claude-multiacc 2.0.26 → 2.0.28

package/lib/install_actions.sh

@@ -0,0 +1,238 @@
+#!/usr/bin/env bash
+# Installer actions, sourced by install.sh. Bash 3.2 compatible.
+
+is_pool_root() { # true when $1 is safe to delete as an account pool
+  case "$1" in
+    ''|/|"$HOME") return 1 ;;
+    */.claude-accounts|*/.codex-accounts) return 0 ;;
+    /*) [ -f "$1/accounts.json" ] ;;
+    *) return 1 ;;
+  esac
+}
+
+strip_block() { # remove our marked block from a file (portable, no sed -i)
+  local f="$1"
+  [ -f "$f" ] || return 0
+  # Unmatched begin marker (end line hand-deleted): stripping would eat the rest
+  # of the rc file. Leave it alone and say so.
+  if grep -qF "$MARK_BEGIN" "$f" && ! grep -qF "$MARK_END" "$f"; then
+    echo "  WARNING: $f has an unterminated claude-multiacc block — fix it by hand; not touching this file" >&2
+    return 1
+  fi
+  awk -v b="$MARK_BEGIN" -v e="$MARK_END" '
+    $0 == b { skip = 1; next }
+    $0 == e { skip = 0; next }
+    !skip { print }
+  ' "$f" > "$f.claude-multiacc.tmp" && mv "$f.claude-multiacc.tmp" "$f"
+}
+
+path_block_body() {
+  # Move (not just add) the shim dir to the front: later rc lines prepend
+  # ~/.local/bin, so a plain add-once guard would leave the real binary first.
+  printf 'PATH="$(printf %%s ":$PATH:" | sed '\''s|:%s/bin:|:|g; s|^:||; s|:$||'\'')"\n' "$REPO_DIR"
+  printf 'export PATH="%s/bin:$PATH"\n' "$REPO_DIR"
+}
+
+append_block() { # strip then append our PATH block to a file
+  local f="$1"
+  strip_block "$f" || return 1   # never create a second block next to a broken one
+  {
+    printf '%s\n' "$MARK_BEGIN"
+    path_block_body
+    printf '%s\n' "$MARK_END"
+  } >> "$f"
+}
+
+do_uninstall() {
+  echo "claude-multiacc: uninstalling (restoring stock behavior)"
+  # An instance install never wrote a shell rc block, a /etc/profile.d file or the
+  # /usr/local/bin shims — those belong to the DEFAULT install and are shared with it.
+  if [ -n "$INSTANCE" ]; then
+    echo "  instance $INSTANCE: removing its agents only (PATH block and shims belong to the default install)"
+  else
+    strip_block "$HOME/.zshenv"
+    strip_block "$HOME/.zprofile"
+    strip_block "$HOME/.zshrc"
+    strip_block "$HOME/.bashrc"
+    strip_block "$HOME/.bash_profile"
+    strip_block "$HOME/.profile"
+  fi
+  if [ "$(machine_kind)" = "mac" ]; then
+    mac_schedule_remove
+  else
+    linux_schedule_remove
+    if [ -z "$INSTANCE" ]; then
+      [ -f "$PROFILED" ] && rm -f "$PROFILED"
+      if [ -L /usr/local/bin/claude ] \
+        && [ "$(canon_path /usr/local/bin/claude)" = "$(canon_path "$REPO_DIR/bin/claude")" ]; then
+        rm -f /usr/local/bin/claude
+        echo "  removed /usr/local/bin/claude shim symlink"
+      fi
+      if [ -L /usr/local/bin/codex ] \
+        && [ "$(canon_path /usr/local/bin/codex)" = "$(canon_path "$REPO_DIR/bin/codex")" ]; then
+        rm -f /usr/local/bin/codex
+        echo "  removed /usr/local/bin/codex shim symlink"
+      fi
+    fi
+  fi
+  local root
+  for root in "$ACC_ROOT" "$CODEX_ACC_ROOT"; do
+    if [ "$PURGE" = "1" ]; then
+      # Either the conventional location, or a directory that is provably a pool (it
+      # holds a manifest) — an instance root lives anywhere, so the manifest is what
+      # makes `rm -rf` safe. Anything else is left alone.
+      if is_pool_root "$root"; then
+        rm -rf "$root"; echo "  purged $root"
+      else
+        echo "  refusing to purge unusual accounts root: $root" >&2
+      fi
+    fi
+  done
+  if [ "$PURGE" != "1" ]; then
+    echo "  account data kept at $ACC_ROOT and $CODEX_ACC_ROOT (use --purge-data to remove)"
+  fi
+  echo "uninstall complete — stock claude behavior restored"
+}
+
+install_binaries() {
+  [ -x "$REPO_DIR/bin/claude" ] || chmod +x "$REPO_DIR/bin/claude" 2>/dev/null || true
+  [ -x "$REPO_DIR/bin/claude-accounts" ] || chmod +x "$REPO_DIR/bin/claude-accounts" 2>/dev/null || true
+  [ -x "$REPO_DIR/bin/codex" ] || chmod +x "$REPO_DIR/bin/codex" 2>/dev/null || true
+  [ -x "$REPO_DIR/bin/codex-accounts" ] || chmod +x "$REPO_DIR/bin/codex-accounts" 2>/dev/null || true
+
+  local real
+  if real="$(find_real_claude "$REPO_DIR/bin/claude")"; then
+    echo "  real claude binary: $real ($("$real" --version 2>/dev/null | head -1 || echo 'version unknown'))"
+  else
+    echo "  WARNING: no real claude binary found — install Claude Code (https://claude.com/claude-code)" >&2
+  fi
+  local real_codex
+  if real_codex="$(find_real_codex "$REPO_DIR/bin/codex")"; then
+    echo "  real codex binary: $real_codex"
+    "$real_codex" --version 2>/dev/null | head -1 || echo '  version unknown'
+  else
+    echo "  note: no codex binary found — install Codex CLI with: npm i -g @openai/codex"
+  fi
+
+  # Keychain-mode note: Claude Code keeps per-config-dir logins in the login Keychain
+  # (one item per dir) whenever the session can open it, and only sessions without
+  # keychain access (ssh, launchd background jobs) fall back to .credentials.json. The
+  # pool reads both (lib/keychain.py); what an operator has to know is that a login
+  # made from a GUI session is invisible to their ssh sessions — mint a portable
+  # token for anything that must work from everywhere.
+  if [ "$kind" = "mac" ] && [ ! -f "$HOME/.claude/.credentials.json" ] \
+    && security find-generic-password -s "Claude Code-credentials" >/dev/null 2>&1; then
+    echo "  note: this Mac keeps Claude Code logins in the Keychain. Per-dir logins made here"
+    echo "  are read from it; ssh/background sessions cannot open it (they see 'locked') —"
+    echo "  use 'claude-accounts mint <acct-NN>' for accounts that must work from everywhere."
+  fi
+}
+
+install_pools() {
+  manifest_init "${SERVER_OVERRIDE:-$DEFAULT_SERVER}"
+  if [ -n "$SERVER_OVERRIDE" ]; then
+    "$PYBIN" - "$MANIFEST" "$SERVER_OVERRIDE" <<'PYEOF'
+import json, os, sys
+doc = json.load(open(sys.argv[1]))
+doc['server'] = sys.argv[2]
+with open(sys.argv[1] + '.tmp', 'w') as f:
+    json.dump(doc, f, indent=2)
+    f.write('\n')
+os.replace(sys.argv[1] + '.tmp', sys.argv[1])
+PYEOF
+  fi
+  if sync_target_is_local "$(sync_target)"; then
+    echo "  account pool: $ACC_ROOT (manifest ready; sync target: none — local-only)"
+  else
+    echo "  account pool: $ACC_ROOT (manifest ready; sync target: $(sync_target))"
+  fi
+  # The codex pool gets its own skeleton + manifest (same schema, separate root).
+  if ! "$REPO_DIR/bin/codex-accounts" init-pool "${SERVER_OVERRIDE:-}" >/dev/null 2>&1; then
+    echo "  WARNING: codex pool init failed (codex-accounts init-pool)" >&2
+  else
+    echo "  codex account pool: $CODEX_ACC_ROOT (manifest ready)"
+  fi
+}
+
+install_mac_paths() {
+  # .zshenv covers non-interactive zsh; the .zshrc block must be LAST so it wins
+  # over ~/.local/bin re-prepends done earlier in .zshrc/.zprofile.
+  # zsh reads: .zshenv always; .zprofile for login; .zshrc for interactive.
+  # The block must end each file that later re-prepends ~/.local/bin.
+  if [ -z "$INSTANCE" ]; then
+    touch "$HOME/.zshenv"
+    append_block "$HOME/.zshenv"
+    touch "$HOME/.zprofile"
+    append_block "$HOME/.zprofile"
+    touch "$HOME/.zshrc"
+    append_block "$HOME/.zshrc"
+    [ -f "$HOME/.bash_profile" ] && append_block "$HOME/.bash_profile"
+    [ -f "$HOME/.bashrc" ] && append_block "$HOME/.bashrc"
+    echo "  PATH block: end of ~/.zshenv, ~/.zprofile, ~/.zshrc (+ bash rc files if present)"
+  fi
+}
+
+install_linux_paths() {
+  if [ -z "$INSTANCE" ]; then
+    touch "$HOME/.bashrc"
+    append_block "$HOME/.bashrc"
+    if [ -w /etc/profile.d ] 2>/dev/null || [ "$(id -u)" = "0" ]; then
+      {
+        printf '%s\n' "$MARK_BEGIN"
+        path_block_body
+        printf '%s\n' "$MARK_END"
+      } > "$PROFILED"
+      echo "  PATH block: ~/.bashrc + $PROFILED"
+    fi
+  fi
+  if [ -z "$INSTANCE" ] && [ "$(id -u)" = "0" ]; then
+    if [ -e /usr/local/bin/claude ] && [ ! -L /usr/local/bin/claude ]; then
+      echo "  WARNING: /usr/local/bin/claude exists and is a real file — NOT overwriting." >&2
+    else
+      ln -sfn "$REPO_DIR/bin/claude" /usr/local/bin/claude
+      echo "  shim: /usr/local/bin/claude -> $REPO_DIR/bin/claude (systemd-PATH compatible)"
+    fi
+    if [ -e /usr/local/bin/codex ] && [ ! -L /usr/local/bin/codex ]; then
+      echo "  WARNING: /usr/local/bin/codex exists and is a real file — NOT overwriting." >&2
+    else
+      ln -sfn "$REPO_DIR/bin/codex" /usr/local/bin/codex
+      echo "  shim: /usr/local/bin/codex -> $REPO_DIR/bin/codex (systemd-PATH compatible)"
+    fi
+  fi
+}
+
+do_install() {
+  local kind
+  kind="$(machine_kind)"
+  echo "claude-multiacc: installing (mode: $kind, repo: $REPO_DIR)"
+  if [ -n "$INSTANCE" ]; then
+    echo "  instance: $INSTANCE (agents labelled $LABEL.*, pools $ACC_ROOT + $CODEX_ACC_ROOT)"
+  fi
+
+  install_binaries
+  install_pools
+
+  # An INSTANCE install never rewrites the shell rc blocks: one interactive PATH
+  # cannot serve two pools, and clobbering the default install's block would point
+  # the operator's shell at an instance pool. Its agents (below) carry the roots
+  # instead, and the runner daemon invokes the shims by absolute path.
+  if [ -n "$INSTANCE" ]; then
+    echo "  PATH block: skipped (instance install) — for a shell against this pool:"
+    echo "    export CLAUDE_ACCOUNTS_ROOT='$ACC_ROOT' CODEX_ACCOUNTS_ROOT='$CODEX_ACC_ROOT'"
+    echo "    export PATH=\"$REPO_DIR/bin:\$PATH\""
+  fi
+  if [ "$kind" = "mac" ]; then
+    install_mac_paths
+    [ "$NO_SCHEDULE" = "1" ] || mac_schedule_install
+  else
+    install_linux_paths
+    [ "$NO_SCHEDULE" = "1" ] || linux_schedule_install
+  fi
+
+  echo
+  echo "install complete. Open a new shell (or 'export PATH=\"$REPO_DIR/bin:\$PATH\"'), then:"
+  echo "  claude-accounts list      # the Claude Code pool"
+  echo "  codex-accounts list       # the Codex pool"
+  echo "  claude-accounts status   # Claude auth + limits detail"
+  echo "  codex-accounts status    # Codex auth + limits detail"
+}

package/lib/install_calendar.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# Calendar job templates, sourced only by mac_schedule_install in install.sh.
+
+  cat > "$PLIST_HEALTH" <<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>Label</key><string>$LABEL.health</string>
+  <key>ProgramArguments</key><array>
+    <string>$REPO_DIR/bin/claude-accounts</string>
+    <string>health</string>
+  </array>
+$(plist_env_block)  <key>StartCalendarInterval</key><dict>
+    <key>Weekday</key><integer>1</integer>
+    <key>Hour</key><integer>9</integer>
+    <key>Minute</key><integer>17</integer>
+  </dict>
+  <key>StandardOutPath</key><string>/dev/null</string>
+  <key>StandardErrorPath</key><string>/dev/null</string>
+</dict></plist>
+EOF
+
+  cat > "$PLIST_UPDATE" <<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>Label</key><string>$LABEL.update</string>
+  <key>ProgramArguments</key><array>
+    <string>$REPO_DIR/bin/claude-accounts</string>
+    <string>self-update</string>
+    <string>--quiet</string>
+  </array>
+$(plist_env_block)  <key>StartCalendarInterval</key><dict>
+    <key>Hour</key><integer>4</integer>
+    <key>Minute</key><integer>7</integer>
+  </dict>
+  <key>StandardOutPath</key><string>/dev/null</string>
+  <key>StandardErrorPath</key><string>/dev/null</string>
+</dict></plist>
+EOF
+
+  cat > "$PLIST_CODEX_HEALTH" <<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>Label</key><string>$LABEL.codex-health</string>
+  <key>ProgramArguments</key><array>
+    <string>$REPO_DIR/bin/codex-accounts</string>
+    <string>health</string>
+  </array>
+$(plist_env_block)  <key>StartCalendarInterval</key><dict>
+    <key>Weekday</key><integer>1</integer>
+    <key>Hour</key><integer>9</integer>
+    <key>Minute</key><integer>37</integer>
+  </dict>
+  <key>StandardOutPath</key><string>/dev/null</string>
+  <key>StandardErrorPath</key><string>/dev/null</string>
+</dict></plist>
+EOF

package/package.json

@@ -1,10 +1,12 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.26",
+  "version": "2.0.28",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {
     "claude-multiacc": "bin/cli.mjs",
+    "claude-accounts": "bin/claude-accounts",
+    "codex-accounts": "bin/codex-accounts",
     "multiacc-select": "bin/multiacc-select"
   },
   "files": [
@@ -53,7 +55,8 @@
   },
   "scripts": {
     "postinstall": "node scripts/postinstall.mjs",
-    "test": "bash tests/run-tests.sh && python3 tests/test_selector.py"
+    "test": "bash tests/run-tests.sh && python3 tests/test_selector.py && npm run test:commands",
+    "test:commands": "python3 tests/test_packaged_commands.py"
   },
   "dependencies": {
     "update-notifier": "^7.3.1"

package/tests/packaged_command_support.py

@@ -0,0 +1,81 @@
+"""Offline npm installation and isolated command execution for the CLI contract."""
+
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import tempfile
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def run(args, env, cwd, **kwargs):
+    return subprocess.run(args, env=env, cwd=cwd, text=True, capture_output=True, timeout=90, **kwargs)
+
+
+def install_package(test):
+    scratch = tempfile.TemporaryDirectory(prefix="multiacc-packaged-commands-")
+    test.addClassCleanup(scratch.cleanup)
+    test.work = Path(scratch.name).resolve()
+    test.prefix = test.work / "npm prefix"
+    test.home = test.work / "home"
+    test.home.mkdir()
+    npm = shutil.which("npm")
+    cache = subprocess.check_output([npm, "config", "get", "cache"], text=True).strip()
+    paths = [str(Path(shutil.which(name)).parent) for name in ("node", "python3", "npm")]
+    test.env = {
+        "HOME": str(test.home), "PATH": os.pathsep.join(dict.fromkeys(paths + ["/usr/bin", "/bin"])),
+        "CI": "1", "NO_UPDATE_NOTIFIER": "1", "PYTHONDONTWRITEBYTECODE": "1",
+        "CLAUDE_MULTIACC_KEYCHAIN": "0", "CLAUDE_MULTIACC_NO_SYNC": "1", "CODEX_MULTIACC_NO_SYNC": "1",
+        "CLAUDE_ACCOUNTS_ROOT": str(test.home / ".claude-accounts"),
+        "CODEX_ACCOUNTS_ROOT": str(test.home / ".codex-accounts"),
+        "npm_config_cache": cache, "npm_config_update_notifier": "false",
+        "npm_config_prefix": str(test.prefix), "npm_config_offline": "true",
+        "npm_config_ignore_scripts": "true",
+    }
+    packed = run([npm, "pack", "--ignore-scripts", "--pack-destination", str(test.work)],
+                 test.env, ROOT)
+    if packed.returncode:
+        raise RuntimeError(packed.stderr)
+    # npm 11 emits a JSON array; npm 12 keys it by package name. Test the artifact
+    # itself so npm's presentation format cannot strand an otherwise valid release.
+    archives = list(test.work.glob("*.tgz"))
+    if len(archives) != 1:
+        raise RuntimeError(f"Expected one packed archive, found {len(archives)}")
+    archive = archives[0]
+    installed = run([npm, "install", "-g", "--prefix", str(test.prefix), "--ignore-scripts", "--offline",
+                     "--no-audit", "--no-fund", str(archive)], test.env, test.work)
+    if installed.returncode:
+        raise RuntimeError("Offline install failed; run npm install --ignore-scripts to warm dependencies.\n"
+                           + installed.stderr)
+    test.package = test.prefix / "lib/node_modules/claude-multiacc"
+    test.env["PATH"] = str(test.prefix / "bin") + os.pathsep + test.env["PATH"]
+    guard = test.prefix / "bin/npm"
+    guard.write_text('#!/usr/bin/env bash\necho "unexpected npm invocation" >&2\nexit 89\n')
+    guard.chmod(0o755)
+    for name in ("claude", "codex", "security", "launchctl", "crontab", "ln"):
+        guard = test.prefix / "bin" / name
+        guard.write_text('#!/usr/bin/env bash\n'
+                         'printf "%s\\n" "$0 $*" >> "$HOME/tool-calls"\nexit 1\n')
+        guard.chmod(0o755)
+
+
+def seed_pools(test):
+    for provider in ("claude", "codex"):
+        pool = Path(test.env[f"{provider.upper()}_ACCOUNTS_ROOT"])
+        account = pool / "acct-01"
+        account.mkdir(parents=True)
+        (pool / "accounts.json").write_text(json.dumps({
+            "version": 1, "server": "none", "threshold": 90,
+            "accounts": [{"id": "acct-01", "email": f"{provider}@example.test",
+                          "home": "mac" if os.uname().sysname == "Darwin" else "server"}],
+        }))
+        credential = ({"tokens": {"access_token": "fixture", "refresh_token": "fixture"}}
+                      if provider == "codex" else {"claudeAiOauth": {
+                          "accessToken": "fixture", "refreshToken": "fixture", "expiresAt": 9999999999999}})
+        filename = "auth.json" if provider == "codex" else ".credentials.json"
+        (account / filename).write_text(json.dumps(credential))
+        fake = test.prefix / "bin" / provider
+        fake.write_text('#!/usr/bin/env bash\nprintf "OK\\n"\n')
+        fake.chmod(0o755)