[haacked]

/usage shows plan usage for one account only, and I switch between three: the default login, ~/.claude-automation, and ~/.claude-personal. Nothing shows which account is out of room or when each limit resets, and nothing shows which account docket and /go will review on next.

/usage-all finds every signed-in account (the default login, each ~/.claude-* directory, and each account in docket's config.toml) and calls /api/oauth/usage with that account's token from the keychain. That's the same endpoint /usage uses. The token goes to curl on stdin, so it never shows up in argv or in the output. When a token has expired, the script runs claude mcp get under that account so Claude Code refreshes the token itself. Writing credentials from the script could race a running session's refresh and invalidate the rotated refresh token. claude mcp list refreshed a real expired token, but it took 22 seconds. mcp get reaches the same refresh path in about a second, but I haven't yet watched it refresh a token whose refresh token is still valid. If it doesn't, the report prints the /login command to run.

The report ends with docket's rotation, the account the next review runs on, and each limit docket recorded. Those lines come from a new run-review.py accounts subcommand. It shares review_accounts() with /go's launch path, so the report and /go can't disagree.

Test plan

• ai/skills/usage-all/scripts/tests/test-claude-usage.sh (30 cases, offline shims for security, curl, claude), on macOS and in an ubuntu:24.04 container with jq 1.7
• python3 ai/skills/go/scripts/tests/test_run_review.py (85 tests, 2 new for accounts)
• ai/tests/test-skill-spec.sh and ai/tests/test-canonical-skills.sh
• Ran the script against the three real accounts
• After merging and running ai/install.sh, run /usage-all once the automation token has expired, to confirm mcp get refreshes it

https://claude.ai/code/session_01EgGS8yEU8u5bLREUrkqhKS