claude-multiacc 2.0.43 → 2.0.45

package/tests/run-tests.sh

@@ -272,8 +272,21 @@ if [ -f "$ctl" ] && grep -qx "brokencli:$acct" "$ctl" 2>/dev/null; then
   exit 1
 fi
 case " $* " in
-  *" -p --output-format text --max-turns 1 "*) echo "OK"; exit 0 ;;
+  *" -p --output-format text --max-turns 1 "*)
+    # verify's real call, refused: `verifysay:<acct>` answers FAKE_VERIFY_TEXT the way
+    # the real client prints a refusal in text mode — on STDOUT, exit 1 (health.log
+    # 2026-09-28: out="You've hit your weekly limit · resets 1am (Europe/Istanbul)" err='').
+    if [ -f "$ctl" ] && grep -qx "verifysay:$acct" "$ctl" 2>/dev/null; then
+      printf '%s\n' "${FAKE_VERIFY_TEXT:-}"
+      exit 1
+    fi
+    echo "OK"; exit 0 ;;
 esac
+if [ -f "$ctl" ] && grep -qx "model404:$acct" "$ctl" 2>/dev/null; then
+  # 2.1.283's 404 model_not_found text: about a MODEL, never the organization.
+  echo "The model claude-nope is not available on your firstParty deployment. Try switching to claude-opus-5, or ask your admin to enable this model."
+  exit 1
+fi
 if [ -f "$ctl" ] && grep -qx "fail:$acct" "$ctl" 2>/dev/null; then
   echo "API Error: 429 rate limit exceeded" >&2
   exit 1
@@ -367,6 +380,9 @@ export CLAUDE_MULTIACC_TOKEN_URL="file://$WORK/token-endpoint-missing.json"
 # (every explicit limits test overrides the URL inline). The pre-armed .limits-kick
 # throttle keeps those background kicks from racing explicit limits runs.
 export CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-endpoint-missing.json"
+# Organization checks must never send synthetic tokens to a real provider. The
+# dedicated identity suite overrides this with its loopback HTTP contract server.
+export CLAUDE_MULTIACC_TOKEN_IDENTITY_URL="file://$WORK/identity-endpoint-missing.json"
 : > "$ACC/.limits-kick"
 # Keychain lookups are OFF for the legacy sections (their pools are file-based and the
 # extra `security` process per account would only slow them down); section 17 turns
@@ -1152,6 +1168,17 @@ check "relogin targets org-blocked accounts" "acct-01 login saved" "$out"
 [ ! -f "$ACC/acct-01/.expired" ] && t_ok "a successful re-login clears an org block" \
   || t_fail "org-block relogin" "marker survived the re-login"
 rm -f "$ACC/acct-01/.expired"
+# The client's 404 model_not_found ends "…or ask your admin to enable this model". The org
+# vocabulary's bare "ask your admin to enable" matched it, parking a healthy account as
+# org-blocked over a model name; only "…to enable access" is the org refusal.
+printf '{"fetched_at":%s,"max_percent":1,"weekly_percent":1,"session_percent":1,"buckets":[]}' "$now" > "$ACC/acct-01/limits.json"
+printf '{"fetched_at":%s,"max_percent":50,"weekly_percent":50,"session_percent":50,"buckets":[]}' "$now" > "$ACC/acct-02/limits.json"
+echo "model404:acct-01" > "$FAKE_CTL"
+out="$(claude -p hello < /dev/null 2>&1)"
+check "a model 404 reaches the caller as it is" "not available on your firstParty deployment" "$out"
+[ ! -f "$ACC/acct-01/.expired" ] && t_ok "a model 404 ('ask your admin to enable this model') parks nothing" \
+  || t_fail "model 404 park" "$(tail -1 "$ACC/acct-01/.expired")"
+rm -f "$FAKE_CTL" "$ACC"/acct-*/limits.json "$ACC"/acct-*/.limited "$ACC"/acct-*/.expired
 
 # ---- 10. token-only account exports CLAUDE_CODE_OAUTH_TOKEN ------------------
 mkdir -p "$ACC/acct-03"
@@ -3210,6 +3237,14 @@ rm -f "$ACC/acct-05/limits.json"
 out="$(CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force 2>&1)"
 [ -f "$ACC/acct-05/.expired" ] && t_ok "a usage fetch does not unpark an org-blocked account" \
   || t_fail "org-block unpark" "telemetry cleared an org block it cannot observe"
+# ...nor one verify wrote with its soft_until (every org park carries one now)
+printf '%s\nreason=org-blocked soft_until=%s marked_at=now detail=test\n' "$now" "$(( $(date +%s) + 21600 ))" \
+  > "$ACC/acct-05/.expired"
+rm -f "$ACC/acct-05/limits.json"
+out="$(CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force 2>&1)"
+grep -q 'reason=org-blocked soft_until=' "$ACC/acct-05/.expired" 2>/dev/null \
+  && t_ok "a usage fetch does not unpark a soft-stamped org block" \
+  || t_fail "soft org-block unpark" "telemetry cleared a soft-stamped org block"
 rm -f "$ACC/acct-05/.expired" "$ACC/acct-05/server.token"
 
 # ---- 16b6. RECENTLY-expired token is left alone (a live session owns it) --------------
@@ -3767,6 +3802,34 @@ RACER
   grep -q "reason=org-blocked" "$SD/acct-01/.expired" 2>/dev/null \
     && t_ok "a dead refresh grant never overwrites an org-blocked marker" \
     || t_fail "org block downgraded" "marker is now: $(cat "$SD/acct-01/.expired" 2>/dev/null | tail -1)"
+  # The same without the portable token beside it — park_dead_grant never parks an
+  # account its token still serves, so the check above cannot see the guard. A live org
+  # block (no soft_until, or one still ahead) is never overwritten; one whose soft_until
+  # has run out binds nothing and outranks nothing, so the dead grant gets its own park.
+  mv "$SD/acct-01/server.token" "$SD/acct-01/server.token.aside"
+  for soft in none "$(( $(date +%s) + 21600 ))" "$(( $(date +%s) - 10 ))"; do
+    if [ "$soft" = none ]; then
+      printf '%s\nreason=org-blocked marked_at=now detail=test\n' "$now" > "$SD/acct-01/.expired"
+    else
+      printf '%s\nreason=org-blocked soft_until=%s marked_at=now detail=test\n' \
+        "$((now - 30000))" "$soft" > "$SD/acct-01/.expired"
+    fi
+    rm -f "$SD/acct-01/limits.json"
+    CLAUDE_ACCOUNTS_ROOT="$SD" CLAUDE_MULTIACC_USAGE_URL="http://127.0.0.1:$uport/ok" \
+      claude-accounts limits --force >/dev/null 2>&1
+    grep -q "reason=org-blocked" "$SD/acct-01/.expired" 2>/dev/null && echo kept || echo "$(tail -1 "$SD/acct-01/.expired" 2>/dev/null)"
+  done > "$WORK/lapsed-org.txt"
+  mv "$SD/acct-01/server.token.aside" "$SD/acct-01/server.token"
+  [ "$(sed -n 1p "$WORK/lapsed-org.txt")" = kept ] \
+    && t_ok "a dead refresh grant (no token beside it) never overwrites an org block" \
+    || t_fail "org block downgraded" "$(sed -n 1p "$WORK/lapsed-org.txt")"
+  [ "$(sed -n 2p "$WORK/lapsed-org.txt")" = kept ] \
+    && t_ok "a dead refresh grant never overwrites an org block inside its soft window" \
+    || t_fail "soft org block downgraded" "$(sed -n 2p "$WORK/lapsed-org.txt")"
+  case "$(sed -n 3p "$WORK/lapsed-org.txt")" in
+    reason=refresh-token-expired*) t_ok "a lapsed org block does not hide a dead refresh grant from its park" ;;
+    *) t_fail "lapsed org block shields a dead grant" "$(sed -n 3p "$WORK/lapsed-org.txt")" ;;
+  esac
   rm -f "$SD/acct-01/.expired" "$SD/acct-01/.credentials.json"
 
   # ---- the >=90% cutoff keeps the TIGHT window --------------------------------
@@ -4290,6 +4353,171 @@ case "$out" in
 esac
 rm -f "$WORK/ctl-brokencli"
 
+# ---- 17a3. a usage-limit refusal proves the org lets the account through --------------
+# acct-15, 2026-09-27: at weekly_all 100% a real call came back with the ORG refusal, and
+# once the lapsed subscription was paid again the same call answered "You've hit your
+# weekly limit" — the provider checks the org gate before the usage limiter. verify
+# failed that answer with no hint and kept the org-blocked park, so a paid account read
+# BLOCKED on that Mac through every re-check. A limit refusal now lifts a park by the PASS
+# rule, and the line stays FAIL (the runner counts it).
+VP="$WORK/verifylimit"
+vnow="$(date +%s)"   # the suite's $now is minutes old by here; soft windows need a fresh one
+VP_HOME=mac; VP_MACHINE=mac; [ "$(uname -s)" = "Darwin" ] || { VP_HOME=server; VP_MACHINE=linux; }
+mkdir -p "$VP/tmp" "$VP/acct-01" "$VP/acct-02" "$VP/acct-03"
+: > "$VP/.limits-kick"
+cat > "$VP/accounts.json" <<EOF2
+{ "version": 1, "threshold": 90,
+  "accounts": [
+    {"id": "acct-01", "email": "vl1@test", "home": "$VP_HOME", "added_at": "2026-09-28T00:00:00Z"},
+    {"id": "acct-02", "email": "vl2@test", "home": "$VP_HOME", "added_at": "2026-09-28T00:00:00Z"},
+    {"id": "acct-03", "email": "vl3@test", "home": "$VP_HOME", "added_at": "2026-09-28T00:00:00Z"}
+  ] }
+EOF2
+VP_LIVE='{"claudeAiOauth":{"accessToken":"sk-ant-oat01-vl","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999}}'
+# acct-01: OAuth login only. acct-02: a live login beside a portable token (verify runs
+# the LOGIN). acct-03: the portable token only (verify runs the TOKEN).
+printf '%s' "$VP_LIVE" > "$VP/acct-01/.credentials.json"
+printf '%s' "$VP_LIVE" > "$VP/acct-02/.credentials.json"
+printf 'sk-ant-oat01-vl-token-02' > "$VP/acct-02/server.token"
+printf 'sk-ant-oat01-vl-token-03' > "$VP/acct-03/server.token"
+printf 'verifysay:acct-01\nverifysay:acct-02\nverifysay:acct-03\n' > "$WORK/ctl-verifysay"
+vp_verify() { # $1 = what the refused call prints
+  FAKE_CTL="$WORK/ctl-verifysay" FAKE_VERIFY_TEXT="$1" CLAUDE_ACCOUNTS_DIR="$VP" \
+    claude-accounts verify 2>&1
+}
+vp_line() { printf '%s\n' "$out" | grep "^$1 " | head -1; }
+vp_park() { # $1 acct, $2 marker line 2 (reason=… fields)
+  printf '%s\n%s\n' "$((vnow - 3600))" "$2" > "$VP/$1/.expired"
+}
+vp_park acct-01 "reason=org-blocked marked_at=2026-09-27T20:42:42Z detail=the account's organization has disabled Claude Code access"
+vp_park acct-02 "reason=setup-token-invalid marked_at=2026-09-27T20:42:42Z detail=portable setup-token failed a real inference"
+vp_park acct-03 "reason=org-blocked soft_until=$((vnow + 20000)) marked_at=2026-09-27T20:42:42Z detail=x"
+rm -f "$VP/acct-03/.server-token-verified"
+out="$(vp_verify "You've hit your weekly limit · resets 1am (Europe/Istanbul)")"
+rc=$?
+check "a limit refusal still reads FAIL, in the shape the runner parses" \
+  "acct-01 vl1@test: FAIL rc=1 out=\"You've hit your weekly limit" "$out"
+check "a limit refusal is called what it is" "usage-limited, not a login or org problem" "$(vp_line acct-01)"
+check "a limit refusal names the park it lifted" "lifted its org-blocked park" "$(vp_line acct-01)"
+[ ! -f "$VP/acct-01/.expired" ] && t_ok "a limit refusal lifts an org-blocked park (the org gate answers first)" \
+  || t_fail "limit lifts org park" "$(tail -1 "$VP/acct-01/.expired")"
+[ "$rc" = 1 ] && check "limit refusals are still counted as failures" "verified 3 account(s), 3 failure(s)" "$out" \
+  || t_fail "limit refusal exit" "rc=$rc"
+n="$(printf '%s\n' "$out" | grep -cE '^(acct-[0-9]+)[[:space:]]+([^[:space:]]+):[[:space:]]+(PASS|FAIL|OK|SKIP)([^[:alnum:]_].*)?$')"
+[ "$n" = 3 ] && t_ok "every account line still matches app-robot's verdict pattern" \
+  || t_fail "verdict pattern" "matched $n of 3: $out"
+# The LOGIN answered for acct-02: that proves nothing about the portable token a real
+# call rejected, so its token park stays — the PASS rule, exactly.
+check "a limit refusal on the login is still called usage-limited" "usage-limited" "$(vp_line acct-02)"
+case "$(vp_line acct-02)" in
+  *lifted*) t_fail "login limit must not claim a lift" "$(vp_line acct-02)" ;;
+  *) t_ok "a limit refusal that lifted nothing does not claim a lift" ;;
+esac
+grep -q 'reason=setup-token-invalid' "$VP/acct-02/.expired" 2>/dev/null \
+  && t_ok "a limit refusal on the OAuth login keeps a setup-token-invalid park" \
+  || t_fail "login limit vs token park" "the token park was lifted by the login's answer"
+[ ! -f "$VP/acct-02/.server-token-verified" ] && t_ok "the login's limit answer records no token proof" \
+  || t_fail "login limit token proof" ".server-token-verified written for a token that never answered"
+# The TOKEN answered for acct-03: its park goes and the token is proven, as on a PASS.
+check "a token limit refusal names the park it lifted" "lifted its org-blocked park" "$(vp_line acct-03)"
+[ ! -f "$VP/acct-03/.expired" ] && t_ok "a limit refusal on the token lifts the park" \
+  || t_fail "token limit lift" "$(tail -1 "$VP/acct-03/.expired")"
+want="$(printf 'sk-ant-oat01-vl-token-03' | { shasum -a 256 2>/dev/null || sha256sum; } | cut -d' ' -f1)"
+[ "$(cat "$VP/acct-03/.server-token-verified" 2>/dev/null)" = "$want" ] \
+  && t_ok "a limit refusal on the token records .server-token-verified for that token" \
+  || t_fail "token limit proof" "got '$(cat "$VP/acct-03/.server-token-verified" 2>/dev/null)'"
+st="$(CLAUDE_ACCOUNTS_DIR="$VP" claude-accounts list --json 2>/dev/null \
+  | python3 -c 'import json,sys; print({a["id"]: a["status"] for a in json.load(sys.stdin)["accounts"]}.get("acct-01"))')"
+[ "$st" != "blocked" ] && t_ok "the lifted account no longer lists as blocked ($st)" \
+  || t_fail "lifted account status" "list --json still says blocked"
+# A model-scoped limit is the same limiter speaking.
+vp_park acct-01 "reason=org-blocked marked_at=2026-09-27T20:42:42Z detail=x"
+out="$(vp_verify "You've reached your Fable limit. Switch to another model, or manage usage credits at claude.ai/settings/usage?from=cc_cl to continue.")"
+[ ! -f "$VP/acct-01/.expired" ] && check "a model-scoped limit lifts the org park too" "lifted its org-blocked park" "$(vp_line acct-01)" \
+  || t_fail "model limit lift" "$(tail -1 "$VP/acct-01/.expired")"
+# ...but not the throttle the client itself calls "not your usage limit", nor an overload:
+# neither proves the org gate was passed, and both contain limit words.
+for said in "API Error: Server is temporarily limiting requests (not your usage limit) · Rate limited" \
+            "API Error: 529 Overloaded. Rate limit exceeded, try again" \
+            "Opus is experiencing high load, please use /model to switch to Sonnet"; do
+  vp_park acct-01 "reason=org-blocked marked_at=2026-09-27T20:42:42Z detail=x"
+  out="$(vp_verify "$said")"
+  if grep -q 'reason=org-blocked' "$VP/acct-01/.expired" 2>/dev/null \
+      && case "$(vp_line acct-01)" in *usage-limited*) false ;; *) true ;; esac; then
+    t_ok "no lift on a transient answer: ${said:0:48}"
+  else
+    t_fail "transient answer lifted a park" "${said:0:48} -> $(vp_line acct-01)"
+  fi
+done
+rm -f "$VP"/acct-*/.expired
+
+# The ORG refusal: verify's park carries the shim's 6 h soft_until, and seeing the refusal
+# again refreshes it (a stale stamp would release a still-blocked account early).
+ORG_TEXT="Your organization has disabled Claude subscription access for Claude Code · Use an Anthropic API key instead, or ask your admin to enable access"
+t0="$(date +%s)"
+out="$(vp_verify "$ORG_TEXT")"
+t1="$(date +%s)"
+check "verify calls out the org block" "ORG BLOCKED" "$(vp_line acct-01)"
+soft="$(sed -n 's/.*soft_until=\([0-9][0-9]*\).*/\1/p' "$VP/acct-01/.expired" 2>/dev/null)"
+{ [ -n "$soft" ] && [ "$soft" -ge $((t0 + 21600)) ] && [ "$soft" -le $((t1 + 21600)) ]; } \
+  && t_ok "verify's org park carries soft_until = now + 6 h" \
+  || t_fail "verify org soft_until" "$(tail -1 "$VP/acct-01/.expired" 2>/dev/null)"
+grep -q '^reason=org-blocked soft_until=[0-9]* marked_at=' "$VP/acct-01/.expired" \
+  && t_ok "verify writes the shim's field order" || t_fail "org park shape" "$(tail -1 "$VP/acct-01/.expired")"
+printf '%s\nreason=org-blocked soft_until=%s marked_at=2026-09-27T20:42:42Z detail=x\n' \
+  "$((vnow - 21000))" "$((vnow + 60))" > "$VP/acct-01/.expired"
+t0="$(date +%s)"
+out="$(vp_verify "$ORG_TEXT")"
+soft="$(sed -n 's/.*soft_until=\([0-9][0-9]*\).*/\1/p' "$VP/acct-01/.expired" 2>/dev/null)"
+epoch="$(head -1 "$VP/acct-01/.expired" 2>/dev/null)"
+{ [ -n "$soft" ] && [ "$soft" -ge $((t0 + 21600)) ] && [ "$epoch" -ge "$t0" ] \
+    && ! grep -q 'marked_at=2026-09-27T20:42:42Z' "$VP/acct-01/.expired"; } \
+  && t_ok "a re-observed org refusal refreshes the park (epoch, marked_at, soft_until)" \
+  || t_fail "org park refresh" "$(cat "$VP/acct-01/.expired" 2>/dev/null | tr '\n' ' ')"
+# A weaker reason still never overwrites an org block that binds...
+out="$(vp_verify "Failed to authenticate. API Error: 401 OAuth access token is invalid.")"
+grep -q 'reason=org-blocked' "$VP/acct-01/.expired" \
+  && t_ok "an auth failure never overwrites an org block in force" \
+  || t_fail "org block outranked" "$(tail -1 "$VP/acct-01/.expired")"
+# ...while one whose soft window has run out binds nothing and outranks nothing.
+printf '%s\nreason=org-blocked soft_until=%s marked_at=2026-09-27T20:42:42Z detail=x\n' \
+  "$((vnow - 30000))" "$((vnow - 10))" > "$VP/acct-01/.expired"
+out="$(vp_verify "Failed to authenticate. API Error: 401 OAuth access token is invalid.")"
+grep -q 'reason=auth-error' "$VP/acct-01/.expired" \
+  && t_ok "a lapsed org block no longer shields the account from an auth park" \
+  || t_fail "lapsed org block" "$(tail -1 "$VP/acct-01/.expired")"
+rm -f "$VP"/acct-*/.expired
+# The 404 model_not_found text is about a model, not the org: no park in verify either.
+out="$(vp_verify "The model claude-nope is not available on your firstParty deployment. Try switching to claude-opus-5, or ask your admin to enable this model.")"
+[ ! -f "$VP/acct-01/.expired" ] && t_ok "verify does not park on 'ask your admin to enable this model'" \
+  || t_fail "verify model 404" "$(tail -1 "$VP/acct-01/.expired")"
+case "$(vp_line acct-01)" in
+  *"ORG BLOCKED"*|*usage-limited*) t_fail "verify model 404 wording" "$(vp_line acct-01)" ;;
+  *) t_ok "a model 404 is neither an org block nor a usage limit" ;;
+esac
+# An org park whose soft_until has passed no longer blocks the account anywhere: the
+# audit (list/expired/status/--json) reads it the way the shim does.
+printf '%s\nreason=org-blocked soft_until=%s marked_at=x detail=x\n' "$((vnow - 30000))" "$((vnow - 10))" \
+  > "$VP/acct-01/.expired"
+printf '%s\nreason=org-blocked soft_until=%s marked_at=x detail=x\n' "$vnow" "$((vnow + 21600))" \
+  > "$VP/acct-02/.expired"
+rows="$(python3 "$REPO_DIR/lib/audit.py" "$VP" "$VP_MACHINE")"
+[ "$(printf '%s\n' "$rows" | awk -F'\t' '$1=="acct-01"{print $4}')" = "ok" ] \
+  && t_ok "a lapsed org park no longer reads blocked in the audit" \
+  || t_fail "lapsed org park audit" "$(printf '%s\n' "$rows" | grep acct-01)"
+[ "$(printf '%s\n' "$rows" | awk -F'\t' '$1=="acct-02"{print $4}')" = "blocked" ] \
+  && t_ok "an org park inside its soft window still reads blocked" \
+  || t_fail "org park audit" "$(printf '%s\n' "$rows" | grep acct-02)"
+out="$(CLAUDE_ACCOUNTS_DIR="$VP" claude-accounts list 2>&1)"
+case "$(printf '%s\n' "$out" | grep '^acct-01 ')" in
+  *ORG-BLOCKED*) t_fail "lapsed org park list" "$(printf '%s\n' "$out" | grep '^acct-01 ')" ;;
+  *) t_ok "list does not flag a lapsed org park" ;;
+esac
+out="$(CLAUDE_ACCOUNTS_DIR="$VP" claude-accounts expired 2>&1)"
+check "expired says when the pool re-tries an org-blocked account" "re-tried by the pool after" "$out"
+rm -f "$WORK/ctl-verifysay"
+unset -f vp_verify vp_line vp_park
+
 # ---- 16e. MCP servers for every account ---------------------------------------------
 # Claude Code keeps MCP servers in the CONFIG DIR, so under the pool a stock `claude mcp
 # add` used to land in ONE random account — appinspire was connected in some sessions
@@ -6883,6 +7111,23 @@ out="$(codex-accounts verify 2>&1)"
 check "codex: verify calls out the workspace block" "ORG BLOCKED" "$out"
 grep -q "reason=org-blocked" "$CX/acct-02/.expired" 2>/dev/null \
   && t_ok "codex: verify parks the org-blocked account" || t_fail "codex verify org park" "no marker"
+# ...with bin/codex's 6 h soft_until, in the shim's field order, refreshed when seen again
+t0="$(date +%s)"
+soft="$(sed -n 's/.*soft_until=\([0-9][0-9]*\).*/\1/p' "$CX/acct-02/.expired" 2>/dev/null)"
+{ [ -n "$soft" ] && [ "$soft" -gt $((t0 + 21000)) ] && [ "$soft" -le $((t0 + 21600)) ] \
+    && grep -q '^reason=org-blocked soft_until=[0-9]* marked_at=' "$CX/acct-02/.expired"; } \
+  && t_ok "codex: verify's org park carries soft_until = now + 6 h" \
+  || t_fail "codex verify org soft_until" "$(tail -1 "$CX/acct-02/.expired" 2>/dev/null)"
+printf '%s\nreason=org-blocked soft_until=%s marked_at=2026-09-27T20:42:42Z detail=x\n' \
+  "$((t0 - 21000))" "$((t0 + 60))" > "$CX/acct-02/.expired"
+out="$(codex-accounts verify 2>&1)"
+soft="$(sed -n 's/.*soft_until=\([0-9][0-9]*\).*/\1/p' "$CX/acct-02/.expired" 2>/dev/null)"
+{ [ -n "$soft" ] && [ "$soft" -ge $((t0 + 21600)) ] \
+    && ! grep -q 'marked_at=2026-09-27T20:42:42Z' "$CX/acct-02/.expired"; } \
+  && t_ok "codex: a re-observed workspace block refreshes the park" \
+  || t_fail "codex org park refresh" "$(cat "$CX/acct-02/.expired" 2>/dev/null | tr '\n' ' ')"
+out="$(codex-accounts expired 2>&1)"
+check "codex: expired says when the pool re-tries a blocked account" "re-tried by the pool after" "$out"
 rm -f "$FAKE_CTL2" "$CX/acct-02/.expired"
 
 # ---- C16. audit vocabulary + empty pool ---------------------------------------------
@@ -7672,12 +7917,12 @@ check "mint refuses an unregistered account dir" "unknown account: acct-77" "$ou
   || t_fail "mint orphan dir" "server.token was written to an unregistered slot"
 rm -rf "$ACC/acct-77"
 
-# mint must NAME the account it is about to bind a token to (the only guard there is).
+# mint must NAME the account even when no saved organization is available to check.
 printf 'sk-ant-oat01-MINTNAMEDMINTNAMEDMINTNAMEDMINTNAMEDMINTNAMED\n' \
   | claude-accounts mint acct-01 --paste > "$WORK/mint-named.out" 2>&1
 out="$(cat "$WORK/mint-named.out")"
 check "mint --paste names the account in its prompt" "for acct-01" "$out"
-check "mint warns that a setup token carries no identity" "carries no identity" "$out"
+check "mint reports an unavailable organization check" "organization could not be checked" "$out"
 
 # ---- 47. every known verb answers --help with exit 0 (app-robot probes with it) ----
 # app-robot's runner asks `<verb> --help` to decide whether a Mac's build has the verb;
@@ -9021,6 +9266,12 @@ else
   t_fail "auto-resume watcher unit suite" "see unittest output above"
 fi
 
+if python3 -m unittest discover -s "$REPO_DIR/tests" -p 'test_*token_identity*.py'; then
+  t_ok "claude: portable token organization identity suite"
+else
+  t_fail "claude portable token identity suite" "see unittest output above"
+fi
+
 # ---- summary ---------------------------------------------------------------------
 echo
 echo "passed: $PASS  failed: $FAIL"

package/tests/test_autoresume.py

@@ -11,6 +11,7 @@ PATH and a fake probe script. Runs under python3.9+.
 
 from __future__ import annotations
 
+import calendar
 import contextlib
 import importlib.util
 import json
@@ -128,6 +129,27 @@ def cx_error(ts, info, message="boom", completed_at=None):
 
 LIMIT_MSG = ("You’ve hit your usage limit. Visit https://chatgpt.com/codex/settings/usage "
              "to purchase more credits or try again at Sep 26th, 2026 12:39 AM.")
+_MONTH_ABBR = ("Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov",
+               "Dec")
+
+
+def limit_msg(epoch):
+    """LIMIT_MSG with its "try again at" date set to ``epoch``, rendered in UTC the way
+    the codex CLI prints it (read it back with TZ=UTC). A walk on the real clock needs this:
+    the classifier ignores a "try again at" that is already past, and a fixed date goes stale
+    (LIMIT_MSG's Sep 26th, 2026 did on that day, which failed the Publish run)."""
+    t = time.gmtime(epoch)
+    day = t.tm_mday
+    nth = "th" if 11 <= day <= 13 else {1: "st", 2: "nd", 3: "rd"}.get(day % 10, "th")
+    return ("You’ve hit your usage limit. Visit https://chatgpt.com/codex/settings/usage "
+            "to purchase more credits or try again at %s %d%s, %d %d:%02d %s."
+            % (_MONTH_ABBR[t.tm_mon - 1], day, nth, t.tm_year, t.tm_hour % 12 or 12,
+               t.tm_min, "AM" if t.tm_hour < 12 else "PM"))
+
+
+def future_reset(now):
+    """A minute-aligned "try again at" three days after ``now``."""
+    return (int(now) // 60 + 3 * 24 * 60) * 60
 
 
 def cx_tokens(ts, primary=None, secondary=None, limit_id="codex", info=None):
@@ -434,6 +456,12 @@ class CodexClassifierTests(unittest.TestCase):
                              1793631600)
             self.assertEqual(ar.parse_try_again("try again at December 3rd, 2026 9:15 AM"),
                              1796289300)
+            self.assertEqual(limit_msg(1790383140), LIMIT_MSG)  # the helper renders it
+            for stamp in ((2026, 10, 1, 12, 5), (2026, 11, 2, 15, 0), (2026, 12, 3, 9, 15),
+                          (2026, 9, 11, 0, 0), (2026, 9, 12, 23, 59), (2026, 9, 13, 12, 0),
+                          (2026, 9, 21, 1, 1), (2026, 9, 22, 13, 30), (2026, 9, 23, 11, 59)):
+                when = calendar.timegm(stamp + (0,))
+                self.assertEqual(ar.parse_try_again(limit_msg(when)), when, limit_msg(when))
         if os.path.exists("/usr/share/zoneinfo/America/New_York"):
             with local_tz("America/New_York"):  # EDT, UTC-4
                 self.assertEqual(ar.parse_try_again(LIMIT_MSG), 1790383140 + 4 * 3600)
@@ -1973,16 +2001,17 @@ class CodexWatcherTests(PoolCase):
         return rc, w, r, path
 
     def test_quota_rotates_with_resume_and_the_message_date(self):
+        reset = future_reset(self.t0)  # the message's date, read in the local (UTC) zone
+        msg = limit_msg(reset)
         with local_tz("UTC"):
             rc, w, r, _ = self.run_codex(
                 ["--yolo", "resume", CX_SID], [
                     cx_meta(self.launched - 7200, cwd=str(self.work)),
-                    cx_error(self.launched - 7000, "usage_limit_exceeded", LIMIT_MSG),
+                    cx_error(self.launched - 7000, "usage_limit_exceeded", msg),
                     cx_event(self.t0 - 2, {"type": "task_started"}),
                     cx_tokens(self.t0 - 1, limit_id="premium"),
-                    cx_error(self.t0 - 1, "usage_limit_exceeded", LIMIT_MSG)])
+                    cx_error(self.t0 - 1, "usage_limit_exceeded", msg)])
         self.assertEqual(rc, 0)
-        reset = 1790383140  # Sep 26th, 2026 12:39 AM, read in the local (UTC) zone
         prompt = ar.resume_prompt("quota")
         probe = r.probes[0]
         self.assertEqual(probe["argv"], [self.self_path, "resume", "--yolo", CX_SID, prompt])
@@ -2234,13 +2263,15 @@ class CliTests(PoolCase):
         self.assertEqual(doc["events"][0]["kind"], "verdict")  # no --since: everything counts
 
     def test_classify_codex(self):
+        reset = future_reset(self.t0)
         path = self.tmp / "r.jsonl"
         path.write_text(jl([cx_meta(self.t0), cx_tokens(self.t0, limit_id="premium"),
-                            cx_error(self.t0, {"usage_limit_exceeded": None}, LIMIT_MSG)]))
+                            cx_error(self.t0, {"usage_limit_exceeded": None},
+                                     limit_msg(reset))]))
         doc = json.loads(self.cli("classify", "--provider", "codex", str(path),
                                   env={"TZ": "UTC"}).stdout)
         self.assertEqual(doc["pending"]["class"], "quota")
-        self.assertEqual(doc["pending"]["reset"], 1790383140)
+        self.assertEqual(doc["pending"]["reset"], reset)
         self.assertNotIn("_message", doc["pending"])
         self.assertNotIn("usage limit", json.dumps(doc))