claude-multiacc 2.0.42 → 2.0.44

package/tests/run-tests.sh

@@ -125,7 +125,9 @@ if [ "${1:-}" = "auth" ] && [ "${2:-}" = "login" ]; then
     h="$(printf '%s' "$CLAUDE_CONFIG_DIR" | { shasum -a 256 2>/dev/null || sha256sum; } | cut -c1-8)"
     hex="$(printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-login","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999,"scopes":["user:inference"],"subscriptionType":"max"}}' \
       | python3 -c 'import sys;print(sys.stdin.buffer.read().hex())')"
-    security add-generic-password -U -a tester -s "Claude Code-credentials-$h" -X "$hex"
+    # The real client's account name is FA(): $USER, and Bun's "unknown" without it.
+    [ -n "${FAKE_LOGIN_SAW:-}" ] && printf '%s\n' "${USER:-<unset>}" > "$FAKE_LOGIN_SAW"
+    security add-generic-password -U -a "${USER:-unknown}" -s "Claude Code-credentials-$h" -X "$hex"
     echo "Logged in."
     exit 0
   fi
@@ -249,6 +251,17 @@ case "${CLAUDE_CODE_OAUTH_TOKEN:-}" in
       *) echo "Failed to authenticate. API Error: 401 OAuth access token is invalid." >&2; exit 1 ;;
     esac ;;
 esac
+if [ -n "${FAKE_KEYCHAIN_CLIENT:-}" ] && [ -n "${CLAUDE_CONFIG_DIR:-}" ] \
+  && [ -z "${CLAUDE_CODE_OAUTH_TOKEN:-}" ]; then
+  # The real macOS client's login lookup: the Keychain item under its FA() name ONLY
+  # ($USER; Bun's "unknown" without it), then .credentials.json — nothing else.
+  h="$(printf '%s' "$CLAUDE_CONFIG_DIR" | { shasum -a 256 2>/dev/null || sha256sum; } | cut -c1-8)"
+  if ! security find-generic-password -a "${USER:-unknown}" -s "Claude Code-credentials-$h" -w >/dev/null 2>&1 \
+    && [ ! -f "$CLAUDE_CONFIG_DIR/.credentials.json" ]; then
+    echo "Not logged in · Please run /login" >&2
+    exit 1
+  fi
+fi
 if [ -f "$ctl" ] && grep -qx "brokencli:$acct" "$ctl" 2>/dev/null; then
   # An infrastructure fault, not a login verdict: the CLI never reached the API.
   # Verbatim from my-mini, 2026-09-10. Note it carries no auth vocabulary at all
@@ -319,67 +332,19 @@ if [ -n "${FAKE_SESSION_ID:-}" ] && [ -n "${CLAUDE_CONFIG_DIR:-}" ]; then
 fi
 # what an interactive client would inherit from the shim (auto-resume must leak nothing)
 [ -n "${FAKE_PRINT_ENV:-}" ] && echo "AR_ENV=$(env | grep -c '^CLAUDE_MULTIACC_AR')"
+[ -n "${FAKE_PRINT_USER:-}" ] && echo "USER=${USER:-<unset>} LOGNAME=${LOGNAME:-<unset>}"
 echo "CFG=$acct TOK=${CLAUDE_CODE_OAUTH_TOKEN:-none} ARGS=$*"
 EOF
 chmod +x "$FAKEBIN/claude"
 
-# Fake macOS `security` (generic-password verbs only): items live as files under
-# $FAKE_KEYCHAIN_DIR/<service> (content = the secret) + <service>.acct (account name).
+# Fake macOS `security` (generic-password verbs only), shared with tests/test_keychain.py:
+# items keyed by (service, account) under $FAKE_KEYCHAIN_DIR, -a selecting its own and
+# no -a the OLDEST, exactly as the real tool behaves (see the file's header).
 # FAKE_KEYCHAIN_LOCKED=1 simulates a session that cannot open the keychain — secret
 # reads and every write exit 36 while ATTRIBUTE reads still answer, exactly the split
 # the real tool exhibits over ssh. Shadows any real /usr/bin/security via PATH, so a
 # macOS dev run of this suite can never touch the developer's actual keychain.
-cat > "$FAKEBIN/security" <<'EOF'
-#!/usr/bin/env bash
-KC="${FAKE_KEYCHAIN_DIR:-/nonexistent-keychain}"
-cmd="${1:-}"; shift || true
-svc=""; acct=""; want_pw=0; hexdata=""
-while [ $# -gt 0 ]; do
-  case "$1" in
-    -s) svc="$2"; shift 2 ;;
-    -a) acct="$2"; shift 2 ;;
-    -w) want_pw=1; shift ;;
-    -X) hexdata="$2"; shift 2 ;;
-    *) shift ;;
-  esac
-done
-# The modification stamp is RECORDED AT WRITE TIME in a sidecar rather than derived
-# from the item file's mtime: `stat`/`date` flags differ between BSD and GNU (on Linux
-# `stat -f %m` even "succeeds" with garbage), and this fake must behave identically on
-# a developer's Mac and on Linux CI.
-item_mdat() { cat "$KC/$svc.mdat" 2>/dev/null || echo 00000000000000; }
-case "$cmd" in
-  show-keychain-info)
-    [ -n "${FAKE_KEYCHAIN_LOCKED:-}" ] && exit 36
-    exit 0 ;;
-  find-generic-password)
-    [ -f "$KC/$svc" ] || exit 44
-    if [ "$want_pw" = "1" ]; then
-      [ -n "${FAKE_KEYCHAIN_LOCKED:-}" ] && exit 36
-      cat "$KC/$svc"
-      exit 0
-    fi
-    a="tester"; [ -f "$KC/$svc.acct" ] && a="$(cat "$KC/$svc.acct")"
-    printf 'keychain: "login.keychain-db"\nclass: "genp"\nattributes:\n'
-    printf '    "acct"<blob>="%s"\n' "$a"
-    printf '    "mdat"<timedate>=0x00  "%sZ\\000"\n' "$(item_mdat)"
-    printf '    "svce"<blob>="%s"\n' "$svc"
-    exit 0 ;;
-  add-generic-password)
-    [ -n "${FAKE_KEYCHAIN_LOCKED:-}" ] && exit 36
-    mkdir -p "$KC"
-    printf '%s' "$hexdata" | python3 -c 'import sys;sys.stdout.buffer.write(bytes.fromhex(sys.stdin.read().strip()))' > "$KC/$svc"
-    printf '%s' "${acct:-tester}" > "$KC/$svc.acct"
-    date -u +%Y%m%d%H%M%S > "$KC/$svc.mdat"
-    exit 0 ;;
-  delete-generic-password)
-    [ -n "${FAKE_KEYCHAIN_LOCKED:-}" ] && exit 36
-    [ -f "$KC/$svc" ] || exit 44
-    rm -f "$KC/$svc" "$KC/$svc.acct" "$KC/$svc.mdat"
-    exit 0 ;;
-  *) exit 1 ;;
-esac
-EOF
+cp "$REPO_DIR/tests/fake_security.sh" "$FAKEBIN/security"
 chmod +x "$FAKEBIN/security"
 
 export PATH="$REPO_DIR/bin:$FAKEBIN:$PATH"
@@ -402,6 +367,9 @@ export CLAUDE_MULTIACC_TOKEN_URL="file://$WORK/token-endpoint-missing.json"
 # (every explicit limits test overrides the URL inline). The pre-armed .limits-kick
 # throttle keeps those background kicks from racing explicit limits runs.
 export CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-endpoint-missing.json"
+# Organization checks must never send synthetic tokens to a real provider. The
+# dedicated identity suite overrides this with its loopback HTTP contract server.
+export CLAUDE_MULTIACC_TOKEN_IDENTITY_URL="file://$WORK/identity-endpoint-missing.json"
 : > "$ACC/.limits-kick"
 # Keychain lookups are OFF for the legacy sections (their pools are file-based and the
 # extra `security` process per account would only slow them down); section 17 turns
@@ -7707,12 +7675,12 @@ check "mint refuses an unregistered account dir" "unknown account: acct-77" "$ou
   || t_fail "mint orphan dir" "server.token was written to an unregistered slot"
 rm -rf "$ACC/acct-77"
 
-# mint must NAME the account it is about to bind a token to (the only guard there is).
+# mint must NAME the account even when no saved organization is available to check.
 printf 'sk-ant-oat01-MINTNAMEDMINTNAMEDMINTNAMEDMINTNAMEDMINTNAMED\n' \
   | claude-accounts mint acct-01 --paste > "$WORK/mint-named.out" 2>&1
 out="$(cat "$WORK/mint-named.out")"
 check "mint --paste names the account in its prompt" "for acct-01" "$out"
-check "mint warns that a setup token carries no identity" "carries no identity" "$out"
+check "mint reports an unavailable organization check" "organization could not be checked" "$out"
 
 # ---- 47. every known verb answers --help with exit 0 (app-robot probes with it) ----
 # app-robot's runner asks `<verb> --help` to decide whether a Mac's build has the verb;
@@ -7769,11 +7737,22 @@ cat > "$KCP/accounts.json" <<EOF
 EOF
 printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-kfile","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999}}' > "$KCP/acct-01/.credentials.json"
 kc_hash() { printf '%s' "$1" | { shasum -a 256 2>/dev/null || sha256sum; } | cut -c1-8; }
-kc_svc_file() { printf '%s/Claude Code-credentials-%s' "$FAKE_KEYCHAIN_DIR" "$(kc_hash "$1")"; }
-kc_put() { # kc_put <acct dir> <credential json> — store it the way the client would
-  security add-generic-password -U -a tester -s "Claude Code-credentials-$(kc_hash "$1")" \
+kc_svc_dir() { printf '%s/Claude Code-credentials-%s' "$FAKE_KEYCHAIN_DIR" "$(kc_hash "$1")"; }
+kc_put() { # kc_put <acct dir> <credential json> [account] — store it the way a client the
+           # pool launches would: under its FA() name, $USER, which lib/common.sh and
+           # bin/claude fill from `id -un` when the caller's env has none
+  security add-generic-password -U -a "${3:-${USER:-$(id -un)}}" -s "Claude Code-credentials-$(kc_hash "$1")" \
     -X "$(printf '%s' "$2" | python3 -c 'import sys;print(sys.stdin.buffer.read().hex())')"
 }
+kc_items() { # kc_items <acct dir> -> the account names holding an item, one per line
+  local i
+  for i in "$(kc_svc_dir "$1")"/*/; do [ -d "$i" ] && basename "$i"; done
+  return 0
+}
+kc_secret() { # kc_secret <acct dir> [account] -> the stored document
+  cat "$(kc_svc_dir "$1")/${2:-${USER:-$(id -un)}}/secret" 2>/dev/null
+}
+KC_ME="$(id -un)"   # the canonical name: what the CLI fills USER with when it is unset
 kc_put "$KCP/acct-02" '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-kchain","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999}}'
 export CLAUDE_MULTIACC_KEYCHAIN=1
 
@@ -7834,13 +7813,25 @@ python3 -c 'import json,sys; d=json.load(open(sys.argv[1])); assert d.get("sourc
 
 # 17e. refresh: an expired keychain credential refreshes via the grant and is written
 # BACK to the keychain — never copied out into a .credentials.json
-kc_put "$KCP/acct-02" '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-kold","refreshToken":"sk-ant-ort01-kc","expiresAt":1000000,"refreshTokenExpiresAt":9999999999999}}'
+# Beside it: a copy of the grant the refresh starts from (spent once the grant rotates —
+# it goes) and ANOTHER live grant (the right account's login beside a wrong-account
+# sign-in's, say — only a verified sign-in may drop that one).
+KC_OLD='{"claudeAiOauth":{"accessToken":"sk-ant-oat01-kold","refreshToken":"sk-ant-ort01-kc","expiresAt":1000000,"refreshTokenExpiresAt":9999999999999}}'
+KC_OTHER='{"claudeAiOauth":{"accessToken":"sk-ant-oat01-kother","refreshToken":"sk-ant-ort01-other","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999}}'
+kc_put "$KCP/acct-02" "$KC_OLD"
+kc_put "$KCP/acct-02" "$KC_OLD" unknown
+kc_put "$KCP/acct-02" "$KC_OTHER" claude-code-user
 rm -f "$KCP/acct-02/limits.json" "$KCP/acct-02/.oauth-refresh.json"
 out="$(CLAUDE_ACCOUNTS_DIR="$KCP" CLAUDE_MULTIACC_TOKEN_URL="file://$WORK/token-ok.json" CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force 2>&1)"
 check "keychain credential refreshes via the grant" "acct-02: oauth access token refreshed" "$out"
-grep -q 'sk-ant-oat01-refreshednew' "$(kc_svc_file "$KCP/acct-02")" \
+kc_secret "$KCP/acct-02" | grep -q 'sk-ant-oat01-refreshednew' \
   && t_ok "rotated credential written back to the keychain" \
   || t_fail "keychain write-back" "item not updated"
+[ "$(kc_items "$KCP/acct-02" | sort | tr '\n' ' ')" = "$(printf '%s\n' "$KC_ME" claude-code-user | sort | tr '\n' ' ')" ] \
+  && [ "$(kc_secret "$KCP/acct-02" claude-code-user)" = "$KC_OTHER" ] \
+  && t_ok "the write-back drops the spent copy of the grant and keeps another live grant" \
+  || t_fail "keychain write-back siblings" "items: $(kc_items "$KCP/acct-02" | tr '\n' ' ')"
+security delete-generic-password -a claude-code-user -s "Claude Code-credentials-$(kc_hash "$KCP/acct-02")" >/dev/null 2>&1
 [ ! -f "$KCP/acct-02/.credentials.json" ] \
   && t_ok "refresh never copies the keychain credential to a file" \
   || t_fail "keychain leak to file" ".credentials.json appeared beside a keychain login"
@@ -7854,14 +7845,30 @@ CLAUDE_ACCOUNTS_DIR="$KCP" claude >/dev/null 2>&1
   && t_ok ".expired self-heals on a newer keychain credential" \
   || t_fail "keychain .expired self-heal" "marker survived a newer keychain login"
 
-# 17g. a login ceremony that lands in the keychain registers instead of dying
+# 17g. a login ceremony that lands in the keychain registers instead of dying. The slot
+# it reserves (acct-03) can carry leftover items from an account once removed there; they
+# go only AFTER the identity read back and the registration committed — a sign-in as an
+# account the pool already has is skipped and must leave them alone.
+kc_put "$KCP/acct-03" "$KC_OTHER" unknown
+out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_LOGIN_KEYCHAIN=1 FAKE_EMAIL=kchain@test CLAUDE_ACCOUNTS_DIR="$KCP" claude-accounts add 2>&1)"
+check "an add that signs in as a registered account is skipped" "already added as acct-02" "$out"
+[ "$(kc_secret "$KCP/acct-03" unknown)" = "$KC_OTHER" ] \
+  && t_ok "a skipped add prunes nothing" \
+  || t_fail "skipped add prune" "items: $(kc_items "$KCP/acct-03" | tr '\n' ' ')"
+grep -q 'keychain prune acct-03' "$KCP/ops.log" 2>/dev/null \
+  && t_fail "skipped add prune" "a prune ran before the registration" \
+  || t_ok "no prune ran for the skipped add"
 out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_LOGIN_KEYCHAIN=1 FAKE_EMAIL=kc3@test CLAUDE_ACCOUNTS_DIR="$KCP" claude-accounts add kc3@test 2>&1)"
 check "add registers a keychain-backed sign-in" "Registered acct-03 for kc3@test" "$out"
 [ ! -f "$KCP/acct-03/.credentials.json" ] \
   && t_ok "keychain add leaves no plaintext credential" \
   || t_fail "keychain add" "unexpected .credentials.json"
-[ -f "$(kc_svc_file "$KCP/acct-03")" ] && t_ok "the sign-in landed in the keychain" \
-  || t_fail "keychain add item" "no keychain item for acct-03"
+[ "$(kc_items "$KCP/acct-03")" = "$KC_ME" ] && kc_secret "$KCP/acct-03" | grep -q 'sk-ant-oat01-login' \
+  && t_ok "the registered sign-in is the one item left, under \$(id -un)" \
+  || t_fail "keychain add item" "items: $(kc_items "$KCP/acct-03" | tr '\n' ' ')"
+grep -q "keychain prune acct-03: pruned: kept $KC_ME, removed unknown" "$KCP/ops.log" 2>/dev/null \
+  && t_ok "the add's prune is logged" \
+  || t_fail "add prune log" "no prune line for acct-03 in ops.log"
 
 # 17h. export refuses a keychain-held machine-local credential, naming the store
 out="$(CLAUDE_ACCOUNTS_DIR="$KCP" claude-accounts export-credential acct-03 --out "$WORK/kc-export.json" 2>&1)"; rc=$?
@@ -7871,7 +7878,7 @@ check "export names the keychain as the machine-local store" "macOS Keychain" "$
 
 # 17i. remove deletes the keychain item with the account
 CLAUDE_ACCOUNTS_DIR="$KCP" claude-accounts remove acct-03 --yes >/dev/null 2>&1
-[ ! -f "$(kc_svc_file "$KCP/acct-03")" ] && t_ok "remove drops the keychain item" \
+[ -z "$(kc_items "$KCP/acct-03")" ] && t_ok "remove drops the keychain item" \
   || t_fail "keychain remove" "the item survived removal"
 
 # 17j. dedupe keeps the duplicate that actually holds the (keychain) login. The
@@ -7889,12 +7896,187 @@ mkdir -p "$KCP/acct-04" "$KCP/acct-05"
 kc_put "$KCP/acct-05" '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-kdup","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999}}'
 out="$(CLAUDE_ACCOUNTS_DIR="$KCP" claude-accounts dedupe --yes 2>&1)"
 check "dedupe removes the credential-less duplicate, not the keychain one" "will remove acct-04 (kdup@test)" "$out"
-[ -f "$(kc_svc_file "$KCP/acct-05")" ] && t_ok "the keychain-authed duplicate survives dedupe" \
+[ -n "$(kc_items "$KCP/acct-05")" ] && t_ok "the keychain-authed duplicate survives dedupe" \
   || t_fail "dedupe keychain keep" "acct-05's keychain item is gone"
 grep -q '"acct-04"' "$KCP/accounts.json" \
   && t_fail "dedupe manifest" "acct-04 still registered" \
   || t_ok "the credential-less duplicate left the manifest"
 
+# 17k. several items per service (2026-09-24). Claude Code names its item after $USER and,
+# under Bun, a client with no USER calls the user "unknown": app-robot's panel ran
+# `claude-accounts login acct-02` from an env without USER, the fresh login landed under
+# "unknown" beside the dead item under the real name, and the check read the dead one
+# (`security -s` without -a answers with the OLDEST item) — "login failed … nothing
+# changed". Now the CLI fills USER, every lookup reads the canonical item (the one the
+# client reads), and a sign-in prunes the siblings only once its identity checked out.
+python3 - "$KCP/accounts.json" <<'EOF2'
+import json, sys
+doc = json.load(open(sys.argv[1]))
+doc['accounts'].append({'id': 'acct-06', 'email': 'kfix@test', 'home': 'mac',
+                        'added_at': '2026-09-24T00:00:00Z'})
+json.dump(doc, open(sys.argv[1], 'w'))
+EOF2
+mkdir -p "$KCP/acct-06"
+KC_DEAD='{"claudeAiOauth":{"accessToken":"sk-ant-oat01-kdead","refreshToken":"r","expiresAt":1000,"refreshTokenExpiresAt":1000}}'
+KC_UNK='{"claudeAiOauth":{"accessToken":"sk-ant-oat01-kunk","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999}}'
+FAKE_KEYCHAIN_MDAT=20260910173739 kc_put "$KCP/acct-06" "$KC_DEAD" "$KC_ME"
+FAKE_KEYCHAIN_MDAT=20260924095747 kc_put "$KCP/acct-06" "$KC_UNK" unknown
+out="$(env -u USER -u LOGNAME CLAUDE_ACCOUNTS_DIR="$KCP" claude-accounts list --json 2>&1)"
+python3 - "$out" <<'EOF2'
+import json, sys
+a6 = {a['id']: a for a in json.loads(sys.argv[1])['accounts']}['acct-06']
+assert a6['selectable'] is False and a6['needs_login'] is True, a6
+EOF2
+[ $? -eq 0 ] && t_ok "the pool judges the canonical (dead) item its client reads, not the newer sibling" \
+  || t_fail "keychain canonical read" "see assertions above"
+# A sign-in as the WRONG account: the client itself overwrites the canonical item, but
+# nothing multiacc does may touch the rest — the live sibling can be the right account's.
+out="$(env -u USER -u LOGNAME CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_LOGIN_KEYCHAIN=1 FAKE_EMAIL=intruder@test \
+  CLAUDE_ACCOUNTS_DIR="$KCP" claude-accounts login acct-06 2>&1)"; rc=$?
+[ "$rc" != "0" ] && t_ok "a wrong-identity login fails" || t_fail "wrong-identity login" "rc=0"
+check "a wrong-identity login says nothing was saved" "nothing saved" "$out"
+[ "$(kc_items "$KCP/acct-06" | sort | tr '\n' ' ')" = "$(printf '%s\n' "$KC_ME" unknown | sort | tr '\n' ' ')" ] \
+  && [ "$(kc_secret "$KCP/acct-06" unknown)" = "$KC_UNK" ] \
+  && t_ok "a wrong-identity login leaves every sibling item intact" \
+  || t_fail "wrong-identity keychain login" "items: $(kc_items "$KCP/acct-06" | tr '\n' ' ')"
+grep -q 'keychain prune acct-06' "$KCP/ops.log" 2>/dev/null \
+  && t_fail "wrong-identity keychain login" "pruned before the identity check" \
+  || t_ok "no prune ran for the wrong-identity login"
+FAKE_KEYCHAIN_MDAT=20260910173739 kc_put "$KCP/acct-06" "$KC_DEAD" "$KC_ME"
+out="$(env -u USER -u LOGNAME CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_LOGIN_KEYCHAIN=1 FAKE_EMAIL=kfix@test \
+  FAKE_LOGIN_SAW="$WORK/kc-login-saw" CLAUDE_ACCOUNTS_DIR="$KCP" claude-accounts login acct-06 2>&1)"; rc=$?
+[ "$rc" = "0" ] && t_ok "a USER-less login over a dead canonical + live sibling succeeds" \
+  || t_fail "USER-less keychain login" "rc=$rc: $(printf '%s' "$out" | tail -c 200)"
+check "the USER-less login reports the keychain store" "acct-06 login saved (macOS Keychain" "$out"
+[ "$(cat "$WORK/kc-login-saw" 2>/dev/null)" = "$KC_ME" ] \
+  && t_ok "the client the ceremony starts gets USER=\$(id -un), not Bun's 'unknown'" \
+  || t_fail "ceremony USER fill" "client saw USER=$(cat "$WORK/kc-login-saw" 2>/dev/null)"
+[ "$(kc_items "$KCP/acct-06")" = "$KC_ME" ] \
+  && t_ok "the verified login leaves exactly ONE item, under \$(id -un)" \
+  || t_fail "keychain prune" "items: $(kc_items "$KCP/acct-06" | tr '\n' ' ')"
+kc_secret "$KCP/acct-06" "$KC_ME" | grep -q 'sk-ant-oat01-login' \
+  && t_ok "the surviving item is the fresh login" \
+  || t_fail "keychain prune" "the canonical item does not hold the fresh login"
+grep -q "keychain prune acct-06: pruned: kept $KC_ME, removed unknown" "$KCP/ops.log" 2>/dev/null \
+  && t_ok "the prune is logged (non-secret) to ops.log" \
+  || t_fail "keychain prune log" "no prune line in ops.log"
+grep -q 'sk-ant' "$KCP/ops.log" 2>/dev/null \
+  && t_fail "keychain prune log" "a credential reached ops.log" \
+  || t_ok "ops.log carries no credential"
+
+# 17l. a failed ceremony changes nothing — not even the stale items ("nothing changed")
+FAKE_KEYCHAIN_MDAT=20260912000000 kc_put "$KCP/acct-06" "$KC_DEAD" "$KC_ME"
+FAKE_KEYCHAIN_MDAT=20260913000000 kc_put "$KCP/acct-06" "$KC_DEAD" unknown
+out="$(env -u USER -u LOGNAME CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_LOGIN_FAIL=1 FAKE_EMAIL=kfix@test \
+  CLAUDE_ACCOUNTS_DIR="$KCP" claude-accounts login acct-06 2>&1)"; rc=$?
+[ "$rc" != "0" ] && [ "$(kc_items "$KCP/acct-06" | sort | tr '\n' ' ')" = "$(printf '%s\n' "$KC_ME" unknown | sort | tr '\n' ' ')" ] \
+  && [ "$(kc_secret "$KCP/acct-06" unknown)" = "$KC_DEAD" ] \
+  && t_ok "an aborted login leaves every item as it was" \
+  || t_fail "aborted keychain login" "rc=$rc items: $(kc_items "$KCP/acct-06" | tr '\n' ' ')"
+
+# 17m. remove drops EVERY item for the dir, whatever name it sits under
+FAKE_KEYCHAIN_MDAT=20260101000000 kc_put "$KCP/acct-06" "$KC_DEAD" claude-code-user
+FAKE_KEYCHAIN_MDAT=20260102000000 kc_put "$KCP/acct-06" "$KC_DEAD" renamed-user
+CLAUDE_ACCOUNTS_DIR="$KCP" claude-accounts remove acct-06 --yes >/dev/null 2>&1
+[ -z "$(kc_items "$KCP/acct-06")" ] && t_ok "remove leaves zero items when duplicates exist" \
+  || t_fail "keychain remove duplicates" "left: $(kc_items "$KCP/acct-06" | tr '\n' ' ')"
+
+# 17n. the shim judges exactly the item its client will read: -a <$USER, filled>. A
+# live login under any other name is invisible to that client, so it is no auth here.
+KSP="$WORK/kcshim"
+mkdir -p "$KSP/tmp" "$KSP/acct-01" "$KSP/acct-02"
+: > "$KSP/.limits-kick"
+cat > "$KSP/accounts.json" <<EOF2
+{ "version": 1, "server": "root@203.0.113.1", "server_root": "/root/.claude-accounts",
+  "server_repo": "/root/claude-multiacc", "threshold": 90,
+  "accounts": [
+    {"id": "acct-01", "email": "sfile@test", "home": "mac", "added_at": "2026-09-24T00:00:00Z"},
+    {"id": "acct-02", "email": "schain@test", "home": "mac", "added_at": "2026-09-24T00:00:00Z"}
+  ] }
+EOF2
+printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-sfile","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999}}' > "$KSP/acct-01/.credentials.json"
+printf '%s\nbucket=session percent=95 reason=limits\n' "$((now+3600))" > "$KSP/acct-01/.limited"
+KC_LIVE='{"claudeAiOauth":{"accessToken":"sk-ant-oat01-slive","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999}}'
+kc_put "$KSP/acct-02" "$KC_LIVE" unknown
+out="$(env -u USER -u LOGNAME CLAUDE_ACCOUNTS_DIR="$KSP" claude 2>&1)"
+check "shim ignores a live item under a name its client never reads" "CFG=acct-01" "$out"
+FAKE_KEYCHAIN_MDAT=20260910000000 kc_put "$KSP/acct-02" "$KC_LIVE" "$KC_ME"
+FAKE_KEYCHAIN_MDAT=20260924000000 kc_put "$KSP/acct-02" "$KC_DEAD" unknown
+out="$(env -u USER -u LOGNAME FAKE_PRINT_USER=1 CLAUDE_ACCOUNTS_DIR="$KSP" claude 2>&1)"
+check "shim reads the -a \$(id -un) item even when a newer sibling is dead" "CFG=acct-02" "$out"
+check "the client the shim starts inherits the filled USER/LOGNAME" "USER=$KC_ME LOGNAME=$KC_ME" "$out"
+out="$(env -u USER -u LOGNAME FAKE_PRINT_USER=1 CLAUDE_CONFIG_DIR="$KSP/acct-02" claude 2>&1)"
+check "a passthrough launch gets the filled USER too" "USER=$KC_ME LOGNAME=$KC_ME" "$out"
+out="$(env USER=other.user LOGNAME=keep FAKE_PRINT_USER=1 CLAUDE_CONFIG_DIR="$KSP/acct-02" claude 2>&1)"
+check "a caller's own USER/LOGNAME are never overridden" "USER=other.user LOGNAME=keep" "$out"
+
+# 17o. an item under a name the client does not read is NO login to anything that judges
+# the account — list, audit, verify — just as it is none to the shim and the client. Only
+# the limits pass looks further, and moves it under the canonical name. my-mini's
+# acct-06/acct-21 shape (the only item under "unknown"), with and without a setup token,
+# plus the reverse order: a stale sibling OLDER than the canonical item.
+KLP="$WORK/kclegacy"
+# The accounts live on THIS machine (CI runs on Linux): a login-less account whose home
+# is another machine is 'remote', not one that needs a login here.
+KLP_HOME=mac; [ "$(uname -s)" = "Darwin" ] || KLP_HOME=server
+mkdir -p "$KLP/tmp" "$KLP/acct-01" "$KLP/acct-02" "$KLP/acct-03"
+: > "$KLP/.limits-kick"
+cat > "$KLP/accounts.json" <<EOF2
+{ "version": 1, "server": "root@203.0.113.1", "server_root": "/root/.claude-accounts",
+  "server_repo": "/root/claude-multiacc", "threshold": 90,
+  "accounts": [
+    {"id": "acct-01", "email": "ltok@test", "home": "$KLP_HOME", "added_at": "2026-09-24T00:00:00Z"},
+    {"id": "acct-02", "email": "lonly@test", "home": "$KLP_HOME", "added_at": "2026-09-24T00:00:00Z"},
+    {"id": "acct-03", "email": "lorder@test", "home": "$KLP_HOME", "added_at": "2026-09-24T00:00:00Z"}
+  ] }
+EOF2
+printf 'sk-ant-oat01-legacy-token-01' > "$KLP/acct-01/server.token"
+KC_L1='{"claudeAiOauth":{"accessToken":"sk-ant-oat01-l1","refreshToken":"sk-ant-ort01-l1","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999}}'
+KC_L2='{"claudeAiOauth":{"accessToken":"sk-ant-oat01-l2","refreshToken":"sk-ant-ort01-l2","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999}}'
+kc_put "$KLP/acct-01" "$KC_L1" unknown
+kc_put "$KLP/acct-02" "$KC_L2" unknown
+FAKE_KEYCHAIN_MDAT=20260901000000 kc_put "$KLP/acct-03" "$KC_DEAD" unknown
+FAKE_KEYCHAIN_MDAT=20260924000000 kc_put "$KLP/acct-03" "$KC_LIVE" "$KC_ME"
+out="$(env -u USER -u LOGNAME CLAUDE_ACCOUNTS_DIR="$KLP" claude-accounts list --json 2>&1)"
+python3 - "$out" <<'EOF2'
+import json, sys
+rows = {a['id']: a for a in json.loads(sys.argv[1])['accounts']}
+a1, a2, a3 = rows['acct-01'], rows['acct-02'], rows['acct-03']
+assert a1['credentials']['oauth_store'] is None, a1['credentials']
+assert a2['selectable'] is False and a2['needs_login'] is True, a2
+assert a2['credentials']['oauth_store'] is None, a2['credentials']
+assert a3['selectable'] is True and a3['credentials']['keychain'] == 'readable', a3
+EOF2
+[ $? -eq 0 ] && t_ok "list --json counts only the item its client reads (none under another name; canonical over an older sibling)" \
+  || t_fail "keychain legacy list" "see assertions above"
+out="$(env -u USER -u LOGNAME FAKE_KEYCHAIN_CLIENT=1 CLAUDE_ACCOUNTS_DIR="$KLP" claude-accounts verify 2>&1)"
+check "verify runs a token-backed account on its token when its login is out of the client's reach" "acct-01 ltok@test: PASS" "$out"
+check "verify skips an account whose only login its client cannot read" "acct-02 lonly@test: SKIP" "$out"
+check "verify passes the canonical item beside an older stale sibling" "acct-03 lorder@test: PASS" "$out"
+[ ! -f "$KLP/acct-01/.expired" ] && [ -f "$KLP/acct-01/.server-token-verified" ] \
+  && t_ok "verify neither parks it nor forgets its token proof" \
+  || t_fail "keychain legacy verify" "acct-01: $(cat "$KLP/acct-01/.expired" 2>/dev/null | tail -1)"
+out="$(env -u USER -u LOGNAME CLAUDE_ACCOUNTS_DIR="$KLP" CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force 2>&1)"
+check "the limits pass moves a login filed under another name" "acct-02: Keychain login moved under $KC_ME" "$out"
+check "and reads usage with it" "acct-02: ok" "$out"
+[ "$(kc_items "$KLP/acct-01")" = "$KC_ME" ] && [ "$(kc_secret "$KLP/acct-01")" = "$KC_L1" ] \
+  && [ "$(kc_items "$KLP/acct-02")" = "$KC_ME" ] && [ "$(kc_secret "$KLP/acct-02")" = "$KC_L2" ] \
+  && t_ok "each moved login is the one item left, under \$(id -un), unchanged" \
+  || t_fail "keychain legacy move" "acct-01: $(kc_items "$KLP/acct-01" | tr '\n' ' ') acct-02: $(kc_items "$KLP/acct-02" | tr '\n' ' ')"
+[ "$(kc_items "$KLP/acct-03" | sort | tr '\n' ' ')" = "$(printf '%s\n' "$KC_ME" unknown | sort | tr '\n' ' ')" ] \
+  && t_ok "the pass leaves an account with a canonical item alone (no write, no prune)" \
+  || t_fail "keychain legacy move" "acct-03: $(kc_items "$KLP/acct-03" | tr '\n' ' ')"
+out="$(env -u USER -u LOGNAME CLAUDE_ACCOUNTS_DIR="$KLP" claude-accounts list --json 2>&1)"
+python3 - "$out" <<'EOF2'
+import json, sys
+a2 = {a['id']: a for a in json.loads(sys.argv[1])['accounts']}['acct-02']
+assert a2['selectable'] is True and a2['credentials']['keychain'] == 'readable', a2
+EOF2
+[ $? -eq 0 ] && t_ok "once moved, the login counts everywhere" \
+  || t_fail "keychain legacy move list" "see assertions above"
+out="$(env -u USER -u LOGNAME FAKE_KEYCHAIN_CLIENT=1 CLAUDE_ACCOUNTS_DIR="$KLP" claude-accounts verify 2>&1)"
+check "and its client can use it" "acct-02 lonly@test: PASS" "$out"
+
 export CLAUDE_MULTIACC_KEYCHAIN=0
 unset FAKE_KEYCHAIN_DIR
 
@@ -8842,6 +9024,12 @@ else
   t_fail "auto-resume watcher unit suite" "see unittest output above"
 fi
 
+if python3 -m unittest discover -s "$REPO_DIR/tests" -p 'test_*token_identity*.py'; then
+  t_ok "claude: portable token organization identity suite"
+else
+  t_fail "claude portable token identity suite" "see unittest output above"
+fi
+
 # ---- summary ---------------------------------------------------------------------
 echo
 echo "passed: $PASS  failed: $FAIL"