claude-org 0.3.0 → 0.5.0

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 ## Unreleased
 
+## 0.5.0 — 2026-10-27
+
+- `proxy`: claude.ai connector MCPs (Slack / Notion / Gmail …) now work in proxy sessions when you are signed in to claude.ai. The launch checks `claude auth status`; with a claude.ai login, `claude` keeps it and sends the per-session secret in an `x-claude-org-secret` header (`ANTHROPIC_CUSTOM_HEADERS`, your own lines kept) instead of `ANTHROPIC_AUTH_TOKEN`. The proxy discards the login token and the header and still sends only org tokens upstream. Without a login (or with `CLAUDE_ORG_NO_CONNECTORS=1`) the session starts as before. The launch line `-> claude.ai connectors: on/off (...)` and the `CLAUDE_ORG_CONNECTORS=1/0` env say which mode is in use (#35)
+
+- `proxy`: each launch keeps its log dir (`claude-org-proxy-*` in the temp dir) for later investigation, but now removes all but the newest 20 at startup, so repeated and headless launches no longer pile up (#15)
+
+## 0.4.0 — 2026-10-11
+
+- `proxy`: hardened for unattended use under a supervisor (#22)
+  - only the `claude` it launched can use it: a per-session secret is checked (constant time) on every request, `Host` must be `127.0.0.1:<port>`, only `GET` / `POST` / `DELETE` under `/v1/` are forwarded, and bodies over 64 MB get 413. Standalone `node lib/proxy.js` needs `CLAUDE_ORG_PROXY_SECRET`
+  - it no longer crashes or hangs: an unreadable token dir gives 503, every request handler error is caught, hop-by-hop headers are dropped, an upstream that sends nothing for 10 min is given up and the next org tried, and a `claude` that cancels or exits mid-response cancels the upstream request
+  - the launcher forwards `SIGTERM` / `SIGHUP` (and `SIGINT` without a terminal) to `claude`, waits for it, and sends `SIGKILL` after 10 s, so killing the launcher pid no longer orphans `claude`; with a terminal, Ctrl-C no longer kills the proxy under a running `claude`
+  - token files must be mode `0600` and owned by the user, org names are limited to `[A-Za-z0-9_-]`, and `CLAUDE_ORG_UPSTREAM` other than `https://api.anthropic.com` is refused unless `CLAUDE_ORG_UNSAFE_UPSTREAM=1`
+  - a 401 from an org (expired token) fails over to the next org, and "no org works" events are logged on fixed-format `ALERT ...` lines a supervisor can grep (README, "Unattended use")
+  - the proxy log never records a request's query string (a refused `/v1/messages?...` is logged as such), so a secret put there cannot leak into the log
+  - README: unattended runs must use proxy mode; how to keep the token dir away from `claude`'s shell and Read tool
+
 ## 0.3.0 — 2026-10-10
 
 - `proxy`: each log line now names the model (`via <org> model=<model> -> <status>`), and the org and model of the last request are written to a JSON state file whose path is passed to `claude` as `CLAUDE_ORG_STATE_FILE`, for statusline and hooks (#12)

package/README.md

@@ -82,9 +82,14 @@ claude-org proxy --resume
 ```
 
 1. A session-scoped proxy starts on `127.0.0.1:<random port>` (one per session; no port collisions).
-2. `claude` launches with `ANTHROPIC_BASE_URL` pointing at the proxy and a **dummy** bearer token.
-3. The proxy replaces the `Authorization` header with a real org token and forwards to `api.anthropic.com`. On a 429 or `anthropic-ratelimit-unified-5h-status: rejected` it marks that org limited until `5h-reset` and **resends the same request** with the next org's token.
-4. Claude Code only ever sees the successful response — the org switched mid-session. SSE streaming is piped through untouched.
+2. `claude` launches with `ANTHROPIC_BASE_URL` pointing at the proxy and a **per-session secret** (generated with `crypto.randomBytes`; it exists only in that `claude`'s environment). How the secret is passed depends on your login (see [claude.ai connectors](#claudeai-connectors-slack--notion-) below):
+   - you are signed in to claude.ai (`claude auth status` shows `"authMethod": "claude.ai"`): in an `x-claude-org-secret` header via `ANTHROPIC_CUSTOM_HEADERS`, and `claude` keeps its claude.ai login, so connector MCPs load. Your other `ANTHROPIC_CUSTOM_HEADERS` lines are kept;
+   - otherwise (no login, an API key or token in your env, or `CLAUDE_ORG_NO_CONNECTORS=1`): as its bearer token (`ANTHROPIC_AUTH_TOKEN`), as in earlier versions.
+
+   The launch prints which one was used: `-> claude.ai connectors: on (...)` / `off (<reason>)`.
+3. The proxy serves only requests that carry that secret, name it in `Host` (`127.0.0.1:<port>`, so a web page cannot reach it by DNS rebinding) and are `GET` / `POST` / `DELETE` under `/v1/`; anything else is refused with 401 / 403 / 404 / 405 and never forwarded. Request bodies over 64 MB get 413.
+4. The proxy replaces the `Authorization` header with a real org token (when `claude` keeps its claude.ai login, that login token arrives as `Authorization` and is discarded, never forwarded or logged), drops the `x-claude-org-secret` header and hop-by-hop headers, and forwards to `api.anthropic.com` (any other upstream is refused unless `CLAUDE_ORG_UNSAFE_UPSTREAM=1`). On a 429 or `anthropic-ratelimit-unified-5h-status: rejected` it marks that org limited until `5h-reset` and **resends the same request** with the next org's token. An org whose token is rejected (401: expired or revoked) is skipped the same way for 10 minutes.
+5. Claude Code only ever sees the successful response — the org switched mid-session. SSE streaming is piped through untouched. When Claude Code cancels or exits mid-response, the upstream request is cancelled too; an upstream that sends nothing for 10 minutes is given up and the next org tried.
 
 One log line per request (`via <org> model=<model> -> <status>`) goes to a temp file printed at launch (`-> proxy 127.0.0.1:<port> (order: ..., strategy: ..., log: ...)`). The prompt and the tokens are never logged.
 
@@ -96,33 +101,73 @@ One log line per request (`via <org> model=<model> -> <status>`) goes to a temp
 [ -n "$CLAUDE_ORG_STATE_FILE" ] && [ -f "$CLAUDE_ORG_STATE_FILE" ] && node -p "require(process.env.CLAUDE_ORG_STATE_FILE).org"
 ```
 
+**claude.ai connectors (Slack / Notion / …)**
+
+Claude Code loads claude.ai connector MCPs (Gmail / Drive / Calendar / Notion / Slack …, `mcp__claude_ai_*`) only while it uses a claude.ai login: when `ANTHROPIC_AUTH_TOKEN` or an API key takes precedence it skips them (its debug log says `[claudeai-mcp] Disabled: API-key auth precedence active`; `ANTHROPIC_BASE_URL` alone does not disable them). So when you are signed in to claude.ai, `claude-org proxy` leaves the login in place and passes its secret in a header instead, and connectors work in proxy sessions:
+
+- Connectors are those of your **claude.ai login** (the default org), whichever org the proxy sends model requests to. Their calls go from Claude Code straight to Anthropic, not through the proxy.
+- The launch asks `claude auth status` first (about one second). If you are not signed in, have an API key or token in your env, or the check fails, the session starts the earlier way (Bearer secret, no connectors) and the launch line says why.
+- `CLAUDE_ORG_NO_CONNECTORS=1` forces the earlier way. The session gets `CLAUDE_ORG_CONNECTORS=1` or `0` so hooks can tell which one it is.
+- Claude Code may also send custom headers to other Anthropic endpoints. The secret is accepted only by this session's loopback proxy and is worthless once it exits.
+
 **Limitations of proxy mode**
 
-- claude.ai connector MCPs (Gmail / Drive / Calendar / Notion / Slack …) and Remote Control are **unavailable**: `ANTHROPIC_AUTH_TOKEN` makes Claude Code treat the session as external-token auth, so `mcp__claude_ai_*` tools do not appear. Local/plugin MCPs work. Open connectors in a plain `claude --resume` session — history is shared.
+- Without a claude.ai login (see above), claude.ai connector MCPs and Remote Control are **unavailable**. Local/plugin MCPs work either way. Open connectors in a plain `claude --resume` session — history is shared.
 - Each proxy serves one session and dies when `claude` exits.
 
 **Subagents**
 
 - Subagents started with Claude Code's Agent tool run in the same process as the parent session and share its `ANTHROPIC_BASE_URL`, so they go through the same proxy with no setup and use the same orgs' limits. Their requests appear in the proxy log with their own `model=` (e.g. a Haiku subagent).
 - Not covered: a `claude` started as a separate process (it needs its own `claude-org proxy`), and agents that run in the cloud (e.g. `isolation: remote`).
-- The connector MCP limitation above applies to subagents too.
+- Subagents get the same connector MCPs as the parent session (none when it started without a claude.ai login).
 - When an org's 5h or 7d window is rejected, the org is taken out for every model, so subagents also move to the next org until the window resets. A 429 for one model only (#8) moves that model only; other models, including those of subagents, stay on the org.
 - Work routed to a Team / Enterprise org (e.g. your company's) counts toward that org's usage, which its admins can see.
 
 ### Prompt cache & tool search
 
-A custom `ANTHROPIC_BASE_URL` + `ANTHROPIC_AUTH_TOKEN` makes Claude Code treat the session as API-key auth, which changes two defaults:
+A custom `ANTHROPIC_BASE_URL` + `ANTHROPIC_AUTH_TOKEN` (the mode without a claude.ai login) makes Claude Code treat the session as API-key auth, which changes two defaults:
 
 - **Prompt cache TTL drops to 5 minutes** (subscription-direct sessions get 1 hour). The 1-hour TTL is requested via the `anthropic-beta` header, which the proxy forwards unchanged.
 - **MCP tool search** (deferred tool-definition loading) is **disabled**.
 
-`claude-org proxy` restores the subscription-equivalent behavior by launching `claude` with `CLAUDE_CODE_PROMPT_CACHE_TTL=1h` and `ENABLE_TOOL_SEARCH=true`. If you have set either variable yourself, your value wins.
+`claude-org proxy` restores the subscription-equivalent behavior by launching `claude` with `CLAUDE_CODE_PROMPT_CACHE_TTL=1h` and `ENABLE_TOOL_SEARCH=true` (in both modes). If you have set either variable yourself, your value wins.
 
 | Entry point | Mid-session switch | Connector MCPs | Best for |
 |---|---|---|---|
 | `claude` | no (default org) | yes | connector work |
 | `claude-org auto --resume` | at launch only | no on preferred org / yes on default | short tasks |
-| `claude-org proxy --resume` | **automatic** | no | long-running work, agents |
+| `claude-org proxy --resume` | **automatic** | yes with a claude.ai login (those of the login) / no otherwise | long-running work, agents, unattended runs |
+
+### Unattended use (supervisors, `--dangerously-skip-permissions`)
+
+When a supervisor starts `claude` without a person watching (e.g. `claude -p` with `--dangerously-skip-permissions`), launch it through `claude-org proxy`, not `claude-org <org>` / `auto`:
+
+- **Use proxy mode only.** `claude-org <org>` and `auto` put the org token into `claude`'s environment as `CLAUDE_CODE_OAUTH_TOKEN`, where a prompt-injected `claude` can read it. In proxy mode the org tokens stay in the launcher process; `claude` only holds the per-session proxy secret, which is worth nothing outside that session (and, when you are signed in to claude.ai, its own claude.ai login, which it has without claude-org too; set `CLAUDE_ORG_NO_CONNECTORS=1` if the unattended session should not use the login).
+- **Signals.** The launcher forwards `SIGTERM` / `SIGHUP` (and `SIGINT` when it has no terminal) to `claude`, waits for it to exit, and reports its exit code (`128+signal` when killed); after 10 s it sends `SIGKILL`. So a supervisor that kills the launcher pid does not leave an orphaned `claude`, and the proxy lives exactly as long as `claude` does. With a terminal, Ctrl-C goes to `claude` only (the launcher stays until `claude` exits).
+- **Keep the token files away from `claude`'s shell.** A `claude` running with permissions skipped can `cat ~/.claude/org-tokens/*.token` from Bash. The proxy refuses token files that are not mode `0600` and owned by you, but that does not stop your own `claude`. Deny the directory to sandboxed commands and to the Read tool in the settings of the project the unattended session runs in (both are needed: the sandbox covers shell commands only, the Read tool follows permission rules):
+
+  ```json
+  {
+    "permissions": { "deny": ["Read(~/.claude/org-tokens/**)"] },
+    "sandbox": {
+      "enabled": true,
+      "credentials": { "files": [{ "path": "~/.claude/org-tokens", "mode": "deny" }] }
+    }
+  }
+  ```
+
+  Source: Claude Code docs, [Configure the sandboxed Bash tool](https://code.claude.com/docs/en/sandboxing) (`sandbox.credentials.files` with `"mode": "deny"` applies the same read block as `sandbox.filesystem.denyRead`; the sandbox runs on macOS, Linux and WSL2, not native Windows). Running the proxy as a separate daemon under another user would close the gap fully; it is not implemented, and would build on the shared proxy discussed in #14 / #18.
+- **Detecting "no org works" from outside.** The proxy log (path on the `-> proxy` launch line) has one fixed-format line per such event, so a supervisor or a notifier can grep for `ALERT `:
+
+  | Line | Meaning |
+  |---|---|
+  | `ALERT token-rejected org=<org> status=401 -> run: claude setup-token ...` | that org's token is expired or revoked; the org is skipped for 10 min |
+  | `ALERT no-org-available model=<model> reason=rate-limited status=429` | every org is over its window; the 429 went to `claude` |
+  | `ALERT no-org-available model=<model> reason=model-rejected status=429` | every org refuses this model; switch the model |
+  | `ALERT no-org-available model=<model> reason=unreachable status=503` | no org answered (network, timeouts, bad token files) |
+  | `ALERT no-org-available model=<model> reason=no-tokens status=503` | the token dir is missing or has no usable `.token` file |
+
+  The state file (`CLAUDE_ORG_STATE_FILE`) records the same outcome as `status` (`503` with `"org": null`, or `401` with the org).
 
 ## Environment variables
 
@@ -135,15 +180,19 @@ A custom `ANTHROPIC_BASE_URL` + `ANTHROPIC_AUTH_TOKEN` makes Claude Code treat t
 | `CLAUDE_ORG_TOKEN_DIR` | `~/.claude/org-tokens` | Where `<name>.token` files live |
 | `CLAUDE_ORG_NOTIFY_CMD` | (unset) | `watch` notification command, run as `<cmd> "<title>" "<message>"` via the OS shell |
 | `CLAUDE_ORG_WATCH_MAX_SLEEP` | `18000` | Max seconds between `watch` re-checks (values < 60 also lower the 60s minimum — for tests) |
-| `CLAUDE_ORG_UPSTREAM` | `https://api.anthropic.com` | API base URL for `probe` and `proxy` (stub upstream in tests) |
-| `CLAUDE_ORG_PROXY` | `1` when launched via `proxy` | Marker env passed to the claude process so user hooks can detect connector-less sessions |
+| `CLAUDE_ORG_UPSTREAM` | `https://api.anthropic.com` | API base URL for `probe` and `proxy` (stub upstream in tests). `proxy` refuses any other value unless `CLAUDE_ORG_UNSAFE_UPSTREAM=1`, since org tokens are sent there |
+| `CLAUDE_ORG_UNSAFE_UPSTREAM` | (unset) | `1` lets `proxy` forward to a `CLAUDE_ORG_UPSTREAM` other than `api.anthropic.com` (tests only) |
+| `CLAUDE_ORG_PROXY_SECRET` | (unset) | Standalone `node lib/proxy.js` only: the value clients must send (as `x-claude-org-secret` header or bearer token). `claude-org proxy` generates one per session itself |
+| `CLAUDE_ORG_NO_CONNECTORS` | (unset) | `1`: `proxy` always passes the secret as `ANTHROPIC_AUTH_TOKEN` (no claude.ai login check, no connector MCPs) |
+| `CLAUDE_ORG_PROXY` | `1` when launched via `proxy` | Marker env passed to the claude process so user hooks can detect proxy sessions |
+| `CLAUDE_ORG_CONNECTORS` | `1` / `0` when launched via `proxy` | Marker env: `1` when the session kept its claude.ai login (connector MCPs can load), `0` otherwise |
 | `CLAUDE_ORG_STATE_FILE` | set when launched via `proxy` | Path of the JSON file holding the org and model of the last request (read it from a statusline or hook) |
 | `CLAUDE_ORG_FORCE_PROBE` | (unset) | Test seam: `allowed` / `rejected[:<epoch>]` / `rejected_until:<epoch>` fakes `probe` results without API calls |
 | `CLAUDE_ORG_REJECT_FILE` | (unset) | Test seam: orgs listed comma-separated in this file are treated as rate-limited by `proxy` |
 
 ## Notes
 
-- **Token safety**: tokens are read from files only and never printed to logs, errors, or test snapshots. The proxy binds to `127.0.0.1` only.
+- **Token safety**: tokens are read from files only and never printed to logs, errors, or test snapshots. A token file must be mode `0600` and owned by you (`chmod 600 ~/.claude/org-tokens/*.token`); one that other users can read is refused. Org names are limited to letters, digits, `_` and `-`. The proxy binds to `127.0.0.1` only and serves only the `claude` it launched (see [Unattended use](#unattended-use-supervisors---dangerously-skip-permissions)).
 - **probe cost**: each `probe` sends one `max_tokens=1` request (~11 tokens billed to that org), once per `auto` launch.
 - **Token expiry**: tokens last ~1 year. If `probe` returns `status=unknown` or `status` shows `(auth status failed)`, rerun `claude setup-token` and overwrite the file.
 

package/bin/claude-org.js

@@ -62,9 +62,20 @@ async function main() {
   }
 }
 
+// Exit by letting the event loop drain instead of process.exit(): on Windows
+// (Node 24.10), process.exit() after two or more fetch() calls aborts with the
+// libuv assertion "!(handle->flags & UV_HANDLE_CLOSING)" in src\win\async.c
+// and exit code 127 instead of ours (#36). If something still holds the loop
+// open, the unref'd timer exits the old way so the CLI never hangs.
+const EXIT_GRACE_MS = 5000;
+function finish(code) {
+  process.exitCode = code;
+  setTimeout(() => process.exit(code), EXIT_GRACE_MS).unref();
+}
+
 main()
-  .then(code => process.exit(code))
+  .then(code => finish(code))
   .catch(e => {
     console.error(`claude-org: ${e.message}`);
-    process.exit(1);
+    finish(1);
   });

package/lib/config.js

@@ -7,7 +7,16 @@ function tokenDir() {
   return process.env.CLAUDE_ORG_TOKEN_DIR || path.join(os.homedir(), '.claude', 'org-tokens');
 }
 
-// Saved org names: *.token files, extension stripped, sorted.
+// An org name is used as a file name under the token dir, so anything that
+// could leave the dir ("../x", "a/b") or confuse a shell is refused.
+const ORG_NAME_RE = /^[\w-]+$/;
+function validOrgName(name) {
+  return typeof name === 'string' && ORG_NAME_RE.test(name);
+}
+
+// Saved org names: *.token files, extension stripped, sorted. A file whose
+// name is not a valid org name is left out, and said so once.
+const reportedBadNames = new Set();
 function listOrgs(dir = tokenDir()) {
   let files;
   try {
@@ -15,12 +24,36 @@ function listOrgs(dir = tokenDir()) {
   } catch {
     return [];
   }
-  return files.filter(f => f.endsWith('.token')).map(f => f.slice(0, -6)).sort();
+  const names = files.filter(f => f.endsWith('.token')).map(f => f.slice(0, -6));
+  for (const n of names) {
+    if (validOrgName(n) || reportedBadNames.has(n)) continue;
+    reportedBadNames.add(n);
+    console.error(`claude-org: ignoring ${path.join(dir, `${n}.token`)}: not an org name (letters, digits, _ and - only)`);
+  }
+  return names.filter(validOrgName).sort();
+}
+
+// Why a token file must be private to the user: the proxy sends its content
+// as a Bearer token, so a file another local user can read hands them that
+// org. Returns '' when the file is fine, else the reason it is refused.
+// Not checked on Windows (no POSIX mode bits there).
+function tokenFileProblem(file) {
+  if (process.platform === 'win32' || typeof process.getuid !== 'function') return '';
+  const st = fs.statSync(file);
+  const me = process.getuid();
+  if (st.uid !== me) return `is owned by uid ${st.uid}, not by you (uid ${me})`;
+  if (st.mode & 0o077) return `is readable by other users (mode ${(st.mode & 0o777).toString(8)}); run: chmod 600 ${file}`;
+  return '';
 }
 
 // Read a token file, stripping CR/LF. Returns null (after printing guidance)
-// when the file is missing or empty.
+// when the name is invalid, the file is missing or empty, or the file is not
+// private to the user.
 function readToken(name, dir = tokenDir()) {
+  if (!validOrgName(name)) {
+    console.error(`claude-org: invalid org name "${name}" (letters, digits, _ and - only)`);
+    return null;
+  }
   const f = path.join(dir, `${name}.token`);
   let raw = '';
   try {
@@ -33,6 +66,11 @@ function readToken(name, dir = tokenDir()) {
     console.error(`  取得: claude setup-token でブラウザから org '${name}' を選び、出力トークンを ${f} に保存（改行なし）`);
     return null;
   }
+  const problem = tokenFileProblem(f);
+  if (problem) {
+    console.error(`claude-org: token file ${f} ${problem}`);
+    return null;
+  }
   return raw.replace(/[\r\n]/g, '');
 }
 
@@ -52,4 +90,4 @@ function resolvePrefer() {
   process.exit(1);
 }
 
-module.exports = { tokenDir, listOrgs, readToken, resolvePrefer };
+module.exports = { tokenDir, listOrgs, readToken, resolvePrefer, validOrgName, tokenFileProblem };

package/lib/launch.js

@@ -2,27 +2,75 @@
 const { spawnClaude } = require('./claude-spawn');
 const { readToken } = require('./config');
 
-// Spawn claude with inherited stdio and extra env. Resolves to the child's
-// exit code (128+n when killed by signal n, like a shell would report).
+// After a forwarded SIGTERM / SIGHUP, how long claude gets to exit on its own
+// before it is killed. Keeps a hung claude from outliving a supervisor's kill.
+const KILL_GRACE_MS = 10 * 1000;
+const FORWARDED_SIGNALS = ['SIGTERM', 'SIGHUP', 'SIGINT'];
+
+// Spawn claude with inherited stdio and extra env (a key set to undefined is
+// removed from the inherited env). Resolves to the child's exit code (128+n
+// when killed by signal n, like a shell would report).
+//
+// Signals sent to this launcher (a supervisor's reaper or timeout kills the
+// launcher pid, not claude) are forwarded to claude, and the launcher waits
+// for claude to exit instead of dying first and leaving claude orphaned with
+// its proxy gone. SIGINT from a terminal (Ctrl-C) reaches both processes at
+// once; forwarding it would give claude a second Ctrl-C, which it reads as
+// "exit". So with a terminal on any of stdin/stdout/stderr, SIGINT is left to
+// claude; with none (headless, under a supervisor) it is forwarded like the
+// others.
+// Windows env names are case-insensitive, so a removed key is matched that way
+// there (an inherited "Anthropic_Auth_Token" must not survive).
+function childEnv(envExtra = {}) {
+  const env = { ...process.env, ...envExtra };
+  const same = process.platform === 'win32' ? (a, b) => a.toUpperCase() === b.toUpperCase() : (a, b) => a === b;
+  for (const [k, v] of Object.entries(envExtra)) {
+    if (v !== undefined) continue;
+    for (const name of Object.keys(env)) if (same(name, k)) delete env[name];
+  }
+  return env;
+}
+
 function runClaude(args, envExtra = {}) {
   return new Promise(resolve => {
     const child = spawnClaude(args, {
       stdio: 'inherit',
-      env: { ...process.env, ...envExtra },
+      env: childEnv(envExtra),
     });
+    let killTimer = null;
+    const handlers = new Map();
+    for (const sig of FORWARDED_SIGNALS) {
+      const h = () => {
+        if (sig === 'SIGINT' && (process.stdin.isTTY || process.stdout.isTTY || process.stderr.isTTY)) return;
+        try { child.kill(sig); } catch { /* already exited */ }
+        if (!killTimer) {
+          killTimer = setTimeout(() => { try { child.kill('SIGKILL'); } catch { /* already exited */ } }, KILL_GRACE_MS);
+          killTimer.unref();
+        }
+      };
+      handlers.set(sig, h);
+      process.on(sig, h);
+    }
+    const done = code => {
+      for (const [sig, h] of handlers) process.off(sig, h);
+      if (killTimer) clearTimeout(killTimer);
+      resolve(code);
+    };
     child.on('error', e => {
       console.error(`claude-org: failed to launch claude: ${e.message}`);
-      resolve(1);
+      done(1);
     });
     child.on('exit', (code, signal) => {
-      if (code !== null) return resolve(code);
-      resolve(signal ? 128 + ({ SIGINT: 2, SIGTERM: 15 }[signal] || 1) : 1);
+      if (code !== null) return done(code);
+      done(signal ? 128 + ({ SIGINT: 2, SIGTERM: 15, SIGKILL: 9, SIGHUP: 1 }[signal] || 1) : 1);
     });
   });
 }
 
 // launch(name, args): 'default' launches a plain `claude`; a token org launches
 // with CLAUDE_CODE_OAUTH_TOKEN set. Returns the process exit code.
+// The token goes into claude's environment, where a prompt-injected claude can
+// read it; unattended runs should use `claude-org proxy` instead (README).
 async function launch(name, args) {
   if (name === 'default') return runClaude(args);
   const tok = readToken(name);
@@ -30,4 +78,4 @@ async function launch(name, args) {
   return runClaude(args, { CLAUDE_CODE_OAUTH_TOKEN: tok });
 }
 
-module.exports = { runClaude, launch };
+module.exports = { runClaude, launch, childEnv };

package/lib/proxy.js

@@ -16,25 +16,38 @@
 // `Authorization: Bearer` alone, but if `x-api-key` is also present it is checked
 // first and returns 401. The proxy drops x-api-key and sends Bearer only.
 //
+// The proxy holds org tokens, so it only serves the one claude it was started
+// for: each request must carry a per-session secret, name the proxy itself in
+// Host (no DNS rebinding from a browser), and be a GET/POST/DELETE under /v1/.
+// The secret comes either in the x-claude-org-secret header (what claude sends
+// for ANTHROPIC_CUSTOM_HEADERS; the Authorization header then holds claude's
+// own claude.ai login token, which is discarded) or as Authorization: Bearer
+// (what claude sends for ANTHROPIC_AUTH_TOKEN). Neither reaches the upstream.
+//
 // Env (standalone mode):
-//   PORT                   listen port (default 0 = OS picks; reported on the
-//                          "listening on" stderr line)
-//   CLAUDE_ORG_TOKEN_DIR   where <name>.token files live (~/.claude/org-tokens)
-//   CLAUDE_ORG_ORDER       org priority, comma-separated (default: alphabetical)
-//   CLAUDE_ORG_STRATEGY    "least-utilized": prefer the usable org with the
-//                          lowest 5h utilization seen so far (default: ORDER)
-//   CLAUDE_ORG_UPSTREAM    forward target (default https://api.anthropic.com)
-//   CLAUDE_ORG_REJECT_FILE test seam: orgs listed comma-separated in this file
-//                          are treated as rate-limited
-//   CLAUDE_ORG_STATE_FILE  where the org and model of the last /v1/messages
-//                          response are written as JSON (unset: not written)
+//   PORT                     listen port (default 0 = OS picks; reported on the
+//                            "listening on" stderr line)
+//   CLAUDE_ORG_PROXY_SECRET  the Bearer value clients must send (required)
+//   CLAUDE_ORG_TOKEN_DIR     where <name>.token files live (~/.claude/org-tokens)
+//   CLAUDE_ORG_ORDER         org priority, comma-separated (default: alphabetical)
+//   CLAUDE_ORG_STRATEGY      "least-utilized": prefer the usable org with the
+//                            lowest 5h utilization seen so far (default: ORDER)
+//   CLAUDE_ORG_UPSTREAM      forward target (default https://api.anthropic.com;
+//                            anything else needs CLAUDE_ORG_UNSAFE_UPSTREAM=1)
+//   CLAUDE_ORG_REJECT_FILE   test seam: orgs listed comma-separated in this file
+//                            are treated as rate-limited
+//   CLAUDE_ORG_STATE_FILE    where the org and model of the last /v1/messages
+//                            response are written as JSON (unset: not written)
 const http = require('http');
 const https = require('https');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
 const zlib = require('zlib');
+const crypto = require('crypto');
+const { validOrgName, tokenFileProblem } = require('./config');
 
+const DEFAULT_UPSTREAM = 'https://api.anthropic.com';
 // How long an org stays out when it is org-wide limited but sent no reset time,
 // and the longest a model-specific refusal keeps an (org, model) pair out.
 const ORG_REJECT_FALLBACK_MS = 10 * 60 * 1000;
@@ -43,6 +56,38 @@ const MODEL_REJECT_MAX_MS = 10 * 60 * 1000;
 // from exhausting memory: the raw body read, and the decompressed copy.
 const ERROR_BODY_MAX_BYTES = 1024 * 1024;
 const ERROR_DECODED_MAX_BYTES = 64 * 1024;
+// The request body is buffered whole (it may be resent to another org). The
+// API's own limit is 32 MB; this cap only keeps a runaway client from filling
+// memory.
+const REQUEST_BODY_MAX_BYTES = 64 * 1024 * 1024;
+// Idle time on the upstream connection (no bytes in either direction) after
+// which the request is given up and the next org tried. Claude Code's own
+// API_TIMEOUT_MS defaults to the same 10 minutes.
+const UPSTREAM_TIMEOUT_MS = 10 * 60 * 1000;
+const ALLOWED_METHODS = new Set(['GET', 'POST', 'DELETE']);
+const SECRET_HEADER = 'x-claude-org-secret';
+// Hop-by-hop headers (RFC 9110 §7.6.1) describe one connection and must not be
+// forwarded; the body is re-framed by this proxy anyway.
+const HOP_BY_HOP = new Set(['connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization',
+  'te', 'trailer', 'trailers', 'transfer-encoding', 'upgrade']);
+
+// A copy of `headers` without the hop-by-hop ones and those the Connection
+// header names.
+function stripHopByHop(headers) {
+  const named = new Set(String(headers.connection || '').split(',').map(s => s.trim().toLowerCase()).filter(Boolean));
+  const out = {};
+  for (const [k, v] of Object.entries(headers)) {
+    const lk = k.toLowerCase();
+    if (!HOP_BY_HOP.has(lk) && !named.has(lk)) out[k] = v;
+  }
+  return out;
+}
+
+// Constant-time comparison that does not leak the secret's length either.
+function secretMatches(given, secret) {
+  const h = s => crypto.createHash('sha256').update(String(s)).digest();
+  return crypto.timingSafeEqual(h(given), h(secret));
+}
 
 // The "model" field of a /v1/messages request body, or '?' when the body is
 // not JSON (the proxy must still forward it). Used as is as the quarantine
@@ -56,11 +101,38 @@ function requestModel(body) {
   }
 }
 
-// The model name for the log: client input, so limited to safe characters and
-// cut short.
+// Claude Code's startup quota check, sent by an interactive session that uses
+// a claude.ai login (so in the connectors mode; captured from 2.1.310 on
+// 2026-10-26): POST /v1/messages, max_tokens 1, no system prompt, one user
+// message "quota". The API answers it with 429 rate_limit_error "Error" and no
+// rate-limit headers for every OAuth token, the claude.ai login's own included
+// (measured on all three), while real requests from the same tokens get 200.
+// So its 429 says nothing about the org or the model: it is passed through
+// from the first org without failover, quarantine or ALERT.
+function isQuotaCheck(body) {
+  try {
+    const j = JSON.parse(body.toString('utf8'));
+    const m = Array.isArray(j.messages) && j.messages.length === 1 ? j.messages[0] : null;
+    if (j.max_tokens !== 1 || j.system !== undefined || !m || m.role !== 'user') return false;
+    const text = typeof m.content === 'string' ? m.content
+      : Array.isArray(m.content) && m.content.length === 1 && m.content[0].type === 'text' ? m.content[0].text : null;
+    return text === 'quota';
+  } catch {
+    return false;
+  }
+}
+
+// Client input for the log: limited to safe characters and cut short.
 function logModel(model) {
   return model.replace(/[^\w.:@/-]/g, '_').slice(0, 80);
 }
+// The query string is dropped: a client may put secrets there, and the log
+// only needs to show which path was refused.
+function logPath(url) {
+  const s = String(url);
+  const q = s.indexOf('?');
+  return (q === -1 ? s : s.slice(0, q) + '?...').replace(/[^\w.:@/?-]/g, '_').slice(0, 120);
+}
 
 // Milliseconds from a Retry-After header, which is either delay-seconds or an
 // HTTP-date. NaN when absent or unparsable.
@@ -87,6 +159,8 @@ function readBody(res, maxBytes) {
     });
     res.on('end', () => resolve(Buffer.concat(chunks)));
     res.on('error', reject);
+    // destroy() without an error (the client went away) emits neither
+    res.on('close', () => reject(new Error('upstream closed before the 429 body ended')));
   });
 }
 
@@ -121,27 +195,54 @@ function createProxy(opts = {}) {
     || path.join(os.homedir(), '.claude', 'org-tokens');
   const ORDER = opts.order
     || (process.env.CLAUDE_ORG_ORDER || '').split(',').map(s => s.trim()).filter(Boolean);
-  const UPSTREAM = new URL(opts.upstream || process.env.CLAUDE_ORG_UPSTREAM || 'https://api.anthropic.com');
+  const UPSTREAM = new URL(opts.upstream || process.env.CLAUDE_ORG_UPSTREAM || DEFAULT_UPSTREAM);
   const REJECT_FILE = 'rejectFile' in opts ? opts.rejectFile : (process.env.CLAUDE_ORG_REJECT_FILE || '');
   const STATE_FILE = 'stateFile' in opts ? opts.stateFile : (process.env.CLAUDE_ORG_STATE_FILE || '');
   const STRATEGY = 'strategy' in opts ? opts.strategy : (process.env.CLAUDE_ORG_STRATEGY || '');
+  const SECRET = 'secret' in opts ? opts.secret : (process.env.CLAUDE_ORG_PROXY_SECRET || '');
+  const ALLOW_ANY_UPSTREAM = 'allowAnyUpstream' in opts ? opts.allowAnyUpstream : process.env.CLAUDE_ORG_UNSAFE_UPSTREAM === '1';
+  const MAX_BODY = opts.maxBodyBytes || REQUEST_BODY_MAX_BYTES;
+  const UPSTREAM_TIMEOUT = opts.upstreamTimeoutMs || UPSTREAM_TIMEOUT_MS;
   const out = opts.log || process.stderr;
   const transport = UPSTREAM.protocol === 'http:' ? http : https;
 
+  // Org tokens go to the upstream as Bearer, so the upstream is pinned to the
+  // real API unless a test says otherwise.
+  if (UPSTREAM.href !== `${DEFAULT_UPSTREAM}/` && !ALLOW_ANY_UPSTREAM) {
+    throw new Error(`CLAUDE_ORG_UPSTREAM=${UPSTREAM.href} is not ${DEFAULT_UPSTREAM}; org tokens are only sent there (set CLAUDE_ORG_UNSAFE_UPSTREAM=1 for a test upstream)`);
+  }
+  if (!SECRET) {
+    throw new Error('proxy secret missing: set CLAUDE_ORG_PROXY_SECRET (claude-org proxy generates one per session)');
+  }
+
   function log(...a) {
     out.write(`[claude-org-proxy ${new Date().toISOString().slice(11, 19)}] ${a.join(' ')}\n`);
   }
   const leastUtilized = STRATEGY === 'least-utilized';
   if (STRATEGY && !leastUtilized) log(`unknown CLAUDE_ORG_STRATEGY "${STRATEGY}" -> using the static order`);
 
+  const reportedBadNames = new Set();
   function listOrgs() {
-    const files = fs.readdirSync(TOKEN_DIR).filter(f => f.endsWith('.token')).map(f => f.slice(0, -6)).sort();
+    const names = fs.readdirSync(TOKEN_DIR).filter(f => f.endsWith('.token')).map(f => f.slice(0, -6));
+    for (const n of names) {
+      if (validOrgName(n) || reportedBadNames.has(n)) continue;
+      reportedBadNames.add(n);
+      log(`ignoring ${TOKEN_DIR}/${logModel(n)}.token: not an org name (letters, digits, _ and - only)`);
+    }
+    const files = names.filter(validOrgName).sort();
     if (ORDER.length === 0) return files;
     const known = new Set(files);
     return ORDER.filter(o => known.has(o)).concat(files.filter(f => !ORDER.includes(f)));
   }
+  // Throws when the file is missing or not private to the user (S5): the
+  // caller skips that org for this request.
   function readToken(name) {
-    return fs.readFileSync(path.join(TOKEN_DIR, `${name}.token`), 'utf8').replace(/[\r\n]/g, '');
+    const f = path.join(TOKEN_DIR, `${name}.token`);
+    const problem = tokenFileProblem(f);
+    if (problem) throw new Error(`token file ${f} ${problem}`);
+    const tok = fs.readFileSync(f, 'utf8').replace(/[\r\n]/g, '');
+    if (!tok) throw new Error(`token file ${f} is empty`);
+    return tok;
   }
 
   // Per-org "rate-limited" memory: name -> recovery epoch (ms). Expired entries
@@ -230,123 +331,264 @@ function createProxy(opts = {}) {
     }
   }
 
-  function forward(org, method, urlPath, headers, body) {
+  // One upstream request. Resolves with the response once its headers are in;
+  // rejects on connection errors, on idle timeout, and when `signal` aborts
+  // (the client went away). The response stream can still fail later; the
+  // caller listens for that.
+  function forward(token, method, urlPath, headers, body, signal) {
     return new Promise((resolve, reject) => {
-      const h = { ...headers };
+      const h = stripHopByHop(headers);
       for (const k of Object.keys(h)) {
         const lk = k.toLowerCase();
-        if (lk === 'x-api-key' || lk === 'host' || lk === 'content-length' || lk === 'authorization') delete h[k];
+        if (lk === 'x-api-key' || lk === 'host' || lk === 'content-length' || lk === 'authorization'
+          || lk === SECRET_HEADER) delete h[k];
       }
-      h.authorization = `Bearer ${readToken(org)}`;
+      h.authorization = `Bearer ${token}`;
       h.host = UPSTREAM.host;
       if (body.length) h['content-length'] = String(body.length);
       const req = transport.request(
-        { hostname: UPSTREAM.hostname, port: UPSTREAM.port || (transport === https ? 443 : 80), path: urlPath, method, headers: h },
+        {
+          hostname: UPSTREAM.hostname,
+          port: UPSTREAM.port || (transport === https ? 443 : 80),
+          path: urlPath,
+          method,
+          headers: h,
+          signal,
+          timeout: UPSTREAM_TIMEOUT,
+        },
         res => resolve(res),
       );
+      req.on('timeout', () => req.destroy(new Error(`no data from upstream for ${UPSTREAM_TIMEOUT} ms`)));
       req.on('error', reject);
       if (body.length) req.write(body);
       req.end();
     });
   }
 
-  const server = http.createServer((clientReq, clientRes) => {
-    const chunks = [];
-    clientReq.on('data', c => chunks.push(c));
-    clientReq.on('end', async () => {
-      const body = Buffer.concat(chunks);
-      const isModelReq = clientReq.url.startsWith('/v1/messages');
-      const model = isModelReq ? requestModel(body) : '';
-      const order = pickOrder(model);
-      let attempt = 0;
-      let modelRefusals = 0;
-      for (const org of order) {
-        attempt++;
-        let up;
+  function refuse(clientRes, status, message) {
+    clientRes.writeHead(status, { 'content-type': 'application/json', connection: 'close' });
+    clientRes.end(JSON.stringify({ type: 'error', error: { type: 'claude_org_proxy', message } }));
+  }
+
+  // Checks done before any body is read or anything is forwarded. Returns
+  // [status, message] for a request to refuse, or null.
+  function gate(clientReq) {
+    // When the header is present it alone decides: the Authorization header is
+    // then claude's claude.ai login token, not the secret.
+    const viaHeader = clientReq.headers[SECRET_HEADER];
+    const auth = clientReq.headers.authorization || '';
+    const authorized = viaHeader !== undefined
+      ? secretMatches(viaHeader, SECRET)
+      : auth.startsWith('Bearer ') && secretMatches(auth.slice(7), SECRET);
+    if (!authorized) {
+      return [401, `missing or wrong proxy secret (the ${SECRET_HEADER} header or Bearer token claude-org proxy gave this session)`];
+    }
+    const addr = server.address(); // null once the server is closing
+    if (!addr) return [503, 'proxy is shutting down'];
+    const expectedHost = `127.0.0.1:${addr.port}`;
+    if (clientReq.headers.host !== expectedHost) return [403, `Host must be ${expectedHost}`];
+    if (!ALLOWED_METHODS.has(clientReq.method)) return [405, `method ${clientReq.method} is not forwarded`];
+    // The path is forwarded as is, so nothing that an upstream could
+    // normalise out of /v1/ ("..", "//", "\\", %2e) is accepted.
+    const pathOnly = clientReq.url.split('?')[0];
+    if (!pathOnly.startsWith('/v1/') || /\.\.|\/\/|\\|%2e/i.test(pathOnly)) return [404, 'only /v1/* is forwarded'];
+    const announced = Number(clientReq.headers['content-length']);
+    if (announced > MAX_BODY) return [413, `request body larger than ${MAX_BODY} bytes`];
+    return null;
+  }
+
+  async function handle(clientReq, clientRes, body) {
+    // The client going away (Claude Code cancelled, or exited) cancels the
+    // upstream request in flight and stops a response being piped, so no org
+    // keeps generating for nobody.
+    const abort = new AbortController();
+    let clientGone = false;
+    let up = null;
+    clientRes.on('close', () => {
+      if (clientRes.writableFinished) return;
+      clientGone = true;
+      abort.abort();
+      if (up) up.destroy();
+    });
+    const quotaCheck = clientReq.url.startsWith('/v1/messages?') || clientReq.url === '/v1/messages'
+      ? isQuotaCheck(body) : false;
+    // A quota check is forwarded like a non-model request: first usable org,
+    // response passed through, no limit bookkeeping.
+    const isModelReq = clientReq.url.startsWith('/v1/messages') && !quotaCheck;
+    const model = isModelReq ? requestModel(body) : '';
+    let order;
+    try {
+      order = pickOrder(model);
+    } catch (e) {
+      log(`cannot list orgs in ${TOKEN_DIR}: ${e.message}`);
+      order = [];
+    }
+    let attempt = 0;
+    let modelRefusals = 0;
+    for (const org of order) {
+      attempt++;
+      if (clientGone) return;
+      let token;
+      try {
+        token = readToken(org);
+      } catch (e) {
+        log(`skipping ${org}: ${e.message}`);
+        continue;
+      }
+      try {
+        up = await forward(token, clientReq.method, clientReq.url, clientReq.headers, body, abort.signal);
+      } catch (e) {
+        if (clientGone) return;
+        log(`upstream error via ${org}: ${e.message}`);
+        continue;
+      }
+      // A response that fails after its headers (idle timeout, reset) is only
+      // logged here; whether the client is cut off is decided where it is piped.
+      up.on('error', e => log(`upstream error via ${org} while reading the response: ${e.message}`));
+      const hdr = name => up.headers[`anthropic-ratelimit-unified-${name}`];
+      const status5h = hdr('5h-status');
+      const status7d = hdr('7d-status');
+      const claim = hdr('representative-claim');
+      const util5h = Number(hdr('5h-utilization'));
+      if (isModelReq && hdr('5h-utilization') !== undefined && Number.isFinite(util5h)) {
+        recordUtil(org, util5h, Number(hdr('5h-reset')));
+      } else if (isModelReq) {
+        answeredUnmeasured.add(org);
+      }
+      const isLast = attempt >= order.length;
+      // A 401 means the org's token is expired or revoked (they last about a
+      // year), not that the request is bad: the org is kept out for a while
+      // and the next one tried. The ALERT line is the fixed format a
+      // supervisor can watch for (README, "Unattended use").
+      if (isModelReq && up.statusCode === 401) {
+        log(`ALERT token-rejected org=${org} status=401 -> run: claude setup-token (org ${org}) and overwrite ${path.join(TOKEN_DIR, `${org}.token`)}`);
+        rejectedUntil.set(org, Date.now() + ORG_REJECT_FALLBACK_MS);
+        if (!isLast) {
+          up.resume();
+          continue;
+        }
+      }
+      // The 5h and 7d windows cover every model of the org, so only those make
+      // the org as a whole unusable. Other refusals are per model: a used-up
+      // per-model weekly allowance (claim=seven_day_overage_included) or a model
+      // that needs usage credits (429 with no window headers). The overall
+      // "unified-status" header is not used: it also reads "rejected" for those.
+      const orgWide = status5h === 'rejected' || status7d === 'rejected';
+      const limited = up.statusCode === 429 || orgWide;
+      const windows = `5h=${status5h ?? '?'}${claim ? `, claim=${claim}` : ''}`;
+      // A 429 body is a small JSON error; buffer it to log the reason and,
+      // if no org is left, to hand it to the client unchanged.
+      let errBody = null;
+      let reason = '';
+      if (isModelReq && up.statusCode === 429) {
         try {
-          up = await forward(org, clientReq.method, clientReq.url, clientReq.headers, body);
+          errBody = await readBody(up, ERROR_BODY_MAX_BYTES);
         } catch (e) {
-          log(`upstream error via ${org}: ${e.message}`);
+          log(`upstream error via ${org} while reading 429 body: ${e.message}`);
           continue;
         }
-        const hdr = name => up.headers[`anthropic-ratelimit-unified-${name}`];
-        const status5h = hdr('5h-status');
-        const status7d = hdr('7d-status');
-        const claim = hdr('representative-claim');
-        const util5h = Number(hdr('5h-utilization'));
-        if (isModelReq && hdr('5h-utilization') !== undefined && Number.isFinite(util5h)) {
-          recordUtil(org, util5h, Number(hdr('5h-reset')));
-        } else if (isModelReq) {
-          answeredUnmeasured.add(org);
-        }
-        // The 5h and 7d windows cover every model of the org, so only those make
-        // the org as a whole unusable. Other refusals are per model: a used-up
-        // per-model weekly allowance (claim=seven_day_overage_included) or a model
-        // that needs usage credits (429 with no window headers). The overall
-        // "unified-status" header is not used: it also reads "rejected" for those.
-        const orgWide = status5h === 'rejected' || status7d === 'rejected';
-        const limited = up.statusCode === 429 || orgWide;
-        const windows = `5h=${status5h ?? '?'}${claim ? `, claim=${claim}` : ''}`;
-        // A 429 body is a small JSON error; buffer it to log the reason and,
-        // if no org is left, to hand it to the client unchanged.
-        let errBody = null;
-        let reason = '';
-        if (isModelReq && up.statusCode === 429) {
-          try {
-            errBody = await readBody(up, ERROR_BODY_MAX_BYTES);
-          } catch (e) {
-            log(`upstream error via ${org} while reading 429 body: ${e.message}`);
-            continue;
-          }
-          reason = describeError(errBody, up.headers['content-encoding']);
-        }
-        const modelRefused = isModelReq && up.statusCode === 429 && !orgWide;
-        if (modelRefused) {
-          // retry-after is honoured when shorter (a transient per-minute limit
-          // must not keep the preferred org out for long); a long one (a weekly
-          // per-model allowance) is capped so the org is re-checked now and then.
-          const ra = retryAfterMs(up.headers['retry-after']);
-          const ms = Number.isFinite(ra) ? Math.min(ra, MODEL_REJECT_MAX_MS) : MODEL_REJECT_MAX_MS;
-          modelRejectedUntil.set(`${org}|${model}`, Date.now() + ms);
-        }
-        const isLast = attempt >= order.length;
-        if (limited && isModelReq && !isLast) {
-          if (orgWide) {
-            // When both windows are rejected the org is back only after the later reset.
-            const resets = [['5h', status5h], ['7d', status7d]]
-              .filter(([, s]) => s === 'rejected')
-              .map(([w]) => Number(hdr(`${w}-reset`)))
-              .filter(Number.isFinite);
-            rejectedUntil.set(org, resets.length ? Math.max(...resets) * 1000 : Date.now() + ORG_REJECT_FALLBACK_MS);
-            log(`${org} is rate-limited (HTTP ${up.statusCode}, ${windows}) -> retrying with next org${reason ? ` (${reason})` : ''}`);
-          } else {
-            modelRefusals++;
-            log(`${org} rejected model ${logModel(model)} (HTTP ${up.statusCode}, ${windows}, ${reason}) -> retrying with next org; ${org} stays in use for other models`);
-          }
-          if (!errBody) up.resume(); // discard the response body and try the next org
-          continue;
+        reason = describeError(errBody, up.headers['content-encoding']);
+      }
+      const modelRefused = isModelReq && up.statusCode === 429 && !orgWide;
+      if (modelRefused) {
+        // retry-after is honoured when shorter (a transient per-minute limit
+        // must not keep the preferred org out for long); a long one (a weekly
+        // per-model allowance) is capped so the org is re-checked now and then.
+        const ra = retryAfterMs(up.headers['retry-after']);
+        const ms = Number.isFinite(ra) ? Math.min(ra, MODEL_REJECT_MAX_MS) : MODEL_REJECT_MAX_MS;
+        modelRejectedUntil.set(`${org}|${model}`, Date.now() + ms);
+      }
+      if (limited && isModelReq && !isLast) {
+        if (orgWide) {
+          // When both windows are rejected the org is back only after the later reset.
+          const resets = [['5h', status5h], ['7d', status7d]]
+            .filter(([, s]) => s === 'rejected')
+            .map(([w]) => Number(hdr(`${w}-reset`)))
+            .filter(Number.isFinite);
+          rejectedUntil.set(org, resets.length ? Math.max(...resets) * 1000 : Date.now() + ORG_REJECT_FALLBACK_MS);
+          log(`${org} is rate-limited (HTTP ${up.statusCode}, ${windows}) -> retrying with next org${reason ? ` (${reason})` : ''}`);
+        } else {
+          modelRefusals++;
+          log(`${org} rejected model ${logModel(model)} (HTTP ${up.statusCode}, ${windows}, ${reason}) -> retrying with next org; ${org} stays in use for other models`);
         }
-        if (isModelReq) {
-          const util = hdr('5h-utilization');
-          log(`${clientReq.method} ${clientReq.url} via ${org} model=${logModel(model)} -> ${up.statusCode} (5h ${status5h ?? '?'} ${util ?? '?'})${reason ? ` ${reason}` : ''}`);
-          writeState(org, model, up.statusCode);
-          if (modelRefused && modelRefusals === attempt - 1) {
-            log(`all orgs rejected model ${logModel(model)} -> switch the model (e.g. /model) or wait for that model's limit to reset; the org tokens are not the cause`);
-          }
+        if (!errBody) up.resume(); // discard the response body and try the next org
+        continue;
+      }
+      if (isModelReq) {
+        const util = hdr('5h-utilization');
+        log(`${clientReq.method} ${clientReq.url} via ${org} model=${logModel(model)} -> ${up.statusCode} (5h ${status5h ?? '?'} ${util ?? '?'})${reason ? ` ${reason}` : ''}`);
+        writeState(org, model, up.statusCode);
+        if (modelRefused && modelRefusals === attempt - 1) {
+          log(`all orgs rejected model ${logModel(model)} -> switch the model (e.g. /model) or wait for that model's limit to reset; the org tokens are not the cause`);
         }
-        clientRes.writeHead(up.statusCode, { ...up.headers, 'x-claude-org': org });
-        if (errBody) {
-          clientRes.end(errBody);
-        } else {
-          up.pipe(clientRes); // SSE streaming is piped through untouched
+        if (limited) {
+          log(`ALERT no-org-available model=${logModel(model)} reason=${modelRefused ? 'model-rejected' : 'rate-limited'} status=${up.statusCode}`);
         }
+      }
+      if (quotaCheck) log(`quota check via ${org} -> ${up.statusCode} (passed through, not counted as a limit)`);
+      if (clientGone) { up.destroy(); return; }
+      clientRes.writeHead(up.statusCode, { ...stripHopByHop(up.headers), 'x-claude-org': org });
+      if (errBody) {
+        clientRes.end(errBody);
+      } else {
+        up.once('error', () => clientRes.destroy()); // the client sees a reset, not a truncated OK
+        up.pipe(clientRes); // SSE streaming is piped through untouched
+      }
+      return;
+    }
+    if (clientGone) return;
+    if (isModelReq) {
+      writeState(null, model, 503); // no org served it
+      log(`ALERT no-org-available model=${logModel(model)} reason=${order.length ? 'unreachable' : 'no-tokens'} status=503`);
+    }
+    refuse(clientRes, 503, 'all orgs rate-limited or unreachable');
+  }
+
+  // Nothing in here may take the process down: with no proxy, every claude
+  // behind it is stranded.
+  const server = http.createServer((clientReq, clientRes) => {
+    try {
+      accept(clientReq, clientRes);
+    } catch (e) {
+      log(`internal error on ${clientReq.method} ${logPath(clientReq.url)}: ${e.stack || e.message}`);
+      if (!clientRes.headersSent) refuse(clientRes, 500, 'proxy internal error (see the proxy log)');
+      else clientRes.destroy();
+    }
+  });
+
+  function accept(clientReq, clientRes) {
+    clientReq.on('error', e => log(`client request error: ${e.message}`));
+    clientRes.on('error', e => log(`client response error: ${e.message}`));
+    const denied = gate(clientReq);
+    if (denied) {
+      log(`refused ${clientReq.method} ${logPath(clientReq.url)}: ${denied[1]} (HTTP ${denied[0]})`);
+      refuse(clientRes, denied[0], denied[1]);
+      return; // the rest of the request body is discarded by node
+    }
+    const chunks = [];
+    let size = 0;
+    let tooLarge = false;
+    clientReq.on('data', c => {
+      if (tooLarge) return;
+      size += c.length;
+      if (size > MAX_BODY) {
+        tooLarge = true;
+        chunks.length = 0;
+        log(`refused ${clientReq.method} ${logPath(clientReq.url)}: request body larger than ${MAX_BODY} bytes (HTTP 413)`);
+        refuse(clientRes, 413, `request body larger than ${MAX_BODY} bytes`);
         return;
       }
-      if (isModelReq) writeState(null, model, 503); // no org served it
-      clientRes.writeHead(503, { 'content-type': 'application/json' });
-      clientRes.end(JSON.stringify({ type: 'error', error: { type: 'claude_org_proxy', message: 'all orgs rate-limited or unreachable' } }));
+      chunks.push(c);
     });
-  });
+    clientReq.on('end', () => {
+      if (tooLarge) return;
+      handle(clientReq, clientRes, Buffer.concat(chunks)).catch(e => {
+        log(`internal error on ${clientReq.method} ${logPath(clientReq.url)}: ${e.stack || e.message}`);
+        if (!clientRes.headersSent) refuse(clientRes, 500, 'proxy internal error (see the proxy log)');
+        else clientRes.destroy();
+      });
+    });
+  }
 
   return { server, listOrgs, log, upstream: UPSTREAM, strategy: leastUtilized ? 'least-utilized' : 'order' };
 }
@@ -354,23 +596,206 @@ function createProxy(opts = {}) {
 // `claude-org proxy [claude args...]`: start an in-process proxy on a random
 // port, point ANTHROPIC_BASE_URL at it, launch claude, and shut the proxy down
 // when claude exits. One proxy per session, so parallel sessions never collide.
+// A log that cannot be written (disk full, dir removed) must not take the
+// proxy down with an unhandled 'error'. Once it fails, ALERT lines would vanish
+// for an unattended session that only watches the log, so they are mirrored to
+// stderr from then on.
+// Each launch leaves a claude-org-proxy-XXXXXX dir in tmpdir (the log is kept
+// for later investigation, so it is not removed on exit). Keep only the newest
+// `keep` finished ones so repeated and headless launches do not pile up.
+//  - Names are matched exactly, and only real directories owned by this user
+//    are removed (tmpdir is shared: someone else could plant a lookalike).
+//    process.getuid does not exist on Windows, where tmpdir is per-user.
+//  - A dir whose launcher is still alive (pid file) is never removed, however
+//    many there are: it holds the open log and the state file.
+//  - "Newest" is the launch time: the pid file is written once at launch and
+//    never touched again, whereas the dir mtime moves whenever state.json is
+//    renamed into it. Dirs from before the pid file existed fall back to mtime.
+const RUN_DIR_PREFIX = 'claude-org-proxy-';
+const RUN_DIR_KEEP = 20;
+const RUN_DIR_RE = new RegExp(`^${RUN_DIR_PREFIX}[A-Za-z0-9]{6}$`);
+
+function launcherAlive(dir) {
+  let pid;
+  try { pid = Number(fs.readFileSync(path.join(dir, 'pid'), 'utf8').trim()); } catch { return false; }
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try { process.kill(pid, 0); return true; } catch (e) { return e.code === 'EPERM'; }
+}
+
+function pruneRunDirs(root, keep = RUN_DIR_KEEP) {
+  let names;
+  try { names = fs.readdirSync(root); } catch { return 0; }
+  const uid = typeof process.getuid === 'function' ? process.getuid() : null;
+  const dirs = [];
+  for (const name of names) {
+    if (!RUN_DIR_RE.test(name)) continue;
+    const full = path.join(root, name);
+    try {
+      const st = fs.lstatSync(full);
+      if (!st.isDirectory() || (uid !== null && st.uid !== uid)) continue;
+      if (launcherAlive(full)) continue;
+      let launched = st.mtimeMs;
+      try { launched = fs.statSync(path.join(full, 'pid')).mtimeMs; } catch { /* pre-pid-file dir */ }
+      dirs.push({ full, launched });
+    } catch { /* removed by a concurrent launch */ }
+  }
+  dirs.sort((a, b) => b.launched - a.launched);
+  let removed = 0;
+  for (const d of dirs.slice(keep)) {
+    try {
+      fs.rmSync(d.full, { recursive: true, force: true });
+      removed++;
+    } catch (e) {
+      console.error(`claude-org: cannot remove old proxy log dir ${d.full}: ${e.message}`);
+    }
+  }
+  return removed;
+}
+
+function guardLogStream(logStream, logf) {
+  let logFailed = false;
+  logStream.on('error', e => {
+    if (!logFailed) console.error(`claude-org: cannot write the proxy log ${logf}: ${e.message}`);
+    logFailed = true;
+  });
+  return {
+    write(line) {
+      if (!line.includes('ALERT ')) return logStream.write(line);
+      // After a confirmed failure, mirror directly (the stream is destroyed and
+      // would only call back with an error again).
+      if (logFailed) { process.stderr.write(line); return false; }
+      // The write that first hits the failure only reports it asynchronously;
+      // recover that line from the callback so a one-off ALERT is not lost.
+      return logStream.write(line, err => { if (err) process.stderr.write(line); });
+    },
+  };
+}
+
+// claude.ai connector MCPs (Slack, Notion, ...) load only while claude uses
+// its claude.ai login: Claude Code 2.1.310 skips them when ANTHROPIC_AUTH_TOKEN
+// or an API key takes precedence ("[claudeai-mcp] Disabled: API-key auth
+// precedence active"). ANTHROPIC_BASE_URL alone does not disable them. So when
+// claude, started with the env it will get, reports a claude.ai login, the
+// secret goes in a custom header and the login stays active; otherwise (no
+// login, an API key or token in the env, the check failed) the secret is the
+// Bearer token, as before. The check costs about one second at launch.
+const AUTH_STATUS_TIMEOUT_MS = 15 * 1000;
+const AUTH_STATUS_MAX_BYTES = 64 * 1024;
+const AUTH_STATUS_KILL_WAIT_MS = 5 * 1000;
+
+function claudeAiLogin(env) {
+  const { spawnClaude } = require('./claude-spawn');
+  return new Promise(resolve => {
+    let out = '';
+    let settled = false;
+    let timer = null;
+    const done = (ok, why) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve({ ok, why });
+    };
+    let child;
+    try {
+      child = spawnClaude(['auth', 'status'], { env, stdio: ['ignore', 'pipe', 'ignore'] });
+    } catch (e) {
+      done(false, `claude auth status could not start: ${e.message}`);
+      return;
+    }
+    let timedOut = null;
+    timer = setTimeout(() => {
+      const why = `claude auth status did not answer within ${AUTH_STATUS_TIMEOUT_MS / 1000} s`;
+      timedOut = why;
+      if (process.platform !== 'win32') {
+        try { child.kill(); } catch { /* already exited */ }
+        done(false, why);
+        return;
+      }
+      // On Windows claude runs under cmd.exe (shell: true); killing only the
+      // shell would leave claude running, so the whole tree is ended. The
+      // launch waits for taskkill (bounded): measured on Windows 11, a
+      // taskkill not waited for left the hung claude running.
+      let killer;
+      try {
+        killer = require('child_process').spawn('taskkill', ['/pid', String(child.pid), '/T', '/F'], { stdio: 'ignore' });
+      } catch {
+        done(false, why);
+        return;
+      }
+      const giveUp = setTimeout(() => done(false, why), AUTH_STATUS_KILL_WAIT_MS);
+      const finish = () => { clearTimeout(giveUp); done(false, why); };
+      killer.on('exit', finish);
+      killer.on('error', finish);
+    }, AUTH_STATUS_TIMEOUT_MS);
+    child.stdout.setEncoding('utf8');
+    child.stdout.on('data', c => { if (out.length < AUTH_STATUS_MAX_BYTES) out += c; });
+    child.on('error', e => done(false, `claude auth status could not start: ${e.message}`));
+    child.on('close', () => {
+      if (timedOut) return done(false, timedOut); // closed because it was killed
+      let st;
+      try { st = JSON.parse(out); } catch { return done(false, 'claude auth status gave no JSON'); }
+      if (st && st.loggedIn === true && st.authMethod === 'claude.ai') return done(true, 'claude.ai login');
+      done(false, `claude auth status: loggedIn=${st && st.loggedIn} authMethod=${String(st && st.authMethod).slice(0, 40)}`);
+    });
+  });
+}
+
+// ANTHROPIC_CUSTOM_HEADERS ("Name: value" lines) with the secret header added.
+// The user's other headers are kept; a secret header inherited from an outer
+// claude-org proxy session is replaced.
+function withSecretHeader(existing, secret) {
+  const lines = String(existing || '').split(/\r?\n/)
+    .filter(l => l.trim() && l.split(':')[0].trim().toLowerCase() !== SECRET_HEADER);
+  return lines.concat(`${SECRET_HEADER}: ${secret}`).join('\n');
+}
+
 async function proxyLaunch(args) {
   const { listOrgs, tokenDir, resolvePrefer } = require('./config');
-  const { runClaude } = require('./launch');
+  const { runClaude, childEnv } = require('./launch');
 
-  const orgs = listOrgs();
+  // An org whose token file the proxy would refuse (S5) is reported here, at
+  // launch, not only in the proxy log after every request has failed.
+  const orgs = listOrgs().filter(name => {
+    const f = path.join(tokenDir(), `${name}.token`);
+    const problem = tokenFileProblem(f);
+    if (problem) console.error(`claude-org: skipping org ${name}: token file ${f} ${problem}`);
+    return !problem;
+  });
   if (orgs.length < 2) {
     console.error(`claude-org: proxy には org トークンが 2 つ以上必要です（${tokenDir()} に ${orgs.join(' ')}）`);
     console.error(`  取得: claude setup-token でもう片方の org を選び、${tokenDir()}/<name>.token に保存`);
     return 1;
   }
 
+  // An ANTHROPIC_AUTH_TOKEN / ANTHROPIC_BASE_URL in this env (e.g. from an
+  // outer claude-org proxy session) is replaced below either way, so the check
+  // runs without them.
+  const unsetForCheck = { ANTHROPIC_AUTH_TOKEN: undefined, ANTHROPIC_BASE_URL: undefined };
+  const login = process.env.CLAUDE_ORG_NO_CONNECTORS === '1'
+    ? { ok: false, why: 'CLAUDE_ORG_NO_CONNECTORS=1' }
+    : await claudeAiLogin(childEnv(unsetForCheck));
+
   const order = process.env.CLAUDE_ORG_ORDER || resolvePrefer();
-  const runDir = fs.mkdtempSync(path.join(os.tmpdir(), 'claude-org-proxy-'));
+  pruneRunDirs(os.tmpdir());
+  const runDir = fs.mkdtempSync(path.join(os.tmpdir(), RUN_DIR_PREFIX));
+  fs.writeFileSync(path.join(runDir, 'pid'), String(process.pid));
   const logf = path.join(runDir, 'proxy.log');
   const stateFile = path.join(runDir, 'state.json');
   const logStream = fs.createWriteStream(logf);
-  const { server, log, upstream, strategy } = createProxy({ order: order.split(','), log: logStream, stateFile });
+  const logOut = guardLogStream(logStream, logf);
+  // Only this claude may use this proxy (and so the org tokens): it must send
+  // this per-session secret, in the x-claude-org-secret header or as its
+  // Bearer token. It goes into the child's env and nowhere else.
+  const secret = crypto.randomBytes(32).toString('hex');
+  let proxy;
+  try {
+    proxy = createProxy({ order: order.split(','), log: logOut, stateFile, secret });
+  } catch (e) {
+    console.error(`claude-org: ${e.message}`);
+    logStream.end();
+    return 1;
+  }
+  const { server, log, upstream, strategy } = proxy;
 
   try {
     await new Promise((resolve, reject) => {
@@ -385,17 +810,30 @@ async function proxyLaunch(args) {
     return 1;
   }
   const port = server.address().port;
+  const connectors = login.ok ? 'on (claude.ai login kept)' : `off (${login.why})`;
+  log(`claude.ai connectors: ${connectors}`);
+  console.error(`-> claude.ai connectors: ${connectors}`);
   console.error(`-> proxy 127.0.0.1:${port} (order: ${order}, strategy: ${strategy}, log: ${logf})`);
 
-  // A custom ANTHROPIC_BASE_URL + AUTH_TOKEN makes Claude Code treat the session
-  // as API-key auth: prompt cache TTL drops to 5min and MCP tool search is
-  // disabled. Restore subscription-equivalent defaults; user-set values win.
+  // With ANTHROPIC_AUTH_TOKEN, Claude Code treats the session as API-key auth:
+  // prompt cache TTL drops to 5min and MCP tool search is disabled. Restore
+  // subscription-equivalent defaults in both modes; user-set values win.
   const envExtra = {
     ANTHROPIC_BASE_URL: `http://127.0.0.1:${port}`,
-    ANTHROPIC_AUTH_TOKEN: 'claude-org-proxy', // dummy; the proxy replaces it
-    CLAUDE_ORG_PROXY: '1',                    // marker: "connector MCPs unavailable" session
+    CLAUDE_ORG_PROXY: '1',                    // marker: session goes through claude-org proxy
+    CLAUDE_ORG_CONNECTORS: login.ok ? '1' : '0', // marker: claude.ai connector MCPs can load
     CLAUDE_ORG_STATE_FILE: stateFile,         // last org/model, for statusline and hooks
   };
+  if (login.ok) {
+    // claude keeps its claude.ai login (and sends that token as Bearer, which
+    // the proxy discards); the secret travels in the custom header. Claude
+    // Code may also send custom headers to other Anthropic endpoints; the
+    // secret is only accepted by this loopback proxy and dies with it.
+    envExtra.ANTHROPIC_AUTH_TOKEN = undefined;
+    envExtra.ANTHROPIC_CUSTOM_HEADERS = withSecretHeader(process.env.ANTHROPIC_CUSTOM_HEADERS, secret);
+  } else {
+    envExtra.ANTHROPIC_AUTH_TOKEN = secret;   // sent as Bearer; the proxy checks it, then swaps in an org token
+  }
   if (!process.env.CLAUDE_CODE_PROMPT_CACHE_TTL) envExtra.CLAUDE_CODE_PROMPT_CACHE_TTL = '1h';
   if (!process.env.ENABLE_TOOL_SEARCH) envExtra.ENABLE_TOOL_SEARCH = 'true';
 
@@ -409,10 +847,23 @@ async function proxyLaunch(args) {
 // `node claude-org-proxy.js`).
 if (require.main === module) {
   const PORT = Number(process.env.PORT || 0);
-  const { server, listOrgs, log, upstream, strategy } = createProxy();
+  let proxy;
+  try {
+    proxy = createProxy();
+  } catch (e) {
+    console.error(`claude-org-proxy: ${e.message}`);
+    process.exit(1);
+  }
+  const { server, listOrgs, log, upstream, strategy } = proxy;
+  server.once('error', e => {
+    console.error(`claude-org-proxy: cannot listen on 127.0.0.1:${PORT}: ${e.message}`);
+    process.exit(1);
+  });
   server.listen(PORT, '127.0.0.1', () => {
-    log(`listening on http://127.0.0.1:${server.address().port} orgs=${listOrgs().join(',')} upstream=${upstream.host} strategy=${strategy}`);
+    let orgs;
+    try { orgs = listOrgs().join(','); } catch (e) { orgs = `<cannot list: ${e.message}>`; }
+    log(`listening on http://127.0.0.1:${server.address().port} orgs=${orgs} upstream=${upstream.host} strategy=${strategy}`);
   });
 }
 
-module.exports = { createProxy, proxyLaunch };
+module.exports = { createProxy, proxyLaunch, guardLogStream, pruneRunDirs, withSecretHeader };

package/lib/usage.js

@@ -20,7 +20,7 @@ token org alphabetically):
   claude-org proxy [claude args...]   launch via a local proxy; a running session
                                     fails over to another org the moment the 5h
                                     limit hits (needs 2+ org tokens; claude.ai
-                                    connector MCPs are unavailable)
+                                    connector MCPs need a claude.ai login)
   claude-org auto [claude args...]    launch on <prefer> if usable, else default
                                     (decided once at launch)
   claude-org <name> [claude args...]  e.g. claude-org work --resume

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-org",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Switch Claude Code between multiple Anthropic organizations, with automatic failover on the 5-hour rate limit",
   "license": "MIT",
   "type": "commonjs",