quota

Claude Code multi-account session vault + login-OTP fetcher.

Manage a roster of Anthropic Claude accounts (claude1..N@in.dancinlab.org) from one compiled hexa CLI:

1. OTP fetch — hand it a login URL or an account, and it returns the newest Claude login verification code (6–8 digits) that just landed in that account's mailbox, read from the Postmark Inbound Messages API (mailbox in.dancinlab.org MX → Postmark inbound).
2. Session vault — save / use / list per-account Claude Code credential sessions (~/.claude/.credentials.json), so when one account hits its quota you swap to another without logging in again.

Credentials never touch argv or logs: the Postmark server token is read from the secret CLI inside a shell command-substitution and written straight into a curl -K config file — it never enters the process's memory.

hexa is a compiled language (hexa run = compile-then-exec, hexa build = AOT native binary), so quota compiles to native on install.

Install

hx install quota          # clone + shim cli/quota.hexa (compile-then-exec, cached)

Or grab a standalone native binary from a release (quota-darwin-arm64, quota-linux-x86_64) — no toolchain required.

Prerequisites

• secret CLI with:
  • postmark.dancinlab_server_token — the Postmark inbound server token.
  • claude<n>.email entries — the account roster is derived from these key names.
• curl on PATH (Postmark API calls).

Usage

OTP:
  quota code <n|email|login-url> [--wait <sec>] [--json]   newest login code for one account
  quota inbox [--json]                                     scan ALL accounts (who got mail + code)
  quota list [--json]                                      roster (index -> email · [saved] mark)

Session vault (swap accounts when one hits its quota):
  quota save <n>          snapshot the live Claude session -> vault slot n
  quota use <n>           restore vault slot n as the live session (backs up the current one)
  quota sessions [--json] list saved vault slots
  quota rm <n>            delete a vault slot

  quota --version | help

Examples

# newest login code for account 3 (bare code on stdout, context on stderr)
quota code 3
# → 483920

# paste the login URL — quota pulls the account from a login_hint= param if present,
# else treats it as an account, then fetches the code
quota code "https://claude.ai/login?login_hint=claude3%40in.dancinlab.org"

# wait up to 60s for a code that arrives AFTER you kick off the login (no stale replay)
quota code 3 --wait 60

# which account just received mail, and what's the code?
quota inbox

# quota exhausted on the current login → park it and switch to account 5
quota save 3       # snapshot the live session as slot 3
quota use 5        # restore slot 5 as the live Claude session (slot 3 stays saved)

quota code prints the bare code to stdout and human context to stderr, so it pipes cleanly: CODE=$(quota code 3).

How it works

[ login URL / account ] ──▶ [ resolve account ] ──▶ [ Postmark inbound scan ]
                                                              │  (token from `secret`,
                                                              │   curl -K, never argv)
                                                              ▼
                                                     [ 6–8 digit OTP ]

[ quota save <n> ]  live ~/.claude/.credentials.json ──▶ ~/.quota/vault/<n>.credentials.json
[ quota use <n>  ]  vault slot ──(backup live first)──▶ live session

• The OTP scan queries all three Postmark inbound states (processed · scheduled · failed), dedups by MessageID, matches the recipient against the roster, and extracts the first 6–8 digit run from the subject (falling back to the message body).
• The account mailbox is dedicated, so the sender domain (anthropic.com) is a soft preference, not a hard filter — any OTP addressed to the account is treated as its code.
• --wait accepts only messages that arrive after invocation, so an old code is never replayed.

State lives under ~/.quota/ (vault/ credential snapshots + quota.log audit JSONL). Nothing there contains a plaintext token.

License

MIT © dancinlab