claude-multiacc 2.0.32 → 2.0.34

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.32",
+  "version": "2.0.34",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {
@@ -56,7 +56,7 @@
   "scripts": {
     "postinstall": "node scripts/postinstall.mjs",
     "test": "npm run test:core && npm run test:seeding && npm run test:commands",
-    "test:core": "bash tests/run-tests.sh && python3 tests/test_selector.py",
+    "test:core": "bash tests/run-tests.sh && python3 tests/test_selector.py && python3 tests/test_shim_path.py",
     "test:seeding": "python3 tests/test_account_seeding.py && npm run test:codex-settings",
     "test:codex-settings": "python3 tests/test_codex_config_edit.py && python3 tests/test_codex_settings.py",
     "test:commands": "python3 tests/test_packaged_commands.py"

package/tests/run-tests.sh

@@ -292,6 +292,10 @@ export CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-endpoint-missing.json"
 # extra `security` process per account would only slow them down); section 17 turns
 # them on explicitly against the fake `security` above.
 export CLAUDE_MULTIACC_KEYCHAIN=0
+# `status` probes fresh login shells with $HOME's rc files (lib/shim_path.py). This suite
+# runs under the operator's real HOME, whose rc files are not under test — section 18
+# turns the probe on against its own fake HOME.
+export CLAUDE_MULTIACC_PATH_PROBE=0
 
 now="$(date +%s)"
 
@@ -2454,10 +2458,18 @@ done
   && t_ok "an account with no weekly reading never enters the band (0 of 10 picks)" \
   || t_fail "session-only ranking" "the weekly-less account took $nd_sess_hits of 10 picks"
 
-# The mirror image: a weekly reading with nothing to say about the session bucket. Here
-# the rival is WORSE on weekly (80 against 37) and still wins every pick, because it is
-# the only candidate that can clear the session gate — which is exactly what a fabricated
-# `session_percent: 0` would have handed the silent account for free.
+# The mirror image — a weekly reading whose 5h bucket has nothing to say — is NOT the
+# same defect, and treating it as one broke selection on 2026-09-22. A weekly window
+# always exists (a fixed calendar week, running whether or not the account is), so a
+# silent weekly bucket is an endpoint that DECLINED. The 5h window only exists while it
+# is OPEN, so a silent session bucket is an account that has simply been IDLE — and an
+# exhausted session is never silent: a spent 5h bucket always reports ~100% with the
+# reset it is waiting on. Recording idle as UNKNOWN cost the pool its entire band,
+# because quota_known needs BOTH readings: the accounts with the MOST headroom
+# (acct-13/acct-14, 0% weekly) were scored 100 and dropped out, leaving acct-17 at 95%
+# weekly as the only band member — selection.log 2026-09-22T12:37:36Z, band-count=1,
+# four picks in a row onto an account already out of weekly headroom. A closed window
+# holds no usage: it reads 0.
 cat > "$WORK/usage-weekly-only.json" <<'EOF'
 {"limits":[
   {"kind":"session","group":"session","percent":0,"resets_at":null,"scope":null},
@@ -2472,10 +2484,33 @@ assert 'no_data' not in d, d
 assert (d['weekly_percent'], d['max_percent']) == (37, 37), d
 assert d['weekly_resets_epoch'] == calendar.timegm(
     time.strptime("2099-01-05T00:00:00", "%Y-%m-%dT%H:%M:%S")), d
-assert 'session_percent' not in d, d             # the 5h bucket reported nothing at all
+# The 5h window is CLOSED, not undocumented, so it holds no usage. max_percent is still
+# taken over the INFORMATIVE buckets only, so this idle 0 never becomes a bucket reading.
+assert d['session_percent'] == 0, d
 EOF
-[ $? -eq 0 ] && t_ok "a weekly-only reading records weekly+max+horizon and NO session_percent" \
-  || t_fail "weekly-only signals" "see $ND/acct-01/limits.json"
+[ $? -eq 0 ] && t_ok "an idle 5h bucket beside a real weekly one records session_percent 0" \
+  || t_fail "idle-session signals" "see $ND/acct-01/limits.json"
+
+# A payload with NO session bucket at ALL is the same story told by omission — the shape
+# every codex account produces while it is quiet. It must rank, not vanish.
+cat > "$WORK/usage-no-session-bucket.json" <<'EOF'
+{"limits":[
+  {"kind":"weekly_all","group":"weekly","percent":37,"resets_at":"2099-01-05T00:00:00+00:00","scope":null}
+]}
+EOF
+ndlimits "$WORK/usage-no-session-bucket.json" --quiet >/dev/null
+python3 - "$ND/acct-01/limits.json" <<'EOF'
+import json, sys
+d = json.load(open(sys.argv[1]))
+assert 'no_data' not in d, d
+assert (d['weekly_percent'], d['session_percent'], d['max_percent']) == (37, 0, 37), d
+EOF
+[ $? -eq 0 ] && t_ok "a payload with no session bucket at all still records session_percent 0" \
+  || t_fail "absent-session signals" "see $ND/acct-01/limits.json"
+
+# ...and that account RANKS: idle plus the better weekly must beat a busier rival — the
+# pick the pool was losing. acct-02 is worse on weekly (80 vs 37) and clears the gate
+# too, so the band alone separates them.
 ndl 80 10 80 > "$ND/acct-02/limits.json"
 rm -f "$ND/.pick-seq" "$ND"/acct-0*/.last-pick "$ND"/acct-0*/.limited
 : > "$ND/selection.log"
@@ -2483,12 +2518,26 @@ nd_wk_hits=0
 for _ in $(seq 1 6); do
   case "$(CLAUDE_ACCOUNTS_ROOT="$ND" claude 2>&1)" in *CFG=acct-01*) nd_wk_hits=$((nd_wk_hits+1)) ;; esac
 done
-[ "$nd_wk_hits" = "0" ] \
-  && t_ok "an unknown session reading never clears the gate, even with the better weekly (0 of 6)" \
-  || t_fail "weekly-only gate" "the session-less account cleared the gate $nd_wk_hits of 6 times"
-grep -q "acct-02 weekly=80% session=10% band=30 band-count=1 session-gate=50 session-ok=1" "$ND/selection.log" \
-  && t_ok "the log shows one account clearing the gate and one band member" \
-  || t_fail "weekly-only gate log" "$(tail -1 "$ND/selection.log" 2>/dev/null)"
+[ "$nd_wk_hits" = "6" ] \
+  && t_ok "an idle account with the better weekly takes every pick (6 of 6)" \
+  || t_fail "idle-session ranking" "the idle account took $nd_wk_hits of 6"
+grep -q "acct-01 weekly=37% session=0% band=30 band-count=1 session-gate=50 session-ok=2" "$ND/selection.log" \
+  && t_ok "the log shows both clearing the gate and the idle account alone in the band" \
+  || t_fail "idle-session log" "$(tail -1 "$ND/selection.log" 2>/dev/null)"
+
+# The guard that must NOT move: a document where NOTHING answered is still unknown. The
+# all-zero 2026-09-04 shape has no informative bucket anywhere, so it writes no signals
+# at all and never picks up a fabricated session 0 on the way out.
+ndlimits "$WORK/usage-allzero.json" --quiet >/dev/null
+python3 - "$ND/acct-01/limits.json" <<'EOF'
+import json, sys
+d = json.load(open(sys.argv[1]))
+assert d.get('no_data') is True, d
+for k in ('max_percent', 'weekly_percent', 'session_percent', 'weekly_resets_epoch'):
+    assert k not in d, (k, d)
+EOF
+[ $? -eq 0 ] && t_ok "an all-zero payload still writes no session_percent (2026-09-04 holds)" \
+  || t_fail "allzero still unknown" "see $ND/acct-01/limits.json"
 
 # ---- 16-nodata-blind. a fresh timestamp is not a usable reading ---------------------
 # The third face of the same defect: blindness was judged on fetched_at alone, so a pool
@@ -5868,6 +5917,13 @@ done
   && t_ok "codex: an account with no weekly reading never enters the band (0 of 10 picks)" \
   || t_fail "codex session-only ranking" "the weekly-less account took $cs_hits of 10 picks"
 
+# The mirror image — a weekly reading whose ~5h window has nothing to say — is NOT the
+# same defect, and codex feels it hardest: an idle account's payload carries the 7d
+# window and no usable session window at all, so session_percent went permanently
+# absent across the whole pool. quota_known needs BOTH readings, so EVERY codex account
+# scored unknown, bestw never left 101, and the band collapsed into the all-gated tie —
+# codex picked uniformly at RANDOM instead of by headroom (selection.log 2026-09-22:
+# `session=?%` on every ranked line). A closed window holds no usage: it reads 0.
 cat > "$WORK/cx-usage-weekly-only.json" <<EOF
 {"email":"nd@cx","plan_type":"pro",
  "rate_limit":{"allowed":true,"limit_reached":false,
@@ -5881,13 +5937,32 @@ import json, sys
 d = json.load(open(sys.argv[1]))
 assert 'no_data' not in d, d
 assert (d['weekly_percent'], d['max_percent']) == (37, 37), d
-assert 'session_percent' not in d, d             # the 5h window reported nothing at all
+# The ~5h window is CLOSED, not undocumented, so it holds no usage. max_percent is still
+# taken over the INFORMATIVE windows only, so this idle 0 never becomes a reading.
+assert d['session_percent'] == 0, d
+EOF
+[ $? -eq 0 ] && t_ok "codex: an idle 5h window beside a real weekly one records session_percent 0" \
+  || t_fail "codex idle-session signals" "see $CD/acct-01/limits.json"
+
+# The same story told by omission: no session window in the payload at all.
+cat > "$WORK/cx-usage-no-session.json" <<EOF
+{"email":"nd@cx","plan_type":"pro",
+ "rate_limit":{"allowed":true,"limit_reached":false,
+   "secondary_window":{"used_percent":37,"limit_window_seconds":604800,"reset_at":$((now+90000))}},
+ "additional_rate_limits":[]}
+EOF
+cdlimits "$WORK/cx-usage-no-session.json" --quiet >/dev/null
+python3 - "$CD/acct-01/limits.json" <<'EOF'
+import json, sys
+d = json.load(open(sys.argv[1]))
+assert 'no_data' not in d, d
+assert (d['weekly_percent'], d['session_percent'], d['max_percent']) == (37, 0, 37), d
 EOF
-[ $? -eq 0 ] && t_ok "codex: a weekly-only reading records weekly+max and NO session_percent" \
-  || t_fail "codex weekly-only signals" "see $CD/acct-01/limits.json"
-# ...and the rivals are WORSE on weekly (80 against 37) and still take every pick,
-# because they are the only ones that can clear the session gate — which is exactly what
-# a fabricated `session_percent: 0` would have handed the silent account for free.
+[ $? -eq 0 ] && t_ok "codex: a payload with no session window at all records session_percent 0" \
+  || t_fail "codex absent-session signals" "see $CD/acct-01/limits.json"
+
+# ...and it RANKS: idle plus the better weekly (37) must beat busier rivals (80), which
+# is the pick this pool was losing on every single invocation.
 cdl 80 10 80 > "$CD/acct-02/limits.json"
 cdl 80 10 80 > "$CD/acct-03/limits.json"
 rm -f "$CD/.pick-seq" "$CD"/acct-0*/.last-pick
@@ -5896,12 +5971,25 @@ cwk_hits=0
 for _ in $(seq 1 6); do
   case "$(CODEX_ACCOUNTS_ROOT="$CD" codex 2>&1)" in *CFG=acct-01*) cwk_hits=$((cwk_hits+1)) ;; esac
 done
-[ "$cwk_hits" = "0" ] \
-  && t_ok "codex: an unknown session reading never clears the gate, even with the better weekly (0 of 6)" \
-  || t_fail "codex weekly-only gate" "the session-less account cleared the gate $cwk_hits of 6 times"
-grep -q "band=30 band-count=2 session-gate=50 session-ok=2" "$CD/selection.log" \
-  && t_ok "codex: the log shows exactly the two accounts that reported a session bucket" \
-  || t_fail "codex weekly-only gate log" "$(tail -1 "$CD/selection.log" 2>/dev/null)"
+[ "$cwk_hits" = "6" ] \
+  && t_ok "codex: an idle account with the better weekly takes every pick (6 of 6)" \
+  || t_fail "codex idle-session ranking" "the idle account took $cwk_hits of 6"
+grep -q "acct-01 weekly=37% session=0% band=30 band-count=1 session-gate=50 session-ok=3" "$CD/selection.log" \
+  && t_ok "codex: all three clear the gate and the idle account is alone in the band" \
+  || t_fail "codex idle-session log" "$(tail -1 "$CD/selection.log" 2>/dev/null)"
+
+# The guard that must NOT move: a payload where NOTHING answered stays unknown, and
+# never picks up a fabricated session 0 on the way out.
+cdlimits "$WORK/cx-usage-allzero.json" --quiet >/dev/null
+python3 - "$CD/acct-01/limits.json" <<'EOF'
+import json, sys
+d = json.load(open(sys.argv[1]))
+assert d.get('no_data') is True, d
+for k in ('max_percent', 'weekly_percent', 'session_percent'):
+    assert k not in d, (k, d)
+EOF
+[ $? -eq 0 ] && t_ok "codex: an all-zero payload still writes no session_percent (2026-09-04 holds)" \
+  || t_fail "codex allzero still unknown" "see $CD/acct-01/limits.json"
 rm -f "$CD"/acct-0*/.limited
 
 # ---- C14. oauth refresh via the token endpoint --------------------------------------
@@ -6897,6 +6985,116 @@ grep -q '"acct-04"' "$KCP/accounts.json" \
 export CLAUDE_MULTIACC_KEYCHAIN=0
 unset FAKE_KEYCHAIN_DIR
 
+# ---- 18. the rc block shadows `claude` even when the rc file that carries it is cut short ----
+# 2026-09-17: a Ctrl-C at the slow conda hook in ~/.zshrc stopped the file before the
+# multiacc block, ~/.local/bin stayed in front, and the next `claude` at that prompt ran
+# the real binary on ~/.claude — "Not logged in · Please run /login". Every `bash -l` and
+# `sh -l` on that Mac bypassed the shim too: ~/.profile (read when there is no
+# ~/.bash_profile) carried no block at all. The block now ends with a prompt hook that
+# re-asserts the shim dir before every prompt, the installer appends to ~/.profile, and
+# `status` probes fresh login shells so a bypass is reported instead of guessed at.
+RCH="$WORK/rc-home"
+mkdir -p "$RCH/.local/bin"
+printf '#!/bin/sh\necho REAL\n' > "$RCH/.local/bin/claude"
+cp "$RCH/.local/bin/claude" "$RCH/.local/bin/codex"
+chmod +x "$RCH/.local/bin/claude" "$RCH/.local/bin/codex"
+rc_block_text() { # the block the installer writes, for THIS repo
+  REPO_DIR="$REPO_DIR" MARK_BEGIN='# >>> claude-multiacc >>>' MARK_END='# <<< claude-multiacc <<<' \
+    bash -c '. "$REPO_DIR/lib/install_actions.sh"; rc_block'
+}
+rc_block_text > "$WORK/rc-block.sh"
+for rsh in sh bash zsh; do
+  command -v "$rsh" >/dev/null 2>&1 || continue
+  if "$rsh" -n "$WORK/rc-block.sh" 2>/dev/null; then t_ok "rc block parses under $rsh"
+  else t_fail "rc block parses under $rsh" "$("$rsh" -n "$WORK/rc-block.sh" 2>&1 | head -2)"; fi
+done
+grep -q '_claude_multiacc_path_guard' "$WORK/rc-block.sh" \
+  && t_ok "rc block carries the prompt hook" || t_fail "rc block carries the prompt hook"
+# bash: the PROMPT_COMMAND hook undoes a later re-prepend, and registers itself once
+out="$(HOME="$RCH" bash -c '. "$1"; . "$1"; PATH="$HOME/.local/bin:$PATH"; eval "$PROMPT_COMMAND"; printf "%s|%s" "${PATH%%:*}" "$PROMPT_COMMAND"' _ "$WORK/rc-block.sh" 2>&1)"
+[ "$out" = "$REPO_DIR/bin|_claude_multiacc_path_guard" ] \
+  && t_ok "bash prompt hook re-asserts the shim dir (registered once)" \
+  || t_fail "bash prompt hook re-asserts the shim dir" "got: $out"
+if command -v zsh >/dev/null 2>&1; then
+  out="$(HOME="$RCH" zsh -c '. "$1"; . "$1"; PATH="$HOME/.local/bin:$PATH"; _claude_multiacc_path_guard; print -r -- "${PATH%%:*}|${(j:,:)precmd_functions}"' _ "$WORK/rc-block.sh" 2>&1)"
+  [ "$out" = "$REPO_DIR/bin|_claude_multiacc_path_guard" ] \
+    && t_ok "zsh precmd hook re-asserts the shim dir (registered once)" \
+    || t_fail "zsh precmd hook re-asserts the shim dir" "got: $out"
+fi
+# ORDER: a hook registered before ours that rewrites PATH (direnv, a venv) must not have
+# the final word — bash appends after it, zsh moves itself behind hooks ~/.zshrc added.
+out="$(HOME="$RCH" bash -c 'PROMPT_COMMAND="other_hook"; . "$1"; printf %s "$PROMPT_COMMAND"' _ "$WORK/rc-block.sh" 2>&1)"
+[ "$out" = "other_hook;_claude_multiacc_path_guard" ] \
+  && t_ok "bash hook is appended after an existing PROMPT_COMMAND" \
+  || t_fail "bash hook is appended after an existing PROMPT_COMMAND" "got: $out"
+if command -v zsh >/dev/null 2>&1; then
+  out="$(HOME="$RCH" zsh -c '. "$1"; precmd_functions+=(later_hook); . "$1"; print -r -- "${(j:,:)precmd_functions}"' _ "$WORK/rc-block.sh" 2>&1)"
+  [ "$out" = "later_hook,_claude_multiacc_path_guard" ] \
+    && t_ok "zsh hook re-registers itself LAST when the block is sourced again" \
+    || t_fail "zsh hook re-registers itself LAST" "got: $out"
+  out="$(HOME="$RCH" zsh -c 'IFS=":"; . "$1"; . "$1"; print -r -- "${(j:,:)precmd_functions}"' _ "$WORK/rc-block.sh" 2>&1)"
+  [ "$out" = "_claude_multiacc_path_guard" ] \
+    && t_ok "zsh hook registers once whatever IFS is" \
+    || t_fail "zsh hook registers once whatever IFS is" "got: $out"
+fi
+# the hook is inert once the shim dir is gone: no error, PATH left alone
+out="$(HOME="$RCH" bash -c 'sed "s|'"$REPO_DIR"'|/nonexistent/multiacc|g" "$1" > "$1.gone"; . "$1.gone"; PATH="$HOME/.local/bin:$PATH"; _claude_multiacc_path_guard; printf "rc=%s %s" "$?" "${PATH%%:*}"' _ "$WORK/rc-block.sh" 2>&1)"
+[ "$out" = "rc=0 $RCH/.local/bin" ] \
+  && t_ok "prompt hook is inert when the shim dir is gone" \
+  || t_fail "prompt hook is inert when the shim dir is gone" "got: $out"
+# ~/.profile: CREATED when absent (a stock Mac has none — without it every bash/sh login
+# shell stays bypassed and the probe would fail health with a remedy that does nothing),
+# appended to exactly once when present, and ~/.bash_profile is never created.
+rm -f "$RCH/.profile"
+HOME="$RCH" REPO_DIR="$REPO_DIR" MARK_BEGIN='# >>> claude-multiacc >>>' MARK_END='# <<< claude-multiacc <<<' \
+  bash -c '. "$REPO_DIR/lib/install_actions.sh"; install_profile_block' >/dev/null
+[ -f "$RCH/.profile" ] && [ "$(grep -c '# >>> claude-multiacc >>>' "$RCH/.profile")" = "1" ] \
+  && t_ok "~/.profile is created with the block when absent" \
+  || t_fail "~/.profile is created with the block when absent"
+printf 'export PATH="$HOME/.local/bin:$PATH"\n' > "$RCH/.profile"
+for _ in 1 2; do
+  HOME="$RCH" REPO_DIR="$REPO_DIR" MARK_BEGIN='# >>> claude-multiacc >>>' MARK_END='# <<< claude-multiacc <<<' \
+    bash -c '. "$REPO_DIR/lib/install_actions.sh"; install_profile_block' >/dev/null
+done
+[ "$(grep -c '# >>> claude-multiacc >>>' "$RCH/.profile")" = "1" ] \
+  && t_ok "~/.profile gets the block exactly once" || t_fail "~/.profile gets the block exactly once"
+[ ! -e "$RCH/.bash_profile" ] && t_ok "installer never creates ~/.bash_profile" \
+  || t_fail "installer never creates ~/.bash_profile" "it exists"
+for lsh in sh bash; do
+  out="$(env -i HOME="$RCH" USER="${USER:-tester}" TERM=dumb PATH=/usr/bin:/bin "$lsh" -lc 'command -v claude' 2>/dev/null)"
+  [ "$out" = "$REPO_DIR/bin/claude" ] && t_ok "$lsh -l resolves the shim through ~/.profile" \
+    || t_fail "$lsh -l resolves the shim through ~/.profile" "got: $out"
+done
+# the interrupted-rc incident, end to end, through the probe `status` prints
+if command -v zsh >/dev/null 2>&1; then
+  cp "$WORK/rc-block.sh" "$RCH/.zshenv"
+  { printf 'export PATH="$HOME/.local/bin:$PATH"\n'; cat "$WORK/rc-block.sh"; } > "$RCH/.zprofile"
+  printf 'export PATH="$HOME/.local/bin:$PATH"\nreturn 0  # the rest of this rc file was never reached\n' > "$RCH/.zshrc"
+  cat "$WORK/rc-block.sh" >> "$RCH/.zshrc"
+  out="$(HOME="$RCH" CLAUDE_MULTIACC_PATH_PROBE=1 python3 "$REPO_DIR/lib/shim_path.py" "$REPO_DIR" 2>&1)"; rc=$?
+  [ "$rc" = 0 ] && case "$out" in *"zsh -li"*"claude: OK"*) t_ok "interrupted ~/.zshrc: the prompt hook still hands claude to the shim" ;; *) t_fail "interrupted ~/.zshrc probe" "$out" ;; esac
+  [ "$rc" = 0 ] || t_fail "interrupted ~/.zshrc probe exit" "rc=$rc: $out"
+  # the same rc files with the OLD two-line block (no hook) are the incident itself
+  for f in .zshenv .zprofile .zshrc; do
+    awk '/^_claude_multiacc_path_guard\(\)/{skip=1} /^# <<< claude-multiacc <<</{skip=0} !skip' "$RCH/$f" > "$RCH/$f.old" && mv "$RCH/$f.old" "$RCH/$f"
+  done
+  out="$(HOME="$RCH" CLAUDE_MULTIACC_PATH_PROBE=1 python3 "$REPO_DIR/lib/shim_path.py" "$REPO_DIR" 2>&1)"; rc=$?
+  case "$rc:$out" in 1:*"zsh -li"*"BYPASSED -> $RCH/.local/bin/claude"*) t_ok "the probe catches the pre-fix block (zsh -li bypassed)" ;;
+    *) t_fail "the probe catches the pre-fix block" "rc=$rc: $out" ;; esac
+  out="$(HOME="$RCH" CLAUDE_MULTIACC_PATH_PROBE=1 claude-accounts status 2>&1)"
+  check "status reports the bypass" "BYPASSED -> $RCH/.local/bin/claude" "$out"
+  check "status names the fix" "claude-multiacc install" "$out"
+  # restore the hook: status is clean again
+  cp "$WORK/rc-block.sh" "$RCH/.zshenv"
+  { printf 'export PATH="$HOME/.local/bin:$PATH"\n'; cat "$WORK/rc-block.sh"; } > "$RCH/.zprofile"
+  out="$(HOME="$RCH" CLAUDE_MULTIACC_PATH_PROBE=1 claude-accounts status 2>&1)"
+  case "$out" in *BYPASSED*|*"NOT ON PATH"*) t_fail "status is clean with the hooked block" "$out" ;;
+    *"shim on PATH"*) t_ok "status is clean with the hooked block" ;;
+    *) t_fail "status prints the shim probe" "$out" ;; esac
+fi
+out="$(HOME="$RCH" claude-accounts status 2>&1)"
+check "status honours CLAUDE_MULTIACC_PATH_PROBE=0" "probe disabled" "$out"
+
 # The reset-credit contract is easier to prove against a stateful local HTTP server
 # than file:// fixtures: it pins thresholding, credit ordering and idempotent POST retry.
 if CODEX_MULTIACC_AUTO_RESET=1 python3 -m unittest discover -s "$REPO_DIR/tests" -p 'test_codex_reset*.py'; then

package/tests/test_packaged_commands.py

@@ -6,6 +6,7 @@ import plistlib
 import re
 import shlex
 import shutil
+import sys
 import unittest
 
 from packaged_command_support import ROOT, install_package, run, seed_pools
@@ -117,13 +118,46 @@ class PackagedCommandsTests(unittest.TestCase):
         identity.write_text('#!/usr/bin/env bash\necho 0\n')
         uname.chmod(0o755)
         identity.chmod(0o755)
+        # bash/sh login shells read ~/.profile when ~/.bash_profile is absent, and a
+        # ~/.bashrc exists on most machines: both must end with the block, ~/.bash_profile
+        # must NOT be created (its existence would stop bash reading ~/.profile).
+        prepend = 'export PATH="$HOME/.local/bin:$PATH"\n'
+        for rc in (".profile", ".bashrc"):
+            (self.home / rc).write_text(prepend)
+        real_bin = self.home / ".local/bin"
+        real_bin.mkdir(parents=True)
+        for name in ("claude", "codex"):
+            (real_bin / name).write_text('#!/bin/sh\necho REAL\n')
+            (real_bin / name).chmod(0o755)
         try:
             for _ in range(2):
                 result = run(["claude-multiacc", "install", "--no-server", "--no-schedule"], self.env, self.work)
                 self.assertEqual(result.returncode, 0, result.stderr)
                 self.assertNotIn("status |", result.stdout)
-            for rc in (".zshenv", ".zprofile", ".zshrc"):
-                self.assertEqual((self.home / rc).read_text().count("# >>> claude-multiacc >>>"), 1)
+            for rc in (".zshenv", ".zprofile", ".zshrc", ".profile", ".bashrc"):
+                text = (self.home / rc).read_text()
+                self.assertEqual(text.count("# >>> claude-multiacc >>>"), 1, rc)
+                self.assertEqual(text.count("_claude_multiacc_path_guard() {"), 1, rc)
+                self.assertTrue(text.rstrip().endswith("# <<< claude-multiacc <<<"), rc)
+            self.assertFalse((self.home / ".bash_profile").exists())
+            # ...and fresh login shells of every flavour now resolve the package's shims,
+            # the real binaries in ~/.local/bin notwithstanding (lib/shim_path.py is the
+            # same probe `claude-accounts status` and `health` print).
+            probe_env = {**self.env, "CLAUDE_MULTIACC_PATH_PROBE": "1", "USER": "tester"}
+            result = run([sys.executable, str(self.package / "lib/shim_path.py"), str(self.package), "--json"],
+                         probe_env, self.work)
+            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+            report = json.loads(result.stdout)
+            self.assertEqual(report["bypassed"], [])
+            answered = [m for m in report["modes"] if m["error"] != "shell not installed"]
+            self.assertGreaterEqual(len(answered), 2)
+            for mode in answered:
+                self.assertIsNone(mode["error"], mode)
+                for name in ("claude", "codex"):
+                    self.assertTrue(mode["results"][name]["ok"], mode)
+            status = run(["claude-accounts", "status"], probe_env, self.work)
+            self.assertIn("shim on PATH", status.stdout)
+            self.assertNotIn("BYPASSED", status.stdout)
             calls = (self.home / "tool-calls").read_text()
             self.assertNotRegex(calls, r"/(launchctl|crontab|ln) ")
             script = 'source "$0" --no-server --no-schedule; mac_schedule_install'
@@ -137,7 +171,9 @@ class PackagedCommandsTests(unittest.TestCase):
                 self.assertTrue(Path(job["ProgramArguments"][0]).is_file())
             result = run(["claude-multiacc", "uninstall"], self.env, self.work)
             self.assertEqual(result.returncode, 0, result.stderr)
-            self.assertNotIn("claude-multiacc", (self.home / ".zshrc").read_text())
+            for rc in (".zshenv", ".zprofile", ".zshrc", ".profile", ".bashrc"):
+                self.assertNotIn("claude-multiacc", (self.home / rc).read_text(), rc)
+            self.assertEqual((self.home / ".profile").read_text(), prepend)
             self.assertTrue((self.home / ".codex-accounts/accounts.json").exists())
             uname.write_text('#!/usr/bin/env bash\necho Linux\n')
             (self.home / "tool-calls").write_text("")