claude-multiacc 2.0.6 → 2.0.7

package/bin/claude-accounts

@@ -1273,6 +1273,7 @@ cmd_limits() {
 import hashlib, json, os, sys, time, urllib.request
 sys.path = [sys.argv[6]] + [p for p in sys.path if p not in ('', '.')]
 import keychain  # noqa: E402  (macOS Keychain-held logins; a no-op elsewhere)
+from audit import creds_doc_state  # noqa: E402  (one rule for "can this credential work")
 
 root, threshold, quiet, url, force = sys.argv[1], int(sys.argv[2]), sys.argv[3] == '1', sys.argv[4], sys.argv[5] == '1'
 now = time.time()
@@ -1655,6 +1656,18 @@ for acct in manifest.get('accounts', []):
     locked = store == 'locked'
     if locked:
         store = None
+    # "This account has an OAuth login that could still work." A Keychain-held one
+    # only the Mac's own launchd probe can open counts: it is unusable HERE, not
+    # broken. A provably DEAD grant (no refresh token, or a refresh token that has
+    # itself expired) does not count — for that account the setup token really is
+    # the only bearer left, and it must still get its one try.
+    oauth_alive = locked
+    if store is not None:
+        try:
+            oauth_alive = creds_doc_state(store.read(), now)[0] == 'ok'
+        except Exception:
+            oauth_alive = True   # unreadable is not proof of death: do not spend the token
+    has_oauth = oauth_alive
     if store is not None:
         try:
             c = store.read().get('claudeAiOauth', {})
@@ -1672,7 +1685,19 @@ for acct in manifest.get('accounts', []):
             tok = None
         if tok:
             bearer, source = tok, 'oauth'
-    if not bearer and os.path.isfile(tpath):
+    # A setup token is a LAST RESORT and only for an account that has no OAuth
+    # credential at all. Where one exists but could not be used this pass — its
+    # access token expired moments ago (refresh_oauth waits REFRESH_MIN_EXPIRED to
+    # prove no live session owns it), a refresh backoff, or a Keychain this session
+    # cannot open — spending the token is guaranteed to earn a 403 it can never not
+    # earn, and that 403 used to park the whole ACCOUNT for six hours. Telemetry then
+    # froze for an account whose OAuth would have worked on the very next pass, and
+    # the shim ranked the pool on hour-old readings. Waiting for the next pass costs
+    # minutes; the token costs six hours and answers nothing.
+    if not bearer and has_oauth:
+        say(f'{aid}: oauth credential not usable this pass; NOT spending the setup '
+            f'token on a usage endpoint that always refuses it — retrying next pass')
+    elif not bearer and os.path.isfile(tpath):
         # Once this endpoint has refused THIS token file for lacking a scope, asking
         # again is guaranteed to fail and only spends the account's hourly budget —
         # which is how a permanent authorization problem disguised itself as a rate
@@ -1717,6 +1742,14 @@ for acct in manifest.get('accounts', []):
         except Exception:
             pass
 
+        def save_prev():
+            """Persist the account's telemetry state as-is (no backoff, no invented
+            freshness) — used when what failed says nothing about the ACCOUNT."""
+            tmp = lpath + '.tmp'
+            with open(tmp, 'w') as f:
+                json.dump(prev, f, indent=1)
+            os.replace(tmp, lpath)
+
         def park(wait, note):
             """Record a failed fetch WITHOUT inventing freshness: fetched_at is left
             exactly as it was, so a parked account still reads as stale everywhere."""
@@ -1724,10 +1757,7 @@ for acct in manifest.get('accounts', []):
             prev['backoff'] = wait
             prev['last_error'] = note
             prev['last_error_at'] = int(now)
-            tmp = lpath + '.tmp'
-            with open(tmp, 'w') as f:
-                json.dump(prev, f, indent=1)
-            os.replace(tmp, lpath)
+            save_prev()
 
         if e.code == 429:
             # Respect Retry-After; otherwise exponential backoff capped at 30 min.
@@ -1765,8 +1795,16 @@ for acct in manifest.get('accounts', []):
                 tdigest = token_digest(tpath)
                 if tdigest:
                     prev['token_scope_denied'] = tdigest
-            park(wait, f'HTTP {e.code} (source={source})'
-                       + (' — permanent, server said do not retry' if denied else ''))
+            if scope_denied and source == 'token':
+                # A refusal of the TOKEN is a fact about that credential, not about
+                # the account: parking the account here also blocked the OAuth path,
+                # so an account that merely missed one refresh went dark for six
+                # hours. The digest above already stops this token being spent again;
+                # leave the account free to try its OAuth login next pass.
+                save_prev()
+            else:
+                park(wait, f'HTTP {e.code} (source={source})'
+                           + (' — permanent, server said do not retry' if denied else ''))
             if scope_denied and source == 'token':
                 # The exact shape of this outage: a setup token is minted WITHOUT the
                 # user:profile scope the usage endpoint requires, so an account whose
@@ -1775,7 +1813,8 @@ for acct in manifest.get('accounts', []):
                 say(f'{aid}: usage endpoint refuses the setup token (HTTP {e.code} — a '
                     f'setup token has no user:profile scope). Telemetry is DEAD for this '
                     f'account until it has an OAuth login here: claude-accounts login {aid}. '
-                    f'Backing off {wait}s.')
+                    f'This token will not be offered again; the ACCOUNT is not parked, so '
+                    f'an OAuth login works the moment it lands.')
             elif denied:
                 say(f'{aid}: usage fetch refused for good (HTTP {e.code}, source={source}); '
                     f'backing off {wait}s — re-login needed: claude-accounts login {aid}')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.6",
+  "version": "2.0.7",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -1791,17 +1791,21 @@ EOF
          claude-accounts limits --force 2>&1)"
   check "a scope-denied 403 names the missing scope" "user:profile" "$out"
   check "a scope-denied 403 names the ceremony that fixes it" "claude-accounts login acct-01" "$out"
-  check "a scope-denied 403 backs off instead of retrying" "Backing off" "$out"
+  # The CREDENTIAL is refused for good (the digest below stops it being offered
+  # again); the ACCOUNT is deliberately NOT parked, because parking it also blocked
+  # the OAuth path and froze telemetry for hours on accounts whose login was fine.
+  check "a scope-denied 403 retires the token, not the account" \
+    "This token will not be offered again" "$out"
   python3 - "$SD/acct-01/limits.json" "$now" <<'EOF'
 import json, sys
 lim = json.load(open(sys.argv[1]))
 now = int(sys.argv[2])
-assert lim['retry_after'] > now + 3600, lim          # parked for hours, not minutes
+assert lim.get('token_scope_denied'), lim            # THIS token is retired
+assert not lim.get('retry_after'), lim               # ...but the account is not parked
 assert lim['fetched_at'] == now - 950000, lim        # a FAILURE never invents freshness
-assert 'HTTP 403' in lim['last_error'], lim
 EOF
-  [ $? -eq 0 ] && t_ok "a refused fetch records a long backoff and keeps its stale fetched_at" \
-    || t_fail "403 backoff state" "see $SD/acct-01/limits.json"
+  [ $? -eq 0 ] && t_ok "a refused token is retired without parking the account, keeping its stale fetched_at" \
+    || t_fail "403 credential-scoped state" "see $SD/acct-01/limits.json"
 
   # The whole point: the next scheduled pass must NOT spend another request. Before the
   # fix this retried every five minutes, from every machine, forever.
@@ -1809,9 +1813,12 @@ EOF
   out="$(CLAUDE_ACCOUNTS_ROOT="$SD" CLAUDE_MULTIACC_USAGE_URL="http://127.0.0.1:$uport/scope-denied" \
          claude-accounts limits 2>&1)"
   after="$(wc -l < "$uhits")"
-  [ "$before" = "$after" ] && t_ok "a parked account is not re-fetched on the next pass" \
+  [ "$before" = "$after" ] && t_ok "a retired token is not re-offered on the next pass" \
     || t_fail "403 retry storm" "endpoint hit again ($before -> $after requests)"
-  check "the parked account says why it is waiting" "backing off after HTTP 403" "$out"
+  # It is the CREDENTIAL that is spent, so the message names the ceremony that
+  # replaces it rather than a clock the operator would otherwise sit and watch.
+  check "and says what would fix it, not how long to wait" \
+    "telemetry stays dark until: claude-accounts login acct-01" "$out"
 
   # Any other non-2xx backs off too — a 5xx retried every pass is the same storm.
   rm -f "$SD/acct-01/limits.json"
@@ -1990,6 +1997,57 @@ EOF
   [ "$before" = "$after" ] && t_ok "a token already refused for scope is not offered again" \
     || t_fail "token re-offered" "endpoint hit again ($before -> $after)"
   check "and the message says what would fix it" "claude-accounts login acct-01" "$out"
+  # ---- an OAuth account NEVER spends its setup token here, and a token refusal
+  # ---- never parks the ACCOUNT ------------------------------------------------
+  # Live symptom (my-mini, 2026-08-28): acct-02/acct-05 sat 1-5 HOURS stale with
+  # "backing off after HTTP 403 (source=token) — permanent" while their OAuth
+  # credentials were fine. The chain: the access token had expired minutes ago, so
+  # refresh_oauth declined (REFRESH_MIN_EXPIRED proves no live session owns it),
+  # the probe fell through to the setup token, the endpoint refused it for scope,
+  # and that parked the whole ACCOUNT for six hours — blocking the OAuth path that
+  # would have worked on the very next pass. The shim then ranked the pool on
+  # hour-old readings and said so ("usage telemetry is 1h old").
+  SD2="$WORK/token-poison"
+  mkdir -p "$SD2/acct-01" "$SD2/tmp"
+  : > "$SD2/.limits-kick"
+  cat > "$SD2/accounts.json" <<EOF
+{ "version": 1, "server": "root@203.0.113.1", "server_root": "/root/.claude-accounts",
+  "server_repo": "/root/claude-multiacc", "threshold": 90,
+  "accounts": [ {"id": "acct-01", "email": "poison@test", "home": "mac",
+                 "added_at": "2026-08-28T00:00:00Z"} ] }
+EOF
+  # An OAuth credential whose ACCESS token expired a moment ago: too recent for
+  # refresh_oauth to touch, so this pass has no bearer it may use.
+  printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-justexpired","refreshToken":"r","expiresAt":%s000,"refreshTokenExpiresAt":9999999999999}}' \
+    "$((now - 30))" > "$SD2/acct-01/.credentials.json"
+  printf 'sk-ant-oat01-PORTABLE0001\n' > "$SD2/acct-01/server.token"
+  before="$(wc -l < "$uhits")"
+  out="$(CLAUDE_ACCOUNTS_ROOT="$SD2" CLAUDE_MULTIACC_USAGE_URL="http://127.0.0.1:$uport/scope-denied" \
+         claude-accounts limits 2>&1)"
+  after="$(wc -l < "$uhits")"
+  [ "$before" = "$after" ] \
+    && t_ok "an OAuth account never spends its setup token on the usage endpoint" \
+    || t_fail "token spent" "the endpoint was called ($before -> $after) with a token that can only 403"
+  check "and it says it will simply retry" "retrying next pass" "$out"
+  [ ! -f "$SD2/acct-01/limits.json" ] \
+    && t_ok "no six-hour park is written for an account that merely missed a refresh" \
+    || t_fail "account parked" "$(cat "$SD2/acct-01/limits.json")"
+
+  # A token-only account still tries once (that is the only way to learn), but the
+  # refusal must park the CREDENTIAL, not the account: the digest is remembered and
+  # no retry_after is written, so a later OAuth login is free to work immediately.
+  rm -f "$SD2/acct-01/.credentials.json" "$SD2/acct-01/limits.json"
+  CLAUDE_ACCOUNTS_ROOT="$SD2" CLAUDE_MULTIACC_USAGE_URL="http://127.0.0.1:$uport/scope-denied" \
+    claude-accounts limits >/dev/null 2>&1
+  python3 - "$SD2/acct-01/limits.json" <<'EOF'
+import json, sys
+d = json.load(open(sys.argv[1]))
+assert d.get('token_scope_denied'), d
+assert not d.get('retry_after'), f"the account was parked by a credential refusal: {d}"
+EOF
+  [ $? -eq 0 ] && t_ok "a token scope refusal parks the credential, never the account" \
+    || t_fail "token refusal parked the account" "see $SD2/acct-01/limits.json"
+
   # Re-minting the token is a new credential, so it earns a fresh try.
   printf 'sk-ant-oat01-REMINTED01\n' > "$SD/acct-01/server.token"
   before="$(wc -l < "$uhits")"