$ARW" && env "${AREC[@]}" CLAUDE_MULTIACC_AR_PROBE=1 \
   CLAUDE_MULTIACC_AR_AVOID="acct-01:$(( $(date +%s) + 3600 )),acct-02:$(( $(date +%s) + 3600 ))" \
   claude --dangerously-skip-permissions </dev/null 2>&1)"
-case "$out" in "pick=acct-0"[12]" tier=soft") t_ok "probe with every account avoided answers tier=soft" ;;
-  *) t_fail "probe tier=soft" "$out" ;; esac
+case "$out" in "pick=acct-0"[12]" tier=hard") t_ok "probe with every account avoided answers tier=hard" ;;
+  *) t_fail "probe tier=hard" "$out" ;; esac
 ar_logged "$ARC" 'all-limited fallback' \
   && t_fail "a probe logs no fallback pick" "$(grep 'all-limited' "$ARC/selection.log")" \
   || t_ok "a probe logs no fallback pick"
@@ -9279,7 +9279,7 @@ else
 fi
 # ...and the auto-resume watcher, unit by unit: classifiers, argv sanitizer, relaunch
 # files, budgets, tmux commands and a fake-runner walk through every stop/relaunch branch.
-if python3 -m unittest discover -s "$REPO_DIR/tests" -p 'test_autoresume.py'; then
+if python3 -m unittest discover -s "$REPO_DIR/tests" -p 'test_autoresume*.py'; then
   t_ok "auto-resume watcher unit suite"
 else
   t_fail "auto-resume watcher unit suite" "see unittest output above"
@@ -9303,6 +9303,12 @@ else
   t_fail "claude persistent organization-block suite" "see unittest output above"
 fi
 
+if python3 "$REPO_DIR/tests/test_claude_org_report.py"; then
+  t_ok "claude: organization recovery report contract suite"
+else
+  t_fail "claude organization recovery report suite" "see unittest output above"
+fi
+
 # ---- summary ---------------------------------------------------------------------
 echo
 echo "passed: $PASS  failed: $FAIL"

package/tests/test_autoresume_fallback.py

@@ -0,0 +1,134 @@
+#!/usr/bin/env python3
+"""Quota fallback regressions using disposable pools and simulated processes only."""
+
+import signal
+import unittest
+
+import test_autoresume as fixtures
+
+
+class QuotaFallbackTests(unittest.TestCase):
+    def scenario(self, provider):
+        case_type = fixtures.PoolCase if provider == "claude" else fixtures.CodexWatcherTests
+        case = case_type()
+        case.setUp()
+        self.addCleanup(case.tearDown)
+        reset = int(case.t0) + 7200
+        previous = "acct-03:%d" % (reset + 100)
+        if provider == "claude":
+            state = case.write_state(["--dangerously-skip-permissions"], avoid=previous)
+            case.registry()
+            path = case.transcript([fixtures.cc_quota(case.t0, resets=reset)])
+        else:
+            state = case.write_state(["--yolo", "resume", fixtures.CX_SID],
+                                     provider=provider, avoid=previous)
+            path = case.rollout([
+                fixtures.cx_meta(case.launched, cwd=str(case.work)),
+                fixtures.cx_tokens(case.t0, primary={"used_percent": 100,
+                    "window_minutes": 300, "resets_at": reset}),
+                fixtures.cx_error(case.t0, "usage_limit_exceeded")])
+        watcher, runner = case.watcher(state)
+        runner.probe_out = "pick=acct-02 tier=soft\n"
+        runner.at(case.t0 + 1500, lambda: runner.exit(case.PID))
+        return case, watcher, runner, path
+
+    def assert_rotation(self, case, watcher, runner, provider):
+        self.assertEqual(runner.signals, [(case.PID, signal.SIGTERM)])
+        case.assert_sequence(runner, provider)
+        fields, argv = case.relaunch_of(runner)
+        reset = int(case.t0) + 7200
+        avoid = "acct-01:%d,acct-03:%d" % (reset, reset + 100)
+        sid = fixtures.SID if provider == "claude" else fixtures.CX_SID
+        expected = ["--dangerously-skip-permissions", "--resume", sid] if provider == "claude" \
+            else ["resume", "--yolo", sid]
+        self.assertEqual(argv, expected + [fixtures.ar.resume_prompt("quota")])
+        self.assertEqual((fields["provider"], fields["class"], fields["acct"], fields["sid"]),
+                         (provider, "quota", "acct-01", sid))
+        self.assertEqual((fields["cwd"], fields["reset"], fields["depth"], fields["avoid"]),
+                         (str(case.work), str(reset), "1", avoid))
+        self.assertEqual(fields["rtype"], "five_hour" if provider == "claude" else "")
+        self.assertEqual(runner.probes[-1]["env"][provider.upper() + "_MULTIACC_AR_AVOID"], avoid)
+        self.assertIsNotNone(watcher.tracker.pending)
+        self.assertIn("probe=acct-02", case.log_lines()[-1])
+
+    def test_quota_uses_other_soft_account_for_both_providers(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                case, watcher, runner, _ = self.scenario(provider)
+                self.assertEqual(watcher.run(), 0)
+                self.assert_rotation(case, watcher, runner, provider)
+                self.assertEqual(len(runner.probes), 1)
+                self.assertEqual(case.events(), ["watch", "detect", "switch"])
+
+    def test_hard_same_account_and_missing_candidates_hold(self):
+        replies = ("pick=acct-02 tier=hard", "pick=acct-01 tier=soft",
+                   "pick=acct-01 tier=eligible", "pick= tier=none", "pick= tier=soft")
+        for provider in ("claude", "codex"):
+            for reply in replies:
+                with self.subTest(provider=provider, reply=reply):
+                    case, watcher, runner, _ = self.scenario(provider)
+                    runner.probe_out = reply + "\n"
+                    runner.at(case.t0 + 15, lambda: runner.exit(case.PID))
+                    self.assertEqual(watcher.run(), 0)
+                    self.assertEqual(len(runner.probes), 1)
+                    self.assertEqual((runner.signals, runner.sends, case.relaunch_files()), ([], [], []))
+                    self.assertEqual(case.events(), ["watch", "detect", "hold"])
+
+    def test_other_rotation_classes_keep_the_eligible_requirement(self):
+        for cls in ("auth", "blocked", "model"):
+            with self.subTest(error_class=cls):
+                self.assertFalse(fixtures.ar.probe_allows(cls, "acct-02", "soft", "acct-01"))
+                self.assertFalse(fixtures.ar.probe_allows(cls, "acct-02", "hard", "acct-01"))
+                self.assertTrue(fixtures.ar.probe_allows(cls, "acct-02", "eligible", "acct-01"))
+
+    def test_user_input_during_soft_probe_cancels_rotation(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                case, watcher, runner, path = self.scenario(provider)
+                record = fixtures.cc_user(case.t0 + 5, "stop, I will continue manually") \
+                    if provider == "claude" else fixtures.cx_event(case.t0 + 5,
+                        {"type": "user_message", "message": "stop, I will continue manually"})
+                original_run = runner.run
+
+                def run(argv, timeout, env=None, cwd=None):
+                    if argv[0] == case.self_path and not runner.probes:
+                        fixtures.append(path, [record])
+                    return original_run(argv, timeout, env=env, cwd=cwd)
+
+                runner.run = run
+                registry = case.root / "acct-01" / "sessions" / ("%d.json" % case.PID)
+                if provider == "claude":
+                    runner.at(case.t0 + 15, registry.unlink)
+                runner.at(case.t0 + 15, lambda: runner.exit(case.PID))
+                self.assertEqual(watcher.run(), 0)
+                self.assertEqual(len(runner.probes), 1)
+                self.assertIsNone(watcher.tracker.pending)
+                self.assertEqual((runner.signals, runner.sends, case.relaunch_files()), ([], [], []))
+
+    def test_prolonged_hold_reprobes_and_recovers_when_soft_capacity_returns(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                case, watcher, runner, _ = self.scenario(provider)
+                runner.probe_out = "pick=acct-02 tier=hard\n"
+                runner.at(case.t0 + 600,
+                          lambda: setattr(runner, "probe_out", "pick=acct-02 tier=soft\n"))
+                self.assertEqual(watcher.run(), 0)
+                self.assert_rotation(case, watcher, runner, provider)
+                self.assertEqual([round(probe["t"] - case.t0) for probe in runner.probes],
+                                 list(range(5, 606, 60)))
+                self.assertEqual(case.events(), ["watch", "detect", "hold", "switch"])
+
+    def test_soft_capacity_does_not_bypass_rotation_budget(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                case, watcher, runner, _ = self.scenario(provider)
+                watcher.st["hist"] = ",".join("quota:%d" % (case.t0 - offset) for offset in range(8))
+                runner.at(case.t0 + 15, lambda: runner.exit(case.PID))
+                self.assertEqual(watcher.run(), 0)
+                self.assertEqual((runner.probes, runner.signals, runner.sends), ([], [], []))
+                self.assertEqual(case.relaunch_files(), [])
+                self.assertIn("reason=rotate-budget", case.log_lines()[-1])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_autoresume_probe.py

@@ -0,0 +1,119 @@
+"""Real shim probes distinguish remaining quota from accounts this chain rejected.
+
+Every account, credential and provider executable is synthetic and local to a
+temporary HOME. Probe mode must never launch the provider or poll its network.
+"""
+
+import json
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+import time
+import unittest
+
+
+REPO = Path(__file__).resolve().parents[1]
+
+
+class AutoresumeProbeTests(unittest.TestCase):
+    def setUp(self):
+        work = tempfile.TemporaryDirectory(prefix="multiacc-ar-probe-")
+        self.addCleanup(work.cleanup)
+        self.home = Path(work.name)
+        self.now = int(time.time())
+        self.fakebin = self.home / "bin"
+        self.fakebin.mkdir()
+        self.env = {k: v for k, v in os.environ.items()
+                    if not k.startswith(("CLAUDE_", "CODEX_", "ANTHROPIC_", "OPENAI_"))
+                    and k not in ("TMUX", "TMUX_PANE")}
+        self.env.update(HOME=str(self.home), PATH=f"{self.fakebin}:{os.environ['PATH']}",
+                        PYTHONDONTWRITEBYTECODE="1")
+        for name in ("claude", "codex", "security", "curl"):
+            script = self.fakebin / name
+            script.write_text('#!/bin/sh\nprintf "%s\\n" "$0" >> "$HOME/unexpected-calls"\nexit 79\n')
+            script.chmod(0o755)
+        for provider in ("claude", "codex"):
+            root = self.home / provider
+            root.mkdir()
+            up = provider.upper()
+            self.env[up + "_ACCOUNTS_ROOT"] = str(root)
+            for key in ("KEYCHAIN", "MCP", "AUTORESUME", "AUTO_RESET", "CLIENT_LIMITS", "PATH_PROBE"):
+                self.env[up + "_MULTIACC_" + key] = "0"
+            self.env[up + "_MULTIACC_NO_SYNC"] = "1"
+            self.env[up + "_MULTIACC_NO_DISTRIBUTE"] = "1"
+            self.env[up + "_MULTIACC_HEADROOM_BAND"] = "0"
+            accounts = [{"id": f"acct-{i:02}", "email": f"fixture-{i}@example.invalid", "home": "mac"}
+                        for i in range(1, 4)]
+            (root / "accounts.json").write_text(json.dumps({
+                "version": 1, "server": "none", "threshold": 90, "accounts": accounts}))
+            for account, used in zip(accounts, (90, 96, 99)):
+                self.seed_account(provider, account["id"], used)
+
+    def seed_account(self, provider, account, used, reason="limits"):
+        path = self.home / provider / account
+        path.mkdir(exist_ok=True)
+        if provider == "claude":
+            credential = {"claudeAiOauth": {"accessToken": "synthetic", "refreshToken": "synthetic",
+                          "expiresAt": (self.now + 86400) * 1000}}
+            filename = ".credentials.json"
+        else:
+            credential = {"tokens": {"access_token": "synthetic", "refresh_token": "synthetic"}}
+            filename = "auth.json"
+        (path / filename).write_text(json.dumps(credential))
+        (path / "limits.json").write_text(json.dumps({
+            "fetched_at": self.now, "weekly_percent": used, "session_percent": 0,
+            "max_percent": used, "weekly_resets_epoch": self.now + 86400, "buckets": []}))
+        marked = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime(self.now))
+        (path / ".limited").write_text(f"{self.now + 86400}\n"
+            f"bucket=weekly_all percent={used} marked_at={marked} reason={reason}\n")
+
+    def probe(self, provider, avoid=""):
+        up = provider.upper()
+        env = {**self.env, up + "_MULTIACC_AR_PROBE": "1", up + "_MULTIACC_AR_AVOID": avoid}
+        result = subprocess.run([str(REPO / "bin" / provider)], env=env, cwd=self.home,
+                                capture_output=True, text=True, input="", timeout=30)
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        self.assertFalse((self.home / "unexpected-calls").exists(), result.stderr)
+        fields = dict(field.split("=", 1) for field in result.stdout.split())
+        return fields["pick"], fields["tier"]
+
+    def test_remaining_quota_is_soft_and_strictly_ranked(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                self.assertEqual(self.probe(provider), ("acct-01", "soft"))
+
+    def test_current_and_previous_chain_accounts_cannot_win_soft_fallback(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                avoid = f"acct-01:{self.now + 3600}"
+                self.assertEqual(self.probe(provider, avoid), ("acct-02", "soft"))
+                avoid += f",acct-02:{self.now + 3600}"
+                self.assertEqual(self.probe(provider, avoid), ("acct-03", "soft"))
+
+    def test_all_avoided_accounts_cannot_be_reported_as_usable(self):
+        avoid = ",".join(f"acct-{i:02}:{self.now + 3600}" for i in range(1, 4))
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                self.assertEqual(self.probe(provider, avoid)[1], "hard")
+
+    def test_expired_avoidance_restores_remaining_quota(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                self.assertEqual(self.probe(provider, f"acct-01:{self.now - 1}"), ("acct-01", "soft"))
+
+    def test_rejected_and_exhausted_accounts_remain_hard(self):
+        for provider in ("claude", "codex"):
+            for reason, used in (("client-rate-limit", 90), ("error-cooldown", 90), ("limits", 100)):
+                with self.subTest(provider=provider, reason=reason):
+                    self.seed_account(provider, "acct-01", used, reason)
+                    self.assertEqual(self.probe(provider), ("acct-02", "soft"))
+                    for account in ("acct-02", "acct-03"):
+                        self.seed_account(provider, account, used, reason)
+                    self.assertEqual(self.probe(provider)[1], "hard")
+                    self.seed_account(provider, "acct-02", 96)
+                    self.seed_account(provider, "acct-03", 99)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_claude_client_error.py

@@ -7,6 +7,7 @@ import json
 from pathlib import Path
 import subprocess
 import sys
+import tempfile
 import unittest
 
 REPO = Path(__file__).resolve().parents[1]
@@ -114,6 +115,33 @@ class ClaudeClientErrorTests(unittest.TestCase):
                 result = subprocess.run(command + args, input=json.dumps(record), text=True, capture_output=True)
                 self.assertEqual((result.returncode, result.stdout, result.stderr), (1, "", ""))
 
+    def test_org_access_proof_returns_exact_stamp_with_clock_slack(self):
+        now = 1800000000.25
+        with tempfile.TemporaryDirectory(prefix="multiacc-client-org-proof-") as directory:
+            marker = Path(directory) / ".client-org-cleared"
+            for stamp in (now - 123.125, now, now + 0.125, now + 300):
+                with self.subTest(stamp=stamp):
+                    marker.write_text(f" {stamp}\n")
+                    self.assertEqual(errors.org_access_verified_at(directory, now), stamp)
+            marker.write_text(str(now).ljust(64))
+            self.assertEqual(errors.org_access_verified_at(directory, now), now)
+            stamp = errors.time.time() - 10
+            marker.write_text(repr(stamp))
+            self.assertEqual(errors.org_access_verified_at(directory), stamp)
+
+    def test_org_access_proof_ignores_missing_invalid_or_oversized_values(self):
+        now = 1800000000.25
+        with tempfile.TemporaryDirectory(prefix="multiacc-client-org-proof-") as directory:
+            marker = Path(directory) / ".client-org-cleared"
+            self.assertIsNone(errors.org_access_verified_at(directory, now))
+            invalid = [b"", b" ", b"NaN", b"Infinity", b"-Infinity", b"-10", b"0", b"true", b"false",
+                       b"True", b"null", b"{}", b"[]", b'"1800000000"', b"\xff", b"1" + b" " * 64,
+                       str(now + 300.001).encode()]
+            for raw in invalid:
+                with self.subTest(raw=raw):
+                    marker.write_bytes(raw)
+                    self.assertIsNone(errors.org_access_verified_at(directory, now))
+
 
 if __name__ == "__main__":
     unittest.main()

package/tests/test_claude_org_report.py

@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+"""The report publishes recovery proof without overriding a newer refusal."""
+
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import time
+import unittest
+
+REPO = Path(__file__).resolve().parents[1]
+
+
+class OrgReportTests(unittest.TestCase):
+    def setUp(self):
+        self.work = tempfile.TemporaryDirectory(prefix="multiacc-org-report-")
+        self.addCleanup(self.work.cleanup)
+        self.root = Path(self.work.name)
+        self.account = self.root / "acct-01"
+        self.account.mkdir()
+        self.now = time.time()
+        (self.root / "accounts.json").write_text(json.dumps({"version": 1, "server": "none",
+            "accounts": [{"id": "acct-01", "email": "fixture@example.invalid", "home": "mac"}]}))
+        (self.account / ".credentials.json").write_text(json.dumps({"claudeAiOauth": {
+            "accessToken": "synthetic", "refreshToken": "synthetic",
+            "expiresAt": (self.now + 86400) * 1000,
+            "refreshTokenExpiresAt": (self.now + 864000) * 1000}}))
+
+    def row(self, kind, provider="claude"):
+        result = subprocess.run([sys.executable, str(REPO / "lib/report.py"),
+            str(self.root), provider, "mac", kind], capture_output=True, text=True,
+            env={**os.environ, "CLAUDE_MULTIACC_KEYCHAIN": "0", "PYTHONDONTWRITEBYTECODE": "1"},
+            timeout=10, check=True)
+        self.assertEqual(result.stderr, "")
+        document = json.loads(result.stdout)
+        self.assertEqual(document["schema"], "claude-multiacc/pool.v1")
+        return document["accounts"][0]
+
+    def test_all_report_verbs_publish_proof_and_preserve_later_org_block(self):
+        stamp = self.now - 5.125
+        (self.account / ".client-org-cleared").write_text(repr(stamp))
+        for kind in ("list", "status", "limits"):
+            with self.subTest(kind=kind):
+                row = self.row(kind)
+                self.assertEqual(row["credentials"]["org_access_verified_at"], stamp)
+                self.assertEqual(row["status"], "active")
+                (self.account / ".expired").write_text(f"{int(self.now)}\nreason=org-blocked\n")
+                row = self.row(kind)
+                self.assertEqual(row["credentials"]["org_access_verified_at"], stamp)
+                self.assertEqual(row["status"], "blocked")
+                self.assertFalse(row["selectable"])
+                (self.account / ".expired").unlink()
+
+    def test_invalid_missing_and_other_provider_proofs_are_omitted(self):
+        marker = self.account / ".client-org-cleared"
+        self.assertNotIn("org_access_verified_at", self.row("list")["credentials"])
+        for text in ("NaN", "-1", str(self.now + 3600), "1" * 65):
+            with self.subTest(text=text):
+                marker.write_text(text)
+                self.assertNotIn("org_access_verified_at", self.row("status")["credentials"])
+        marker.write_text(repr(self.now))
+        self.assertNotIn("org_access_verified_at", self.row("list", "codex")["credentials"])
+
+
+if __name__ == "__main__":
+    unittest.main()