claude-multiacc 2.0.58 → 2.0.60

package/tests/test_mcp_registry.py

@@ -88,7 +88,7 @@ class EffectiveMergeTests(RegistryCase):
 
 
 class ClaudeReconcileTests(RegistryCase):
-    def test_upsert_purges_tombstones_everywhere_and_keeps_extras(self):
+    def test_upsert_purges_tombstones_everywhere_and_adopts_extras(self):
         (self.root / "acct-01" / ".claude.json").write_text(json.dumps({
             "numStartups": 3,
             "mcpServers": {"adspower-local-api": STDIO, "mine": STDIO,
@@ -107,7 +107,10 @@ class ClaudeReconcileTests(RegistryCase):
                          {"type": "stdio", "command": "npx",
                           "args": ["-y", "appinspire-mcp@latest", "serve"], "env": {"K": "V"}})
         self.assertEqual(sorted(doc["projects"]["/p"]["mcpServers"]), ["keep"])
-        self.assertEqual(sorted(self.claude_doc("acct-02")["mcpServers"]), ["appinspire-mcp"])
+        # an extra no section names is adopted: every account gets it (2026-10-22)
+        self.assertEqual(sorted(self.claude_doc("acct-02")["mcpServers"]), ["appinspire-mcp", "mine"])
+        self.assertEqual(sorted(self.claude_doc("acct-02")["projects"]["/p"]["mcpServers"]), ["keep"])
+        self.assertEqual(sorted(self.registry()["mcpServers"]), ["appinspire-mcp", "mine"])
         self.assertEqual(self.registry()["retired"], ["adspower-local-api"])
         self.assertTrue((self.root / "acct-01" / ".mcp-applied").exists())
 
@@ -514,7 +517,9 @@ class CodexReconcileTests(RegistryCase):
         self.assertEqual(rc, 0)
         doc = self.parsed()
         self.assertEqual(doc["mcp_servers"]["old"]["command"], "new")
-        self.assertEqual(doc["mcp_servers"]["other"], {"command": "c"})
+        # the extra is adopted, so it now comes back in the registry's own translation
+        self.assertEqual(doc["mcp_servers"]["other"]["command"], "c")
+        self.assertIn("other", self.registry()["mcpServers"])
 
     def test_an_unsupported_layout_is_refused_and_the_file_survives(self):
         original = 'mcp_servers = { old = { command = "a" } }\n'
@@ -593,5 +598,231 @@ class CodexReconcileTests(RegistryCase):
         self.assertIn("acct-01: unchanged", out)
 
 
+class AdoptTests(RegistryCase):
+    """A server some route around the shims' mirror put into ONE account (2026-10-22: the
+    operator's `alias claude='claude --dangerously-skip-permissions'` hid every typed
+    `claude mcp add` from it) is adopted by the next reconcile, and every account gets it."""
+
+    MOTION = {"type": "http", "url": "https://xgdzyqfalbibzelpdpvr.supabase.co/functions/v1/mcp"}
+
+    def write(self, account, doc):
+        (self.root / account).mkdir(exist_ok=True)
+        (self.root / account / ".claude.json").write_text(json.dumps(doc))
+
+    def test_one_accounts_server_reaches_every_account_from_a_single_account_apply(self):
+        self.write("acct-01", {"mcpServers": {"motionsites": self.MOTION}})
+        self.write("acct-02", {"mcpServers": {}})
+        # what the shim runs before exec, for the picked account alone
+        rc, _, _ = self.run_cli("claude", "apply", "--account-dir", self.acct("acct-01"),
+                                "--fail-open", "--quiet")
+        self.assertEqual(rc, 0)
+        self.assertEqual(self.registry()["mcpServers"], {"motionsites": self.MOTION})
+        self.assertEqual(self.claude_doc("acct-02")["mcpServers"], {"motionsites": self.MOTION})
+        self.assertIn('mcp adopt "motionsites" into the registry',
+                      (self.root / "ops.log").read_text())
+        # nothing left to adopt: a second pass changes nothing
+        before = (self.root / "mcp-servers.json").read_text()
+        rc, out, _ = self.run_cli("claude", "apply", "--all")
+        self.assertEqual((rc, before), (0, (self.root / "mcp-servers.json").read_text()))
+        self.assertNotIn("adopted", out)
+
+    def test_the_definition_most_accounts_hold_wins(self):
+        headless = {"type": "stdio", "command": "npx", "env": {},
+                    "args": ["-y", "@playwright/mcp@latest", "--headless"]}
+        plain = {"type": "stdio", "command": "npx", "args": ["-y", "@playwright/mcp@latest"],
+                 "env": {}}
+        (self.root / "accounts.json").write_text(json.dumps({"version": 1, "accounts": [
+            {"id": "acct-01"}, {"id": "acct-02"}, {"id": "acct-03"}]}))
+        self.write("acct-01", {"mcpServers": {"playwright": plain}})  # the newest file
+        self.write("acct-02", {"mcpServers": {"playwright": headless}})
+        self.write("acct-03", {"mcpServers": {"playwright": headless}})
+        os.utime(self.root / "acct-02" / ".claude.json", (1, 1))
+        os.utime(self.root / "acct-03" / ".claude.json", (1, 1))
+        rc, out, _ = self.run_cli("claude", "apply", "--all")
+        self.assertEqual(rc, 0)
+        self.assertIn("the definition 2 of 3 accounts hold", out)
+        for account in ("acct-01", "acct-02", "acct-03"):
+            self.assertEqual(self.claude_doc(account)["mcpServers"]["playwright"], headless)
+
+    def test_a_tie_goes_to_the_newest_config(self):
+        old = {"type": "http", "url": "https://old.example/mcp"}
+        new = {"type": "http", "url": "https://new.example/mcp"}
+        self.write("acct-01", {"mcpServers": {"x": old}})
+        self.write("acct-02", {"mcpServers": {"x": new}})
+        os.utime(self.root / "acct-01" / ".claude.json", (1, 1))
+        self.run_cli("claude", "apply", "--all")
+        self.assertEqual(self.registry()["mcpServers"]["x"], new)
+
+    def test_retired_servers_are_never_adopted(self):
+        self.run_cli("claude", "add-json", "gone", json.dumps(HTTP))
+        self.run_cli("claude", "remove", "gone")
+        self.run_cli("claude", "add-json", "useronly", json.dumps(HTTP))
+        self.run_cli("claude", "remove", "useronly", "--user-only")
+        self.write("acct-01", {"mcpServers": {"gone": HTTP, "useronly": HTTP},
+                               "projects": {"/p": {"mcpServers": {"gone": HTTP}}}})
+        rc, _, _ = self.run_cli("claude", "apply", "--all")
+        self.assertEqual(rc, 0)
+        self.assertEqual(self.registry()["mcpServers"], {})
+        self.assertEqual(self.claude_doc("acct-01")["mcpServers"], {})
+        self.assertEqual(self.claude_doc("acct-01")["projects"]["/p"]["mcpServers"], {})
+
+    def test_an_overlay_owners_servers_and_tombstones_stay_out_of_the_registry(self):
+        self.run_cli("claude", "import-local", "--owner", "app-robot",
+                     stdin=json.dumps({"mcpServers": {"robot": STDIO}, "retired": ["dropped"]}))
+        self.write("acct-01", {"mcpServers": {"robot": STDIO, "dropped": HTTP}})
+        self.run_cli("claude", "apply", "--all")
+        self.assertFalse((self.root / "mcp-servers.json").exists())  # nothing adopted
+        self.assertEqual(sorted(self.claude_doc("acct-02")["mcpServers"]), ["robot"])
+
+    def test_project_servers_are_adopted_but_mcpjson_approvals_are_not(self):
+        # one account's click on a project's .mcp.json server must not override another
+        # account's rejection everywhere (disabledMcpjsonServers)
+        self.write("acct-01", {"projects": {"/p": {"mcpServers": {"local": STDIO},
+                                                   "enabledMcpjsonServers": ["team"]}}})
+        self.write("acct-02", {"projects": {"/p": {"disabledMcpjsonServers": ["team"]}}})
+        self.run_cli("claude", "apply", "--all")
+        project = self.claude_doc("acct-02")["projects"]["/p"]
+        self.assertEqual(project["mcpServers"], {"local": STDIO})
+        self.assertNotIn("team", project.get("enabledMcpjsonServers", []))
+        self.assertEqual(project["disabledMcpjsonServers"], ["team"])
+
+    def test_a_single_account_apply_chooses_what_every_account_would(self):
+        old = {"type": "http", "url": "https://old.example/mcp"}
+        new = {"type": "http", "url": "https://new.example/mcp"}
+        (self.root / "accounts.json").write_text(json.dumps({"version": 1, "accounts": [
+            {"id": "acct-01"}, {"id": "acct-02"}, {"id": "acct-03"}]}))
+        self.write("acct-01", {"mcpServers": {"x": old}})  # the account launched first
+        self.write("acct-02", {"mcpServers": {"x": new}})
+        self.write("acct-03", {"mcpServers": {"x": new}})
+        self.run_cli("claude", "apply", "--account-dir", self.acct("acct-01"),
+                     "--fail-open", "--quiet")
+        for account in ("acct-01", "acct-02", "acct-03"):
+            self.assertEqual(self.claude_doc(account)["mcpServers"]["x"], new)
+
+    def test_an_account_being_seeded_gets_the_registry_too(self):
+        # seeding applies to a dir the manifest does not list yet
+        self.run_cli("claude", "add-json", "reg1", json.dumps(HTTP))
+        self.write("acct-01", {"mcpServers": {"reg1": HTTP, "newone": self.MOTION}})
+        self.write("acct-07", {"mcpServers": {}})
+        self.run_cli("claude", "apply", "--account-dir", self.acct("acct-07"))
+        self.assertEqual(sorted(self.claude_doc("acct-07")["mcpServers"]), ["newone", "reg1"])
+
+    def test_a_server_carrying_values_stays_on_this_machine(self):
+        secret = {"type": "http", "url": "https://api.example/mcp",
+                  "headers": {"Authorization": "Bearer abc"}}
+        referenced = {"type": "http", "url": "https://api.example/mcp2",
+                      "headers": {"Authorization": "${API_TOKEN}"}}
+        self.write("acct-01", {"mcpServers": {"secret": secret, "referenced": referenced}})
+        self.run_cli("claude", "apply", "--all")
+        self.assertEqual(list(self.registry()["mcpServers"]), ["referenced"])
+        self.assertEqual(self.overlay()["owners"]["local"]["mcpServers"], {"secret": secret})
+        self.assertEqual(self.claude_doc("acct-02")["mcpServers"]["secret"], secret)
+
+    def test_an_overlay_owners_drop_stays_retired_across_imports(self):
+        self.write("acct-01", {"mcpServers": {}})
+        for payload in ({"mcpServers": {"robot": STDIO}}, {"mcpServers": {}},
+                        {"mcpServers": {"other": HTTP}}):
+            self.run_cli("claude", "import-local", "--owner", "app-robot", stdin=json.dumps(payload))
+        self.assertIn("robot", self.overlay()["owners"]["app-robot"]["retired"])
+        # a copy that never went through the ledger (a dir copied from an old account)
+        self.write("acct-02", {"mcpServers": {"robot": STDIO}})
+        self.run_cli("claude", "apply", "--all")
+        self.assertFalse((self.root / "mcp-servers.json").exists())
+        self.assertNotIn("robot", self.claude_doc("acct-02")["mcpServers"])
+        # publishing it again lifts the tombstone
+        self.run_cli("claude", "import-local", "--owner", "app-robot",
+                     stdin=json.dumps({"mcpServers": {"robot": STDIO}}))
+        self.assertNotIn("robot", self.overlay()["owners"]["app-robot"]["retired"])
+
+    def test_a_replica_adopts_into_its_own_overlay(self):
+        (self.root / "sync-role").write_text("replica\n")
+        self.write("acct-01", {"mcpServers": {"motionsites": self.MOTION}})
+        self.run_cli("claude", "apply", "--all")
+        self.assertFalse((self.root / "mcp-servers.json").exists())
+        self.assertEqual(self.overlay()["owners"]["local"]["mcpServers"],
+                         {"motionsites": self.MOTION})
+        self.assertEqual(self.claude_doc("acct-02")["mcpServers"], {"motionsites": self.MOTION})
+
+    def test_a_copy_the_pool_wrote_itself_is_never_adopted_back(self):
+        # README's recovery for a stray synced entry: drop it WITHOUT a tombstone. The copies
+        # the reconcile wrote stay in the accounts, and must not come back as "new" servers.
+        self.write("acct-01", {"mcpServers": {}})
+        self.write("acct-02", {"mcpServers": {}})
+        self.run_cli("claude", "add-json", "stray", json.dumps(HTTP))
+        self.assertIn("stray", self.claude_doc("acct-02")["mcpServers"])
+        registry = self.registry()
+        del registry["mcpServers"]["stray"]
+        (self.root / "mcp-servers.json").write_text(json.dumps(registry))
+        self.run_cli("claude", "apply", "--all")
+        self.assertNotIn("stray", self.registry()["mcpServers"])
+        self.assertNotIn("adopt", (self.root / "ops.log").read_text())
+
+    def test_a_vanished_overlay_owners_server_stays_out_of_the_synced_registry(self):
+        # app-robot publishes a machine-specific appinspire-mcp into the overlay; were the
+        # overlay ever gone, every account's copy must not be pushed to the whole fleet
+        self.write("acct-01", {"mcpServers": {}})
+        self.run_cli("claude", "import-local", "--owner", "app-robot",
+                     stdin=json.dumps({"mcpServers": {"appinspire-mcp": STDIO}}))
+        self.assertIn("appinspire-mcp", self.claude_doc("acct-01")["mcpServers"])
+        (self.root / "mcp-servers.local.json").unlink()
+        self.run_cli("claude", "apply", "--all")
+        self.assertFalse((self.root / "mcp-servers.json").exists())
+        ledger = json.loads((self.root / "acct-01" / ".mcp-managed.json").read_text())
+        self.assertIn("appinspire-mcp", ledger["user"])
+
+    def test_the_kill_switch_leaves_extras_where_they_are(self):
+        self.write("acct-01", {"mcpServers": {"motionsites": self.MOTION}})
+        with mock_env(CLAUDE_MULTIACC_MCP_ADOPT="0"):
+            self.run_cli("claude", "apply", "--all")
+        self.assertFalse((self.root / "mcp-servers.json").exists())
+        self.assertFalse((self.root / "acct-02" / ".claude.json").exists())
+
+    def test_an_unreadable_account_never_stops_the_others(self):
+        (self.root / "acct-01" / ".claude.json").write_text("{not json")
+        self.write("acct-02", {"mcpServers": {"motionsites": self.MOTION}})
+        rc, _, _ = self.run_cli("claude", "apply", "--all")
+        self.assertEqual(rc, R.EXIT_PARTIAL)  # acct-01 itself still fails to reconcile
+        self.assertEqual(self.registry()["mcpServers"], {"motionsites": self.MOTION})
+
+    @unittest.skipUnless(HAS_TOMLLIB, "codex reconcile needs tomllib (Python 3.11+)")
+    def test_a_codex_table_the_registry_cannot_express_as_it_is_is_left_alone(self):
+        text = ('[mcp_servers.odd]\ncommand = "c"\nenabled = false\n'
+                'env_vars = [{ name = "K", source = "remote" }]\n')
+        (self.root / "acct-01" / "config.toml").write_text(text)
+        rc, _, err = self.run_cli("codex", "apply", "--all")
+        self.assertEqual(rc, 0)
+        self.assertEqual((self.root / "acct-01" / "config.toml").read_text(), text)
+        self.assertFalse((self.root / "mcp-servers.json").exists())
+
+    @unittest.skipUnless(HAS_TOMLLIB, "codex reconcile needs tomllib (Python 3.11+)")
+    def test_a_codex_accounts_server_is_adopted_for_every_codex_account(self):
+        (self.root / "acct-01" / "config.toml").write_text(
+            '[mcp_servers.motionsites]\nurl = "https://xgdzyqfalbibzelpdpvr.supabase.co/functions/v1/mcp"\n')
+        rc, _, _ = self.run_cli("codex", "apply", "--all")
+        self.assertEqual(rc, 0)
+        import tomllib
+        doc = tomllib.loads((self.root / "acct-02" / "config.toml").read_text())
+        self.assertEqual(doc["mcp_servers"]["motionsites"]["url"], self.MOTION["url"])
+        # and the round trip is stable: the next pass rewrites nothing
+        text = (self.root / "acct-01" / "config.toml").read_text()
+        rc, out, _ = self.run_cli("codex", "apply", "--all")
+        self.assertIn("acct-01: unchanged", out)
+        self.assertEqual(text, (self.root / "acct-01" / "config.toml").read_text())
+
+
+@contextlib.contextmanager
+def mock_env(**values):
+    saved = {key: os.environ.get(key) for key in values}
+    os.environ.update(values)
+    try:
+        yield
+    finally:
+        for key, value in saved.items():
+            if value is None:
+                os.environ.pop(key, None)
+            else:
+                os.environ[key] = value
+
+
 if __name__ == "__main__":
     unittest.main()

package/tests/test_packaged_commands.py

@@ -61,6 +61,13 @@ class PackagedCommandsTests(unittest.TestCase):
                 self.assertRegex(result.stdout, r"(?i)usage")
         result = run([str(self.package / "install.sh"), "--help"], self.env, self.work)
         self.assertEqual(result.returncode, 0, result.stderr)
+        # The catalog verb refreshes pools when it runs; asked for help it must write nothing.
+        for prefix in (["claude-accounts"], ["codex-accounts"], ["claude-multiacc"], ["claude-multiacc", "codex"]):
+            for args in (["model-catalog", "--help"], ["model-catalog", "refresh", "--help"]):
+                with self.subTest(prefix=prefix, args=args):
+                    result = run(prefix + args, self.env, self.work)
+                    self.assertEqual(result.returncode, 0, result.stderr)
+                    self.assertIn("model-catalog [refresh|show]", result.stdout)
         self.assertEqual(before, sorted(str(path) for path in self.home.rglob("*")))
 
     def test_verify_and_json_reports_use_the_correct_pool(self):
@@ -140,6 +147,10 @@ class PackagedCommandsTests(unittest.TestCase):
                 self.assertEqual(text.count("_claude_multiacc_path_guard() {"), 1, rc)
                 self.assertTrue(text.rstrip().endswith("# <<< claude-multiacc <<<"), rc)
             self.assertFalse((self.home / ".bash_profile").exists())
+            # Every install refreshes the model catalog into both pools (the stubbed CLIs exit 1
+            # and are never needed: the refresh reads files only).
+            for pool in (".claude-accounts", ".codex-accounts"):
+                self.assertEqual(json.loads((self.home / pool / "model-catalog.json").read_text())["schema"], 1)
             # ...and fresh login shells of every flavour now resolve the package's shims,
             # the real binaries in ~/.local/bin notwithstanding (lib/shim_path.py is the
             # same probe `claude-accounts status` and `health` print).
@@ -185,6 +196,36 @@ class PackagedCommandsTests(unittest.TestCase):
             uname.unlink()
             identity.unlink()
 
+    def test_installer_refreshes_the_model_catalog_and_fails_open(self):
+        pools = [self.home / ".claude-accounts", self.home / ".codex-accounts"]
+        install = ["claude-multiacc", "install", "--no-server", "--no-schedule"]
+        for pool in pools:
+            if (pool / "model-catalog.json").exists():
+                (pool / "model-catalog.json").unlink()
+        result = run(install, self.env, self.work)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn("model catalog: refreshed", result.stdout)
+        shipped = json.loads((self.package / "lib/model_catalog.json").read_text())
+        for pool in pools:
+            doc = json.loads((pool / "model-catalog.json").read_text())
+            self.assertEqual(doc["schema"], 1)
+            for provider in ("claude", "codex"):  # no CLI cache in these pools: the shipped lineup
+                self.assertEqual(doc[provider]["models"], shipped[provider]["models"])
+        # A refresh that cannot run never fails the install: one note, nothing written.
+        module = self.package / "lib/model_catalog.py"
+        original = module.read_text()
+        for pool in pools:
+            (pool / "model-catalog.json").unlink()
+        module.write_text("raise SystemExit(1)\n")
+        try:
+            result = run(install, self.env, self.work)
+        finally:
+            module.write_text(original)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn("model catalog could not be refreshed", result.stderr)
+        self.assertIn("install complete", result.stdout)
+        self.assertEqual([pool for pool in pools if (pool / "model-catalog.json").exists()], [])
+
     def test_selector_transport_and_version_match_across_entrypoints(self):
         expected = None
         for prefix in (["multiacc-select"], ["claude-multiacc", "select"]):