claude-org 0.2.2 → 0.4.0

package/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 ## Unreleased
 
+## 0.4.0 — 2026-10-11
+
+- `proxy`: hardened for unattended use under a supervisor (#22)
+  - only the `claude` it launched can use it: a per-session secret is checked (constant time) on every request, `Host` must be `127.0.0.1:<port>`, only `GET` / `POST` / `DELETE` under `/v1/` are forwarded, and bodies over 64 MB get 413. Standalone `node lib/proxy.js` needs `CLAUDE_ORG_PROXY_SECRET`
+  - it no longer crashes or hangs: an unreadable token dir gives 503, every request handler error is caught, hop-by-hop headers are dropped, an upstream that sends nothing for 10 min is given up and the next org tried, and a `claude` that cancels or exits mid-response cancels the upstream request
+  - the launcher forwards `SIGTERM` / `SIGHUP` (and `SIGINT` without a terminal) to `claude`, waits for it, and sends `SIGKILL` after 10 s, so killing the launcher pid no longer orphans `claude`; with a terminal, Ctrl-C no longer kills the proxy under a running `claude`
+  - token files must be mode `0600` and owned by the user, org names are limited to `[A-Za-z0-9_-]`, and `CLAUDE_ORG_UPSTREAM` other than `https://api.anthropic.com` is refused unless `CLAUDE_ORG_UNSAFE_UPSTREAM=1`
+  - a 401 from an org (expired token) fails over to the next org, and "no org works" events are logged on fixed-format `ALERT ...` lines a supervisor can grep (README, "Unattended use")
+  - the proxy log never records a request's query string (a refused `/v1/messages?...` is logged as such), so a secret put there cannot leak into the log
+  - README: unattended runs must use proxy mode; how to keep the token dir away from `claude`'s shell and Read tool
+
+## 0.3.0 — 2026-10-10
+
+- `proxy`: each log line now names the model (`via <org> model=<model> -> <status>`), and the org and model of the last request are written to a JSON state file whose path is passed to `claude` as `CLAUDE_ORG_STATE_FILE`, for statusline and hooks (#12)
+- `probe` / `status`: `--model <id>` (or `CLAUDE_ORG_PROBE_MODEL`) checks that model instead of Haiku and appends `model_status=available|unavailable|unknown` (and `model_error=` when refused), so "5h allowed but this model is refused" is told apart. `auto` falls back to the default org when the preferred org refuses the model (#9)
+- `proxy`: `CLAUDE_ORG_STRATEGY=least-utilized` sends each request to the usable org with the lowest 5h utilization it has reported (orgs not yet measured are tried first). Unset keeps the priority order; the launch line and the log now show the strategy (#7)
+- Docs: proxy mode now explains that Agent-tool subagents go through the same proxy and what that implies (#16)
+
 ## 0.2.2 — 2026-10-10
 
 - Development: `npm run release -- <patch|minor|major|X.Y.Z>` runs the whole release (checks, tests, CHANGELOG, version, commit, tag, push, npm publish, registry check)

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 miyashita337
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 miyashita337
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -57,13 +57,22 @@ Repeat steps 1–2 **once per org**:
 | `claude-org proxy [claude args...]` | Launch via a local proxy: a **running** session fails over to another org the moment the 5h limit hits. Needs 2+ org tokens (incl. one for the default side). |
 | `claude-org auto [claude args...]` | Launch on the preferred org if usable, else on the default org. Decided once at launch. |
 | `claude-org <name> [claude args...]` | Launch with that org's token, e.g. `claude-org work --resume`. |
-| `claude-org probe [<name>]` | Print the org's 5h window state on one line (`status= 5h_util= 5h_reset= 5h_reset_local=`). Exit 0 when `allowed`. |
+| `claude-org probe [<name>] [--model <id>]` | Print the org's 5h window state on one line (`status= 5h_util= 5h_reset= 5h_reset_local=`). Exit 0 when `allowed`. With `--model`, probe with that model and append `model= model_status=` (see below). |
 | `claude-org watch` | Poll the preferred org until its window recovers, then notify (terminal + optional `CLAUDE_ORG_NOTIFY_CMD`). |
-| `claude-org status` | `claude auth status` for every saved token + the default login. |
+| `claude-org status [--model <id>]` | `claude auth status` and `probe` for every saved token + the default login. |
 | `claude-org list` | List saved org names. |
 
 `auto` and `<name>` only read env at launch — they cannot switch a running session. Settings, plugins, and session history live under `~/.claude/` and are shared across orgs, so `claude-org auto --resume` continues a session started under the other org.
 
+**Checking a model, not just the window**: `probe` and `status` use Haiku by default, but an org can show `status=allowed` and still refuse another model (for example one that needs usage credits). Pass the model your session uses:
+
+```sh
+claude-org probe work --model claude-fable-5-1
+# status=allowed 5h_util=0.34 ... model=claude-fable-5-1 model_status=unavailable model_error=rate_limit_error
+```
+
+`model_status` is `available` (2xx), `unavailable` (refused while the 5h/7d windows are not rejected; exit 1) or `unknown` (no response, bad token or permission, timeout, server error, or a rejected window; the exit code then follows `status` alone). Setting `CLAUDE_ORG_PROBE_MODEL` applies the same check to `probe`, `status` and `auto`; `auto` then launches on the default org when the preferred org refuses that model.
+
 The **preferred org** (used by `auto`, `watch`, and as `proxy`'s first candidate) resolves in this order: `CLAUDE_ORG_PREFER` -> first entry of `CLAUDE_ORG_ORDER` -> first `.token` file alphabetically.
 
 ## proxy mode
@@ -73,17 +82,34 @@ claude-org proxy --resume
 ```
 
 1. A session-scoped proxy starts on `127.0.0.1:<random port>` (one per session; no port collisions).
-2. `claude` launches with `ANTHROPIC_BASE_URL` pointing at the proxy and a **dummy** bearer token.
-3. The proxy replaces the `Authorization` header with a real org token and forwards to `api.anthropic.com`. On a 429 or `anthropic-ratelimit-unified-5h-status: rejected` it marks that org limited until `5h-reset` and **resends the same request** with the next org's token.
-4. Claude Code only ever sees the successful response — the org switched mid-session. SSE streaming is piped through untouched.
+2. `claude` launches with `ANTHROPIC_BASE_URL` pointing at the proxy and a **per-session secret** as its bearer token (`ANTHROPIC_AUTH_TOKEN`, generated with `crypto.randomBytes`; it exists only in that `claude`'s environment).
+3. The proxy serves only requests that carry that secret, name it in `Host` (`127.0.0.1:<port>`, so a web page cannot reach it by DNS rebinding) and are `GET` / `POST` / `DELETE` under `/v1/`; anything else is refused with 401 / 403 / 404 / 405 and never forwarded. Request bodies over 64 MB get 413.
+4. The proxy replaces the `Authorization` header with a real org token, drops hop-by-hop headers, and forwards to `api.anthropic.com` (any other upstream is refused unless `CLAUDE_ORG_UNSAFE_UPSTREAM=1`). On a 429 or `anthropic-ratelimit-unified-5h-status: rejected` it marks that org limited until `5h-reset` and **resends the same request** with the next org's token. An org whose token is rejected (401: expired or revoked) is skipped the same way for 10 minutes.
+5. Claude Code only ever sees the successful response — the org switched mid-session. SSE streaming is piped through untouched. When Claude Code cancels or exits mid-response, the upstream request is cancelled too; an upstream that sends nothing for 10 minutes is given up and the next org tried.
 
-One log line per request (`via <org> -> <status>`) goes to a temp file printed at launch (`-> proxy 127.0.0.1:<port> (order: ..., log: ...)`).
+One log line per request (`via <org> model=<model> -> <status>`) goes to a temp file printed at launch (`-> proxy 127.0.0.1:<port> (order: ..., strategy: ..., log: ...)`). The prompt and the tokens are never logged.
+
+**Spreading load by utilization**: with `CLAUDE_ORG_STRATEGY=least-utilized`, the proxy remembers the `5h-utilization` each org last reported and sends each request to the usable org with the lowest value. An org that has not reported yet is tried first (in priority order) so it gets measured once; one that answers without a utilization goes after the measured ones. A value is forgotten when that org's 5h window resets. Rate-limited orgs are still skipped. Utilization is a share of each org's own plan, not an absolute amount, so a larger plan is picked more often; if you want one org's allowance used up first (e.g. your company's), keep the default and set `CLAUDE_ORG_ORDER` instead.
+
+**Which org is in use right now**: after each model request the proxy writes `{"org", "model", "status", "at"}` as JSON (`org` is `null` with `status` 503 when no org could serve) to `state.json` in the same temp directory as the log. Its path is exported to the `claude` process as `CLAUDE_ORG_STATE_FILE`, so a statusline command or hook can show it, e.g.:
+
+```sh
+[ -n "$CLAUDE_ORG_STATE_FILE" ] && [ -f "$CLAUDE_ORG_STATE_FILE" ] && node -p "require(process.env.CLAUDE_ORG_STATE_FILE).org"
+```
 
 **Limitations of proxy mode**
 
 - claude.ai connector MCPs (Gmail / Drive / Calendar / Notion / Slack …) and Remote Control are **unavailable**: `ANTHROPIC_AUTH_TOKEN` makes Claude Code treat the session as external-token auth, so `mcp__claude_ai_*` tools do not appear. Local/plugin MCPs work. Open connectors in a plain `claude --resume` session — history is shared.
 - Each proxy serves one session and dies when `claude` exits.
 
+**Subagents**
+
+- Subagents started with Claude Code's Agent tool run in the same process as the parent session and share its `ANTHROPIC_BASE_URL`, so they go through the same proxy with no setup and use the same orgs' limits. Their requests appear in the proxy log with their own `model=` (e.g. a Haiku subagent).
+- Not covered: a `claude` started as a separate process (it needs its own `claude-org proxy`), and agents that run in the cloud (e.g. `isolation: remote`).
+- The connector MCP limitation above applies to subagents too.
+- When an org's 5h or 7d window is rejected, the org is taken out for every model, so subagents also move to the next org until the window resets. A 429 for one model only (#8) moves that model only; other models, including those of subagents, stay on the org.
+- Work routed to a Team / Enterprise org (e.g. your company's) counts toward that org's usage, which its admins can see.
+
 ### Prompt cache & tool search
 
 A custom `ANTHROPIC_BASE_URL` + `ANTHROPIC_AUTH_TOKEN` makes Claude Code treat the session as API-key auth, which changes two defaults:
@@ -97,7 +123,38 @@ A custom `ANTHROPIC_BASE_URL` + `ANTHROPIC_AUTH_TOKEN` makes Claude Code treat t
 |---|---|---|---|
 | `claude` | no (default org) | yes | connector work |
 | `claude-org auto --resume` | at launch only | no on preferred org / yes on default | short tasks |
-| `claude-org proxy --resume` | **automatic** | no | long-running work, agents |
+| `claude-org proxy --resume` | **automatic** | no | long-running work, agents, unattended runs |
+
+### Unattended use (supervisors, `--dangerously-skip-permissions`)
+
+When a supervisor starts `claude` without a person watching (e.g. `claude -p` with `--dangerously-skip-permissions`), launch it through `claude-org proxy`, not `claude-org <org>` / `auto`:
+
+- **Use proxy mode only.** `claude-org <org>` and `auto` put the org token into `claude`'s environment as `CLAUDE_CODE_OAUTH_TOKEN`, where a prompt-injected `claude` can read it. In proxy mode the tokens stay in the launcher process; `claude` only holds the per-session proxy secret, which is worth nothing outside that session.
+- **Signals.** The launcher forwards `SIGTERM` / `SIGHUP` (and `SIGINT` when it has no terminal) to `claude`, waits for it to exit, and reports its exit code (`128+signal` when killed); after 10 s it sends `SIGKILL`. So a supervisor that kills the launcher pid does not leave an orphaned `claude`, and the proxy lives exactly as long as `claude` does. With a terminal, Ctrl-C goes to `claude` only (the launcher stays until `claude` exits).
+- **Keep the token files away from `claude`'s shell.** A `claude` running with permissions skipped can `cat ~/.claude/org-tokens/*.token` from Bash. The proxy refuses token files that are not mode `0600` and owned by you, but that does not stop your own `claude`. Deny the directory to sandboxed commands and to the Read tool in the settings of the project the unattended session runs in (both are needed: the sandbox covers shell commands only, the Read tool follows permission rules):
+
+  ```json
+  {
+    "permissions": { "deny": ["Read(~/.claude/org-tokens/**)"] },
+    "sandbox": {
+      "enabled": true,
+      "credentials": { "files": [{ "path": "~/.claude/org-tokens", "mode": "deny" }] }
+    }
+  }
+  ```
+
+  Source: Claude Code docs, [Configure the sandboxed Bash tool](https://code.claude.com/docs/en/sandboxing) (`sandbox.credentials.files` with `"mode": "deny"` applies the same read block as `sandbox.filesystem.denyRead`; the sandbox runs on macOS, Linux and WSL2, not native Windows). Running the proxy as a separate daemon under another user would close the gap fully; it is not implemented, and would build on the shared proxy discussed in #14 / #18.
+- **Detecting "no org works" from outside.** The proxy log (path on the `-> proxy` launch line) has one fixed-format line per such event, so a supervisor or a notifier can grep for `ALERT `:
+
+  | Line | Meaning |
+  |---|---|
+  | `ALERT token-rejected org=<org> status=401 -> run: claude setup-token ...` | that org's token is expired or revoked; the org is skipped for 10 min |
+  | `ALERT no-org-available model=<model> reason=rate-limited status=429` | every org is over its window; the 429 went to `claude` |
+  | `ALERT no-org-available model=<model> reason=model-rejected status=429` | every org refuses this model; switch the model |
+  | `ALERT no-org-available model=<model> reason=unreachable status=503` | no org answered (network, timeouts, bad token files) |
+  | `ALERT no-org-available model=<model> reason=no-tokens status=503` | the token dir is missing or has no usable `.token` file |
+
+  The state file (`CLAUDE_ORG_STATE_FILE`) records the same outcome as `status` (`503` with `"org": null`, or `401` with the org).
 
 ## Environment variables
 
@@ -105,17 +162,22 @@ A custom `ANTHROPIC_BASE_URL` + `ANTHROPIC_AUTH_TOKEN` makes Claude Code treat t
 |---|---|---|
 | `CLAUDE_ORG_PREFER` | (unset) | Preferred org for `auto` / `watch` / `proxy` |
 | `CLAUDE_ORG_ORDER` | (unset) | Comma-separated org priority for `proxy`; unlisted orgs follow alphabetically |
+| `CLAUDE_ORG_STRATEGY` | (unset: priority order) | `least-utilized`: `proxy` sends each request to the usable org with the lowest 5h utilization (see proxy mode) |
+| `CLAUDE_ORG_PROBE_MODEL` | (unset: Haiku) | Model used by `probe` / `status` / `auto` to check the org; adds `model_status=` to the probe line |
 | `CLAUDE_ORG_TOKEN_DIR` | `~/.claude/org-tokens` | Where `<name>.token` files live |
 | `CLAUDE_ORG_NOTIFY_CMD` | (unset) | `watch` notification command, run as `<cmd> "<title>" "<message>"` via the OS shell |
 | `CLAUDE_ORG_WATCH_MAX_SLEEP` | `18000` | Max seconds between `watch` re-checks (values < 60 also lower the 60s minimum — for tests) |
-| `CLAUDE_ORG_UPSTREAM` | `https://api.anthropic.com` | API base URL for `probe` and `proxy` (stub upstream in tests) |
+| `CLAUDE_ORG_UPSTREAM` | `https://api.anthropic.com` | API base URL for `probe` and `proxy` (stub upstream in tests). `proxy` refuses any other value unless `CLAUDE_ORG_UNSAFE_UPSTREAM=1`, since org tokens are sent there |
+| `CLAUDE_ORG_UNSAFE_UPSTREAM` | (unset) | `1` lets `proxy` forward to a `CLAUDE_ORG_UPSTREAM` other than `api.anthropic.com` (tests only) |
+| `CLAUDE_ORG_PROXY_SECRET` | (unset) | Standalone `node lib/proxy.js` only: the bearer value clients must send. `claude-org proxy` generates one per session itself |
 | `CLAUDE_ORG_PROXY` | `1` when launched via `proxy` | Marker env passed to the claude process so user hooks can detect connector-less sessions |
+| `CLAUDE_ORG_STATE_FILE` | set when launched via `proxy` | Path of the JSON file holding the org and model of the last request (read it from a statusline or hook) |
 | `CLAUDE_ORG_FORCE_PROBE` | (unset) | Test seam: `allowed` / `rejected[:<epoch>]` / `rejected_until:<epoch>` fakes `probe` results without API calls |
 | `CLAUDE_ORG_REJECT_FILE` | (unset) | Test seam: orgs listed comma-separated in this file are treated as rate-limited by `proxy` |
 
 ## Notes
 
-- **Token safety**: tokens are read from files only and never printed to logs, errors, or test snapshots. The proxy binds to `127.0.0.1` only.
+- **Token safety**: tokens are read from files only and never printed to logs, errors, or test snapshots. A token file must be mode `0600` and owned by you (`chmod 600 ~/.claude/org-tokens/*.token`); one that other users can read is refused. Org names are limited to letters, digits, `_` and `-`. The proxy binds to `127.0.0.1` only and serves only the `claude` it launched (see [Unattended use](#unattended-use-supervisors---dangerously-skip-permissions)).
 - **probe cost**: each `probe` sends one `max_tokens=1` request (~11 tokens billed to that org), once per `auto` launch.
 - **Token expiry**: tokens last ~1 year. If `probe` returns `status=unknown` or `status` shows `(auth status failed)`, rerun `claude setup-token` and overwrite the file.
 

package/bin/claude-org.js

@@ -10,6 +10,23 @@ const { statusAll } = require('../lib/status');
 const { watch } = require('../lib/watch');
 const { proxyLaunch } = require('../lib/proxy');
 
+// `--model <id>` / `--model=<id>` for probe and status. Returns the model
+// ('' when absent) and the remaining args. A missing value is an error rather
+// than a silent fall back to the default model.
+function takeModel(args) {
+  const rest = [];
+  let model = '';
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === '--model' || args[i].startsWith('--model=')) {
+      model = args[i] === '--model' ? args[++i] : args[i].slice(8);
+      if (!model || model.startsWith('-')) throw new Error('--model needs a model id, e.g. --model claude-fable-5-1');
+    } else {
+      rest.push(args[i]);
+    }
+  }
+  return { model, rest };
+}
+
 async function main() {
   const [cmd, ...rest] = process.argv.slice(2);
   switch (cmd) {
@@ -23,11 +40,12 @@ async function main() {
       for (const o of listOrgs()) console.log(o);
       return 0;
     case 'status':
-      return statusAll();
+      return statusAll(takeModel(rest).model || undefined);
     case 'probe': {
-      const r = await probe(rest[0] || resolvePrefer());
+      const { model, rest: names } = takeModel(rest);
+      const r = await probe(names[0] || resolvePrefer(), model || undefined);
       if (r.line) console.log(r.line);
-      return r.allowed ? 0 : 1;
+      return r.usable ? 0 : 1;
     }
     case 'pick':
       console.log(await pick());

package/lib/config.js

@@ -7,7 +7,16 @@ function tokenDir() {
   return process.env.CLAUDE_ORG_TOKEN_DIR || path.join(os.homedir(), '.claude', 'org-tokens');
 }
 
-// Saved org names: *.token files, extension stripped, sorted.
+// An org name is used as a file name under the token dir, so anything that
+// could leave the dir ("../x", "a/b") or confuse a shell is refused.
+const ORG_NAME_RE = /^[\w-]+$/;
+function validOrgName(name) {
+  return typeof name === 'string' && ORG_NAME_RE.test(name);
+}
+
+// Saved org names: *.token files, extension stripped, sorted. A file whose
+// name is not a valid org name is left out, and said so once.
+const reportedBadNames = new Set();
 function listOrgs(dir = tokenDir()) {
   let files;
   try {
@@ -15,12 +24,36 @@ function listOrgs(dir = tokenDir()) {
   } catch {
     return [];
   }
-  return files.filter(f => f.endsWith('.token')).map(f => f.slice(0, -6)).sort();
+  const names = files.filter(f => f.endsWith('.token')).map(f => f.slice(0, -6));
+  for (const n of names) {
+    if (validOrgName(n) || reportedBadNames.has(n)) continue;
+    reportedBadNames.add(n);
+    console.error(`claude-org: ignoring ${path.join(dir, `${n}.token`)}: not an org name (letters, digits, _ and - only)`);
+  }
+  return names.filter(validOrgName).sort();
+}
+
+// Why a token file must be private to the user: the proxy sends its content
+// as a Bearer token, so a file another local user can read hands them that
+// org. Returns '' when the file is fine, else the reason it is refused.
+// Not checked on Windows (no POSIX mode bits there).
+function tokenFileProblem(file) {
+  if (process.platform === 'win32' || typeof process.getuid !== 'function') return '';
+  const st = fs.statSync(file);
+  const me = process.getuid();
+  if (st.uid !== me) return `is owned by uid ${st.uid}, not by you (uid ${me})`;
+  if (st.mode & 0o077) return `is readable by other users (mode ${(st.mode & 0o777).toString(8)}); run: chmod 600 ${file}`;
+  return '';
 }
 
 // Read a token file, stripping CR/LF. Returns null (after printing guidance)
-// when the file is missing or empty.
+// when the name is invalid, the file is missing or empty, or the file is not
+// private to the user.
 function readToken(name, dir = tokenDir()) {
+  if (!validOrgName(name)) {
+    console.error(`claude-org: invalid org name "${name}" (letters, digits, _ and - only)`);
+    return null;
+  }
   const f = path.join(dir, `${name}.token`);
   let raw = '';
   try {
@@ -33,6 +66,11 @@ function readToken(name, dir = tokenDir()) {
     console.error(`  取得: claude setup-token でブラウザから org '${name}' を選び、出力トークンを ${f} に保存（改行なし）`);
     return null;
   }
+  const problem = tokenFileProblem(f);
+  if (problem) {
+    console.error(`claude-org: token file ${f} ${problem}`);
+    return null;
+  }
   return raw.replace(/[\r\n]/g, '');
 }
 
@@ -52,4 +90,4 @@ function resolvePrefer() {
   process.exit(1);
 }
 
-module.exports = { tokenDir, listOrgs, readToken, resolvePrefer };
+module.exports = { tokenDir, listOrgs, readToken, resolvePrefer, validOrgName, tokenFileProblem };

package/lib/launch.js

@@ -2,27 +2,62 @@
 const { spawnClaude } = require('./claude-spawn');
 const { readToken } = require('./config');
 
+// After a forwarded SIGTERM / SIGHUP, how long claude gets to exit on its own
+// before it is killed. Keeps a hung claude from outliving a supervisor's kill.
+const KILL_GRACE_MS = 10 * 1000;
+const FORWARDED_SIGNALS = ['SIGTERM', 'SIGHUP', 'SIGINT'];
+
 // Spawn claude with inherited stdio and extra env. Resolves to the child's
 // exit code (128+n when killed by signal n, like a shell would report).
+//
+// Signals sent to this launcher (a supervisor's reaper or timeout kills the
+// launcher pid, not claude) are forwarded to claude, and the launcher waits
+// for claude to exit instead of dying first and leaving claude orphaned with
+// its proxy gone. SIGINT from a terminal (Ctrl-C) reaches both processes at
+// once; forwarding it would give claude a second Ctrl-C, which it reads as
+// "exit". So with a terminal on any of stdin/stdout/stderr, SIGINT is left to
+// claude; with none (headless, under a supervisor) it is forwarded like the
+// others.
 function runClaude(args, envExtra = {}) {
   return new Promise(resolve => {
     const child = spawnClaude(args, {
       stdio: 'inherit',
       env: { ...process.env, ...envExtra },
     });
+    let killTimer = null;
+    const handlers = new Map();
+    for (const sig of FORWARDED_SIGNALS) {
+      const h = () => {
+        if (sig === 'SIGINT' && (process.stdin.isTTY || process.stdout.isTTY || process.stderr.isTTY)) return;
+        try { child.kill(sig); } catch { /* already exited */ }
+        if (!killTimer) {
+          killTimer = setTimeout(() => { try { child.kill('SIGKILL'); } catch { /* already exited */ } }, KILL_GRACE_MS);
+          killTimer.unref();
+        }
+      };
+      handlers.set(sig, h);
+      process.on(sig, h);
+    }
+    const done = code => {
+      for (const [sig, h] of handlers) process.off(sig, h);
+      if (killTimer) clearTimeout(killTimer);
+      resolve(code);
+    };
     child.on('error', e => {
       console.error(`claude-org: failed to launch claude: ${e.message}`);
-      resolve(1);
+      done(1);
     });
     child.on('exit', (code, signal) => {
-      if (code !== null) return resolve(code);
-      resolve(signal ? 128 + ({ SIGINT: 2, SIGTERM: 15 }[signal] || 1) : 1);
+      if (code !== null) return done(code);
+      done(signal ? 128 + ({ SIGINT: 2, SIGTERM: 15, SIGKILL: 9, SIGHUP: 1 }[signal] || 1) : 1);
     });
   });
 }
 
 // launch(name, args): 'default' launches a plain `claude`; a token org launches
 // with CLAUDE_CODE_OAUTH_TOKEN set. Returns the process exit code.
+// The token goes into claude's environment, where a prompt-injected claude can
+// read it; unattended runs should use `claude-org proxy` instead (README).
 async function launch(name, args) {
   if (name === 'default') return runClaude(args);
   const tok = readToken(name);

package/lib/pick.js

@@ -3,18 +3,23 @@ const { resolvePrefer } = require('./config');
 const { probe } = require('./probe');
 
 // pick(): which org `auto` should launch on. Returns 'default' when the
-// preferred org is over its 5h limit (or its token is missing). The decision
-// reason goes to stderr as a single `-> ...` line.
+// preferred org is over its 5h limit (or its token is missing), or refused the
+// model set in CLAUDE_ORG_PROBE_MODEL. The decision reason goes to stderr as a
+// single `-> ...` line.
 async function pick() {
   const prefer = resolvePrefer();
   const r = await probe(prefer);
-  if (r.allowed) {
+  if (r.usable) {
     let util = r.util;
     if (util !== '?') util = `${Math.trunc(Number(util) * 100)}%`;
     console.error(`-> ${prefer} (5h ${util} used)`);
     return prefer;
   }
-  console.error(`-> default (${prefer} is ${r.status}, resets ${r.resetLocal})`);
+  if (r.allowed) {
+    console.error(`-> default (${prefer} refused model ${r.model})`);
+  } else {
+    console.error(`-> default (${prefer} is ${r.status}, resets ${r.resetLocal})`);
+  }
   return 'default';
 }
 

package/lib/probe.js

@@ -2,18 +2,78 @@
 const { readToken } = require('./config');
 const { epochToHHMM } = require('./time');
 
-// probe(name): send a 1-token inference request and read the unified 5h
-// rate-limit headers. Returns { line, status, util, reset, resetLocal, allowed }.
-// `line` is the canonical one-line output:
+const DEFAULT_MODEL = 'claude-haiku-4-5-20251001';
+
+// Whether the org served the probed model. The 5h window is shared by every
+// model, but a model can still be refused while it reads "allowed" (it needs
+// usage credits, or its own weekly allowance is used up), so this is judged
+// from the HTTP status, not from the window headers.
+//   available    2xx
+//   unavailable  any other 4xx, while neither the 5h nor the 7d window is
+//                rejected
+//   unknown      no response, 401/403 (token or org permission), 408, 5xx, or
+//                a rejected window (which hides whether the model itself
+//                would be served)
+function judgeModel(res) {
+  if (!res) return 'unknown';
+  if (res.ok) return 'available';
+  const h = name => res.headers.get(`anthropic-ratelimit-unified-${name}`);
+  if (h('5h-status') === 'rejected' || h('7d-status') === 'rejected') return 'unknown';
+  if ([401, 403, 408].includes(res.status) || res.status >= 500 || res.status < 400) return 'unknown';
+  return 'unavailable';
+}
+
+// One 1-token request. Returns { res, errorType }: res is null when no response
+// came; errorType is error.type of a non-2xx JSON body ('' otherwise).
+async function send(tok, model) {
+  const base = (process.env.CLAUDE_ORG_UPSTREAM || 'https://api.anthropic.com').replace(/\/+$/, '');
+  try {
+    const res = await fetch(`${base}/v1/messages`, {
+      method: 'POST',
+      headers: {
+        authorization: `Bearer ${tok}`,
+        'anthropic-beta': 'oauth-2025-04-20',
+        'anthropic-version': '2023-06-01',
+        'content-type': 'application/json',
+      },
+      body: JSON.stringify({ model, max_tokens: 1, messages: [{ role: 'user', content: 'hi' }] }),
+      signal: AbortSignal.timeout(20000),
+    });
+    let errorType = '';
+    if (res.ok) {
+      res.body && res.body.cancel().catch(() => {});
+    } else {
+      try {
+        errorType = String(JSON.parse(await res.text()).error.type || '').replace(/[^\w.-]/g, '_').slice(0, 60);
+      } catch {
+        errorType = ''; // not a JSON error body: the HTTP status still decides model_status
+      }
+    }
+    return { res, errorType };
+  } catch {
+    return { res: null, errorType: '' };
+  }
+}
+
+// probe(name, model): send a 1-token inference request and read the unified
+// 5h rate-limit headers. Returns { line, status, util, reset, resetLocal,
+// allowed, model, modelStatus, usable }. `line` is the canonical one-line output:
 //   status=<allowed|rejected|unknown> 5h_util=<0.xx|?> 5h_reset=<epoch|?> 5h_reset_local=<HH:MM|?>
+// When a model is given (argument, else CLAUDE_ORG_PROBE_MODEL), the request
+// uses it and the line ends with ` model=<id> model_status=<see judgeModel>`,
+// plus ` model_error=<error.type>` when the model was refused.
+// Without one the request uses Haiku and the line is unchanged. `usable` is
+// "allowed and the model was not refused".
 //
 // Test seam: CLAUDE_ORG_FORCE_PROBE = allowed | rejected[:<epoch>] |
 // rejected_until:<epoch> (rejected_until flips to allowed once <epoch> passes).
 // When forced, the token file is not required and no request is sent.
 // CLAUDE_ORG_UPSTREAM overrides the API base URL (stub upstream in tests).
-async function probe(name) {
+async function probe(name, model = process.env.CLAUDE_ORG_PROBE_MODEL || '') {
   const forced = process.env.CLAUDE_ORG_FORCE_PROBE;
   let status, util, reset;
+  let modelStatus = 'unknown';
+  let modelError = '';
   if (forced) {
     const idx = forced.indexOf(':');
     status = idx === -1 ? forced : forced.slice(0, idx);
@@ -24,29 +84,26 @@ async function probe(name) {
     util = '?';
   } else {
     const tok = readToken(name);
-    if (tok === null) return { line: null, status: 'unknown', util: '?', reset: '?', resetLocal: '?', allowed: false };
-    const base = (process.env.CLAUDE_ORG_UPSTREAM || 'https://api.anthropic.com').replace(/\/+$/, '');
-    let headers = null;
-    try {
-      const res = await fetch(`${base}/v1/messages`, {
-        method: 'POST',
-        headers: {
-          authorization: `Bearer ${tok}`,
-          'anthropic-beta': 'oauth-2025-04-20',
-          'anthropic-version': '2023-06-01',
-          'content-type': 'application/json',
-        },
-        body: JSON.stringify({
-          model: 'claude-haiku-4-5-20251001',
-          max_tokens: 1,
-          messages: [{ role: 'user', content: 'hi' }],
-        }),
-        signal: AbortSignal.timeout(20000),
-      });
-      headers = res.headers;
-      res.body && res.body.cancel().catch(() => {});
-    } catch {
-      headers = null;
+    if (tok === null) {
+      return { line: null, status: 'unknown', util: '?', reset: '?', resetLocal: '?', allowed: false, model, modelStatus, usable: false };
+    }
+    const first = await send(tok, model || DEFAULT_MODEL);
+    let headers = first.res && first.res.headers;
+    modelStatus = judgeModel(first.res);
+    if (modelStatus === 'unavailable') modelError = first.errorType;
+    // A refusal for the model itself carried no window headers on 2026-10-10
+    // (Fable 5.1 on an org without usage credits), so the 5h state is read
+    // from a second request with the default model.
+    if (model && modelStatus === 'unavailable' && !headers.get('anthropic-ratelimit-unified-5h-status')) {
+      const second = await send(tok, DEFAULT_MODEL);
+      headers = second.res && second.res.headers;
+      // A rejected window there means the first 429 may have been the window,
+      // not the model, so the model cannot be judged.
+      const w = name => headers && headers.get(`anthropic-ratelimit-unified-${name}`);
+      if (w('5h-status') === 'rejected' || w('7d-status') === 'rejected') {
+        modelStatus = 'unknown';
+        modelError = '';
+      }
     }
     status = (headers && (headers.get('anthropic-ratelimit-unified-5h-status')
       || headers.get('anthropic-ratelimit-unified-status'))) || 'unknown';
@@ -54,8 +111,12 @@ async function probe(name) {
     reset = (headers && headers.get('anthropic-ratelimit-unified-5h-reset')) || '?';
   }
   const resetLocal = reset !== '?' ? epochToHHMM(reset) : '?';
-  const line = `status=${status} 5h_util=${util} 5h_reset=${reset} 5h_reset_local=${resetLocal}`;
-  return { line, status, util, reset, resetLocal, allowed: status === 'allowed' };
+  let line = `status=${status} 5h_util=${util} 5h_reset=${reset} 5h_reset_local=${resetLocal}`;
+  // The model is user input; keep the key=value line parseable.
+  if (model) line += ` model=${model.replace(/[^\w.:@/-]/g, '_')} model_status=${modelStatus}${modelError ? ` model_error=${modelError}` : ''}`;
+  const allowed = status === 'allowed';
+  const usable = allowed && !(model && modelStatus === 'unavailable');
+  return { line, status, util, reset, resetLocal, allowed, model, modelStatus, usable };
 }
 
 module.exports = { probe };