claude-multiacc 2.0.38 → 2.0.40

package/tests/run-tests.sh

@@ -41,6 +41,62 @@ mkdir -p "$ACC/tmp" "$FAKEBIN"
 cat > "$FAKEBIN/claude" <<'EOF'
 #!/usr/bin/env bash
 # fake real claude for tests (not a multiacc shim)
+if [ "${1:-}" = "mcp" ] && [ -n "${CLAUDE_CONFIG_DIR:-}" ]; then
+  # A stand-in for the real `claude mcp add|add-json|remove`: `-s user` edits the
+  # config dir's .claude.json mcpServers, the default `local` scope edits
+  # projects[$PWD].mcpServers, exactly where the real client keeps them.
+  python3 - "$CLAUDE_CONFIG_DIR/.claude.json" "$PWD" "$@" <<'PY'
+import json, os, sys
+path, cwd, argv = sys.argv[1], sys.argv[2], sys.argv[3:]
+try:
+    doc = json.load(open(path))
+except Exception:
+    doc = {}
+verb, rest = argv[1], argv[2:]
+scope, name, cmd, envs, js = None, None, [], {}, None
+i = 0
+while i < len(rest):
+    a = rest[i]
+    if a in ("-s", "--scope"):
+        scope = rest[i + 1]; i += 2; continue
+    if a in ("-e", "--env"):
+        k, v = rest[i + 1].split("=", 1); envs[k] = v; i += 2; continue
+    if a == "--":
+        cmd = rest[i + 1:]; break
+    if name is None:
+        name = a
+    elif verb == "add-json" and js is None:
+        js = a
+    i += 1
+def user_bucket(create):
+    return doc.setdefault("mcpServers", {}) if create else (doc.get("mcpServers") or {})
+def local_bucket(create):
+    if create:
+        return doc.setdefault("projects", {}).setdefault(cwd, {}).setdefault("mcpServers", {})
+    return ((doc.get("projects") or {}).get(cwd) or {}).get("mcpServers") or {}
+if verb in ("add", "add-json"):
+    block = json.loads(js) if verb == "add-json" else {"type": "stdio", "command": cmd[0], "args": cmd[1:], "env": envs}
+    (user_bucket(True) if scope == "user" else local_bucket(True))[name] = block
+    print("Added stdio MCP server %s to %s config" % (name, scope or "local"))
+else:
+    buckets = {"user": user_bucket, "local": local_bucket}
+    order = [scope] if scope else ["local", "user"]
+    for sc in order:
+        b = buckets[sc](False)
+        if name in b:
+            del b[name]; print("Removed MCP server %s from %s config" % (name, sc)); break
+    else:
+        print("No MCP server found with name: %s" % name, file=sys.stderr); sys.exit(1)
+with open(path + ".tmp", "w") as f:
+    json.dump(doc, f, indent=2)
+os.replace(path + ".tmp", path)
+PY
+  rc=$?
+  # FAKE_MCP_WRITE_THEN_FAIL=1: the client DID write the file and then died (a crash
+  # after its save) — the shim must pass the failure through and mirror nothing.
+  [ "$rc" = 0 ] && [ -n "${FAKE_MCP_WRITE_THEN_FAIL:-}" ] && exit 1
+  exit $rc
+fi
 if [ "${1:-}" = "auth" ] && [ "${2:-}" = "status" ]; then
   if [ -n "${FAKE_AUTH_FAIL:-}" ]; then echo '{"loggedIn": false}'; exit 0; fi
   # A setup token is minted with scope user:inference ALONE, so the real CLI answers
@@ -3852,15 +3908,20 @@ EOF
   SSHFAKE="$WORK/sshfake"
   SSHLOG="$WORK/sshfake.log"
   mkdir -p "$SSHFAKE"
+  # Both fakes DRAIN stdin like the real tools do: ssh forwards it to the remote
+  # command and rsync's transport reads it. A fake that left stdin alone hid the
+  # bug where the peer loop fed them its own peer list.
   cat > "$SSHFAKE/ssh" <<'EOF'
 #!/usr/bin/env bash
 printf 'ssh %s\n' "$*" >> "${SSHLOG:?}"
+[ -t 0 ] || cat >/dev/null
 case "$*" in *"${SSH_FAIL_HOST:-@@none@@}"*) exit 1 ;; esac
 exit 0
 EOF
   cat > "$SSHFAKE/rsync" <<'EOF'
 #!/usr/bin/env bash
 printf 'rsync %s\n' "$*" >> "${SSHLOG:?}"
+[ -t 0 ] || cat >/dev/null
 exit 0
 EOF
   chmod +x "$SSHFAKE/ssh" "$SSHFAKE/rsync"
@@ -3910,14 +3971,22 @@ EOF
   python3 - "$ACC/accounts.json" <<'EOF'
 import json, os, sys
 d = json.load(open(sys.argv[1]))
-d['peers'] = [{'target': 'gas@peer1', 'root': '/Users/gas/.claude-accounts', 'repo': '/Users/gas/claude-multiacc'}]
+d['peers'] = [{'target': 'gas@peer1', 'root': '/Users/gas/.claude-accounts', 'repo': '/Users/gas/claude-multiacc'},
+              {'target': 'gas@peer2', 'root': '/Users/gas/.claude-accounts', 'repo': '/Users/gas/claude-multiacc'},
+              {'target': 'gas@peer3', 'root': '/Users/gas/.claude-accounts', 'repo': '/Users/gas/claude-multiacc'}]
 json.dump(d, open(sys.argv[1] + '.tmp', 'w'), indent=2); os.replace(sys.argv[1] + '.tmp', sys.argv[1])
 EOF
   : > "$SSHLOG"
   out="$(PATH="$SSHFAKE:$PATH" CLAUDE_MULTIACC_NO_SYNC=0 claude-accounts sync 2>&1)"
   rc=$?
   [ "$rc" = "0" ] && t_ok "multi-target sync succeeds" || t_fail "multi-target sync" "rc=$rc: $out"
-  check "multi-target sync reports the peer" "+ 1 peer(s)" "$out"
+  check "multi-target sync reports every peer" "+ 3 peer(s)" "$out"
+  # EVERY peer is pushed, not just the first: the ssh/rsync inside the loop must not
+  # be allowed to eat the peer list off stdin (mini-3..8 got nothing for 18 days).
+  grep -q "rsync.*gas@peer2:/Users/gas/.claude-accounts/accounts.json" "$SSHLOG" \
+    && grep -q "rsync.*gas@peer3:/Users/gas/.claude-accounts/accounts.json" "$SSHLOG" \
+    && t_ok "the second and third peers are pushed too (stdin not eaten by the first)" \
+    || t_fail "later peers skipped" "$(grep -c 'accounts.json' "$SSHLOG") manifest pushes: $(grep accounts.json "$SSHLOG" | tr '\n' '|')"
   grep -q "rsync.*root@203.0.113.1:/root/.claude-accounts/accounts.json" "$SSHLOG" \
     && grep -q "rsync.*gas@peer1:/Users/gas/.claude-accounts/accounts.json" "$SSHLOG" \
     && t_ok "manifest pushed to BOTH targets" \
@@ -3928,9 +3997,32 @@ EOF
     && t_ok "primary target pushed before the peer" \
     || t_fail "target order" "primary=$first_primary peer=$first_peer"
   n_remov="$(grep -c "for dd in acct-" "$SSHLOG")"
-  [ "$n_remov" = "2" ] && t_ok "removal propagation ran on each target" \
-    || t_fail "per-target removal" "expected 2 removal sweeps, saw $n_remov"
+  [ "$n_remov" = "4" ] && t_ok "removal propagation ran on each target" \
+    || t_fail "per-target removal" "expected 4 removal sweeps, saw $n_remov"
   grep -q "post-sync" "$SSHLOG" && t_ok "post-sync hooks invoked" || t_fail "post-sync hooks" "none recorded"
+  # The MCP registry rides with the manifest to EVERY target; the machine-local overlay
+  # (a runner daemon's view of THIS Mac) never leaves. Without a registry file nothing
+  # about it is pushed, so a target's own registry is never blanked.
+  grep -q "mcp-servers" "$SSHLOG" \
+    && t_fail "registry push without a registry" "pushed a registry that does not exist: $(grep mcp-servers "$SSHLOG")" \
+    || t_ok "no registry file => no registry push"
+  printf '{"version":1,"mcpServers":{"regsync":{"type":"stdio","command":"echo","args":["hi"],"env":{}}},"retired":[],"projects":{}}\n' \
+    > "$ACC/mcp-servers.json"
+  printf '{"version":1,"owners":{"panel":{"mcpServers":{"local-only":{"type":"stdio","command":"true","args":[],"env":{}}},"retired":[]}}}\n' \
+    > "$ACC/mcp-servers.local.json"
+  : > "$SSHLOG"
+  out="$(PATH="$SSHFAKE:$PATH" CLAUDE_MULTIACC_NO_SYNC=0 claude-accounts sync 2>&1)"
+  rc=$?
+  [ "$rc" = "0" ] && t_ok "sync with a registry succeeds" || t_fail "registry sync" "rc=$rc: $out"
+  grep -q "rsync.*mcp-servers.json root@203.0.113.1:/root/.claude-accounts/mcp-servers.json" "$SSHLOG" \
+    && grep -q "rsync.*mcp-servers.json gas@peer1:/Users/gas/.claude-accounts/mcp-servers.json" "$SSHLOG" \
+    && t_ok "the MCP registry is pushed to BOTH targets" \
+    || t_fail "registry push" "$(grep mcp-servers "$SSHLOG")"
+  grep -q "mcp-servers.local.json" "$SSHLOG" \
+    && t_fail "overlay push" "the machine-local overlay was pushed: $(grep local.json "$SSHLOG")" \
+    || t_ok "the machine-local overlay is never pushed"
+  rm -f "$ACC/mcp-servers.json" "$ACC/mcp-servers.local.json"
+  for _d in "$ACC"/acct-*; do rm -f "$_d/.mcp-applied"; done
   # a primary failure aborts the WHOLE sync: the peer is never contacted
   : > "$SSHLOG"
   out="$(PATH="$SSHFAKE:$PATH" SSH_FAIL_HOST="root@203.0.113.1" CLAUDE_MULTIACC_NO_SYNC=0 claude-accounts sync 2>&1)"
@@ -4073,6 +4165,26 @@ dp_drain
   && t_ok "only an exact 'replica' value suppresses the telemetry push" \
   || t_fail "replica anchor (distribute)" "'not-replica' suppressed the push"
 rm -f "$DPOOL/sync-role"
+# The MCP registry rides along with the telemetry, so a server the shim mirrored from a
+# stock 'claude mcp add' reaches every peer within one limits cadence. The overlay does not.
+printf '{"version":1,"mcpServers":{"ride":{"type":"stdio","command":"echo","args":["hi"],"env":{}}},"retired":[],"projects":{}}\n' \
+  > "$DPOOL/mcp-servers.json"
+printf '{"version":1,"owners":{"panel":{"mcpServers":{},"retired":[]}}}\n' > "$DPOOL/mcp-servers.local.json"
+: > "$RSLOG"
+PATH="$RSFAKE:$PATH" CLAUDE_ACCOUNTS_ROOT="$DPOOL" \
+  CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force --quiet
+waited=0
+while [ "$waited" -lt 50 ] && [ "$(grep -c '^RSYNC ' "$RSLOG" 2>/dev/null)" -lt 3 ]; do
+  sleep 0.2; waited=$((waited + 1))
+done
+dp_drain
+[ "$(grep -c '^FILE mcp-servers.json$' "$RSLOG")" = "3" ] \
+  && t_ok "the MCP registry rides along with the telemetry push to all three targets" \
+  || t_fail "registry in limits push" "mcp-servers.json listed $(grep -c '^FILE mcp-servers.json$' "$RSLOG")x, want 3: $(grep FILE "$RSLOG" | tr '\n' '|')"
+grep -q '^FILE mcp-servers.local.json$' "$RSLOG" \
+  && t_fail "overlay in limits push" "the machine-local overlay was pushed" \
+  || t_ok "the machine-local overlay never rides along"
+rm -f "$DPOOL/mcp-servers.json" "$DPOOL/mcp-servers.local.json"
 
 # ---- 16d-lock. a distribute lock is honored while it is alive, broken once it is not -
 # The push serializes on a lock DIRECTORY, and a detached push that is killed (logout,
@@ -4148,6 +4260,253 @@ case "$out" in
 esac
 rm -f "$WORK/ctl-brokencli"
 
+# ---- 16e. MCP servers for every account ---------------------------------------------
+# Claude Code keeps MCP servers in the CONFIG DIR, so under the pool a stock `claude mcp
+# add` used to land in ONE random account — appinspire was connected in some sessions
+# and not in others (2026-09-22). The pool's registry (mcp-servers.json) is reconciled
+# into every account at seed time and by the shim right before exec, and a stock add
+# under the shim is mirrored into the registry. Own pool root, so nothing here leaks
+# into the sections above or below.
+MPOOL="$WORK/mcp-pool"
+mkdir -p "$MPOOL/acct-01" "$MPOOL/acct-02" "$MPOOL/tmp"
+: > "$MPOOL/.limits-kick"
+cat > "$MPOOL/accounts.json" <<'EOF'
+{"version":1,"server":"none","threshold":90,
+ "accounts":[
+   {"id":"acct-01","email":"m1@test","home":"mac","added_at":"2026-07-13T00:00:00Z"},
+   {"id":"acct-02","email":"m2@test","home":"mac","added_at":"2026-07-13T00:00:00Z"}]}
+EOF
+for i in 01 02; do
+  printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-mcp%s","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999}}' \
+    "$i" > "$MPOOL/acct-$i/.credentials.json"
+  printf '{"mcpServers":{"own-%s":{"type":"stdio","command":"true","args":[],"env":{}}},"numStartups":1}\n' "$i" \
+    > "$MPOOL/acct-$i/.claude.json"
+done
+# A python that LOGS every invocation, then runs the real python3: proves whether the
+# shim spent a python start-up on a launch, which the stamp exists to avoid.
+PYLOG="$WORK/mcp-pylog"
+cat > "$WORK/pylog.sh" <<EOF
+#!/usr/bin/env bash
+printf 'PY %s\n' "\$*" >> "$PYLOG"
+exec python3 "\$@"
+EOF
+chmod +x "$WORK/pylog.sh"
+mcp_has() { # mcp_has <acct> <name> [<project>] -> 0 when the account carries the server
+  python3 - "$MPOOL/$1/.claude.json" "$2" "${3:-}" <<'PY'
+import json, sys
+doc = json.load(open(sys.argv[1]))
+name, project = sys.argv[2], sys.argv[3]
+if project:
+    sys.exit(0 if name in (((doc.get("projects") or {}).get(project) or {}).get("mcpServers") or {}) else 1)
+sys.exit(0 if name in (doc.get("mcpServers") or {}) else 1)
+PY
+}
+# (iv) the CLI: add for THIS provider only, list, remove (retires), apply repairs drift
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp add --provider claude reg1 -e K=v -- echo hi 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "mcp add (claude only) exits 0" || t_fail "mcp add rc" "rc=$rc: $out"
+[ -f "$MPOOL/mcp-servers.json" ] && t_ok "mcp add writes the pool registry" || t_fail "registry file" "missing"
+mcp_has acct-01 reg1 && mcp_has acct-02 reg1 && t_ok "mcp add reconciles EVERY account" \
+  || t_fail "mcp add reconcile" "$(cat "$MPOOL/acct-01/.claude.json" "$MPOOL/acct-02/.claude.json")"
+mcp_has acct-01 own-01 && mcp_has acct-02 own-02 && t_ok "an account's own extra servers survive the reconcile" \
+  || t_fail "extras preserved" "$(cat "$MPOOL/acct-01/.claude.json")"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp list 2>&1)"
+check "mcp list names the server" "reg1" "$out"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); sys.exit(0 if "reg1" in d.get("mcpServers",{}) else 1)' "$out" \
+  && t_ok "mcp list --json carries mcpServers" || t_fail "mcp list --json" "$out"
+# drift: the client rewrote the file without the server (its in-memory state was older)
+python3 - "$MPOOL/acct-02/.claude.json" <<'PY'
+import json, os, sys
+p = sys.argv[1]; d = json.load(open(p)); d["mcpServers"].pop("reg1", None)
+json.dump(d, open(p + ".tmp", "w")); os.replace(p + ".tmp", p)
+PY
+mcp_has acct-02 reg1 && t_fail "drift fixture" "reg1 still present" || t_ok "drift fixture: acct-02 lost reg1"
+# (i) a launch reconciles the picked account before exec, and stamps it
+: > "$PYLOG"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_ACCOUNT=acct-02 CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" claude 2>&1)"
+check "launch runs on the pinned account" "CFG=acct-02" "$out"
+mcp_has acct-02 reg1 && t_ok "the shim reconciles the picked account before exec" \
+  || t_fail "shim reconcile" "$(cat "$MPOOL/acct-02/.claude.json")"
+[ -s "$MPOOL/acct-02/.mcp-applied" ] && t_ok "the reconcile leaves a stamp" || t_fail "stamp" "no .mcp-applied"
+grep -q "apply" "$PYLOG" && t_ok "python ran once for the drifted account" || t_fail "python ran" "$(cat "$PYLOG")"
+# (ii) the stamp short-circuits: nothing changed => no python at all; python gone => still launches
+: > "$PYLOG"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_ACCOUNT=acct-02 CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" claude 2>&1)"
+check "second launch still runs" "CFG=acct-02" "$out"
+[ ! -s "$PYLOG" ] && t_ok "an unchanged registry + config spends no python start-up" \
+  || t_fail "stamp short-circuit" "python ran: $(cat "$PYLOG")"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_ACCOUNT=acct-02 CLAUDE_MULTIACC_PYTHON=/nonexistent/python3 claude 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && check "a missing python never breaks a launch" "CFG=acct-02" "$out" \
+  || t_fail "fail-open python" "rc=$rc: $out"
+touch "$MPOOL/mcp-servers.json"
+sleep 1; touch "$MPOOL/mcp-servers.json"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_ACCOUNT=acct-02 CLAUDE_MULTIACC_PYTHON=/nonexistent/python3 claude 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && check "a changed registry with no python still launches (fail-open)" "CFG=acct-02" "$out" \
+  || t_fail "fail-open changed registry" "rc=$rc: $out"
+: > "$PYLOG"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_ACCOUNT=acct-02 CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" claude 2>&1)"
+grep -q "apply" "$PYLOG" && t_ok "a touched registry re-runs the reconcile" || t_fail "registry mtime" "no python run"
+# (vi) the kill switch: no reconcile at launch
+python3 - "$MPOOL/acct-01/.claude.json" <<'PY'
+import json, os, sys
+p = sys.argv[1]; d = json.load(open(p)); d["mcpServers"].pop("reg1", None)
+json.dump(d, open(p + ".tmp", "w")); os.replace(p + ".tmp", p)
+PY
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_ACCOUNT=acct-01 CLAUDE_MULTIACC_MCP=0 claude 2>&1)"
+check "kill switch: launch still runs" "CFG=acct-01" "$out"
+mcp_has acct-01 reg1 && t_fail "kill switch" "CLAUDE_MULTIACC_MCP=0 still reconciled" \
+  || t_ok "CLAUDE_MULTIACC_MCP=0 leaves the account alone"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp apply 2>&1)"
+mcp_has acct-01 reg1 && t_ok "mcp apply repairs the drifted account" || t_fail "mcp apply" "$out"
+# (iii) learn-from-write: a stock 'claude mcp add' under the shim reaches EVERY account
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude mcp add -s user x -- echo hi 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && check "stock 'claude mcp add' still answers like the real client" "Added stdio MCP server x" "$out" \
+  || t_fail "stock mcp add rc" "rc=$rc: $out"
+mcp_has acct-01 x && mcp_has acct-02 x && t_ok "a stock 'claude mcp add -s user' lands in EVERY account" \
+  || t_fail "mirror add" "$(cat "$MPOOL/acct-01/.claude.json" "$MPOOL/acct-02/.claude.json")"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); s=d["mcpServers"]["x"]; sys.exit(0 if s.get("command")=="echo" and s.get("args")==["hi"] else 1)' "$out" \
+  && t_ok "the mirrored server is in the registry with the client's own block" || t_fail "mirror registry" "$out"
+mkdir -p "$WORK/mcp-proj"
+# the client keys the project by its normalized cwd, so ask the shell for that spelling
+MPROJ="$(cd "$WORK/mcp-proj" && pwd)"
+out="$(cd "$MPROJ" && CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude mcp add y -- echo yo 2>&1)"
+mcp_has acct-01 y "$MPROJ" && mcp_has acct-02 y "$MPROJ" \
+  && t_ok "a stock project-local add is mirrored for that project in EVERY account" \
+  || t_fail "mirror local add" "$out $(cat "$MPOOL/acct-01/.claude.json")"
+mcp_has acct-01 y && t_fail "local scope leak" "y landed in user scope" || t_ok "a project-local add stays project-local"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude mcp remove -s user x 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "stock 'claude mcp remove' exits 0" || t_fail "stock mcp remove rc" "rc=$rc: $out"
+mcp_has acct-01 x || mcp_has acct-02 x \
+  && t_fail "mirror remove" "x survives in an account" || t_ok "a stock 'claude mcp remove' drops the server from EVERY account"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); sys.exit(0 if "x" in d.get("retiredUser",[]) and "x" not in d.get("mcpServers",{}) else 1)' "$out" \
+  && t_ok "a learned user-scope remove is a USER-SCOPE tombstone (retiredUser) in the registry" || t_fail "tombstone" "$out"
+# the kill switch also disables the mirror: the stock add lands in one account only
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_ACCOUNT=acct-01 CLAUDE_MULTIACC_MCP=0 claude mcp add -s user solo -- echo solo 2>&1)"
+mcp_has acct-01 solo && ! mcp_has acct-02 solo && t_ok "CLAUDE_MULTIACC_MCP=0: a stock add stays in one account" \
+  || t_fail "kill switch mirror" "$out"
+# a failing real command is never mirrored, and its exit status passes through
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_ACCOUNT=acct-02 claude mcp remove -s user never-there 2>&1)"
+rc=$?
+[ "$rc" != "0" ] && t_ok "a failed 'claude mcp remove' keeps its exit status" || t_fail "mcp remove passthrough rc" "rc=0: $out"
+# ...even when the client wrote its file BEFORE failing: the write stays in that one
+# account, the registry learns nothing, and the other account is untouched
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_ACCOUNT=acct-02 FAKE_MCP_WRITE_THEN_FAIL=1 claude mcp add -s user wtf -- echo w 2>&1)"
+rc=$?
+[ "$rc" != "0" ] && t_ok "a client that writes and then fails still fails the shim run" || t_fail "write-then-fail rc" "rc=0: $out"
+mcp_has acct-02 wtf && ! mcp_has acct-01 wtf && t_ok "the failed add stays in the one account that wrote it" \
+  || t_fail "write-then-fail leak" "$(cat "$MPOOL/acct-01/.claude.json")"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); sys.exit(0 if "wtf" not in d.get("mcpServers",{}) and "wtf" not in d.get("retired",[]) and "wtf" not in d.get("retiredUser",[]) else 1)' "$out" \
+  && t_ok "a failed stock add is never mirrored into the registry" || t_fail "failed mirror add" "$out"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_ACCOUNT=acct-02 FAKE_MCP_WRITE_THEN_FAIL=1 claude mcp remove -s user wtf 2>&1)"
+rc=$?
+[ "$rc" != "0" ] && t_ok "a client that removes and then fails still fails the shim run" || t_fail "write-then-fail remove rc" "rc=0: $out"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); sys.exit(0 if "wtf" not in d.get("retired",[]) and "wtf" not in d.get("retiredUser",[]) else 1)' "$out" \
+  && t_ok "a failed stock remove leaves no tombstone" || t_fail "failed mirror remove" "$out"
+# NESTED session: a pooled session exports CLAUDE_CONFIG_DIR=<acct> + CLAUDE_SHIM_ACTIVE=1
+# and its children inherit both, so an agent's `claude mcp add` reaches the passthrough
+# with the account already chosen — it must be mirrored exactly like a top-level one
+: > "$PYLOG"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_CONFIG_DIR="$MPOOL/acct-01" CLAUDE_SHIM_ACTIVE=1 CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" claude mcp add -s user nested -- echo n 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "a nested (in-session) 'claude mcp add' exits 0" || t_fail "nested add rc" "rc=$rc: $out"
+mcp_has acct-01 nested && mcp_has acct-02 nested && t_ok "a nested add is mirrored into EVERY account" \
+  || t_fail "nested mirror" "$out $(cat "$MPOOL/acct-02/.claude.json")"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); sys.exit(0 if "nested" in d.get("mcpServers",{}) else 1)' "$out" \
+  && t_ok "a nested add reaches the registry" || t_fail "nested registry" "$out"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_CONFIG_DIR="$MPOOL/acct-01" CLAUDE_SHIM_ACTIVE=1 claude mcp remove -s user nested 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "a nested 'claude mcp remove' exits 0" || t_fail "nested remove rc" "rc=$rc: $out"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); sys.exit(0 if "nested" in d.get("retiredUser",[]) and "nested" not in d.get("mcpServers",{}) else 1)' "$out" \
+  && t_ok "a nested remove leaves a user-scope tombstone" || t_fail "nested tombstone" "$out"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_ACCOUNT=acct-01 claude 2>&1)"
+check "the next launch on that account still runs" "CFG=acct-01" "$out"
+mcp_has acct-01 nested && t_fail "nested remove undone" "the next launch re-added nested" \
+  || t_ok "a nested remove is not undone by the next launch"
+# a CLAUDE_CONFIG_DIR OUTSIDE the pool is plain passthrough: no python, no mirror
+mkdir -p "$WORK/mcp-outside"
+: > "$PYLOG"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_CONFIG_DIR="$WORK/mcp-outside" CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" claude mcp add -s user outside -- echo o 2>&1)"
+[ "$?" = "0" ] && [ ! -s "$PYLOG" ] && ! mcp_has acct-01 outside \
+  && t_ok "a config dir outside the pool is untouched passthrough (no python, no mirror)" \
+  || t_fail "outside passthrough" "$out; pylog: $(cat "$PYLOG")"
+# the help pre-scan stops at `--`: -h in the SERVER's command line is not our --help
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp add --provider claude hsvc -- node s.js -h 127.0.0.1 2>&1)"
+rc=$?
+case "$out" in *USAGE*) t_fail "help scan" "-h after -- printed usage" ;; *) [ "$rc" = "0" ] && t_ok "-h after -- is the server's own flag, not --help" || t_fail "help scan rc" "rc=$rc: $out" ;; esac
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); sys.exit(0 if d["mcpServers"]["hsvc"]["args"]==["s.js","-h","127.0.0.1"] else 1)' "$out" \
+  && t_ok "the server keeps its -h argument" || t_fail "help scan args" "$out"
+# retirement reaches a server that was only ever hand-added to ONE account
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp remove --provider claude own-01 2>&1)"
+mcp_has acct-01 own-01 && t_fail "retire hand-added" "own-01 survives" \
+  || t_ok "mcp remove retires a server that was hand-added to a single account"
+# --provider both: the change reaches the codex pool beside this one
+CXM="$WORK/mcp-codex-pool"
+mkdir -p "$CXM/acct-01" "$CXM/tmp"
+cat > "$CXM/accounts.json" <<'EOF'
+{"version":1,"server":"none","threshold":90,
+ "accounts":[{"id":"acct-01","email":"cm1@cx","home":"mac","added_at":"2026-08-21T00:00:00Z"}]}
+EOF
+printf 'model = "gpt-5"\n\n[mcp_servers.keep]\ncommand = "true"\nargs = []\n' > "$CXM/acct-01/config.toml"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CODEX_ACCOUNTS_DIR="$CXM" CODEX_MULTIACC_NO_SYNC=1 claude-accounts mcp add shared -- echo both 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "mcp add --provider both (default) exits 0" || t_fail "mcp add both rc" "rc=$rc: $out"
+mcp_has acct-01 shared && t_ok "--provider both: the claude pool has the server" || t_fail "both claude" "$out"
+grep -q '^\[mcp_servers.shared\]' "$CXM/acct-01/config.toml" \
+  && t_ok "--provider both: the codex pool beside it has [mcp_servers.shared]" \
+  || t_fail "both codex" "$out $(cat "$CXM/acct-01/config.toml")"
+grep -q '^model = "gpt-5"' "$CXM/acct-01/config.toml" && grep -q '^\[mcp_servers.keep\]' "$CXM/acct-01/config.toml" \
+  && t_ok "the codex config keeps its unrelated content" || t_fail "codex lossless" "$(cat "$CXM/acct-01/config.toml")"
+[ -f "$CXM/mcp-servers.json" ] && t_ok "the codex pool got its own registry" || t_fail "codex registry" "missing"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CODEX_ACCOUNTS_DIR="$WORK/no-such-codex-pool" claude-accounts mcp add lonely -- echo one 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "no sibling pool: the mirror is silently skipped" || t_fail "no sibling" "rc=$rc: $out"
+case "$out" in *"no manifest"*|*"warning"*) t_fail "no sibling silence" "$out" ;; *) t_ok "no sibling pool: no warning" ;; esac
+# an EXPLICIT --provider codex with no codex pool is a loud error, not a silent no-op
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CODEX_ACCOUNTS_DIR="$WORK/no-such-codex-pool" claude-accounts mcp add --provider codex q -- echo q 2>&1)"
+rc=$?
+[ "$rc" != "0" ] && check "an explicit --provider codex without a codex pool fails loudly" "no codex pool" "$out" \
+  || t_fail "explicit provider" "rc=0: $out"
+# rc 3: the registry is saved, the healthy accounts are reconciled, the broken one is
+# reported, and the change STILL reaches the sibling pool (and would still sync)
+cp "$MPOOL/acct-02/.claude.json" "$WORK/mcp-acct-02.bak"
+printf '{not json' > "$MPOOL/acct-02/.claude.json"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CODEX_ACCOUNTS_DIR="$CXM" CODEX_MULTIACC_NO_SYNC=1 claude-accounts mcp add partial -- echo p 2>&1)"
+rc=$?
+[ "$rc" = "3" ] && t_ok "a corrupt account makes mcp add exit 3 (saved, partially applied)" || t_fail "partial rc" "rc=$rc: $out"
+check "the partial add says how to repair" "mcp apply" "$out"
+mcp_has acct-01 partial && t_ok "the healthy account was reconciled despite the corrupt one" || t_fail "partial healthy" "$out"
+grep -q '^\[mcp_servers.partial\]' "$CXM/acct-01/config.toml" \
+  && t_ok "the partial add still reached the codex pool beside it" || t_fail "partial sibling" "$(cat "$CXM/acct-01/config.toml")"
+cp "$WORK/mcp-acct-02.bak" "$MPOOL/acct-02/.claude.json"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp apply 2>&1)"
+mcp_has acct-02 partial && t_ok "mcp apply repairs the account once its config is fixed" || t_fail "partial repair" "$out"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp add --provider mars z -- echo z 2>&1)"
+rc=$?
+[ "$rc" != "0" ] && check "an unknown --provider is refused" "must be claude, codex or both" "$out" \
+  || t_fail "provider validation" "rc=0"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp bogus 2>&1)"
+rc=$?
+[ "$rc" != "0" ] && check "an unknown mcp subcommand is refused" "unknown mcp subcommand" "$out" \
+  || t_fail "subcommand validation" "rc=0"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp --help 2>&1)"
+check "mcp --help prints usage" "claude-accounts mcp add" "$out"
+# seeding a NEW account applies the registry (import goes through seed_account_dir)
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts import m3@test --id acct-03 --no-sync 2>&1)"
+mcp_has acct-03 reg1 && mcp_has acct-03 shared && t_ok "a newly seeded account gets every registered server" \
+  || t_fail "seed applies registry" "$out $(cat "$MPOOL/acct-03/.claude.json" 2>/dev/null)"
+
 # ---- 17b. verify authenticates the way the SHIM would ---------------------------------
 # A dead credential next to a live portable token: the shim runs that account with the
 # TOKEN, so verify must too — testing it with the dead credential would fail a healthy
@@ -4446,11 +4805,65 @@ export MKAUTH
 mk_cx_auth() { python3 "$MKAUTH" "$@"; }
 FUTURE_EXP=$((now + 864000))
 
+# A stand-in for the real `codex mcp add|remove`: appends / strips a
+# `[mcp_servers.NAME]` table in $CODEX_HOME/config.toml, where the real CLI keeps them.
+# A separate file because the fake codex below is an UNQUOTED heredoc.
+FAKE_CODEX_MCP="$WORK/fake_codex_mcp.py"
+cat > "$FAKE_CODEX_MCP" <<'EOF'
+import os, re, sys
+path, argv = sys.argv[1], sys.argv[2:]
+verb, rest = argv[1], argv[2:]
+name, cmd, envs = None, [], {}
+i = 0
+while i < len(rest):
+    a = rest[i]
+    if a == "--env":
+        k, v = rest[i + 1].split("=", 1); envs[k] = v; i += 2; continue
+    if a == "--":
+        cmd = rest[i + 1:]; break
+    if name is None:
+        name = a
+    i += 1
+src = open(path).read() if os.path.exists(path) else ""
+out, skip, found = [], False, False
+for line in src.splitlines(keepends=True):
+    st = line.strip()
+    if st.startswith("["):
+        skip = bool(re.match(r"\[mcp_servers\." + re.escape(name) + r"(\.|\])", st))
+        found = found or skip
+    if not skip:
+        out.append(line)
+src = "".join(out)
+def q(v):
+    return '"' + v.replace("\\", "\\\\").replace('"', '\\"') + '"'
+if verb == "add":
+    if src and not src.endswith("\n"):
+        src += "\n"
+    src += "\n[mcp_servers.%s]\ncommand = %s\nargs = [%s]\n" % (name, q(cmd[0]), ", ".join(q(a) for a in cmd[1:]))
+    if envs:
+        src += "env = { %s }\n" % ", ".join("%s = %s" % (k, q(v)) for k, v in envs.items())
+    print("Added global MCP server '%s'." % name)
+elif not found:
+    print("No MCP server named '%s' found." % name, file=sys.stderr); sys.exit(1)
+else:
+    print("Removed global MCP server '%s'." % name)
+with open(path + ".tmp", "w") as f:
+    f.write(src)
+os.replace(path + ".tmp", path)
+EOF
+
 # Fake "real" codex: prints which CODEX_HOME it ran under; scriptable login +
 # failures via a control file. (Note: must not contain the hyphenated shim marker.)
 cat > "$FAKEBIN/codex" <<EOF
 #!/usr/bin/env bash
 # fake real codex for tests (not a shim)
+if [ "\${1:-}" = "mcp" ] && [ -n "\${CODEX_HOME:-}" ]; then
+  python3 "$FAKE_CODEX_MCP" "\$CODEX_HOME/config.toml" "\$@"
+  rc=\$?
+  # FAKE_MCP_WRITE_THEN_FAIL=1: wrote the table, then died — nothing may be mirrored.
+  [ "\$rc" = 0 ] && [ -n "\${FAKE_MCP_WRITE_THEN_FAIL:-}" ] && exit 1
+  exit \$rc
+fi
 if [ "\${1:-}" = "login" ]; then
   shift
   # record the flags the CLI chose (device-auth default vs --browser opt-out)
@@ -6501,6 +6914,184 @@ else
   t_ok "codex npm-layer tests skipped (node not installed)"
 fi
 
+# ---- C19. MCP servers for every account (codex parity) ------------------------------
+# Same contract as 16e over config.toml: the registry is reconciled into the picked
+# account before exec (stamped, no python when nothing changed), a stock `codex mcp
+# add|remove` under the shim is mirrored into every account, and `codex-accounts mcp`
+# manages the registry — for this pool alone with --provider codex.
+CXP="$WORK/cx-mcp-pool"
+mkdir -p "$CXP/acct-01" "$CXP/acct-02" "$CXP/tmp"
+: > "$CXP/.limits-kick"
+cat > "$CXP/accounts.json" <<'EOF'
+{"version":1,"server":"none","threshold":90,
+ "accounts":[
+   {"id":"acct-01","email":"p1@cx","home":"mac","added_at":"2026-08-21T00:00:00Z"},
+   {"id":"acct-02","email":"p2@cx","home":"mac","added_at":"2026-08-21T00:00:00Z"}]}
+EOF
+mk_cx_auth "$CXP/acct-01/auth.json" p1@cx "$FUTURE_EXP"
+mk_cx_auth "$CXP/acct-02/auth.json" p2@cx "$FUTURE_EXP"
+for i in 01 02; do
+  printf 'model = "gpt-5"\n\n[mcp_servers.own-%s]\ncommand = "true"\nargs = []\n' "$i" > "$CXP/acct-$i/config.toml"
+done
+cx_has() { grep -q "^\[mcp_servers\.$2\]" "$CXP/$1/config.toml" 2>/dev/null; }
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" codex-accounts mcp add --provider codex reg1 -- echo hi 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "codex: mcp add (codex only) exits 0" || t_fail "codex mcp add rc" "rc=$rc: $out"
+cx_has acct-01 reg1 && cx_has acct-02 reg1 && t_ok "codex: mcp add reconciles EVERY account" \
+  || t_fail "codex mcp add reconcile" "$(cat "$CXP/acct-01/config.toml" "$CXP/acct-02/config.toml")"
+cx_has acct-01 own-01 && grep -q '^model = "gpt-5"' "$CXP/acct-01/config.toml" \
+  && t_ok "codex: an account's own servers and settings survive the reconcile" \
+  || t_fail "codex extras preserved" "$(cat "$CXP/acct-01/config.toml")"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" codex-accounts mcp list 2>&1)"
+check "codex: mcp list names the server" "reg1" "$out"
+# drift + launch: the picked account is reconciled before exec, and stamped
+python3 - "$CXP/acct-02/config.toml" <<'PY'
+import re, sys
+p = sys.argv[1]; src = open(p).read()
+out, skip = [], False
+for line in src.splitlines(keepends=True):
+    if line.lstrip().startswith("["):
+        skip = line.strip().startswith("[mcp_servers.reg1")
+    if not skip: out.append(line)
+open(p, "w").write("".join(out))
+PY
+cx_has acct-02 reg1 && t_fail "codex drift fixture" "reg1 still present" || t_ok "codex drift fixture: acct-02 lost reg1"
+: > "$PYLOG"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_ACCOUNT=acct-02 CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" codex 2>&1)"
+check "codex: launch runs on the pinned account" "CFG=acct-02" "$out"
+cx_has acct-02 reg1 && t_ok "codex: the shim reconciles the picked account before exec" \
+  || t_fail "codex shim reconcile" "$(cat "$CXP/acct-02/config.toml")"
+[ -s "$CXP/acct-02/.mcp-applied" ] && t_ok "codex: the reconcile leaves a stamp" || t_fail "codex stamp" "no .mcp-applied"
+: > "$PYLOG"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_ACCOUNT=acct-02 CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" codex 2>&1)"
+check "codex: second launch still runs" "CFG=acct-02" "$out"
+[ ! -s "$PYLOG" ] && t_ok "codex: an unchanged registry + config spends no python start-up" \
+  || t_fail "codex stamp short-circuit" "python ran: $(cat "$PYLOG")"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_ACCOUNT=acct-02 CLAUDE_MULTIACC_PYTHON=/nonexistent/python3 codex 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && check "codex: a missing python never breaks a launch" "CFG=acct-02" "$out" \
+  || t_fail "codex fail-open python" "rc=$rc: $out"
+# kill switch
+python3 - "$CXP/acct-01/config.toml" <<'PY'
+import sys
+p = sys.argv[1]; src = open(p).read()
+out, skip = [], False
+for line in src.splitlines(keepends=True):
+    if line.lstrip().startswith("["):
+        skip = line.strip().startswith("[mcp_servers.reg1")
+    if not skip: out.append(line)
+open(p, "w").write("".join(out))
+PY
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_ACCOUNT=acct-01 CODEX_MULTIACC_MCP=0 codex 2>&1)"
+check "codex: kill switch: launch still runs" "CFG=acct-01" "$out"
+cx_has acct-01 reg1 && t_fail "codex kill switch" "CODEX_MULTIACC_MCP=0 still reconciled" \
+  || t_ok "codex: CODEX_MULTIACC_MCP=0 leaves the account alone"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" codex-accounts mcp apply 2>&1)"
+cx_has acct-01 reg1 && t_ok "codex: mcp apply repairs the drifted account" || t_fail "codex mcp apply" "$out"
+# learn-from-write: a stock 'codex mcp add' under the shim reaches EVERY account
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" codex mcp add x -- echo hi 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && check "codex: stock 'codex mcp add' still answers like the real client" "Added global MCP server 'x'" "$out" \
+  || t_fail "codex stock mcp add rc" "rc=$rc: $out"
+cx_has acct-01 x && cx_has acct-02 x && t_ok "codex: a stock 'codex mcp add' lands in EVERY account" \
+  || t_fail "codex mirror add" "$(cat "$CXP/acct-01/config.toml" "$CXP/acct-02/config.toml")"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" codex-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); s=d["mcpServers"]["x"]; sys.exit(0 if s.get("command")=="echo" and s.get("args")==["hi"] else 1)' "$out" \
+  && t_ok "codex: the mirrored server is in the registry as a Claude-style block" || t_fail "codex mirror registry" "$out"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" codex mcp remove x 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "codex: stock 'codex mcp remove' exits 0" || t_fail "codex stock mcp remove rc" "rc=$rc: $out"
+cx_has acct-01 x || cx_has acct-02 x \
+  && t_fail "codex mirror remove" "x survives in an account" || t_ok "codex: a stock 'codex mcp remove' drops the server from EVERY account"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" codex-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); sys.exit(0 if ("x" in d.get("retiredUser",[]) or "x" in d.get("retired",[])) and "x" not in d.get("mcpServers",{}) else 1)' "$out" \
+  && t_ok "codex: a removed server is retired in the registry" || t_fail "codex tombstone" "$out"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_ACCOUNT=acct-01 CODEX_MULTIACC_MCP=0 codex mcp add solo -- echo solo 2>&1)"
+cx_has acct-01 solo && ! cx_has acct-02 solo && t_ok "codex: CODEX_MULTIACC_MCP=0: a stock add stays in one account" \
+  || t_fail "codex kill switch mirror" "$out"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_ACCOUNT=acct-02 codex mcp remove never-there 2>&1)"
+rc=$?
+[ "$rc" != "0" ] && t_ok "codex: a failed 'codex mcp remove' keeps its exit status" || t_fail "codex mcp remove rc" "rc=0: $out"
+# a client that wrote its table and then died: nothing is mirrored, the failure passes
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_ACCOUNT=acct-02 FAKE_MCP_WRITE_THEN_FAIL=1 codex mcp add wtf -- echo w 2>&1)"
+rc=$?
+[ "$rc" != "0" ] && t_ok "codex: a client that writes and then fails still fails the shim run" || t_fail "codex write-then-fail rc" "rc=0: $out"
+cx_has acct-02 wtf && ! cx_has acct-01 wtf && t_ok "codex: the failed add stays in the one account that wrote it" \
+  || t_fail "codex write-then-fail leak" "$(cat "$CXP/acct-01/config.toml")"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" codex-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); sys.exit(0 if "wtf" not in d.get("mcpServers",{}) and "wtf" not in d.get("retired",[]) and "wtf" not in d.get("retiredUser",[]) else 1)' "$out" \
+  && t_ok "codex: a failed stock add is never mirrored into the registry" || t_fail "codex failed mirror add" "$out"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_ACCOUNT=acct-02 FAKE_MCP_WRITE_THEN_FAIL=1 codex mcp remove wtf 2>&1)"
+rc=$?
+[ "$rc" != "0" ] && t_ok "codex: a client that removes and then fails still fails the shim run" || t_fail "codex write-then-fail remove rc" "rc=0: $out"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" codex-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); sys.exit(0 if "wtf" not in d.get("retired",[]) and "wtf" not in d.get("retiredUser",[]) else 1)' "$out" \
+  && t_ok "codex: a failed stock remove leaves no tombstone" || t_fail "codex failed mirror remove" "$out"
+# NESTED session: CODEX_HOME=<acct> + CODEX_SHIM_ACTIVE=1 is what every pooled codex
+# session's children inherit — the passthrough must mirror the write all the same
+: > "$PYLOG"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_HOME="$CXP/acct-01" CODEX_SHIM_ACTIVE=1 CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" codex mcp add nested -- echo n 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "codex: a nested (in-session) 'codex mcp add' exits 0" || t_fail "codex nested add rc" "rc=$rc: $out"
+cx_has acct-01 nested && cx_has acct-02 nested && t_ok "codex: a nested add is mirrored into EVERY account" \
+  || t_fail "codex nested mirror" "$out $(cat "$CXP/acct-02/config.toml")"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_HOME="$CXP/acct-01" CODEX_SHIM_ACTIVE=1 codex mcp remove nested 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "codex: a nested 'codex mcp remove' exits 0" || t_fail "codex nested remove rc" "rc=$rc: $out"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" codex-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); sys.exit(0 if ("nested" in d.get("retiredUser",[]) or "nested" in d.get("retired",[])) and "nested" not in d.get("mcpServers",{}) else 1)' "$out" \
+  && t_ok "codex: a nested remove leaves a tombstone" || t_fail "codex nested tombstone" "$out"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_ACCOUNT=acct-01 codex 2>&1)"
+check "codex: the next launch on that account still runs" "CFG=acct-01" "$out"
+cx_has acct-01 nested && t_fail "codex nested remove undone" "the next launch re-added nested" \
+  || t_ok "codex: a nested remove is not undone by the next launch"
+mkdir -p "$WORK/cx-outside"
+: > "$PYLOG"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_HOME="$WORK/cx-outside" CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" codex mcp add outside -- echo o 2>&1)"
+[ "$?" = "0" ] && [ ! -s "$PYLOG" ] && ! cx_has acct-01 outside \
+  && t_ok "codex: a CODEX_HOME outside the pool is untouched passthrough (no python, no mirror)" \
+  || t_fail "codex outside passthrough" "$out; pylog: $(cat "$PYLOG")"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" codex-accounts mcp add --provider codex hsvc -- node s.js -h 127.0.0.1 2>&1)"
+rc=$?
+case "$out" in *USAGE*) t_fail "codex help scan" "-h after -- printed usage" ;; *) [ "$rc" = "0" ] && t_ok "codex: -h after -- is the server's own flag, not --help" || t_fail "codex help scan rc" "rc=$rc: $out" ;; esac
+grep -q '^args = \["s.js", "-h", "127.0.0.1"\]' "$CXP/acct-01/config.toml" \
+  && t_ok "codex: the server keeps its -h argument" || t_fail "codex help scan args" "$(cat "$CXP/acct-01/config.toml")"
+# --provider both from the codex side reaches the claude pool beside it
+CLM="$WORK/mcp-claude-pool"
+mkdir -p "$CLM/acct-01" "$CLM/tmp"
+cat > "$CLM/accounts.json" <<'EOF'
+{"version":1,"server":"none","threshold":90,
+ "accounts":[{"id":"acct-01","email":"cl1@test","home":"mac","added_at":"2026-07-13T00:00:00Z"}]}
+EOF
+printf '{"mcpServers":{}}\n' > "$CLM/acct-01/.claude.json"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CLAUDE_ACCOUNTS_ROOT="$CLM" codex-accounts mcp add shared -- echo both 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "codex: mcp add --provider both (default) exits 0" || t_fail "codex mcp add both rc" "rc=$rc: $out"
+cx_has acct-01 shared && t_ok "codex: --provider both: the codex pool has the server" || t_fail "codex both codex" "$out"
+python3 -c 'import json,sys; d=json.load(open(sys.argv[1])); sys.exit(0 if "shared" in d.get("mcpServers",{}) else 1)' "$CLM/acct-01/.claude.json" \
+  && t_ok "codex: --provider both: the claude pool beside it has the server" \
+  || t_fail "codex both claude" "$(cat "$CLM/acct-01/.claude.json")"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" codex-accounts mcp --help 2>&1)"
+check "codex: mcp --help prints usage" "codex-accounts mcp add" "$out"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CLAUDE_ACCOUNTS_ROOT="$WORK/no-such-claude-pool" codex-accounts mcp add --provider claude q -- echo q 2>&1)"
+rc=$?
+[ "$rc" != "0" ] && check "codex: an explicit --provider claude without a claude pool fails loudly" "no claude pool" "$out" \
+  || t_fail "codex explicit provider" "rc=0: $out"
+cp "$CXP/acct-02/config.toml" "$WORK/cx-acct-02.bak"
+printf '[mcp_servers.broken\ncommand = "x"\n' > "$CXP/acct-02/config.toml"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CLAUDE_ACCOUNTS_ROOT="$CLM" codex-accounts mcp add partial -- echo p 2>&1)"
+rc=$?
+[ "$rc" = "3" ] && t_ok "codex: a corrupt config.toml makes mcp add exit 3 (saved, partially applied)" || t_fail "codex partial rc" "rc=$rc: $out"
+cx_has acct-01 partial && t_ok "codex: the healthy account was reconciled despite the corrupt one" || t_fail "codex partial healthy" "$out"
+python3 -c 'import json,sys; d=json.load(open(sys.argv[1])); sys.exit(0 if "partial" in d.get("mcpServers",{}) else 1)' "$CLM/acct-01/.claude.json" \
+  && t_ok "codex: the partial add still reached the claude pool beside it" || t_fail "codex partial sibling" "$(cat "$CLM/acct-01/.claude.json")"
+cp "$WORK/cx-acct-02.bak" "$CXP/acct-02/config.toml"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" codex-accounts mcp apply 2>&1)"
+cx_has acct-02 partial && t_ok "codex: mcp apply repairs the account once its config is fixed" || t_fail "codex partial repair" "$out"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" codex-accounts import p3@cx --id acct-03 --no-sync 2>&1)"
+cx_has acct-03 reg1 && cx_has acct-03 shared && t_ok "codex: a newly seeded account gets every registered server" \
+  || t_fail "codex seed applies registry" "$out $(cat "$CXP/acct-03/config.toml" 2>/dev/null)"
+
 # ---- 20. panel pools: --json, credential transfer, instance roots, local sync -------
 # Everything here runs against pools under $WORK/panel, addressed with the NEW
 # CLAUDE_ACCOUNTS_ROOT/CODEX_ACCOUNTS_ROOT env — while CLAUDE_ACCOUNTS_DIR (the legacy
@@ -7303,6 +7894,16 @@ else
 fi
 # ...and its claude twin: the cedar_ember status rides on the usage response, the claim
 # is idempotent across the fleet, and a confirmed reset lifts even a weekly client park.
+# The claude half of the MCP registry must run on STOCK macOS python (3.9): the shim
+# reconciles with whatever `python3` is on PATH, and a runner Mac's is /usr/bin/python3.
+# Skipped silently where that interpreter is absent or already 3.11+ (CI is ubuntu).
+if [ -x /usr/bin/python3 ] && /usr/bin/python3 -c 'import sys; sys.exit(0 if sys.version_info < (3, 11) else 1)' 2>/dev/null; then
+  if /usr/bin/python3 "$REPO_DIR/tests/test_mcp_registry.py" >/dev/null 2>&1; then
+    t_ok "MCP registry unit suite on stock python $(/usr/bin/python3 -c 'import sys;print("%d.%d"%sys.version_info[:2])')"
+  else
+    t_fail "MCP registry unit suite on stock python" "/usr/bin/python3 tests/test_mcp_registry.py failed"
+  fi
+fi
 if CLAUDE_MULTIACC_AUTO_RESET=1 python3 -m unittest discover -s "$REPO_DIR/tests" -p 'test_claude_reset*.py'; then
   t_ok "claude: automatic limit-reset integration suite"
 else