[Feature]: Per-project Claude account (ask on launch, remember per project) #23227

Problem or use case

Summary: Let each project remember which managed Claude account its Claude sessions use. Optionally, Orca asks the first time and offers "Remember for this project"; after that, Claude in that project starts on that account automatically, even while other projects run on a different account at the same time.

I keep a work and a personal Claude subscription on one machine, both signed in as managed accounts in Orca. The active account is global per host, so before starting Claude in a work repo I have to remember to switch, and switching affects every project. When I forget, the session runs (and bills) on the wrong account, and nothing in the project shows it.

This is the per-project half of #5203 / #6921 (duplicates: #5635, #7782, #14254). #6921's implementation (#6963) stalled and was withdrawn, so today there's still no way to tie a project to an account.

Proposed solution

A GUI layer on top of the per-launch account primitive in #22691 (--account). It adds no new credential mechanism: every pinned launch goes through #22691's pinned path (its own config dir, Keychain scoping, single-owner refresh guards). The data shape follows #13664, which added a per-project GitHub account (Repo.ghAccount + a Settings → Repository section).

1. A saved account per project. Settings → Repository gets a "Claude Account" section next to "GitHub Account":
Default (today's behavior) · Ask every time · each Claude account signed in on this machine.
It's stored per agent (agentAccounts.claude) so other agents can be added once they have a per-launch account primitive.

2. An opt-in prompt. A global setting, off by default: "Ask which Claude account to use for each project." When it's on and a project has no saved account (or is set to "Ask every time"), starting Claude shows:

┌──────────────────────────────────────────────┐
│ Choose a Claude account                      │
│ Pick the Claude account to start in          │
│ acme-backend.                                │
│                                              │
│  Account                                     │
│  ┌────────────────────────────────────────┐  │
│  │ me@work.example · Work Org          ▾ │  │
│  └────────────────────────────────────────┘  │
│  ☑ Remember for this project                 │
│    You can change this in Settings → Repo.   │
│                                              │
│                        [Cancel]  [Start]     │
└──────────────────────────────────────────────┘

• Remember checked: saved on the project. Later launches (new tabs, new workspaces, restarts) use it without asking.
• Remember unchecked: this launch only.
• It appears for launches the user starts (New Workspace, new agent tab / ⌘⌥T, quick launch, tab-bar menu), and only when 2+ accounts are signed in.

3. Every GUI launch honors it. The account is resolved in the main process for both spawn lanes (the renderer pty:spawn lane and #22691's runtime lane). Resumes and restores replay the account the session started on, not the project's current setting. A native-chat (structured) Claude launch in a project with a saved account runs as a terminal, so it can be pinned.

4. Visible, and never the wrong account silently. A pinned tab's tooltip shows the account email. If the saved account can't be used (removed, in use by terminals from when it was active, being switched…), Claude doesn't start on another account. The pane explains why and offers Start on active account (this launch only) or Retry.

Resolution order: explicit choice → the account the session started on (resume) → project setting → active account.

Expected behavior and edge cases

• Users with one account, or who leave the global setting off and every project on Default, see no change.
• SSH projects are never pinned, and the section is disabled there. WSL too, for now (feat(claude-accounts): launch a Claude agent on a specific managed account with --account #22691 doesn't pin WSL accounts yet); a WSL launch with a saved account is refused with an explanation rather than silently using another account.
• Paired hosts: the account travels on terminal.createAgentSession / ensureAgentSession only to hosts that advertise the new capability, so older hosts keep working unchanged.

Known limitations

• After splitting a tab whose pane was refused, the refusal message shows again once that pane is clicked (existing per-pane error behavior).
• Older paired hosts without the capability can't honor a one-time pick. On a capable host, an agent-only launch that falls back to the legacy create path uses the project's saved account instead of a one-time pick.
• The e2e spec runs on Linux CI and skips on macOS, where managed credentials live in the login Keychain that the e2e harness doesn't isolate.

Out of scope: per-worktree overrides, project-group inheritance (suggested on #6921), per-account usage bars, Codex and other agents.

Alternatives or additional context

• Workarounds today: switch the global account before each session, or point the agent command override at a wrapper script that sets CLAUDE_CONFIG_DIR from a marker file (Named agent variants (own command + own account), selectable per pane — Claude has no equivalent of codex-pane-accounts.json #15592). The wrapper bypasses Orca's managed accounts and the UI can't show which account a pane uses.
• Why per project: work vs. personal splits follow the repository; per worktree was called "excessive" in [Feature] Multiple AI Account, Per Project? #5635's discussion.
• How this differs from open issues:
  • [Feature]: Per-worktree account pinning — run different Claude/Codex accounts concurrently #9496 asks for per-worktree pinning or a picker on every launch. This is project-level, with a one-time prompt and a remembered choice.
  • [Feature]: Per-project default agent, and open it (not a terminal) when selecting an empty workspace #22932 asks for a per-project default agent. This is which account that agent uses. They'd fit together in Settings → Repository.
• Implementation: I have a working, tested implementation stacked on feat(claude-accounts): launch a Claude agent on a specific managed account with --account #22691 (PR to follow and linked here). It depends on feat(claude-accounts): launch a Claude agent on a specific managed account with --account #22691 landing first.
• Related: [Feature] Different Claude Accounts for different projects #5203, [Feature]: Per-worktree Claude account binding (concurrent multi-account + per-project defaults) #6921 / feat: per-worktree Claude account binding (concurrent multi-account) #6963, [Feature]: Select the Claude account for headless/agent spawns via CLI (--account / orca account list) #8770, [Feature]: Per-worktree account pinning — run different Claude/Codex accounts concurrently #9496, [Bug]: Create-worktree GitHub issue/PR search ignores directory-scoped GH_TOKEN (direnv) and uses the globally active gh account #13612 / feat(github): bind projects to a specific gh account #13664, [Feature]: Per-pane managed accounts for Claude (Codex parity) instead of in-place credential swapping of the default CLAUDE_CONFIG_DIR #14254, [Bug]: Active Claude managed account is materialized into the user's default CLAUDE_CONFIG_DIR — sessions launched outside Orca bill the selected account #16016, feat(agents): launch profiles — run one agent under several credential homes or providers at once #18674, feat(claude-accounts): launch a Claude agent on a specific managed account with --account #22691, [Feature]: Per-project default agent, and open it (not a terminal) when selecting an empty workspace #22932.