claude-multiacc 2.0.60 → 2.0.64

package/tests/test_codex_mcp_oauth_adopt.py

@@ -0,0 +1,87 @@
+#!/usr/bin/env python3
+"""The documented default-home adoption is the only supported external account link."""
+import json
+import os
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / 'lib'))
+import codex_mcp_oauth as M
+
+ENTRY = {'server_name': 'demo', 'server_url': 'https://example.invalid/mcp',
+         'client_id': 'fake-client', 'access_token': 'fake-access', 'refresh_token': 'fake-refresh'}
+
+
+class DefaultAdoptionTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.home = Path(self.temp.name).resolve()
+        environment = patch.dict(os.environ, {'HOME': str(self.home)})
+        environment.start()
+        self.addCleanup(environment.stop)
+        self.root = self.home / '.codex-accounts'
+        self.root.mkdir()
+        self.default = self.home / '.codex'
+        self.default.mkdir()
+        self.adopted = self.root / 'acct-01'
+        self.adopted.symlink_to(self.default, target_is_directory=True)
+        self.regular = self.root / 'acct-02'
+        self.regular.mkdir()
+        (self.root / 'accounts.json').write_text(json.dumps({'accounts': [{'id': 'acct-01'}, {'id': 'acct-02'}]}))
+        (self.regular / '.credentials.json').write_text(json.dumps({'demo|1234': ENTRY}))
+        (self.default / 'auth.json').write_text('default-subscription-login')
+        (self.regular / 'auth.json').write_text('regular-subscription-login')
+
+    def test_adopted_default_joins_storage_preserving_logical_identity(self):
+        self.assertTrue(M.ensure(self.root, self.adopted))
+        authority = self.root / M.SHARED_DIR / 'credentials.json'
+        for path in (self.default, self.adopted, self.regular):
+            self.assertTrue(os.path.samefile(path / '.credentials.json', authority))
+            self.assertEqual((path / 'mcp-oauth-locks').resolve(), self.root / M.SHARED_DIR / 'locks')
+        receipt = json.loads((self.root / M.SHARED_DIR / 'managed.json').read_text())
+        self.assertEqual(receipt['accounts'], ['acct-01', 'acct-02'])
+        self.assertEqual((self.default / 'auth.json').read_text(), 'default-subscription-login')
+        self.assertEqual((self.regular / 'auth.json').read_text(), 'regular-subscription-login')
+        self.assertTrue(self.adopted.is_symlink())
+        self.assertTrue(M.ensure(self.root, self.default))
+        self.assertTrue(M.ensure(self.root, self.regular))
+
+    def test_foreign_adopted_target_and_duplicate_homes_are_rejected(self):
+        foreign = self.home / 'foreign'
+        foreign.mkdir()
+        self.adopted.unlink()
+        self.adopted.symlink_to(foreign, target_is_directory=True)
+        self.assertFalse(M.ensure(self.root, self.adopted))
+        self.assertEqual(list(foreign.iterdir()), [])
+        self.assertFalse((self.root / M.SHARED_DIR).exists())
+        self.adopted.unlink()
+        self.adopted.symlink_to(self.default, target_is_directory=True)
+        extra = self.root / 'acct-03'
+        extra.symlink_to(self.default, target_is_directory=True)
+        names = ['acct-01', 'acct-02', 'acct-03']
+        (self.root / 'accounts.json').write_text(json.dumps({'accounts': [{'id': name} for name in names]}))
+        self.assertFalse(M.ensure(self.root, self.default))
+        self.assertFalse((self.root / M.SHARED_DIR).exists())
+        self.assertFalse((self.default / '.credentials.json').exists())
+
+    def test_unlisted_default_home_and_retargeted_account_are_rejected(self):
+        (self.root / 'accounts.json').write_text(json.dumps({'accounts': [{'id': 'acct-02'}]}))
+        self.assertFalse(M.ensure(self.root, self.default))
+        self.assertFalse((self.root / M.SHARED_DIR).exists())
+        (self.root / 'accounts.json').write_text(json.dumps({'accounts': [{'id': 'acct-01'}, {'id': 'acct-02'}]}))
+        accounts = M.account_dirs(self.root)
+        foreign = self.home / 'foreign'
+        foreign.mkdir()
+        self.adopted.unlink()
+        self.adopted.symlink_to(foreign, target_is_directory=True)
+        with self.assertRaises(M.Deferred):
+            M.check_paths(self.root, accounts)
+        self.assertEqual(list(foreign.iterdir()), [])
+
+
+if __name__ == '__main__':
+    unittest.main()

package/tests/test_codex_mcp_oauth_migration.py

@@ -0,0 +1,141 @@
+#!/usr/bin/env python3
+"""Migration keeps preexisting native lock descriptors serialized through cutover."""
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import time
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / 'lib'))
+import codex_mcp_oauth as M
+import codex_mcp_oauth_locks as L
+from codex_mcp_oauth_store import Deferred
+
+DOCUMENT = {'demo|1234': {'server_name': 'demo', 'server_url': 'https://example.invalid',
+                          'client_id': 'fake-client', 'access_token': 'fake-access'}}
+WAITER = '''import fcntl,os,sys,time
+fd=os.open(sys.argv[1],os.O_RDWR)
+print('opened',flush=True)
+time.sleep(0.3)
+try:
+ fcntl.flock(fd,fcntl.LOCK_EX|fcntl.LOCK_NB)
+ print('unsafe',flush=True)
+except BlockingIOError:
+ print('blocked',flush=True)
+os.close(fd)
+'''
+
+
+class MigrationTests(unittest.TestCase):
+    def setUp(self):
+        temporary = tempfile.TemporaryDirectory()
+        self.addCleanup(temporary.cleanup)
+        self.root = Path(temporary.name)
+        self.accounts = [self.root / 'acct-01', self.root / 'acct-02']
+        for account in self.accounts:
+            (account / 'mcp-oauth-locks').mkdir(parents=True)
+            (account / 'mcp-oauth-locks' / 'file-store.lock').touch()
+        (self.root / 'accounts.json').write_text(json.dumps({'accounts': [{'id': p.name} for p in self.accounts]}))
+        self.source = self.accounts[0] / '.credentials.json'
+        self.source.write_text(json.dumps(DOCUMENT))
+        self.shared = self.root / M.SHARED_DIR / 'locks'
+
+    def test_open_unlocked_descriptor_defers_before_any_cutover(self):
+        path = self.accounts[1] / 'mcp-oauth-locks' / 'file-store.lock'
+        fd = os.open(path, os.O_RDWR)
+        try:
+            self.assertFalse(M.ensure(self.root))
+            self.assertTrue(all(not (account / 'mcp-oauth-locks').is_symlink() for account in self.accounts))
+            self.assertEqual(json.loads(self.source.read_text()), DOCUMENT)
+            self.assertFalse((self.accounts[1] / '.credentials.json').exists())
+            self.assertEqual(path.stat().st_ino, os.fstat(fd).st_ino)
+        finally:
+            os.close(fd)
+        self.assertTrue(M.ensure(self.root))
+
+    def test_waiter_opened_after_preflight_drains_before_credentials_are_shared(self):
+        original = L.exchange
+        children = []
+
+        def exchange_with_waiter(source, target):
+            if source.parent.name == self.accounts[1].name:
+                child = subprocess.Popen([sys.executable, '-c', WAITER, str(source / 'file-store.lock')],
+                                         stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+                children.append(child)
+                self.assertEqual(child.stdout.readline().strip(), 'opened')
+                self.assertFalse((self.accounts[1] / '.credentials.json').exists())
+            original(source, target)
+            self.assertTrue(source.is_symlink())
+            self.assertTrue(target.is_dir() and not target.is_symlink())
+
+        started = time.monotonic()
+        with patch.object(L, 'exchange', side_effect=exchange_with_waiter):
+            self.assertTrue(M.ensure(self.root))
+        self.assertGreaterEqual(time.monotonic() - started, 0.3)
+        for child in children:
+            output, error = child.communicate(timeout=5)
+            self.assertEqual((child.returncode, output.strip(), error), (0, 'blocked', ''))
+        self.assertTrue(os.path.samefile(self.source, self.accounts[1] / '.credentials.json'))
+        self.assertEqual(list((self.shared.parent / 'retired-locks').iterdir()), [])
+
+    def test_lock_created_after_snapshot_keeps_its_inode(self):
+        original = L.exchange
+        created = []
+        name = 'a' * 64 + '.lock'
+
+        def exchange_with_new_lock(source, target):
+            if source.parent.name == self.accounts[1].name:
+                path = source / name
+                path.touch()
+                created.append(path.stat().st_ino)
+            original(source, target)
+
+        with patch.object(L, 'exchange', side_effect=exchange_with_new_lock):
+            self.assertTrue(M.ensure(self.root))
+        self.assertEqual((self.shared / name).stat().st_ino, created[0])
+
+    def test_unavailable_exchange_defers_without_mutating_credentials(self):
+        with patch.object(L, 'exchange_supported', side_effect=Deferred('unavailable')):
+            self.assertFalse(M.ensure(self.root))
+        self.assertEqual(json.loads(self.source.read_text()), DOCUMENT)
+        self.assertTrue(all(not (account / 'mcp-oauth-locks').is_symlink() for account in self.accounts))
+
+    def test_completed_migration_never_probes_process_handles_again(self):
+        self.assertTrue(M.ensure(self.root))
+        with patch.object(L, 'external_handles', side_effect=AssertionError('unnecessary process probe')):
+            self.assertTrue(M.ensure(self.root))
+
+    def test_partial_cutover_failure_drains_waiter_before_releasing_locks(self):
+        third = self.root / 'acct-03'
+        (third / 'mcp-oauth-locks').mkdir(parents=True)
+        (third / 'mcp-oauth-locks' / 'file-store.lock').touch()
+        self.accounts.append(third)
+        (self.root / 'accounts.json').write_text(json.dumps({'accounts': [{'id': p.name} for p in self.accounts]}))
+        original, children = L.exchange, []
+
+        def interrupted_exchange(source, target):
+            if source.parent.name == 'acct-03':
+                raise Deferred('injected cutover failure')
+            if source.parent.name == 'acct-02':
+                child = subprocess.Popen([sys.executable, '-c', WAITER, str(source / 'file-store.lock')],
+                                         stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+                children.append(child)
+                self.assertEqual(child.stdout.readline().strip(), 'opened')
+            original(source, target)
+
+        with patch.object(L, 'exchange', side_effect=interrupted_exchange):
+            self.assertFalse(M.ensure(self.root))
+        self.assertEqual(json.loads(self.source.read_text()), DOCUMENT)
+        self.assertFalse((self.accounts[1] / '.credentials.json').exists())
+        for child in children:
+            output, error = child.communicate(timeout=5)
+            self.assertEqual((child.returncode, output.strip(), error), (0, 'blocked', ''))
+        self.assertTrue(M.ensure(self.root))
+
+
+if __name__ == '__main__':
+    unittest.main()

package/tests/test_codex_mcp_oauth_native.py

@@ -0,0 +1,109 @@
+#!/usr/bin/env python3
+"""Linux process exit must not hide a live native OAuth lock holder."""
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import time
+import unittest
+from unittest.mock import MagicMock, patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / 'lib'))
+import codex_mcp_oauth_native as N
+from codex_mcp_oauth_store import Deferred
+
+
+def scan_process(process):
+    """Limit the proc fixture to this test's process, retaining real fd operations."""
+    root = MagicMock()
+    root.iterdir.return_value = [process]
+    with patch.object(N, 'Path', return_value=root):
+        return N.linux_handles(set(), set())
+
+
+class NativeProcessTests(unittest.TestCase):
+    def test_denied_live_or_unproven_process_still_defers(self):
+        statuses = [
+            'State:\tS (sleeping)\nThreads:\t1\n',
+            'State:\tZ (zombie)\nThreads:\t2\n',
+            'State:\tZ (zombie)\n',
+            'State:\tZ (zombie)\nThreads:\tinvalid\n',
+            'Threads:\t1\n',
+        ]
+        process = MagicMock(spec=Path)
+        process.name = '12345'
+        process.stat.return_value.st_uid = os.getuid()
+        process.__truediv__.return_value.iterdir.side_effect = PermissionError('denied')
+        for status in statuses:
+            with self.subTest(status=status):
+                process.__truediv__.return_value.read_text.return_value = status
+                with self.assertRaises(Deferred):
+                    scan_process(process)
+
+    def test_denied_single_thread_exit_does_not_block_migration(self):
+        process = MagicMock(spec=Path)
+        process.name = '12345'
+        process.stat.return_value.st_uid = os.getuid()
+        process.__truediv__.return_value.iterdir.side_effect = PermissionError('denied')
+        for state in ('Z (zombie)', 'X (dead)'):
+            with self.subTest(state=state):
+                process.__truediv__.return_value.read_text.return_value = f'State:\t{state}\nThreads:\t1\n'
+                self.assertFalse(scan_process(process))
+
+    def test_unreadable_status_defers_but_vanished_process_does_not(self):
+        process = MagicMock(spec=Path)
+        process.name = '12345'
+        process.stat.return_value.st_uid = os.getuid()
+        process.__truediv__.return_value.iterdir.side_effect = PermissionError('denied')
+        process.__truediv__.return_value.read_text.side_effect = PermissionError('denied')
+        with self.assertRaises(Deferred):
+            scan_process(process)
+        process.__truediv__.return_value.read_text.side_effect = FileNotFoundError('gone')
+        self.assertFalse(scan_process(process))
+
+    @unittest.skipUnless(sys.platform == 'linux', 'requires Linux proc metadata')
+    def test_real_unreaped_child_releases_its_file_descriptors(self):
+        child = subprocess.Popen([sys.executable, '-c', 'pass'])
+        try:
+            os.waitid(os.P_PID, child.pid, os.WEXITED | os.WNOWAIT)
+            process = Path('/proc') / str(child.pid)
+            self.assertTrue(N.exited_process(process))
+            self.assertFalse(scan_process(process))
+        finally:
+            child.wait(timeout=3)
+
+    @unittest.skipUnless(sys.platform == 'linux', 'requires Linux thread-group behavior')
+    def test_zombie_leader_with_living_thread_still_defers(self):
+        script = '''import ctypes,os,sys,threading,time
+ready=threading.Event()
+def owner():
+    with open(sys.argv[1], 'w'):
+        ready.set()
+        time.sleep(10)
+threading.Thread(target=owner).start()
+ready.wait()
+ctypes.CDLL(None).pthread_exit(None)
+'''
+        with tempfile.TemporaryDirectory() as directory:
+            child = subprocess.Popen([sys.executable, '-c', script, str(Path(directory) / 'lock')])
+            try:
+                process = Path('/proc') / str(child.pid)
+                deadline = time.monotonic() + 3
+                while time.monotonic() < deadline:
+                    status = (process / 'status').read_text()
+                    if 'State:\tZ' in status and 'Threads:\t2' in status:
+                        break
+                    time.sleep(0.01)
+                else:
+                    self.fail('fixture did not leave a zombie leader with a living thread')
+                self.assertFalse(N.exited_process(process))
+                with self.assertRaises(Deferred):
+                    scan_process(process)
+            finally:
+                child.kill()
+                child.wait(timeout=3)
+
+
+if __name__ == '__main__':
+    unittest.main()

package/tests/test_codex_mcp_oauth_safety.py

@@ -0,0 +1,130 @@
+#!/usr/bin/env python3
+"""Sharing boundaries and recovery use synthetic machine-local pools only."""
+import json
+import os
+from pathlib import Path
+import sys
+import tempfile
+import subprocess
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / 'lib'))
+import codex_mcp_oauth as M
+from codex_mcp_oauth_store import SENTINEL
+
+ENTRY = {'server_name': 'demo', 'server_url': 'https://example.invalid/mcp',
+         'client_id': 'fake-client', 'access_token': 'fake-access', 'refresh_token': 'fake-refresh'}
+
+
+class SafetyTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        self.account = self.root / 'acct-01'
+        self.account.mkdir()
+        (self.root / 'accounts.json').write_text(json.dumps({'accounts': [{'id': 'acct-01'}]}))
+        self.source = self.account / '.credentials.json'
+        self.source.write_text(json.dumps({'demo|1234': ENTRY}))
+        self.shared = self.root / M.SHARED_DIR
+
+    def test_nonmanifest_and_symlink_accounts_are_never_touched(self):
+        outside = self.root / 'unmanaged'
+        outside.mkdir()
+        self.assertFalse(M.ensure(self.root, outside))
+        self.assertFalse(self.shared.exists())
+        self.source.unlink()
+        self.account.rmdir()
+        self.account.symlink_to(outside, target_is_directory=True)
+        self.assertFalse(M.ensure(self.root, self.account, initialize=True))
+        self.assertEqual(list(outside.iterdir()), [])
+
+    def test_symlink_credentials_and_shared_state_are_refused(self):
+        other = self.root / 'private.json'
+        self.source.rename(other)
+        before = other.read_bytes()
+        self.source.symlink_to(other)
+        self.assertFalse(M.ensure(self.root))
+        self.assertEqual(other.read_bytes(), before)
+        self.source.unlink()
+        other.rename(self.source)
+        outside = self.root / 'outside'
+        outside.mkdir()
+        self.shared.symlink_to(outside, target_is_directory=True)
+        self.assertFalse(M.ensure(self.root))
+        self.assertEqual(list(outside.iterdir()), [])
+
+    def test_shared_canonical_deletion_never_reimports_old_link(self):
+        self.assertTrue(M.ensure(self.root))
+        (self.shared / 'credentials.json').unlink()
+        self.assertTrue(M.ensure(self.root))
+        self.assertEqual(set(json.loads(self.source.read_text())), {SENTINEL})
+        self.assertTrue(M.ensure(self.root))
+        self.assertEqual(set(json.loads(self.source.read_text())), {SENTINEL})
+
+    def test_removed_account_link_clears_shared_document(self):
+        self.assertTrue(M.ensure(self.root))
+        self.source.unlink()
+        self.assertTrue(M.ensure(self.root))
+        self.assertEqual(set(json.loads(self.source.read_text())), {SENTINEL})
+
+    def test_foreign_locks_and_malformed_documents_are_refused(self):
+        foreign = self.root / 'foreign-locks'
+        foreign.mkdir()
+        locks = self.account / 'mcp-oauth-locks'
+        locks.symlink_to(foreign, target_is_directory=True)
+        self.assertFalse(M.ensure(self.root))
+        self.assertEqual(list(foreign.iterdir()), [])
+        locks.unlink()
+        for doc in ([], {'bad': {'access_token': 'secret-do-not-print'}}, {'bad': dict(ENTRY, expires_at='bad')}):
+            self.source.write_text(json.dumps(doc))
+            self.assertFalse(M.ensure(self.root))
+        self.assertFalse(self.shared.exists())
+
+    def test_encrypted_backend_is_refused_unless_explicit_file_store(self):
+        config = self.account / 'config.toml'
+        config.write_text('[features]\nsecret_auth_storage = true\n')
+        self.assertFalse(M.ensure(self.root))
+        self.assertFalse(self.shared.exists())
+        config.write_text('mcp_oauth_credentials_store = "file"\n[features]\nsecret_auth_storage = true\n')
+        self.assertTrue(M.ensure(self.root))
+
+    def test_cli_refusal_reports_only_static_reason(self):
+        binary = self.root / 'codex-fake'
+        binary.write_text('#!/bin/sh\necho "codex-cli 0.163.0"\n')
+        binary.chmod(0o700)
+        self.source.write_text('{"secret-do-not-print": "private-value-do-not-print"}')
+        command = [sys.executable, M.__file__, 'ensure', '--root', str(self.root), '--codex-bin', str(binary)]
+        result = subprocess.run(command, capture_output=True, text=True, check=False)
+        self.assertEqual(result.returncode, 1)
+        self.assertIn('invalid credential entry', result.stderr)
+        self.assertNotIn('private-value', result.stdout + result.stderr)
+        self.assertNotIn('secret-do-not-print', result.stdout + result.stderr)
+        quiet = subprocess.run(command + ['--quiet'], capture_output=True, text=True, check=False)
+        self.assertEqual(quiet.returncode, 1)
+        self.assertEqual(quiet.stdout + quiet.stderr, '')
+
+    def test_failed_link_staging_preserves_original_grant_and_lock_directory(self):
+        other = self.root / 'acct-02'
+        other.mkdir()
+        (self.root / 'accounts.json').write_text(json.dumps({'accounts': [{'id': 'acct-01'}, {'id': 'acct-02'}]}))
+        before = self.source.read_bytes()
+        real_link = os.link
+
+        def reject_destination(source, destination):
+            if Path(destination).parent == other.resolve():
+                raise OSError('synthetic destination failure')
+            return real_link(source, destination)
+
+        with patch('codex_mcp_oauth_store.os.link', side_effect=reject_destination):
+            self.assertFalse(M.ensure(self.root))
+        self.assertEqual(self.source.read_bytes(), before)
+        self.assertFalse((other / '.credentials.json').exists())
+        self.assertFalse((self.account / 'mcp-oauth-locks').is_symlink())
+        self.assertEqual(list(other.glob('.codex-mcp-oauth*')), [])
+        self.assertTrue(M.ensure(self.root))
+
+
+if __name__ == '__main__':
+    unittest.main()

package/tests/test_codex_mcp_oauth_shim.py

@@ -0,0 +1,188 @@
+#!/usr/bin/env python3
+"""Exercise Codex OAuth launch hooks with native-shaped, entirely synthetic state."""
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import time
+import unittest
+
+REPO = Path(__file__).resolve().parents[1]
+SHIM = REPO / 'bin/codex'
+CLI = REPO / 'bin/codex-accounts'
+ENTRY = {'server_name': 'motionsites', 'server_url': 'https://example.invalid/mcp',
+         'client_id': 'fake-client', 'access_token': 'fake-mcp-access', 'refresh_token': 'fake-mcp-refresh',
+         'expires_at': 2000000000000, 'scopes': []}
+DOCUMENT = {'motionsites|0000000000000001': ENTRY}
+REAL = '''#!/bin/sh
+if [ "${1:-}" = --version ]; then
+  echo "codex-cli ${TEST_CODEX_VERSION:-0.163.0}"
+  exit 0
+fi
+printf 'exec %s\n' "${CODEX_HOME##*/}" >> "$EVENT_LOG"
+if [ "$CODEX_HOME/.credentials.json" -ef "$CODEX_ACCOUNTS_ROOT/.codex-mcp-oauth/credentials.json" ]; then
+  echo shared
+else
+  echo private
+fi
+if [ "${TEST_RETRY_ONCE:-0}" = 1 ] && [ ! -e "$RETRY_MARK" ]; then
+  : > "$RETRY_MARK"
+  echo 'usage limit exceeded' >&2
+  exit 1
+fi
+'''
+PYTHON = '''#!/bin/sh
+printf 'python %s\n' "${1##*/}" >> "$EVENT_LOG"
+exec "$REAL_PYTHON" "$@"
+'''
+
+
+class CodexMcpOauthShimTests(unittest.TestCase):
+    def setUp(self):
+        work = tempfile.TemporaryDirectory(prefix='codex-mcp-oauth-shim-')
+        self.addCleanup(work.cleanup)
+        self.work = Path(work.name)
+        self.pool, self.home, self.realbin = [self.work / name for name in ('pool', 'home', 'realbin')]
+        for directory in (self.pool, self.home, self.realbin):
+            directory.mkdir()
+        self.accounts = [self.pool / name for name in ('acct-01', 'acct-02')]
+        manifest = {'version': 1, 'server': 'none', 'accounts': [{'id': p.name} for p in self.accounts]}
+        (self.pool / 'accounts.json').write_text(json.dumps(manifest))
+        for account in self.accounts:
+            account.mkdir()
+            (account / 'auth.json').write_text('{"tokens":{"access_token":"fake-codex-access"}}\n')
+            (account / 'config.toml').write_text('# account settings\nmodel = "kept"\n')
+            (account / 'limits.json').write_text(json.dumps({
+                'fetched_at': int(time.time()), 'weekly_percent': 10, 'session_percent': 10, 'max_percent': 10}))
+        self.credential = self.accounts[0] / '.credentials.json'
+        self.credential.write_text(json.dumps(DOCUMENT))
+        self.events = self.work / 'events.log'
+        for name, script in (('codex', REAL), ('python-log', PYTHON)):
+            executable = self.realbin / name
+            executable.write_text(script)
+            executable.chmod(0o755)
+        self.env = {
+            'PATH': f'{self.realbin}:/usr/bin:/bin:/usr/sbin:/sbin', 'HOME': str(self.home), 'USER': 'tester',
+            'LC_ALL': 'C', 'CODEX_ACCOUNTS_ROOT': str(self.pool), 'EVENT_LOG': str(self.events),
+            'CLAUDE_MULTIACC_PYTHON': str(self.realbin / 'python-log'), 'REAL_PYTHON': sys.executable,
+            'CODEX_MULTIACC_AUTORESUME': '0', 'CODEX_MULTIACC_CLIENT_LIMITS': '0',
+            'CODEX_MULTIACC_PATH_PROBE': '0', 'CODEX_MULTIACC_MODEL_CATALOG': '0',
+            'CLAUDE_MULTIACC_MODEL_CATALOG': '0', 'CODEX_MULTIACC_MCP': '0',
+            'RETRY_MARK': str(self.work / 'retried'), 'PYTHONDONTWRITEBYTECODE': '1',
+        }
+
+    def run_command(self, argv, **environment):
+        self.events.write_text('')
+        result = subprocess.run([str(item) for item in argv], env={**self.env, **environment},
+                                stdin=subprocess.DEVNULL, capture_output=True, text=True, timeout=60)
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        self.assertNotIn('fake-mcp-access', result.stdout + result.stderr)
+        self.assertNotIn('fake-mcp-refresh', result.stdout + result.stderr)
+        return result, self.events.read_text().splitlines()
+
+    def test_pinned_selected_and_nested_clients_receive_shared_state_before_exec(self):
+        modes = ({'CODEX_ACCOUNT': 'acct-02'}, {},
+                 {'CODEX_HOME': str(self.accounts[1]), 'CODEX_SHIM_ACTIVE': '1'})
+        original_auth = [(account / 'auth.json').read_bytes() for account in self.accounts]
+        for environment in modes:
+            with self.subTest(environment=environment):
+                result, events = self.run_command([SHIM, '--help'], **environment)
+                self.assertEqual(result.stdout.strip(), 'shared')
+                self.assertEqual(events[0], 'python codex_mcp_oauth.py')
+                self.assertTrue(events[-1].startswith('exec acct-'))
+                authority = self.pool / '.codex-mcp-oauth/credentials.json'
+                for account, before in zip(self.accounts, original_auth):
+                    self.assertTrue(os.path.samefile(account / '.credentials.json', authority))
+                    self.assertEqual((account / 'mcp-oauth-locks').resolve(), (authority.parent / 'locks').resolve())
+                    self.assertEqual((account / 'auth.json').read_bytes(), before)
+
+    def test_retry_prepares_the_replacement_account_before_running_it(self):
+        result, events = self.run_command([SHIM, 'exec', 'test prompt'], TEST_RETRY_ONCE='1')
+        oauth_and_exec = [line for line in events if line == 'python codex_mcp_oauth.py' or line.startswith('exec ')]
+        self.assertEqual(len(oauth_and_exec), 4, events)
+        self.assertEqual(oauth_and_exec[::2], ['python codex_mcp_oauth.py'] * 2)
+        self.assertNotEqual(oauth_and_exec[1], oauth_and_exec[3])
+        self.assertEqual(result.stdout.strip(), 'shared')
+
+    def test_empty_pool_kill_switch_and_missing_python_preserve_launch(self):
+        self.credential.unlink()
+        result, events = self.run_command([SHIM, '--help'], CODEX_ACCOUNT='acct-02')
+        self.assertEqual((result.stdout.strip(), events), ('private', ['exec acct-02']))
+        self.assertFalse((self.pool / '.codex-mcp-oauth').exists())
+        self.credential.write_text(json.dumps(DOCUMENT))
+        for environment in ({'CODEX_MULTIACC_MCP_OAUTH': '0'}, {'CODEX_MULTIACC_DISABLE': '1',
+                             'CODEX_HOME': str(self.accounts[1])},
+                            {'CLAUDE_MULTIACC_PYTHON': '/nonexistent/python3'}):
+            with self.subTest(environment=environment):
+                result, events = self.run_command([SHIM, '--help'], CODEX_ACCOUNT='acct-02', **environment)
+                self.assertEqual((result.stdout.strip(), events), ('private', ['exec acct-02']))
+                self.assertFalse((self.accounts[1] / '.credentials.json').exists())
+        broken = self.work / 'broken-install'
+        (broken / 'bin').mkdir(parents=True)
+        (broken / 'lib').mkdir()
+        shim = broken / 'bin/codex'
+        shim.write_bytes(SHIM.read_bytes())
+        shim.chmod(0o755)
+        (broken / 'lib/codex_mcp_oauth.sh').write_text('if then invalid shell syntax\n')
+        result, events = self.run_command([shim, '--help'], CODEX_ACCOUNT='acct-02')
+        self.assertEqual((result.stdout.strip(), events), ('private', ['exec acct-02']))
+
+    def test_nested_foreign_and_retired_homes_cannot_initialize_pool_sharing(self):
+        for home in (self.work / 'foreign', self.pool / 'acct-99'):
+            with self.subTest(home=home):
+                home.mkdir()
+                path = home / '.credentials.json'
+                path.write_text('{"outside":"untouched"}\n')
+                before = path.read_bytes()
+                result, _events = self.run_command([SHIM, '--help'], CODEX_HOME=str(home), CODEX_SHIM_ACTIVE='1')
+                self.assertEqual(result.stdout.strip(), 'private')
+                self.assertEqual(path.read_bytes(), before)
+                self.assertFalse((self.pool / '.codex-mcp-oauth').exists())
+                self.assertEqual(json.loads(self.credential.read_text()), DOCUMENT)
+
+    def test_auth_sync_dispatches_and_keeps_cli_arguments(self):
+        result, events = self.run_command([CLI, 'mcp', 'auth-sync', '--quiet'])
+        self.assertEqual(result.stdout, '')
+        self.assertIn('python codex_mcp_oauth.py', events)
+        self.assertTrue(os.path.samefile(self.credential, self.accounts[1] / '.credentials.json'))
+        self.assertTrue((self.accounts[1] / 'mcp-oauth-locks').is_symlink())
+
+    def test_account_seeding_joins_existing_oauth_state(self):
+        command = ['bash', '-c', '. "$1"; seed_account_dir "$2"', 'seed',
+                   REPO / 'lib/common.sh', self.accounts[1]]
+        _result, events = self.run_command(command, MULTIACC_PROVIDER='codex')
+        self.assertIn('python codex_mcp_oauth.py', events)
+        self.assertTrue(os.path.samefile(self.credential, self.accounts[1] / '.credentials.json'))
+        self.assertEqual((self.accounts[1] / 'config.toml').read_text(), '# account settings\nmodel = "kept"\n')
+
+    def test_pool_backstop_joins_every_manifest_account(self):
+        command = ['bash', '-c', '. "$1"; codex_mcp_oauth_ensure "$2" "$3" "$4" "" "$5"', 'backstop',
+                   REPO / 'lib/codex_mcp_oauth.sh', self.pool, self.realbin / 'python-log',
+                   REPO / 'lib/codex_mcp_oauth.py', self.realbin / 'codex']
+        _result, events = self.run_command(command)
+        self.assertEqual(events, ['python codex_mcp_oauth.py'])
+        self.assertTrue(os.path.samefile(self.credential, self.accounts[1] / '.credentials.json'))
+        # A subsequent pass must accept already linked lock dirs, including /var aliases on macOS.
+        newcomer = self.pool / 'acct-03'
+        newcomer.mkdir()
+        manifest_path = self.pool / 'accounts.json'
+        manifest = json.loads(manifest_path.read_text())
+        manifest['accounts'].append({'id': newcomer.name})
+        manifest_path.write_text(json.dumps(manifest))
+        self.run_command(command)
+        self.assertTrue(os.path.samefile(self.credential, newcomer / '.credentials.json'))
+
+    def test_older_native_client_preserves_private_credentials(self):
+        result, events = self.run_command([SHIM, '--help'], CODEX_ACCOUNT='acct-02', TEST_CODEX_VERSION='0.162.0')
+        self.assertEqual(result.stdout.strip(), 'private')
+        self.assertEqual(events, ['python codex_mcp_oauth.py', 'exec acct-02'])
+        self.assertFalse((self.pool / '.codex-mcp-oauth').exists())
+        self.assertEqual(json.loads(self.credential.read_text()), DOCUMENT)
+
+
+if __name__ == '__main__':
+    unittest.main()