claude-multiacc 2.0.57 → 2.0.59

package/docs/INSTALLATION.md

@@ -46,7 +46,13 @@ postinstall, so `npm i -g claude-multiacc@latest` fully updates the shim, CLI, a
 A daily job (launchd on macOS, cron on Linux, 04:07) runs `claude-accounts self-update`
 to pull the latest release on its own — `npm i -g claude-multiacc@latest` for npm installs,
 `git pull && ./install.sh` for git checkouts; set `CLAUDE_MULTIACC_AUTOUPDATE=0` before install to
-opt out. `update-notifier` also prints a one-line nudge when a newer version is on npm.
+opt out. An npm install only ever moves UP: it installs the registry's version only when that
+is newer than its own, and nothing when it cannot read the registry's version. A build
+installed by hand ahead of a publish must carry a version at or above the registry's (the
+registry's own, or the next patch, which `node scripts/auto-version.mjs` writes into
+`package.json` in a checkout); it then stays until a newer release is published. A git
+checkout pulls with `--ff-only`. `update-notifier` also prints a one-line nudge when a newer
+version is on npm.
 (Note: newer npm versions gate install scripts; if postinstall is blocked, just run
 `claude-multiacc install` once.)
 

package/docs/VERIFICATION.md

@@ -88,6 +88,10 @@ repointed via `CLAUDE_BIN=/usr/local/bin/claude` and restarted healthy.
 
 - Tokens and credentials live as 0600 files under `~/.claude-accounts` (and
   `/root/.claude-accounts` on the server). Server compromise = account access.
+- `~/.claude-accounts/mcp-oauth.json` (0600) holds the MCP servers' OAuth logins every
+  account on this machine shares (README, *MCP OAuth logins*). It never leaves the machine:
+  sync and the limits fan-out push explicit file lists that do not name it, and
+  `mcp auth-status` / `ops.log` name servers, accounts and expiries, never a token.
 - `selection.log` records timestamps, accounts and cwd, and for auto-resume also
   session ids and error classes. It never records prompt or transcript text.
 - Rotating multiple subscriptions to spread usage may be flagged by anti-abuse systems;

package/lib/audit.py

@@ -24,6 +24,16 @@ the same document and the same machine-local class; the file is simply gone once
 client has moved it into the Keychain, so a file-only reading calls a working login
 "missing" (that is exactly what happened to a whole pool on 2026-08-28).
 
+That document is the client's whole credential store: it also keeps the OAuth state of
+the MCP servers the account signed into (`mcpOAuth`, `mcpOAuthClientConfig`, each entry
+with its own expiresAt/refreshToken). It holds a LOGIN only when it carries a
+`claudeAiOauth` object. From a session that cannot open the Keychain (ssh/tmux) Claude
+Code 2.1.303 writes a .credentials.json holding only MCP state as soon as an OAuth MCP
+server is discovered; counting that file as the login picked accounts that exported no
+token and could only say "Not logged in" (2026-10-19). Such a document is no login for
+any decision here — the Keychain item and server.token decide — and every expiry or
+refresh-token reading looks inside the login object alone (bin/claude: file_login).
+
 Run directly for a TSV dump:  python3 lib/audit.py <acc-root> [mac|linux]
 Columns: id, email, home, state, label, reason, fix
 """
@@ -59,6 +69,44 @@ def _nonempty(path):
         return False
 
 
+def _text(path):
+    try:
+        with open(path, errors='replace') as f:
+            return f.read()
+    except OSError:
+        return None
+
+
+# The login object found in a document's TEXT, as the shim isolates it (bin/claude:
+# cred_login_of): flat, so it ends at its first closing brace — or, in a truncated file,
+# at the end of the text. Only for a document that does not parse.
+_LOGIN_TEXT = re.compile(r'"claudeAiOauth"\s*:\s*\{[^}]*')
+
+
+def login_of(doc):
+    """The Claude login a parsed credential document carries — its `claudeAiOauth`
+    object — or None: a document holding only MCP OAuth state holds no login."""
+    o = doc.get('claudeAiOauth') if isinstance(doc, dict) else None
+    return o if isinstance(o, dict) else None
+
+
+def file_has_login(cpath):
+    """True when <cpath> (a .credentials.json) holds a Claude login, by the shim's rule
+    (bin/claude: file_login): a document carrying a `claudeAiOauth` object — or, for one
+    that does not parse (truncated, mid-write), text that still opens one. An empty file
+    or one with MCP state alone is no login: the Keychain and server.token decide."""
+    if not _nonempty(cpath):
+        return False
+    txt = _text(cpath)
+    if txt is None:
+        return False
+    try:
+        doc = json.loads(txt)
+    except (ValueError, RecursionError):
+        return bool(_LOGIN_TEXT.search(txt))
+    return login_of(doc) is not None
+
+
 def marker_reason(mpath):
     """Second line of a marker file, as a human string ('' when absent/unreadable)."""
     try:
@@ -109,15 +157,22 @@ def expired_marked(d, now=None):
             return False
     elif slug != 'org-blocked':
         mt = _mtime(mpath)
-        for name in ('.credentials.json', 'server.token'):
-            p = os.path.join(d, name)
-            if os.path.isfile(p) and _mtime(p) > mt:
+        p = os.path.join(d, 'server.token')
+        if os.path.isfile(p) and _mtime(p) > mt:
+            return False
+        # A newer LOGIN is the evidence a credential park is about. The client rewrites
+        # .credentials.json with MCP state alone on every MCP token refresh; that file
+        # proves nothing about the login and heals nothing.
+        cpath = os.path.join(d, '.credentials.json')
+        if file_has_login(cpath):
+            if _mtime(cpath) > mt:
                 return False
         # A login the client keeps in the Keychain is "written after the marker" in
         # exactly the same sense — its modification stamp is readable even when this
-        # session cannot open the secret.
-        if not os.path.isfile(os.path.join(d, '.credentials.json')) \
-                and keychain.item_mtime(d) > mt:
+        # session cannot open the secret. An item this session CAN read is judged by
+        # what it holds: MCP state alone heals nothing there either.
+        elif keychain.item_mtime(d) > mt \
+                and keychain.probe(d)['state'] in ('present', 'locked'):
             return False
     soft = marker_soft_until(detail)
     if soft is not None and soft <= now:
@@ -136,18 +191,22 @@ def _ms(value):
 
 def _scrape(cpath):
     """The shim's rule for a credential JSON cannot parse: sed out the numbers and the
-    presence of a refresh token (bin/claude: cred_num / creds_dead). Used so a
-    half-written file is judged the same way on both sides — audit.py must never call
-    an account dead that the shim is happily selecting."""
-    try:
-        txt = open(cpath, errors='replace').read()
-    except OSError:
+    presence of a refresh token (bin/claude: cred_num / creds_dead) — from the LOGIN
+    object alone, since every MCP entry beside it carries an expiresAt and a
+    refreshToken of its own. Used so a half-written file is judged the same way on both
+    sides — audit.py must never call an account dead that the shim is happily
+    selecting. None when the text opens no login at all."""
+    txt = _text(cpath)
+    m = _LOGIN_TEXT.search(txt) if txt is not None else None
+    if not m:
         return None
+    login = m.group(0)
+
     def num(key):
-        m = re.search(r'"%s"\s*:\s*(\d+)' % key, txt)
-        return float(m.group(1)) / 1000.0 if m else 0.0
+        found = re.search(r'"%s"\s*:\s*(\d+)' % key, login)
+        return float(found.group(1)) / 1000.0 if found else 0.0
     return {'exp': num('expiresAt'), 'rexp': num('refreshTokenExpiresAt'),
-            'has_refresh': bool(re.search(r'"refreshToken"\s*:\s*"[^"]', txt))}
+            'has_refresh': bool(re.search(r'"refreshToken"\s*:\s*"[^"]', login))}
 
 
 def creds_doc_state(doc, now):
@@ -171,7 +230,8 @@ def creds_doc_state(doc, now):
 
 
 def creds_state(cpath, now):
-    """(state, reason) for an on-disk .credentials.json."""
+    """(state, reason) for an on-disk .credentials.json that holds a login
+    (file_has_login) — a file without one is no login to judge."""
     scraped = None
     try:
         return creds_doc_state(json.load(open(cpath)), now)
@@ -191,12 +251,13 @@ def oauth_login(d, now):
     """Where <d>'s OAuth login lives and whether it can authenticate.
 
     Returns {'store': 'file'|'keychain'|None, 'state': 'ok'|'expired'|'locked'|None,
-             'reason': str, 'doc': dict|None}. The FILE wins when both exist: it is what
-    a session without keychain access (ssh) will use, and the client itself reads the
-    keychain first only when it can open it. 'locked' means the login exists in the
-    Keychain but this session cannot open it."""
+             'reason': str, 'doc': dict|None}. The FILE wins when it holds a login: it is
+    what a session without keychain access (ssh) will use, and the client itself reads
+    the keychain first only when it can open it. A file or item holding MCP state alone
+    is no login (store None unless the other place has one). 'locked' means the login
+    exists in the Keychain but this session cannot open it."""
     cpath = os.path.join(d, '.credentials.json')
-    if _nonempty(cpath):
+    if file_has_login(cpath):
         state, reason = creds_state(cpath, now)
         return {'store': 'file', 'state': state, 'reason': reason, 'doc': None}
     kc = keychain.probe(d)
@@ -215,6 +276,11 @@ def oauth_login(d, now):
                 'reason': ('OAuth login is in the macOS Keychain, which this session '
                            'cannot open (ssh/background) — it works from the Mac\'s own '
                            'session'), 'doc': None}
+    if kc['state'] == 'nologin' or _nonempty(cpath):
+        # The client's MCP OAuth state with no login beside it (or a file that is no
+        # credential at all): nothing here authenticates, whatever its entries' expiry.
+        return {'store': None, 'state': None, 'doc': None,
+                'reason': 'no Claude login here (the credential store holds no claudeAiOauth)'}
     return {'store': None, 'state': None, 'reason': '', 'doc': None}
 
 
@@ -356,7 +422,7 @@ def audit_account(root, acct, now=None, machine=None, require_verified_token=Fal
         row['reason'] = f'no auth here — the grant lives on the {home} machine'
     else:
         row['state'] = 'missing'
-        row['reason'] = 'no credentials on this machine'
+        row['reason'] = login['reason'] or 'no credentials on this machine'
     return done(row)