claude-multiacc 2.0.28 → 2.0.30

package/bin/claude-accounts

@@ -2482,6 +2482,21 @@ AUTH_ERR = re.compile(
 ORG_ERR = re.compile(
     r'organization has disabled|subscription access.*disabl|disabled claude subscription'
     r'|ask your admin to enable|not authorized to use claude code', re.I)
+# EXCULPATORY, tested FIRST — the twin of BROKEN_CLI in bin/codex-accounts, and
+# it matters MORE here: AUTH_ERR above matches a bare `401` or `403`, so any
+# machine fault whose output happens to contain those three digits parks a live
+# login. `mark_expired` writes no `soft_until`, so that verdict is permanent
+# until a person clears it. These patterns say the CLI never reached the API,
+# which is a fact about the machine and never about the login.
+# See health.log 2026-08-24: `env: node: No such file or directory` failed
+# every account in one pass.
+BROKEN_CLI = re.compile(
+    r'missing optional dependency|unsupported (platform|target triple):'
+    r'|cannot find module|ERR_MODULE_NOT_FOUND|ERR_DLOPEN_FAILED'
+    r'|env: node: no such file or directory|node: command not found'
+    r'|spawn .{0,80}(ENOENT|EACCES|EPERM)|^dyld\[[0-9]+\]:'
+    r'|cannot execute binary file|bad CPU type in executable|exec format error',
+    re.I | re.M)
 
 def mark_expired(d, slug, detail=''):
     """Park an account the shim must stop selecting. Verify is the strongest signal
@@ -2607,9 +2622,16 @@ for acct in manifest.get('accounts', []):
                 pass
         print(f'{aid} {acct["email"]}: PASS ({dt:.1f}s) -> {out[:60]!r}')
     else:
-        err = (r.stderr or '').strip()[:200]
+        raw = (r.stderr or '').strip()
+        err = raw[:200]
         hint = ''
-        if ORG_ERR.search(out) or ORG_ERR.search(err):
+        # STDERR only, and the WHOLE of it: stdout is the model's own answer,
+        # and a session that merely discusses "Cannot find module" must not be
+        # able to excuse a real dead login.
+        if BROKEN_CLI.search(raw):
+            hint = (' — the Claude CLI cannot run on this machine; not a login '
+                    'problem, nothing was parked')
+        elif ORG_ERR.search(out) or ORG_ERR.search(err):
             # Not an auth problem: the account authenticates fine, its organization
             # has simply turned Claude Code subscription access off. Park it — a
             # re-login changes nothing — and say what actually helps.

package/bin/codex-accounts

@@ -1768,6 +1768,30 @@ ORG_ERR = re.compile(
     r'disabled by (your )?(workspace )?admin|admin (has )?disabled'
     r'|(workspace|organization) has disabled (codex|chatgpt)'
     r'|codex.{0,20}disabled for (your|this) (workspace|organization)', re.I)
+# EXCULPATORY, and therefore tested FIRST. These say the CLI never reached the
+# API at all — a missing native package, a missing node, an unrunnable binary —
+# so they are facts about this MACHINE, not about the login. Parking on one
+# converts an indeterminate probe into "this login is dead", and that verdict
+# does not self-heal: `mark_expired` here writes no `soft_until`, so the shim
+# reads it as proven dead and keeps it, while the panel refuses to re-import
+# the token until its fingerprint changes.
+#
+# Not hypothetical. health.log 2026-08-24T06:37:02Z: all four accounts
+# `FAIL rc=127 err='env: node: No such file or directory'` — one broken PATH
+# reddened the entire matrix, and it escaped parking only because that exact
+# string happens not to match AUTH_ERR. `Missing optional dependency
+# @openai/codex-<platform>` (my-mini, 2026-09-10) is the same class.
+#
+# Keep it NARROW. It must never contain a word a genuine auth failure uses
+# ("permission denied", "forbidden", a bare "not found"), or a real dead login
+# would be excused as a broken machine. Widen only with a test.
+BROKEN_CLI = re.compile(
+    r'missing optional dependency|unsupported (platform|target triple):'
+    r'|cannot find module|ERR_MODULE_NOT_FOUND|ERR_DLOPEN_FAILED'
+    r'|env: node: no such file or directory|node: command not found'
+    r'|spawn .{0,80}(ENOENT|EACCES|EPERM)|^dyld\[[0-9]+\]:'
+    r'|cannot execute binary file|bad CPU type in executable|exec format error',
+    re.I | re.M)
 
 def mark_expired(d, slug, detail=''):
     """Park an account the shim must stop selecting. Verify is the strongest signal
@@ -1845,9 +1869,16 @@ for acct in manifest.get('accounts', []):
             pass
         print(f'{aid} {acct["email"]}: PASS ({dt:.1f}s) -> {(last or out)[:60]!r}')
     else:
-        err = (r.stderr or '').strip()[:200]
+        raw = (r.stderr or '').strip()
+        err = raw[:200]
         hint = ''
-        if ORG_ERR.search(out) or ORG_ERR.search(err):
+        # STDERR only, and the WHOLE of it: stdout is the model's own answer,
+        # and a session that merely discusses "Cannot find module" must not be
+        # able to excuse a real dead login.
+        if BROKEN_CLI.search(raw):
+            hint = (' — the Codex CLI cannot run on this machine; not a login '
+                    'problem, nothing was parked')
+        elif ORG_ERR.search(out) or ORG_ERR.search(err):
             # Not an auth problem: the account authenticates fine, a workspace admin
             # has simply turned Codex access off. Park it — a re-login changes
             # nothing — and say what actually helps.

package/docs/ACCOUNT_OPERATIONS.md

@@ -131,6 +131,15 @@ manually via:
 claude-accounts sync      # and codex-accounts sync for the codex pool
 ```
 
+Account creation and sync seed missing settings from the machine's default provider
+directory and link its global instructions: `~/.claude/CLAUDE.md` for Claude,
+`~/.codex/AGENTS.md` for Codex. Existing account settings (including models) and
+instruction files or links are preserved. The addon does not generate instructions
+or enable/disable agents. To share newly created global instructions with existing
+accounts, run `claude-accounts sync --no-server` and/or `codex-accounts sync --no-server`.
+This only repairs accounts in the manifest, leaving retired directories untouched.
+Global instruction files remain machine-local; sync does not copy them between hosts.
+
 Targets are the resolved sync target — env override, else the manifest's
 `server`/`server_root`/`server_repo` (the Linux box), see *Pointing sync somewhere else*
 below — plus an optional `peers` array for additional machines (e.g. a second Mac):

package/lib/common.sh

@@ -677,7 +677,7 @@ codex_share_state_index() { # $1 acct dir — seed time: whatever index names ex
 }
 
 # Seed an account config dir so headless runs never prompt.
-#   claude: stripped .claude.json, copied settings.json, shared projects/ symlink
+#   claude: stripped .claude.json, copied settings.json, shared CLAUDE.md + projects/
 #           (shared history => --continue/--resume work regardless of picked account).
 #   codex:  copied config.toml (carries project trust + settings, no identity),
 #           shared sessions/ symlink (=> `codex resume` finds every session) with the
@@ -718,6 +718,9 @@ PYEOF
   if [ ! -f "$d/settings.json" ] && [ -f "$HOME/.claude/settings.json" ]; then
     cp "$HOME/.claude/settings.json" "$d/settings.json" 2>/dev/null || true
   fi
+  if [ ! -e "$d/CLAUDE.md" ] && [ -f "$HOME/.claude/CLAUDE.md" ]; then
+    ln -s "$HOME/.claude/CLAUDE.md" "$d/CLAUDE.md" 2>/dev/null || true
+  fi
   if [ ! -e "$d/projects" ] && [ -d "$HOME/.claude/projects" ]; then
     ln -s "$HOME/.claude/projects" "$d/projects" 2>/dev/null || true
   fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.28",
+  "version": "2.0.30",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {
@@ -55,7 +55,9 @@
   },
   "scripts": {
     "postinstall": "node scripts/postinstall.mjs",
-    "test": "bash tests/run-tests.sh && python3 tests/test_selector.py && npm run test:commands",
+    "test": "npm run test:core && npm run test:seeding && npm run test:commands",
+    "test:core": "bash tests/run-tests.sh && python3 tests/test_selector.py",
+    "test:seeding": "python3 tests/test_account_seeding.py",
     "test:commands": "python3 tests/test_packaged_commands.py"
   },
   "dependencies": {

package/tests/run-tests.sh

@@ -136,6 +136,15 @@ case "${CLAUDE_CODE_OAUTH_TOKEN:-}" in
       *) echo "Failed to authenticate. API Error: 401 OAuth access token is invalid." >&2; exit 1 ;;
     esac ;;
 esac
+if [ -f "$ctl" ] && grep -qx "brokencli:$acct" "$ctl" 2>/dev/null; then
+  # An infrastructure fault, not a login verdict: the CLI never reached the API.
+  # Verbatim from my-mini, 2026-09-10. Note it carries no auth vocabulary at all
+  # — the danger is that AUTH_ERR matches a bare `401`, and a node stack frame
+  # or a version string can contain one.
+  echo "Error: Missing optional dependency @openai/codex-darwin-arm64. Reinstall Codex: npm install -g @openai/codex@latest" >&2
+  echo "    at findCodexExecutable (file:///opt/homebrew/lib/node_modules/@openai/codex/bin/codex.js:107:9)" >&2
+  exit 1
+fi
 case " $* " in
   *" -p --output-format text --max-turns 1 "*) echo "OK"; exit 0 ;;
 esac
@@ -3898,6 +3907,27 @@ check "import rejects an API key as token" "not a subscription setup-token" "$ou
 out="$(printf 'sk-ant-api03-ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ' | claude-accounts mint acct-01 --paste 2>&1)"
 check "mint --paste rejects an API key" "not a subscription setup-token" "$out"
 
+# ---- 17a2. a CLI that cannot run is not a dead login ----------------------------------
+# health.log 2026-08-24T06:37:02Z: all four accounts FAIL rc=127
+# err='env: node: No such file or directory'. One broken PATH reddened the whole
+# verify matrix, and it escaped parking only because that string happens not to
+# match AUTH_ERR — which matches a bare `401`, so a node stack frame carrying one
+# is enough. `mark_expired` writes no soft stamp, so such a park is permanent,
+# and the panel then refuses to re-import the token until its fingerprint changes.
+rm -f "$ACC/acct-01/.expired"
+printf 'brokencli:acct-01\n' > "$WORK/ctl-brokencli"
+out="$(FAKE_CTL="$WORK/ctl-brokencli" claude-accounts verify 2>&1)"
+check "a broken CLI is reported as a machine fault" "cannot run on this machine" "$out"
+check "a broken CLI still fails the account" "acct-01" "$out"
+[ ! -f "$ACC/acct-01/.expired" ] \
+  && t_ok "a broken CLI never parks a live login" \
+  || t_fail "broken CLI parking" "verify parked an account over an infrastructure fault"
+case "$out" in
+  *"login is dead"*) t_fail "broken CLI wording" "verify blamed the login for a machine fault" ;;
+  *) t_ok "a broken CLI is not called a dead login" ;;
+esac
+rm -f "$WORK/ctl-brokencli"
+
 # ---- 17b. verify authenticates the way the SHIM would ---------------------------------
 # A dead credential next to a live portable token: the shim runs that account with the
 # TOKEN, so verify must too — testing it with the dead credential would fail a healthy

package/tests/test_account_seeding.py

@@ -0,0 +1,112 @@
+#!/usr/bin/env python3
+"""Account seeding preserves settings and shares machine-local global instructions."""
+
+import json
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+
+
+REPO = Path(__file__).resolve().parents[1]
+PROVIDERS = (("claude", "CLAUDE.md", "settings.json"), ("codex", "AGENTS.md", "config.toml"))
+
+
+class AccountSeedingTests(unittest.TestCase):
+    def setUp(self):
+        self.work = tempfile.TemporaryDirectory()
+        self.addCleanup(self.work.cleanup)
+        self.home = Path(self.work.name)
+        self.env = {**os.environ, "HOME": str(self.home), "CLAUDE_MULTIACC_PYTHON": "python3"}
+        for provider, _, _ in PROVIDERS:
+            (self.home / f".{provider}").mkdir()
+            self.env[f"{provider.upper()}_ACCOUNTS_ROOT"] = str(self.home / f".{provider}-accounts")
+
+    def seed(self, provider, directory=None):
+        account = directory or self.home / f".{provider}-accounts" / "acct-01"
+        subprocess.run(
+            ["bash", "-c", '. "$1"; seed_account_dir "$2"', "seed", str(REPO / "lib/common.sh"), str(account)],
+            env={**self.env, "MULTIACC_PROVIDER": provider}, check=True, capture_output=True, text=True,
+        )
+        return account
+
+    def test_instructions_are_shared_and_updates_remain_visible(self):
+        for provider, name, _ in PROVIDERS:
+            with self.subTest(provider=provider):
+                source = self.home / f".{provider}" / name
+                source.write_text("Global preferences\n")
+                account = self.seed(provider)
+                self.assertTrue((account / name).is_symlink())
+                self.assertEqual((account / name).resolve(), source.resolve())
+                source.write_text("Updated preferences\n")
+                self.seed(provider)
+                self.assertEqual((account / name).read_text(), "Updated preferences\n")
+
+    def test_existing_files_and_links_are_preserved(self):
+        for provider, name, _ in PROVIDERS:
+            with self.subTest(provider=provider):
+                (self.home / f".{provider}" / name).write_text("Global preferences\n")
+                account = self.seed(provider)
+                target = account / name
+                target.unlink()
+                target.write_text("Account preferences\n")
+                self.seed(provider)
+                self.assertFalse(target.is_symlink())
+                self.assertEqual(target.read_text(), "Account preferences\n")
+                target.unlink()
+                local = self.home / f"{provider}-local.md"
+                target.symlink_to(local)
+                self.seed(provider)
+                self.assertEqual(target.readlink(), local)  # Dangling custom link is also owned by the user.
+                local.write_text("Custom preferences\n")
+                self.seed(provider)
+                self.assertEqual(target.read_text(), "Custom preferences\n")
+
+    def test_missing_global_file_never_creates_a_dangling_or_self_link(self):
+        for provider, name, _ in PROVIDERS:
+            with self.subTest(provider=provider):
+                account = self.seed(provider)
+                self.assertFalse(os.path.lexists(account / name))
+                base = self.home / f".{provider}"
+                self.seed(provider, base)
+                self.assertFalse(os.path.lexists(base / name))
+                (base / name).write_text("Global preferences\n")
+                self.seed(provider, base)
+                self.assertFalse((base / name).is_symlink())
+
+    def test_existing_settings_and_model_are_not_overwritten(self):
+        for provider, _, name in PROVIDERS:
+            with self.subTest(provider=provider):
+                source = self.home / f".{provider}" / name
+                source.write_text('{"model":"global"}\n' if provider == "claude" else 'model = "global"\n')
+                account = self.seed(provider)
+                self.assertEqual((account / name).read_bytes(), source.read_bytes())
+                original = '{"model":"account"}\n' if provider == "claude" else 'model = "account"\n'
+                (account / name).write_text(original)
+                self.seed(provider)
+                self.assertEqual((account / name).read_text(), original)
+
+    def test_local_sync_repairs_only_manifest_accounts(self):
+        for provider, name, _ in PROVIDERS:
+            with self.subTest(provider=provider):
+                (self.home / f".{provider}" / name).write_text("Global preferences\n")
+                root = self.home / f".{provider}-accounts"
+                (root / "acct-01").mkdir(parents=True)
+                (root / "acct-99").mkdir()
+                (root / "accounts.json").write_text(json.dumps({
+                    "version": 1, "server": "none",
+                    "accounts": [{"id": "acct-01", "email": "fixture@example.test", "home": "mac"}],
+                }))
+                for _ in range(2):
+                    result = subprocess.run(
+                        [str(REPO / "bin" / f"{provider}-accounts"), "sync", "--no-server"],
+                        env=self.env, check=True, capture_output=True, text=True,
+                    )
+                    self.assertIn("nothing pushed", result.stdout)
+                self.assertTrue((root / "acct-01" / name).is_symlink())
+                self.assertFalse(os.path.lexists(root / "acct-99" / name))
+
+
+if __name__ == "__main__":
+    unittest.main()