claude-multiacc 2.0.59 → 2.0.61

package/tests/run-tests.sh

@@ -49,6 +49,18 @@ mkdir -p "$ACC/tmp" "$FAKEBIN"
 cat > "$FAKEBIN/claude" <<'EOF'
 #!/usr/bin/env bash
 # fake real claude for tests (not a multiacc shim)
+# Global options may precede the subcommand, as commander allows (the operator's alias
+# `claude --dangerously-skip-permissions`, the shim's own `--model X`): the mcp stand-in
+# skips the two the suite types, and nothing else — `--resume mcp add x` is no mcp run.
+_fa=("$@")
+while [ "${#_fa[@]}" -gt 0 ]; do
+  case "${_fa[0]}" in
+    --dangerously-skip-permissions) _fa=("${_fa[@]:1}") ;;
+    --model) _fa=("${_fa[@]:2}") ;;
+    *) break ;;
+  esac
+done
+if [ "${_fa[0]:-}" = "mcp" ] && [ "${_fa[0]:-}" != "${1:-}" ]; then set -- "${_fa[@]}"; fi
 if [ "${1:-}" = "mcp" ] && [ -n "${CLAUDE_CONFIG_DIR:-}" ]; then
   # A stand-in for the real `claude mcp add|add-json|remove`: `-s user` edits the
   # config dir's .claude.json mcpServers, the default `local` scope edits
@@ -438,6 +450,11 @@ unset TMUX TMUX_PANE 2>/dev/null || true
 # everywhere; section 19a turns it on against its own roots (and the limits-pass backstop is
 # exercised with the switch on in tests/test_autoresume_catalog_cli.py).
 export CLAUDE_MULTIACC_MODEL_CATALOG=0 CODEX_MULTIACC_MODEL_CATALOG=0
+# MCP adoption (lib/mcp_registry.py adopt) would take whatever the operator's real
+# ~/.claude.json names — seeding copies it into every test account, this HOME being the
+# operator's — into the test pool's registry. tests/test_mcp_registry.py covers adoption in
+# disposable pools.
+export CLAUDE_MULTIACC_MCP_ADOPT=0 CODEX_MULTIACC_MCP_ADOPT=0
 
 now="$(date +%s)"
 
@@ -5200,6 +5217,69 @@ out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_ACCOUNT=acct-01 claude 2>&1)"
 check "the next launch on that account still runs" "CFG=acct-01" "$out"
 mcp_has acct-01 nested && t_fail "nested remove undone" "the next launch re-added nested" \
   || t_ok "a nested remove is not undone by the next launch"
+# GLOBAL OPTIONS before `mcp` (2026-10-22): the operator's alias claude='claude
+# --dangerously-skip-permissions' put a flag in front of every typed `claude mcp add`,
+# the mirror looked at $1 alone, and motionsites landed in 2 of 11 accounts. The shim
+# finds the subcommand the way commander does: a flag is skipped, a value option skips
+# its value, and an optional-value one (--resume) takes the next word as its own.
+: > "$PYLOG"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" claude --dangerously-skip-permissions mcp add -s user dsp -- echo d 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && check "a flag before mcp: the stock add still answers like the real client" "Added stdio MCP server dsp" "$out" \
+  || t_fail "flag-first add rc" "rc=$rc: $out"
+mcp_has acct-01 dsp && mcp_has acct-02 dsp && t_ok "'claude --dangerously-skip-permissions mcp add' lands in EVERY account" \
+  || t_fail "flag-first mirror" "$out $(cat "$MPOOL/acct-01/.claude.json" "$MPOOL/acct-02/.claude.json")"
+grep -q " learn " "$PYLOG" && t_ok "a flag-first add is mirrored through learn" || t_fail "flag-first learn" "$(cat "$PYLOG")"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); s=d["mcpServers"].get("dsp") or {}; sys.exit(0 if s.get("command")=="echo" and s.get("args")==["d"] else 1)' "$out" \
+  && t_ok "a flag-first add reaches the registry with the client's own block" || t_fail "flag-first registry" "$out"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude --dangerously-skip-permissions mcp remove -s user dsp 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "'claude --dangerously-skip-permissions mcp remove' exits 0" || t_fail "flag-first remove rc" "rc=$rc: $out"
+mcp_has acct-01 dsp || mcp_has acct-02 dsp \
+  && t_fail "flag-first remove mirror" "dsp survives in an account" || t_ok "a flag-first remove drops the server from EVERY account"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); sys.exit(0 if "dsp" in d.get("retiredUser",[]) and "dsp" not in d.get("mcpServers",{}) else 1)' "$out" \
+  && t_ok "a flag-first remove leaves a user-scope tombstone" || t_fail "flag-first tombstone" "$out"
+# nested (an agent inside a pooled session, alias or not): same parse, same mirror
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_CONFIG_DIR="$MPOOL/acct-01" CLAUDE_SHIM_ACTIVE=1 claude --dangerously-skip-permissions mcp add -s user dspn -- echo n 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "a nested flag-first 'claude mcp add' exits 0" || t_fail "nested flag-first rc" "rc=$rc: $out"
+mcp_has acct-01 dspn && mcp_has acct-02 dspn && t_ok "a nested 'claude --dangerously-skip-permissions mcp add' lands in EVERY account" \
+  || t_fail "nested flag-first mirror" "$out $(cat "$MPOOL/acct-02/.claude.json")"
+# a value option: --model's value is skipped, and add-json is a mutation like add
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude --model opus mcp add-json -s user mj '{"type":"stdio","command":"echo","args":["j"],"env":{}}' 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "'claude --model opus mcp add-json' exits 0" || t_fail "model-first add-json rc" "rc=$rc: $out"
+mcp_has acct-01 mj && mcp_has acct-02 mj && t_ok "'claude --model opus mcp add-json' lands in EVERY account" \
+  || t_fail "model-first mirror" "$out $(cat "$MPOOL/acct-01/.claude.json" "$MPOOL/acct-02/.claude.json")"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); s=d["mcpServers"].get("mj") or {}; sys.exit(0 if s.get("args")==["j"] else 1)' "$out" \
+  && t_ok "a --model-first add-json reaches the registry" || t_fail "model-first registry" "$out"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_CONFIG_DIR="$MPOOL/acct-02" CLAUDE_SHIM_ACTIVE=1 claude --model opus mcp add-json -s user mjn '{"type":"stdio","command":"echo","args":["n"],"env":{}}' 2>&1)"
+mcp_has acct-01 mjn && mcp_has acct-02 mjn && t_ok "a nested 'claude --model opus mcp add-json' lands in EVERY account" \
+  || t_fail "nested model-first mirror" "$out $(cat "$MPOOL/acct-01/.claude.json")"
+# NOT a mutation: --resume takes the next word (a session id or search term) as its
+# value, and -p's prompt is one word that merely reads "mcp add …" — the shim must run
+# no snapshot and no learn, and nothing reaches any account or the registry
+: > "$PYLOG"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_ACCOUNT=acct-01 CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" claude --resume mcp add rsm 2>&1 </dev/null)"
+rc=$?
+[ "$rc" = "0" ] && check "'claude --resume mcp add rsm' runs as an ordinary launch" "CFG=acct-01" "$out" \
+  || t_fail "resume-first rc" "rc=$rc: $out"
+grep -Eq " (snapshot|learn) " "$PYLOG" && t_fail "resume-first mirror attempt" "$(cat "$PYLOG")" \
+  || t_ok "'claude --resume mcp add' is no mcp mutation (no snapshot, no learn)"
+: > "$PYLOG"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_ACCOUNT=acct-01 CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" claude -p "mcp add psm" 2>&1 </dev/null)"
+rc=$?
+[ "$rc" = "0" ] && check "'claude -p \"mcp add psm\"' runs as an ordinary print" "CFG=acct-01" "$out" \
+  || t_fail "print-prompt rc" "rc=$rc: $out"
+grep -Eq " (snapshot|learn) " "$PYLOG" && t_fail "print-prompt mirror attempt" "$(cat "$PYLOG")" \
+  || t_ok "a -p prompt reading 'mcp add' is no mcp mutation (no snapshot, no learn)"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp list --json 2>&1)"
+mcp_has acct-01 rsm || mcp_has acct-01 psm || mcp_has acct-02 rsm || mcp_has acct-02 psm \
+  || python3 -c 'import json,sys; d=json.loads(sys.argv[1]); a=set(d.get("mcpServers",{}))|set(d.get("retired",[]))|set(d.get("retiredUser",[])); sys.exit(0 if a & {"rsm","psm","add","mcp"} else 1)' "$out" \
+  && t_fail "non-mutation leak" "$out" || t_ok "neither non-mutation reaches an account or the registry"
 # a CLAUDE_CONFIG_DIR OUTSIDE the pool is plain passthrough: no python, no mirror
 mkdir -p "$WORK/mcp-outside"
 : > "$PYLOG"
@@ -5789,6 +5869,18 @@ cat > "$FAKEBIN/codex" <<EOF
 #!/usr/bin/env bash
 # fake real codex for tests (not a shim)
 if [ "\${1:-}" = --help ]; then echo 'Usage: legacy codex [OPTIONS]'; exit 0; fi
+# Global options may precede the subcommand, as clap allows (the operator's alias
+# \`codex --dangerously-bypass-approvals-and-sandbox\`, -c k=v, -m model): the mcp
+# stand-in skips the ones the suite types.
+_fa=("\$@")
+while [ "\${#_fa[@]}" -gt 0 ]; do
+  case "\${_fa[0]}" in
+    --dangerously-bypass-approvals-and-sandbox) _fa=("\${_fa[@]:1}") ;;
+    -c|-m) _fa=("\${_fa[@]:2}") ;;
+    *) break ;;
+  esac
+done
+if [ "\${_fa[0]:-}" = "mcp" ] && [ "\${_fa[0]:-}" != "\${1:-}" ]; then set -- "\${_fa[@]}"; fi
 if [ "\${1:-}" = "mcp" ] && [ -n "\${CODEX_HOME:-}" ]; then
   python3 "$FAKE_CODEX_MCP" "\$CODEX_HOME/config.toml" "\$@"
   rc=\$?
@@ -8011,6 +8103,57 @@ out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_ACCOUNT=acct-01 codex 2>&1)"
 check "codex: the next launch on that account still runs" "CFG=acct-01" "$out"
 cx_has acct-01 nested && t_fail "codex nested remove undone" "the next launch re-added nested" \
   || t_ok "codex: a nested remove is not undone by the next launch"
+# GLOBAL OPTIONS before `mcp` (2026-10-22, parity with 16e): the operator's alias
+# codex='codex --dangerously-bypass-approvals-and-sandbox' put a flag in front of every
+# typed `codex mcp add`. The shim finds the subcommand the way clap does: a flag is
+# skipped, -c/-m skip their value.
+: > "$PYLOG"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" codex --dangerously-bypass-approvals-and-sandbox mcp add dbx -- echo d 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && check "codex: a flag before mcp: the stock add still answers like the real client" "Added global MCP server 'dbx'" "$out" \
+  || t_fail "codex flag-first add rc" "rc=$rc: $out"
+cx_has acct-01 dbx && cx_has acct-02 dbx && t_ok "codex: 'codex --dangerously-bypass-approvals-and-sandbox mcp add' lands in EVERY account" \
+  || t_fail "codex flag-first mirror" "$out $(cat "$CXP/acct-01/config.toml" "$CXP/acct-02/config.toml")"
+grep -q " learn " "$PYLOG" && t_ok "codex: a flag-first add is mirrored through learn" || t_fail "codex flag-first learn" "$(cat "$PYLOG")"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" codex-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); s=d["mcpServers"].get("dbx") or {}; sys.exit(0 if s.get("command")=="echo" and s.get("args")==["d"] else 1)' "$out" \
+  && t_ok "codex: a flag-first add reaches the registry" || t_fail "codex flag-first registry" "$out"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" codex -c a=b -m o3 mcp remove dbx 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "codex: 'codex -c a=b -m o3 mcp remove' exits 0" || t_fail "codex value-first remove rc" "rc=$rc: $out"
+cx_has acct-01 dbx || cx_has acct-02 dbx \
+  && t_fail "codex value-first remove mirror" "dbx survives in an account" \
+  || t_ok "codex: 'codex -c a=b -m o3 mcp remove' drops the server from EVERY account"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" codex-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); sys.exit(0 if ("dbx" in d.get("retiredUser",[]) or "dbx" in d.get("retired",[])) and "dbx" not in d.get("mcpServers",{}) else 1)' "$out" \
+  && t_ok "codex: a value-first remove is retired in the registry" || t_fail "codex value-first tombstone" "$out"
+# nested: the same two shapes from inside a pooled codex session
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_HOME="$CXP/acct-01" CODEX_SHIM_ACTIVE=1 codex --dangerously-bypass-approvals-and-sandbox mcp add dbxn -- echo n 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "codex: a nested flag-first 'codex mcp add' exits 0" || t_fail "codex nested flag-first rc" "rc=$rc: $out"
+cx_has acct-01 dbxn && cx_has acct-02 dbxn && t_ok "codex: a nested flag-first add lands in EVERY account" \
+  || t_fail "codex nested flag-first mirror" "$out $(cat "$CXP/acct-02/config.toml")"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_HOME="$CXP/acct-01" CODEX_SHIM_ACTIVE=1 codex -c a=b -m o3 mcp remove dbxn 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "codex: a nested 'codex -c a=b -m o3 mcp remove' exits 0" || t_fail "codex nested value-first remove rc" "rc=$rc: $out"
+cx_has acct-01 dbxn || cx_has acct-02 dbxn \
+  && t_fail "codex nested value-first remove mirror" "dbxn survives in an account" \
+  || t_ok "codex: a nested value-first remove drops the server from EVERY account"
+# NOT a mutation (parity with 16e's --resume / -p): a one-word prompt that reads
+# "mcp add …", and -i, whose variadic value takes every word up to the next option
+: > "$PYLOG"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_ACCOUNT=acct-01 CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" codex "mcp add psx" 2>&1 </dev/null)"
+rc=$?
+[ "$rc" = "0" ] && check "codex: a prompt reading 'mcp add' runs as an ordinary launch" "CFG=acct-01" "$out" \
+  || t_fail "codex prompt rc" "rc=$rc: $out"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_ACCOUNT=acct-01 CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" codex -i shot.png mcp add psx 2>&1 </dev/null)"
+rc=$?
+[ "$rc" = "0" ] && check "codex: 'codex -i shot.png mcp add psx' runs as an ordinary launch" "CFG=acct-01" "$out" \
+  || t_fail "codex image-first rc" "rc=$rc: $out"
+grep -Eq " (snapshot|learn) " "$PYLOG" && t_fail "codex non-mutation mirror attempt" "$(cat "$PYLOG")" \
+  || t_ok "codex: neither a prompt nor -i's words are an mcp mutation (no snapshot, no learn)"
+cx_has acct-01 psx || cx_has acct-02 psx && t_fail "codex non-mutation leak" "psx in an account" \
+  || t_ok "codex: neither non-mutation reaches an account"
 mkdir -p "$WORK/cx-outside"
 : > "$PYLOG"
 out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_HOME="$WORK/cx-outside" CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" codex mcp add outside -- echo o 2>&1)"
@@ -10108,7 +10251,9 @@ fi
 # reconciles with whatever `python3` is on PATH, and a runner Mac's is /usr/bin/python3.
 # Skipped silently where that interpreter is absent or already 3.11+ (CI is ubuntu).
 if [ -x /usr/bin/python3 ] && /usr/bin/python3 -c 'import sys; sys.exit(0 if sys.version_info < (3, 11) else 1)' 2>/dev/null; then
-  if /usr/bin/python3 "$REPO_DIR/tests/test_mcp_registry.py" >/dev/null 2>&1; then
+  # Only this unit suite's disposable pools opt back in; legacy sections stay protected.
+  if CLAUDE_MULTIACC_MCP_ADOPT=1 CODEX_MULTIACC_MCP_ADOPT=1 \
+       /usr/bin/python3 "$REPO_DIR/tests/test_mcp_registry.py" >/dev/null 2>&1; then
     t_ok "MCP registry unit suite on stock python $(/usr/bin/python3 -c 'import sys;print("%d.%d"%sys.version_info[:2])')"
   else
     t_fail "MCP registry unit suite on stock python" "/usr/bin/python3 tests/test_mcp_registry.py failed"

package/tests/test_mcp_mirror.py

@@ -0,0 +1,148 @@
+#!/usr/bin/env python3
+"""Stock mutations must not promote concurrent runner publications into the registry."""
+
+import json
+from pathlib import Path
+import unittest
+from unittest.mock import patch
+
+from test_mcp_registry import HAS_TOMLLIB, HTTP, R, RegistryCase, STDIO
+
+APP = "appinspire-mcp"
+MOTION = "motionsites"
+V1 = {"type": "stdio", "command": "/releases/1000249/python", "args": ["launcher.pyc"], "env": {}}
+V2 = {"type": "stdio", "command": "/releases/1000250/python", "args": ["launcher.pyc"], "env": {}}
+V3 = {"type": "stdio", "command": "/bin/sh", "args": ["-p", "-c", "exec node server.mjs"], "env": {}}
+
+
+class MirrorCases:
+    def setUp(self):
+        super().setUp()
+        if self.provider == "codex" and not HAS_TOMLLIB:
+            self.skipTest("Codex requires tomllib")
+        if self.replica:
+            (self.root / "sync-role").write_text("replica\n")
+
+    def publish(self, servers):
+        rc, _, err = self.run_cli(self.provider, "import-local", "--owner", "app-robot",
+                                 stdin=json.dumps({"mcpServers": servers}))
+        self.assertEqual(rc, 0, err)
+
+    def write_account(self, servers, projects=None):
+        if self.provider == "claude":
+            R._claude_save(self.acct(), {"mcpServers": servers, "projects": projects or {}})
+        else:
+            eff = R.Effective()
+            eff.servers = servers
+            text, notes = R.reconcile_codex_text("", eff)
+            self.assertFalse(notes)
+            (Path(self.acct()) / "config.toml").write_text(text)
+
+    def before(self):
+        rc, snapshot, err = self.run_cli(self.provider, "snapshot", "--account-dir", self.acct())
+        self.assertEqual(rc, 0, err)
+        path = self.root / "before.json"
+        path.write_text(snapshot)
+        return str(path)
+
+    def learn(self, before, name):
+        scope = ["--name", name] if name is not None else []
+        rc, _, err = self.run_cli(self.provider, "learn", "--account-dir", self.acct(),
+                                 "--before", before, *scope)
+        self.assertEqual(rc, 0, err)
+        return R._Target(str(self.root)).section
+
+    def test_named_add_ignores_delayed_runner_generation(self):
+        self.publish({APP: V1})
+        before = self.before()
+        self.publish({APP: V2})
+        # import-local commits G3 under the lock, then applies accounts outside it.
+        # Pause before apply: the client still sees G2, which differs from current G3.
+        with patch.object(R, "_apply_all", return_value=0):
+            self.publish({APP: V3})
+        self.write_account({APP: V2, MOTION: HTTP})
+        section = self.learn(before, MOTION)
+        self.assertEqual(set(section["mcpServers"]), {MOTION})
+        self.assertEqual(section["retired"] + section["retiredUser"], [])
+        self.assertEqual(self.overlay()["owners"]["app-robot"]["mcpServers"], {APP: V3})
+        for account in ("acct-01", "acct-02"):
+            snapshot = R.snapshot(self.provider, self.acct(account))
+            self.assertEqual(snapshot["user"][APP]["command"], "/bin/sh")
+            self.assertEqual(snapshot["user"][MOTION]["url"], HTTP["url"])
+
+    def test_named_remove_does_not_promote_runner_retirement(self):
+        self.publish({APP: V1})
+        self.run_cli(self.provider, "add-json", MOTION, json.dumps(HTTP))
+        before = self.before()
+        self.publish({})
+        self.write_account({})
+        section = self.learn(before, MOTION)
+        self.assertEqual(section["mcpServers"], {})
+        self.assertEqual(section["retiredUser"], [MOTION])
+        self.assertEqual(section["retired"], [])
+        self.assertEqual(self.overlay()["owners"]["app-robot"]["retired"], [APP])
+
+    def test_explicit_owner_override_and_removal_still_mirror(self):
+        self.publish({APP: V1})
+        before = self.before()
+        self.write_account({APP: HTTP})
+        section = self.learn(before, APP)
+        self.assertEqual(section["mcpServers"][APP]["url"], HTTP["url"])
+        self.assertEqual(self.overlay()["owners"]["app-robot"]["mcpServers"], {APP: V1})
+        before = self.before()
+        self.write_account({})
+        section = self.learn(before, APP)
+        self.assertEqual(section["mcpServers"], {})
+        self.assertEqual(section["retiredUser"], [APP])
+        self.assertEqual(section["retired"], [])
+
+    def test_bulk_import_excludes_external_updates_and_retirements(self):
+        self.publish({APP: V1, "old-runner-tool": STDIO})
+        self.run_cli(self.provider, "import-local", "--owner", "local",
+                     stdin=json.dumps({"mcpServers": {"local-tool": V1}}))
+        before = self.before()
+        self.publish({APP: V2})
+        with patch.object(R, "_apply_all", return_value=0):
+            self.publish({APP: V3})
+        self.write_account({APP: V2, MOTION: HTTP, "local-tool": HTTP})
+        section = self.learn(before, None)
+        self.assertEqual(set(section["mcpServers"]), {MOTION, "local-tool"} if self.replica else {MOTION})
+        local = self.overlay()["owners"]["local"]["mcpServers"]["local-tool"]
+        self.assertEqual(local.get("url") if self.replica else local, HTTP["url"] if self.replica else V1)
+        self.assertEqual(section["retired"] + section["retiredUser"], [])
+
+    def test_named_project_changes_and_approvals_stay_scoped(self):
+        if self.provider != "claude":
+            self.skipTest("project MCP entries are Claude-only")
+        for name in (MOTION, "other"):
+            self.run_cli("claude", "add-json", name, json.dumps(STDIO), "--scope", "project",
+                         "--project", "/project")
+        before = self.before()
+        self.write_account({}, {"/project": {"mcpServers": {MOTION: HTTP, "other": HTTP},
+                                             "enabledMcpjsonServers": [MOTION, "other"]}})
+        section = self.learn(before, MOTION)
+        project = section["projects"]["/project"]
+        self.assertEqual(project["mcpServers"], {MOTION: HTTP, "other": STDIO})
+        self.assertEqual(project["enabledMcpjsonServers"], [MOTION])
+        other = self.claude_doc("acct-02")["projects"]["/project"]
+        self.assertEqual(other["enabledMcpjsonServers"], [MOTION])
+
+
+class ClaudeSourceTests(MirrorCases, RegistryCase):
+    provider, replica = "claude", False
+
+
+class ClaudeReplicaTests(MirrorCases, RegistryCase):
+    provider, replica = "claude", True
+
+
+class CodexSourceTests(MirrorCases, RegistryCase):
+    provider, replica = "codex", False
+
+
+class CodexReplicaTests(MirrorCases, RegistryCase):
+    provider, replica = "codex", True
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_mcp_mirror_args.py

@@ -0,0 +1,129 @@
+#!/usr/bin/env python3
+"""MCP target parsing uses native verb options, without reading command payloads."""
+
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+
+from test_mcp_registry import R
+
+HELPER = Path(__file__).resolve().parents[1] / "lib" / "mcp_mirror.sh"
+
+
+class MutationNameTests(unittest.TestCase):
+    def parse(self, *args):
+        return subprocess.run(["/bin/bash", "-uc", '. "$1"; shift; mcp_mutation_name "$@"',
+                               "mcp-target-test", str(HELPER), *args], capture_output=True, text=True)
+
+    def test_native_options_before_name(self):
+        cases = [
+            ("claude", "add", "-s", "user", "-t", "http", "motionsites", "https://example.test"),
+            ("claude", "add", "-suser", "-thttp", "motionsites", "https://example.test"),
+            ("claude", "add", "--scope=user", "--callback-port", "1234", "--client-id", "cid",
+             "--client-secret", "motionsites", "https://example.test"),
+            ("claude", "add", "-e", "A=1", "B=2", "-H", "X: 1", "Y: 2", "--", "motionsites", "echo"),
+            ("claude", "add", "-eA=1", "B=2", "--scope=user", "motionsites", "--", "echo", "--unknown"),
+            ("claude", "add-json", "-suser", "--client-secret", "motionsites", '{"command":"echo"}'),
+            ("claude", "remove", "--scope=user", "motionsites"),
+            ("codex", "add", "-c", "x=1", "--env", "A=1", "--url=https://example.test", "motionsites"),
+            ("codex", "add", "--enable", "x", "--disable=y", "--bearer-token-env-var", "MCP_TOKEN",
+             "--oauth-client-id", "cid", "--oauth-client-secret", "dummy", "--oauth-resource", "r",
+             "--oauth-client-registration", "dynamic", "motionsites"),
+            ("codex", "remove", "-cx=1", "--enable=x", "--disable", "y", "motionsites"),
+            ("codex", "add", "motionsites", "--", "node", "--env", "appinspire-mcp"),
+            ("claude", "add", "motionsites", "--", "node", "--help"),
+            ("codex", "add", "motionsites", "--help"),
+            ("claude", "remove", "motionsites", "-h"),
+            ("claude", "add", "--client-id", "--help", "motionsites", "https://example.test"),
+        ]
+        for args in cases:
+            with self.subTest(args=args):
+                result = self.parse(*args)
+                self.assertEqual((result.returncode, result.stdout, result.stderr), (0, "motionsites\n", ""))
+
+    def test_unknown_or_incomplete_options_never_become_a_broad_mirror(self):
+        cases = [
+            ("claude", "add", "--future-value", "appinspire-mcp", "motionsites"),
+            ("claude", "remove", "--scope"),
+            ("claude", "add", "-e", "A=1", "motionsites", "echo"),
+            ("claude", "add-json", "--client-secret=unexpected", "motionsites", "{}"),
+            ("codex", "add", "--unknown=value", "motionsites"),
+            ("codex", "remove", "--config"),
+            ("codex", "add", "--"),
+            ("claude", "add-from-claude-desktop"),
+        ]
+        for args in cases:
+            with self.subTest(args=args):
+                result = self.parse(*args)
+                self.assertNotEqual(result.returncode, 0)
+                self.assertEqual(result.stdout, "")
+
+    def test_help_without_a_target_has_a_distinct_quiet_status(self):
+        for provider in ("claude", "codex"):
+            for flag in ("-h", "--help"):
+                result = self.parse(provider, "add", flag)
+                self.assertEqual((result.returncode, result.stdout, result.stderr), (2, "", ""))
+
+    def run_shim(self, provider, args, native_exit=0):
+        with tempfile.TemporaryDirectory() as work:
+            root = Path(work)
+            pool, fakebin = root / "pool", root / "bin"
+            (pool / "acct-01").mkdir(parents=True)
+            fakebin.mkdir()
+            (pool / "accounts.json").write_text('{"version":1,"accounts":[{"id":"acct-01"}]}')
+            native = fakebin / provider
+            native.write_text('#!/bin/sh\nprintf "NATIVE\\n"\nprintf "%s\\n" "$@"\nexit "$FAKE_EXIT"\n')
+            native.chmod(0o755)
+            logger = fakebin / "mcp-python"
+            logger.write_text('#!/bin/sh\nprintf "%s\\n" "$@" >> "$MCP_TEST_LOG"\n'
+                              'case "$*" in *" snapshot "*) printf "{}\\n" ;; esac\n')
+            logger.chmod(0o755)
+            log = root / "mirror.log"
+            env = {"PATH": f"{fakebin}:/usr/bin:/bin", "HOME": work, "USER": "test", "LOGNAME": "test",
+                   "TMPDIR": work, "FAKE_EXIT": str(native_exit), "MCP_TEST_LOG": str(log),
+                   "CLAUDE_MULTIACC_PYTHON": str(logger), f"{provider.upper()}_ACCOUNTS_ROOT": str(pool),
+                   f"{provider.upper()}_SHIM_ACTIVE": "1",
+                   "CLAUDE_CONFIG_DIR" if provider == "claude" else "CODEX_HOME": str(pool / "acct-01")}
+            result = subprocess.run([str(HELPER.parents[1] / "bin" / provider), *args], env=env,
+                                    capture_output=True, text=True, timeout=10)
+            return result, log.read_text() if log.exists() else ""
+
+    def test_literal_help_global_value_still_mirrors(self):
+        args = ["--system-prompt", "--help", "mcp", "add-json", "--scope", "user", "motionsites",
+                '{"command":"echo","args":[]}']
+        result, log = self.run_shim("claude", args)
+        self.assertEqual((result.returncode, result.stderr), (0, ""))
+        self.assertEqual(result.stdout.splitlines(), ["NATIVE", *args])
+        self.assertIn("\nlearn\n", log)
+        self.assertIn("\n--name=motionsites\n", log)
+
+    def test_leading_dash_name_reaches_the_registry_parser(self):
+        args = ["mcp", "add", "--", "-probe-name", "echo"]
+        for provider in ("claude", "codex"):
+            result, log = self.run_shim(provider, args)
+            self.assertEqual((result.returncode, result.stderr), (0, ""))
+            self.assertEqual(result.stdout.splitlines(), ["NATIVE", *args])
+            words = log.splitlines()
+            tail = words[words.index("learn") + 1:]
+            parsed = R.build_parser().parse_args(["--root", "unused", "--provider", provider, "learn", *tail])
+            self.assertEqual(parsed.name, "-probe-name")
+
+    def test_help_is_quiet_native_passthrough(self):
+        for provider in ("claude", "codex"):
+            result, log = self.run_shim(provider, ["mcp", "add", "--help"])
+            self.assertEqual((result.returncode, result.stderr, log), (0, "", ""))
+            self.assertEqual(result.stdout.splitlines(), ["NATIVE", "mcp", "add", "--help"])
+
+    def test_unknown_options_keep_native_argv_and_exit_without_mirroring(self):
+        args = ["mcp", "add", "--future-value", "appinspire-mcp", "motionsites"]
+        for provider in ("claude", "codex"):
+            for native_exit in (0, 7):
+                result, log = self.run_shim(provider, args, native_exit)
+                self.assertEqual((result.returncode, log), (native_exit, ""))
+                self.assertEqual(result.stdout.splitlines(), ["NATIVE", *args])
+                self.assertEqual("change not mirrored" in result.stderr, native_exit == 0)
+
+
+if __name__ == "__main__":
+    unittest.main()