claude-multiacc 2.0.57 → 2.0.59

package/lib/install_actions.sh

@@ -188,6 +188,24 @@ PYEOF
   fi
 }
 
+# The model/effort catalog auto-resume relaunches sessions with (lib/model_catalog.py), into
+# both pools on EVERY install and update: npm's postinstall and the git self-update both run
+# this installer. It runs before the scheduler step, because reloading the update agent can
+# end the very job that is running this install. Best-effort: a catalog that cannot be
+# written never fails an install, and the limits passes retry it within the hour.
+install_model_catalog() {
+  if ! model_catalog_on claude && ! model_catalog_on codex; then
+    echo "  model catalog: refresh switched off ($MODEL_CATALOG_OFF_BY)"
+    return 0
+  fi
+  if "$REPO_DIR/bin/claude-accounts" model-catalog refresh --quiet </dev/null >/dev/null 2>&1; then
+    echo "  model catalog: refreshed (auto-resume model and effort matching)"
+  else
+    echo "  note: the model catalog could not be refreshed; auto-resume uses the shipped copy" >&2
+  fi
+  return 0
+}
+
 # bash and sh read ~/.profile for a LOGIN shell when ~/.bash_profile and ~/.bash_login
 # are absent — `bash -lc`, `sh -lc`, a tmux/ssh session whose login shell is bash. Left
 # without a block, such a shell ends its startup with whatever /etc/profile and its own
@@ -265,6 +283,7 @@ do_install() {
 
   install_binaries
   install_pools
+  install_model_catalog
 
   # An INSTANCE install never rewrites the shell rc blocks: one interactive PATH
   # cannot serve two pools, and clobbering the default install's block would point

package/lib/keychain.py

@@ -40,33 +40,44 @@ Hence the rules here:
     report, verify and the marker checks must not count it (a fallback that did made
     ``list --json`` advertise accounts the shim never picks, and made ``verify`` test a
     token-backed account on a login its client could not see, then park it);
-  - ``probe(d, legacy=True)`` adds the old no ``-a`` first match when no canonical item
-    exists. Only the limits pass (which then moves such a login under the canonical
-    name) and ``dedupe`` (which must not throw away a stranded grant) ask for it; it
-    costs a second call when no canonical item exists;
-  - :func:`write` always targets the canonical name. Once the canonical item reads back
-    with the access token just written, it deletes each other item that is provably
-    spent: the same grant (the written refresh token, or the ``supersedes`` one a
-    refresh started from), a dead login, or not a credential at all. A LIVE other grant
-    stays — after a sign-in as the wrong account the client itself put the intruder's
-    grant under the canonical name, and the right account's login may be that sibling;
+  - ``probe(d, legacy=True)`` adds the old no ``-a`` first match when the canonical item
+    holds no login (none exists, or it holds MCP state only). Only the limits pass (which
+    then moves such a login under the canonical name) and ``dedupe`` (which must not
+    throw away a stranded grant) ask for it; it costs a second call in that case only;
+  - :func:`write` always targets the canonical name, and lands INTO the document the
+    item holds: the keys it is given replace theirs, every other top-level key (the
+    client's MCP OAuth state) stays. Once the canonical item reads back with the access
+    token just written, it deletes each other item that is provably spent: the same
+    grant (the written refresh token, or the ``supersedes`` one a refresh started from),
+    a dead login, or not a credential at all. A LIVE other grant stays — after a sign-in
+    as the wrong account the client itself put the intruder's grant under the canonical
+    name, and the right account's login may be that sibling;
   - :func:`delete` removes every item for the service, whatever its name;
-  - :func:`prune` deletes all non-canonical items, and ONLY when the canonical item is
+  - :func:`prune` deletes the non-canonical items, and ONLY when the canonical item is
     present, readable and a live credential (audit.creds_doc_state 'ok'). It never
-    writes and never handles the secret beyond that read. The sign-in commands run it
+    writes and never handles the secret beyond those reads. The sign-in commands run it
     once the ceremony's identity check has passed — never before, so a sign-in as the
     wrong account cannot cost the right account its login.
 
+The document is the client's whole credential store, not only the login: beside
+``claudeAiOauth`` (the Claude login) it keeps its MCP servers' OAuth state (``mcpOAuth``,
+``mcpOAuthClientConfig``; 2.1.303). An item is a LOGIN only when it carries a
+``claudeAiOauth`` object; one holding only the rest is MCP state — no login for any
+decision (``nologin``), and never deleted as "not a credential" by write or prune.
+
 This module is the one place that knows the keychain layout. Everything else asks
 :func:`probe`, which never raises and never prints the secret.
 
 States returned by :func:`probe`:
   present      the item exists and this process could read it (``doc`` is the parsed
                ``{"claudeAiOauth": …}`` document, identical in shape to the file)
+  nologin      the item exists and was readable, a JSON object WITHOUT a login (the
+               client's MCP OAuth state alone); ``doc`` is that document. No login here,
+               exactly as if there were no item; ``legacy=True`` then looks further
   locked       the item exists but this session cannot open the keychain (exit 36) —
                a GUI-session process on this Mac CAN use it; an ssh session cannot
   absent       no such item
-  corrupt      the item exists and was readable, but is not a credential document
+  corrupt      the item exists and was readable, but is not a JSON object at all
   unavailable  not macOS, no ``security`` tool, or it failed in a way that says
                nothing about the item (timeout, crash)
 ``account`` is the name of the item that answered: the canonical one, or with
@@ -196,16 +207,34 @@ def _names(service, skip=()):
     return True, names
 
 
-def _credential(text):
+def _credential(text, any_object=False):
+    """The parsed item when it carries a Claude login (a ``claudeAiOauth`` object), else
+    None. ``any_object=True`` returns every JSON object — MCP state with no login among
+    them — and None only for a secret that is no JSON object at all."""
     try:
         doc = json.loads(text.strip())
     except ValueError:
         return None
-    if isinstance(doc, dict) and isinstance(doc.get('claudeAiOauth'), dict):
+    if not isinstance(doc, dict):
+        return None
+    if any_object or isinstance(doc.get('claudeAiOauth'), dict):
         return doc
     return None
 
 
+def _item_state(doc):
+    """probe's verdict on a secret parsed by ``_credential(text, any_object=True)``."""
+    if doc is None:
+        return 'corrupt'
+    return 'present' if isinstance(doc.get('claudeAiOauth'), dict) else 'nologin'
+
+
+def _keeps_other_state(doc):
+    """True when an item holds something besides the login — the client's MCP OAuth
+    state, which no multiacc sweep may throw away with a spent or missing login."""
+    return isinstance(doc, dict) and any(key != 'claudeAiOauth' for key in doc)
+
+
 def _doc_state(doc):
     """audit.creds_doc_state's verdict ('ok' / 'expired') on a parsed credential — the
     one rule for "can this login work", imported lazily because audit imports this
@@ -222,11 +251,11 @@ def _doc_state(doc):
 
 def _legacy_probe(service, result):
     """The lookup as it was before canonical names: the no ``-a`` first match. Only
-    ``probe(legacy=True)`` asks for it, and only when no canonical item exists."""
+    ``probe(legacy=True)`` asks for it, and only when the canonical item holds no login."""
     rc, out, _err = _run(['find-generic-password', '-s', service, '-w'])
     if rc == 0:
-        doc = _credential(out)
-        result.update(state='present' if doc is not None else 'corrupt', doc=doc)
+        doc = _credential(out, any_object=True)
+        result.update(state=_item_state(doc), doc=doc)
     elif rc == EXIT_NOT_FOUND:
         result['state'] = 'absent'
     elif rc == EXIT_NO_INTERACTION:
@@ -242,9 +271,9 @@ def probe(config_dir, legacy=False):
     """Never raises, never logs the secret. See the module doc for the states. Reads
     the item under :func:`canonical_account` — the one a multiacc-launched client reads
     — in ONE ``security`` call (two only for a locked keychain, to tell it from an
-    absent item). ``legacy=True`` falls back to the old no ``-a`` first match when no
-    canonical item exists (a second call); only a caller that migrates such an item or
-    must not discard it asks for that."""
+    absent item). ``legacy=True`` falls back to the old no ``-a`` first match when the
+    canonical item holds no login — none exists, or it holds MCP state only (a second
+    call); only a caller that migrates such an item or must not discard it asks for that."""
     service = service_name(config_dir)
     canonical = canonical_account()
     result = {'state': 'unavailable', 'service': service, 'doc': None,
@@ -255,9 +284,15 @@ def probe(config_dir, legacy=False):
         return result
     rc, out, _err = _run(['find-generic-password', '-a', canonical, '-s', service, '-w'])
     if rc == 0:
-        doc = _credential(out)
-        result.update(state='present' if doc is not None else 'corrupt', doc=doc,
-                      account=canonical)
+        doc = _credential(out, any_object=True)
+        result.update(state=_item_state(doc), doc=doc, account=canonical)
+        if result['state'] == 'nologin' and legacy:
+            # MCP state alone is no login — exactly as if the item were absent — so the
+            # migration read looks for one stranded under another name, as it would then.
+            found = _legacy_probe(service, dict(result, state='unavailable', doc=None,
+                                                account=None))
+            if found['state'] == 'present':
+                return found
         return result
     if rc == EXIT_NO_INTERACTION:
         arc, _acct, modified = _attributes(service, canonical)
@@ -292,6 +327,13 @@ def write(config_dir, doc, account=None, supersedes=None):
     and IGNORED: the canonical name is the one item a multiacc-launched client reads.
     True when the add succeeded.
 
+    ``doc`` lands INTO the document the item holds now: its top-level keys replace the
+    item's and every other key stays. The client keeps its MCP servers' OAuth state
+    (``mcpOAuth``, ``mcpOAuthClientConfig``) in that same item, and a login write that
+    replaced the document would sign every one of them out — so a caller passes only the
+    keys it owns (a refresh writes ``{"claudeAiOauth": …}``). An item that cannot be
+    read first (locked, a failing tool) is never written blind.
+
     Once the canonical item reads back with the access token just written, each other
     item for the service is read and deleted when it is provably spent: it holds the
     same grant (the written refresh token, or ``supersedes`` — the refresh token a
@@ -299,7 +341,8 @@ def write(config_dir, doc, account=None, supersedes=None):
     login, or no credential at all. A live OTHER grant is kept: a sign-in as the wrong
     account puts the intruder's grant under the canonical name, and a refresh of it must
     not destroy the right account's login beside it — only a sign-in whose identity
-    checked out may (:func:`prune`). Those reads cost calls on a write only.
+    checked out may (:func:`prune`). An item carrying MCP state is kept whatever its
+    login. Those reads cost calls on a write only.
 
     The document is passed on argv — the same choice the client makes when its payload
     does not fit `security -i`'s line limit; ``ps`` exposure lasts milliseconds and is
@@ -309,7 +352,15 @@ def write(config_dir, doc, account=None, supersedes=None):
         return False
     service = service_name(config_dir)
     canonical = canonical_account()
-    payload = json.dumps(doc, separators=(',', ':')).encode('utf-8').hex()
+    rc, out, _err = _run(['find-generic-password', '-a', canonical, '-s', service, '-w'])
+    if rc == 0:
+        merged = dict(_credential(out, any_object=True) or {})
+    elif rc == EXIT_NOT_FOUND:
+        merged = {}
+    else:
+        return False
+    merged.update(doc if isinstance(doc, dict) else {})
+    payload = json.dumps(merged, separators=(',', ':')).encode('utf-8').hex()
     rc, _out, _err = _run(['add-generic-password', '-U', '-a', canonical, '-s', service,
                            '-X', payload])
     if rc != 0:
@@ -326,10 +377,13 @@ def write(config_dir, doc, account=None, supersedes=None):
         rc, out, _err = _run(['find-generic-password', '-a', name, '-s', service, '-w'])
         if rc != 0:
             continue                 # gone, or cannot be judged: leave it
-        other = _credential(out)
-        grant = other['claudeAiOauth'].get('refreshToken') if other is not None else None
-        if other is not None and not (isinstance(grant, str) and grant in spent) \
-                and _doc_state(other)[0] == 'ok':
+        other = _credential(out, any_object=True)
+        if _keeps_other_state(other):
+            continue                 # the client's MCP state rides on it: never ours
+        login = other if _item_state(other) == 'present' else None
+        grant = login['claudeAiOauth'].get('refreshToken') if login is not None else None
+        if login is not None and not (isinstance(grant, str) and grant in spent) \
+                and _doc_state(login)[0] == 'ok':
             continue                 # a live grant of its own
         _run(['delete-generic-password', '-a', name, '-s', service])
     return True
@@ -357,8 +411,9 @@ def delete(config_dir):
 def prune(config_dir):
     """Delete the items for the dir that sit under any name but the canonical one —
     only when the canonical item is present, readable and a live credential by the
-    audit's own rule. Never writes; a no-op in every other case. Returns (ok, one-line
-    status); the status names accounts and states only, never the secret."""
+    audit's own rule — except an item carrying the client's MCP state, which is never
+    pruned. Never writes; a no-op in every other case. Returns (ok, one-line status);
+    the status names accounts and states only, never the secret."""
     if not enabled():
         return True, 'skip: keychain lookups are off'
     service = service_name(config_dir)
@@ -370,23 +425,32 @@ def prune(config_dir):
         return True, 'skip: keychain locked for this session'
     if rc != 0:
         return True, 'skip: keychain unavailable'
-    doc = _credential(out)
+    doc = _credential(out, any_object=True)
     if doc is None:
         return True, f'skip: the item under {canonical} is not a credential'
+    if _item_state(doc) == 'nologin':
+        return True, f'skip: the item under {canonical} holds no login (MCP state only)'
     state, reason = _doc_state(doc)
     if state != 'ok':
         return True, f'skip: the login under {canonical} is {state} ({reason})'
     ok, siblings = _names(service, skip=(canonical,))
-    removed, left = [], []
+    removed, left, mcp = [], [], []
     for name in siblings:
+        rc, out, _err = _run(['find-generic-password', '-a', name, '-s', service, '-w'])
+        if rc == 0 and _keeps_other_state(_credential(out, any_object=True)):
+            mcp.append(name)         # the client's MCP state rides on it: never pruned
+            continue
         rc, _out, _err = _run(['delete-generic-password', '-a', name, '-s', service])
         (removed if rc in (0, EXIT_NOT_FOUND) else left).append(name)
+    kept = canonical + (f" and MCP state under {','.join(mcp)}" if mcp else '')
     if left or not ok:
-        return False, (f"failed: kept {canonical}, removed {','.join(removed) or '-'}, "
+        return False, (f"failed: kept {kept}, removed {','.join(removed) or '-'}, "
                        f"left {','.join(left) or '-'}"
                        + ('' if ok else ' (could not list every item)'))
     if removed:
-        return True, f"pruned: kept {canonical}, removed {','.join(removed)}"
+        return True, f"pruned: kept {kept}, removed {','.join(removed)}"
+    if mcp:
+        return True, f'ok: the login under {kept}'
     return True, f'ok: one item, under {canonical}'
 
 
@@ -421,5 +485,85 @@ def main(argv):
     return 0
 
 
+# ---------------------------------------------------------------- the raw document
+# The client keeps ONE JSON document per config dir: the login under `claudeAiOauth`
+# beside other state — `mcpOAuth`, MCP servers' OAuth logins (lib/mcp_oauth.py). Every
+# function above judges the login; these two read and write the document whatever it
+# holds, for the one caller that merges a key into it and leaves the rest alone.
+
+#: `security -i` reads each command line into a 4096-byte buffer; Claude Code keeps 64
+#: bytes of headroom and passes a longer command on argv instead (2.1.303).
+SECURITY_STDIN_LIMIT = 4096 - 64
+
+
+def _run_input(args, data, timeout=TIMEOUT_S):
+    """:func:`_run` with ``data`` on stdin."""
+    try:
+        p = subprocess.run(['security'] + list(args), input=data, capture_output=True,
+                           text=True, timeout=timeout)
+    except (OSError, subprocess.SubprocessError):
+        return None, '', ''
+    return p.returncode, p.stdout or '', p.stderr or ''
+
+
+def _json_object(text):
+    """The JSON object `find-generic-password -w` printed, or None. The tool prints a
+    secret it cannot show as text in hex, so that spelling is accepted too."""
+    text = (text or '').strip()
+    try:
+        doc = json.loads(text)
+    except ValueError:
+        if not re.fullmatch(r'(?:[0-9A-Fa-f]{2})+', text):
+            return None
+        try:
+            doc = json.loads(bytes.fromhex(text).decode('utf-8'))
+        except ValueError:
+            return None
+    return doc if isinstance(doc, dict) else None
+
+
+def read_doc(config_dir, timeout=TIMEOUT_S):
+    """(state, doc) of the canonical item — the one a multiacc-launched client reads —
+    whatever the document holds: 'present' with the parsed JSON object, 'absent' (exit
+    44; also when lookups are off), 'locked' (exit 36: the item exists and this session
+    cannot open the keychain), 'corrupt' (readable, not a JSON object) or 'unavailable'
+    (no keychain here, or the tool failed). ONE `security` call; never raises, never
+    prints the secret."""
+    if not enabled():
+        off = os.environ.get('CLAUDE_MULTIACC_KEYCHAIN', '').strip().lower() \
+            in ('0', 'false', 'no', 'off')
+        return ('absent' if off else 'unavailable'), None
+    rc, out, _err = _run(['find-generic-password', '-a', canonical_account(), '-s',
+                          service_name(config_dir), '-w'], timeout=timeout)
+    if rc == 0:
+        doc = _json_object(out)
+        return ('present', doc) if doc is not None else ('corrupt', None)
+    if rc == EXIT_NOT_FOUND:
+        return 'absent', None
+    if rc == EXIT_NO_INTERACTION:
+        return 'locked', None
+    return 'unavailable', None
+
+
+def write_doc(config_dir, doc, timeout=TIMEOUT_S):
+    """Store ``doc`` as the canonical item the way the client's own update() does:
+    ``add-generic-password -U -a <name> -s <svc> -X <hex>`` typed into `security -i` on
+    stdin while the command fits the tool's line buffer — the secret never reaches argv —
+    and passed on argv only beyond :data:`SECURITY_STDIN_LIMIT`. ``-U`` CREATES a missing
+    item, so a caller writes only an item it has just read. True when `security` took
+    the write; the caller reads it back to know what landed. Never prints the secret."""
+    if not enabled():
+        return False
+    canonical, service = canonical_account(), service_name(config_dir)
+    payload = json.dumps(doc, separators=(',', ':')).encode('utf-8').hex()
+    command = f'add-generic-password -U -a "{canonical}" -s "{service}" -X "{payload}"\n'
+    if len(command) <= SECURITY_STDIN_LIMIT:
+        rc, _out, _err = _run_input(['-i'], command, timeout=timeout)
+    else:
+        rc, _out, _err = _run(['add-generic-password', '-U', '-a', canonical, '-s', service,
+                               '-X', payload], timeout=timeout)
+    return rc == 0
+
+
 if __name__ == '__main__':
     sys.exit(main(sys.argv))