claude-multiacc 2.0.8 → 2.0.10

package/bin/claude

@@ -559,17 +559,26 @@ client_auth_scan() { # $1 acct dir
   return 1
 }
 
-mark_proven_auth_dead() { # $1 acct dir, $2 fixed safe detail
-  local marked
+mark_proven_auth_dead() { # $1 acct dir, $2 fixed safe detail, $3 optional reason slug
+  local marked slug="${3:-auth-error}"
   marked="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-  { echo "$now"; echo "reason=auth-error marked_at=$marked detail=$2"; } \
+  { echo "$now"; echo "reason=$slug marked_at=$marked detail=$2"; } \
     2>/dev/null > "$1/.expired.$$" && mv -f "$1/.expired.$$" "$1/.expired" 2>/dev/null \
     || rm -f "$1/.expired.$$" 2>/dev/null || true
 }
 
 mark_client_auth_dead() { # $1 acct dir
-  mark_proven_auth_dead "$1" "client session failed to authenticate"
-  sel_log "$(basename "$1") parked (auth-error) — client-reported"
+  local tok
+  tok="$(acct_token "$1")"
+  if [ -n "$tok" ]; then
+    rm -f "$1/.server-token-verified" 2>/dev/null || true
+    mark_proven_auth_dead "$1" "client rejected the portable OAuth token" \
+      "setup-token-invalid"
+    sel_log "$(basename "$1") parked (setup-token-invalid) — client-reported"
+  else
+    mark_proven_auth_dead "$1" "client session failed to authenticate"
+    sel_log "$(basename "$1") parked (auth-error) — client-reported"
+  fi
 }
 
 mark_client_limit() { # $1 acct dir, $2 reset epoch, $3 rate limit type
@@ -750,8 +759,9 @@ token_preflight() { # $1 acct dir, $2 setup-token; rc 1 only for proven invalid
   if [ "$rc" -ne 0 ] \
     && grep -qiE "$token_auth_pat" "$tmpd/out" "$tmpd/err" 2>/dev/null; then
     rm -f "$marker" 2>/dev/null || true
-    mark_proven_auth_dead "$d" "portable OAuth token rejected by inference preflight"
-    sel_log "$(basename "$d") parked (auth-error) — setup-token preflight returned 401"
+    mark_proven_auth_dead "$d" "portable OAuth token rejected by inference preflight" \
+      "setup-token-invalid"
+    sel_log "$(basename "$d") parked (setup-token-invalid) — preflight returned 401"
     rm -rf "$tmpd"
     return 1
   fi
@@ -1244,9 +1254,14 @@ while :; do
       park_detail="the account's organization has disabled Claude Code subscription access"
       park_soft=$((now + PARK_SOFT_ORG))
     elif grep -qiE "$PARK_AUTH" "$tmpd/out" "$tmpd/err" 2>/dev/null; then
-      park_reason="auth-error"
-      park_detail="run failed to authenticate"
-      park_soft=$((now + PARK_SOFT_AUTH))
+      if [ -n "$tok" ]; then
+        park_reason="setup-token-invalid"
+        park_detail="run rejected the portable OAuth token"
+      else
+        park_reason="auth-error"
+        park_detail="run failed to authenticate"
+        park_soft=$((now + PARK_SOFT_AUTH))
+      fi
     fi
     # An account that ran out of ONE model has not run out. Cooling it down would
     # take a perfectly usable account out of the pool for every other model too —
@@ -1254,13 +1269,20 @@ while :; do
     model_scoped=0
     grep -qiE "$MODEL_LIMITPAT" "$tmpd/out" "$tmpd/err" 2>/dev/null && model_scoped=1
     if [ -n "$park_reason" ]; then
-      {
-        echo "$now"
-        echo "reason=$park_reason soft_until=$park_soft marked_at=$(date -u +%Y-%m-%dT%H:%M:%SZ) detail=$park_detail"
-      } 2>/dev/null > "$cur/.expired.$$" \
+      if [ "$park_reason" = "setup-token-invalid" ]; then
+        rm -f "$cur/.server-token-verified" 2>/dev/null || true
+        park_line="reason=$park_reason marked_at=$(date -u +%Y-%m-%dT%H:%M:%SZ) detail=$park_detail"
+      else
+        park_line="reason=$park_reason soft_until=$park_soft marked_at=$(date -u +%Y-%m-%dT%H:%M:%SZ) detail=$park_detail"
+      fi
+      { echo "$now"; echo "$park_line"; } 2>/dev/null > "$cur/.expired.$$" \
         && mv -f "$cur/.expired.$$" "$cur/.expired" 2>/dev/null \
         || rm -f "$cur/.expired.$$" 2>/dev/null || true
-      sel_log "$(basename "$cur") parked ($park_reason until $park_soft) — see: claude-accounts expired"
+      if [ "$park_reason" = "setup-token-invalid" ]; then
+        sel_log "$(basename "$cur") parked ($park_reason, durable) — see: claude-accounts expired"
+      else
+        sel_log "$(basename "$cur") parked ($park_reason until $park_soft) — see: claude-accounts expired"
+      fi
     elif [ "$model_scoped" = 0 ]; then
       {
         echo $((now + 600))

package/bin/claude-accounts

@@ -227,6 +227,8 @@ for a in accounts:
     flags = []
     if st['state'] == 'expired':
         flags.append('EXPIRED-LOGIN')
+    elif st['state'] == 'token-invalid':
+        flags.append('INVALID-TOKEN')
     elif st['state'] == 'blocked':
         flags.append('ORG-BLOCKED')
     elif st['state'] == 'missing':
@@ -239,7 +241,7 @@ for a in accounts:
           f"auth={'+'.join(auth) or 'NONE':<11} {' '.join(flags)}")
 bad = [a for a in accounts
        if audit_account(root, a, machine=machine)['state']
-       in ('expired', 'blocked', 'missing')]
+       in ('expired', 'token-invalid', 'blocked', 'missing')]
 if bad:
     print()
     print(f"{len(bad)} account(s) are NOT usable — details: claude-accounts expired")
@@ -317,13 +319,15 @@ for a in doc.get('accounts', []):
     aid = a['id']
     d = os.path.join(root, aid)
     st = audit_account(root, a, machine=machine)
-    if st['state'] in ('expired', 'blocked', 'missing'):
+    if st['state'] in ('expired', 'token-invalid', 'blocked', 'missing'):
         needs_login.append(aid)
     else:
         selectable_ids.append(aid)
     banner = {'ok': '', 'remote': '  [not logged in here — grant lives elsewhere]',
               'missing': '  ** NO LOGIN — claude-accounts relogin %s **' % aid,
               'expired': '  ** LOGIN EXPIRED — claude-accounts relogin %s **' % aid,
+              'token-invalid': ('  ** SETUP-TOKEN INVALID — '
+                                'claude-accounts login %s --token **' % aid),
               'blocked': '  ** ORG BLOCKED — Claude Code disabled for this account **',
               'locked': '  [login is in the macOS Keychain — locked for THIS session, fine from the Mac itself]',
               }[st['state']]
@@ -1040,17 +1044,34 @@ cmd_expired() {
     die "the manifest lists accounts but none could be audited — check $MANIFEST"
   fi
   bad="$(printf '%s\n' "$rows" \
-    | awk -F'\t' 'NF >= 4 && $1 != "" && $4 ~ /^(expired|blocked|missing|unverified)$/ { print $1 }')"
+    | awk -F'\t' '
+      NF >= 4 && $1 != "" && $4 ~ /^(expired|token-invalid|blocked|missing|unverified)$/ {
+        print $1
+      }')"
   if [ "$quiet" = "1" ]; then
     [ -n "$bad" ] || return 0
     printf '%s\n' "$bad"
     return 1
   fi
   printf '%s\n' "$rows" | awk -F'\t' '
-    BEGIN { bad = 0; ok = 0; remote = 0; relogin = 0 }
+    BEGIN { bad = 0; ok = 0; remote = 0; relogin = 0; retoken = 0; unverified = 0 }
     NF < 4 || $1 == "" { next }          # never invent an account from a blank line
     $4 == "ok"     { ok++; next }
     $4 == "remote" { remote++; rem = rem sprintf("  %-9s %-28s %s\n", $1, $2, $6); next }
+    $4 == "unverified" {
+      bad++
+      unverified++
+      printf "  %-9s %-28s %-9s %s\n", $1, $2, $5, $6
+      printf "  %-9s %-28s %-9s fix: %s\n", "", "", "", $7
+      next
+    }
+    $4 == "token-invalid" {
+      bad++
+      retoken++
+      printf "  %-9s %-28s %-13s %s\n", $1, $2, $5, $6
+      printf "  %-9s %-28s %-13s fix: %s\n", "", "", "", $7
+      next
+    }
     {
       bad++
       relogin++
@@ -1064,13 +1085,21 @@ cmd_expired() {
         printf "\nNot logged in here on purpose (another machine owns the grant):\n"
         printf "%s", rem
       }
+      if (unverified > 0) {
+        printf "\nVerify portable tokens:\n"
+        printf "  claude-accounts verify\n"
+      }
+      if (retoken > 0) {
+        printf "\nReplace invalid portable setup-tokens:\n"
+        printf "  claude-accounts login acct-NN --token\n"
+      }
       if (relogin > 0) {
         printf "\nRe-authenticate them:\n"
         printf "  claude-accounts relogin            # every account that needs it\n"
         printf "  claude-accounts relogin acct-NN    # just one\n"
       }
     }'
-  # Exit 1 when something needs a human, so cron/health checks can alert on it.
+  # Exit 1 when something needs attention, so cron/health checks can alert on it.
   [ -z "$bad" ]
 }
 
@@ -2164,8 +2193,14 @@ for acct in manifest.get('accounts', []):
                 os.remove(os.path.join(d, '.server-token-verified'))
             except OSError:
                 pass
-            mark_expired(d, 'auth-error', 'a real call came back not-authenticated')
-            hint = f' — login is dead, run: claude-accounts relogin {aid}'
+            if uses_token:
+                mark_expired(d, 'setup-token-invalid',
+                             'portable setup-token failed a real inference')
+                hint = (f' — portable setup-token is invalid, run: '
+                        f'claude-accounts login {aid} --token')
+            else:
+                mark_expired(d, 'auth-error', 'a real call came back not-authenticated')
+                hint = f' — login is dead, run: claude-accounts relogin {aid}'
         print(f'{aid} {acct["email"]}: FAIL rc={r.returncode} '
               f'out={out[:120]!r} err={err!r}{hint}')
         failures += 1

package/docs/ACCOUNT_OPERATIONS.md

@@ -215,7 +215,8 @@ providers (`lib/report.py`), so a consumer writes one parser:
   "accounts": [{
     "id": "acct-05", "email": "…", "home": "mac", "added_at": "…Z",
     "home_dir": "/Users/gas/.claude-accounts/acct-05", "adopted": false,
-    "status": "active",            // active|limited|expired|blocked|missing|remote
+    "status": "active",            // active|limited|expired|token-invalid|blocked
+                                   // missing|remote
     "state": "ok", "label": "OK", "reason": "…", "fix": "…",
     "selectable": true, "needs_login": false,
     "credential_class": "portable", // portable|machine-local|none

package/lib/audit.py

@@ -5,6 +5,7 @@ shim's selection rule (bin/claude: creds_dead / expired_marked / auth_dead).
 States:
   ok       usable right now (live OAuth credential, or a portable server.token)
   expired  has auth material that CANNOT authenticate — needs `claude-accounts relogin`
+  token-invalid  a portable setup-token was rejected — needs a new setup-token, not a login
   blocked  authenticates, but its organization has disabled Claude Code subscription
            access — a re-login cannot fix it, so it needs an admin (or removal)
   locked   the OAuth login is in the macOS Keychain and THIS session cannot open it
@@ -193,8 +194,9 @@ def oauth_login(d, now):
     return {'store': None, 'state': None, 'reason': '', 'doc': None}
 
 
-LABELS = {'ok': 'OK', 'expired': 'EXPIRED', 'blocked': 'BLOCKED', 'locked': 'KEYCHAIN LOCKED',
-          'missing': 'NO LOGIN', 'remote': 'ELSEWHERE', 'unverified': 'UNVERIFIED'}
+LABELS = {'ok': 'OK', 'expired': 'EXPIRED', 'token-invalid': 'TOKEN INVALID',
+          'blocked': 'BLOCKED', 'locked': 'KEYCHAIN LOCKED', 'missing': 'NO LOGIN',
+          'remote': 'ELSEWHERE', 'unverified': 'UNVERIFIED'}
 
 # `import --home` speaks mac|server; machine_kind() speaks mac|linux. Same two boxes,
 # two vocabularies — normalize, or an un-authenticated account on the very machine that
@@ -216,6 +218,8 @@ def _elsewhere(home, machine):
 
 
 def _fix_for(state, aid):
+    if state == 'token-invalid':
+        return f'claude-accounts login {aid} --token'
     if state == 'blocked':
         # A fresh sign-in re-issues the grant and in practice clears this, so it is
         # handled like any other dead login. If it comes back BLOCKED after a re-login,
@@ -266,6 +270,9 @@ def audit_account(root, acct, now=None, machine=None, require_verified_token=Fal
             row['state'] = 'blocked'
             row['reason'] = ('this account\'s organization has disabled Claude Code '
                              'subscription access')
+        elif slug == 'setup-token-invalid':
+            row['state'] = 'token-invalid'
+            row['reason'] = 'portable setup-token was rejected by a real inference'
         else:
             row['state'] = 'expired'
             row['reason'] = f'marked dead by the pool ({detail or "authentication failed"})'

package/lib/common.sh

@@ -495,7 +495,8 @@ clear_auth_markers() { # $1 = acct dir
   rm -f "$1/.expired" "$1/.oauth-refresh.json" 2>/dev/null || true
 }
 
-# TSV rows: id, email, home, state (ok|expired|blocked|missing|remote), label, reason, fix.
+# TSV rows: id, email, home, state
+# (ok|expired|token-invalid|blocked|missing|remote|locked|unverified), label, reason, fix.
 # Fails LOUD (nonzero, message on stderr): callers decide policy from these rows, and a
 # silently empty audit reads exactly like a perfectly healthy pool.
 account_audit() {
@@ -518,7 +519,8 @@ account_audit() {
 # Ids the shim will NOT select — everything a human has to look at.
 accounts_unusable() {
   account_audit \
-    | awk -F'\t' 'NF >= 4 && $1 != "" && ($4 == "expired" || $4 == "blocked" || $4 == "missing") { print $1 }'
+    | awk -F'\t' \
+      'NF >= 4 && $1 != "" && $4 ~ /^(expired|token-invalid|blocked|missing)$/ { print $1 }'
 }
 
 # Ids a re-login should be pointed at. Org-blocked accounts are included: a fresh

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.8",
+  "version": "2.0.10",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -515,7 +515,7 @@ case "$out" in
   *"API Error: 401"*) t_fail "revoked setup-token hides preflight 401" "401 reached caller" ;;
   *) t_ok "revoked setup-token hides preflight 401" ;;
 esac
-grep -q 'reason=auth-error' "$ACC/acct-01/.expired" 2>/dev/null \
+grep -q 'reason=setup-token-invalid' "$ACC/acct-01/.expired" 2>/dev/null \
   && t_ok "revoked setup-token writes .expired" \
   || t_fail "revoked setup-token marker" ".expired missing"
 if grep -q 'soft_until=' "$ACC/acct-01/.expired" 2>/dev/null; then
@@ -523,6 +523,37 @@ if grep -q 'soft_until=' "$ACC/acct-01/.expired" 2>/dev/null; then
 else
   t_ok "proven token rejection is durable"
 fi
+out="$(claude-accounts expired 2>&1)"
+check "revoked setup-token is not mislabeled as a dead login" "TOKEN INVALID" "$out"
+check "revoked setup-token gets the token replacement fix" \
+  "claude-accounts login acct-01 --token" "$out"
+case "$out" in
+  *"claude-accounts relogin acct-01"*)
+    t_fail "revoked setup-token does not recommend re-login" "wrong recovery shown" ;;
+  *) t_ok "revoked setup-token does not recommend re-login" ;;
+esac
+# A token can be revoked after it passed preflight. The captured -p path must retire
+# that exact verified token too, rather than giving it a one-hour generic login park.
+rm -f "$ACC/acct-01/.expired"
+token_digest="$(printf '%s' 'sk-ant-oat01-REVOKEDREVOKEDREVOKEDREVOKEDREVOKEDREVOKED' \
+  | { shasum -a 256 2>/dev/null || sha256sum; } | cut -d ' ' -f1)"
+printf '%s\n' "$token_digest" > "$ACC/acct-01/.server-token-verified"
+out="$(claude -p 'Reply OK' < /dev/null 2>&1)"
+case "$out" in
+  *"API Error: 401"*) t_fail "revoked verified token hides runtime 401" "401 reached caller" ;;
+  *) t_ok "revoked verified token hides runtime 401" ;;
+esac
+grep -q 'reason=setup-token-invalid' "$ACC/acct-01/.expired" 2>/dev/null \
+  && t_ok "revoked verified token keeps token classification" \
+  || t_fail "revoked verified token marker" ".expired missing"
+[ ! -f "$ACC/acct-01/.server-token-verified" ] \
+  && t_ok "revoked verified token clears its proof" \
+  || t_fail "revoked verified token proof" "verification marker survived"
+if grep -q 'soft_until=' "$ACC/acct-01/.expired" 2>/dev/null; then
+  t_fail "revoked verified token is durably quarantined" "marker has a soft expiry"
+else
+  t_ok "revoked verified token is durably quarantined"
+fi
 out="$(CLAUDE_ACCOUNT=acct-01 claude --resume d6ccbac0-6643-4780-a99e-3afa1683478e 2>&1)"
 rc=$?
 check "pinned revoked setup-token is classified before --resume" \
@@ -2463,6 +2494,11 @@ out="$(claude-accounts expired 2>&1)"
 check "expired does not call an unverified setup-token healthy" "acct-01" "$out"
 check "expired labels an unverified setup-token" "UNVERIFIED" "$out"
 check "expired gives the setup-token verification fix" "claude-accounts verify" "$out"
+case "$out" in
+  *"Re-authenticate them"*)
+    t_fail "unverified setup-token does not demand re-login" "expired gave the wrong fix" ;;
+  *) t_ok "unverified setup-token does not demand re-login" ;;
+esac
 out="$(claude-accounts verify 2>&1)"
 case "$out" in *"acct-01 a@test: PASS"*) t_ok "verify uses the portable token when the credential is dead" ;;
   *) t_fail "verify token fallback" "expected acct-01 PASS, got: $(printf '%s' "$out" | grep acct-01)" ;; esac
@@ -2475,7 +2511,19 @@ state="$(python3 "$REPO_DIR/lib/audit.py" "$ACC" "$(uname -s | tr '[:upper:]' '[
   strict-tokens | awk -F'\t' '$1=="acct-01"{print $4}')"
 [ "$state" = "ok" ] && t_ok "verified setup-token is no longer false-unknown" \
   || t_fail "verified setup-token audit" "expected ok, got: $state"
+printf 'sk-ant-oat01-REVOKEDREVOKEDREVOKEDREVOKEDREVOKEDREVOKED' \
+  > "$ACC/acct-01/server.token"
+rm -f "$ACC/acct-01/.server-token-verified"
+out="$(claude-accounts verify 2>&1)"
+check "verify calls a rejected setup-token what it is" "portable setup-token is invalid" "$out"
+check "verify recommends replacing a rejected setup-token" \
+  "claude-accounts login acct-01 --token" "$out"
+out="$(claude-accounts expired 2>&1)"
+check "verify marker retains setup-token classification" "TOKEN INVALID" "$out"
+check "verify marker retains setup-token recovery" \
+  "claude-accounts login acct-01 --token" "$out"
 rm -f "$ACC/acct-01/server.token"
+rm -f "$ACC/acct-01/.expired" "$ACC/acct-01/.server-token-verified"
 printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-test01","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999}}' > "$ACC/acct-01/.credentials.json"
 
 # ---- 17c. audit: machine vocabulary (home=server vs machine_kind=linux) ---------------