claude-org 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+## 0.5.0 — 2026-10-27
+
+- `proxy`: claude.ai connector MCPs (Slack / Notion / Gmail …) now work in proxy sessions when you are signed in to claude.ai. The launch checks `claude auth status`; with a claude.ai login, `claude` keeps it and sends the per-session secret in an `x-claude-org-secret` header (`ANTHROPIC_CUSTOM_HEADERS`, your own lines kept) instead of `ANTHROPIC_AUTH_TOKEN`. The proxy discards the login token and the header and still sends only org tokens upstream. Without a login (or with `CLAUDE_ORG_NO_CONNECTORS=1`) the session starts as before. The launch line `-> claude.ai connectors: on/off (...)` and the `CLAUDE_ORG_CONNECTORS=1/0` env say which mode is in use (#35)
+
+- `proxy`: each launch keeps its log dir (`claude-org-proxy-*` in the temp dir) for later investigation, but now removes all but the newest 20 at startup, so repeated and headless launches no longer pile up (#15)
+
 ## 0.4.0 — 2026-10-11
 
 - `proxy`: hardened for unattended use under a supervisor (#22)

package/README.md

@@ -82,9 +82,13 @@ claude-org proxy --resume
 ```
 
 1. A session-scoped proxy starts on `127.0.0.1:<random port>` (one per session; no port collisions).
-2. `claude` launches with `ANTHROPIC_BASE_URL` pointing at the proxy and a **per-session secret** as its bearer token (`ANTHROPIC_AUTH_TOKEN`, generated with `crypto.randomBytes`; it exists only in that `claude`'s environment).
+2. `claude` launches with `ANTHROPIC_BASE_URL` pointing at the proxy and a **per-session secret** (generated with `crypto.randomBytes`; it exists only in that `claude`'s environment). How the secret is passed depends on your login (see [claude.ai connectors](#claudeai-connectors-slack--notion-) below):
+   - you are signed in to claude.ai (`claude auth status` shows `"authMethod": "claude.ai"`): in an `x-claude-org-secret` header via `ANTHROPIC_CUSTOM_HEADERS`, and `claude` keeps its claude.ai login, so connector MCPs load. Your other `ANTHROPIC_CUSTOM_HEADERS` lines are kept;
+   - otherwise (no login, an API key or token in your env, or `CLAUDE_ORG_NO_CONNECTORS=1`): as its bearer token (`ANTHROPIC_AUTH_TOKEN`), as in earlier versions.
+
+   The launch prints which one was used: `-> claude.ai connectors: on (...)` / `off (<reason>)`.
 3. The proxy serves only requests that carry that secret, name it in `Host` (`127.0.0.1:<port>`, so a web page cannot reach it by DNS rebinding) and are `GET` / `POST` / `DELETE` under `/v1/`; anything else is refused with 401 / 403 / 404 / 405 and never forwarded. Request bodies over 64 MB get 413.
-4. The proxy replaces the `Authorization` header with a real org token, drops hop-by-hop headers, and forwards to `api.anthropic.com` (any other upstream is refused unless `CLAUDE_ORG_UNSAFE_UPSTREAM=1`). On a 429 or `anthropic-ratelimit-unified-5h-status: rejected` it marks that org limited until `5h-reset` and **resends the same request** with the next org's token. An org whose token is rejected (401: expired or revoked) is skipped the same way for 10 minutes.
+4. The proxy replaces the `Authorization` header with a real org token (when `claude` keeps its claude.ai login, that login token arrives as `Authorization` and is discarded, never forwarded or logged), drops the `x-claude-org-secret` header and hop-by-hop headers, and forwards to `api.anthropic.com` (any other upstream is refused unless `CLAUDE_ORG_UNSAFE_UPSTREAM=1`). On a 429 or `anthropic-ratelimit-unified-5h-status: rejected` it marks that org limited until `5h-reset` and **resends the same request** with the next org's token. An org whose token is rejected (401: expired or revoked) is skipped the same way for 10 minutes.
 5. Claude Code only ever sees the successful response — the org switched mid-session. SSE streaming is piped through untouched. When Claude Code cancels or exits mid-response, the upstream request is cancelled too; an upstream that sends nothing for 10 minutes is given up and the next org tried.
 
 One log line per request (`via <org> model=<model> -> <status>`) goes to a temp file printed at launch (`-> proxy 127.0.0.1:<port> (order: ..., strategy: ..., log: ...)`). The prompt and the tokens are never logged.
@@ -97,39 +101,48 @@ One log line per request (`via <org> model=<model> -> <status>`) goes to a temp
 [ -n "$CLAUDE_ORG_STATE_FILE" ] && [ -f "$CLAUDE_ORG_STATE_FILE" ] && node -p "require(process.env.CLAUDE_ORG_STATE_FILE).org"
 ```
 
+**claude.ai connectors (Slack / Notion / …)**
+
+Claude Code loads claude.ai connector MCPs (Gmail / Drive / Calendar / Notion / Slack …, `mcp__claude_ai_*`) only while it uses a claude.ai login: when `ANTHROPIC_AUTH_TOKEN` or an API key takes precedence it skips them (its debug log says `[claudeai-mcp] Disabled: API-key auth precedence active`; `ANTHROPIC_BASE_URL` alone does not disable them). So when you are signed in to claude.ai, `claude-org proxy` leaves the login in place and passes its secret in a header instead, and connectors work in proxy sessions:
+
+- Connectors are those of your **claude.ai login** (the default org), whichever org the proxy sends model requests to. Their calls go from Claude Code straight to Anthropic, not through the proxy.
+- The launch asks `claude auth status` first (about one second). If you are not signed in, have an API key or token in your env, or the check fails, the session starts the earlier way (Bearer secret, no connectors) and the launch line says why.
+- `CLAUDE_ORG_NO_CONNECTORS=1` forces the earlier way. The session gets `CLAUDE_ORG_CONNECTORS=1` or `0` so hooks can tell which one it is.
+- Claude Code may also send custom headers to other Anthropic endpoints. The secret is accepted only by this session's loopback proxy and is worthless once it exits.
+
 **Limitations of proxy mode**
 
-- claude.ai connector MCPs (Gmail / Drive / Calendar / Notion / Slack …) and Remote Control are **unavailable**: `ANTHROPIC_AUTH_TOKEN` makes Claude Code treat the session as external-token auth, so `mcp__claude_ai_*` tools do not appear. Local/plugin MCPs work. Open connectors in a plain `claude --resume` session — history is shared.
+- Without a claude.ai login (see above), claude.ai connector MCPs and Remote Control are **unavailable**. Local/plugin MCPs work either way. Open connectors in a plain `claude --resume` session — history is shared.
 - Each proxy serves one session and dies when `claude` exits.
 
 **Subagents**
 
 - Subagents started with Claude Code's Agent tool run in the same process as the parent session and share its `ANTHROPIC_BASE_URL`, so they go through the same proxy with no setup and use the same orgs' limits. Their requests appear in the proxy log with their own `model=` (e.g. a Haiku subagent).
 - Not covered: a `claude` started as a separate process (it needs its own `claude-org proxy`), and agents that run in the cloud (e.g. `isolation: remote`).
-- The connector MCP limitation above applies to subagents too.
+- Subagents get the same connector MCPs as the parent session (none when it started without a claude.ai login).
 - When an org's 5h or 7d window is rejected, the org is taken out for every model, so subagents also move to the next org until the window resets. A 429 for one model only (#8) moves that model only; other models, including those of subagents, stay on the org.
 - Work routed to a Team / Enterprise org (e.g. your company's) counts toward that org's usage, which its admins can see.
 
 ### Prompt cache & tool search
 
-A custom `ANTHROPIC_BASE_URL` + `ANTHROPIC_AUTH_TOKEN` makes Claude Code treat the session as API-key auth, which changes two defaults:
+A custom `ANTHROPIC_BASE_URL` + `ANTHROPIC_AUTH_TOKEN` (the mode without a claude.ai login) makes Claude Code treat the session as API-key auth, which changes two defaults:
 
 - **Prompt cache TTL drops to 5 minutes** (subscription-direct sessions get 1 hour). The 1-hour TTL is requested via the `anthropic-beta` header, which the proxy forwards unchanged.
 - **MCP tool search** (deferred tool-definition loading) is **disabled**.
 
-`claude-org proxy` restores the subscription-equivalent behavior by launching `claude` with `CLAUDE_CODE_PROMPT_CACHE_TTL=1h` and `ENABLE_TOOL_SEARCH=true`. If you have set either variable yourself, your value wins.
+`claude-org proxy` restores the subscription-equivalent behavior by launching `claude` with `CLAUDE_CODE_PROMPT_CACHE_TTL=1h` and `ENABLE_TOOL_SEARCH=true` (in both modes). If you have set either variable yourself, your value wins.
 
 | Entry point | Mid-session switch | Connector MCPs | Best for |
 |---|---|---|---|
 | `claude` | no (default org) | yes | connector work |
 | `claude-org auto --resume` | at launch only | no on preferred org / yes on default | short tasks |
-| `claude-org proxy --resume` | **automatic** | no | long-running work, agents, unattended runs |
+| `claude-org proxy --resume` | **automatic** | yes with a claude.ai login (those of the login) / no otherwise | long-running work, agents, unattended runs |
 
 ### Unattended use (supervisors, `--dangerously-skip-permissions`)
 
 When a supervisor starts `claude` without a person watching (e.g. `claude -p` with `--dangerously-skip-permissions`), launch it through `claude-org proxy`, not `claude-org <org>` / `auto`:
 
-- **Use proxy mode only.** `claude-org <org>` and `auto` put the org token into `claude`'s environment as `CLAUDE_CODE_OAUTH_TOKEN`, where a prompt-injected `claude` can read it. In proxy mode the tokens stay in the launcher process; `claude` only holds the per-session proxy secret, which is worth nothing outside that session.
+- **Use proxy mode only.** `claude-org <org>` and `auto` put the org token into `claude`'s environment as `CLAUDE_CODE_OAUTH_TOKEN`, where a prompt-injected `claude` can read it. In proxy mode the org tokens stay in the launcher process; `claude` only holds the per-session proxy secret, which is worth nothing outside that session (and, when you are signed in to claude.ai, its own claude.ai login, which it has without claude-org too; set `CLAUDE_ORG_NO_CONNECTORS=1` if the unattended session should not use the login).
 - **Signals.** The launcher forwards `SIGTERM` / `SIGHUP` (and `SIGINT` when it has no terminal) to `claude`, waits for it to exit, and reports its exit code (`128+signal` when killed); after 10 s it sends `SIGKILL`. So a supervisor that kills the launcher pid does not leave an orphaned `claude`, and the proxy lives exactly as long as `claude` does. With a terminal, Ctrl-C goes to `claude` only (the launcher stays until `claude` exits).
 - **Keep the token files away from `claude`'s shell.** A `claude` running with permissions skipped can `cat ~/.claude/org-tokens/*.token` from Bash. The proxy refuses token files that are not mode `0600` and owned by you, but that does not stop your own `claude`. Deny the directory to sandboxed commands and to the Read tool in the settings of the project the unattended session runs in (both are needed: the sandbox covers shell commands only, the Read tool follows permission rules):
 
@@ -169,8 +182,10 @@ When a supervisor starts `claude` without a person watching (e.g. `claude -p` wi
 | `CLAUDE_ORG_WATCH_MAX_SLEEP` | `18000` | Max seconds between `watch` re-checks (values < 60 also lower the 60s minimum — for tests) |
 | `CLAUDE_ORG_UPSTREAM` | `https://api.anthropic.com` | API base URL for `probe` and `proxy` (stub upstream in tests). `proxy` refuses any other value unless `CLAUDE_ORG_UNSAFE_UPSTREAM=1`, since org tokens are sent there |
 | `CLAUDE_ORG_UNSAFE_UPSTREAM` | (unset) | `1` lets `proxy` forward to a `CLAUDE_ORG_UPSTREAM` other than `api.anthropic.com` (tests only) |
-| `CLAUDE_ORG_PROXY_SECRET` | (unset) | Standalone `node lib/proxy.js` only: the bearer value clients must send. `claude-org proxy` generates one per session itself |
-| `CLAUDE_ORG_PROXY` | `1` when launched via `proxy` | Marker env passed to the claude process so user hooks can detect connector-less sessions |
+| `CLAUDE_ORG_PROXY_SECRET` | (unset) | Standalone `node lib/proxy.js` only: the value clients must send (as `x-claude-org-secret` header or bearer token). `claude-org proxy` generates one per session itself |
+| `CLAUDE_ORG_NO_CONNECTORS` | (unset) | `1`: `proxy` always passes the secret as `ANTHROPIC_AUTH_TOKEN` (no claude.ai login check, no connector MCPs) |
+| `CLAUDE_ORG_PROXY` | `1` when launched via `proxy` | Marker env passed to the claude process so user hooks can detect proxy sessions |
+| `CLAUDE_ORG_CONNECTORS` | `1` / `0` when launched via `proxy` | Marker env: `1` when the session kept its claude.ai login (connector MCPs can load), `0` otherwise |
 | `CLAUDE_ORG_STATE_FILE` | set when launched via `proxy` | Path of the JSON file holding the org and model of the last request (read it from a statusline or hook) |
 | `CLAUDE_ORG_FORCE_PROBE` | (unset) | Test seam: `allowed` / `rejected[:<epoch>]` / `rejected_until:<epoch>` fakes `probe` results without API calls |
 | `CLAUDE_ORG_REJECT_FILE` | (unset) | Test seam: orgs listed comma-separated in this file are treated as rate-limited by `proxy` |

package/bin/claude-org.js

@@ -62,9 +62,20 @@ async function main() {
   }
 }
 
+// Exit by letting the event loop drain instead of process.exit(): on Windows
+// (Node 24.10), process.exit() after two or more fetch() calls aborts with the
+// libuv assertion "!(handle->flags & UV_HANDLE_CLOSING)" in src\win\async.c
+// and exit code 127 instead of ours (#36). If something still holds the loop
+// open, the unref'd timer exits the old way so the CLI never hangs.
+const EXIT_GRACE_MS = 5000;
+function finish(code) {
+  process.exitCode = code;
+  setTimeout(() => process.exit(code), EXIT_GRACE_MS).unref();
+}
+
 main()
-  .then(code => process.exit(code))
+  .then(code => finish(code))
   .catch(e => {
     console.error(`claude-org: ${e.message}`);
-    process.exit(1);
+    finish(1);
   });

package/lib/launch.js

@@ -7,8 +7,9 @@ const { readToken } = require('./config');
 const KILL_GRACE_MS = 10 * 1000;
 const FORWARDED_SIGNALS = ['SIGTERM', 'SIGHUP', 'SIGINT'];
 
-// Spawn claude with inherited stdio and extra env. Resolves to the child's
-// exit code (128+n when killed by signal n, like a shell would report).
+// Spawn claude with inherited stdio and extra env (a key set to undefined is
+// removed from the inherited env). Resolves to the child's exit code (128+n
+// when killed by signal n, like a shell would report).
 //
 // Signals sent to this launcher (a supervisor's reaper or timeout kills the
 // launcher pid, not claude) are forwarded to claude, and the launcher waits
@@ -18,11 +19,23 @@ const FORWARDED_SIGNALS = ['SIGTERM', 'SIGHUP', 'SIGINT'];
 // "exit". So with a terminal on any of stdin/stdout/stderr, SIGINT is left to
 // claude; with none (headless, under a supervisor) it is forwarded like the
 // others.
+// Windows env names are case-insensitive, so a removed key is matched that way
+// there (an inherited "Anthropic_Auth_Token" must not survive).
+function childEnv(envExtra = {}) {
+  const env = { ...process.env, ...envExtra };
+  const same = process.platform === 'win32' ? (a, b) => a.toUpperCase() === b.toUpperCase() : (a, b) => a === b;
+  for (const [k, v] of Object.entries(envExtra)) {
+    if (v !== undefined) continue;
+    for (const name of Object.keys(env)) if (same(name, k)) delete env[name];
+  }
+  return env;
+}
+
 function runClaude(args, envExtra = {}) {
   return new Promise(resolve => {
     const child = spawnClaude(args, {
       stdio: 'inherit',
-      env: { ...process.env, ...envExtra },
+      env: childEnv(envExtra),
     });
     let killTimer = null;
     const handlers = new Map();
@@ -65,4 +78,4 @@ async function launch(name, args) {
   return runClaude(args, { CLAUDE_CODE_OAUTH_TOKEN: tok });
 }
 
-module.exports = { runClaude, launch };
+module.exports = { runClaude, launch, childEnv };

package/lib/proxy.js

@@ -17,9 +17,12 @@
 // first and returns 401. The proxy drops x-api-key and sends Bearer only.
 //
 // The proxy holds org tokens, so it only serves the one claude it was started
-// for: each request must carry a per-session secret (Authorization: Bearer,
-// what claude sends for ANTHROPIC_AUTH_TOKEN), name the proxy itself in Host
-// (no DNS rebinding from a browser), and be a GET/POST/DELETE under /v1/.
+// for: each request must carry a per-session secret, name the proxy itself in
+// Host (no DNS rebinding from a browser), and be a GET/POST/DELETE under /v1/.
+// The secret comes either in the x-claude-org-secret header (what claude sends
+// for ANTHROPIC_CUSTOM_HEADERS; the Authorization header then holds claude's
+// own claude.ai login token, which is discarded) or as Authorization: Bearer
+// (what claude sends for ANTHROPIC_AUTH_TOKEN). Neither reaches the upstream.
 //
 // Env (standalone mode):
 //   PORT                     listen port (default 0 = OS picks; reported on the
@@ -62,6 +65,7 @@ const REQUEST_BODY_MAX_BYTES = 64 * 1024 * 1024;
 // API_TIMEOUT_MS defaults to the same 10 minutes.
 const UPSTREAM_TIMEOUT_MS = 10 * 60 * 1000;
 const ALLOWED_METHODS = new Set(['GET', 'POST', 'DELETE']);
+const SECRET_HEADER = 'x-claude-org-secret';
 // Hop-by-hop headers (RFC 9110 §7.6.1) describe one connection and must not be
 // forwarded; the body is re-framed by this proxy anyway.
 const HOP_BY_HOP = new Set(['connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization',
@@ -97,6 +101,27 @@ function requestModel(body) {
   }
 }
 
+// Claude Code's startup quota check, sent by an interactive session that uses
+// a claude.ai login (so in the connectors mode; captured from 2.1.310 on
+// 2026-10-26): POST /v1/messages, max_tokens 1, no system prompt, one user
+// message "quota". The API answers it with 429 rate_limit_error "Error" and no
+// rate-limit headers for every OAuth token, the claude.ai login's own included
+// (measured on all three), while real requests from the same tokens get 200.
+// So its 429 says nothing about the org or the model: it is passed through
+// from the first org without failover, quarantine or ALERT.
+function isQuotaCheck(body) {
+  try {
+    const j = JSON.parse(body.toString('utf8'));
+    const m = Array.isArray(j.messages) && j.messages.length === 1 ? j.messages[0] : null;
+    if (j.max_tokens !== 1 || j.system !== undefined || !m || m.role !== 'user') return false;
+    const text = typeof m.content === 'string' ? m.content
+      : Array.isArray(m.content) && m.content.length === 1 && m.content[0].type === 'text' ? m.content[0].text : null;
+    return text === 'quota';
+  } catch {
+    return false;
+  }
+}
+
 // Client input for the log: limited to safe characters and cut short.
 function logModel(model) {
   return model.replace(/[^\w.:@/-]/g, '_').slice(0, 80);
@@ -315,7 +340,8 @@ function createProxy(opts = {}) {
       const h = stripHopByHop(headers);
       for (const k of Object.keys(h)) {
         const lk = k.toLowerCase();
-        if (lk === 'x-api-key' || lk === 'host' || lk === 'content-length' || lk === 'authorization') delete h[k];
+        if (lk === 'x-api-key' || lk === 'host' || lk === 'content-length' || lk === 'authorization'
+          || lk === SECRET_HEADER) delete h[k];
       }
       h.authorization = `Bearer ${token}`;
       h.host = UPSTREAM.host;
@@ -347,9 +373,15 @@ function createProxy(opts = {}) {
   // Checks done before any body is read or anything is forwarded. Returns
   // [status, message] for a request to refuse, or null.
   function gate(clientReq) {
+    // When the header is present it alone decides: the Authorization header is
+    // then claude's claude.ai login token, not the secret.
+    const viaHeader = clientReq.headers[SECRET_HEADER];
     const auth = clientReq.headers.authorization || '';
-    if (!auth.startsWith('Bearer ') || !secretMatches(auth.slice(7), SECRET)) {
-      return [401, 'missing or wrong proxy secret (the Bearer token claude-org proxy gave this session)'];
+    const authorized = viaHeader !== undefined
+      ? secretMatches(viaHeader, SECRET)
+      : auth.startsWith('Bearer ') && secretMatches(auth.slice(7), SECRET);
+    if (!authorized) {
+      return [401, `missing or wrong proxy secret (the ${SECRET_HEADER} header or Bearer token claude-org proxy gave this session)`];
     }
     const addr = server.address(); // null once the server is closing
     if (!addr) return [503, 'proxy is shutting down'];
@@ -378,7 +410,11 @@ function createProxy(opts = {}) {
       abort.abort();
       if (up) up.destroy();
     });
-    const isModelReq = clientReq.url.startsWith('/v1/messages');
+    const quotaCheck = clientReq.url.startsWith('/v1/messages?') || clientReq.url === '/v1/messages'
+      ? isQuotaCheck(body) : false;
+    // A quota check is forwarded like a non-model request: first usable org,
+    // response passed through, no limit bookkeeping.
+    const isModelReq = clientReq.url.startsWith('/v1/messages') && !quotaCheck;
     const model = isModelReq ? requestModel(body) : '';
     let order;
     try {
@@ -489,6 +525,7 @@ function createProxy(opts = {}) {
           log(`ALERT no-org-available model=${logModel(model)} reason=${modelRefused ? 'model-rejected' : 'rate-limited'} status=${up.statusCode}`);
         }
       }
+      if (quotaCheck) log(`quota check via ${org} -> ${up.statusCode} (passed through, not counted as a limit)`);
       if (clientGone) { up.destroy(); return; }
       clientRes.writeHead(up.statusCode, { ...stripHopByHop(up.headers), 'x-claude-org': org });
       if (errBody) {
@@ -559,9 +596,162 @@ function createProxy(opts = {}) {
 // `claude-org proxy [claude args...]`: start an in-process proxy on a random
 // port, point ANTHROPIC_BASE_URL at it, launch claude, and shut the proxy down
 // when claude exits. One proxy per session, so parallel sessions never collide.
+// A log that cannot be written (disk full, dir removed) must not take the
+// proxy down with an unhandled 'error'. Once it fails, ALERT lines would vanish
+// for an unattended session that only watches the log, so they are mirrored to
+// stderr from then on.
+// Each launch leaves a claude-org-proxy-XXXXXX dir in tmpdir (the log is kept
+// for later investigation, so it is not removed on exit). Keep only the newest
+// `keep` finished ones so repeated and headless launches do not pile up.
+//  - Names are matched exactly, and only real directories owned by this user
+//    are removed (tmpdir is shared: someone else could plant a lookalike).
+//    process.getuid does not exist on Windows, where tmpdir is per-user.
+//  - A dir whose launcher is still alive (pid file) is never removed, however
+//    many there are: it holds the open log and the state file.
+//  - "Newest" is the launch time: the pid file is written once at launch and
+//    never touched again, whereas the dir mtime moves whenever state.json is
+//    renamed into it. Dirs from before the pid file existed fall back to mtime.
+const RUN_DIR_PREFIX = 'claude-org-proxy-';
+const RUN_DIR_KEEP = 20;
+const RUN_DIR_RE = new RegExp(`^${RUN_DIR_PREFIX}[A-Za-z0-9]{6}$`);
+
+function launcherAlive(dir) {
+  let pid;
+  try { pid = Number(fs.readFileSync(path.join(dir, 'pid'), 'utf8').trim()); } catch { return false; }
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try { process.kill(pid, 0); return true; } catch (e) { return e.code === 'EPERM'; }
+}
+
+function pruneRunDirs(root, keep = RUN_DIR_KEEP) {
+  let names;
+  try { names = fs.readdirSync(root); } catch { return 0; }
+  const uid = typeof process.getuid === 'function' ? process.getuid() : null;
+  const dirs = [];
+  for (const name of names) {
+    if (!RUN_DIR_RE.test(name)) continue;
+    const full = path.join(root, name);
+    try {
+      const st = fs.lstatSync(full);
+      if (!st.isDirectory() || (uid !== null && st.uid !== uid)) continue;
+      if (launcherAlive(full)) continue;
+      let launched = st.mtimeMs;
+      try { launched = fs.statSync(path.join(full, 'pid')).mtimeMs; } catch { /* pre-pid-file dir */ }
+      dirs.push({ full, launched });
+    } catch { /* removed by a concurrent launch */ }
+  }
+  dirs.sort((a, b) => b.launched - a.launched);
+  let removed = 0;
+  for (const d of dirs.slice(keep)) {
+    try {
+      fs.rmSync(d.full, { recursive: true, force: true });
+      removed++;
+    } catch (e) {
+      console.error(`claude-org: cannot remove old proxy log dir ${d.full}: ${e.message}`);
+    }
+  }
+  return removed;
+}
+
+function guardLogStream(logStream, logf) {
+  let logFailed = false;
+  logStream.on('error', e => {
+    if (!logFailed) console.error(`claude-org: cannot write the proxy log ${logf}: ${e.message}`);
+    logFailed = true;
+  });
+  return {
+    write(line) {
+      if (!line.includes('ALERT ')) return logStream.write(line);
+      // After a confirmed failure, mirror directly (the stream is destroyed and
+      // would only call back with an error again).
+      if (logFailed) { process.stderr.write(line); return false; }
+      // The write that first hits the failure only reports it asynchronously;
+      // recover that line from the callback so a one-off ALERT is not lost.
+      return logStream.write(line, err => { if (err) process.stderr.write(line); });
+    },
+  };
+}
+
+// claude.ai connector MCPs (Slack, Notion, ...) load only while claude uses
+// its claude.ai login: Claude Code 2.1.310 skips them when ANTHROPIC_AUTH_TOKEN
+// or an API key takes precedence ("[claudeai-mcp] Disabled: API-key auth
+// precedence active"). ANTHROPIC_BASE_URL alone does not disable them. So when
+// claude, started with the env it will get, reports a claude.ai login, the
+// secret goes in a custom header and the login stays active; otherwise (no
+// login, an API key or token in the env, the check failed) the secret is the
+// Bearer token, as before. The check costs about one second at launch.
+const AUTH_STATUS_TIMEOUT_MS = 15 * 1000;
+const AUTH_STATUS_MAX_BYTES = 64 * 1024;
+const AUTH_STATUS_KILL_WAIT_MS = 5 * 1000;
+
+function claudeAiLogin(env) {
+  const { spawnClaude } = require('./claude-spawn');
+  return new Promise(resolve => {
+    let out = '';
+    let settled = false;
+    let timer = null;
+    const done = (ok, why) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve({ ok, why });
+    };
+    let child;
+    try {
+      child = spawnClaude(['auth', 'status'], { env, stdio: ['ignore', 'pipe', 'ignore'] });
+    } catch (e) {
+      done(false, `claude auth status could not start: ${e.message}`);
+      return;
+    }
+    let timedOut = null;
+    timer = setTimeout(() => {
+      const why = `claude auth status did not answer within ${AUTH_STATUS_TIMEOUT_MS / 1000} s`;
+      timedOut = why;
+      if (process.platform !== 'win32') {
+        try { child.kill(); } catch { /* already exited */ }
+        done(false, why);
+        return;
+      }
+      // On Windows claude runs under cmd.exe (shell: true); killing only the
+      // shell would leave claude running, so the whole tree is ended. The
+      // launch waits for taskkill (bounded): measured on Windows 11, a
+      // taskkill not waited for left the hung claude running.
+      let killer;
+      try {
+        killer = require('child_process').spawn('taskkill', ['/pid', String(child.pid), '/T', '/F'], { stdio: 'ignore' });
+      } catch {
+        done(false, why);
+        return;
+      }
+      const giveUp = setTimeout(() => done(false, why), AUTH_STATUS_KILL_WAIT_MS);
+      const finish = () => { clearTimeout(giveUp); done(false, why); };
+      killer.on('exit', finish);
+      killer.on('error', finish);
+    }, AUTH_STATUS_TIMEOUT_MS);
+    child.stdout.setEncoding('utf8');
+    child.stdout.on('data', c => { if (out.length < AUTH_STATUS_MAX_BYTES) out += c; });
+    child.on('error', e => done(false, `claude auth status could not start: ${e.message}`));
+    child.on('close', () => {
+      if (timedOut) return done(false, timedOut); // closed because it was killed
+      let st;
+      try { st = JSON.parse(out); } catch { return done(false, 'claude auth status gave no JSON'); }
+      if (st && st.loggedIn === true && st.authMethod === 'claude.ai') return done(true, 'claude.ai login');
+      done(false, `claude auth status: loggedIn=${st && st.loggedIn} authMethod=${String(st && st.authMethod).slice(0, 40)}`);
+    });
+  });
+}
+
+// ANTHROPIC_CUSTOM_HEADERS ("Name: value" lines) with the secret header added.
+// The user's other headers are kept; a secret header inherited from an outer
+// claude-org proxy session is replaced.
+function withSecretHeader(existing, secret) {
+  const lines = String(existing || '').split(/\r?\n/)
+    .filter(l => l.trim() && l.split(':')[0].trim().toLowerCase() !== SECRET_HEADER);
+  return lines.concat(`${SECRET_HEADER}: ${secret}`).join('\n');
+}
+
 async function proxyLaunch(args) {
   const { listOrgs, tokenDir, resolvePrefer } = require('./config');
-  const { runClaude } = require('./launch');
+  const { runClaude, childEnv } = require('./launch');
 
   // An org whose token file the proxy would refuse (S5) is reported here, at
   // launch, not only in the proxy log after every request has failed.
@@ -577,25 +767,29 @@ async function proxyLaunch(args) {
     return 1;
   }
 
+  // An ANTHROPIC_AUTH_TOKEN / ANTHROPIC_BASE_URL in this env (e.g. from an
+  // outer claude-org proxy session) is replaced below either way, so the check
+  // runs without them.
+  const unsetForCheck = { ANTHROPIC_AUTH_TOKEN: undefined, ANTHROPIC_BASE_URL: undefined };
+  const login = process.env.CLAUDE_ORG_NO_CONNECTORS === '1'
+    ? { ok: false, why: 'CLAUDE_ORG_NO_CONNECTORS=1' }
+    : await claudeAiLogin(childEnv(unsetForCheck));
+
   const order = process.env.CLAUDE_ORG_ORDER || resolvePrefer();
-  const runDir = fs.mkdtempSync(path.join(os.tmpdir(), 'claude-org-proxy-'));
+  pruneRunDirs(os.tmpdir());
+  const runDir = fs.mkdtempSync(path.join(os.tmpdir(), RUN_DIR_PREFIX));
+  fs.writeFileSync(path.join(runDir, 'pid'), String(process.pid));
   const logf = path.join(runDir, 'proxy.log');
   const stateFile = path.join(runDir, 'state.json');
   const logStream = fs.createWriteStream(logf);
-  // A log that cannot be written (disk full, dir removed) must not take the
-  // proxy down with an unhandled 'error'.
-  let logFailed = false;
-  logStream.on('error', e => {
-    if (!logFailed) console.error(`claude-org: cannot write the proxy log ${logf}: ${e.message}`);
-    logFailed = true;
-  });
+  const logOut = guardLogStream(logStream, logf);
   // Only this claude may use this proxy (and so the org tokens): it must send
-  // this per-session secret as its Bearer token. It goes into the child's env
-  // and nowhere else.
+  // this per-session secret, in the x-claude-org-secret header or as its
+  // Bearer token. It goes into the child's env and nowhere else.
   const secret = crypto.randomBytes(32).toString('hex');
   let proxy;
   try {
-    proxy = createProxy({ order: order.split(','), log: logStream, stateFile, secret });
+    proxy = createProxy({ order: order.split(','), log: logOut, stateFile, secret });
   } catch (e) {
     console.error(`claude-org: ${e.message}`);
     logStream.end();
@@ -616,17 +810,30 @@ async function proxyLaunch(args) {
     return 1;
   }
   const port = server.address().port;
+  const connectors = login.ok ? 'on (claude.ai login kept)' : `off (${login.why})`;
+  log(`claude.ai connectors: ${connectors}`);
+  console.error(`-> claude.ai connectors: ${connectors}`);
   console.error(`-> proxy 127.0.0.1:${port} (order: ${order}, strategy: ${strategy}, log: ${logf})`);
 
-  // A custom ANTHROPIC_BASE_URL + AUTH_TOKEN makes Claude Code treat the session
-  // as API-key auth: prompt cache TTL drops to 5min and MCP tool search is
-  // disabled. Restore subscription-equivalent defaults; user-set values win.
+  // With ANTHROPIC_AUTH_TOKEN, Claude Code treats the session as API-key auth:
+  // prompt cache TTL drops to 5min and MCP tool search is disabled. Restore
+  // subscription-equivalent defaults in both modes; user-set values win.
   const envExtra = {
     ANTHROPIC_BASE_URL: `http://127.0.0.1:${port}`,
-    ANTHROPIC_AUTH_TOKEN: secret,             // sent as Bearer; the proxy checks it, then swaps in an org token
-    CLAUDE_ORG_PROXY: '1',                    // marker: "connector MCPs unavailable" session
+    CLAUDE_ORG_PROXY: '1',                    // marker: session goes through claude-org proxy
+    CLAUDE_ORG_CONNECTORS: login.ok ? '1' : '0', // marker: claude.ai connector MCPs can load
     CLAUDE_ORG_STATE_FILE: stateFile,         // last org/model, for statusline and hooks
   };
+  if (login.ok) {
+    // claude keeps its claude.ai login (and sends that token as Bearer, which
+    // the proxy discards); the secret travels in the custom header. Claude
+    // Code may also send custom headers to other Anthropic endpoints; the
+    // secret is only accepted by this loopback proxy and dies with it.
+    envExtra.ANTHROPIC_AUTH_TOKEN = undefined;
+    envExtra.ANTHROPIC_CUSTOM_HEADERS = withSecretHeader(process.env.ANTHROPIC_CUSTOM_HEADERS, secret);
+  } else {
+    envExtra.ANTHROPIC_AUTH_TOKEN = secret;   // sent as Bearer; the proxy checks it, then swaps in an org token
+  }
   if (!process.env.CLAUDE_CODE_PROMPT_CACHE_TTL) envExtra.CLAUDE_CODE_PROMPT_CACHE_TTL = '1h';
   if (!process.env.ENABLE_TOOL_SEARCH) envExtra.ENABLE_TOOL_SEARCH = 'true';
 
@@ -659,4 +866,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { createProxy, proxyLaunch };
+module.exports = { createProxy, proxyLaunch, guardLogStream, pruneRunDirs, withSecretHeader };

package/lib/usage.js

@@ -20,7 +20,7 @@ token org alphabetically):
   claude-org proxy [claude args...]   launch via a local proxy; a running session
                                     fails over to another org the moment the 5h
                                     limit hits (needs 2+ org tokens; claude.ai
-                                    connector MCPs are unavailable)
+                                    connector MCPs need a claude.ai login)
   claude-org auto [claude args...]    launch on <prefer> if usable, else default
                                     (decided once at launch)
   claude-org <name> [claude args...]  e.g. claude-org work --resume

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-org",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Switch Claude Code between multiple Anthropic organizations, with automatic failover on the 5-hour rate limit",
   "license": "MIT",
   "type": "commonjs",