claude-multiacc 2.0.26 → 2.0.28

package/tests/run-tests.sh

@@ -4906,6 +4906,296 @@ check "codex: sign-in as registered email refused" "already added as acct-01" "$
 n="$(grep -c '"email": "a@cx"' "$CX/accounts.json")"
 [ "$n" = "1" ] && t_ok "codex: no second entry for a re-signed-in email" || t_fail "codex dup signin" "count=$n"
 
+# ---- C11b. one index for the shared session tree ------------------------------------
+# codex refuses to start until state_<schema>.sqlite has indexed every rollout under
+# $CODEX_HOME/sessions. The layout shares that tree across accounts, so it must share
+# the index too — a private index per account re-read the whole tree per account and
+# stranded a 15-minute worker lease whenever a scan was cut short (my-mini 2026-09-09:
+# six fresh accounts refused every launch as "local database appears to be damaged").
+CXH="$WORK/cxhome"
+mkdir -p "$CXH/.codex/sessions"
+printf 'home index' > "$CXH/.codex/state_5.sqlite"
+# (a) seeding: a new account links the tree AND the index the home already has
+out="$(HOME="$CXH" FAKE_EMAIL=idx@cx codex-accounts add 2>&1)"
+nid="$(printf '%s' "$out" | sed -n 's/.*Registered \(acct-[0-9]*\) .*/\1/p' | head -1)"
+[ -n "$nid" ] || t_fail "codex shared index seed" "add did not register: $(printf '%s' "$out" | head -c 200)"
+[ "$(readlink "$CX/$nid/sessions" 2>/dev/null)" = "$CXH/.codex/sessions" ] \
+  && t_ok "codex: a new account shares the home's session tree" \
+  || t_fail "codex shared tree seed" "sessions -> $(readlink "$CX/$nid/sessions" 2>/dev/null)"
+[ "$(readlink "$CX/$nid/state_5.sqlite" 2>/dev/null)" = "$CXH/.codex/state_5.sqlite" ] \
+  && t_ok "codex: a new account shares the home's rollout index with that tree" \
+  || t_fail "codex shared index seed" "state_5.sqlite -> $(readlink "$CX/$nid/state_5.sqlite" 2>/dev/null)"
+[ -n "$nid" ] && codex-accounts remove "$nid" --yes >/dev/null 2>&1
+
+# The launch-time heal, on its own pool so nothing here leaks into the other codex tests.
+CXS="$WORK/cx-state"
+mkdir -p "$CXS/tmp" "$CXS/acct-01" "$CXS/acct-02" "$CXS/acct-03"
+: > "$CXS/.limits-kick"
+cat > "$CXS/accounts.json" <<EOF2
+{"version": 1, "server": "root@203.0.113.1", "server_root": "/root/.codex-accounts",
+ "server_repo": "/root/claude-multiacc", "threshold": 90,
+ "accounts": [
+  {"id": "acct-01", "email": "s1@cx", "home": "mac", "added_at": "2026-09-09T00:00:00Z"},
+  {"id": "acct-02", "email": "s2@cx", "home": "mac", "added_at": "2026-09-09T00:00:00Z"},
+  {"id": "acct-03", "email": "s3@cx", "home": "mac", "added_at": "2026-09-09T00:00:00Z"}]}
+EOF2
+for i in 01 02 03; do mk_cx_auth "$CXS/acct-$i/auth.json" "s$i@cx" "$FUTURE_EXP"; done
+CXH2="$WORK/cxhome2"
+mkdir -p "$CXH2/.codex/sessions"
+ln -s "$CXH2/.codex/sessions" "$CXS/acct-01/sessions"
+ln -s "$CXH2/.codex/sessions" "$CXS/acct-02/sessions"
+mkdir -p "$CXS/acct-03/sessions"                       # a PRIVATE tree
+printf 'closed private index' > "$CXS/acct-01/state_5.sqlite"
+printf 'open private index' > "$CXS/acct-02/state_5.sqlite"
+printf 'wal' > "$CXS/acct-02/state_5.sqlite-wal"
+printf 'shm' > "$CXS/acct-02/state_5.sqlite-shm"
+printf 'private tree index' > "$CXS/acct-03/state_5.sqlite"
+# (b) an OPEN private index (its -wal beside it) is never moved while the home has no index
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-02 codex 2>&1)"
+check "codex: launch on an account with an open private index" "CFG=acct-02" "$out"
+{ [ -f "$CXS/acct-02/state_5.sqlite" ] && [ ! -L "$CXS/acct-02/state_5.sqlite" ] \
+    && [ ! -e "$CXH2/.codex/state_5.sqlite" ]; } \
+  && t_ok "codex: an open private index is never promoted (one inode, two -shm files, is how WAL corrupts)" \
+  || t_fail "codex open index promote" "$(ls -la "$CXS/acct-02" "$CXH2/.codex" 2>&1 | head -c 400)"
+# a -shm on its own is just as much a live database as a -wal is
+mv "$CXS/acct-02/state_5.sqlite-wal" "$CXS/acct-02/held-wal"
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-02 codex 2>&1)"
+check "codex: launch on an account whose index has only a -shm" "CFG=acct-02" "$out"
+{ [ -f "$CXS/acct-02/state_5.sqlite" ] && [ ! -e "$CXH2/.codex/state_5.sqlite" ]; } \
+  && t_ok "codex: a -shm alone also refuses the promote" \
+  || t_fail "codex shm promote" "$(ls -la "$CXS/acct-02" "$CXH2/.codex" 2>&1 | head -c 400)"
+mv "$CXS/acct-02/held-wal" "$CXS/acct-02/state_5.sqlite-wal"
+# (c) a CLOSED private index is promoted into the home and linked back
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-01 codex 2>&1)"
+check "codex: launch on an account with a closed private index" "CFG=acct-01" "$out"
+[ "$(cat "$CXH2/.codex/state_5.sqlite" 2>/dev/null)" = "closed private index" ] \
+  && t_ok "codex: the first closed private index becomes the home's shared index" \
+  || t_fail "codex index promote" "home index: $(cat "$CXH2/.codex/state_5.sqlite" 2>&1 | head -c 80)"
+[ "$(readlink "$CXS/acct-01/state_5.sqlite" 2>/dev/null)" = "$CXH2/.codex/state_5.sqlite" ] \
+  && t_ok "codex: the promoting account links to the shared index" \
+  || t_fail "codex index promote link" "state_5.sqlite -> $(readlink "$CXS/acct-01/state_5.sqlite" 2>/dev/null)"
+# (d) the home has an index now, but the account's own is still OPEN: moving it would
+#     split its holder across two databases (codex's sqlx pool re-opens BY PATH), so it
+#     is left alone until the process that has it exits and clears its -wal/-shm.
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-02 codex 2>&1)"
+check "codex: relaunch on the account with the open private index" "CFG=acct-02" "$out"
+{ [ -f "$CXS/acct-02/state_5.sqlite" ] && [ ! -L "$CXS/acct-02/state_5.sqlite" ]; } \
+  && t_ok "codex: an index a process can still open is never moved, even once the home has one" \
+  || t_fail "codex open index retire" "$(ls "$CXS/acct-02" 2>&1 | tr '\n' ' ')"
+# (d2) its holder exited and SQLite removed the pair: now it is retired beside the link
+rm -f "$CXS/acct-02/state_5.sqlite-wal" "$CXS/acct-02/state_5.sqlite-shm"
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-02 codex 2>&1)"
+check "codex: relaunch once the private index is closed" "CFG=acct-02" "$out"
+[ "$(readlink "$CXS/acct-02/state_5.sqlite" 2>/dev/null)" = "$CXH2/.codex/state_5.sqlite" ] \
+  && t_ok "codex: a closed private index is retired for the shared one once the home has it" \
+  || t_fail "codex index retire" "state_5.sqlite -> $(readlink "$CXS/acct-02/state_5.sqlite" 2>/dev/null)"
+[ "$(cat "$CXS/acct-02/state_5.sqlite.private" 2>/dev/null)" = "open private index" ] \
+  && t_ok "codex: the retired index stays beside the link, never deleted" \
+  || t_fail "codex index retire files" "$(ls "$CXS/acct-02" 2>&1 | tr '\n' ' ')"
+[ "$(cat "$CXH2/.codex/state_5.sqlite" 2>/dev/null)" = "closed private index" ] \
+  && t_ok "codex: retiring never overwrites the shared index" \
+  || t_fail "codex index retire overwrite" "home index changed"
+# (d3) an account with NO index of its own is linked even while the shared one is in use —
+#      the case the whole change exists for, and the one liveness must never block
+mkdir -p "$CXS/acct-06" && ln -s "$CXH2/.codex/sessions" "$CXS/acct-06/sessions"
+mk_cx_auth "$CXS/acct-06/auth.json" s6@cx "$FUTURE_EXP"
+printf 'wal' > "$CXH2/.codex/state_5.sqlite-wal"
+printf 'shm' > "$CXH2/.codex/state_5.sqlite-shm"
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-06 codex 2>&1)"
+check "codex: launch on a brand-new account while the shared index is in use" "CFG=acct-06" "$out"
+[ "$(readlink "$CXS/acct-06/state_5.sqlite" 2>/dev/null)" = "$CXH2/.codex/state_5.sqlite" ] \
+  && t_ok "codex: an account with no index of its own is linked whatever the shared one is doing" \
+  || t_fail "codex new account link" "$(ls -la "$CXS/acct-06" 2>&1 | head -c 300)"
+rm -f "$CXH2/.codex/state_5.sqlite-wal" "$CXH2/.codex/state_5.sqlite-shm"
+# (e) a PRIVATE session tree keeps its private index
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-03 codex 2>&1)"
+check "codex: launch on an account with its own session tree" "CFG=acct-03" "$out"
+{ [ -f "$CXS/acct-03/state_5.sqlite" ] && [ ! -L "$CXS/acct-03/state_5.sqlite" ]; } \
+  && t_ok "codex: an account with a private session tree keeps its private index" \
+  || t_fail "codex private tree index" "$(ls -la "$CXS/acct-03" 2>&1 | head -c 300)"
+# (f) the index the INSTALLED binary will create is linked ahead of time, so a schema bump
+#     still costs one backfill per Mac, not one per account
+FAKEBIN_IDX="$WORK/fakebin-idx"
+mkdir -p "$FAKEBIN_IDX"
+{ cat "$FAKEBIN/codex"; printf '# rollout index name carried by the real binary: state_7.sqlite\n'; } > "$FAKEBIN_IDX/codex"
+chmod +x "$FAKEBIN_IDX/codex"
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-01 PATH="$REPO_DIR/bin:$FAKEBIN_IDX:$PATH" codex 2>&1)"
+check "codex: launch through a binary that names a newer index" "CFG=acct-01" "$out"
+[ "$(readlink "$CXS/acct-01/state_7.sqlite" 2>/dev/null)" = "$CXH2/.codex/state_7.sqlite" ] \
+  && t_ok "codex: the index the installed binary creates next is linked before it exists" \
+  || t_fail "codex index pre-link" "state_7.sqlite -> $(readlink "$CXS/acct-01/state_7.sqlite" 2>/dev/null)"
+[ ! -e "$CXH2/.codex/state_7.sqlite" ] && t_ok "codex: pre-linking creates nothing in the home itself" \
+  || t_fail "codex index pre-link home" "home gained state_7.sqlite"
+grep -q " state_7.sqlite$" "$CXS/.state-index" 2>/dev/null \
+  && t_ok "codex: the binary's index name is memoized per binary" \
+  || t_fail "codex index name memo" "$(cat "$CXS/.state-index" 2>&1)"
+# (f2) the launcher is a script that names no index; the schema name lives in the native
+#      binary vendored beside it — the branch that actually fires on an npm install
+VENDOR="$WORK/npm/node_modules/@openai/codex/bin"
+mkdir -p "$VENDOR" "$WORK/npm/node_modules/@openai/codex/node_modules/@openai/codex-darwin-arm64/vendor/aarch64-apple-darwin/bin"
+{ cat "$FAKEBIN/codex"; printf '# a launcher script naming no index\n'; } > "$VENDOR/codex.js"
+chmod +x "$VENDOR/codex.js"
+printf 'binary bytes state_8.sqlite more bytes' \
+  > "$WORK/npm/node_modules/@openai/codex/node_modules/@openai/codex-darwin-arm64/vendor/aarch64-apple-darwin/bin/codex"
+FAKEBIN_VENDOR="$WORK/fakebin-vendor"
+mkdir -p "$FAKEBIN_VENDOR"
+ln -s "$VENDOR/codex.js" "$FAKEBIN_VENDOR/codex"
+rm -f "$CXS/.state-index"
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-01 PATH="$REPO_DIR/bin:$FAKEBIN_VENDOR:$PATH" codex 2>&1)"
+check "codex: launch through an npm launcher with a vendored binary" "CFG=acct-01" "$out"
+[ "$(readlink "$CXS/acct-01/state_8.sqlite" 2>/dev/null)" = "$CXH2/.codex/state_8.sqlite" ] \
+  && t_ok "codex: the index name is read from the vendored binary when the launcher names none" \
+  || t_fail "codex vendored index name" "$(ls "$CXS/acct-01" 2>&1 | tr '\n' ' '); memo=$(cat "$CXS/.state-index" 2>&1)"
+grep -q "^$(cd "$(dirname "$VENDOR/codex.js")" && pwd -P)/codex.js:" "$CXS/.state-index" 2>/dev/null \
+  && t_ok "codex: the memo keys on the file the launcher symlink resolves to, not the link" \
+  || t_fail "codex memo key" "$(cat "$CXS/.state-index" 2>&1)"
+rm -f "$CXS/.state-index" "$CXS/acct-01/state_8.sqlite"
+# (g) an adopted account (the dir IS the home) is never rewritten
+ln -s "$CXH2/.codex" "$CXS/acct-04"
+python3 - "$CXS/accounts.json" <<'PYEOF'
+import json, sys
+doc = json.load(open(sys.argv[1]))
+doc['accounts'].append({'id': 'acct-04', 'email': 'adopted@cx', 'home': 'mac', 'added_at': '2026-09-09T00:00:00Z'})
+json.dump(doc, open(sys.argv[1], 'w'), indent=2)
+PYEOF
+mk_cx_auth "$CXH2/.codex/auth.json" adopted@cx "$FUTURE_EXP"
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-04 codex 2>&1)"
+check "codex: launch on an adopted account" "CFG=acct-04" "$out"
+{ [ -f "$CXH2/.codex/state_5.sqlite" ] && [ ! -L "$CXH2/.codex/state_5.sqlite" ]; } \
+  && t_ok "codex: the home's own index is never turned into a link" \
+  || t_fail "codex adopted index" "$(ls -la "$CXH2/.codex" 2>&1 | head -c 300)"
+# (i) codex's own corruption recovery moved this account's LINK into db-backups/ and
+#     rebuilt a private index in its place: that is codex's verdict on the shared file,
+#     so the account keeps what codex rebuilt and this name is left alone entirely.
+mkdir -p "$CXS/acct-01/db-backups/sqlite-1700000000-0"
+mv "$CXS/acct-01/state_5.sqlite" "$CXS/acct-01/db-backups/sqlite-1700000000-0/state_5.sqlite"
+printf 'rebuilt after damage' > "$CXS/acct-01/state_5.sqlite"
+homesum="$(cat "$CXH2/.codex/state_5.sqlite" 2>/dev/null)"
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-01 codex 2>&1)"
+check "codex: launch after codex rejected the shared index for this account" "CFG=acct-01" "$out"
+{ [ "$(cat "$CXS/acct-01/state_5.sqlite" 2>/dev/null)" = "rebuilt after damage" ] \
+    && [ ! -L "$CXS/acct-01/state_5.sqlite" ]; } \
+  && t_ok "codex: an account codex rebuilt for keeps that index instead of the shared one" \
+  || t_fail "codex rejected shared index" "$(ls -la "$CXS/acct-01" 2>&1 | head -c 400)"
+[ "$(cat "$CXH2/.codex/state_5.sqlite" 2>/dev/null)" = "$homesum" ] \
+  && t_ok "codex: the rejected shared index is left exactly as it was, for its other users" \
+  || t_fail "codex rejected shared index home" "home index changed"
+# the marker only speaks for the file it names: a link pointing elsewhere is not a verdict
+mkdir -p "$CXS/acct-05/db-backups/sqlite-1700000000-0"
+mkdir -p "$CXS/acct-05" && ln -s "$CXH2/.codex/sessions" "$CXS/acct-05/sessions"
+mk_cx_auth "$CXS/acct-05/auth.json" s5@cx "$FUTURE_EXP"
+ln -s "$CXH2/.codex/state_9.sqlite" "$CXS/acct-05/db-backups/sqlite-1700000000-0/state_5.sqlite"
+printf 'unrelated private index' > "$CXS/acct-05/state_5.sqlite"
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-05 codex 2>&1)"
+check "codex: launch with a db-backups link naming another file" "CFG=acct-05" "$out"
+[ "$(readlink "$CXS/acct-05/state_5.sqlite" 2>/dev/null)" = "$CXH2/.codex/state_5.sqlite" ] \
+  && t_ok "codex: a db-backups link that names a different file is not a verdict on the shared one" \
+  || t_fail "codex marker scope" "$(ls -la "$CXS/acct-05" 2>&1 | head -c 300)"
+# (j) a second retirement keeps the first retired copy
+rm "$CXS/acct-02/state_5.sqlite"
+printf 'second private index' > "$CXS/acct-02/state_5.sqlite"
+out="$(HOME="$CXH2" CODEX_ACCOUNTS_DIR="$CXS" CODEX_ACCOUNT=acct-02 codex 2>&1)"
+check "codex: launch on an account retiring a second private index" "CFG=acct-02" "$out"
+{ [ "$(cat "$CXS/acct-02/state_5.sqlite.private" 2>/dev/null)" = "open private index" ] \
+    && [ "$(cat "$CXS"/acct-02/state_5.sqlite.private.[0-9]* 2>/dev/null)" = "second private index" ] \
+    && [ -L "$CXS/acct-02/state_5.sqlite" ]; } \
+  && t_ok "codex: retiring never overwrites an earlier retired copy" \
+  || t_fail "codex retire unique" "$(ls "$CXS/acct-02" 2>&1 | tr '\n' ' ')"
+# (k) several processes promoting the same account at once. `mv` here could rename one
+#     shim's fresh symlink onto the file another had just promoted, leaving
+#     ~/.codex/state_N.sqlite pointing at itself — ELOOP, every account on the Mac unable
+#     to start, and repaired by neither codex (ELOOP is not a corruption code) nor this
+#     shim (`[ -L "$link" ]` would skip the name forever). link(2) refuses an existing
+#     target, so the promote is atomic or it does not happen. The window is narrow, so
+#     this drives the core function directly and repeats until the odds are not the test's.
+CORE="$WORK/state-index-core.sh"
+{ printf '#!/usr/bin/env bash\nset -u\n'
+  awk '/^state_index_names\(\) \{/,/^}$/' "$REPO_DIR/bin/codex"
+  awk '/^shared_index_rejected\(\) \{/,/^}$/' "$REPO_DIR/bin/codex"
+  awk '/^share_state_index_links\(\) \{/,/^}$/' "$REPO_DIR/bin/codex"
+  printf 'share_state_index_links "$1" "$2" ""\n'; } > "$CORE"
+chmod +x "$CORE"
+# The losing interleave is: the winner promotes and links, THEN the loser acts on a
+# decision it made before either happened. Forcing it beats waiting for it — a `ln`/`mv`
+# that sleeps puts the loser inside that window on purpose, and the winner is injected
+# there. With the rename promote this renames the loser's own link onto its target; with
+# link(2) it simply refuses.
+SLOWBIN="$WORK/slowbin"
+mkdir -p "$SLOWBIN"
+for cmd in ln mv; do
+  printf '#!/usr/bin/env bash\nsleep 1\nfor c in /bin/%s /usr/bin/%s; do [ -x "$c" ] && exec "$c" "$@"; done\nexit 127\n' \
+    "$cmd" "$cmd" > "$SLOWBIN/$cmd"
+  chmod +x "$SLOWBIN/$cmd"
+done
+rd="$WORK/promote-interleave"
+mkdir -p "$rd/home/sessions" "$rd/acct"
+ln -s "$rd/home/sessions" "$rd/acct/sessions"
+printf 'the loser index' > "$rd/acct/state_5.sqlite"
+( PATH="$SLOWBIN:$PATH" "$CORE" "$rd/acct" "$rd/home" >/dev/null 2>&1 ) &
+slow=$!
+sleep 0.4                       # the loser has decided the home is empty, and not yet acted
+printf 'the winner index' > "$rd/home/state_5.sqlite"
+rm -f "$rd/acct/state_5.sqlite"
+ln -s "$rd/home/state_5.sqlite" "$rd/acct/state_5.sqlite"
+wait "$slow" 2>/dev/null
+{ [ -f "$rd/home/state_5.sqlite" ] && [ ! -L "$rd/home/state_5.sqlite" ] \
+    && [ "$(cat "$rd/home/state_5.sqlite" 2>/dev/null)" = "the winner index" ]; } \
+  && t_ok "codex: a promote that loses the race refuses instead of renaming onto the winner" \
+  || t_fail "codex promote atomicity" "shared index is $(ls -la "$rd/home/state_5.sqlite" 2>&1 | head -c 160)"
+[ "$(cat "$rd/acct/state_5.sqlite" 2>/dev/null)" = "the winner index" ] \
+  && t_ok "codex: the losing account still reads the shared index through its link" \
+  || t_fail "codex promote atomicity" "acct reads $(cat "$rd/acct/state_5.sqlite" 2>&1 | head -c 120)"
+
+races=0; bad=0; badwhy=""
+
+# (l) the heal belongs to the LAUNCH, not to the pin: an unpinned selection and a retry
+#     that rotates to another account must both link the account they actually serve.
+CXU="$WORK/cx-unpinned"; CXHU="$WORK/cxhome-unpinned"
+mkdir -p "$CXU/tmp" "$CXU/acct-01" "$CXU/acct-02" "$CXHU/.codex/sessions"
+: > "$CXU/.limits-kick"
+cat > "$CXU/accounts.json" <<EOF2
+{"version": 1, "server": "root@203.0.113.1", "server_root": "/root/.codex-accounts",
+ "server_repo": "/root/claude-multiacc", "threshold": 90,
+ "accounts": [
+  {"id": "acct-01", "email": "u1@cx", "home": "mac", "added_at": "2026-09-09T00:00:00Z"},
+  {"id": "acct-02", "email": "u2@cx", "home": "mac", "added_at": "2026-09-09T00:00:00Z"}]}
+EOF2
+for i in 01 02; do
+  mk_cx_auth "$CXU/acct-$i/auth.json" "u$i@cx" "$FUTURE_EXP"
+  ln -s "$CXHU/.codex/sessions" "$CXU/acct-$i/sessions"
+done
+printf 'the shared index' > "$CXHU/.codex/state_5.sqlite"
+cxlj 5 5 5 > "$CXU/acct-01/limits.json"
+cxlj 20 20 20 > "$CXU/acct-02/limits.json"
+out="$(HOME="$CXHU" CODEX_ACCOUNTS_DIR="$CXU" CODEX_MULTIACC_HEADROOM_BAND=0 codex 2>&1)"
+picked="$(printf '%s' "$out" | sed -n 's/.*CFG=\(acct-[0-9]*\).*/\1/p' | head -1)"
+{ [ -n "$picked" ] \
+    && [ "$(readlink "$CXU/$picked/state_5.sqlite" 2>/dev/null)" = "$CXHU/.codex/state_5.sqlite" ]; } \
+  && t_ok "codex: an unpinned launch links the account it selected ($picked)" \
+  || t_fail "codex unpinned heal" "picked=${picked:-none} $(ls -la "$CXU"/acct-0*/state_5.sqlite 2>&1 | head -c 300)"
+rm -f "$CXU"/acct-0*/state_5.sqlite
+echo "fail:acct-01" > "$FAKE_CTL2"
+out="$(HOME="$CXHU" CODEX_ACCOUNTS_DIR="$CXU" CODEX_MULTIACC_HEADROOM_BAND=0 codex exec "hello" < /dev/null 2>&1)"
+rm -f "$FAKE_CTL2" "$CXU/acct-01/.limited"
+case "$out" in *CFG=acct-02*) t_ok "codex: the retry rotated to the second account" ;;
+  *) t_fail "codex retry heal" "did not land on acct-02: $(printf '%s' "$out" | head -c 200)" ;; esac
+[ "$(readlink "$CXU/acct-02/state_5.sqlite" 2>/dev/null)" = "$CXHU/.codex/state_5.sqlite" ] \
+  && t_ok "codex: the account a retry rotates onto is linked too" \
+  || t_fail "codex retry heal" "acct-02 -> $(readlink "$CXU/acct-02/state_5.sqlite" 2>/dev/null)"
+
+# (h) the two copies of the core (shim + lib/common.sh) are byte-identical
+core_of() { # $1 file, $2 function name -> its body
+  awk -v fn="$2" '$0 ~ "^"fn"\\(\\) \\{" {p=1} p {print} p && /^}$/ {exit}' "$1"
+}
+for fn in state_index_names shared_index_rejected share_state_index_links; do
+  if [ "$(core_of "$REPO_DIR/bin/codex" "$fn")" = "$(core_of "$REPO_DIR/lib/common.sh" "$fn")" ] \
+     && [ -n "$(core_of "$REPO_DIR/bin/codex" "$fn")" ]; then
+    t_ok "codex: $fn is byte-identical in bin/codex and lib/common.sh"
+  else
+    t_fail "codex shared-index parity" "$fn differs between bin/codex and lib/common.sh"
+  fi
+done
+
 # ---- C12. login command + expired worklist + relogin --------------------------------
 # an account with no auth on this machine: login completes it
 codex-accounts import d@cx --id acct-04 --no-sync >/dev/null 2>&1
@@ -5635,8 +5925,11 @@ EOF
 grep -q "rt-rotated-new" "$CX/limits.log" \
   && t_fail "codex token leak" "a refresh token leaked into limits.log" \
   || t_ok "codex: limits.log leaks no tokens"
-# recently-expired token is left alone (a live codex session may own it) — even --force
-mk_cx_auth "$CX/acct-01/auth.json" a@cx "$((now - 100))"
+# recently-expired token is left alone (a live codex session may own it) — even --force.
+# The expiry is measured from NOW, not from the suite's start: the gate is a five-minute
+# window, and pinning it to $now silently makes this assertion depend on how long every
+# preceding test took.
+mk_cx_auth "$CX/acct-01/auth.json" a@cx "$(( $(date +%s) - 100 ))"
 cp "$CX/acct-01/auth.json" "$WORK/cx-recent.bak"
 rm -f "$CX/acct-01/limits.json" "$CX/acct-01/.oauth-refresh.json"
 out="$(CODEX_MULTIACC_TOKEN_URL="file://$WORK/cx-token-ok.json" CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-low.json" codex-accounts limits --force 2>&1)"

package/tests/test_packaged_commands.py

@@ -0,0 +1,170 @@
+"""Exercise documented commands from npm's actual bin links, without shell rc files."""
+
+import json
+from pathlib import Path
+import plistlib
+import re
+import shlex
+import shutil
+import unittest
+
+from packaged_command_support import ROOT, install_package, run, seed_pools
+
+
+@unittest.skipUnless(shutil.which("node") and shutil.which("npm"), "Node/npm required")
+class PackagedCommandsTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        install_package(cls)
+
+    def test_global_commands_work_without_postinstall_or_shell_rc(self):
+        for command in ("claude-multiacc", "claude-accounts", "codex-accounts", "multiacc-select"):
+            with self.subTest(command=command):
+                resolved = shutil.which(command, path=self.env["PATH"])
+                self.assertEqual(resolved, str(self.prefix / "bin" / command))
+                flag = "--version" if command == "multiacc-select" else "--help"
+                result = run([command, flag], self.env, self.work)
+                self.assertEqual(result.returncode, 0, result.stderr)
+        for shell in ("bash", "zsh"):
+            if not shutil.which(shell):
+                continue
+            result = run([shell, "-fc", "codex-accounts verify --help"], self.env, self.work)
+            self.assertEqual(result.returncode, 0, result.stderr)
+        for command in ("claude-accounts", "codex-accounts"):
+            result = run([command, "list"], self.env, self.work)
+            self.assertNotEqual(result.returncode, 0)
+            self.assertIn("run claude-multiacc install first", result.stderr)
+
+    def test_every_account_help_command_dispatches_directly_and_via_wrapper(self):
+        for provider in ("claude", "codex"):
+            direct = f"{provider}-accounts"
+            help_result = run([str(self.package / "bin" / direct), "--help"], self.env, self.work)
+            verbs = set(re.findall(rf"^  {direct} ([a-z-]+)", help_result.stdout, re.MULTILINE))
+            self.assertGreaterEqual(len(verbs), 18)
+            wrapper = ["claude-multiacc"] + (["codex"] if provider == "codex" else [])
+            for prefix in ([direct], wrapper):
+                for verb in sorted(verbs):
+                    with self.subTest(prefix=prefix, verb=verb):
+                        result = run(prefix + [verb, "--help"], self.env, self.work)
+                        self.assertEqual(result.returncode, 0, result.stderr)
+                        self.assertIn(f"{direct} {verb}", result.stdout)
+                result = run(prefix + ["not-a-command", "--help"], self.env, self.work)
+                self.assertNotEqual(result.returncode, 0)
+
+    def test_wrapper_and_installer_help_have_no_side_effects(self):
+        before = sorted(str(path) for path in self.home.rglob("*"))
+        for verb in ("help", "install", "update", "uninstall", "doctor", "self-update", "codex", "select"):
+            with self.subTest(verb=verb):
+                result = run(["claude-multiacc", verb, "--help"], self.env, self.work)
+                self.assertEqual(result.returncode, 0, result.stderr)
+                self.assertRegex(result.stdout, r"(?i)usage")
+        result = run([str(self.package / "install.sh"), "--help"], self.env, self.work)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(before, sorted(str(path) for path in self.home.rglob("*")))
+
+    def test_verify_and_json_reports_use_the_correct_pool(self):
+        seed_pools(self)
+        for provider in ("claude", "codex"):
+            wrapper = ["claude-multiacc"] + (["codex"] if provider == "codex" else [])
+            for prefix in ([f"{provider}-accounts"], wrapper):
+                for verb in ("list", "status"):
+                    result = run(prefix + [verb, "--json"], self.env, self.work)
+                    self.assertEqual(result.returncode, 0, result.stderr)
+                    self.assertEqual(json.loads(result.stdout)["provider"], provider)
+                for flags, expected in ((["--quick"], ": OK"), ([], ": PASS")):
+                    result = run(prefix + ["verify"] + flags, self.env, self.work)
+                    self.assertEqual(result.returncode, 0, result.stderr)
+                    self.assertIn(f"{provider}@example.test{expected}", result.stdout)
+
+    def test_self_update_uses_the_running_install_prefix(self):
+        fake_npm = self.prefix / "bin/npm"
+        original = fake_npm.read_text()
+        fake_npm.write_text('#!/usr/bin/env bash\n'
+                            'if [ "$1" = view ]; then echo 999.0.0; exit 0; fi\n'
+                            'printf "%s\\n" "$@" > "$HOME/update-args"\nexit 42\n')
+        fake_npm.chmod(0o755)
+        try:
+            result = run(["claude-multiacc", "self-update"], self.env, self.work)
+            self.assertNotEqual(result.returncode, 0)
+            args = (self.home / "update-args").read_text().splitlines()
+            self.assertEqual(args, ["install", "-g", "--prefix", str(self.prefix), "claude-multiacc@latest"])
+        finally:
+            fake_npm.write_text(original)
+
+    def test_git_and_npx_path_entrypoint_matches_npm(self):
+        entrypoint = self.package / "bin/claude-multiacc"
+        self.assertTrue(entrypoint.is_file())
+        result = run([str(entrypoint), "--version"], self.env, self.work)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(result.stdout.strip(), json.loads((self.package / "package.json").read_text())["version"])
+
+    def test_installer_is_idempotent_and_instances_leave_system_commands_alone(self):
+        uname = self.prefix / "bin/uname"
+        identity = self.prefix / "bin/id"
+        uname.write_text('#!/usr/bin/env bash\necho Darwin\n')
+        identity.write_text('#!/usr/bin/env bash\necho 0\n')
+        uname.chmod(0o755)
+        identity.chmod(0o755)
+        try:
+            for _ in range(2):
+                result = run(["claude-multiacc", "install", "--no-server", "--no-schedule"], self.env, self.work)
+                self.assertEqual(result.returncode, 0, result.stderr)
+                self.assertNotIn("status |", result.stdout)
+            for rc in (".zshenv", ".zprofile", ".zshrc"):
+                self.assertEqual((self.home / rc).read_text().count("# >>> claude-multiacc >>>"), 1)
+            calls = (self.home / "tool-calls").read_text()
+            self.assertNotRegex(calls, r"/(launchctl|crontab|ln) ")
+            script = 'source "$0" --no-server --no-schedule; mac_schedule_install'
+            result = run(["bash", "-c", script, str(self.package / "install.sh")], self.env, self.work)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            plists = list((self.home / "Library/LaunchAgents").glob("*.plist"))
+            self.assertEqual(len(plists), 5)
+            for path in plists:
+                job = plistlib.loads(path.read_bytes())
+                self.assertIn("PATH", job["EnvironmentVariables"])
+                self.assertTrue(Path(job["ProgramArguments"][0]).is_file())
+            result = run(["claude-multiacc", "uninstall"], self.env, self.work)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            self.assertNotIn("claude-multiacc", (self.home / ".zshrc").read_text())
+            self.assertTrue((self.home / ".codex-accounts/accounts.json").exists())
+            uname.write_text('#!/usr/bin/env bash\necho Linux\n')
+            (self.home / "tool-calls").write_text("")
+            args = ["install", "--instance", "sandbox", "--no-server", "--no-schedule"]
+            result = run(["claude-multiacc"] + args, self.env, self.work)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            self.assertNotIn("/ln ", (self.home / "tool-calls").read_text())
+        finally:
+            uname.unlink()
+            identity.unlink()
+
+    def test_selector_transport_and_version_match_across_entrypoints(self):
+        expected = None
+        for prefix in (["multiacc-select"], ["claude-multiacc", "select"]):
+            version = run(prefix + ["--version"], self.env, self.work)
+            self.assertEqual(version.returncode, 0, version.stderr)
+            result = run(prefix + ["--request-json", "-", "--response-json", "-"], self.env, self.work, input="{}")
+            self.assertEqual(result.returncode, 0, result.stderr)
+            response = json.loads(result.stdout)
+            self.assertEqual(response["selector_version"], version.stdout.strip())
+            self.assertEqual(response["error_code"], "invalid_request")
+            if expected is not None:
+                self.assertEqual(response, expected)
+            expected = response
+
+    def test_documented_shell_examples_parse_and_command_names_exist(self):
+        documents = [ROOT / "README.md", *sorted((ROOT / "docs").glob("*.md"))]
+        for document in documents:
+            for block in re.findall(r"```(?:bash|sh)\n(.*?)```", document.read_text(), re.DOTALL):
+                result = run(["bash", "-n"], self.env, self.work, input=block)
+                self.assertEqual(result.returncode, 0, f"{document.name}: {result.stderr}")
+                for line in block.splitlines():
+                    tokens = shlex.split(line, comments=True)
+                    if not tokens or tokens[0] not in ("claude-accounts", "codex-accounts", "claude-multiacc"):
+                        continue
+                    self.assertNotIn("|", tokens, f"{document.name}: alternatives must be separate commands")
+                    self.assertIsNone(re.search(r"--[a-z-]+#", line), line)
+                    self.assertIsNotNone(shutil.which(tokens[0], path=self.env["PATH"]), line)
+
+
+if __name__ == "__main__":
+    unittest.main()