claude-multiacc 2.0.58 → 2.0.60

package/bin/claude

@@ -123,20 +123,115 @@ mcp_ensure() { # $1 acct dir — silent, never changes the exit status
   return 0
 }
 
+# ---- MCP OAuth logins for every account (lib/mcp_oauth.py) ------------------------
+# The client keeps an MCP server's OAuth login in the config dir's credential store
+# (`mcpOAuth` in .credentials.json, or in the account's Keychain item) — so a server
+# authenticated under one pooled account said "needs authentication" under every other
+# (2026-10-19: five separate higgsfield grants in five accounts, stubs everywhere else).
+# The pool keeps the newest login per server in <pool>/mcp-oauth.json (machine-local,
+# never synced) and merges it into the picked account's stores right before exec — a
+# setup-token account with no .credentials.json gets one holding MCP state alone, which
+# file_login reads as no login, so its token is still exported — and only behind a
+# recent refreshing limits pass: one shared login, one refresher. No network here:
+# refreshing is that pass's job. Bash only on the hot path —
+# python runs when an account's file changed since the last harvest (the mtime of
+# <pool>/.mcp-oauth-seen) and either a store exists or that file carries MCP OAuth state,
+# or when the store changed since this account last got it (its <dir>/.mcp-oauth-applied
+# stamp).
+# Fail-open: python bounds its own run and never changes the exit status.
+MCP_OAUTH_PY="$SELF_DIR/../lib/mcp_oauth.py"
+mcp_oauth_ensure() { # $1 acct dir — silent, never changes the exit status
+  [ "${CLAUDE_MULTIACC_MCP_OAUTH:-1}" = "0" ] && return 0
+  [ -f "$MCP_OAUTH_PY" ] || return 0
+  local store="$ACC_ROOT/mcp-oauth.json" f changed=0 run=0
+  local -a creds
+  creds=("$ACC_ROOT"/acct-*/.credentials.json)
+  # -nt is also true when the right-hand file is missing: a first look always runs.
+  for f in "${creds[@]}"; do
+    if [ "$f" -nt "$ACC_ROOT/.mcp-oauth-seen" ]; then changed=1; break; fi
+  done
+  if [ -f "$store" ]; then
+    if [ "$changed" = 1 ] || [ "$store" -nt "$1/.mcp-oauth-applied" ]; then run=1; fi
+  elif [ "$changed" = 1 ] && LC_ALL=C grep -qs '"mcpOAuth"' "${creds[@]}" 2>/dev/null; then
+    run=1                                   # no store yet: a grep, and only after a change
+  fi
+  [ "$run" = 1 ] || return 0
+  "$MCP_PYBIN" "$MCP_OAUTH_PY" ensure --root "$ACC_ROOT" --account-dir "$1" --quiet \
+    >/dev/null 2>&1 </dev/null || true
+  return 0
+}
+
 # `claude mcp add|add-json|remove` writes ONE account's .claude.json — the one it ran
 # under — and nobody else's. So the shim runs it as a child instead of exec-ing it, then
 # mirrors what it wrote into the registry and every other account (`learn` diffs the
 # account against a snapshot taken just before). The real CLI's own parser and writer do
 # the work; the shim only copies the outcome. Exits with the real binary's status; a
 # mirror failure is one hint line. Returns 1 when this run is not such a command.
+# The index of the first positional argument as the real CLI's parser (commander) finds
+# it: global options may come first, in any number. The operator's `alias claude='claude
+# --dangerously-skip-permissions'` puts one in front of every `claude mcp add` typed at a
+# prompt, and the scoped-limit fallback prepends `--model X`; the mirror once looked at $1
+# alone, so on 2026-10-22 motionsites (and playwright, inspo) sat in the one account a
+# typed add ran under. A value option skips its value; an optional-value one the next
+# word unless it is an option; a variadic one every word up to the next option. `--`, or
+# a positional after `--` counts (commander's own rule). No positional: status 1. Options
+# of claude 2.1.308 (`claude --help`; hidden ones left out on purpose): an unknown one
+# counts as a flag — at worst its value is taken for the positional, which is then no
+# `mcp`, the run is not mirrored, and the registry's adoption picks the server up instead.
+CLI_VALUE_OPTS=" --agent --agents --append-system-prompt --append-system-prompt-file \
+--autocompact --debug-file --effort --environment --fallback-model --input-format \
+--json-schema --max-budget-usd --model -n --name --output-format --permission-mode \
+--permission-prompts --permission-prompt-tool --plugin-dir --plugin-url \
+--remote-control-session-name-prefix --session-id --setting-sources --settings \
+--system-prompt --system-prompt-file --system-prompt-snapshot "
+CLI_OPTIONAL_OPTS=" -d --debug --cloud --from-pr --prompt-suggestions --remote-control --rc \
+--remote -r --resume --teleport -w --worktree "
+CLI_VARIADIC_OPTS=" --add-dir --allowedTools --allowed-tools --betas --disallowedTools \
+--disallowed-tools --file --mcp-config --tools "
+cli_positional_at() { # argv -> prints the index of its first positional argument
+  local i=1 a nx
+  while [ "$i" -le "$#" ]; do
+    a="${!i}"
+    case "$a" in
+      --) i=$((i + 1)); [ "$i" -le "$#" ] || return 1; printf '%s\n' "$i"; return 0 ;;
+      --*=*) i=$((i + 1)); continue ;;
+      -?*) ;;
+      *) printf '%s\n' "$i"; return 0 ;;
+    esac
+    i=$((i + 1))
+    case "$CLI_VALUE_OPTS" in *" $a "*) i=$((i + 1)); continue ;; esac
+    case "$CLI_OPTIONAL_OPTS" in
+      *" $a "*) nx="${!i:-}"; case "$nx" in ''|-*) ;; *) i=$((i + 1)) ;; esac; continue ;;
+    esac
+    case "$CLI_VARIADIC_OPTS" in
+      *" $a "*)
+        while [ "$i" -le "$#" ]; do
+          nx="${!i}"; case "$nx" in -*) break ;; esac; i=$((i + 1))
+        done ;;
+    esac
+  done
+  return 1
+}
+
+# Whether argv is `claude [global options] mcp add|add-json|add-from-claude-desktop|remove …`.
+# The exact word -p/--print (or --bg/--background) anywhere before a `--` puts the client in
+# print/background mode, which never runs the subcommand.
+mcp_mutation_argv() {
+  local i j a
+  for a in "$@"; do
+    case "$a" in --) break ;; -p|--print|--bg|--background) return 1 ;; esac
+  done
+  i="$(cli_positional_at "$@")" || return 1
+  [ "${!i}" = "mcp" ] || return 1
+  j=$((i + 1))
+  case "${!j:-}" in add|add-json|add-from-claude-desktop|remove) return 0 ;; esac
+  return 1
+}
+
 mcp_mirror_run() { # $1 acct dir, then the user's argv — exits when it handled the run
-  local d="$1" snap="" rc verb="${2:-}" sub="${3:-}"
+  local d="$1" snap="" rc
   shift
-  # The scoped-limit fallback may have prepended `--model X` (a global option the real
-  # CLI accepts in front of any subcommand): look past it.
-  if [ "$verb" = "--model" ]; then verb="${3:-}"; sub="${4:-}"; fi
-  [ "$verb" = "mcp" ] || return 1
-  case "$sub" in add|add-json|remove) ;; *) return 1 ;; esac
+  mcp_mutation_argv "$@" || return 1
   [ "${CLAUDE_MULTIACC_MCP:-1}" != "0" ] && [ -f "$MCP_PY" ] || return 1
   mcp_ensure "$d"
   snap="$(mktemp "${TMPDIR:-/tmp}/claude-mcp-snap.XXXXXX" 2>/dev/null)" || snap=""
@@ -169,9 +264,8 @@ mcp_nested_mirror() {
   [ "${CLAUDE_MULTIACC_DISABLE:-0}" = "1" ] && return 1
   [ "${CLAUDE_MULTIACC_MCP:-1}" = "0" ] && return 1
   [ -n "${CLAUDE_CONFIG_DIR:-}" ] || return 1
-  local verb="${1:-}" cfg="${CLAUDE_CONFIG_DIR%/}" d=""
-  if [ "$verb" = "--model" ]; then verb="${3:-}"; fi
-  [ "$verb" = "mcp" ] || return 1
+  local cfg="${CLAUDE_CONFIG_DIR%/}" d=""
+  mcp_mutation_argv "$@" || return 1
   # A DIRECT child of the pool root, by its given spelling or its physical one (an
   # adopted account is a symlink whose target is the operator's ~/.claude).
   case "$cfg" in
@@ -243,18 +337,38 @@ kc_service() { # $1 = acct dir -> the keychain service name the client uses for
   elif command -v sha256sum >/dev/null 2>&1; then h="$(printf '%s' "$1" | sha256sum 2>/dev/null)"; fi
   printf 'Claude Code-credentials-%s' "$(printf '%s' "$h" | cut -c1-8)"
 }
+# A credentials document — the Keychain item or <dir>/.credentials.json — is a Claude
+# LOGIN only when it carries a `claudeAiOauth` object. The client keeps its MCP servers'
+# OAuth state in the same document (`mcpOAuth`, every entry with an expiresAt and a
+# refreshToken of its own), and from a session that cannot open the Keychain (ssh/tmux)
+# Claude Code 2.1.303 writes a .credentials.json holding ONLY that as soon as an OAuth MCP
+# server is discovered. Counted as the login, such a file got its account picked with no
+# token exported — "Not logged in · Run /login" on every run — while the greedy expiry
+# scrape read the MCP entry's future expiresAt as the login's (2026-10-19). So every check
+# reads the login object alone. It is flat: this isolates it up to its closing brace, or to
+# the end of a truncated document (as lenient as the scrape always was). The C locale
+# keeps one invalid byte elsewhere in the document from hiding it; no process is started.
+CRED_LOGIN_RE='"claudeAiOauth"[[:space:]]*:[[:space:]]*[{][^}]*'
+CRED_LOGIN=""
+cred_login_of() { # $1 = document text; sets CRED_LOGIN to its login object, rc 1 when none
+  local LC_ALL=C
+  CRED_LOGIN=""
+  [[ $1 =~ $CRED_LOGIN_RE ]] || return 1
+  CRED_LOGIN="${BASH_REMATCH[0]}"
+}
 # One lookup per dir per run: has_auth, auth_dead and acct_token all ask about the
 # same dir in a row, and every `security` call is a process. Memoised in variables
 # (not a $(...) result) so the memo survives — callers read KC_JSON after kc_lookup.
 KC_MEMO_DIR=""; KC_MEMO_RC=1; KC_JSON=""
-kc_lookup() { # $1 = acct dir; sets KC_JSON; rc 0 readable, 1 none, 2 exists but locked here
+kc_lookup() { # $1 = acct dir; sets KC_JSON; rc 0 readable login, 1 none (an item holding
+              # MCP state alone included), 2 exists but locked here
   [ "$KC_ON" = "1" ] || { KC_JSON=""; return 1; }
   if [ "$KC_MEMO_DIR" = "$1" ]; then return "$KC_MEMO_RC"; fi
   local out rc
   out="$(security find-generic-password -a "$KC_ACCOUNT" -s "$(kc_service "$1")" -w 2>/dev/null)"; rc=$?
   KC_MEMO_DIR="$1"; KC_JSON=""; KC_MEMO_RC=1
   case "$rc" in
-    0) case "$out" in *claudeAiOauth*) KC_JSON="$out"; KC_MEMO_RC=0 ;; esac ;;
+    0) if cred_login_of "$out"; then KC_JSON="$out"; KC_MEMO_RC=0; fi ;;
     36) KC_MEMO_RC=2 ;;
   esac
   return "$KC_MEMO_RC"
@@ -288,7 +402,8 @@ sel_log() {
 
 # ---- auto-resume ----------------------------------------------------------------
 # An interactive session that stops on a usage limit, a failed login, an API error or a
-# crash is resumed — same session id, no keystroke — on another pooled account. The TUI
+# crash, or whose client shows its critical-memory banner, is resumed — same session id, no
+# keystroke — on another pooled account (crash/memory: any one, the same included). The TUI
 # at a limit does not exit; it idles on "continuing automatically at <reset>", which can
 # be days away. The shim's share of the job is small on purpose and never blocks:
 #   - the plain interactive exec stays byte-identical; just before it, a detached watcher
@@ -321,6 +436,8 @@ AR_LOADED=0
 AR_ARGV=()
 AR_ORIG_ARGV=()
 AR_R_CLASS="" AR_R_ACCT="" AR_R_RESET="" AR_R_RTYPE="" AR_R_MARKED="" AR_R_SID=""
+AR_R_MODEL=""     # the model the relaunched session last ran on (its --resume restores it)
+AR_R_VIA=""       # token|login: the credential the left run carried (its watcher's state)
 AR_TRUST=0        # this run continues a relaunch: its cwd is trusted in the picked account
 AR_PY=""
 
@@ -343,7 +460,7 @@ ar_field_ok() { # $1 value
 # later, by ar_relaunch_apply, still ahead of any selection.
 ar_relaunch_load() { # $1 token -> 0 with AR_ARGV and the AR_R_*/chain fields set
   local tok="$1" rf af line k v n=0 a="" ok=0 ver="" prov="" sid="" cwd=""
-  local cls="" acct="" reset="" rtype="" marked="" depth=0 avoid="" hist="" chain="" cross_bad=0
+  local cls="" acct="" reset="" rtype="" marked="" depth=0 avoid="" hist="" chain="" cross_bad=0 model="" via=""
   # Alphanumerics only: the token becomes part of a path, so no '/' and no '..'.
   case "$tok" in *[!A-Za-z0-9]*) return 1 ;; esac
   [ "${#tok}" -ge 8 ] && [ "${#tok}" -le 64 ] || return 1
@@ -379,6 +496,8 @@ ar_relaunch_load() { # $1 token -> 0 with AR_ARGV and the AR_R_*/chain fields se
           if [ "$k" = cross ]; then AR_CROSS="$v"; else AR_HANDOFF_TOKEN="$v"; fi ;;
         hist) ar_field_ok "$v" && hist="$v" ;;
         chain) ar_field_ok "$v" && [ "${#v}" -le 64 ] && chain="$v" ;;
+        model) case "$v" in ''|[!A-Za-z0-9]*|*[!]A-Za-z0-9._:/@+[-]*) ;; *) [ "${#v}" -le 200 ] && model="$v" ;; esac ;;
+        via) case "$v" in token|login) via="$v" ;; esac ;;
       esac
     done < "$rf"
     if [ "$ver" = 1 ] && [ "$prov" = claude ] && [ -f "$af" ] \
@@ -404,7 +523,7 @@ ar_relaunch_load() { # $1 token -> 0 with AR_ARGV and the AR_R_*/chain fields se
   fi
   AR_LOADED=1
   AR_R_CLASS="$cls"; AR_R_ACCT="$acct"; AR_R_RESET="$reset"; AR_R_RTYPE="$rtype"
-  AR_R_MARKED="$marked"
+  AR_R_MARKED="$marked"; AR_R_MODEL="$model"; AR_R_SID="$sid"; AR_R_VIA="$via"
   AR_DEPTH="$depth"; AR_HIST="$hist"; AR_CHAIN="$chain"; AR_AVOID="$avoid"
   # The pane's shell sits wherever the session was launched, but the session's own cwd is
   # what --resume looks the transcript up by. Everything already resolved against the old
@@ -439,18 +558,30 @@ ar_token_dead() { # $1 session id (the token's, else the file's) or empty
 # The verdict the watcher saw, written through the SAME writers the transcript scans use
 # (never shortening a longer park), so the old account is out of the pool before this
 # very selection runs — and for every other launch too. Other classes (model-scoped,
-# transient, billing/hold, crash) leave no marker: the watcher's AVOID list covers them.
+# transient, billing/hold) leave no marker: the watcher's AVOID list covers them. crash and
+# memory (the client at critical memory) are about the PROCESS: nothing is marked, the chain
+# avoids nothing more, and selection is the ordinary one, the account just left included.
 ar_relaunch_apply() {
   local d=""
   [ "$AR_LOADED" = 1 ] || return 0
   [ -n "$AR_R_ACCT" ] && [ -d "$ACC_ROOT/$AR_R_ACCT" ] && d="$ACC_ROOT/$AR_R_ACCT"
   if [ -n "$d" ]; then
     case "$AR_R_CLASS" in
+      crash|memory) ;;
       quota)
         if num_ok "$AR_R_RESET" && [ "$AR_R_RESET" -gt "$now" ] && [ -n "$AR_R_RTYPE" ]; then
           mark_client_limit "$d" "$AR_R_RESET" "$AR_R_RTYPE" "$AR_R_MARKED"
         fi ;;
-      auth) mark_client_auth_dead "$d" ;;
+      auth)
+        # The watcher knew what its run carried (the state the launching shim wrote); only
+        # a relaunch file without that (an older watcher) falls back to the sid's index line,
+        # which names the session the run was launched on, not one it switched to since.
+        if [ -n "$AR_R_VIA" ]; then
+          SESS_VIA=""; [ "$AR_R_VIA" = token ] && SESS_VIA=token
+        else
+          sess_via "$d" "$AR_R_SID"
+        fi
+        mark_client_auth_dead "$d" "$SESS_VIA" ;;
       blocked)
         if [ "$AR_R_RTYPE" = "oauth_org_not_allowed" ]; then
           mark_proven_auth_dead "$d" "organization disabled Claude Code subscription access" "org-blocked"
@@ -563,8 +694,10 @@ ar_python() {
   AR_PY="$py"
 }
 
-ar_start_watcher() { # $1 provider, $2 picked acct dir
-  local prov="$1" dir="$2" lib st tmp launched root nl=$'\n'
+ar_start_watcher() { # $1 provider, $2 picked acct dir, $3 token when the run carries the
+                     # portable token (the relaunch names the credential it left: via=)
+  local prov="$1" dir="$2" lib st tmp launched root nl=$'\n' via=login
+  [ "${3:-}" = token ] && via=token
   # Kill switches: the env for one shell, the file for the whole pool (the watcher
   # re-reads the file every tick, so it also stops sessions already running).
   case "${CLAUDE_MULTIACC_AUTORESUME:-1}" in 0|false|no|off) return 1 ;; esac
@@ -606,7 +739,7 @@ ar_start_watcher() { # $1 provider, $2 picked acct dir
     "self=$SELF" "acc_root=$root" "depth=$AR_DEPTH" "avoid=$AR_AVOID" \
     "hist=$AR_HIST" "chain=$AR_CHAIN" "avoid_claude=$AR_AVOID_CLAUDE" \
     "avoid_codex=$AR_AVOID_CODEX" "pool_claude=$AR_POOL_CLAUDE" "pool_codex=$AR_POOL_CODEX" \
-    "handoff_token=$AR_HANDOFF_TOKEN" 2>/dev/null > "$tmp" \
+    "handoff_token=$AR_HANDOFF_TOKEN" "via=$via" 2>/dev/null > "$tmp" \
     && mv -f "$tmp" "$st" 2>/dev/null \
     || { rm -f "$tmp" 2>/dev/null; return 1; }
   if [ -n "$AR_HANDOFF_TOKEN" ]; then
@@ -637,7 +770,7 @@ ar_trust() { # $1 picked acct dir
 
 # Called right before the plain interactive exec. Whatever the gate decided, the TUI
 # never sees an auto-resume variable (a nested `claude` must not inherit a probe flag).
-ar_spawn_watcher() { # $1 provider, $2 picked acct dir
+ar_spawn_watcher() { # $1 provider, $2 picked acct dir, $3 token|"" (ar_start_watcher)
   local rc=0 v
   ar_start_watcher "$@" || rc=$?
   for v in ${!CLAUDE_MULTIACC_AR_*}; do unset "$v"; done
@@ -1271,20 +1404,44 @@ iso_of_epoch() { # $1 seconds -> UTC ISO8601 ('' when neither date(1) dialect wo
 # Locale-proof (plain integers), and short enough that num_ok always passes.
 iso_key() { local t="${1%%.*}"; t="$(printf '%s' "$t" | LC_ALL=C tr -cd '0-9')"; printf '%s\n' "${t}"; }
 
-# Index line: "<session id> <ISO claim>". The claim is the session's OWN start time, and
-# an id belongs to exactly ONE account.
+# Index line: "<session id> <ISO claim>[ token]". The claim is the session's OWN start
+# time, and an id belongs to exactly ONE account.
 # Why both: `claude --continue` resumes the SAME session id under whichever account the
 # pool hands out next (the client only mints a new id with --fork-session), and the
 # transcript is shared — so without a single owner one rejection would mark every account
 # that ever touched that session, and without the claim time the new owner would inherit
 # a rejection the PREVIOUS owner earned. Each rule only ever removes attribution: the
 # failure mode is a missed limit, never an invented one.
-sess_index_add() { # $1 acct dir, $2 session id, $3 start epoch (optional)
-  local idx="$1/.sessions-index" tmp oidx claim=""
+# `token` says the shim launched the run on the account's portable token itself (its
+# capture, $4): only such a run's authentication failure is evidence against that token.
+# A session merely sighted carries none, nor one launched on the login; the launching run
+# sets it every time, since a session resumed in the same account may change credential.
+sess_index_add() { # $1 acct dir, $2 session id, $3 start epoch (optional), $4 token|login:
+                   # the credential THIS shim launched the run on (sel_capture_session)
+  local idx="$1/.sessions-index" tmp oidx claim="" via="" ln out="" hit=0
   sess_id_ok "$2" || return 0
+  [ "${4:-}" = token ] && via=" token"
   # `( |$)` also matches a claim-less line from an older build, so such an entry is still
   # deduped and can still be released when another account takes the session over.
-  [ -f "$idx" ] && LC_ALL=C grep -qE -- "^$2( |$)" "$idx" 2>/dev/null && return 0
+  if [ -f "$idx" ] && LC_ALL=C grep -qE -- "^$2( |$)" "$idx" 2>/dev/null; then
+    [ -n "${4:-}" ] || return 0
+    # The launching run's credential, onto the line the session already has (claim kept;
+    # a claim-less line cannot carry it). Builtins only, and no write when it is right.
+    while IFS= read -r ln || [ -n "$ln" ]; do
+      case "$ln" in
+        "$2 "*)
+          claim="${ln#* }"; claim="${claim%% *}"
+          [ "$ln" = "$2 $claim$via" ] || { ln="$2 $claim$via"; hit=1; } ;;
+      esac
+      out="$out$ln
+"
+      ln=""
+    done < "$idx"
+    [ "$hit" = 1 ] || return 0
+    printf '%s' "$out" 2>/dev/null > "$idx.$$" && mv -f "$idx.$$" "$idx" 2>/dev/null \
+      || rm -f "$idx.$$" 2>/dev/null
+    return 0
+  fi
   num_ok "${3:-}" && claim="$(iso_of_epoch "$3")"
   [ -n "$claim" ] || claim="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
   for oidx in "$ACC_ROOT"/acct-*/.sessions-index; do
@@ -1300,35 +1457,90 @@ sess_index_add() { # $1 acct dir, $2 session id, $3 start epoch (optional)
     fi
   done
   tmp="$idx.$$"
-  { [ -f "$idx" ] && cat "$idx" 2>/dev/null; printf '%s %s\n' "$2" "$claim"; } \
+  { [ -f "$idx" ] && cat "$idx" 2>/dev/null; printf '%s %s%s\n' "$2" "$claim" "$via"; } \
     | tail -n "$SESS_INDEX_MAX" 2>/dev/null > "$tmp" \
     && mv -f "$tmp" "$idx" 2>/dev/null || rm -f "$tmp" 2>/dev/null
   return 0
 }
 
-sess_index_refresh() { # $1 acct dir — record every run currently live in this account
-  local f id started known="" ln
+# The credential the shim launched <session> on, from <dir>'s index: SESS_VIA=token, or
+# empty (the login, or not launched by the shim at all). Builtins only.
+SESS_VIA=""
+sess_via() { # $1 acct dir, $2 session id; sets SESS_VIA
+  local ln
+  SESS_VIA=""
+  sess_id_ok "${2:-}" || return 0
+  [ -f "$1/.sessions-index" ] || return 0
+  while IFS= read -r ln; do
+    case "$ln" in "$2 "*" token") SESS_VIA=token ;; "$2"|"$2 "*) SESS_VIA="" ;; esac
+  done < "$1/.sessions-index"
+}
+
+sess_index_refresh() { # $1 acct dir — record every run currently live in this account;
+                       # $2 the pid this shim execs into and $3 the credential that run
+                       # carries (token|login): sel_capture_session only
+  local f id started known="" tagged=" " ln via pid rst rvia
   sessions_owned "$1" || return 0
   # Read the index ONCE with the builtin, so the steady state (every live session already
   # claimed) costs one sed per session and not a grep and a second sed on top.
   if [ -f "$1/.sessions-index" ]; then
-    while IFS= read -r ln; do known="$known ${ln%% *}"; done < "$1/.sessions-index"
+    while IFS= read -r ln; do
+      known="$known ${ln%% *}"
+      case "$ln" in *" token") tagged="$tagged${ln%% *} " ;; esac
+    done < "$1/.sessions-index"
   fi
   for f in "$1"/sessions/*.json; do
     [ -f "$f" ] || continue
     # A symlinked registry entry would let another pool's session id in under this
     # account's name (second-pass codex-review finding, nested-symlink variant).
     [ -L "$f" ] && continue
+    pid="${f##*/}"; pid="${pid%.json}"
+    # The run this shim execs into is the one session whose credential it knows: its line
+    # gets it even when another run sighted the session first. Any other live run the shim
+    # launched has its credential on record by PROCESS (sess_via_record), for whichever
+    # session the client has switched it to since (/clear, /resume inside the TUI).
+    via=""; rvia=""
+    if [ -n "${3:-}" ] && [ "$pid" = "${2:-}" ]; then
+      via="$3"
+    else
+      case "$pid" in
+        ''|*[!0-9]*) ;;
+        *) if [ -f "$1/.sessions-via/$pid" ] && [ ! -L "$1/.sessions-via/$pid" ]; then
+             rst=""
+             { IFS=' ' read -r rst rvia < "$1/.sessions-via/$pid"; } 2>/dev/null
+             case "$rvia" in token|login) ;; *) rvia="" ;; esac
+           fi ;;
+      esac
+    fi
     id="$(LC_ALL=C sed -n 's/.*"sessionId"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$f" 2>/dev/null | head -1)"
     sess_id_ok "$id" || continue
-    case "$known" in *" $id "*|*" $id") continue ;; esac
+    case "$known" in
+      *" $id "*|*" $id")
+        if [ -z "$via" ]; then
+          # Builtins only while the line already says what the record says.
+          [ -n "$rvia" ] || continue
+          case "$tagged" in
+            *" $id "*) [ "$rvia" = token ] && continue ;;
+            *) [ "$rvia" = login ] && continue ;;
+          esac
+        fi ;;
+    esac
     # startedAt is epoch MILLIseconds; using the session's real start (not "now") is what
     # lets a session that has been running since before this shim was installed still be
-    # attributed correctly.
+    # attributed correctly. It also names the process: the client rewrites only the
+    # sessionId when it switches sessions, so a record whose startedAt differs was written
+    # for an earlier process under a reused pid, and says nothing about this one.
     started="$(LC_ALL=C sed -n 's/.*"startedAt"[[:space:]]*:[[:space:]]*\([0-9][0-9]*\).*/\1/p' "$f" 2>/dev/null | head -1)"
+    if [ -n "$rvia" ] && num_ok "$started" && [ "$started" = "$rst" ]; then
+      via="$rvia"
+    fi
+    if [ -z "$via" ]; then
+      case "$known" in *" $id "*|*" $id") continue ;; esac
+    fi
     num_ok "$started" && started=$((started / 1000)) || started=""
-    sess_index_add "$1" "$id" "$started"
+    sess_index_add "$1" "$id" "$started" "$via"
     known="$known $id"
+    case "$via" in token) tagged="$tagged$id " ;; login) tagged="${tagged/ $id / }" ;; esac
   done
   return 0
 }
@@ -1350,7 +1562,10 @@ claim_conflicted() { # $1 acct dir, $2 session id, $3 our ISO claim
     # older claim followed by a newer one), and it is the newest rival that decides.
     while IFS= read -r other; do
       [ -n "$other" ] || continue
-      case "$other" in *' '*) ok="$(iso_key "${other#* }")" ;; *) return 0 ;; esac
+      case "$other" in
+        *' '*) other="${other#* }"; ok="$(iso_key "${other%% *}")" ;;
+        *) return 0 ;;
+      esac
       num_ok "$ok" || return 0
       [ "$ok" -ge "$mk" ] && return 0
     done <<EOF
@@ -1401,7 +1616,7 @@ client_limit_scan() { # $1 acct dir
   while IFS= read -r ln; do
     id="${ln%% *}"
     claim=""
-    case "$ln" in *' '*) claim="${ln#* }" ;; esac
+    case "$ln" in *' '*) claim="${ln#* }"; claim="${claim%% *}" ;; esac
     sess_id_ok "$id" && { ids+=("$id"); claims+=("$claim"); }
   done < "$idx"
   # The budget bounds ENTRIES EXAMINED, not just transcripts read: an entry that fails the
@@ -1475,11 +1690,14 @@ client_limit_scan() { # $1 acct dir
 # A TUI rejection cannot use the -p retry path because the client owns the terminal.
 # Read only structured API errors belonging to this account's session claim. The JSON
 # helper runs only when the bounded grep finds an auth or organization error code.
-CLIENT_ERROR_REASON=""
-client_error_scan() { # $1 acct dir; sets CLIENT_ERROR_REASON
-  local idx="$1/.sessions-index" ln id claim p line read_n=0 i cleared=0 parser auth=""
-  local ids=() claims=()
-  CLIENT_ERROR_REASON=""
+# A `claude-accounts verify` that reached the account (.client-org-cleared) supersedes
+# every error recorded before it, an authentication failure as much as an org refusal.
+CLIENT_ERROR_REASON=""; CLIENT_ERROR_VIA=""
+client_error_scan() { # $1 acct dir; sets CLIENT_ERROR_REASON, and CLIENT_ERROR_VIA=token
+                      # when an auth failure came from a run the shim launched on the token
+  local idx="$1/.sessions-index" ln id claim via p line read_n=0 i cleared=0 parser auth=""
+  local ids=() claims=() vias=()
+  CLIENT_ERROR_REASON=""; CLIENT_ERROR_VIA=""
   { [ -L "$1" ] || [ -L "$1/sessions" ]; } && return 1
   parser="$SELF_DIR/../lib/claude_client_error.py"
   [ -f "$parser" ] || return 1
@@ -1488,13 +1706,15 @@ client_error_scan() { # $1 acct dir; sets CLIENT_ERROR_REASON
   [ -f "$1/.client-org-cleared" ] \
     && { IFS= read -r cleared < "$1/.client-org-cleared" 2>/dev/null || cleared=0; }
   while IFS= read -r ln; do
-    id="${ln%% *}"; claim=""
+    id="${ln%% *}"; claim=""; via=""
     case "$ln" in *' '*) claim="${ln#* }" ;; esac
-    sess_id_ok "$id" && { ids+=("$id"); claims+=("$claim"); }
+    case "$claim" in *' '*) via="${claim#* }"; claim="${claim%% *}" ;; esac
+    sess_id_ok "$id" && { ids+=("$id"); claims+=("$claim"); vias+=("$via"); }
   done < "$idx"
   i=$(( ${#ids[@]} - 1 ))
   while [ "$i" -ge 0 ] && [ "$read_n" -lt "$QUOTA_SCAN_MAX_FILES" ]; do
-    id="${ids[$i]}"; claim="${claims[$i]}"; i=$((i - 1)); read_n=$((read_n + 1))
+    id="${ids[$i]}"; claim="${claims[$i]}"; via="${vias[$i]}"
+    i=$((i - 1)); read_n=$((read_n + 1))
     sess_transcript "$1" "$id" || continue
     p="$SESS_TRANSCRIPT"
     [ $((now - $(file_mtime "$p"))) -le "$QUOTA_SCAN_MAX_AGE" ] || continue
@@ -1507,7 +1727,7 @@ client_error_scan() { # $1 acct dir; sets CLIENT_ERROR_REASON
       --claim "$claim" --org-cleared "$cleared" 2>/dev/null)" || continue
     case "$line" in
       org-blocked\ *) CLIENT_ERROR_REASON="org-blocked"; return 0 ;;
-      auth\ *) auth=1 ;;
+      auth\ *) auth=1; [ "$via" = token ] && CLIENT_ERROR_VIA=token ;;
     esac
   done
   [ -n "$auth" ] && { CLIENT_ERROR_REASON="auth"; return 0; }
@@ -1527,10 +1747,14 @@ mark_proven_auth_dead() { # $1 acct dir, $2 fixed safe detail, $3 optional reaso
     || rm -f "$1/.expired.$$" 2>/dev/null || true
 }
 
-mark_client_auth_dead() { # $1 acct dir
-  local tok
-  tok="$(acct_token "$1")"
-  if [ -n "$tok" ]; then
+# The park names the credential the FAILED run carried, never the one this run would pick
+# (they differ whenever the account's credentials changed in between): a run the shim
+# launched on the portable token (its index line, sess_index_add) retires that token, and
+# anything else is the login's. Asking acct_token here charged the token for runs that
+# never carried one — the "Not logged in" runs of 2026-10-19, once an MCP-only file stopped
+# counting as their login — and parked a working token until a new one was minted.
+mark_client_auth_dead() { # $1 acct dir, $2 token when the failed run carried the token
+  if [ "${2:-}" = token ]; then
     rm -f "$1/.server-token-verified" 2>/dev/null || true
     mark_proven_auth_dead "$1" "client rejected the portable OAuth token" \
       "setup-token-invalid"
@@ -1569,47 +1793,97 @@ mark_client_limit() { # $1 acct dir, $2 reset epoch, $3 rate limit type, $4 reje
 # it (and every other live run of the account) in the index, because by the time the
 # user quits a limit-hit session and starts a new one, the client has already deleted
 # its registry file and nothing else can name the transcript that holds the evidence.
-sel_capture_session() { # $1 acct dir
-  local d="$1" pid=$$
+# It also records what the run carries — the portable token, or the login — which only
+# this shim knows (mark_client_auth_dead).
+sel_capture_session() { # $1 acct dir, $2 token when the run carries the portable token
+  local d="$1" pid=$$ via=login
+  [ "${2:-}" = token ] && via=token
   [ "${CLAUDE_MULTIACC_CLIENT_LIMITS:-1}" = "0" ] && return 0
   (
     # Ctrl-C / a closed terminal must not kill the capture: it is bounded (60s) and
     # stops the moment the run it is watching is gone.
     trap '' INT HUP TERM QUIT
-    i=0
+    i=0 tries=0
     while [ "$i" -lt 600 ]; do
       kill -0 "$pid" 2>/dev/null || break
-      sess_index_refresh "$d"
-      [ -f "$d/sessions/$pid.json" ] && break
+      sess_index_refresh "$d" "$pid" "$via"
+      if [ -f "$d/sessions/$pid.json" ]; then
+        # Registered: the run's credential goes on record by process. A registry file caught
+        # mid-write (no startedAt yet) gets a few more looks.
+        sess_via_record "$d" "$pid" "$via" && break
+        tries=$((tries + 1)); [ "$tries" -lt 10 ] || break
+      fi
       sleep 0.1
       i=$((i + 1))
     done
-    sess_index_refresh "$d"
+    sess_index_refresh "$d" "$pid" "$via"
   ) >/dev/null 2>&1 </dev/null &
   return 0
 }
 
+# The credential the shim launched a PROCESS on, for that process's whole life:
+# <acct>/.sessions-via/<pid> holds "<its registry startedAt, ms> token|login". The client
+# keeps one registry file per process and, on /clear or a /resume inside the TUI, rewrites
+# only its sessionId (2.1.304's session-switch listener merges {sessionId, updatedAt} into
+# it), so the capture tags only the run's FIRST session; sess_index_refresh tags every later
+# one from this record. startedAt survives those rewrites and names the process, so a reused
+# pid inherits nothing. Written once the registry file is there (the capture, in the
+# background); a record whose registry file is gone is dropped then too.
+sess_via_record() { # $1 acct dir, $2 pid, $3 token|login; rc 1: the registry file is there
+                    # but names no startedAt (yet)
+  local dir="$1/.sessions-via" f st
+  sessions_owned "$1" || return 0
+  [ -f "$1/sessions/$2.json" ] && [ ! -L "$1/sessions/$2.json" ] || return 0
+  st="$(LC_ALL=C sed -n 's/.*"startedAt"[[:space:]]*:[[:space:]]*\([0-9][0-9]*\).*/\1/p' \
+    "$1/sessions/$2.json" 2>/dev/null | head -1)"
+  num_ok "$st" || return 1
+  [ -L "$dir" ] && return 0
+  [ -d "$dir" ] || mkdir "$dir" 2>/dev/null || [ -d "$dir" ] || return 0
+  for f in "$dir"/*; do
+    [ -f "$f" ] || continue
+    [ -e "$1/sessions/${f##*/}.json" ] || rm -f "$f" 2>/dev/null
+  done
+  printf '%s %s\n' "$st" "$3" 2>/dev/null > "$dir/.$2.$$" \
+    && mv -f "$dir/.$2.$$" "$dir/$2" 2>/dev/null || rm -f "$dir/.$2.$$" 2>/dev/null
+  return 0
+}
+
+# The login a dir's .credentials.json carries (cred_login_of) — a file holding only MCP
+# state, or an empty one, carries none. Memoised for the dir like kc_lookup: has_auth,
+# auth_dead and acct_token all read it in a row, and the read is a fork.
+FILE_MEMO_DIR=""; FILE_MEMO_RC=1; FILE_LOGIN=""
+file_login() { # $1 = acct dir; sets CRED_LOGIN; rc 0 when the file holds a login
+  if [ "$FILE_MEMO_DIR" != "$1" ]; then
+    local doc=""
+    FILE_MEMO_DIR="$1"; FILE_MEMO_RC=1; FILE_LOGIN=""
+    if [ -s "$1/.credentials.json" ]; then
+      { doc="$(< "$1/.credentials.json")"; } 2>/dev/null
+      cred_login_of "$doc" && { FILE_LOGIN="$CRED_LOGIN"; FILE_MEMO_RC=0; }
+    fi
+  fi
+  CRED_LOGIN="$FILE_LOGIN"
+  return "$FILE_MEMO_RC"
+}
+
 # An empty credentials file is NOT auth (an interrupted write must not make a
-# dead account selectable and turn a working stock run into an auth failure).
+# dead account selectable and turn a working stock run into an auth failure), and
+# neither is one holding only MCP state: it leaves the decision to the token/Keychain.
 # A Keychain-held login counts only when THIS session can read it (kc_lookup rc 0).
-has_auth() { [ -s "$1/.credentials.json" ] || [ -s "$1/server.token" ] || kc_lookup "$1"; }
+has_auth() { file_login "$1" || [ -s "$1/server.token" ] || kc_lookup "$1"; }
 # The OAuth login itself, wherever the client keeps it (file or readable Keychain item).
-has_oauth() { [ -f "$1/.credentials.json" ] || kc_lookup "$1"; }
+has_oauth() { file_login "$1" || kc_lookup "$1"; }
 
 cred_num() { # cred_num <json text> <json key> -> integer (epoch ms) or empty
   # The leading quote makes "expiresAt" unambiguous: "refreshTokenExpiresAt" cannot match it.
   printf '%s' "$1" | LC_ALL=C sed -n "s/.*\"$2\"[[:space:]]*:[[:space:]]*\([0-9][0-9]*\).*/\1/p" 2>/dev/null | head -1
 }
 
-# The credential document for <dir>: .credentials.json when present (even unreadable
-# or truncated — the scrape below is deliberately lenient), else the Keychain item
-# this session can read. Empty when there is neither.
-cred_text() { # $1 = acct dir
-  if [ -s "$1/.credentials.json" ]; then
-    cat "$1/.credentials.json" 2>/dev/null
-  elif kc_lookup "$1"; then
-    printf '%s' "$KC_JSON"
-  fi
+# The login object for <dir>: from .credentials.json when that file carries one (even
+# truncated — the scrape below is deliberately lenient), else from the Keychain item
+# this session can read. rc 1, CRED_LOGIN empty, when neither holds a login.
+cred_login() { # $1 = acct dir; sets CRED_LOGIN
+  file_login "$1" && return 0
+  kc_lookup "$1" && cred_login_of "$KC_JSON"
 }
 
 # TRUE when the dir's OAuth login exists but can no longer authenticate: the access
@@ -1617,17 +1891,17 @@ cred_text() { # $1 = acct dir
 # itself expired). Such an account fails EVERY run with "OAuth session expired and
 # could not be refreshed", so selecting it is strictly worse than not having it.
 # Anything unparseable fails OPEN (treated as alive) — telemetry-free guesswork must
-# never take a working account out of the pool.
+# never take a working account out of the pool. Read from the login object only: the
+# MCP entries beside it carry an expiresAt and a refreshToken that say nothing about it.
 creds_dead() { # $1 = acct dir
-  local src exp rexp
-  has_oauth "$1" || return 1
-  src="$(cred_text "$1")"
-  exp="$(cred_num "$src" expiresAt)"
+  local exp rexp
+  cred_login "$1" || return 1
+  exp="$(cred_num "$CRED_LOGIN" expiresAt)"
   case "$exp" in ''|*[!0-9]*) exp=0 ;; esac
   [ $((exp / 1000)) -gt "$now" ] && return 1        # access token still valid
   # Access token expired: only a live refresh token can save it.
-  printf '%s' "$src" | grep -q '"refreshToken"[[:space:]]*:[[:space:]]*"[^"]' 2>/dev/null || return 0
-  rexp="$(cred_num "$src" refreshTokenExpiresAt)"
+  printf '%s' "$CRED_LOGIN" | grep -q '"refreshToken"[[:space:]]*:[[:space:]]*"[^"]' 2>/dev/null || return 0
+  rexp="$(cred_num "$CRED_LOGIN" refreshTokenExpiresAt)"
   case "$rexp" in ''|*[!0-9]*) return 1 ;; esac     # unknown expiry => fail open
   [ $((rexp / 1000)) -le "$now" ]
 }
@@ -1635,8 +1909,9 @@ creds_dead() { # $1 = acct dir
 # `.expired` is the persistent "this account needs a re-login" marker: written by
 # claude-accounts (refresh grant expired/revoked) and by the retry path below when a
 # real call fails with an auth error. It SELF-HEALS: any credential written after the
-# marker (successful re-login, or a refresh by another process) clears it, and a
-# successful `claude-accounts limits` fetch removes it outright.
+# marker (successful re-login, or a refresh by another process — a login or a token, never
+# MCP state alone) clears it, and a successful `claude-accounts limits` fetch removes it
+# outright.
 # A marker written by the SHIM (a guess from one failed run) also carries
 # `soft_until=<epoch>`: once that passes the account returns to the pool by itself, so
 # a misread never costs an account permanently. Markers written by claude-accounts —
@@ -1645,7 +1920,7 @@ creds_dead() { # $1 = acct dir
 # An org block stays until verify proves access, including a usage-limiter refusal.
 # Time and credential refreshes cannot prove the organization's policy changed.
 expired_marked() { # $1 = acct dir
-  local m="$1/.expired" mt f soft reason
+  local m="$1/.expired" mt soft reason kc
   [ -f "$m" ] || return 1
   reason="$(LC_ALL=C sed -n 's/.*reason=\([A-Za-z0-9._-][A-Za-z0-9._-]*\).*/\1/p' "$m" 2>/dev/null | head -1)"
   [ "$reason" = "org-blocked" ] && return 0
@@ -1681,17 +1956,27 @@ expired_marked() { # $1 = acct dir
   # "Your organization has disabled Claude subscription access".
   if [ "$reason" != "org-blocked" ]; then
     mt="$(file_mtime "$m")"
-    for f in "$1/.credentials.json" "$1/server.token"; do
-      if [ -f "$f" ] && [ "$(file_mtime "$f")" -gt "$mt" ]; then
+    if [ -f "$1/server.token" ] && [ "$(file_mtime "$1/server.token")" -gt "$mt" ]; then
+      rm -f "$m" 2>/dev/null
+      return 1
+    fi
+    # A newer LOGIN is the evidence. The client rewrites .credentials.json with MCP state
+    # alone on every MCP token refresh, which says nothing about the login, so only a
+    # file that carries one can heal the park; any other leaves it to the Keychain.
+    if file_login "$1"; then
+      if [ "$(file_mtime "$1/.credentials.json")" -gt "$mt" ]; then
         rm -f "$m" 2>/dev/null
         return 1
       fi
-    done
     # A login the client keeps in the Keychain is "written after the marker" in the
-    # same sense; its stamp is readable even from a session that cannot open it.
-    if [ ! -f "$1/.credentials.json" ] && [ "$(kc_mtime "$1")" -gt "$mt" ]; then
-      rm -f "$m" 2>/dev/null
-      return 1
+    # same sense; its stamp is readable even from a session that cannot open it. An item
+    # this session CAN read is judged by what it holds: MCP state alone heals nothing.
+    elif [ "$(kc_mtime "$1")" -gt "$mt" ]; then
+      kc=0; kc_lookup "$1" || kc=$?
+      if [ "$kc" -ne 1 ]; then
+        rm -f "$m" 2>/dev/null
+        return 1
+      fi
     fi
   fi
   soft="$(LC_ALL=C sed -n 's/.*soft_until=\([0-9][0-9]*\).*/\1/p' "$m" 2>/dev/null | head -1)"
@@ -1824,11 +2109,13 @@ if [ -n "${CLAUDE_ACCOUNT:-}" ]; then
       fi
       export CLAUDE_CODE_OAUTH_TOKEN="$tok"
     fi
-    # A pinned account carries every registered MCP server too, and a pinned
-    # `claude mcp add|remove` is mirrored like any other (exits inside).
+    # A pinned account carries every registered MCP server (and the pool's MCP OAuth
+    # logins) too, and a pinned `claude mcp add|remove` is mirrored like any other
+    # (exits inside).
     mcp_ensure "$d"
+    mcp_oauth_ensure "$d"
     mcp_mirror_run "$d" "$@" || true
-    sel_capture_session "$d"
+    sel_capture_session "$d" "${tok:+token}"
     exec "$REAL" "$@"
   fi
   sel_log "pin-invalid account=$CLAUDE_ACCOUNT (no such dir; random fallback)"
@@ -1854,7 +2141,7 @@ for d in "$ACC_ROOT"/acct-*; do
       mark_proven_auth_dead "$d" "organization disabled Claude Code subscription access" "org-blocked"
       sel_log "${d##*/} parked (org-blocked) — client-reported"
     else
-      mark_client_auth_dead "$d"
+      mark_client_auth_dead "$d" "$CLIENT_ERROR_VIA"
     fi
     valid=("${valid[@]:0:${#valid[@]}-1}")
     expired+=("$d")
@@ -2192,20 +2479,27 @@ PICK_TOKEN="$tok"
 # session on "You've reached your Fable 5 limit" — the exact failure this selection
 # path exists to avoid (operator, tmux 136) — so the fallback model is pinned once,
 # before exec. An explicit --model is never touched: such a run does not get here.
+# A relaunch names the model its session last ran on, which --resume restores: only a
+# session on the limited model itself is pinned off it; any other keeps its own model.
 if [ -z "$RUN_MODEL" ]; then
   sel_tok="$(scoped_tok_of_marker "$pick")"
   [ -n "$sel_tok" ] || sel_tok="$(scoped_over_tok "$pick")"
   if [ -n "$sel_tok" ] && ! scoped_blocks_run "$sel_tok"; then
-    set -- --model "$FALLBACK_MODEL" "$@"
-    sel_log "$(basename "$pick") -> --model $FALLBACK_MODEL (its $sel_tok bucket is full)"
+    case "$(sel_lc "${AR_R_MODEL:-$sel_tok}")" in
+      *"$(sel_lc "$sel_tok")"*)
+        set -- --model "$FALLBACK_MODEL" "$@"
+        sel_log "$(basename "$pick") -> --model $FALLBACK_MODEL (its $sel_tok bucket is full)" ;;
+    esac
   fi
 fi
 # Remember the pick so the NEXT run does not hand back the same account. An explicit
 # CLAUDE_ACCOUNT pin deliberately does not: a pin is a caller overriding selection,
 # not a turn in the rotation.
 remember_pick "$pick"
-# The picked account carries every registered MCP server before the client starts.
+# The picked account carries every registered MCP server, and the MCP OAuth logins any
+# account on this machine holds, before the client starts.
 mcp_ensure "$pick"
+mcp_oauth_ensure "$pick"
 
 # Opportunistic limits refresh: non-blocking, throttled, backgrounded. The windows are
 # deliberately wide (10m, matching the 5m scheduled pass): the usage endpoint rate-limits
@@ -2284,7 +2578,7 @@ export CLAUDE_SHIM_ACTIVE=1
 
 # A `claude mcp add|add-json|remove` is run as a child under the picked account and
 # mirrored to every other one (exits inside); anything else falls through to exec.
-if [ "${1:-}" = "mcp" ] || { [ "${1:-}" = "--model" ] && [ "${3:-}" = "mcp" ]; }; then
+if mcp_mutation_argv "$@"; then
   export CLAUDE_CONFIG_DIR="$pick"
   tok="$PICK_TOKEN"
   [ -n "$tok" ] && export CLAUDE_CODE_OAUTH_TOKEN="$tok"
@@ -2320,9 +2614,9 @@ if [ "$wants_retry" = "0" ]; then
   export CLAUDE_CONFIG_DIR="$pick"
   tok="$PICK_TOKEN"
   [ -n "$tok" ] && export CLAUDE_CODE_OAUTH_TOKEN="$tok"
-  sel_capture_session "$pick"
+  sel_capture_session "$pick" "${tok:+token}"
   ar_trust "$pick"
-  if ! ar_spawn_watcher claude "$pick" && [ -n "$AR_HANDOFF_TOKEN" ]; then
+  if ! ar_spawn_watcher claude "$pick" "${tok:+token}" && [ -n "$AR_HANDOFF_TOKEN" ]; then
     printf 'claude-multiacc: auto-resume handoff could not start its watcher.\n' >&2
     exit 2
   fi
@@ -2335,7 +2629,7 @@ tmpd="$(mktemp -d "$ACC_ROOT/tmp/shim.XXXXXX" 2>/dev/null)" || {
   export CLAUDE_CONFIG_DIR="$pick"
   tok="$PICK_TOKEN"
   [ -n "$tok" ] && export CLAUDE_CODE_OAUTH_TOKEN="$tok"
-  sel_capture_session "$pick"
+  sel_capture_session "$pick" "${tok:+token}"
   exec "$REAL" "$@"
 }
 trap 'rm -rf "$tmpd"' EXIT
@@ -2347,7 +2641,7 @@ if ! : > "$tmpd/out" 2>/dev/null || ! : > "$tmpd/err" 2>/dev/null; then
   export CLAUDE_CONFIG_DIR="$pick"
   tok="$PICK_TOKEN"
   [ -n "$tok" ] && export CLAUDE_CODE_OAUTH_TOKEN="$tok"
-  sel_capture_session "$pick"
+  sel_capture_session "$pick" "${tok:+token}"
   exec "$REAL" "$@"
 fi
 
@@ -2530,6 +2824,7 @@ while :; do
       # away from — not the one that bounced.
       remember_pick "$cur"
       mcp_ensure "$cur"
+      mcp_oauth_ensure "$cur"
       rotated=1
       attempt=2
       continue