Account-first Phase 3: Claude Cowork / Desktop accounts

[robinebers]

TL;DR

Cowork sessions become account-aware: each sandbox names the account that ran it, and a Claude Desktop login distinct from every CLI login gets its own card — backed read-only by Desktop's org-pinned Safe Storage credentials, with its Cowork sessions as the card's spend.

What was happening

• The Claude card counted every Cowork sandbox on the machine, no matter which account ran the session — a Desktop signed into a different account silently bled its spend into the default card.
• A Claude Desktop login with no CLI counterpart was invisible: no card, no limits, no spend.
• The Desktop Safe Storage fallback always followed Desktop's active org, which becomes wrong the moment more than one Claude account exists on the machine.

What this changes

• ClaudeCoworkDiscovery (new): a launch-time walk over Cowork's session sandboxes that reads each sandbox's own .claude.json identity file (no keychain, no credentials, 400ms budget). The walk itself is shared with the spend scanner, so discovery and scanning can never see different sandbox sets.
• Assembly routing: sandboxes naming the default account stay exactly where they've always been; sandboxes naming a known config-dir account attach as that card's extra log roots; a distinct account becomes one Desktop-backed card. The moment any non-default sandbox exists, the default card's Cowork walk is partitioned so another account's sessions can't bleed into its spend.
• Org-pinned Desktop credentials: ClaudeDesktopAuthStore.load accepts an organization pin; a Desktop-backed card reads exactly its account's cached token, never Desktop's active org. New ClaudeCredentialScope.desktopOnly(organization:).
• Default card stays safe: once extra Claude cards exist, the default card's Desktop fallback is pinned to its own org (parsed from its identity key) — or disabled when that org is unknown — instead of blindly borrowing whatever org Desktop has active.
• ClaudeLogUsageScanner: gains coworkRootsOverride to scan an explicit sandbox set (the partition); cache identity includes the partition so changing it invalidates correctly.
• New .desktop source kind on account records; Desktop-backed cards reuse the whole existing account-card pipeline (layout, rename, iCloud identity, CLI/API matching).

Heads-up

• Signing Desktop out removes the card the same way a deleted config dir does (owner decision: cards render only while their source is found).
• A distinct Cowork account with no org pin gets no card (Desktop caches tokens per org, so an unpinned read could fetch another account's usage) — but its sandboxes still stay out of the default card's spend.
• Sandboxes with no identity file (pre-identity sessions, mid-creation) keep counting on the default card, exactly as the built-in walk always has.

Tests

• 13 new tests: sandbox identity reading, all four assembly routing paths (default / fold-onto-config-dir-card / distinct-account card / no-org-pin skip), org-pinned Desktop load, .desktopOnly scope, pinned standard fallback, and the scanner partition.
• Full suite: 1292 tests pass.
• Live run on this machine: default-only setup unchanged (no sandboxes from other accounts → no partition, byte-identical walk).

Made with Cursor

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 015a575. Configure here.}

[robinebers]

Just discovered a bug that when logged into Claude Code but changing the account while OpenUsage is running, that this logic now shows 2x the same account despite Cowork still having knowledge over two different accounts. This needs fixing.

[robinebers]

Bug: bare-id Claude account disappears after default-home swap

What I expected

Two Claude cards (as before the swap):

1. Team (SUNSTORY) — Desktop / Cowork
2. Personal — default home ~/.claude

What actually happens

Only one Claude card renders after Personal takes over the default home. Team is discovered every launch, then intentionally dropped.

Repro (this machine)

1. Registry has two Claude accounts, same user UUID, different orgs:
   • claude (Team / SUNSTORY) — source: desktop only, no default home
   • claude@b2d3867d (Personal) — source: defaultHome at ~/.claude with the badge
2. Launch account-first-phase-3 / this PR’s build.
3. Logs every launch:

accounts: claude default identity resolved (claude@b2d3867d)
discovery: cowork partition — default keeps 21 sandbox dir(s), 1 other account(s) found
WARN: discovery: the claude record's account now lives outside the default home; its card is unavailable until swap support lands

4. Refresh batch is a single Claude provider (claude), not two. UI shows one Claude card.

When it still worked

Through ~2026-07-30 both cards refreshed (claude + claude@b2d3867d). After Personal moved into ~/.claude, Team only exists via Cowork/Desktop and hits the Phase 3 guard.

Root cause

In ProviderAccountAssembly, extra-card build skips any planned card whose reconciled record id is the bare family id:

guard record.id != "claude" else {
    // The bare record's account has moved out of the default home into a side login
    // while another account occupies the default. The bare CARD is the default home's
    // runtime, so this record can't render under its own id this launch. Proper swap
    // support re-points this in Phase 4; until then the parked account stays hidden.
    AppLog.warn(.config, "discovery: the claude record's account now lives outside the default home; its card is unavailable until swap support lands")
    continue
}

So:

• Team still owns bare id claude (first account at default home historically).
• Personal holds the default badge under claude@b2d3867d.
• Team is found as a Desktop-backed extra → planned card exists → reconcile maps it to id claude → skipped.
• Personal is default, not an “extra”, so no second card is minted for claude@b2d3867d either.
• Net: only the default-home runtime card remains; Team is gone from the UI.

This matches the plan’s “swap re-points sources” story, but Phase 4 isn’t here yet — and today that gap is user-visible data loss (a known, still-found account with rename/layout/history simply stops rendering).

Expected fix direction (Phase 4 or a Phase 3 follow-up)

When the bare-id account no longer holds the default home:

• Keep its card rendering under a stable non-bare id (or re-point the bare id’s runtime to the badge holder and mint/keep a side id for the parked account), so both accounts stay visible whenever their sources are found.
• Don’t require the parked account to vanish until cswap lands.

Happy to help verify a patch against this machine’s registry state.

[robinebers]

Superseded by #1140, which rebuilds Claude multi-account support on the current main branch with account-owned runtimes, Desktop and CLI discovery, account-safe iCloud synchronization, and comprehensive regression coverage.