claude-multiacc 2.0.59 → 2.0.60

package/tests/run-tests.sh

@@ -49,6 +49,18 @@ mkdir -p "$ACC/tmp" "$FAKEBIN"
 cat > "$FAKEBIN/claude" <<'EOF'
 #!/usr/bin/env bash
 # fake real claude for tests (not a multiacc shim)
+# Global options may precede the subcommand, as commander allows (the operator's alias
+# `claude --dangerously-skip-permissions`, the shim's own `--model X`): the mcp stand-in
+# skips the two the suite types, and nothing else — `--resume mcp add x` is no mcp run.
+_fa=("$@")
+while [ "${#_fa[@]}" -gt 0 ]; do
+  case "${_fa[0]}" in
+    --dangerously-skip-permissions) _fa=("${_fa[@]:1}") ;;
+    --model) _fa=("${_fa[@]:2}") ;;
+    *) break ;;
+  esac
+done
+if [ "${_fa[0]:-}" = "mcp" ] && [ "${_fa[0]:-}" != "${1:-}" ]; then set -- "${_fa[@]}"; fi
 if [ "${1:-}" = "mcp" ] && [ -n "${CLAUDE_CONFIG_DIR:-}" ]; then
   # A stand-in for the real `claude mcp add|add-json|remove`: `-s user` edits the
   # config dir's .claude.json mcpServers, the default `local` scope edits
@@ -438,6 +450,11 @@ unset TMUX TMUX_PANE 2>/dev/null || true
 # everywhere; section 19a turns it on against its own roots (and the limits-pass backstop is
 # exercised with the switch on in tests/test_autoresume_catalog_cli.py).
 export CLAUDE_MULTIACC_MODEL_CATALOG=0 CODEX_MULTIACC_MODEL_CATALOG=0
+# MCP adoption (lib/mcp_registry.py adopt) would take whatever the operator's real
+# ~/.claude.json names — seeding copies it into every test account, this HOME being the
+# operator's — into the test pool's registry. tests/test_mcp_registry.py covers adoption in
+# disposable pools.
+export CLAUDE_MULTIACC_MCP_ADOPT=0 CODEX_MULTIACC_MCP_ADOPT=0
 
 now="$(date +%s)"
 
@@ -5200,6 +5217,69 @@ out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_ACCOUNT=acct-01 claude 2>&1)"
 check "the next launch on that account still runs" "CFG=acct-01" "$out"
 mcp_has acct-01 nested && t_fail "nested remove undone" "the next launch re-added nested" \
   || t_ok "a nested remove is not undone by the next launch"
+# GLOBAL OPTIONS before `mcp` (2026-10-22): the operator's alias claude='claude
+# --dangerously-skip-permissions' put a flag in front of every typed `claude mcp add`,
+# the mirror looked at $1 alone, and motionsites landed in 2 of 11 accounts. The shim
+# finds the subcommand the way commander does: a flag is skipped, a value option skips
+# its value, and an optional-value one (--resume) takes the next word as its own.
+: > "$PYLOG"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" claude --dangerously-skip-permissions mcp add -s user dsp -- echo d 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && check "a flag before mcp: the stock add still answers like the real client" "Added stdio MCP server dsp" "$out" \
+  || t_fail "flag-first add rc" "rc=$rc: $out"
+mcp_has acct-01 dsp && mcp_has acct-02 dsp && t_ok "'claude --dangerously-skip-permissions mcp add' lands in EVERY account" \
+  || t_fail "flag-first mirror" "$out $(cat "$MPOOL/acct-01/.claude.json" "$MPOOL/acct-02/.claude.json")"
+grep -q " learn " "$PYLOG" && t_ok "a flag-first add is mirrored through learn" || t_fail "flag-first learn" "$(cat "$PYLOG")"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); s=d["mcpServers"].get("dsp") or {}; sys.exit(0 if s.get("command")=="echo" and s.get("args")==["d"] else 1)' "$out" \
+  && t_ok "a flag-first add reaches the registry with the client's own block" || t_fail "flag-first registry" "$out"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude --dangerously-skip-permissions mcp remove -s user dsp 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "'claude --dangerously-skip-permissions mcp remove' exits 0" || t_fail "flag-first remove rc" "rc=$rc: $out"
+mcp_has acct-01 dsp || mcp_has acct-02 dsp \
+  && t_fail "flag-first remove mirror" "dsp survives in an account" || t_ok "a flag-first remove drops the server from EVERY account"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); sys.exit(0 if "dsp" in d.get("retiredUser",[]) and "dsp" not in d.get("mcpServers",{}) else 1)' "$out" \
+  && t_ok "a flag-first remove leaves a user-scope tombstone" || t_fail "flag-first tombstone" "$out"
+# nested (an agent inside a pooled session, alias or not): same parse, same mirror
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_CONFIG_DIR="$MPOOL/acct-01" CLAUDE_SHIM_ACTIVE=1 claude --dangerously-skip-permissions mcp add -s user dspn -- echo n 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "a nested flag-first 'claude mcp add' exits 0" || t_fail "nested flag-first rc" "rc=$rc: $out"
+mcp_has acct-01 dspn && mcp_has acct-02 dspn && t_ok "a nested 'claude --dangerously-skip-permissions mcp add' lands in EVERY account" \
+  || t_fail "nested flag-first mirror" "$out $(cat "$MPOOL/acct-02/.claude.json")"
+# a value option: --model's value is skipped, and add-json is a mutation like add
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude --model opus mcp add-json -s user mj '{"type":"stdio","command":"echo","args":["j"],"env":{}}' 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "'claude --model opus mcp add-json' exits 0" || t_fail "model-first add-json rc" "rc=$rc: $out"
+mcp_has acct-01 mj && mcp_has acct-02 mj && t_ok "'claude --model opus mcp add-json' lands in EVERY account" \
+  || t_fail "model-first mirror" "$out $(cat "$MPOOL/acct-01/.claude.json" "$MPOOL/acct-02/.claude.json")"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); s=d["mcpServers"].get("mj") or {}; sys.exit(0 if s.get("args")==["j"] else 1)' "$out" \
+  && t_ok "a --model-first add-json reaches the registry" || t_fail "model-first registry" "$out"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_CONFIG_DIR="$MPOOL/acct-02" CLAUDE_SHIM_ACTIVE=1 claude --model opus mcp add-json -s user mjn '{"type":"stdio","command":"echo","args":["n"],"env":{}}' 2>&1)"
+mcp_has acct-01 mjn && mcp_has acct-02 mjn && t_ok "a nested 'claude --model opus mcp add-json' lands in EVERY account" \
+  || t_fail "nested model-first mirror" "$out $(cat "$MPOOL/acct-01/.claude.json")"
+# NOT a mutation: --resume takes the next word (a session id or search term) as its
+# value, and -p's prompt is one word that merely reads "mcp add …" — the shim must run
+# no snapshot and no learn, and nothing reaches any account or the registry
+: > "$PYLOG"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_ACCOUNT=acct-01 CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" claude --resume mcp add rsm 2>&1 </dev/null)"
+rc=$?
+[ "$rc" = "0" ] && check "'claude --resume mcp add rsm' runs as an ordinary launch" "CFG=acct-01" "$out" \
+  || t_fail "resume-first rc" "rc=$rc: $out"
+grep -Eq " (snapshot|learn) " "$PYLOG" && t_fail "resume-first mirror attempt" "$(cat "$PYLOG")" \
+  || t_ok "'claude --resume mcp add' is no mcp mutation (no snapshot, no learn)"
+: > "$PYLOG"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_ACCOUNT=acct-01 CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" claude -p "mcp add psm" 2>&1 </dev/null)"
+rc=$?
+[ "$rc" = "0" ] && check "'claude -p \"mcp add psm\"' runs as an ordinary print" "CFG=acct-01" "$out" \
+  || t_fail "print-prompt rc" "rc=$rc: $out"
+grep -Eq " (snapshot|learn) " "$PYLOG" && t_fail "print-prompt mirror attempt" "$(cat "$PYLOG")" \
+  || t_ok "a -p prompt reading 'mcp add' is no mcp mutation (no snapshot, no learn)"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp list --json 2>&1)"
+mcp_has acct-01 rsm || mcp_has acct-01 psm || mcp_has acct-02 rsm || mcp_has acct-02 psm \
+  || python3 -c 'import json,sys; d=json.loads(sys.argv[1]); a=set(d.get("mcpServers",{}))|set(d.get("retired",[]))|set(d.get("retiredUser",[])); sys.exit(0 if a & {"rsm","psm","add","mcp"} else 1)' "$out" \
+  && t_fail "non-mutation leak" "$out" || t_ok "neither non-mutation reaches an account or the registry"
 # a CLAUDE_CONFIG_DIR OUTSIDE the pool is plain passthrough: no python, no mirror
 mkdir -p "$WORK/mcp-outside"
 : > "$PYLOG"
@@ -5789,6 +5869,18 @@ cat > "$FAKEBIN/codex" <<EOF
 #!/usr/bin/env bash
 # fake real codex for tests (not a shim)
 if [ "\${1:-}" = --help ]; then echo 'Usage: legacy codex [OPTIONS]'; exit 0; fi
+# Global options may precede the subcommand, as clap allows (the operator's alias
+# \`codex --dangerously-bypass-approvals-and-sandbox\`, -c k=v, -m model): the mcp
+# stand-in skips the ones the suite types.
+_fa=("\$@")
+while [ "\${#_fa[@]}" -gt 0 ]; do
+  case "\${_fa[0]}" in
+    --dangerously-bypass-approvals-and-sandbox) _fa=("\${_fa[@]:1}") ;;
+    -c|-m) _fa=("\${_fa[@]:2}") ;;
+    *) break ;;
+  esac
+done
+if [ "\${_fa[0]:-}" = "mcp" ] && [ "\${_fa[0]:-}" != "\${1:-}" ]; then set -- "\${_fa[@]}"; fi
 if [ "\${1:-}" = "mcp" ] && [ -n "\${CODEX_HOME:-}" ]; then
   python3 "$FAKE_CODEX_MCP" "\$CODEX_HOME/config.toml" "\$@"
   rc=\$?
@@ -8011,6 +8103,57 @@ out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_ACCOUNT=acct-01 codex 2>&1)"
 check "codex: the next launch on that account still runs" "CFG=acct-01" "$out"
 cx_has acct-01 nested && t_fail "codex nested remove undone" "the next launch re-added nested" \
   || t_ok "codex: a nested remove is not undone by the next launch"
+# GLOBAL OPTIONS before `mcp` (2026-10-22, parity with 16e): the operator's alias
+# codex='codex --dangerously-bypass-approvals-and-sandbox' put a flag in front of every
+# typed `codex mcp add`. The shim finds the subcommand the way clap does: a flag is
+# skipped, -c/-m skip their value.
+: > "$PYLOG"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" codex --dangerously-bypass-approvals-and-sandbox mcp add dbx -- echo d 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && check "codex: a flag before mcp: the stock add still answers like the real client" "Added global MCP server 'dbx'" "$out" \
+  || t_fail "codex flag-first add rc" "rc=$rc: $out"
+cx_has acct-01 dbx && cx_has acct-02 dbx && t_ok "codex: 'codex --dangerously-bypass-approvals-and-sandbox mcp add' lands in EVERY account" \
+  || t_fail "codex flag-first mirror" "$out $(cat "$CXP/acct-01/config.toml" "$CXP/acct-02/config.toml")"
+grep -q " learn " "$PYLOG" && t_ok "codex: a flag-first add is mirrored through learn" || t_fail "codex flag-first learn" "$(cat "$PYLOG")"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" codex-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); s=d["mcpServers"].get("dbx") or {}; sys.exit(0 if s.get("command")=="echo" and s.get("args")==["d"] else 1)' "$out" \
+  && t_ok "codex: a flag-first add reaches the registry" || t_fail "codex flag-first registry" "$out"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" codex -c a=b -m o3 mcp remove dbx 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "codex: 'codex -c a=b -m o3 mcp remove' exits 0" || t_fail "codex value-first remove rc" "rc=$rc: $out"
+cx_has acct-01 dbx || cx_has acct-02 dbx \
+  && t_fail "codex value-first remove mirror" "dbx survives in an account" \
+  || t_ok "codex: 'codex -c a=b -m o3 mcp remove' drops the server from EVERY account"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" codex-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); sys.exit(0 if ("dbx" in d.get("retiredUser",[]) or "dbx" in d.get("retired",[])) and "dbx" not in d.get("mcpServers",{}) else 1)' "$out" \
+  && t_ok "codex: a value-first remove is retired in the registry" || t_fail "codex value-first tombstone" "$out"
+# nested: the same two shapes from inside a pooled codex session
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_HOME="$CXP/acct-01" CODEX_SHIM_ACTIVE=1 codex --dangerously-bypass-approvals-and-sandbox mcp add dbxn -- echo n 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "codex: a nested flag-first 'codex mcp add' exits 0" || t_fail "codex nested flag-first rc" "rc=$rc: $out"
+cx_has acct-01 dbxn && cx_has acct-02 dbxn && t_ok "codex: a nested flag-first add lands in EVERY account" \
+  || t_fail "codex nested flag-first mirror" "$out $(cat "$CXP/acct-02/config.toml")"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_HOME="$CXP/acct-01" CODEX_SHIM_ACTIVE=1 codex -c a=b -m o3 mcp remove dbxn 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "codex: a nested 'codex -c a=b -m o3 mcp remove' exits 0" || t_fail "codex nested value-first remove rc" "rc=$rc: $out"
+cx_has acct-01 dbxn || cx_has acct-02 dbxn \
+  && t_fail "codex nested value-first remove mirror" "dbxn survives in an account" \
+  || t_ok "codex: a nested value-first remove drops the server from EVERY account"
+# NOT a mutation (parity with 16e's --resume / -p): a one-word prompt that reads
+# "mcp add …", and -i, whose variadic value takes every word up to the next option
+: > "$PYLOG"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_ACCOUNT=acct-01 CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" codex "mcp add psx" 2>&1 </dev/null)"
+rc=$?
+[ "$rc" = "0" ] && check "codex: a prompt reading 'mcp add' runs as an ordinary launch" "CFG=acct-01" "$out" \
+  || t_fail "codex prompt rc" "rc=$rc: $out"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_ACCOUNT=acct-01 CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" codex -i shot.png mcp add psx 2>&1 </dev/null)"
+rc=$?
+[ "$rc" = "0" ] && check "codex: 'codex -i shot.png mcp add psx' runs as an ordinary launch" "CFG=acct-01" "$out" \
+  || t_fail "codex image-first rc" "rc=$rc: $out"
+grep -Eq " (snapshot|learn) " "$PYLOG" && t_fail "codex non-mutation mirror attempt" "$(cat "$PYLOG")" \
+  || t_ok "codex: neither a prompt nor -i's words are an mcp mutation (no snapshot, no learn)"
+cx_has acct-01 psx || cx_has acct-02 psx && t_fail "codex non-mutation leak" "psx in an account" \
+  || t_ok "codex: neither non-mutation reaches an account"
 mkdir -p "$WORK/cx-outside"
 : > "$PYLOG"
 out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_HOME="$WORK/cx-outside" CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" codex mcp add outside -- echo o 2>&1)"

package/tests/test_mcp_registry.py

@@ -88,7 +88,7 @@ class EffectiveMergeTests(RegistryCase):
 
 
 class ClaudeReconcileTests(RegistryCase):
-    def test_upsert_purges_tombstones_everywhere_and_keeps_extras(self):
+    def test_upsert_purges_tombstones_everywhere_and_adopts_extras(self):
         (self.root / "acct-01" / ".claude.json").write_text(json.dumps({
             "numStartups": 3,
             "mcpServers": {"adspower-local-api": STDIO, "mine": STDIO,
@@ -107,7 +107,10 @@ class ClaudeReconcileTests(RegistryCase):
                          {"type": "stdio", "command": "npx",
                           "args": ["-y", "appinspire-mcp@latest", "serve"], "env": {"K": "V"}})
         self.assertEqual(sorted(doc["projects"]["/p"]["mcpServers"]), ["keep"])
-        self.assertEqual(sorted(self.claude_doc("acct-02")["mcpServers"]), ["appinspire-mcp"])
+        # an extra no section names is adopted: every account gets it (2026-10-22)
+        self.assertEqual(sorted(self.claude_doc("acct-02")["mcpServers"]), ["appinspire-mcp", "mine"])
+        self.assertEqual(sorted(self.claude_doc("acct-02")["projects"]["/p"]["mcpServers"]), ["keep"])
+        self.assertEqual(sorted(self.registry()["mcpServers"]), ["appinspire-mcp", "mine"])
         self.assertEqual(self.registry()["retired"], ["adspower-local-api"])
         self.assertTrue((self.root / "acct-01" / ".mcp-applied").exists())
 
@@ -514,7 +517,9 @@ class CodexReconcileTests(RegistryCase):
         self.assertEqual(rc, 0)
         doc = self.parsed()
         self.assertEqual(doc["mcp_servers"]["old"]["command"], "new")
-        self.assertEqual(doc["mcp_servers"]["other"], {"command": "c"})
+        # the extra is adopted, so it now comes back in the registry's own translation
+        self.assertEqual(doc["mcp_servers"]["other"]["command"], "c")
+        self.assertIn("other", self.registry()["mcpServers"])
 
     def test_an_unsupported_layout_is_refused_and_the_file_survives(self):
         original = 'mcp_servers = { old = { command = "a" } }\n'
@@ -593,5 +598,231 @@ class CodexReconcileTests(RegistryCase):
         self.assertIn("acct-01: unchanged", out)
 
 
+class AdoptTests(RegistryCase):
+    """A server some route around the shims' mirror put into ONE account (2026-10-22: the
+    operator's `alias claude='claude --dangerously-skip-permissions'` hid every typed
+    `claude mcp add` from it) is adopted by the next reconcile, and every account gets it."""
+
+    MOTION = {"type": "http", "url": "https://xgdzyqfalbibzelpdpvr.supabase.co/functions/v1/mcp"}
+
+    def write(self, account, doc):
+        (self.root / account).mkdir(exist_ok=True)
+        (self.root / account / ".claude.json").write_text(json.dumps(doc))
+
+    def test_one_accounts_server_reaches_every_account_from_a_single_account_apply(self):
+        self.write("acct-01", {"mcpServers": {"motionsites": self.MOTION}})
+        self.write("acct-02", {"mcpServers": {}})
+        # what the shim runs before exec, for the picked account alone
+        rc, _, _ = self.run_cli("claude", "apply", "--account-dir", self.acct("acct-01"),
+                                "--fail-open", "--quiet")
+        self.assertEqual(rc, 0)
+        self.assertEqual(self.registry()["mcpServers"], {"motionsites": self.MOTION})
+        self.assertEqual(self.claude_doc("acct-02")["mcpServers"], {"motionsites": self.MOTION})
+        self.assertIn('mcp adopt "motionsites" into the registry',
+                      (self.root / "ops.log").read_text())
+        # nothing left to adopt: a second pass changes nothing
+        before = (self.root / "mcp-servers.json").read_text()
+        rc, out, _ = self.run_cli("claude", "apply", "--all")
+        self.assertEqual((rc, before), (0, (self.root / "mcp-servers.json").read_text()))
+        self.assertNotIn("adopted", out)
+
+    def test_the_definition_most_accounts_hold_wins(self):
+        headless = {"type": "stdio", "command": "npx", "env": {},
+                    "args": ["-y", "@playwright/mcp@latest", "--headless"]}
+        plain = {"type": "stdio", "command": "npx", "args": ["-y", "@playwright/mcp@latest"],
+                 "env": {}}
+        (self.root / "accounts.json").write_text(json.dumps({"version": 1, "accounts": [
+            {"id": "acct-01"}, {"id": "acct-02"}, {"id": "acct-03"}]}))
+        self.write("acct-01", {"mcpServers": {"playwright": plain}})  # the newest file
+        self.write("acct-02", {"mcpServers": {"playwright": headless}})
+        self.write("acct-03", {"mcpServers": {"playwright": headless}})
+        os.utime(self.root / "acct-02" / ".claude.json", (1, 1))
+        os.utime(self.root / "acct-03" / ".claude.json", (1, 1))
+        rc, out, _ = self.run_cli("claude", "apply", "--all")
+        self.assertEqual(rc, 0)
+        self.assertIn("the definition 2 of 3 accounts hold", out)
+        for account in ("acct-01", "acct-02", "acct-03"):
+            self.assertEqual(self.claude_doc(account)["mcpServers"]["playwright"], headless)
+
+    def test_a_tie_goes_to_the_newest_config(self):
+        old = {"type": "http", "url": "https://old.example/mcp"}
+        new = {"type": "http", "url": "https://new.example/mcp"}
+        self.write("acct-01", {"mcpServers": {"x": old}})
+        self.write("acct-02", {"mcpServers": {"x": new}})
+        os.utime(self.root / "acct-01" / ".claude.json", (1, 1))
+        self.run_cli("claude", "apply", "--all")
+        self.assertEqual(self.registry()["mcpServers"]["x"], new)
+
+    def test_retired_servers_are_never_adopted(self):
+        self.run_cli("claude", "add-json", "gone", json.dumps(HTTP))
+        self.run_cli("claude", "remove", "gone")
+        self.run_cli("claude", "add-json", "useronly", json.dumps(HTTP))
+        self.run_cli("claude", "remove", "useronly", "--user-only")
+        self.write("acct-01", {"mcpServers": {"gone": HTTP, "useronly": HTTP},
+                               "projects": {"/p": {"mcpServers": {"gone": HTTP}}}})
+        rc, _, _ = self.run_cli("claude", "apply", "--all")
+        self.assertEqual(rc, 0)
+        self.assertEqual(self.registry()["mcpServers"], {})
+        self.assertEqual(self.claude_doc("acct-01")["mcpServers"], {})
+        self.assertEqual(self.claude_doc("acct-01")["projects"]["/p"]["mcpServers"], {})
+
+    def test_an_overlay_owners_servers_and_tombstones_stay_out_of_the_registry(self):
+        self.run_cli("claude", "import-local", "--owner", "app-robot",
+                     stdin=json.dumps({"mcpServers": {"robot": STDIO}, "retired": ["dropped"]}))
+        self.write("acct-01", {"mcpServers": {"robot": STDIO, "dropped": HTTP}})
+        self.run_cli("claude", "apply", "--all")
+        self.assertFalse((self.root / "mcp-servers.json").exists())  # nothing adopted
+        self.assertEqual(sorted(self.claude_doc("acct-02")["mcpServers"]), ["robot"])
+
+    def test_project_servers_are_adopted_but_mcpjson_approvals_are_not(self):
+        # one account's click on a project's .mcp.json server must not override another
+        # account's rejection everywhere (disabledMcpjsonServers)
+        self.write("acct-01", {"projects": {"/p": {"mcpServers": {"local": STDIO},
+                                                   "enabledMcpjsonServers": ["team"]}}})
+        self.write("acct-02", {"projects": {"/p": {"disabledMcpjsonServers": ["team"]}}})
+        self.run_cli("claude", "apply", "--all")
+        project = self.claude_doc("acct-02")["projects"]["/p"]
+        self.assertEqual(project["mcpServers"], {"local": STDIO})
+        self.assertNotIn("team", project.get("enabledMcpjsonServers", []))
+        self.assertEqual(project["disabledMcpjsonServers"], ["team"])
+
+    def test_a_single_account_apply_chooses_what_every_account_would(self):
+        old = {"type": "http", "url": "https://old.example/mcp"}
+        new = {"type": "http", "url": "https://new.example/mcp"}
+        (self.root / "accounts.json").write_text(json.dumps({"version": 1, "accounts": [
+            {"id": "acct-01"}, {"id": "acct-02"}, {"id": "acct-03"}]}))
+        self.write("acct-01", {"mcpServers": {"x": old}})  # the account launched first
+        self.write("acct-02", {"mcpServers": {"x": new}})
+        self.write("acct-03", {"mcpServers": {"x": new}})
+        self.run_cli("claude", "apply", "--account-dir", self.acct("acct-01"),
+                     "--fail-open", "--quiet")
+        for account in ("acct-01", "acct-02", "acct-03"):
+            self.assertEqual(self.claude_doc(account)["mcpServers"]["x"], new)
+
+    def test_an_account_being_seeded_gets_the_registry_too(self):
+        # seeding applies to a dir the manifest does not list yet
+        self.run_cli("claude", "add-json", "reg1", json.dumps(HTTP))
+        self.write("acct-01", {"mcpServers": {"reg1": HTTP, "newone": self.MOTION}})
+        self.write("acct-07", {"mcpServers": {}})
+        self.run_cli("claude", "apply", "--account-dir", self.acct("acct-07"))
+        self.assertEqual(sorted(self.claude_doc("acct-07")["mcpServers"]), ["newone", "reg1"])
+
+    def test_a_server_carrying_values_stays_on_this_machine(self):
+        secret = {"type": "http", "url": "https://api.example/mcp",
+                  "headers": {"Authorization": "Bearer abc"}}
+        referenced = {"type": "http", "url": "https://api.example/mcp2",
+                      "headers": {"Authorization": "${API_TOKEN}"}}
+        self.write("acct-01", {"mcpServers": {"secret": secret, "referenced": referenced}})
+        self.run_cli("claude", "apply", "--all")
+        self.assertEqual(list(self.registry()["mcpServers"]), ["referenced"])
+        self.assertEqual(self.overlay()["owners"]["local"]["mcpServers"], {"secret": secret})
+        self.assertEqual(self.claude_doc("acct-02")["mcpServers"]["secret"], secret)
+
+    def test_an_overlay_owners_drop_stays_retired_across_imports(self):
+        self.write("acct-01", {"mcpServers": {}})
+        for payload in ({"mcpServers": {"robot": STDIO}}, {"mcpServers": {}},
+                        {"mcpServers": {"other": HTTP}}):
+            self.run_cli("claude", "import-local", "--owner", "app-robot", stdin=json.dumps(payload))
+        self.assertIn("robot", self.overlay()["owners"]["app-robot"]["retired"])
+        # a copy that never went through the ledger (a dir copied from an old account)
+        self.write("acct-02", {"mcpServers": {"robot": STDIO}})
+        self.run_cli("claude", "apply", "--all")
+        self.assertFalse((self.root / "mcp-servers.json").exists())
+        self.assertNotIn("robot", self.claude_doc("acct-02")["mcpServers"])
+        # publishing it again lifts the tombstone
+        self.run_cli("claude", "import-local", "--owner", "app-robot",
+                     stdin=json.dumps({"mcpServers": {"robot": STDIO}}))
+        self.assertNotIn("robot", self.overlay()["owners"]["app-robot"]["retired"])
+
+    def test_a_replica_adopts_into_its_own_overlay(self):
+        (self.root / "sync-role").write_text("replica\n")
+        self.write("acct-01", {"mcpServers": {"motionsites": self.MOTION}})
+        self.run_cli("claude", "apply", "--all")
+        self.assertFalse((self.root / "mcp-servers.json").exists())
+        self.assertEqual(self.overlay()["owners"]["local"]["mcpServers"],
+                         {"motionsites": self.MOTION})
+        self.assertEqual(self.claude_doc("acct-02")["mcpServers"], {"motionsites": self.MOTION})
+
+    def test_a_copy_the_pool_wrote_itself_is_never_adopted_back(self):
+        # README's recovery for a stray synced entry: drop it WITHOUT a tombstone. The copies
+        # the reconcile wrote stay in the accounts, and must not come back as "new" servers.
+        self.write("acct-01", {"mcpServers": {}})
+        self.write("acct-02", {"mcpServers": {}})
+        self.run_cli("claude", "add-json", "stray", json.dumps(HTTP))
+        self.assertIn("stray", self.claude_doc("acct-02")["mcpServers"])
+        registry = self.registry()
+        del registry["mcpServers"]["stray"]
+        (self.root / "mcp-servers.json").write_text(json.dumps(registry))
+        self.run_cli("claude", "apply", "--all")
+        self.assertNotIn("stray", self.registry()["mcpServers"])
+        self.assertNotIn("adopt", (self.root / "ops.log").read_text())
+
+    def test_a_vanished_overlay_owners_server_stays_out_of_the_synced_registry(self):
+        # app-robot publishes a machine-specific appinspire-mcp into the overlay; were the
+        # overlay ever gone, every account's copy must not be pushed to the whole fleet
+        self.write("acct-01", {"mcpServers": {}})
+        self.run_cli("claude", "import-local", "--owner", "app-robot",
+                     stdin=json.dumps({"mcpServers": {"appinspire-mcp": STDIO}}))
+        self.assertIn("appinspire-mcp", self.claude_doc("acct-01")["mcpServers"])
+        (self.root / "mcp-servers.local.json").unlink()
+        self.run_cli("claude", "apply", "--all")
+        self.assertFalse((self.root / "mcp-servers.json").exists())
+        ledger = json.loads((self.root / "acct-01" / ".mcp-managed.json").read_text())
+        self.assertIn("appinspire-mcp", ledger["user"])
+
+    def test_the_kill_switch_leaves_extras_where_they_are(self):
+        self.write("acct-01", {"mcpServers": {"motionsites": self.MOTION}})
+        with mock_env(CLAUDE_MULTIACC_MCP_ADOPT="0"):
+            self.run_cli("claude", "apply", "--all")
+        self.assertFalse((self.root / "mcp-servers.json").exists())
+        self.assertFalse((self.root / "acct-02" / ".claude.json").exists())
+
+    def test_an_unreadable_account_never_stops_the_others(self):
+        (self.root / "acct-01" / ".claude.json").write_text("{not json")
+        self.write("acct-02", {"mcpServers": {"motionsites": self.MOTION}})
+        rc, _, _ = self.run_cli("claude", "apply", "--all")
+        self.assertEqual(rc, R.EXIT_PARTIAL)  # acct-01 itself still fails to reconcile
+        self.assertEqual(self.registry()["mcpServers"], {"motionsites": self.MOTION})
+
+    @unittest.skipUnless(HAS_TOMLLIB, "codex reconcile needs tomllib (Python 3.11+)")
+    def test_a_codex_table_the_registry_cannot_express_as_it_is_is_left_alone(self):
+        text = ('[mcp_servers.odd]\ncommand = "c"\nenabled = false\n'
+                'env_vars = [{ name = "K", source = "remote" }]\n')
+        (self.root / "acct-01" / "config.toml").write_text(text)
+        rc, _, err = self.run_cli("codex", "apply", "--all")
+        self.assertEqual(rc, 0)
+        self.assertEqual((self.root / "acct-01" / "config.toml").read_text(), text)
+        self.assertFalse((self.root / "mcp-servers.json").exists())
+
+    @unittest.skipUnless(HAS_TOMLLIB, "codex reconcile needs tomllib (Python 3.11+)")
+    def test_a_codex_accounts_server_is_adopted_for_every_codex_account(self):
+        (self.root / "acct-01" / "config.toml").write_text(
+            '[mcp_servers.motionsites]\nurl = "https://xgdzyqfalbibzelpdpvr.supabase.co/functions/v1/mcp"\n')
+        rc, _, _ = self.run_cli("codex", "apply", "--all")
+        self.assertEqual(rc, 0)
+        import tomllib
+        doc = tomllib.loads((self.root / "acct-02" / "config.toml").read_text())
+        self.assertEqual(doc["mcp_servers"]["motionsites"]["url"], self.MOTION["url"])
+        # and the round trip is stable: the next pass rewrites nothing
+        text = (self.root / "acct-01" / "config.toml").read_text()
+        rc, out, _ = self.run_cli("codex", "apply", "--all")
+        self.assertIn("acct-01: unchanged", out)
+        self.assertEqual(text, (self.root / "acct-01" / "config.toml").read_text())
+
+
+@contextlib.contextmanager
+def mock_env(**values):
+    saved = {key: os.environ.get(key) for key in values}
+    os.environ.update(values)
+    try:
+        yield
+    finally:
+        for key, value in saved.items():
+            if value is None:
+                os.environ.pop(key, None)
+            else:
+                os.environ[key] = value
+
+
 if __name__ == "__main__":
     unittest.main()