claude-multiacc 2.0.9 → 2.0.11

package/bin/claude

@@ -559,17 +559,26 @@ client_auth_scan() { # $1 acct dir
   return 1
 }
 
-mark_proven_auth_dead() { # $1 acct dir, $2 fixed safe detail
-  local marked
+mark_proven_auth_dead() { # $1 acct dir, $2 fixed safe detail, $3 optional reason slug
+  local marked slug="${3:-auth-error}"
   marked="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-  { echo "$now"; echo "reason=auth-error marked_at=$marked detail=$2"; } \
+  { echo "$now"; echo "reason=$slug marked_at=$marked detail=$2"; } \
     2>/dev/null > "$1/.expired.$$" && mv -f "$1/.expired.$$" "$1/.expired" 2>/dev/null \
     || rm -f "$1/.expired.$$" 2>/dev/null || true
 }
 
 mark_client_auth_dead() { # $1 acct dir
-  mark_proven_auth_dead "$1" "client session failed to authenticate"
-  sel_log "$(basename "$1") parked (auth-error) — client-reported"
+  local tok
+  tok="$(acct_token "$1")"
+  if [ -n "$tok" ]; then
+    rm -f "$1/.server-token-verified" 2>/dev/null || true
+    mark_proven_auth_dead "$1" "client rejected the portable OAuth token" \
+      "setup-token-invalid"
+    sel_log "$(basename "$1") parked (setup-token-invalid) — client-reported"
+  else
+    mark_proven_auth_dead "$1" "client session failed to authenticate"
+    sel_log "$(basename "$1") parked (auth-error) — client-reported"
+  fi
 }
 
 mark_client_limit() { # $1 acct dir, $2 reset epoch, $3 rate limit type
@@ -750,8 +759,9 @@ token_preflight() { # $1 acct dir, $2 setup-token; rc 1 only for proven invalid
   if [ "$rc" -ne 0 ] \
     && grep -qiE "$token_auth_pat" "$tmpd/out" "$tmpd/err" 2>/dev/null; then
     rm -f "$marker" 2>/dev/null || true
-    mark_proven_auth_dead "$d" "portable OAuth token rejected by inference preflight"
-    sel_log "$(basename "$d") parked (auth-error) — setup-token preflight returned 401"
+    mark_proven_auth_dead "$d" "portable OAuth token rejected by inference preflight" \
+      "setup-token-invalid"
+    sel_log "$(basename "$d") parked (setup-token-invalid) — preflight returned 401"
     rm -rf "$tmpd"
     return 1
   fi
@@ -1244,9 +1254,14 @@ while :; do
       park_detail="the account's organization has disabled Claude Code subscription access"
       park_soft=$((now + PARK_SOFT_ORG))
     elif grep -qiE "$PARK_AUTH" "$tmpd/out" "$tmpd/err" 2>/dev/null; then
-      park_reason="auth-error"
-      park_detail="run failed to authenticate"
-      park_soft=$((now + PARK_SOFT_AUTH))
+      if [ -n "$tok" ]; then
+        park_reason="setup-token-invalid"
+        park_detail="run rejected the portable OAuth token"
+      else
+        park_reason="auth-error"
+        park_detail="run failed to authenticate"
+        park_soft=$((now + PARK_SOFT_AUTH))
+      fi
     fi
     # An account that ran out of ONE model has not run out. Cooling it down would
     # take a perfectly usable account out of the pool for every other model too —
@@ -1254,13 +1269,20 @@ while :; do
     model_scoped=0
     grep -qiE "$MODEL_LIMITPAT" "$tmpd/out" "$tmpd/err" 2>/dev/null && model_scoped=1
     if [ -n "$park_reason" ]; then
-      {
-        echo "$now"
-        echo "reason=$park_reason soft_until=$park_soft marked_at=$(date -u +%Y-%m-%dT%H:%M:%SZ) detail=$park_detail"
-      } 2>/dev/null > "$cur/.expired.$$" \
+      if [ "$park_reason" = "setup-token-invalid" ]; then
+        rm -f "$cur/.server-token-verified" 2>/dev/null || true
+        park_line="reason=$park_reason marked_at=$(date -u +%Y-%m-%dT%H:%M:%SZ) detail=$park_detail"
+      else
+        park_line="reason=$park_reason soft_until=$park_soft marked_at=$(date -u +%Y-%m-%dT%H:%M:%SZ) detail=$park_detail"
+      fi
+      { echo "$now"; echo "$park_line"; } 2>/dev/null > "$cur/.expired.$$" \
         && mv -f "$cur/.expired.$$" "$cur/.expired" 2>/dev/null \
         || rm -f "$cur/.expired.$$" 2>/dev/null || true
-      sel_log "$(basename "$cur") parked ($park_reason until $park_soft) — see: claude-accounts expired"
+      if [ "$park_reason" = "setup-token-invalid" ]; then
+        sel_log "$(basename "$cur") parked ($park_reason, durable) — see: claude-accounts expired"
+      else
+        sel_log "$(basename "$cur") parked ($park_reason until $park_soft) — see: claude-accounts expired"
+      fi
     elif [ "$model_scoped" = 0 ]; then
       {
         echo $((now + 600))

package/bin/claude-accounts

@@ -227,6 +227,8 @@ for a in accounts:
     flags = []
     if st['state'] == 'expired':
         flags.append('EXPIRED-LOGIN')
+    elif st['state'] == 'token-invalid':
+        flags.append('INVALID-TOKEN')
     elif st['state'] == 'blocked':
         flags.append('ORG-BLOCKED')
     elif st['state'] == 'missing':
@@ -239,7 +241,7 @@ for a in accounts:
           f"auth={'+'.join(auth) or 'NONE':<11} {' '.join(flags)}")
 bad = [a for a in accounts
        if audit_account(root, a, machine=machine)['state']
-       in ('expired', 'blocked', 'missing')]
+       in ('expired', 'token-invalid', 'blocked', 'missing')]
 if bad:
     print()
     print(f"{len(bad)} account(s) are NOT usable — details: claude-accounts expired")
@@ -317,13 +319,15 @@ for a in doc.get('accounts', []):
     aid = a['id']
     d = os.path.join(root, aid)
     st = audit_account(root, a, machine=machine)
-    if st['state'] in ('expired', 'blocked', 'missing'):
+    if st['state'] in ('expired', 'token-invalid', 'blocked', 'missing'):
         needs_login.append(aid)
     else:
         selectable_ids.append(aid)
     banner = {'ok': '', 'remote': '  [not logged in here — grant lives elsewhere]',
               'missing': '  ** NO LOGIN — claude-accounts relogin %s **' % aid,
               'expired': '  ** LOGIN EXPIRED — claude-accounts relogin %s **' % aid,
+              'token-invalid': ('  ** SETUP-TOKEN INVALID — '
+                                'claude-accounts login %s --token **' % aid),
               'blocked': '  ** ORG BLOCKED — Claude Code disabled for this account **',
               'locked': '  [login is in the macOS Keychain — locked for THIS session, fine from the Mac itself]',
               }[st['state']]
@@ -504,8 +508,7 @@ cmd_add() {
     # Portable setup-token variant (works on Mac AND server; needs a recent sign-in).
     echo "Preparing $id for $elabel (portable token) — NOTHING is registered until sign-in completes."
     run_token_ceremony "$d" || die "sign-in failed or aborted — nothing was created"
-    ( umask 077; printf '%s' "$CEREMONY_TOKEN" > "$d/server.token" )
-    chmod 600 "$d/server.token"
+    commit_ceremony_token "$d" "$CEREMONY_TOKEN" "$id"
     got="$(token_email "$CEREMONY_TOKEN")"
   else
     # Default: full Claude Code login (full scopes, no long-lived-token step-up).
@@ -567,7 +570,9 @@ EOF
 
 add_cleanup_reserved() {
   # EXIT trap for cmd_add: remove a reserved-but-uncommitted account dir (and, in case
-  # we died mid-critical-section, release the lock).
+  # we died mid-critical-section, release the lock). A ceremony interrupted mid-way
+  # must also hand the terminal back at its own width.
+  restore_ceremony_tty 2>/dev/null || true
   [ -n "${RESERVED_DIR:-}" ] && rm -rf "$RESERVED_DIR" 2>/dev/null
   mutate_unlock 2>/dev/null || true
 }
@@ -790,6 +795,137 @@ valid_subscription_token() {
   esac
 }
 
+# A complete subscription setup-token is 108 characters (sk-ant-oat01- + 95). The
+# ceremony scrapes it from a terminal transcript, and the client's TUI HARD-WRAPS at
+# the pty's width — an unsized pty (the panel's) renders as 80 columns. Every
+# panel-driven mint of 2026-08-28 therefore saved the first 79 characters of a
+# 108-character token; the fleet rejected all seven with 401 while the minting Mac,
+# still holding its OAuth login, looked healthy. Two guards, belt and braces: the
+# terminal is widened for the ceremony, and the capture must pass a real inference
+# before it is saved anywhere.
+SETUP_TOKEN_FULL_LEN=108
+CEREMONY_TTY_MIN_COLS=160
+CEREMONY_TTY_COLS=400
+CEREMONY_TTY_ORIG=""
+
+widen_ceremony_tty() {
+  CEREMONY_TTY_ORIG=""
+  [ -t 0 ] || return 0
+  local size rows cols
+  size="$(stty size 2>/dev/null)" || return 0
+  rows="${size%% *}"; cols="${size##* }"
+  case "$cols" in ''|*[!0-9]*) return 0 ;; esac
+  case "$rows" in ''|*[!0-9]*) rows=0 ;; esac
+  [ "$cols" -ge "$CEREMONY_TTY_MIN_COLS" ] && return 0
+  CEREMONY_TTY_ORIG="$rows $cols"
+  # `script` copies stdin's window size to the pty it opens for the client, so
+  # widening here is what the client sees. A zero row count is an unsized pty too.
+  stty cols "$CEREMONY_TTY_COLS" rows "$([ "$rows" -gt 0 ] && echo "$rows" || echo 50)" 2>/dev/null \
+    || CEREMONY_TTY_ORIG=""
+}
+
+restore_ceremony_tty() {
+  [ -n "$CEREMONY_TTY_ORIG" ] || return 0
+  stty rows "${CEREMONY_TTY_ORIG%% *}" cols "${CEREMONY_TTY_ORIG##* }" 2>/dev/null || true
+  CEREMONY_TTY_ORIG=""
+}
+
+token_digest() { # $1 token; prints a non-secret sha256 digest (same as the shim's)
+  local h=""
+  if command -v shasum >/dev/null 2>&1; then
+    h="$(printf '%s' "$1" | shasum -a 256 2>/dev/null)"
+  elif command -v sha256sum >/dev/null 2>&1; then
+    h="$(printf '%s' "$1" | sha256sum 2>/dev/null)"
+  fi
+  printf '%s' "$h" | cut -d ' ' -f1
+}
+
+record_token_verified() { # $1 acct dir, $2 token — the shim's own proof marker (token_preflight)
+  local digest
+  digest="$(token_digest "$2")"
+  [ -n "$digest" ] || return 0
+  { umask 077; printf '%s\n' "$digest" > "$1/.server-token-verified.$$"; } 2>/dev/null \
+    && mv -f "$1/.server-token-verified.$$" "$1/.server-token-verified" 2>/dev/null \
+    || rm -f "$1/.server-token-verified.$$" 2>/dev/null || true
+}
+
+# Prove a captured token with ONE real inference before it is saved. rc 0 = Claude
+# answered with it; rc 1 = Claude REJECTED it (401: revoked, wrong account's grant,
+# or captured incomplete); rc 2 = inconclusive (network, 429, timeout). The probe runs
+# in an EMPTY config dir: the account dir may hold an OAuth login the client would
+# silently prefer, and this must exercise the captured token and nothing else. The
+# token travels by environment, never argv.
+CEREMONY_CHECK_DETAIL=""
+ceremony_probe() { # $1 = real claude, $2 = empty config dir; token in CEREMONY_TOKEN_UNDER_TEST
+  "$PYBIN" - "$1" "$2" "$ACC_ROOT" <<'PYEOF'
+import os, re, subprocess, sys
+real, cfg, root = sys.argv[1], sys.argv[2], sys.argv[3]
+env = {k: v for k, v in os.environ.items()
+       if k not in ('ANTHROPIC_API_KEY', 'CLAUDE_ACCOUNT', 'CEREMONY_TOKEN_UNDER_TEST')}
+env['CLAUDE_CONFIG_DIR'] = cfg
+env['CLAUDE_CODE_OAUTH_TOKEN'] = os.environ['CEREMONY_TOKEN_UNDER_TEST']
+env['CLAUDE_SHIM_ACTIVE'] = '1'
+# The shim's own vocabulary for a rejected token (bin/claude token_preflight).
+AUTH = re.compile(r'failed to authenticate|oauth (access )?token is invalid|oauth session expired'
+                  r'|please run /login|invalid bearer token|authentication_error|\b401\b', re.I)
+try:
+    r = subprocess.run([real, '-p', '--output-format', 'text', '--max-turns', '1'],
+                       env=env, capture_output=True, text=True, timeout=180,
+                       input='Reply with exactly: OK\n', cwd=root)
+except subprocess.TimeoutExpired:
+    print('inconclusive\ttimed out after 180s'); sys.exit(0)
+except OSError as exc:
+    print(f'inconclusive\t{exc}'); sys.exit(0)
+out, err = (r.stdout or '').strip(), (r.stderr or '').strip()
+if r.returncode == 0 and 'ok' in out.lower():
+    print('ok\t'); sys.exit(0)
+if AUTH.search(out) or AUTH.search(err):
+    print('rejected\t' + (err or out)[:160].replace('\n', ' ')); sys.exit(0)
+print('inconclusive\t' + f'rc={r.returncode} ' + (err or out)[:160].replace('\n', ' '))
+PYEOF
+}
+
+ceremony_token_check() { # $1 = token
+  local tok="$1" real tmpd verdict
+  CEREMONY_CHECK_DETAIL=""
+  real="$(find_real_claude "$_self")" || { CEREMONY_CHECK_DETAIL="real claude binary not found"; return 2; }
+  mkdir -p "$ACC_ROOT/tmp" 2>/dev/null || true
+  tmpd="$(mktemp -d "$ACC_ROOT/tmp/mint-check.XXXXXX" 2>/dev/null)" \
+    || { CEREMONY_CHECK_DETAIL="cannot create a scratch config dir"; return 2; }
+  chmod 700 "$tmpd" 2>/dev/null || true
+  verdict="$(CEREMONY_TOKEN_UNDER_TEST="$tok" ceremony_probe "$real" "$tmpd")"
+  rm -rf "$tmpd" 2>/dev/null || true
+  case "$verdict" in
+    ok*) return 0 ;;
+    rejected*) CEREMONY_CHECK_DETAIL="${verdict#rejected	}"; return 1 ;;
+    inconclusive*) CEREMONY_CHECK_DETAIL="${verdict#inconclusive	}"; return 2 ;;
+    *) CEREMONY_CHECK_DETAIL="no verdict"; return 2 ;;
+  esac
+}
+
+# The ONE place a ceremony's token is written: only after ceremony_token_check, so a
+# token Claude rejects is never saved, uploaded, or distributed. $1 = acct dir,
+# $2 = token, $3 = acct id (messages only).
+commit_ceremony_token() {
+  local d="$1" tok="$2" id="$3" rc=0
+  ceremony_token_check "$tok" || rc=$?
+  if [ "$rc" -eq 1 ]; then
+    if [ "${#tok}" -lt "$SETUP_TOKEN_FULL_LEN" ]; then
+      die "Claude rejected the captured token (${CEREMONY_CHECK_DETAIL:-401}) — it is ${#tok} characters and a complete setup-token is $SETUP_TOKEN_FULL_LEN: the sign-in terminal wrapped it and only its first line was captured. Nothing saved for $id. Mint again from a terminal at least $CEREMONY_TTY_MIN_COLS columns wide, or from an updated panel."
+    fi
+    die "Claude rejected the captured token (${CEREMONY_CHECK_DETAIL:-401}) — nothing saved for $id; sign in again as the right account and retry"
+  fi
+  ( umask 077; printf '%s' "$tok" > "$d/server.token" )
+  chmod 600 "$d/server.token"
+  if [ "$rc" -eq 0 ]; then
+    record_token_verified "$d" "$tok"
+    echo "Token verified by a real inference."
+  else
+    rm -f "$d/.server-token-verified" 2>/dev/null || true
+    warn "the token could not be verified right now (${CEREMONY_CHECK_DETAIL:-no answer}) — saved as UNVERIFIED; the shim proves it on first use, or run: claude-accounts verify"
+  fi
+}
+
 CEREMONY_TOKEN=""
 run_token_ceremony() { # $1 = config dir
   CEREMONY_TOKEN=""
@@ -813,11 +949,16 @@ If you do see "Sign in again to continue", that is Claude's security step, not a
 error — just sign in to that account and approve; the code still appears.
 TIP
   if [ -t 0 ]; then
+    # The client's TUI hard-wraps at the pty's width, and the token is scraped from
+    # the transcript below — see SETUP_TOKEN_FULL_LEN for the 79-character tokens
+    # this produced. `script` copies the (widened) window size to the client's pty.
+    widen_ceremony_tty
     if [ "$(machine_kind)" = "mac" ]; then
       script -q "$cap" env CLAUDE_CONFIG_DIR="$d" CLAUDE_SHIM_ACTIVE=1 "$real" setup-token
     else
       script -q -c "CLAUDE_CONFIG_DIR='$d' CLAUDE_SHIM_ACTIVE=1 '$real' setup-token" "$cap"
     fi
+    restore_ceremony_tty
   else
     # Headless (tests / piped code): capture into the 0600 file only. Never tee the
     # raw token to stdout — a redirected run would write the secret to a plain log.
@@ -825,7 +966,10 @@ TIP
     sed -E 's/sk-ant-oat[0-9]{2}-[A-Za-z0-9_-]*/sk-ant-oat**-<redacted>/g' "$cap"
   fi
   umask "$old_umask"
-  CEREMONY_TOKEN="$(grep -aoE 'sk-ant-oat[0-9]{2}-[A-Za-z0-9_-]{40,}' "$cap" | tail -1)"
+  # The LONGEST match, not the last: a TUI repaints its frame many times, and a
+  # frame rendered while the terminal was still narrow holds a wrapped fragment.
+  CEREMONY_TOKEN="$(grep -aoE 'sk-ant-oat[0-9]{2}-[A-Za-z0-9_-]{40,}' "$cap" \
+    | awk '{ if (length($0) > length(best)) best = $0 } END { if (best != "") print best }')"
   rm -f "$cap"
   [ -n "$CEREMONY_TOKEN" ] || return 1
   valid_subscription_token "$CEREMONY_TOKEN" || {
@@ -937,6 +1081,8 @@ cmd_mint() {
   local email tok="" got
   email="$(account_email "$id")"
   [ -n "$email" ] || die "$id has no email in the manifest — refusing to mint a token nobody could attribute"
+  trap 'restore_ceremony_tty; exit 130' INT TERM
+  trap 'restore_ceremony_tty' EXIT
   if [ "$paste" = "1" ]; then
     printf 'Paste the sk-ant-oat... token for %s (%s): ' "$id" "${email:-unknown email}"
     read -r tok
@@ -953,8 +1099,7 @@ cmd_mint() {
   if [ -n "$got" ] && [ -n "$email" ] && [ "$got" != "$email" ]; then
     die "that token authenticates as $got but $id is $email — nothing saved"
   fi
-  ( umask 077; printf '%s' "$tok" > "$d/server.token" )
-  chmod 600 "$d/server.token"
+  commit_ceremony_token "$d" "$tok" "$id"
   clear_auth_markers "$d"
   log_to ops.log "mint $id"
   echo "Token saved to $d/server.token"
@@ -984,13 +1129,14 @@ cmd_login() {
   email="$(account_email "$id")"
   echo "Sign in as $email for $id."
   if [ "$token" = "1" ]; then
+    trap 'restore_ceremony_tty; exit 130' INT TERM
+    trap 'restore_ceremony_tty' EXIT
     run_token_ceremony "$d" || die "sign-in failed or aborted — nothing changed"
     got="$(token_email "$CEREMONY_TOKEN")"
     if [ -n "$got" ] && [ "$got" != "$email" ] && [ "$force" != "1" ]; then
       die "you signed in as $got but $id is $email — nothing saved (use --force to override)"
     fi
-    ( umask 077; printf '%s' "$CEREMONY_TOKEN" > "$d/server.token" )
-    chmod 600 "$d/server.token"
+    commit_ceremony_token "$d" "$CEREMONY_TOKEN" "$id"
     clear_auth_markers "$d"
     [ -n "$got" ] || warn "a setup token carries no identity — $id is trusted to hold $email because that is who you approved as"
     echo "$id token saved (portable — works on Mac and server)."
@@ -1040,14 +1186,17 @@ cmd_expired() {
     die "the manifest lists accounts but none could be audited — check $MANIFEST"
   fi
   bad="$(printf '%s\n' "$rows" \
-    | awk -F'\t' 'NF >= 4 && $1 != "" && $4 ~ /^(expired|blocked|missing|unverified)$/ { print $1 }')"
+    | awk -F'\t' '
+      NF >= 4 && $1 != "" && $4 ~ /^(expired|token-invalid|blocked|missing|unverified)$/ {
+        print $1
+      }')"
   if [ "$quiet" = "1" ]; then
     [ -n "$bad" ] || return 0
     printf '%s\n' "$bad"
     return 1
   fi
   printf '%s\n' "$rows" | awk -F'\t' '
-    BEGIN { bad = 0; ok = 0; remote = 0; relogin = 0; unverified = 0 }
+    BEGIN { bad = 0; ok = 0; remote = 0; relogin = 0; retoken = 0; unverified = 0 }
     NF < 4 || $1 == "" { next }          # never invent an account from a blank line
     $4 == "ok"     { ok++; next }
     $4 == "remote" { remote++; rem = rem sprintf("  %-9s %-28s %s\n", $1, $2, $6); next }
@@ -1058,6 +1207,13 @@ cmd_expired() {
       printf "  %-9s %-28s %-9s fix: %s\n", "", "", "", $7
       next
     }
+    $4 == "token-invalid" {
+      bad++
+      retoken++
+      printf "  %-9s %-28s %-13s %s\n", $1, $2, $5, $6
+      printf "  %-9s %-28s %-13s fix: %s\n", "", "", "", $7
+      next
+    }
     {
       bad++
       relogin++
@@ -1075,6 +1231,10 @@ cmd_expired() {
         printf "\nVerify portable tokens:\n"
         printf "  claude-accounts verify\n"
       }
+      if (retoken > 0) {
+        printf "\nReplace invalid portable setup-tokens:\n"
+        printf "  claude-accounts login acct-NN --token\n"
+      }
       if (relogin > 0) {
         printf "\nRe-authenticate them:\n"
         printf "  claude-accounts relogin            # every account that needs it\n"
@@ -2175,8 +2335,14 @@ for acct in manifest.get('accounts', []):
                 os.remove(os.path.join(d, '.server-token-verified'))
             except OSError:
                 pass
-            mark_expired(d, 'auth-error', 'a real call came back not-authenticated')
-            hint = f' — login is dead, run: claude-accounts relogin {aid}'
+            if uses_token:
+                mark_expired(d, 'setup-token-invalid',
+                             'portable setup-token failed a real inference')
+                hint = (f' — portable setup-token is invalid, run: '
+                        f'claude-accounts login {aid} --token')
+            else:
+                mark_expired(d, 'auth-error', 'a real call came back not-authenticated')
+                hint = f' — login is dead, run: claude-accounts relogin {aid}'
         print(f'{aid} {acct["email"]}: FAIL rc={r.returncode} '
               f'out={out[:120]!r} err={err!r}{hint}')
         failures += 1

package/docs/ACCOUNT_OPERATIONS.md

@@ -215,7 +215,8 @@ providers (`lib/report.py`), so a consumer writes one parser:
   "accounts": [{
     "id": "acct-05", "email": "…", "home": "mac", "added_at": "…Z",
     "home_dir": "/Users/gas/.claude-accounts/acct-05", "adopted": false,
-    "status": "active",            // active|limited|expired|blocked|missing|remote
+    "status": "active",            // active|limited|expired|token-invalid|blocked
+                                   // missing|remote
     "state": "ok", "label": "OK", "reason": "…", "fix": "…",
     "selectable": true, "needs_login": false,
     "credential_class": "portable", // portable|machine-local|none

package/lib/audit.py

@@ -5,6 +5,7 @@ shim's selection rule (bin/claude: creds_dead / expired_marked / auth_dead).
 States:
   ok       usable right now (live OAuth credential, or a portable server.token)
   expired  has auth material that CANNOT authenticate — needs `claude-accounts relogin`
+  token-invalid  a portable setup-token was rejected — needs a new setup-token, not a login
   blocked  authenticates, but its organization has disabled Claude Code subscription
            access — a re-login cannot fix it, so it needs an admin (or removal)
   locked   the OAuth login is in the macOS Keychain and THIS session cannot open it
@@ -193,8 +194,9 @@ def oauth_login(d, now):
     return {'store': None, 'state': None, 'reason': '', 'doc': None}
 
 
-LABELS = {'ok': 'OK', 'expired': 'EXPIRED', 'blocked': 'BLOCKED', 'locked': 'KEYCHAIN LOCKED',
-          'missing': 'NO LOGIN', 'remote': 'ELSEWHERE', 'unverified': 'UNVERIFIED'}
+LABELS = {'ok': 'OK', 'expired': 'EXPIRED', 'token-invalid': 'TOKEN INVALID',
+          'blocked': 'BLOCKED', 'locked': 'KEYCHAIN LOCKED', 'missing': 'NO LOGIN',
+          'remote': 'ELSEWHERE', 'unverified': 'UNVERIFIED'}
 
 # `import --home` speaks mac|server; machine_kind() speaks mac|linux. Same two boxes,
 # two vocabularies — normalize, or an un-authenticated account on the very machine that
@@ -216,6 +218,8 @@ def _elsewhere(home, machine):
 
 
 def _fix_for(state, aid):
+    if state == 'token-invalid':
+        return f'claude-accounts login {aid} --token'
     if state == 'blocked':
         # A fresh sign-in re-issues the grant and in practice clears this, so it is
         # handled like any other dead login. If it comes back BLOCKED after a re-login,
@@ -244,6 +248,12 @@ def _token_verified(d, tpath):
         return False
 
 
+# The report (`list --json`) tells the panel the same thing per Mac: a Mac reads
+# "active" for any token FILE it can see, and only this says whether a real call
+# ever succeeded with it here.
+token_verified = _token_verified
+
+
 def audit_account(root, acct, now=None, machine=None, require_verified_token=False):
     now = time.time() if now is None else now
     aid = acct.get('id', '')
@@ -266,6 +276,9 @@ def audit_account(root, acct, now=None, machine=None, require_verified_token=Fal
             row['state'] = 'blocked'
             row['reason'] = ('this account\'s organization has disabled Claude Code '
                              'subscription access')
+        elif slug == 'setup-token-invalid':
+            row['state'] = 'token-invalid'
+            row['reason'] = 'portable setup-token was rejected by a real inference'
         else:
             row['state'] = 'expired'
             row['reason'] = f'marked dead by the pool ({detail or "authentication failed"})'

package/lib/common.sh

@@ -495,7 +495,8 @@ clear_auth_markers() { # $1 = acct dir
   rm -f "$1/.expired" "$1/.oauth-refresh.json" 2>/dev/null || true
 }
 
-# TSV rows: id, email, home, state (ok|expired|blocked|missing|remote), label, reason, fix.
+# TSV rows: id, email, home, state
+# (ok|expired|token-invalid|blocked|missing|remote|locked|unverified), label, reason, fix.
 # Fails LOUD (nonzero, message on stderr): callers decide policy from these rows, and a
 # silently empty audit reads exactly like a perfectly healthy pool.
 account_audit() {
@@ -518,7 +519,8 @@ account_audit() {
 # Ids the shim will NOT select — everything a human has to look at.
 accounts_unusable() {
   account_audit \
-    | awk -F'\t' 'NF >= 4 && $1 != "" && ($4 == "expired" || $4 == "blocked" || $4 == "missing") { print $1 }'
+    | awk -F'\t' \
+      'NF >= 4 && $1 != "" && $4 ~ /^(expired|token-invalid|blocked|missing)$/ { print $1 }'
 }
 
 # Ids a re-login should be pointed at. Org-blocked accounts are included: a fresh

package/lib/report.py

@@ -46,6 +46,7 @@ import time
 
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 import keychain  # noqa: E402
+from audit import token_verified  # noqa: E402
 
 SCHEMA = 'claude-multiacc/pool.v1'
 
@@ -172,7 +173,10 @@ def _claude_credentials(d):
     has_token = _size(tpath) > 0
     detail = {'oauth': has_oauth, 'token': has_token, 'oauth_store': None, 'keychain': None,
               'oauth_expires_at': None, 'oauth_refresh_expires_at': None,
-              'token_minted_at': None, 'token_age_days': None}
+              'token_minted_at': None, 'token_age_days': None,
+              # True once THIS exact token passed a real inference on this machine
+              # (.server-token-verified); False = present but never proven here.
+              'token_verified': token_verified(d, tpath) if has_token else None}
     o = None
     if has_oauth:
         detail['oauth_store'] = 'file'
@@ -347,6 +351,9 @@ def _account_row(root, a, aid, d, provider, jwt_claims, audit_account, now, kind
         'credential_class': cclass,
         'portable': cclass == 'portable',
         'credentials': cdetail,
+        # Flat copy for heartbeat consumers: a portable token this Mac has proven
+        # (True), holds unproven (False), or does not hold (None).
+        'token_verified': cdetail.get('token_verified') if provider == 'claude' else None,
         'limited': bool(limited),
         'limit_reset_at': _iso(reset_epoch) if limited and reset_epoch else None,
         'limit_reset_epoch': reset_epoch if limited and reset_epoch else None,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.9",
+  "version": "2.0.11",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -74,6 +74,19 @@ fi
 if [ "${1:-}" = "setup-token" ]; then
   echo "Open this sign-in link: https://claude.ai/oauth/authorize?fake=1"
   [ -n "${FAKE_TOKEN_FAIL:-}" ] && { echo "sign-in aborted" >&2; exit 1; }
+  if [ -n "${FAKE_TOKEN_FULL:-}" ]; then
+    # The real client's shape: a 108-character token that the TUI HARD-WRAPS at the
+    # terminal's width — an unsized pty (0 columns) renders as 80, and a 79-character
+    # first line is exactly what every panel mint of 2026-08-28 saved.
+    tok="sk-ant-oat01-$(printf '%66s' '' | tr ' ' W)$(printf '%23s' '' | tr ' ' T)TAILOK"
+    cols="$(stty size 2>/dev/null | awk '{print $2}')"
+    if [ -n "${FAKE_TOKEN_WRAP:-}" ] || { [ -n "$cols" ] && [ "$cols" -lt 108 ]; }; then
+      printf ' %s\n%s\n' "${tok:0:79}" "${tok:79}"
+    else
+      printf ' %s\n' "$tok"
+    fi
+    exit 0
+  fi
   echo "Your token: sk-ant-oat01-FAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKE"
   exit 0
 fi
@@ -88,6 +101,13 @@ case "${CLAUDE_CODE_OAUTH_TOKEN:-}" in
   *REVOKED*)
     echo "Please run /login · API Error: 401 OAuth access token is invalid." >&2
     exit 1 ;;
+  sk-ant-oat01-WWW*)
+    # The wrapped fixture above: only the COMPLETE token (with its tail) authenticates;
+    # its 79-character first line is what Claude answered 401 to, fleet-wide.
+    case "$CLAUDE_CODE_OAUTH_TOKEN" in
+      *TAILOK) : ;;
+      *) echo "Failed to authenticate. API Error: 401 OAuth access token is invalid." >&2; exit 1 ;;
+    esac ;;
 esac
 case " $* " in
   *" -p --output-format text --max-turns 1 "*) echo "OK"; exit 0 ;;
@@ -515,7 +535,7 @@ case "$out" in
   *"API Error: 401"*) t_fail "revoked setup-token hides preflight 401" "401 reached caller" ;;
   *) t_ok "revoked setup-token hides preflight 401" ;;
 esac
-grep -q 'reason=auth-error' "$ACC/acct-01/.expired" 2>/dev/null \
+grep -q 'reason=setup-token-invalid' "$ACC/acct-01/.expired" 2>/dev/null \
   && t_ok "revoked setup-token writes .expired" \
   || t_fail "revoked setup-token marker" ".expired missing"
 if grep -q 'soft_until=' "$ACC/acct-01/.expired" 2>/dev/null; then
@@ -523,6 +543,37 @@ if grep -q 'soft_until=' "$ACC/acct-01/.expired" 2>/dev/null; then
 else
   t_ok "proven token rejection is durable"
 fi
+out="$(claude-accounts expired 2>&1)"
+check "revoked setup-token is not mislabeled as a dead login" "TOKEN INVALID" "$out"
+check "revoked setup-token gets the token replacement fix" \
+  "claude-accounts login acct-01 --token" "$out"
+case "$out" in
+  *"claude-accounts relogin acct-01"*)
+    t_fail "revoked setup-token does not recommend re-login" "wrong recovery shown" ;;
+  *) t_ok "revoked setup-token does not recommend re-login" ;;
+esac
+# A token can be revoked after it passed preflight. The captured -p path must retire
+# that exact verified token too, rather than giving it a one-hour generic login park.
+rm -f "$ACC/acct-01/.expired"
+token_digest="$(printf '%s' 'sk-ant-oat01-REVOKEDREVOKEDREVOKEDREVOKEDREVOKEDREVOKED' \
+  | { shasum -a 256 2>/dev/null || sha256sum; } | cut -d ' ' -f1)"
+printf '%s\n' "$token_digest" > "$ACC/acct-01/.server-token-verified"
+out="$(claude -p 'Reply OK' < /dev/null 2>&1)"
+case "$out" in
+  *"API Error: 401"*) t_fail "revoked verified token hides runtime 401" "401 reached caller" ;;
+  *) t_ok "revoked verified token hides runtime 401" ;;
+esac
+grep -q 'reason=setup-token-invalid' "$ACC/acct-01/.expired" 2>/dev/null \
+  && t_ok "revoked verified token keeps token classification" \
+  || t_fail "revoked verified token marker" ".expired missing"
+[ ! -f "$ACC/acct-01/.server-token-verified" ] \
+  && t_ok "revoked verified token clears its proof" \
+  || t_fail "revoked verified token proof" "verification marker survived"
+if grep -q 'soft_until=' "$ACC/acct-01/.expired" 2>/dev/null; then
+  t_fail "revoked verified token is durably quarantined" "marker has a soft expiry"
+else
+  t_ok "revoked verified token is durably quarantined"
+fi
 out="$(CLAUDE_ACCOUNT=acct-01 claude --resume d6ccbac0-6643-4780-a99e-3afa1683478e 2>&1)"
 rc=$?
 check "pinned revoked setup-token is classified before --resume" \
@@ -1232,6 +1283,86 @@ esac
 [ -s "$ACC/acct-04/server.token" ] && t_ok "add --token writes server.token" || t_fail "add --token" "missing"
 out="$(CLAUDE_ACCOUNT=acct-04 claude 2>&1)"
 check "token account exports CLAUDE_CODE_OAUTH_TOKEN" "TOK=sk-ant-oat01-FAKE" "$out"
+
+# ---- 15c1a. a ceremony's token is PROVEN before it is saved --------------------------
+# add --token above ran the inference probe: the exact token is on record as verified
+# on this machine, so the audit never calls a fresh mint UNVERIFIED — and the panel
+# can tell a proven token from one a Mac merely holds.
+[ -f "$ACC/acct-04/.server-token-verified" ] \
+  && t_ok "add --token proves the token with a real inference before saving" \
+  || t_fail "add --token verification marker" ".server-token-verified missing"
+out="$(claude-accounts list --json 2>/dev/null | python3 -c '
+import json, sys
+rows = {a["id"]: a for a in json.load(sys.stdin)["accounts"]}
+print(rows["acct-04"].get("token_verified"))')"
+[ "$out" = "True" ] && t_ok "list --json reports the token as verified here" \
+  || t_fail "list --json token_verified" "expected True, got: $out"
+# The 2026-08-28 shape: the client's TUI wrapped the 108-character token at 80 columns
+# and only its 79-character first line was captured. Claude rejects the fragment; the
+# mint must refuse to save it and say WHY (seven fleet-wide 401s were the old answer).
+orig="$(cat "$ACC/acct-04/server.token")"
+out="$(FAKE_TOKEN_FULL=1 FAKE_TOKEN_WRAP=1 claude-accounts mint acct-04 2>&1 </dev/null)"
+rc=$?
+[ "$rc" != "0" ] && t_ok "a wrapped (79-char) token capture is refused" || t_fail "wrapped token rc" "rc=0"
+check "the refusal names the truncation" "79 characters" "$out"
+check "the refusal names the cause" "terminal wrapped it" "$out"
+[ "$(cat "$ACC/acct-04/server.token")" = "$orig" ] && t_ok "a refused capture leaves the old token in place" \
+  || t_fail "refused capture" "server.token was overwritten"
+# A pasted token gets the same proof: a revoked one is refused, not saved.
+out="$(printf 'sk-ant-oat01-REVOKEDREVOKEDREVOKEDREVOKEDREVOKEDREVOKEDREVOKED' | claude-accounts mint acct-04 --paste 2>&1)"
+rc=$?
+[ "$rc" != "0" ] && t_ok "mint --paste refuses a token Claude rejects" || t_fail "paste rejected rc" "rc=0"
+check "the paste refusal says Claude rejected it" "Claude rejected the captured token" "$out"
+[ "$(cat "$ACC/acct-04/server.token")" = "$orig" ] && t_ok "a rejected paste saves nothing" \
+  || t_fail "rejected paste" "server.token was overwritten"
+
+# ---- 15c1b. the ceremony widens an unsized pty, so the whole token is captured ------
+# The panel drives the ceremony over a pty it never sized (0x0 -> the TUI renders 80
+# columns wide). Run the mint under exactly such a pty: the fake wraps its token
+# whenever the terminal is narrower than the token, so only a widened terminal yields
+# all 108 characters — and the capture must then pass the inference probe.
+cat > "$WORK/pty-run.py" <<'EOF'
+import os, pty, select, sys
+pid, fd = pty.fork()          # a fresh pty: 0 rows, 0 columns, like the panel's
+if pid == 0:
+    os.execvp(sys.argv[1], sys.argv[1:])
+buf = b''
+while True:
+    try:
+        ready, _, _ = select.select([fd], [], [], 60)
+        if not ready:
+            break
+        chunk = os.read(fd, 4096)
+    except OSError:
+        break
+    if not chunk:
+        break
+    buf += chunk
+_, status = os.waitpid(pid, 0)
+sys.stdout.write(buf.decode('utf-8', 'ignore'))
+sys.exit(os.WEXITSTATUS(status) if os.WIFEXITED(status) else 1)
+EOF
+size="$(python3 "$WORK/pty-run.py" stty size | tr -d '\r' | tail -1)"
+[ "$size" = "0 0" ] && t_ok "the test pty really is unsized (the panel's shape)" \
+  || t_fail "test pty size" "expected '0 0', got '$size'"
+if command -v script >/dev/null 2>&1; then
+  out="$(FAKE_TOKEN_FULL=1 python3 "$WORK/pty-run.py" claude-accounts mint acct-04 2>&1)"
+  rc=$?
+  [ "$rc" = "0" ] && t_ok "mint under an unsized pty succeeds" \
+    || t_fail "unsized-pty mint rc" "rc=$rc: $(printf '%s' "$out" | tail -c 300)"
+  n="$(tr -d '[:space:]' < "$ACC/acct-04/server.token" | wc -c | tr -d ' ')"
+  [ "$n" = "108" ] && t_ok "the unsized pty is widened: all 108 characters captured" \
+    || t_fail "unsized-pty capture" "saved $n characters"
+  check "the widened-pty mint verifies its token" "Token verified by a real inference" "$out"
+  case "$(tr -d '[:space:]' < "$ACC/acct-04/server.token")" in
+    *TAILOK) t_ok "the saved token is the complete one" ;;
+    *) t_fail "saved token" "tail missing" ;;
+  esac
+  [ -f "$ACC/acct-04/.server-token-verified" ] && t_ok "the widened-pty mint records its proof" \
+    || t_fail "widened-pty proof" "marker missing"
+else
+  printf 'skip unsized-pty mint (no script(1) here)\n'
+fi
 claude-accounts remove acct-04 --yes >/dev/null 2>&1
 
 # ---- 15c0. add with NO email: derives it from the verified sign-in -------------------
@@ -2480,7 +2611,19 @@ state="$(python3 "$REPO_DIR/lib/audit.py" "$ACC" "$(uname -s | tr '[:upper:]' '[
   strict-tokens | awk -F'\t' '$1=="acct-01"{print $4}')"
 [ "$state" = "ok" ] && t_ok "verified setup-token is no longer false-unknown" \
   || t_fail "verified setup-token audit" "expected ok, got: $state"
+printf 'sk-ant-oat01-REVOKEDREVOKEDREVOKEDREVOKEDREVOKEDREVOKED' \
+  > "$ACC/acct-01/server.token"
+rm -f "$ACC/acct-01/.server-token-verified"
+out="$(claude-accounts verify 2>&1)"
+check "verify calls a rejected setup-token what it is" "portable setup-token is invalid" "$out"
+check "verify recommends replacing a rejected setup-token" \
+  "claude-accounts login acct-01 --token" "$out"
+out="$(claude-accounts expired 2>&1)"
+check "verify marker retains setup-token classification" "TOKEN INVALID" "$out"
+check "verify marker retains setup-token recovery" \
+  "claude-accounts login acct-01 --token" "$out"
 rm -f "$ACC/acct-01/server.token"
+rm -f "$ACC/acct-01/.expired" "$ACC/acct-01/.server-token-verified"
 printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-test01","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999}}' > "$ACC/acct-01/.credentials.json"
 
 # ---- 17c. audit: machine vocabulary (home=server vs machine_kind=linux) ---------------