claude-org 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## Unreleased
 
+## 0.4.0 — 2026-10-11
+
+- `proxy`: hardened for unattended use under a supervisor (#22)
+  - only the `claude` it launched can use it: a per-session secret is checked (constant time) on every request, `Host` must be `127.0.0.1:<port>`, only `GET` / `POST` / `DELETE` under `/v1/` are forwarded, and bodies over 64 MB get 413. Standalone `node lib/proxy.js` needs `CLAUDE_ORG_PROXY_SECRET`
+  - it no longer crashes or hangs: an unreadable token dir gives 503, every request handler error is caught, hop-by-hop headers are dropped, an upstream that sends nothing for 10 min is given up and the next org tried, and a `claude` that cancels or exits mid-response cancels the upstream request
+  - the launcher forwards `SIGTERM` / `SIGHUP` (and `SIGINT` without a terminal) to `claude`, waits for it, and sends `SIGKILL` after 10 s, so killing the launcher pid no longer orphans `claude`; with a terminal, Ctrl-C no longer kills the proxy under a running `claude`
+  - token files must be mode `0600` and owned by the user, org names are limited to `[A-Za-z0-9_-]`, and `CLAUDE_ORG_UPSTREAM` other than `https://api.anthropic.com` is refused unless `CLAUDE_ORG_UNSAFE_UPSTREAM=1`
+  - a 401 from an org (expired token) fails over to the next org, and "no org works" events are logged on fixed-format `ALERT ...` lines a supervisor can grep (README, "Unattended use")
+  - the proxy log never records a request's query string (a refused `/v1/messages?...` is logged as such), so a secret put there cannot leak into the log
+  - README: unattended runs must use proxy mode; how to keep the token dir away from `claude`'s shell and Read tool
+
 ## 0.3.0 — 2026-10-10
 
 - `proxy`: each log line now names the model (`via <org> model=<model> -> <status>`), and the org and model of the last request are written to a JSON state file whose path is passed to `claude` as `CLAUDE_ORG_STATE_FILE`, for statusline and hooks (#12)

package/README.md

@@ -82,9 +82,10 @@ claude-org proxy --resume
 ```
 
 1. A session-scoped proxy starts on `127.0.0.1:<random port>` (one per session; no port collisions).
-2. `claude` launches with `ANTHROPIC_BASE_URL` pointing at the proxy and a **dummy** bearer token.
-3. The proxy replaces the `Authorization` header with a real org token and forwards to `api.anthropic.com`. On a 429 or `anthropic-ratelimit-unified-5h-status: rejected` it marks that org limited until `5h-reset` and **resends the same request** with the next org's token.
-4. Claude Code only ever sees the successful response — the org switched mid-session. SSE streaming is piped through untouched.
+2. `claude` launches with `ANTHROPIC_BASE_URL` pointing at the proxy and a **per-session secret** as its bearer token (`ANTHROPIC_AUTH_TOKEN`, generated with `crypto.randomBytes`; it exists only in that `claude`'s environment).
+3. The proxy serves only requests that carry that secret, name it in `Host` (`127.0.0.1:<port>`, so a web page cannot reach it by DNS rebinding) and are `GET` / `POST` / `DELETE` under `/v1/`; anything else is refused with 401 / 403 / 404 / 405 and never forwarded. Request bodies over 64 MB get 413.
+4. The proxy replaces the `Authorization` header with a real org token, drops hop-by-hop headers, and forwards to `api.anthropic.com` (any other upstream is refused unless `CLAUDE_ORG_UNSAFE_UPSTREAM=1`). On a 429 or `anthropic-ratelimit-unified-5h-status: rejected` it marks that org limited until `5h-reset` and **resends the same request** with the next org's token. An org whose token is rejected (401: expired or revoked) is skipped the same way for 10 minutes.
+5. Claude Code only ever sees the successful response — the org switched mid-session. SSE streaming is piped through untouched. When Claude Code cancels or exits mid-response, the upstream request is cancelled too; an upstream that sends nothing for 10 minutes is given up and the next org tried.
 
 One log line per request (`via <org> model=<model> -> <status>`) goes to a temp file printed at launch (`-> proxy 127.0.0.1:<port> (order: ..., strategy: ..., log: ...)`). The prompt and the tokens are never logged.
 
@@ -122,7 +123,38 @@ A custom `ANTHROPIC_BASE_URL` + `ANTHROPIC_AUTH_TOKEN` makes Claude Code treat t
 |---|---|---|---|
 | `claude` | no (default org) | yes | connector work |
 | `claude-org auto --resume` | at launch only | no on preferred org / yes on default | short tasks |
-| `claude-org proxy --resume` | **automatic** | no | long-running work, agents |
+| `claude-org proxy --resume` | **automatic** | no | long-running work, agents, unattended runs |
+
+### Unattended use (supervisors, `--dangerously-skip-permissions`)
+
+When a supervisor starts `claude` without a person watching (e.g. `claude -p` with `--dangerously-skip-permissions`), launch it through `claude-org proxy`, not `claude-org <org>` / `auto`:
+
+- **Use proxy mode only.** `claude-org <org>` and `auto` put the org token into `claude`'s environment as `CLAUDE_CODE_OAUTH_TOKEN`, where a prompt-injected `claude` can read it. In proxy mode the tokens stay in the launcher process; `claude` only holds the per-session proxy secret, which is worth nothing outside that session.
+- **Signals.** The launcher forwards `SIGTERM` / `SIGHUP` (and `SIGINT` when it has no terminal) to `claude`, waits for it to exit, and reports its exit code (`128+signal` when killed); after 10 s it sends `SIGKILL`. So a supervisor that kills the launcher pid does not leave an orphaned `claude`, and the proxy lives exactly as long as `claude` does. With a terminal, Ctrl-C goes to `claude` only (the launcher stays until `claude` exits).
+- **Keep the token files away from `claude`'s shell.** A `claude` running with permissions skipped can `cat ~/.claude/org-tokens/*.token` from Bash. The proxy refuses token files that are not mode `0600` and owned by you, but that does not stop your own `claude`. Deny the directory to sandboxed commands and to the Read tool in the settings of the project the unattended session runs in (both are needed: the sandbox covers shell commands only, the Read tool follows permission rules):
+
+  ```json
+  {
+    "permissions": { "deny": ["Read(~/.claude/org-tokens/**)"] },
+    "sandbox": {
+      "enabled": true,
+      "credentials": { "files": [{ "path": "~/.claude/org-tokens", "mode": "deny" }] }
+    }
+  }
+  ```
+
+  Source: Claude Code docs, [Configure the sandboxed Bash tool](https://code.claude.com/docs/en/sandboxing) (`sandbox.credentials.files` with `"mode": "deny"` applies the same read block as `sandbox.filesystem.denyRead`; the sandbox runs on macOS, Linux and WSL2, not native Windows). Running the proxy as a separate daemon under another user would close the gap fully; it is not implemented, and would build on the shared proxy discussed in #14 / #18.
+- **Detecting "no org works" from outside.** The proxy log (path on the `-> proxy` launch line) has one fixed-format line per such event, so a supervisor or a notifier can grep for `ALERT `:
+
+  | Line | Meaning |
+  |---|---|
+  | `ALERT token-rejected org=<org> status=401 -> run: claude setup-token ...` | that org's token is expired or revoked; the org is skipped for 10 min |
+  | `ALERT no-org-available model=<model> reason=rate-limited status=429` | every org is over its window; the 429 went to `claude` |
+  | `ALERT no-org-available model=<model> reason=model-rejected status=429` | every org refuses this model; switch the model |
+  | `ALERT no-org-available model=<model> reason=unreachable status=503` | no org answered (network, timeouts, bad token files) |
+  | `ALERT no-org-available model=<model> reason=no-tokens status=503` | the token dir is missing or has no usable `.token` file |
+
+  The state file (`CLAUDE_ORG_STATE_FILE`) records the same outcome as `status` (`503` with `"org": null`, or `401` with the org).
 
 ## Environment variables
 
@@ -135,7 +167,9 @@ A custom `ANTHROPIC_BASE_URL` + `ANTHROPIC_AUTH_TOKEN` makes Claude Code treat t
 | `CLAUDE_ORG_TOKEN_DIR` | `~/.claude/org-tokens` | Where `<name>.token` files live |
 | `CLAUDE_ORG_NOTIFY_CMD` | (unset) | `watch` notification command, run as `<cmd> "<title>" "<message>"` via the OS shell |
 | `CLAUDE_ORG_WATCH_MAX_SLEEP` | `18000` | Max seconds between `watch` re-checks (values < 60 also lower the 60s minimum — for tests) |
-| `CLAUDE_ORG_UPSTREAM` | `https://api.anthropic.com` | API base URL for `probe` and `proxy` (stub upstream in tests) |
+| `CLAUDE_ORG_UPSTREAM` | `https://api.anthropic.com` | API base URL for `probe` and `proxy` (stub upstream in tests). `proxy` refuses any other value unless `CLAUDE_ORG_UNSAFE_UPSTREAM=1`, since org tokens are sent there |
+| `CLAUDE_ORG_UNSAFE_UPSTREAM` | (unset) | `1` lets `proxy` forward to a `CLAUDE_ORG_UPSTREAM` other than `api.anthropic.com` (tests only) |
+| `CLAUDE_ORG_PROXY_SECRET` | (unset) | Standalone `node lib/proxy.js` only: the bearer value clients must send. `claude-org proxy` generates one per session itself |
 | `CLAUDE_ORG_PROXY` | `1` when launched via `proxy` | Marker env passed to the claude process so user hooks can detect connector-less sessions |
 | `CLAUDE_ORG_STATE_FILE` | set when launched via `proxy` | Path of the JSON file holding the org and model of the last request (read it from a statusline or hook) |
 | `CLAUDE_ORG_FORCE_PROBE` | (unset) | Test seam: `allowed` / `rejected[:<epoch>]` / `rejected_until:<epoch>` fakes `probe` results without API calls |
@@ -143,7 +177,7 @@ A custom `ANTHROPIC_BASE_URL` + `ANTHROPIC_AUTH_TOKEN` makes Claude Code treat t
 
 ## Notes
 
-- **Token safety**: tokens are read from files only and never printed to logs, errors, or test snapshots. The proxy binds to `127.0.0.1` only.
+- **Token safety**: tokens are read from files only and never printed to logs, errors, or test snapshots. A token file must be mode `0600` and owned by you (`chmod 600 ~/.claude/org-tokens/*.token`); one that other users can read is refused. Org names are limited to letters, digits, `_` and `-`. The proxy binds to `127.0.0.1` only and serves only the `claude` it launched (see [Unattended use](#unattended-use-supervisors---dangerously-skip-permissions)).
 - **probe cost**: each `probe` sends one `max_tokens=1` request (~11 tokens billed to that org), once per `auto` launch.
 - **Token expiry**: tokens last ~1 year. If `probe` returns `status=unknown` or `status` shows `(auth status failed)`, rerun `claude setup-token` and overwrite the file.
 

package/lib/config.js

@@ -7,7 +7,16 @@ function tokenDir() {
   return process.env.CLAUDE_ORG_TOKEN_DIR || path.join(os.homedir(), '.claude', 'org-tokens');
 }
 
-// Saved org names: *.token files, extension stripped, sorted.
+// An org name is used as a file name under the token dir, so anything that
+// could leave the dir ("../x", "a/b") or confuse a shell is refused.
+const ORG_NAME_RE = /^[\w-]+$/;
+function validOrgName(name) {
+  return typeof name === 'string' && ORG_NAME_RE.test(name);
+}
+
+// Saved org names: *.token files, extension stripped, sorted. A file whose
+// name is not a valid org name is left out, and said so once.
+const reportedBadNames = new Set();
 function listOrgs(dir = tokenDir()) {
   let files;
   try {
@@ -15,12 +24,36 @@ function listOrgs(dir = tokenDir()) {
   } catch {
     return [];
   }
-  return files.filter(f => f.endsWith('.token')).map(f => f.slice(0, -6)).sort();
+  const names = files.filter(f => f.endsWith('.token')).map(f => f.slice(0, -6));
+  for (const n of names) {
+    if (validOrgName(n) || reportedBadNames.has(n)) continue;
+    reportedBadNames.add(n);
+    console.error(`claude-org: ignoring ${path.join(dir, `${n}.token`)}: not an org name (letters, digits, _ and - only)`);
+  }
+  return names.filter(validOrgName).sort();
+}
+
+// Why a token file must be private to the user: the proxy sends its content
+// as a Bearer token, so a file another local user can read hands them that
+// org. Returns '' when the file is fine, else the reason it is refused.
+// Not checked on Windows (no POSIX mode bits there).
+function tokenFileProblem(file) {
+  if (process.platform === 'win32' || typeof process.getuid !== 'function') return '';
+  const st = fs.statSync(file);
+  const me = process.getuid();
+  if (st.uid !== me) return `is owned by uid ${st.uid}, not by you (uid ${me})`;
+  if (st.mode & 0o077) return `is readable by other users (mode ${(st.mode & 0o777).toString(8)}); run: chmod 600 ${file}`;
+  return '';
 }
 
 // Read a token file, stripping CR/LF. Returns null (after printing guidance)
-// when the file is missing or empty.
+// when the name is invalid, the file is missing or empty, or the file is not
+// private to the user.
 function readToken(name, dir = tokenDir()) {
+  if (!validOrgName(name)) {
+    console.error(`claude-org: invalid org name "${name}" (letters, digits, _ and - only)`);
+    return null;
+  }
   const f = path.join(dir, `${name}.token`);
   let raw = '';
   try {
@@ -33,6 +66,11 @@ function readToken(name, dir = tokenDir()) {
     console.error(`  取得: claude setup-token でブラウザから org '${name}' を選び、出力トークンを ${f} に保存（改行なし）`);
     return null;
   }
+  const problem = tokenFileProblem(f);
+  if (problem) {
+    console.error(`claude-org: token file ${f} ${problem}`);
+    return null;
+  }
   return raw.replace(/[\r\n]/g, '');
 }
 
@@ -52,4 +90,4 @@ function resolvePrefer() {
   process.exit(1);
 }
 
-module.exports = { tokenDir, listOrgs, readToken, resolvePrefer };
+module.exports = { tokenDir, listOrgs, readToken, resolvePrefer, validOrgName, tokenFileProblem };

package/lib/launch.js

@@ -2,27 +2,62 @@
 const { spawnClaude } = require('./claude-spawn');
 const { readToken } = require('./config');
 
+// After a forwarded SIGTERM / SIGHUP, how long claude gets to exit on its own
+// before it is killed. Keeps a hung claude from outliving a supervisor's kill.
+const KILL_GRACE_MS = 10 * 1000;
+const FORWARDED_SIGNALS = ['SIGTERM', 'SIGHUP', 'SIGINT'];
+
 // Spawn claude with inherited stdio and extra env. Resolves to the child's
 // exit code (128+n when killed by signal n, like a shell would report).
+//
+// Signals sent to this launcher (a supervisor's reaper or timeout kills the
+// launcher pid, not claude) are forwarded to claude, and the launcher waits
+// for claude to exit instead of dying first and leaving claude orphaned with
+// its proxy gone. SIGINT from a terminal (Ctrl-C) reaches both processes at
+// once; forwarding it would give claude a second Ctrl-C, which it reads as
+// "exit". So with a terminal on any of stdin/stdout/stderr, SIGINT is left to
+// claude; with none (headless, under a supervisor) it is forwarded like the
+// others.
 function runClaude(args, envExtra = {}) {
   return new Promise(resolve => {
     const child = spawnClaude(args, {
       stdio: 'inherit',
       env: { ...process.env, ...envExtra },
     });
+    let killTimer = null;
+    const handlers = new Map();
+    for (const sig of FORWARDED_SIGNALS) {
+      const h = () => {
+        if (sig === 'SIGINT' && (process.stdin.isTTY || process.stdout.isTTY || process.stderr.isTTY)) return;
+        try { child.kill(sig); } catch { /* already exited */ }
+        if (!killTimer) {
+          killTimer = setTimeout(() => { try { child.kill('SIGKILL'); } catch { /* already exited */ } }, KILL_GRACE_MS);
+          killTimer.unref();
+        }
+      };
+      handlers.set(sig, h);
+      process.on(sig, h);
+    }
+    const done = code => {
+      for (const [sig, h] of handlers) process.off(sig, h);
+      if (killTimer) clearTimeout(killTimer);
+      resolve(code);
+    };
     child.on('error', e => {
       console.error(`claude-org: failed to launch claude: ${e.message}`);
-      resolve(1);
+      done(1);
     });
     child.on('exit', (code, signal) => {
-      if (code !== null) return resolve(code);
-      resolve(signal ? 128 + ({ SIGINT: 2, SIGTERM: 15 }[signal] || 1) : 1);
+      if (code !== null) return done(code);
+      done(signal ? 128 + ({ SIGINT: 2, SIGTERM: 15, SIGKILL: 9, SIGHUP: 1 }[signal] || 1) : 1);
     });
   });
 }
 
 // launch(name, args): 'default' launches a plain `claude`; a token org launches
 // with CLAUDE_CODE_OAUTH_TOKEN set. Returns the process exit code.
+// The token goes into claude's environment, where a prompt-injected claude can
+// read it; unattended runs should use `claude-org proxy` instead (README).
 async function launch(name, args) {
   if (name === 'default') return runClaude(args);
   const tok = readToken(name);

package/lib/proxy.js

@@ -16,25 +16,35 @@
 // `Authorization: Bearer` alone, but if `x-api-key` is also present it is checked
 // first and returns 401. The proxy drops x-api-key and sends Bearer only.
 //
+// The proxy holds org tokens, so it only serves the one claude it was started
+// for: each request must carry a per-session secret (Authorization: Bearer,
+// what claude sends for ANTHROPIC_AUTH_TOKEN), name the proxy itself in Host
+// (no DNS rebinding from a browser), and be a GET/POST/DELETE under /v1/.
+//
 // Env (standalone mode):
-//   PORT                   listen port (default 0 = OS picks; reported on the
-//                          "listening on" stderr line)
-//   CLAUDE_ORG_TOKEN_DIR   where <name>.token files live (~/.claude/org-tokens)
-//   CLAUDE_ORG_ORDER       org priority, comma-separated (default: alphabetical)
-//   CLAUDE_ORG_STRATEGY    "least-utilized": prefer the usable org with the
-//                          lowest 5h utilization seen so far (default: ORDER)
-//   CLAUDE_ORG_UPSTREAM    forward target (default https://api.anthropic.com)
-//   CLAUDE_ORG_REJECT_FILE test seam: orgs listed comma-separated in this file
-//                          are treated as rate-limited
-//   CLAUDE_ORG_STATE_FILE  where the org and model of the last /v1/messages
-//                          response are written as JSON (unset: not written)
+//   PORT                     listen port (default 0 = OS picks; reported on the
+//                            "listening on" stderr line)
+//   CLAUDE_ORG_PROXY_SECRET  the Bearer value clients must send (required)
+//   CLAUDE_ORG_TOKEN_DIR     where <name>.token files live (~/.claude/org-tokens)
+//   CLAUDE_ORG_ORDER         org priority, comma-separated (default: alphabetical)
+//   CLAUDE_ORG_STRATEGY      "least-utilized": prefer the usable org with the
+//                            lowest 5h utilization seen so far (default: ORDER)
+//   CLAUDE_ORG_UPSTREAM      forward target (default https://api.anthropic.com;
+//                            anything else needs CLAUDE_ORG_UNSAFE_UPSTREAM=1)
+//   CLAUDE_ORG_REJECT_FILE   test seam: orgs listed comma-separated in this file
+//                            are treated as rate-limited
+//   CLAUDE_ORG_STATE_FILE    where the org and model of the last /v1/messages
+//                            response are written as JSON (unset: not written)
 const http = require('http');
 const https = require('https');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
 const zlib = require('zlib');
+const crypto = require('crypto');
+const { validOrgName, tokenFileProblem } = require('./config');
 
+const DEFAULT_UPSTREAM = 'https://api.anthropic.com';
 // How long an org stays out when it is org-wide limited but sent no reset time,
 // and the longest a model-specific refusal keeps an (org, model) pair out.
 const ORG_REJECT_FALLBACK_MS = 10 * 60 * 1000;
@@ -43,6 +53,37 @@ const MODEL_REJECT_MAX_MS = 10 * 60 * 1000;
 // from exhausting memory: the raw body read, and the decompressed copy.
 const ERROR_BODY_MAX_BYTES = 1024 * 1024;
 const ERROR_DECODED_MAX_BYTES = 64 * 1024;
+// The request body is buffered whole (it may be resent to another org). The
+// API's own limit is 32 MB; this cap only keeps a runaway client from filling
+// memory.
+const REQUEST_BODY_MAX_BYTES = 64 * 1024 * 1024;
+// Idle time on the upstream connection (no bytes in either direction) after
+// which the request is given up and the next org tried. Claude Code's own
+// API_TIMEOUT_MS defaults to the same 10 minutes.
+const UPSTREAM_TIMEOUT_MS = 10 * 60 * 1000;
+const ALLOWED_METHODS = new Set(['GET', 'POST', 'DELETE']);
+// Hop-by-hop headers (RFC 9110 §7.6.1) describe one connection and must not be
+// forwarded; the body is re-framed by this proxy anyway.
+const HOP_BY_HOP = new Set(['connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization',
+  'te', 'trailer', 'trailers', 'transfer-encoding', 'upgrade']);
+
+// A copy of `headers` without the hop-by-hop ones and those the Connection
+// header names.
+function stripHopByHop(headers) {
+  const named = new Set(String(headers.connection || '').split(',').map(s => s.trim().toLowerCase()).filter(Boolean));
+  const out = {};
+  for (const [k, v] of Object.entries(headers)) {
+    const lk = k.toLowerCase();
+    if (!HOP_BY_HOP.has(lk) && !named.has(lk)) out[k] = v;
+  }
+  return out;
+}
+
+// Constant-time comparison that does not leak the secret's length either.
+function secretMatches(given, secret) {
+  const h = s => crypto.createHash('sha256').update(String(s)).digest();
+  return crypto.timingSafeEqual(h(given), h(secret));
+}
 
 // The "model" field of a /v1/messages request body, or '?' when the body is
 // not JSON (the proxy must still forward it). Used as is as the quarantine
@@ -56,11 +97,17 @@ function requestModel(body) {
   }
 }
 
-// The model name for the log: client input, so limited to safe characters and
-// cut short.
+// Client input for the log: limited to safe characters and cut short.
 function logModel(model) {
   return model.replace(/[^\w.:@/-]/g, '_').slice(0, 80);
 }
+// The query string is dropped: a client may put secrets there, and the log
+// only needs to show which path was refused.
+function logPath(url) {
+  const s = String(url);
+  const q = s.indexOf('?');
+  return (q === -1 ? s : s.slice(0, q) + '?...').replace(/[^\w.:@/?-]/g, '_').slice(0, 120);
+}
 
 // Milliseconds from a Retry-After header, which is either delay-seconds or an
 // HTTP-date. NaN when absent or unparsable.
@@ -87,6 +134,8 @@ function readBody(res, maxBytes) {
     });
     res.on('end', () => resolve(Buffer.concat(chunks)));
     res.on('error', reject);
+    // destroy() without an error (the client went away) emits neither
+    res.on('close', () => reject(new Error('upstream closed before the 429 body ended')));
   });
 }
 
@@ -121,27 +170,54 @@ function createProxy(opts = {}) {
     || path.join(os.homedir(), '.claude', 'org-tokens');
   const ORDER = opts.order
     || (process.env.CLAUDE_ORG_ORDER || '').split(',').map(s => s.trim()).filter(Boolean);
-  const UPSTREAM = new URL(opts.upstream || process.env.CLAUDE_ORG_UPSTREAM || 'https://api.anthropic.com');
+  const UPSTREAM = new URL(opts.upstream || process.env.CLAUDE_ORG_UPSTREAM || DEFAULT_UPSTREAM);
   const REJECT_FILE = 'rejectFile' in opts ? opts.rejectFile : (process.env.CLAUDE_ORG_REJECT_FILE || '');
   const STATE_FILE = 'stateFile' in opts ? opts.stateFile : (process.env.CLAUDE_ORG_STATE_FILE || '');
   const STRATEGY = 'strategy' in opts ? opts.strategy : (process.env.CLAUDE_ORG_STRATEGY || '');
+  const SECRET = 'secret' in opts ? opts.secret : (process.env.CLAUDE_ORG_PROXY_SECRET || '');
+  const ALLOW_ANY_UPSTREAM = 'allowAnyUpstream' in opts ? opts.allowAnyUpstream : process.env.CLAUDE_ORG_UNSAFE_UPSTREAM === '1';
+  const MAX_BODY = opts.maxBodyBytes || REQUEST_BODY_MAX_BYTES;
+  const UPSTREAM_TIMEOUT = opts.upstreamTimeoutMs || UPSTREAM_TIMEOUT_MS;
   const out = opts.log || process.stderr;
   const transport = UPSTREAM.protocol === 'http:' ? http : https;
 
+  // Org tokens go to the upstream as Bearer, so the upstream is pinned to the
+  // real API unless a test says otherwise.
+  if (UPSTREAM.href !== `${DEFAULT_UPSTREAM}/` && !ALLOW_ANY_UPSTREAM) {
+    throw new Error(`CLAUDE_ORG_UPSTREAM=${UPSTREAM.href} is not ${DEFAULT_UPSTREAM}; org tokens are only sent there (set CLAUDE_ORG_UNSAFE_UPSTREAM=1 for a test upstream)`);
+  }
+  if (!SECRET) {
+    throw new Error('proxy secret missing: set CLAUDE_ORG_PROXY_SECRET (claude-org proxy generates one per session)');
+  }
+
   function log(...a) {
     out.write(`[claude-org-proxy ${new Date().toISOString().slice(11, 19)}] ${a.join(' ')}\n`);
   }
   const leastUtilized = STRATEGY === 'least-utilized';
   if (STRATEGY && !leastUtilized) log(`unknown CLAUDE_ORG_STRATEGY "${STRATEGY}" -> using the static order`);
 
+  const reportedBadNames = new Set();
   function listOrgs() {
-    const files = fs.readdirSync(TOKEN_DIR).filter(f => f.endsWith('.token')).map(f => f.slice(0, -6)).sort();
+    const names = fs.readdirSync(TOKEN_DIR).filter(f => f.endsWith('.token')).map(f => f.slice(0, -6));
+    for (const n of names) {
+      if (validOrgName(n) || reportedBadNames.has(n)) continue;
+      reportedBadNames.add(n);
+      log(`ignoring ${TOKEN_DIR}/${logModel(n)}.token: not an org name (letters, digits, _ and - only)`);
+    }
+    const files = names.filter(validOrgName).sort();
     if (ORDER.length === 0) return files;
     const known = new Set(files);
     return ORDER.filter(o => known.has(o)).concat(files.filter(f => !ORDER.includes(f)));
   }
+  // Throws when the file is missing or not private to the user (S5): the
+  // caller skips that org for this request.
   function readToken(name) {
-    return fs.readFileSync(path.join(TOKEN_DIR, `${name}.token`), 'utf8').replace(/[\r\n]/g, '');
+    const f = path.join(TOKEN_DIR, `${name}.token`);
+    const problem = tokenFileProblem(f);
+    if (problem) throw new Error(`token file ${f} ${problem}`);
+    const tok = fs.readFileSync(f, 'utf8').replace(/[\r\n]/g, '');
+    if (!tok) throw new Error(`token file ${f} is empty`);
+    return tok;
   }
 
   // Per-org "rate-limited" memory: name -> recovery epoch (ms). Expired entries
@@ -230,123 +306,252 @@ function createProxy(opts = {}) {
     }
   }
 
-  function forward(org, method, urlPath, headers, body) {
+  // One upstream request. Resolves with the response once its headers are in;
+  // rejects on connection errors, on idle timeout, and when `signal` aborts
+  // (the client went away). The response stream can still fail later; the
+  // caller listens for that.
+  function forward(token, method, urlPath, headers, body, signal) {
     return new Promise((resolve, reject) => {
-      const h = { ...headers };
+      const h = stripHopByHop(headers);
       for (const k of Object.keys(h)) {
         const lk = k.toLowerCase();
         if (lk === 'x-api-key' || lk === 'host' || lk === 'content-length' || lk === 'authorization') delete h[k];
       }
-      h.authorization = `Bearer ${readToken(org)}`;
+      h.authorization = `Bearer ${token}`;
       h.host = UPSTREAM.host;
       if (body.length) h['content-length'] = String(body.length);
       const req = transport.request(
-        { hostname: UPSTREAM.hostname, port: UPSTREAM.port || (transport === https ? 443 : 80), path: urlPath, method, headers: h },
+        {
+          hostname: UPSTREAM.hostname,
+          port: UPSTREAM.port || (transport === https ? 443 : 80),
+          path: urlPath,
+          method,
+          headers: h,
+          signal,
+          timeout: UPSTREAM_TIMEOUT,
+        },
         res => resolve(res),
       );
+      req.on('timeout', () => req.destroy(new Error(`no data from upstream for ${UPSTREAM_TIMEOUT} ms`)));
       req.on('error', reject);
       if (body.length) req.write(body);
       req.end();
     });
   }
 
-  const server = http.createServer((clientReq, clientRes) => {
-    const chunks = [];
-    clientReq.on('data', c => chunks.push(c));
-    clientReq.on('end', async () => {
-      const body = Buffer.concat(chunks);
-      const isModelReq = clientReq.url.startsWith('/v1/messages');
-      const model = isModelReq ? requestModel(body) : '';
-      const order = pickOrder(model);
-      let attempt = 0;
-      let modelRefusals = 0;
-      for (const org of order) {
-        attempt++;
-        let up;
+  function refuse(clientRes, status, message) {
+    clientRes.writeHead(status, { 'content-type': 'application/json', connection: 'close' });
+    clientRes.end(JSON.stringify({ type: 'error', error: { type: 'claude_org_proxy', message } }));
+  }
+
+  // Checks done before any body is read or anything is forwarded. Returns
+  // [status, message] for a request to refuse, or null.
+  function gate(clientReq) {
+    const auth = clientReq.headers.authorization || '';
+    if (!auth.startsWith('Bearer ') || !secretMatches(auth.slice(7), SECRET)) {
+      return [401, 'missing or wrong proxy secret (the Bearer token claude-org proxy gave this session)'];
+    }
+    const addr = server.address(); // null once the server is closing
+    if (!addr) return [503, 'proxy is shutting down'];
+    const expectedHost = `127.0.0.1:${addr.port}`;
+    if (clientReq.headers.host !== expectedHost) return [403, `Host must be ${expectedHost}`];
+    if (!ALLOWED_METHODS.has(clientReq.method)) return [405, `method ${clientReq.method} is not forwarded`];
+    // The path is forwarded as is, so nothing that an upstream could
+    // normalise out of /v1/ ("..", "//", "\\", %2e) is accepted.
+    const pathOnly = clientReq.url.split('?')[0];
+    if (!pathOnly.startsWith('/v1/') || /\.\.|\/\/|\\|%2e/i.test(pathOnly)) return [404, 'only /v1/* is forwarded'];
+    const announced = Number(clientReq.headers['content-length']);
+    if (announced > MAX_BODY) return [413, `request body larger than ${MAX_BODY} bytes`];
+    return null;
+  }
+
+  async function handle(clientReq, clientRes, body) {
+    // The client going away (Claude Code cancelled, or exited) cancels the
+    // upstream request in flight and stops a response being piped, so no org
+    // keeps generating for nobody.
+    const abort = new AbortController();
+    let clientGone = false;
+    let up = null;
+    clientRes.on('close', () => {
+      if (clientRes.writableFinished) return;
+      clientGone = true;
+      abort.abort();
+      if (up) up.destroy();
+    });
+    const isModelReq = clientReq.url.startsWith('/v1/messages');
+    const model = isModelReq ? requestModel(body) : '';
+    let order;
+    try {
+      order = pickOrder(model);
+    } catch (e) {
+      log(`cannot list orgs in ${TOKEN_DIR}: ${e.message}`);
+      order = [];
+    }
+    let attempt = 0;
+    let modelRefusals = 0;
+    for (const org of order) {
+      attempt++;
+      if (clientGone) return;
+      let token;
+      try {
+        token = readToken(org);
+      } catch (e) {
+        log(`skipping ${org}: ${e.message}`);
+        continue;
+      }
+      try {
+        up = await forward(token, clientReq.method, clientReq.url, clientReq.headers, body, abort.signal);
+      } catch (e) {
+        if (clientGone) return;
+        log(`upstream error via ${org}: ${e.message}`);
+        continue;
+      }
+      // A response that fails after its headers (idle timeout, reset) is only
+      // logged here; whether the client is cut off is decided where it is piped.
+      up.on('error', e => log(`upstream error via ${org} while reading the response: ${e.message}`));
+      const hdr = name => up.headers[`anthropic-ratelimit-unified-${name}`];
+      const status5h = hdr('5h-status');
+      const status7d = hdr('7d-status');
+      const claim = hdr('representative-claim');
+      const util5h = Number(hdr('5h-utilization'));
+      if (isModelReq && hdr('5h-utilization') !== undefined && Number.isFinite(util5h)) {
+        recordUtil(org, util5h, Number(hdr('5h-reset')));
+      } else if (isModelReq) {
+        answeredUnmeasured.add(org);
+      }
+      const isLast = attempt >= order.length;
+      // A 401 means the org's token is expired or revoked (they last about a
+      // year), not that the request is bad: the org is kept out for a while
+      // and the next one tried. The ALERT line is the fixed format a
+      // supervisor can watch for (README, "Unattended use").
+      if (isModelReq && up.statusCode === 401) {
+        log(`ALERT token-rejected org=${org} status=401 -> run: claude setup-token (org ${org}) and overwrite ${path.join(TOKEN_DIR, `${org}.token`)}`);
+        rejectedUntil.set(org, Date.now() + ORG_REJECT_FALLBACK_MS);
+        if (!isLast) {
+          up.resume();
+          continue;
+        }
+      }
+      // The 5h and 7d windows cover every model of the org, so only those make
+      // the org as a whole unusable. Other refusals are per model: a used-up
+      // per-model weekly allowance (claim=seven_day_overage_included) or a model
+      // that needs usage credits (429 with no window headers). The overall
+      // "unified-status" header is not used: it also reads "rejected" for those.
+      const orgWide = status5h === 'rejected' || status7d === 'rejected';
+      const limited = up.statusCode === 429 || orgWide;
+      const windows = `5h=${status5h ?? '?'}${claim ? `, claim=${claim}` : ''}`;
+      // A 429 body is a small JSON error; buffer it to log the reason and,
+      // if no org is left, to hand it to the client unchanged.
+      let errBody = null;
+      let reason = '';
+      if (isModelReq && up.statusCode === 429) {
         try {
-          up = await forward(org, clientReq.method, clientReq.url, clientReq.headers, body);
+          errBody = await readBody(up, ERROR_BODY_MAX_BYTES);
         } catch (e) {
-          log(`upstream error via ${org}: ${e.message}`);
+          log(`upstream error via ${org} while reading 429 body: ${e.message}`);
           continue;
         }
-        const hdr = name => up.headers[`anthropic-ratelimit-unified-${name}`];
-        const status5h = hdr('5h-status');
-        const status7d = hdr('7d-status');
-        const claim = hdr('representative-claim');
-        const util5h = Number(hdr('5h-utilization'));
-        if (isModelReq && hdr('5h-utilization') !== undefined && Number.isFinite(util5h)) {
-          recordUtil(org, util5h, Number(hdr('5h-reset')));
-        } else if (isModelReq) {
-          answeredUnmeasured.add(org);
-        }
-        // The 5h and 7d windows cover every model of the org, so only those make
-        // the org as a whole unusable. Other refusals are per model: a used-up
-        // per-model weekly allowance (claim=seven_day_overage_included) or a model
-        // that needs usage credits (429 with no window headers). The overall
-        // "unified-status" header is not used: it also reads "rejected" for those.
-        const orgWide = status5h === 'rejected' || status7d === 'rejected';
-        const limited = up.statusCode === 429 || orgWide;
-        const windows = `5h=${status5h ?? '?'}${claim ? `, claim=${claim}` : ''}`;
-        // A 429 body is a small JSON error; buffer it to log the reason and,
-        // if no org is left, to hand it to the client unchanged.
-        let errBody = null;
-        let reason = '';
-        if (isModelReq && up.statusCode === 429) {
-          try {
-            errBody = await readBody(up, ERROR_BODY_MAX_BYTES);
-          } catch (e) {
-            log(`upstream error via ${org} while reading 429 body: ${e.message}`);
-            continue;
-          }
-          reason = describeError(errBody, up.headers['content-encoding']);
-        }
-        const modelRefused = isModelReq && up.statusCode === 429 && !orgWide;
-        if (modelRefused) {
-          // retry-after is honoured when shorter (a transient per-minute limit
-          // must not keep the preferred org out for long); a long one (a weekly
-          // per-model allowance) is capped so the org is re-checked now and then.
-          const ra = retryAfterMs(up.headers['retry-after']);
-          const ms = Number.isFinite(ra) ? Math.min(ra, MODEL_REJECT_MAX_MS) : MODEL_REJECT_MAX_MS;
-          modelRejectedUntil.set(`${org}|${model}`, Date.now() + ms);
-        }
-        const isLast = attempt >= order.length;
-        if (limited && isModelReq && !isLast) {
-          if (orgWide) {
-            // When both windows are rejected the org is back only after the later reset.
-            const resets = [['5h', status5h], ['7d', status7d]]
-              .filter(([, s]) => s === 'rejected')
-              .map(([w]) => Number(hdr(`${w}-reset`)))
-              .filter(Number.isFinite);
-            rejectedUntil.set(org, resets.length ? Math.max(...resets) * 1000 : Date.now() + ORG_REJECT_FALLBACK_MS);
-            log(`${org} is rate-limited (HTTP ${up.statusCode}, ${windows}) -> retrying with next org${reason ? ` (${reason})` : ''}`);
-          } else {
-            modelRefusals++;
-            log(`${org} rejected model ${logModel(model)} (HTTP ${up.statusCode}, ${windows}, ${reason}) -> retrying with next org; ${org} stays in use for other models`);
-          }
-          if (!errBody) up.resume(); // discard the response body and try the next org
-          continue;
+        reason = describeError(errBody, up.headers['content-encoding']);
+      }
+      const modelRefused = isModelReq && up.statusCode === 429 && !orgWide;
+      if (modelRefused) {
+        // retry-after is honoured when shorter (a transient per-minute limit
+        // must not keep the preferred org out for long); a long one (a weekly
+        // per-model allowance) is capped so the org is re-checked now and then.
+        const ra = retryAfterMs(up.headers['retry-after']);
+        const ms = Number.isFinite(ra) ? Math.min(ra, MODEL_REJECT_MAX_MS) : MODEL_REJECT_MAX_MS;
+        modelRejectedUntil.set(`${org}|${model}`, Date.now() + ms);
+      }
+      if (limited && isModelReq && !isLast) {
+        if (orgWide) {
+          // When both windows are rejected the org is back only after the later reset.
+          const resets = [['5h', status5h], ['7d', status7d]]
+            .filter(([, s]) => s === 'rejected')
+            .map(([w]) => Number(hdr(`${w}-reset`)))
+            .filter(Number.isFinite);
+          rejectedUntil.set(org, resets.length ? Math.max(...resets) * 1000 : Date.now() + ORG_REJECT_FALLBACK_MS);
+          log(`${org} is rate-limited (HTTP ${up.statusCode}, ${windows}) -> retrying with next org${reason ? ` (${reason})` : ''}`);
+        } else {
+          modelRefusals++;
+          log(`${org} rejected model ${logModel(model)} (HTTP ${up.statusCode}, ${windows}, ${reason}) -> retrying with next org; ${org} stays in use for other models`);
         }
-        if (isModelReq) {
-          const util = hdr('5h-utilization');
-          log(`${clientReq.method} ${clientReq.url} via ${org} model=${logModel(model)} -> ${up.statusCode} (5h ${status5h ?? '?'} ${util ?? '?'})${reason ? ` ${reason}` : ''}`);
-          writeState(org, model, up.statusCode);
-          if (modelRefused && modelRefusals === attempt - 1) {
-            log(`all orgs rejected model ${logModel(model)} -> switch the model (e.g. /model) or wait for that model's limit to reset; the org tokens are not the cause`);
-          }
+        if (!errBody) up.resume(); // discard the response body and try the next org
+        continue;
+      }
+      if (isModelReq) {
+        const util = hdr('5h-utilization');
+        log(`${clientReq.method} ${clientReq.url} via ${org} model=${logModel(model)} -> ${up.statusCode} (5h ${status5h ?? '?'} ${util ?? '?'})${reason ? ` ${reason}` : ''}`);
+        writeState(org, model, up.statusCode);
+        if (modelRefused && modelRefusals === attempt - 1) {
+          log(`all orgs rejected model ${logModel(model)} -> switch the model (e.g. /model) or wait for that model's limit to reset; the org tokens are not the cause`);
         }
-        clientRes.writeHead(up.statusCode, { ...up.headers, 'x-claude-org': org });
-        if (errBody) {
-          clientRes.end(errBody);
-        } else {
-          up.pipe(clientRes); // SSE streaming is piped through untouched
+        if (limited) {
+          log(`ALERT no-org-available model=${logModel(model)} reason=${modelRefused ? 'model-rejected' : 'rate-limited'} status=${up.statusCode}`);
         }
+      }
+      if (clientGone) { up.destroy(); return; }
+      clientRes.writeHead(up.statusCode, { ...stripHopByHop(up.headers), 'x-claude-org': org });
+      if (errBody) {
+        clientRes.end(errBody);
+      } else {
+        up.once('error', () => clientRes.destroy()); // the client sees a reset, not a truncated OK
+        up.pipe(clientRes); // SSE streaming is piped through untouched
+      }
+      return;
+    }
+    if (clientGone) return;
+    if (isModelReq) {
+      writeState(null, model, 503); // no org served it
+      log(`ALERT no-org-available model=${logModel(model)} reason=${order.length ? 'unreachable' : 'no-tokens'} status=503`);
+    }
+    refuse(clientRes, 503, 'all orgs rate-limited or unreachable');
+  }
+
+  // Nothing in here may take the process down: with no proxy, every claude
+  // behind it is stranded.
+  const server = http.createServer((clientReq, clientRes) => {
+    try {
+      accept(clientReq, clientRes);
+    } catch (e) {
+      log(`internal error on ${clientReq.method} ${logPath(clientReq.url)}: ${e.stack || e.message}`);
+      if (!clientRes.headersSent) refuse(clientRes, 500, 'proxy internal error (see the proxy log)');
+      else clientRes.destroy();
+    }
+  });
+
+  function accept(clientReq, clientRes) {
+    clientReq.on('error', e => log(`client request error: ${e.message}`));
+    clientRes.on('error', e => log(`client response error: ${e.message}`));
+    const denied = gate(clientReq);
+    if (denied) {
+      log(`refused ${clientReq.method} ${logPath(clientReq.url)}: ${denied[1]} (HTTP ${denied[0]})`);
+      refuse(clientRes, denied[0], denied[1]);
+      return; // the rest of the request body is discarded by node
+    }
+    const chunks = [];
+    let size = 0;
+    let tooLarge = false;
+    clientReq.on('data', c => {
+      if (tooLarge) return;
+      size += c.length;
+      if (size > MAX_BODY) {
+        tooLarge = true;
+        chunks.length = 0;
+        log(`refused ${clientReq.method} ${logPath(clientReq.url)}: request body larger than ${MAX_BODY} bytes (HTTP 413)`);
+        refuse(clientRes, 413, `request body larger than ${MAX_BODY} bytes`);
         return;
       }
-      if (isModelReq) writeState(null, model, 503); // no org served it
-      clientRes.writeHead(503, { 'content-type': 'application/json' });
-      clientRes.end(JSON.stringify({ type: 'error', error: { type: 'claude_org_proxy', message: 'all orgs rate-limited or unreachable' } }));
+      chunks.push(c);
     });
-  });
+    clientReq.on('end', () => {
+      if (tooLarge) return;
+      handle(clientReq, clientRes, Buffer.concat(chunks)).catch(e => {
+        log(`internal error on ${clientReq.method} ${logPath(clientReq.url)}: ${e.stack || e.message}`);
+        if (!clientRes.headersSent) refuse(clientRes, 500, 'proxy internal error (see the proxy log)');
+        else clientRes.destroy();
+      });
+    });
+  }
 
   return { server, listOrgs, log, upstream: UPSTREAM, strategy: leastUtilized ? 'least-utilized' : 'order' };
 }
@@ -358,7 +563,14 @@ async function proxyLaunch(args) {
   const { listOrgs, tokenDir, resolvePrefer } = require('./config');
   const { runClaude } = require('./launch');
 
-  const orgs = listOrgs();
+  // An org whose token file the proxy would refuse (S5) is reported here, at
+  // launch, not only in the proxy log after every request has failed.
+  const orgs = listOrgs().filter(name => {
+    const f = path.join(tokenDir(), `${name}.token`);
+    const problem = tokenFileProblem(f);
+    if (problem) console.error(`claude-org: skipping org ${name}: token file ${f} ${problem}`);
+    return !problem;
+  });
   if (orgs.length < 2) {
     console.error(`claude-org: proxy には org トークンが 2 つ以上必要です（${tokenDir()} に ${orgs.join(' ')}）`);
     console.error(`  取得: claude setup-token でもう片方の org を選び、${tokenDir()}/<name>.token に保存`);
@@ -370,7 +582,26 @@ async function proxyLaunch(args) {
   const logf = path.join(runDir, 'proxy.log');
   const stateFile = path.join(runDir, 'state.json');
   const logStream = fs.createWriteStream(logf);
-  const { server, log, upstream, strategy } = createProxy({ order: order.split(','), log: logStream, stateFile });
+  // A log that cannot be written (disk full, dir removed) must not take the
+  // proxy down with an unhandled 'error'.
+  let logFailed = false;
+  logStream.on('error', e => {
+    if (!logFailed) console.error(`claude-org: cannot write the proxy log ${logf}: ${e.message}`);
+    logFailed = true;
+  });
+  // Only this claude may use this proxy (and so the org tokens): it must send
+  // this per-session secret as its Bearer token. It goes into the child's env
+  // and nowhere else.
+  const secret = crypto.randomBytes(32).toString('hex');
+  let proxy;
+  try {
+    proxy = createProxy({ order: order.split(','), log: logStream, stateFile, secret });
+  } catch (e) {
+    console.error(`claude-org: ${e.message}`);
+    logStream.end();
+    return 1;
+  }
+  const { server, log, upstream, strategy } = proxy;
 
   try {
     await new Promise((resolve, reject) => {
@@ -392,7 +623,7 @@ async function proxyLaunch(args) {
   // disabled. Restore subscription-equivalent defaults; user-set values win.
   const envExtra = {
     ANTHROPIC_BASE_URL: `http://127.0.0.1:${port}`,
-    ANTHROPIC_AUTH_TOKEN: 'claude-org-proxy', // dummy; the proxy replaces it
+    ANTHROPIC_AUTH_TOKEN: secret,             // sent as Bearer; the proxy checks it, then swaps in an org token
     CLAUDE_ORG_PROXY: '1',                    // marker: "connector MCPs unavailable" session
     CLAUDE_ORG_STATE_FILE: stateFile,         // last org/model, for statusline and hooks
   };
@@ -409,9 +640,22 @@ async function proxyLaunch(args) {
 // `node claude-org-proxy.js`).
 if (require.main === module) {
   const PORT = Number(process.env.PORT || 0);
-  const { server, listOrgs, log, upstream, strategy } = createProxy();
+  let proxy;
+  try {
+    proxy = createProxy();
+  } catch (e) {
+    console.error(`claude-org-proxy: ${e.message}`);
+    process.exit(1);
+  }
+  const { server, listOrgs, log, upstream, strategy } = proxy;
+  server.once('error', e => {
+    console.error(`claude-org-proxy: cannot listen on 127.0.0.1:${PORT}: ${e.message}`);
+    process.exit(1);
+  });
   server.listen(PORT, '127.0.0.1', () => {
-    log(`listening on http://127.0.0.1:${server.address().port} orgs=${listOrgs().join(',')} upstream=${upstream.host} strategy=${strategy}`);
+    let orgs;
+    try { orgs = listOrgs().join(','); } catch (e) { orgs = `<cannot list: ${e.message}>`; }
+    log(`listening on http://127.0.0.1:${server.address().port} orgs=${orgs} upstream=${upstream.host} strategy=${strategy}`);
   });
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-org",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Switch Claude Code between multiple Anthropic organizations, with automatic failover on the 5-hour rate limit",
   "license": "MIT",
   "type": "commonjs",