claude-multiacc 1.0.7 → 1.0.8

package/tests/run-tests.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
-# claude-multiacc sandboxed test suite.
-# No network, no real accounts, no quota: fake `claude` binary + file:// usage fixtures.
+# claude-multiacc sandboxed test suite — covers BOTH providers (claude + codex).
+# No network, no real accounts, no quota: fake `claude`/`codex` binaries + file://
+# usage/token fixtures.
 set -u
 
 REPO_DIR="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -88,6 +89,12 @@ export CLAUDE_MULTIACC_MIN_FETCH=0
 # The oauth token endpoint must NEVER be hit for real from tests: default to a missing
 # file:// fixture (refresh fails fast, offline); the refresh tests override per-case.
 export CLAUDE_MULTIACC_TOKEN_URL="file://$WORK/token-endpoint-missing.json"
+# Same for the usage endpoint: the SHIM's opportunistic background `limits --quiet`
+# kick inherits this default, so it can never reach a real endpoint from tests
+# (every explicit limits test overrides the URL inline). The pre-armed .limits-kick
+# throttle keeps those background kicks from racing explicit limits runs.
+export CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-endpoint-missing.json"
+: > "$ACC/.limits-kick"
 
 now="$(date +%s)"
 
@@ -1245,6 +1252,788 @@ else
   t_ok "npm-layer tests skipped (node not installed)"
 fi
 
+# ============================ CODEX PROVIDER =====================================
+# The codex pool (bin/codex + bin/codex-accounts + lib/codex_audit.py) is separate
+# code over separate state (~/.codex-accounts), so it gets its own sandboxed pass:
+# fake `codex` binary, JWT-shaped auth fixtures, file:// usage/token endpoints.
+
+export CODEX_ACCOUNTS_DIR="$WORK/codex-accounts"
+CX="$CODEX_ACCOUNTS_DIR"
+mkdir -p "$CX/tmp"
+unset CODEX_HOME CODEX_ACCOUNT CODEX_SHIM_ACTIVE 2>/dev/null || true
+export CODEX_MULTIACC_NO_SYNC=1
+export CODEX_MULTIACC_MIN_FETCH=0
+export CODEX_MULTIACC_TOKEN_URL="file://$WORK/cx-token-endpoint-missing.json"
+# Default usage URL is an offline missing fixture: the SHIM's opportunistic
+# background `limits --quiet` kick must never reach a real endpoint from tests
+# (each limits test overrides the URL inline). The pre-armed .limits-kick throttle
+# below keeps those background kicks from racing the explicit limits runs at all.
+export CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-endpoint-missing.json"
+export CODEX_MULTIACC_FORCE_TTY=1
+export FAKE_CTL2="$WORK/ctl2"
+: > "$CX/.limits-kick"
+
+# Codex auth fixtures are real-shaped: auth.json carrying JWTs whose exp/email
+# claims the audit decodes offline (exactly what the CLI does).
+MKAUTH="$WORK/mk_cx_auth.py"
+cat > "$MKAUTH" <<'EOF'
+import base64, json, sys
+def jwt(claims):
+    enc = lambda o: base64.urlsafe_b64encode(json.dumps(o).encode()).rstrip(b'=').decode()
+    return f"{enc({'alg':'RS256'})}.{enc(claims)}.sig"
+path, email, exp, mode = sys.argv[1], sys.argv[2], float(sys.argv[3]), (sys.argv[4] if len(sys.argv) > 4 else '')
+if mode == 'apikey':
+    doc = {"auth_mode": "apikey", "OPENAI_API_KEY": "sk-test-api-key", "tokens": None, "last_refresh": None}
+else:
+    auth_claim = {"chatgpt_plan_type": "pro", "chatgpt_account_id": "acct-uuid"}
+    tokens = {
+        "id_token": jwt({"email": email, "exp": exp, "https://api.openai.com/auth": auth_claim}),
+        "access_token": jwt({"exp": exp, "https://api.openai.com/auth": auth_claim}),
+        "refresh_token": "rt-" + email,
+        "account_id": "acct-uuid",
+    }
+    if mode == 'norefresh':
+        tokens.pop('refresh_token')
+    doc = {"auth_mode": "chatgpt", "OPENAI_API_KEY": None, "tokens": tokens,
+           "last_refresh": "2026-01-01T00:00:00Z"}
+json.dump(doc, open(path, 'w'))
+EOF
+export MKAUTH
+mk_cx_auth() { python3 "$MKAUTH" "$@"; }
+FUTURE_EXP=$((now + 864000))
+
+# Fake "real" codex: prints which CODEX_HOME it ran under; scriptable login +
+# failures via a control file. (Note: must not contain the hyphenated shim marker.)
+cat > "$FAKEBIN/codex" <<EOF
+#!/usr/bin/env bash
+# fake real codex for tests (not a shim)
+if [ "\${1:-}" = "login" ]; then
+  shift
+  # record the flags the CLI chose (device-auth default vs --browser opt-out)
+  printf '%s\n' "\$*" > "\${FAKE_LOGIN_ARGS:-/dev/null}" 2>/dev/null || true
+  [ -n "\${FAKE_LOGIN_FAIL:-}" ] && { echo "login aborted" >&2; exit 1; }
+  # simulate a completed ChatGPT sign-in: write a JWT-shaped auth.json
+  python3 "\$MKAUTH" "\${CODEX_HOME:-/dev/null}/auth.json" "\${FAKE_EMAIL:-fake@test}" "\$(( \$(date +%s) + 864000 ))"
+  echo "Successfully logged in"
+  exit 0
+fi
+ctl="\${FAKE_CTL2:-/nonexistent}"
+acct="\$(basename "\${CODEX_HOME:-none}")"
+if [ -f "\$ctl" ] && grep -qx "fail:\$acct" "\$ctl" 2>/dev/null; then
+  echo "ERROR: 429 Too Many Requests — you have hit your usage limit" >&2
+  exit 1
+fi
+if [ -f "\$ctl" ] && grep -qx "authfail:\$acct" "\$ctl" 2>/dev/null; then
+  echo "Error: token expired. Please run codex login again" >&2
+  exit 1
+fi
+if [ -f "\$ctl" ] && grep -qx "orgfail:\$acct" "\$ctl" 2>/dev/null; then
+  echo "Codex has been disabled by your workspace admin"
+  exit 1
+fi
+outfile=""
+prev=""
+for a in "\$@"; do
+  case "\$prev" in -o|--output-last-message) outfile="\$a" ;; esac
+  case "\$a" in
+    --exit7) echo "ordinary failure, not auth related" >&2; exit 7 ;;
+    --echo-stdin) cat; exit 0 ;;
+  esac
+  prev="\$a"
+done
+[ -n "\$outfile" ] && printf 'OK' > "\$outfile"
+echo "CFG=\$acct"
+EOF
+chmod +x "$FAKEBIN/codex"
+
+# ---- C1. passthrough: no manifest yet ---------------------------------------------
+out="$(codex 2>&1)"
+check "codex: passthrough without manifest" "CFG=none" "$out"
+
+# ---- codex manifest + two chatgpt accounts ----------------------------------------
+cat > "$CX/accounts.json" <<EOF
+{
+  "version": 1,
+  "server": "root@203.0.113.1",
+  "server_root": "/root/.codex-accounts",
+  "server_repo": "/root/claude-multiacc",
+  "threshold": 90,
+  "accounts": [
+    {"id": "acct-01", "email": "a@cx", "home": "mac", "added_at": "2026-08-21T00:00:00Z"},
+    {"id": "acct-02", "email": "b@cx", "home": "mac", "added_at": "2026-08-21T00:00:00Z"}
+  ]
+}
+EOF
+for i in 01 02; do
+  mkdir -p "$CX/acct-$i"
+done
+mk_cx_auth "$CX/acct-01/auth.json" a@cx "$FUTURE_EXP"
+mk_cx_auth "$CX/acct-02/auth.json" b@cx "$FUTURE_EXP"
+
+# ---- C2. passthrough guards --------------------------------------------------------
+out="$(CODEX_HOME=/tmp/other codex 2>&1)"
+check "codex: passthrough with CODEX_HOME" "CFG=other" "$out"
+out="$(CODEX_MULTIACC_DISABLE=1 codex 2>&1)"
+check "codex: passthrough when disabled" "CFG=none" "$out"
+
+# ---- C3. headroom selection --------------------------------------------------------
+cxlj() { printf '{"fetched_at":%s,"weekly_percent":%s,"session_percent":%s,"max_percent":%s,"buckets":[]}' "$now" "$1" "$2" "$3"; }
+cxlj 80 10 80 > "$CX/acct-01/limits.json"
+cxlj 20 10 20 > "$CX/acct-02/limits.json"
+all2=1
+for _ in $(seq 1 15); do
+  case "$(codex 2>&1)" in *CFG=acct-02*) ;; *) all2=0 ;; esac
+done
+[ "$all2" = "1" ] && t_ok "codex: picks the highest weekly-headroom account" \
+  || t_fail "codex headroom selection" "picked the more-utilized account"
+# high session must NOT beat better weekly headroom
+cxlj 10 85 85 > "$CX/acct-01/limits.json"
+cxlj 70 20 70 > "$CX/acct-02/limits.json"
+all1=1
+for _ in $(seq 1 15); do
+  case "$(codex 2>&1)" in *CFG=acct-01*) ;; *) all1=0 ;; esac
+done
+[ "$all1" = "1" ] && t_ok "codex: high session does NOT beat better weekly headroom" \
+  || t_fail "codex weekly-over-session" "ranked the account with less weekly headroom higher"
+# equal scores spread load
+cxlj 10 10 10 > "$CX/acct-01/limits.json"
+cxlj 10 10 10 > "$CX/acct-02/limits.json"
+hits1=0; hits2=0
+for _ in $(seq 1 40); do
+  case "$(codex 2>&1)" in
+    *CFG=acct-01*) hits1=$((hits1+1)) ;;
+    *CFG=acct-02*) hits2=$((hits2+1)) ;;
+  esac
+done
+{ [ "$hits1" -gt 0 ] && [ "$hits2" -gt 0 ] && [ $((hits1+hits2)) -eq 40 ]; } \
+  && t_ok "codex: equal scores spread randomly (acct-01=$hits1 acct-02=$hits2)" \
+  || t_fail "codex tie spreading" "acct-01=$hits1 acct-02=$hits2 (want both >0, total 40)"
+# stale telemetry ranks neutral, never free
+printf '{"fetched_at":1,"weekly_percent":1,"session_percent":1,"max_percent":1,"buckets":[]}' > "$CX/acct-01/limits.json"
+cxlj 30 30 30 > "$CX/acct-02/limits.json"
+out="$(codex 2>&1)"
+check "codex: stale 1% loses to fresh 30%" "CFG=acct-02" "$out"
+rm -f "$CX"/acct-*/limits.json
+
+# ---- C4. pin -----------------------------------------------------------------------
+out="$(CODEX_ACCOUNT=acct-02 codex 2>&1)"
+check "codex: CODEX_ACCOUNT pin" "CFG=acct-02" "$out"
+mkdir -p "$CX/acct-07"
+out="$(CODEX_ACCOUNT=acct-07 codex 2>&1)"
+check "codex: pin to auth-less dir (ceremony)" "CFG=acct-07" "$out"
+rmdir "$CX/acct-07"
+
+# ---- C5. limited marker excludes; pin overrides; expired marker self-clears ---------
+printf '%s\nbucket=GPT-5.3-Codex-Spark:7d percent=95 reason=limits\n' "$((now+3600))" > "$CX/acct-01/.limited"
+all2=1
+for _ in $(seq 1 15); do
+  case "$(codex 2>&1)" in *CFG=acct-02*) ;; *) all2=0 ;; esac
+done
+[ "$all2" = "1" ] && t_ok "codex: limited account excluded from pool" || t_fail "codex limited exclusion" "acct-01 was still picked"
+out="$(CODEX_ACCOUNT=acct-01 codex 2>&1)"
+check "codex: explicit pin wins over marker" "CFG=acct-01" "$out"
+printf '%s\nbucket=5h percent=95 reason=limits\n' "$((now-10))" > "$CX/acct-01/.limited"
+codex >/dev/null 2>&1
+[ ! -f "$CX/acct-01/.limited" ] && t_ok "codex: expired .limited marker self-clears" \
+  || t_fail "codex marker expiry" ".limited survived its reset time"
+
+# ---- C6. all limited -> least-utilized fallback -------------------------------------
+printf '%s\nbucket=7d percent=95 reason=limits\n' "$((now+3600))" > "$CX/acct-01/.limited"
+printf '%s\nbucket=7d percent=99 reason=limits\n' "$((now+3600))" > "$CX/acct-02/.limited"
+cxlj 95 10 95 > "$CX/acct-01/limits.json"
+cxlj 99 10 99 > "$CX/acct-02/limits.json"
+out="$(codex 2>&1)"
+check "codex: all-limited falls back to least utilized" "CFG=acct-01" "$out"
+grep -q "all-limited fallback=acct-01" "$CX/selection.log" \
+  && t_ok "codex: all-limited fallback logged" || t_fail "codex fallback log" "no all-limited line"
+rm -f "$CX"/acct-*/.limited "$CX"/acct-*/limits.json
+
+# ---- C7. dead logins: .expired excludes, heals on newer credential ------------------
+printf '%s\nreason=refresh-denied-http-400 marked_at=t detail=x\n' "$now" > "$CX/acct-01/.expired"
+all2=1
+for _ in $(seq 1 10); do
+  case "$(codex 2>&1)" in *CFG=acct-02*) ;; *) all2=0 ;; esac
+done
+[ "$all2" = "1" ] && t_ok "codex: dead login (proven park) is never selected" \
+  || t_fail "codex dead login" "a parked account was selected"
+# ...not even as the all-limited fallback
+printf '%s\nbucket=7d percent=95 reason=limits\n' "$((now+3600))" > "$CX/acct-02/.limited"
+out="$(codex 2>&1)"
+check "codex: limited-but-alive beats dead in the fallback" "CFG=acct-02" "$out"
+rm -f "$CX/acct-02/.limited"
+# a NEWER credential heals a credential-scoped park
+sleep 1
+mk_cx_auth "$CX/acct-01/auth.json" a@cx "$FUTURE_EXP"
+out="$(CODEX_SHIM_SELECT=random codex 2>&1)"
+[ ! -f "$CX/acct-01/.expired" ] && t_ok "codex: newer auth.json clears a credential park" \
+  || t_fail "codex park heal" ".expired survived a newer credential"
+# an org-blocked park survives a newer credential (policy, not credential)
+printf '%s\nreason=org-blocked marked_at=t detail=x\n' "$now" > "$CX/acct-01/.expired"
+sleep 1
+mk_cx_auth "$CX/acct-01/auth.json" a@cx "$FUTURE_EXP"
+codex >/dev/null 2>&1
+[ -f "$CX/acct-01/.expired" ] && t_ok "codex: org-blocked park survives a credential refresh" \
+  || t_fail "codex org park" "a token write cleared an org-policy park"
+rm -f "$CX/acct-01/.expired"
+# a soft-stamped park expires on its own
+printf '%s\nreason=auth-error soft_until=%s marked_at=t detail=x\n' "$now" "$((now-5))" > "$CX/acct-02/.expired"
+codex >/dev/null 2>&1
+[ ! -f "$CX/acct-02/.expired" ] && t_ok "codex: soft_until park expires on its own" \
+  || t_fail "codex soft park" "an elapsed soft park still excluded the account"
+
+# ---- C8. exec auto-retry ------------------------------------------------------------
+# acct-01 gets the strictly better score so headroom selection deterministically
+# picks it FIRST; the scripted failure then forces the retry onto acct-02.
+cx_first_01() { cxlj 5 5 5 > "$CX/acct-01/limits.json"; cxlj 20 20 20 > "$CX/acct-02/limits.json"; }
+cx_first_01
+# rate limit: retry on the other account + self-expiring cooldown for the failed one
+echo "fail:acct-01" > "$FAKE_CTL2"
+out="$(codex exec "hello" < /dev/null 2>&1)"
+case "$out" in *CFG=acct-02*) t_ok "codex: exec retries a rate-limited account on another" ;;
+  *) t_fail "codex retry" "did not land on acct-02: $out" ;; esac
+if [ -f "$CX/acct-01/.limited" ]; then
+  grep -q "error-cooldown" "$CX/acct-01/.limited" \
+    && t_ok "codex: rate-limited account got a cooldown, not a park" \
+    || t_fail "codex cooldown" "marker is not an error-cooldown"
+else
+  t_fail "codex cooldown" "no .limited cooldown written"
+fi
+rm -f "$CX/acct-01/.limited" "$FAKE_CTL2"
+# auth failure parks (soft) instead of a cooldown
+cx_first_01
+echo "authfail:acct-01" > "$FAKE_CTL2"
+codex exec "hello" < /dev/null >/dev/null 2>&1
+if [ -f "$CX/acct-01/.expired" ]; then
+  grep -q "reason=auth-error" "$CX/acct-01/.expired" && grep -q "soft_until=" "$CX/acct-01/.expired" \
+    && t_ok "codex: auth failure parks the account with a soft stamp" \
+    || t_fail "codex auth park" "marker malformed: $(cat "$CX/acct-01/.expired")"
+else
+  t_fail "codex auth park" "no .expired written after an auth failure"
+fi
+rm -f "$CX/acct-01/.expired" "$FAKE_CTL2"
+# org-disabled failure parks as org-blocked
+cx_first_01
+echo "orgfail:acct-01" > "$FAKE_CTL2"
+codex exec "hello" < /dev/null >/dev/null 2>&1
+grep -q "reason=org-blocked" "$CX/acct-01/.expired" 2>/dev/null \
+  && t_ok "codex: workspace-disabled failure parks as org-blocked" \
+  || t_fail "codex org park from run" "marker: $(cat "$CX/acct-01/.expired" 2>/dev/null || echo none)"
+rm -f "$CX/acct-01/.expired" "$FAKE_CTL2"
+# ordinary failure: exit code passes through, no retry, no marker
+out="$(codex exec --exit7 < /dev/null 2>&1)"
+rc=$?
+[ "$rc" = "7" ] && t_ok "codex: non-auth failure exit code passes through" || t_fail "codex rc passthrough" "rc=$rc"
+[ ! -f "$CX/acct-01/.limited" ] && [ ! -f "$CX/acct-02/.limited" ] \
+  && t_ok "codex: ordinary failure marks nothing" || t_fail "codex ordinary failure" "a marker appeared"
+# retry only engages for exec: a plain (interactive-style) run with a failing account
+# passes the failure straight through — no retry, no marker classification.
+printf 'fail:acct-01\nfail:acct-02\n' > "$FAKE_CTL2"
+out="$(codex "prompt" < /dev/null 2>&1)"
+rc=$?
+[ "$rc" = "1" ] && t_ok "codex: non-exec run is never retried (rc passes through)" \
+  || t_fail "codex non-exec retry" "rc=$rc"
+[ ! -f "$CX/acct-01/.limited" ] && [ ! -f "$CX/acct-02/.limited" ] \
+  && t_ok "codex: non-exec failure writes no markers" \
+  || t_fail "codex non-exec markers" "a marker appeared without the retry path"
+rm -f "$FAKE_CTL2" "$CX"/acct-*/.limited "$CX"/acct-*/.expired
+# stdin/stdout byte fidelity through the retry path
+printf 'line1\nline2\n' > "$WORK/cx-stdin.txt"
+out="$(codex exec --echo-stdin < "$WORK/cx-stdin.txt" 2>&1)"
+[ "$out" = "$(printf 'line1\nline2')" ] && t_ok "codex: stdin passes byte-identically through retry buffering" \
+  || t_fail "codex stdin fidelity" "got: $out"
+# user args survive selection
+out="$(codex exec "two words" --exit7 < /dev/null 2>&1)"
+rc=$?
+[ "$rc" = "7" ] && t_ok "codex: user args survive selection (pick_best untouched \$@)" \
+  || t_fail "codex args" "rc=$rc out=$out"
+# HOME unset: fail open into passthrough
+out="$(env -u HOME -u CODEX_ACCOUNTS_DIR PATH="$PATH" "$REPO_DIR/bin/codex" 2>&1)"
+check "codex: HOME unset fails open into passthrough" "CFG=none" "$out"
+rm -f "$CX"/acct-*/limits.json
+
+# ---- C9. selection log --------------------------------------------------------------
+grep -qE 'acct-0[12]' "$CX/selection.log" && t_ok "codex: selection.log written" \
+  || t_fail "codex selection.log" "no selections logged"
+
+# ---- C10. CLI: list / import / remove / dedupe --------------------------------------
+out="$(codex-accounts list 2>&1)"
+check "codex-accounts list shows accounts" "a@cx" "$out"
+check "codex-accounts list shows auth kind" "auth=chatgpt" "$out"
+mk_cx_auth "$WORK/cx-import.json" c@cx "$FUTURE_EXP"
+out="$(codex-accounts import c@cx --id acct-03 --auth "$WORK/cx-import.json" --no-sync 2>&1)"
+check "codex-accounts import" "Imported acct-03" "$out"
+[ -f "$CX/acct-03/auth.json" ] && t_ok "codex: imported auth.json in place" || t_fail "codex import" "auth.json missing"
+perm="$(ls -l "$CX/acct-03/auth.json" | cut -c1-10)"
+[ "$perm" = "-rw-------" ] && t_ok "codex: imported auth.json is 0600" || t_fail "codex import perms" "$perm"
+# duplicate email refused without --force / --id
+out="$(codex-accounts import c@cx --no-sync 2>&1)"
+rc=$?
+check "codex: duplicate import refused" "already registered as acct-03" "$out"
+[ "$rc" != "0" ] && t_ok "codex: duplicate import exits nonzero" || t_fail "codex dup import rc" "rc=0"
+# dedupe removes a forced duplicate, keeping the authed one
+codex-accounts import c@cx --id acct-04 --force --no-sync >/dev/null 2>&1
+out="$(codex-accounts dedupe --yes 2>&1)"
+check "codex: dedupe removes the duplicate" "Removed 1 duplicate" "$out"
+codex-accounts list 2>&1 | grep -q "acct-04" \
+  && t_fail "codex dedupe" "acct-04 still listed" || t_ok "codex: dedupe kept one entry per email"
+out="$(codex-accounts remove acct-03 --yes 2>&1)"
+check "codex-accounts remove" "Removed acct-03" "$out"
+[ ! -d "$CX/acct-03" ] && t_ok "codex: removed account dir deleted" || t_fail "codex remove" "dir still present"
+
+# ---- C11. login-first add ceremony --------------------------------------------------
+# derived email: no argument, identity read back from the sign-in
+out="$(FAKE_EMAIL=new@cx codex-accounts add 2>&1)"
+check "codex: add with no email derives it from the sign-in" "Registered acct-03 for new@cx" "$out"
+grep -q '"email": "new@cx"' "$CX/accounts.json" && t_ok "codex: derived email registered" \
+  || t_fail "codex add derive" "manifest lacks new@cx"
+# signed in as a different account than named: register who actually authenticated
+out="$(FAKE_EMAIL=other@cx codex-accounts add named@cx 2>&1)"
+check "codex: mismatched sign-in registers the real account" "registering the account that actually authenticated" "$out"
+grep -q '"email": "other@cx"' "$CX/accounts.json" && t_ok "codex: actual identity registered" \
+  || t_fail "codex add mismatch" "manifest lacks other@cx"
+codex-accounts remove acct-04 --yes >/dev/null 2>&1
+# aborted login leaves zero traces
+before="$(ls "$CX" | sort)"
+out="$(FAKE_LOGIN_FAIL=1 codex-accounts add gone@cx 2>&1)"
+rc=$?
+[ "$rc" != "0" ] && t_ok "codex: aborted login exits nonzero" || t_fail "codex abort rc" "rc=0"
+after="$(ls "$CX" | sort)"
+[ "$before" = "$after" ] && t_ok "codex: aborted login leaves zero traces" \
+  || t_fail "codex abort traces" "pool dir changed: $after"
+grep -q "gone@cx" "$CX/accounts.json" && t_fail "codex abort manifest" "gone@cx registered" \
+  || t_ok "codex: aborted login registered nothing"
+# adding an already-registered email skips before sign-in
+out="$(codex-accounts add a@cx 2>&1)"
+rc=$?
+check "codex: add of registered email skips gracefully" "already added as acct-01" "$out"
+[ "$rc" = "0" ] && t_ok "codex: duplicate add exits 0 (no-op)" || t_fail "codex dup add rc" "rc=$rc"
+# signing in AS an already-registered email (unnamed) also refuses a second entry
+out="$(FAKE_EMAIL=a@cx codex-accounts add 2>&1)"
+check "codex: sign-in as registered email refused" "already added as acct-01" "$out"
+n="$(grep -c '"email": "a@cx"' "$CX/accounts.json")"
+[ "$n" = "1" ] && t_ok "codex: no second entry for a re-signed-in email" || t_fail "codex dup signin" "count=$n"
+
+# ---- C12. login command + expired worklist + relogin --------------------------------
+# an account with no auth on this machine: login completes it
+codex-accounts import d@cx --id acct-04 --no-sync >/dev/null 2>&1
+out="$(codex-accounts expired 2>&1)"
+rc=$?
+check "codex: expired lists the auth-less account" "acct-04" "$out"
+[ "$rc" != "0" ] && t_ok "codex: expired exits 1 when a human is needed" || t_fail "codex expired rc" "rc=0"
+out="$(FAKE_EMAIL=d@cx codex-accounts login acct-04 2>&1)"
+check "codex: login completes an auth-less account" "login saved" "$out"
+[ -s "$CX/acct-04/auth.json" ] && t_ok "codex: login wrote auth.json" || t_fail "codex login" "no auth.json"
+# wrong sign-in identity is refused AND the prior credential is restored — the wrong
+# account's auth.json must never stay installed under this id (codex-review finding)
+out="$(FAKE_EMAIL=wrong@cx codex-accounts login acct-04 2>&1)"
+rc=$?
+check "codex: login refuses a wrong-account sign-in" "you signed in as wrong@cx" "$out"
+[ "$rc" != "0" ] && t_ok "codex: wrong-identity login exits nonzero" || t_fail "codex login identity rc" "rc=0"
+got_email="$(python3 - "$CX/acct-04/auth.json" <<'EOF'
+import base64, json, sys
+t = json.load(open(sys.argv[1]))['tokens']['id_token']
+p = t.split('.')[1]; p += '=' * (-len(p) % 4)
+print(json.loads(base64.urlsafe_b64decode(p)).get('email', ''))
+EOF
+)"
+[ "$got_email" = "d@cx" ] && t_ok "codex: refused login restores the prior credential" \
+  || t_fail "codex login restore" "auth.json now belongs to: $got_email"
+# the sign-in ceremony is DEVICE-CODE by default (the localhost browser callback
+# cannot reach a remote/SSH machine); --browser opts into the callback flow
+export FAKE_LOGIN_ARGS="$WORK/cx-login-args"
+: > "$FAKE_LOGIN_ARGS"
+FAKE_EMAIL=d@cx codex-accounts login acct-04 >/dev/null 2>&1
+rc=$?
+{ [ "$rc" = "0" ] && [ "$(cat "$FAKE_LOGIN_ARGS")" = "--device-auth" ]; } \
+  && t_ok "codex: sign-in uses the device-code flow by default" \
+  || t_fail "codex device default" "rc=$rc login args: '$(cat "$FAKE_LOGIN_ARGS")'"
+: > "$FAKE_LOGIN_ARGS"
+FAKE_EMAIL=d@cx codex-accounts login acct-04 --browser >/dev/null 2>&1
+rc=$?
+{ [ "$rc" = "0" ] && [ "$(cat "$FAKE_LOGIN_ARGS")" = "" ]; } \
+  && t_ok "codex: --browser opts into the localhost callback flow" \
+  || t_fail "codex --browser opt-out" "rc=$rc login args: '$(cat "$FAKE_LOGIN_ARGS")'"
+unset FAKE_LOGIN_ARGS
+
+# a parked account shows in expired and relogin fixes exactly that
+printf '%s\nreason=refresh-denied-http-400 marked_at=t detail=x\n' "$now" > "$CX/acct-04/.expired"
+out="$(codex-accounts expired 2>&1)"
+check "codex: expired shows the parked account" "acct-04" "$out"
+out="$(FAKE_EMAIL=d@cx codex-accounts relogin --yes 2>&1)"
+check "codex: relogin re-authenticates the worklist" "re-authenticated 1 of 1" "$out"
+[ ! -f "$CX/acct-04/.expired" ] && t_ok "codex: relogin cleared the park" || t_fail "codex relogin" "park survived"
+# a relogin whose ceremony fails is NOT reported fixed: the dead credential stays
+# on disk, and success is judged by whether the credential can AUTHENTICATE.
+mk_cx_auth "$CX/acct-04/auth.json" d@cx 1000 norefresh
+out="$(FAKE_LOGIN_FAIL=1 FAKE_EMAIL=d@cx codex-accounts relogin --yes 2>&1)"
+rc=$?
+check "codex: failed relogin says still failing" "still failing" "$out"
+[ "$rc" != "0" ] && t_ok "codex: failed relogin exits nonzero" || t_fail "codex failed relogin rc" "rc=0"
+out="$(codex-accounts expired 2>&1)"
+check "codex: the un-fixed account is still on the worklist" "acct-04" "$out"
+# api-key-only auth is not subscription auth: audited as unusable, never selected
+mk_cx_auth "$CX/acct-04/auth.json" d@cx "$FUTURE_EXP" apikey
+out="$(codex-accounts expired 2>&1)"
+check "codex: api-key auth is called out as unsupported" "API key" "$out"
+out="$(CODEX_SHIM_SELECT=random codex 2>&1)"
+case "$out" in *CFG=acct-04*) t_fail "codex apikey selection" "api-key account was selected" ;;
+  *) t_ok "codex: api-key account is never selected" ;; esac
+codex-accounts remove acct-04 --yes >/dev/null 2>&1
+
+# ---- C13. limits: fixture endpoint, marking, classification -------------------------
+: > "$CX/.limits-kick"   # re-arm the shim-kick throttle: no background limits racing these
+cat > "$WORK/cx-usage-high.json" <<EOF
+{"email":"a@cx","plan_type":"pro",
+ "rate_limit":{"allowed":true,"limit_reached":false,
+   "primary_window":{"used_percent":42,"limit_window_seconds":18000,"reset_at":$((now+3600))},
+   "secondary_window":{"used_percent":57,"limit_window_seconds":604800,"reset_at":$((now+90000))}},
+ "code_review_rate_limit":null,
+ "additional_rate_limits":[
+   {"limit_name":"GPT-5.3-Codex-Spark","rate_limit":{"allowed":true,"limit_reached":false,
+     "primary_window":{"used_percent":12,"limit_window_seconds":18000,"reset_at":$((now+3600))},
+     "secondary_window":{"used_percent":95,"limit_window_seconds":604800,"reset_at":$((now+90000))}}}]}
+EOF
+out="$(CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-high.json" codex-accounts limits 2>&1)"
+check "codex: >=90% model bucket marks the account" "LIMITED GPT-5.3-Codex-Spark:7d at 95%" "$out"
+[ -f "$CX/acct-01/.limited" ] && t_ok "codex: .limited marker written" || t_fail "codex limits marker" "missing"
+IFS= read -r first < "$CX/acct-01/.limited"
+[ "$first" = "$((now+90000))" ] && t_ok "codex: marker carries the offender's reset epoch" \
+  || t_fail "codex marker reset" "first line: $first"
+python3 - "$CX/acct-01/limits.json" <<'EOF'
+import json, sys
+d = json.load(open(sys.argv[1]))
+assert d['max_percent'] == 95, d['max_percent']
+assert d['weekly_percent'] == 95, d['weekly_percent']
+assert d['session_percent'] == 42, d['session_percent']
+names = {b['name']: (b['group'], b['percent']) for b in d['buckets']}
+assert names['5h'] == ('session', 42), names
+assert names['7d'] == ('weekly', 57), names
+assert names['GPT-5.3-Codex-Spark:5h'] == ('session', 12), names
+assert names['GPT-5.3-Codex-Spark:7d'] == ('weekly', 95), names
+EOF
+[ $? -eq 0 ] && t_ok "codex: buckets classified session/weekly with per-model names" \
+  || t_fail "codex bucket classification" "see assertions"
+# below-threshold refresh clears the marker
+cat > "$WORK/cx-usage-low.json" <<EOF
+{"email":"a@cx","plan_type":"pro",
+ "rate_limit":{"allowed":true,"limit_reached":false,
+   "primary_window":{"used_percent":5,"limit_window_seconds":18000,"reset_at":$((now+3600))},
+   "secondary_window":{"used_percent":9,"limit_window_seconds":604800,"reset_at":$((now+90000))}},
+ "additional_rate_limits":[]}
+EOF
+out="$(CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-low.json" codex-accounts limits 2>&1)"
+check "codex: below-threshold refresh clears the marker" "marker cleared" "$out"
+[ ! -f "$CX/acct-01/.limited" ] && t_ok "codex: marker gone after clean pass" || t_fail "codex marker clear" "still present"
+# a hard limit_reached verdict excludes even when no window is >= threshold
+cat > "$WORK/cx-usage-blocked.json" <<EOF
+{"email":"a@cx","plan_type":"pro",
+ "rate_limit":{"allowed":false,"limit_reached":true,
+   "primary_window":{"used_percent":50,"limit_window_seconds":18000,"reset_at":$((now+3600))}}}
+EOF
+out="$(CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-blocked.json" codex-accounts limits 2>&1)"
+check "codex: limit_reached without a >=90% window still marks" "LIMITED limit_reached at 100%" "$out"
+rm -f "$CX"/acct-*/.limited
+# reshaped payload: windows are still found by the recursive fallback
+cat > "$WORK/cx-usage-reshaped.json" <<EOF
+{"totally":{"new":{"shape":{"used_percent":97,"limit_window_seconds":604800,"reset_at":$((now+90000))}}}}
+EOF
+out="$(CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-reshaped.json" codex-accounts limits 2>&1)"
+check "codex: reshaped payload still tracked (fallback walk)" "LIMITED" "$out"
+rm -f "$CX"/acct-*/.limited
+# garbage payload degrades that account only, never the run
+printf 'this is not json' > "$WORK/cx-usage-garbage.json"
+out="$(CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-garbage.json" codex-accounts limits 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "codex: garbage payload fails open (rc=0)" || t_fail "codex garbage rc" "rc=$rc"
+check "codex: garbage payload logged as failure" "usage fetch failed" "$out"
+# fetch throttle: fresh data is not re-fetched
+out="$(CODEX_MULTIACC_MIN_FETCH=9999 CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-low.json" codex-accounts limits 2>&1)"
+printf '%s' "$out" | grep -q "acct-01" \
+  && t_fail "codex fetch throttle" "fresh account was re-fetched: $out" \
+  || t_ok "codex: fresh account skipped by the fetch throttle"
+# 429 backoff honored
+python3 - "$CX/acct-02/limits.json" "$now" <<'EOF'
+import json, sys
+json.dump({'fetched_at': 0, 'retry_after': int(sys.argv[2]) + 300, 'backoff': 120},
+          open(sys.argv[1], 'w'))
+EOF
+out="$(CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-low.json" codex-accounts limits 2>&1)"
+check "codex: 429 backoff honored" "acct-02: backing off after 429" "$out"
+rm -f "$CX"/acct-*/limits.json
+
+# ---- C14. oauth refresh via the token endpoint --------------------------------------
+# expired bearer, missing endpoint: fail open with backoff
+mk_cx_auth "$CX/acct-01/auth.json" a@cx 1000
+out="$(CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-low.json" codex-accounts limits 2>&1)"
+rc=$?
+check "codex: failed oauth refresh logged with backoff" "acct-01: oauth refresh failed" "$out"
+check "codex: expired bearer logged, not fatal" "acct-01: no fresh bearer" "$out"
+[ "$rc" = "0" ] && t_ok "codex: limits exits 0 with an expired-bearer account" || t_fail "codex refresh rc" "rc=$rc"
+[ -f "$CX/acct-01/.oauth-refresh.json" ] && t_ok "codex: refresh failure recorded for backoff" \
+  || t_fail "codex refresh backoff file" "missing"
+# a now-working endpoint is not retried inside the backoff window
+python3 - "$WORK/cx-token-ok.json" "$((now + 864000))" <<'EOF'
+import base64, json, sys
+def jwt(claims):
+    enc = lambda o: base64.urlsafe_b64encode(json.dumps(o).encode()).rstrip(b'=').decode()
+    return f"{enc({'alg':'RS256'})}.{enc(claims)}.sig"
+exp = float(sys.argv[2])
+auth_claim = {"chatgpt_plan_type": "pro", "chatgpt_account_id": "acct-uuid"}
+json.dump({"access_token": jwt({"exp": exp, "https://api.openai.com/auth": auth_claim, "marker": "REFRESHED"}),
+           "refresh_token": "rt-rotated-new",
+           "id_token": jwt({"email": "a@cx", "exp": exp, "https://api.openai.com/auth": auth_claim})},
+          open(sys.argv[1], 'w'))
+EOF
+out="$(CODEX_MULTIACC_TOKEN_URL="file://$WORK/cx-token-ok.json" CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-low.json" codex-accounts limits 2>&1)"
+check "codex: refresh backoff honored (no early retry)" "acct-01: no fresh bearer" "$out"
+grep -q "rt-rotated-new" "$CX/acct-01/auth.json" \
+  && t_fail "codex backoff" "auth.json rewritten inside the backoff window" \
+  || t_ok "codex: no refresh inside the backoff window"
+# --force refreshes: rotated tokens persisted 0600, telemetry follows
+out="$(CODEX_MULTIACC_TOKEN_URL="file://$WORK/cx-token-ok.json" CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-low.json" codex-accounts limits --force 2>&1)"
+check "codex: --force refreshes the expired token" "acct-01: access token refreshed" "$out"
+check "codex: refreshed account fetches telemetry" "acct-01: ok" "$out"
+python3 - "$CX/acct-01/auth.json" <<'EOF'
+import base64, json, os, stat, sys
+doc = json.load(open(sys.argv[1]))
+t = doc['tokens']
+payload = t['access_token'].split('.')[1]
+payload += '=' * (-len(payload) % 4)
+claims = json.loads(base64.urlsafe_b64decode(payload))
+assert claims.get('marker') == 'REFRESHED', 'access token not replaced'
+assert t['refresh_token'] == 'rt-rotated-new', 'refresh token not rotated'
+assert doc.get('last_refresh', '').startswith('20'), 'last_refresh not stamped'
+mode = stat.S_IMODE(os.stat(sys.argv[1]).st_mode)
+assert mode == 0o600, oct(mode)
+EOF
+[ $? -eq 0 ] && t_ok "codex: rotated credential persisted with 0600" || t_fail "codex rotation" "see assertions"
+[ ! -f "$CX/acct-01/.oauth-refresh.json" ] && t_ok "codex: successful refresh clears the backoff file" \
+  || t_fail "codex refresh clear" "backoff file still present"
+grep -q "rt-rotated-new" "$CX/limits.log" \
+  && t_fail "codex token leak" "a refresh token leaked into limits.log" \
+  || t_ok "codex: limits.log leaks no tokens"
+# recently-expired token is left alone (a live codex session may own it) — even --force
+mk_cx_auth "$CX/acct-01/auth.json" a@cx "$((now - 100))"
+cp "$CX/acct-01/auth.json" "$WORK/cx-recent.bak"
+rm -f "$CX/acct-01/limits.json" "$CX/acct-01/.oauth-refresh.json"
+out="$(CODEX_MULTIACC_TOKEN_URL="file://$WORK/cx-token-ok.json" CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-low.json" codex-accounts limits --force 2>&1)"
+check "codex: recently-expired token not refreshed (even --force)" "acct-01: no fresh bearer" "$out"
+cmp -s "$CX/acct-01/auth.json" "$WORK/cx-recent.bak" \
+  && t_ok "codex: recently-expired credential left untouched" \
+  || t_fail "codex refresh gate" "credential rewritten inside the 5-min grace window"
+# no refresh token at all: parked with a clear reason
+mk_cx_auth "$CX/acct-01/auth.json" a@cx 1000 norefresh
+rm -f "$CX/acct-01/limits.json" "$CX/acct-01/.oauth-refresh.json"
+out="$(CODEX_MULTIACC_TOKEN_URL="file://$WORK/cx-token-ok.json" CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-low.json" codex-accounts limits --force 2>&1)"
+grep -q "reason=no-refresh-token" "$CX/acct-01/.expired" 2>/dev/null \
+  && t_ok "codex: refreshless expired credential is parked" \
+  || t_fail "codex no-refresh park" "no marker written"
+# a later successful authenticated fetch unparks it
+mk_cx_auth "$CX/acct-01/auth.json" a@cx "$FUTURE_EXP"
+rm -f "$CX/acct-01/limits.json"
+out="$(CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-low.json" codex-accounts limits --force 2>&1)"
+[ ! -f "$CX/acct-01/.expired" ] && t_ok "codex: a successful usage fetch clears the dead-auth marker" \
+  || t_fail "codex unpark" ".expired survived an authenticated fetch"
+# ...but never an org-blocked park (telemetry proves nothing about workspace policy)
+printf '%s\nreason=org-blocked marked_at=t detail=x\n' "$now" > "$CX/acct-01/.expired"
+rm -f "$CX/acct-01/limits.json"
+CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-low.json" codex-accounts limits --force >/dev/null 2>&1
+[ -f "$CX/acct-01/.expired" ] && t_ok "codex: a usage fetch does not unpark an org-blocked account" \
+  || t_fail "codex org unpark" "telemetry cleared an org block it cannot observe"
+rm -f "$CX/acct-01/.expired"
+# a 4xx from the token endpoint must not park the pool; invalid_grant is proof
+port=""
+python3 "$srv_script" > "$WORK/cx-token-port" 2>/dev/null &
+cx_srv_pid=$!
+for _ in $(seq 1 20); do
+  port="$(head -1 "$WORK/cx-token-port" 2>/dev/null)"
+  case "$port" in ''|*[!0-9]*) port=""; sleep 0.2 ;; *) break ;; esac
+done
+if [ -z "$port" ]; then
+  kill "$cx_srv_pid" 2>/dev/null; wait "$cx_srv_pid" 2>/dev/null || true
+  t_ok "codex: token-endpoint 4xx tests skipped (cannot bind a loopback port here)"
+else
+  mk_cx_stale() {
+    mk_cx_auth "$CX/acct-01/auth.json" a@cx 1000
+    rm -f "$CX/acct-01/limits.json" "$CX/acct-01/.oauth-refresh.json" "$CX/acct-01/.expired"
+  }
+  mk_cx_stale
+  CODEX_MULTIACC_TOKEN_URL="http://127.0.0.1:$port/boom" CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-low.json" codex-accounts limits --force >/dev/null 2>&1
+  [ ! -f "$CX/acct-01/.expired" ] && t_ok "codex: one opaque 4xx does not park an account" \
+    || t_fail "codex 4xx park" "a single non-invalid_grant 400 parked the account"
+  CODEX_MULTIACC_TOKEN_URL="http://127.0.0.1:$port/boom" CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-low.json" codex-accounts limits --force >/dev/null 2>&1
+  CODEX_MULTIACC_TOKEN_URL="http://127.0.0.1:$port/boom" CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-low.json" codex-accounts limits --force >/dev/null 2>&1
+  [ -f "$CX/acct-01/.expired" ] && t_ok "codex: a repeatedly-refused grant is parked on the third strike" \
+    || t_fail "codex 4xx strikes" "still not parked after three refusals"
+  mk_cx_stale
+  CODEX_MULTIACC_TOKEN_URL="http://127.0.0.1:$port/invalid-grant" CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-low.json" codex-accounts limits --force >/dev/null 2>&1
+  grep -q "invalid_grant" "$CX/acct-01/.expired" 2>/dev/null \
+    && t_ok "codex: invalid_grant parks the account immediately" \
+    || t_fail "codex invalid_grant" "no marker for an explicit invalid_grant"
+  kill "$cx_srv_pid" 2>/dev/null; wait "$cx_srv_pid" 2>/dev/null || true
+fi
+mk_cx_auth "$CX/acct-01/auth.json" a@cx "$FUTURE_EXP"
+rm -f "$CX/acct-01/.expired" "$CX/acct-01/.oauth-refresh.json" "$CX"/acct-*/limits.json
+# malformed tokens object (null) degrades that account only
+cp "$CX/acct-01/auth.json" "$WORK/cx-auth01.bak"
+printf '{"auth_mode":"chatgpt","tokens": null}' > "$CX/acct-01/auth.json"
+out="$(CODEX_MULTIACC_TOKEN_URL="file://$WORK/cx-token-ok.json" CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-low.json" codex-accounts limits --force 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "codex: null tokens object fails open (rc=0)" || t_fail "codex null tokens rc" "rc=$rc"
+check "codex: null tokens degrades only that account" "acct-01: no fresh bearer" "$out"
+[ -f "$CX/acct-02/limits.json" ] && t_ok "codex: accounts after a malformed one still refresh" \
+  || t_fail "codex fail-open loop" "acct-02 starved by acct-01's malformed auth"
+cp "$WORK/cx-auth01.bak" "$CX/acct-01/auth.json"
+rm -f "$CX"/acct-*/limits.json
+
+# refresh is not attempted at all when the rotated credential could not be persisted
+# (the grant rotates the refresh token — consuming it and then failing to write
+# auth.json would strand the account; codex-review finding)
+mk_cx_auth "$CX/acct-01/auth.json" a@cx 1000
+rm -f "$CX/acct-01/limits.json" "$CX/acct-01/.oauth-refresh.json"
+chmod 500 "$CX/acct-01"
+out="$(CODEX_MULTIACC_TOKEN_URL="file://$WORK/cx-token-ok.json" CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-low.json" codex-accounts limits --force 2>&1)"
+chmod 700 "$CX/acct-01"
+check "codex: unpersistable credential skips the refresh grant" "refresh not attempted" "$out"
+grep -q "rt-rotated-new" "$CX/acct-01/auth.json" \
+  && t_fail "codex refresh preflight" "the grant was consumed despite an unwritable dir" \
+  || t_ok "codex: refresh grant not consumed when persistence would fail"
+mk_cx_auth "$CX/acct-01/auth.json" a@cx "$FUTURE_EXP"
+rm -f "$CX/acct-01/.oauth-refresh.json"
+
+# two parallel imports get distinct ids and both land in the manifest (lock coverage;
+# codex-review finding)
+codex-accounts import p1@cx --no-sync >/dev/null 2>&1 &
+imp1=$!
+codex-accounts import p2@cx --no-sync >/dev/null 2>&1 &
+imp2=$!
+wait "$imp1"; wait "$imp2"
+n1="$(grep -c '"email": "p1@cx"' "$CX/accounts.json")"
+n2="$(grep -c '"email": "p2@cx"' "$CX/accounts.json")"
+id1="$(python3 -c "import json,sys; print(next((a['id'] for a in json.load(open('$CX/accounts.json'))['accounts'] if a['email']=='p1@cx'), ''))")"
+id2="$(python3 -c "import json,sys; print(next((a['id'] for a in json.load(open('$CX/accounts.json'))['accounts'] if a['email']=='p2@cx'), ''))")"
+{ [ "$n1" = "1" ] && [ "$n2" = "1" ] && [ -n "$id1" ] && [ -n "$id2" ] && [ "$id1" != "$id2" ]; } \
+  && t_ok "codex: parallel imports get distinct ids ($id1, $id2)" \
+  || t_fail "codex parallel import" "p1=$n1($id1) p2=$n2($id2)"
+codex-accounts remove "$id1" --yes >/dev/null 2>&1
+codex-accounts remove "$id2" --yes >/dev/null 2>&1
+
+# ---- C15. verify --------------------------------------------------------------------
+out="$(codex-accounts verify --quick 2>&1)"
+check "codex: verify --quick passes chatgpt accounts" "acct-01 a@cx: OK" "$out"
+check "codex: verify --quick counts" "0 failure(s)" "$out"
+out="$(codex-accounts verify 2>&1)"
+check "codex: full verify PASS via the real-call matrix" "acct-01 a@cx: PASS" "$out"
+check "codex: full verify zero failures" "0 failure(s)" "$out"
+# verify parks a dead login it discovers, and a PASS clears an existing park
+echo "authfail:acct-02" > "$FAKE_CTL2"
+printf '%s\nreason=auth-error marked_at=t detail=x\n' "$now" > "$CX/acct-01/.expired"
+out="$(codex-accounts verify 2>&1)"
+check "codex: verify flags the dead login" "acct-02 b@cx: FAIL" "$out"
+check "codex: verify says what fixes it" "codex-accounts relogin acct-02" "$out"
+grep -q "reason=auth-error" "$CX/acct-02/.expired" 2>/dev/null \
+  && t_ok "codex: verify parks the dead login" || t_fail "codex verify park" "no marker"
+[ ! -f "$CX/acct-01/.expired" ] && t_ok "codex: a verify PASS clears an existing park" \
+  || t_fail "codex verify unpark" "PASS left the marker in place"
+rm -f "$FAKE_CTL2" "$CX/acct-02/.expired"
+# an org-disabled account is parked as org-blocked
+echo "orgfail:acct-02" > "$FAKE_CTL2"
+out="$(codex-accounts verify 2>&1)"
+check "codex: verify calls out the workspace block" "ORG BLOCKED" "$out"
+grep -q "reason=org-blocked" "$CX/acct-02/.expired" 2>/dev/null \
+  && t_ok "codex: verify parks the org-blocked account" || t_fail "codex verify org park" "no marker"
+rm -f "$FAKE_CTL2" "$CX/acct-02/.expired"
+
+# ---- C16. audit vocabulary + empty pool ---------------------------------------------
+mkdir -p "$CX/acct-06"
+python3 - "$CX/accounts.json" <<'EOF'
+import json, sys
+doc = json.load(open(sys.argv[1]))
+doc['accounts'] = [a for a in doc['accounts'] if a['id'] != 'acct-06']
+doc['accounts'].append({'id': 'acct-06', 'email': 'srv@cx', 'home': 'server'})
+doc['accounts'].sort(key=lambda a: a['id'])
+json.dump(doc, open(sys.argv[1], 'w'), indent=2)
+EOF
+out="$(python3 "$REPO_DIR/lib/codex_audit.py" "$CX" linux | awk -F'\t' '$1=="acct-06"{print $4}')"
+[ "$out" = "missing" ] && t_ok "codex: home=server on the server means NO LOGIN, not 'elsewhere'" \
+  || t_fail "codex home vocabulary" "expected missing on linux, got: $out"
+out="$(python3 "$REPO_DIR/lib/codex_audit.py" "$CX" mac | awk -F'\t' '$1=="acct-06"{print $4}')"
+[ "$out" = "remote" ] && t_ok "codex: home=server on the Mac is correctly 'elsewhere'" \
+  || t_fail "codex home vocabulary" "expected remote on mac, got: $out"
+python3 - "$CX/accounts.json" <<'EOF'
+import json, sys
+doc = json.load(open(sys.argv[1]))
+doc['accounts'] = [a for a in doc['accounts'] if a['id'] != 'acct-06']
+json.dump(doc, open(sys.argv[1], 'w'), indent=2)
+EOF
+rm -rf "$CX/acct-06"
+cxemptypool="$WORK/cx-emptypool"
+mkdir -p "$cxemptypool/tmp"
+printf '{"version":1,"threshold":90,"accounts":[]}' > "$cxemptypool/accounts.json"
+out="$(CODEX_ACCOUNTS_DIR="$cxemptypool" codex-accounts expired 2>&1)"
+rc=$?
+check "codex: expired on an empty pool says so" "No accounts registered yet" "$out"
+[ "$rc" = "0" ] && t_ok "codex: empty pool exits 0" || t_fail "codex empty pool rc" "rc=$rc"
+
+# ---- C17. security hardening --------------------------------------------------------
+mkdir -p "$WORK/cx-canary" && : > "$WORK/cx-canary/DO_NOT_DELETE"
+cp "$CX/accounts.json" "$WORK/cx-manifest.bak"
+python3 - "$CX/accounts.json" <<'EOF'
+import json, os, sys
+d = json.load(open(sys.argv[1]))
+d['accounts'].append({'id': '../cx-canary', 'email': 'evil@cx', 'home': 'mac'})
+json.dump(d, open(sys.argv[1] + '.tmp', 'w'), indent=2); os.replace(sys.argv[1] + '.tmp', sys.argv[1])
+EOF
+out="$(codex-accounts remove ../cx-canary --yes 2>&1)"
+rc=$?
+[ -f "$WORK/cx-canary/DO_NOT_DELETE" ] && t_ok "codex: remove refuses path-traversal id" \
+  || t_fail "codex path traversal" "remove ../cx-canary DELETED files outside the pool"
+[ "$rc" != "0" ] && t_ok "codex: traversal id rejected nonzero" || t_fail "codex traversal rc" "rc=0"
+codex-accounts list 2>&1 | grep -q "\.\./cx-canary" \
+  && t_fail "codex id filter" "traversal id surfaced" \
+  || t_ok "codex: invalid manifest ids are filtered out"
+cp "$WORK/cx-manifest.bak" "$CX/accounts.json"
+if [ "$(uname -s)" = "Darwin" ]; then
+  python3 - "$CX/accounts.json" <<'EOF'
+import json, os, sys
+d = json.load(open(sys.argv[1]))
+d['server_root'] = "/tmp/x'; touch /tmp/cx_multiacc_PWNED; #"
+json.dump(d, open(sys.argv[1] + '.tmp', 'w'), indent=2); os.replace(sys.argv[1] + '.tmp', sys.argv[1])
+EOF
+  rm -f /tmp/cx_multiacc_PWNED
+  out="$(CODEX_MULTIACC_NO_SYNC=0 codex-accounts sync 2>&1)"
+  [ ! -f /tmp/cx_multiacc_PWNED ] && t_ok "codex: sync rejects injected server_root" \
+    || { t_fail "codex command injection" "server_root injection EXECUTED"; rm -f /tmp/cx_multiacc_PWNED; }
+  check "codex: injected server_root refused" "not a plain absolute path" "$out"
+  cp "$WORK/cx-manifest.bak" "$CX/accounts.json"
+  python3 - "$CX/accounts.json" <<'EOF'
+import json, os, sys
+d = json.load(open(sys.argv[1])); d['accounts'] = []
+json.dump(d, open(sys.argv[1] + '.tmp', 'w'), indent=2); os.replace(sys.argv[1] + '.tmp', sys.argv[1])
+EOF
+  out="$(CODEX_MULTIACC_NO_SYNC=0 codex-accounts sync 2>&1)"
+  rc=$?
+  check "codex: empty manifest refuses to sync" "refusing to blank the server pool" "$out"
+  [ "$rc" != "0" ] && t_ok "codex: empty-manifest sync exits nonzero" || t_fail "codex empty sync rc" "rc=0"
+  cp "$WORK/cx-manifest.bak" "$CX/accounts.json"
+else
+  t_ok "codex: sync validation tests skipped (Mac-only feature)"
+fi
+
+# ---- C18. status + npm layer --------------------------------------------------------
+out="$(codex-accounts status 2>&1)"
+check "codex: status shows threshold" "90%" "$out"
+check "codex: status shows account" "a@cx" "$out"
+check "codex: status shows plan" "plan pro" "$out"
+if command -v node >/dev/null 2>&1; then
+  out="$(node "$REPO_DIR/bin/cli.mjs" codex list 2>&1)"
+  check "cli.mjs codex passthrough (list)" "a@cx" "$out"
+  out="$(node "$REPO_DIR/bin/cli.mjs" --help 2>&1)"
+  check "cli --help documents the codex pool" "codex-accounts" "$out"
+else
+  t_ok "codex npm-layer tests skipped (node not installed)"
+fi
+
 # ---- summary ---------------------------------------------------------------------
 echo
 echo "passed: $PASS  failed: $FAIL"