claude-multiacc 2.0.65 → 2.0.67

package/lib/claude_oauth_refresh.py

@@ -0,0 +1,225 @@
+"""Refresh machine-local Claude logins without racing the native rotating grant.
+
+Claude Code 2.1.310 holds both refresh locks across the token request. The storage
+lock protects only the final read/compare/write, never the network round trip.
+An invalid_grant response can leave an empty-token tombstone; that is not a newer
+login and must not displace a successfully rotated grant. A removed login is logout.
+"""
+from __future__ import annotations
+
+import json
+import os
+import time
+import urllib.error
+import urllib.request
+
+from claude_oauth_lock import RefreshLock
+from mcp_oauth import CLIENT_LOCK, CLIENT_LOCK_STALE_S, ClientLock
+
+REFRESH_MIN_EXPIRED = 300
+REFRESH_FAIL_BACKOFF = 600
+REFRESH_DENIED_BACKOFF = 21600
+CLIENT_LOCK_PROBE_S = 1.0
+CLIENT_LOCK_WAIT_S = 10.0
+
+
+def read_login(store):
+    """Unreadable, missing, or non-object logins cannot authorize a token write."""
+    try:
+        doc = store.read()
+        login = doc.get('claudeAiOauth') if isinstance(doc, dict) else None
+        return dict(login) if isinstance(login, dict) else None
+    except Exception:
+        return None
+
+
+def client_lock_busy(directory):
+    deadline = time.monotonic() + CLIENT_LOCK_PROBE_S
+    while True:
+        try:
+            if time.time() - os.stat(os.path.join(directory, CLIENT_LOCK)).st_mtime > CLIENT_LOCK_STALE_S:
+                return False
+        except OSError:
+            return False
+        if time.monotonic() >= deadline:
+            return True
+        time.sleep(0.05)
+
+
+def rotated_login(login, data, now):
+    result = dict(login, accessToken=data['access_token'])
+    if data.get('refresh_token'):
+        result['refreshToken'] = data['refresh_token']
+    result['expiresAt'] = int((now + float(data.get('expires_in') or 3600)) * 1000)
+    if data.get('refresh_token_expires_in'):
+        result['refreshTokenExpiresAt'] = int((now + float(data['refresh_token_expires_in'])) * 1000)
+    return result
+
+
+class OAuthRefresher:
+    def __init__(self, *, now, force, token_url, client_id, say, park_dead_grant, clear_expired):
+        self.now = now
+        self.force = force
+        self.token_url = token_url
+        self.client_id = client_id
+        self.say = say
+        self.park = park_dead_grant
+        self.clear_expired = clear_expired
+
+    def refresh(self, aid, directory, store):
+        # This lock must fail closed: a grace period after access expiry does not
+        # prove that another process has stopped refreshing the same rotating grant.
+        lock = RefreshLock(directory)
+        if not lock.acquire():
+            self.say(f'{aid}: oauth refresh skipped — the client holds its refresh lock; the next pass retries')
+            return None
+        try:
+            # Reread AFTER ownership: the client may have refreshed while we waited.
+            login = read_login(store)
+            if login is None:
+                return None
+            if login.get('accessToken') and login.get('expiresAt', 0) / 1000 > self.now + 60:
+                return login['accessToken']
+            if not self.eligible(aid, directory, login):
+                return None
+            if client_lock_busy(directory) or lock.compromised:
+                self.say(f'{aid}: oauth refresh skipped — the client holds its credential lock ({CLIENT_LOCK})')
+                return None
+            data = self.post(aid, directory, login['refreshToken'], store)
+            if data is None:
+                return None
+            rotated = rotated_login(login, data, self.now)
+            if not self.save(aid, directory, store, login['refreshToken'], rotated):
+                return None
+            try:
+                os.remove(os.path.join(directory, '.oauth-refresh.json'))
+            except OSError:
+                pass
+            if self.clear_expired(directory):
+                self.say(f'{aid}: dead-auth marker cleared (refresh grant works again)')
+            self.say(f'{aid}: oauth access token refreshed via refresh-token grant')
+            return rotated['accessToken']
+        finally:
+            lock.release()
+
+    def eligible(self, aid, directory, login):
+        if not login.get('refreshToken'):
+            self.park(aid, directory, 'no-refresh-token',
+                      'credential has no refresh token and its access token expired')
+            return False
+        if login.get('expiresAt', 0) / 1000 > self.now - REFRESH_MIN_EXPIRED:
+            return False
+        refresh_expiry = login.get('refreshTokenExpiresAt')
+        if refresh_expiry and refresh_expiry / 1000 <= self.now:
+            self.park(aid, directory, 'refresh-token-expired',
+                      'the refresh token itself expired; only a re-login can fix it')
+            return False
+        if not self.force:
+            try:
+                with open(os.path.join(directory, '.oauth-refresh.json')) as stream:
+                    if json.load(stream).get('retry_after', 0) > self.now:
+                        return False
+            except (OSError, ValueError, AttributeError):
+                pass
+        return True
+
+    def back_off(self, aid, directory, wait, why, denials=0):
+        path = os.path.join(directory, '.oauth-refresh.json')
+        try:
+            with open(path + '.tmp', 'w') as stream:
+                json.dump({'retry_after': int(self.now + wait), 'error': why, 'denials': denials,
+                           'at': time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())}, stream)
+            os.replace(path + '.tmp', path)
+        except OSError:
+            pass
+        self.say(f'{aid}: oauth refresh failed ({why}); backing off {wait}s; limits left as-is')
+
+    def post(self, aid, directory, refresh_token, store):
+        body = json.dumps({'grant_type': 'refresh_token', 'refresh_token': refresh_token,
+                           'client_id': self.client_id}).encode()
+        request = urllib.request.Request(self.token_url, data=body, headers={
+            'Content-Type': 'application/json', 'User-Agent': 'claude-multiacc/1.0',
+        })
+        try:
+            data = json.loads(urllib.request.urlopen(request, timeout=30).read().decode())
+        except Exception as error:
+            # A sign-in/logout can replace this grant without the refresh lock.
+            # A failure of the old request must never park the new login.
+            disk = read_login(store)
+            if disk is None or disk.get('refreshToken') != refresh_token:
+                self.say(f'{aid}: oauth login changed during a failed refresh; leaving its state unchanged')
+                return None
+            if isinstance(error, urllib.error.HTTPError) and error.code in (400, 401, 403):
+                self.denied(aid, directory, error, store, refresh_token)
+            else:
+                why = f'HTTP {error.code}' if isinstance(error, urllib.error.HTTPError) else type(error).__name__
+                self.back_off(aid, directory, REFRESH_FAIL_BACKOFF, why)
+            return None
+        if not isinstance(data, dict) or not data.get('access_token'):
+            disk = read_login(store)
+            if disk is not None and disk.get('refreshToken') == refresh_token:
+                self.back_off(aid, directory, REFRESH_DENIED_BACKOFF, 'no access_token in response')
+            return None
+        return data
+
+    def denied(self, aid, directory, error, store, refresh_token):
+        body = ''
+        try:
+            body = error.read(400).decode('utf-8', 'replace')
+        except Exception:
+            pass
+        denials = 1
+        try:
+            with open(os.path.join(directory, '.oauth-refresh.json')) as stream:
+                denials += int(json.load(stream).get('denials', 0))
+        except (OSError, ValueError, TypeError, AttributeError):
+            pass
+        lock = ClientLock(directory, CLIENT_LOCK_WAIT_S)
+        if not lock.acquire():
+            return  # no rotation occurred; retry without marking an uncertain login
+        try:
+            disk = read_login(store)
+            if disk is None or disk.get('refreshToken') != refresh_token:
+                return
+            if 'invalid_grant' in body:
+                self.park(aid, directory, f'refresh-denied-http-{error.code}',
+                          'the refresh grant was refused as invalid_grant (revoked or rotated away)')
+            elif denials >= 3:
+                self.park(aid, directory, f'refresh-denied-http-{error.code}',
+                          f'the refresh grant was refused {denials} times in a row')
+            self.back_off(aid, directory, REFRESH_DENIED_BACKOFF,
+                          f'HTTP {error.code} — refresh token may be revoked; re-login needed', denials)
+        finally:
+            lock.release()
+
+    def save(self, aid, directory, store, started_with, login):
+        lock = ClientLock(directory, CLIENT_LOCK_WAIT_S)
+        held = False
+        try:
+            held = lock.acquire()
+        except Exception:
+            pass
+        if not held and os.path.isdir(lock.path):
+            self.say(f'{aid}: the client kept its credential lock ({CLIENT_LOCK}) past '
+                     f'{int(CLIENT_LOCK_WAIT_S)}s — writing the rotated login without it')
+        try:
+            disk = read_login(store)
+            # Native invalid_grant clears these three fields but leaves the login
+            # object. A missing document/key is logout, never a tombstone to restore.
+            tombstone = (disk is not None and disk.get('refreshToken') == ''
+                         and disk.get('accessToken') == '' and disk.get('expiresAt') == 0)
+            if disk is None or (disk.get('refreshToken') != started_with and not tombstone):
+                self.say(f'{aid}: credential was refreshed by something else mid-flight — '
+                         f'keeping the newer one in the {store.kind} (or its removal)')
+                return False
+            try:
+                # Store implementations merge only this key, preserving current MCP state.
+                store.write({'claudeAiOauth': login})
+            except Exception as error:
+                self.say(f'{aid}: token refreshed but credentials NOT persisted '
+                         f'({type(error).__name__}) — re-login may be needed')
+                return False
+            return True
+        finally:
+            if held:
+                lock.release()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.65",
+  "version": "2.0.67",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {
@@ -56,7 +56,8 @@
   "scripts": {
     "postinstall": "node scripts/postinstall.mjs",
     "test": "npm run test:core && npm run test:seeding && npm run test:commands",
-    "test:core": "bash tests/run-tests.sh && npm run test:selector && npm run test:shim",
+    "test:core": "bash tests/run-tests.sh && npm run test:claude-oauth && npm run test:selector && npm run test:shim",
+    "test:claude-oauth": "python3 -m unittest discover -s tests -p 'test_claude_oauth*.py'",
     "test:shim": "python3 tests/test_shim_path.py && npm run test:codex-stdin",
     "test:codex-stdin": "python3 tests/test_codex_exec_stdin.py && python3 tests/test_codex_retry_process.py",
     "test:selector": "python3 -m unittest discover -s tests -p 'test_selector*.py'",

package/tests/autoresume_cross_tmux_environment.py

@@ -53,7 +53,10 @@ def test_environment(home, pools, overrides):
                             "USAGE_URL": "file:///nonexistent", "TOKEN_URL": "file:///nonexistent",
                             "AR_POLL": "0.05", "AR_GRACE": "0.4", "AR_HOLD_REPROBE": "0.3",
                             "AR_TERM_GRACE": "0.3", "AR_PANE_WAIT": "4", "AR_RELAUNCH_WAIT": "5",
-                            "AR_PROMPT_WAIT": "2", "AR_TRANSIENT_LADDER": "0.4"}.items():
+                            # A real target process can take over two seconds to persist
+                            # its first prompt. Match the relaunch allowance; production
+                            # allows 30s, and missing/stale receipts are still rejected.
+                            "AR_PROMPT_WAIT": "5", "AR_TRANSIENT_LADDER": "0.4"}.items():
             env[prefix + "MULTIACC_" + name] = value
     env.update(overrides)
     return env

package/tests/claude_oauth_fixture.py

@@ -0,0 +1,100 @@
+"""Temporary Claude OAuth stores and a stub provider; never load a real account."""
+
+from __future__ import annotations
+
+import ast
+import io
+import json
+import os
+from pathlib import Path
+import sys
+import tempfile
+import time
+from unittest import mock
+import urllib.request
+
+REPO = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(REPO / "lib"))
+import claude_oauth_refresh  # noqa: E402
+
+
+def file_store_class():
+    """Load the real file store only; never execute limits or access the real pool."""
+    source = (REPO / "bin/claude-accounts").read_text(encoding="utf-8")
+    source = source.split("cmd_limits() {", 1)[1].split("<<'PYEOF'", 1)[1]
+    source = source.split("\n", 1)[1].split("\nPYEOF", 1)[0]
+    nodes = [node for node in ast.parse(source).body
+             if isinstance(node, ast.ClassDef) and node.name == "FileStore"]
+    namespace = {"json": json, "os": os}
+    exec(compile(ast.Module(body=nodes, type_ignores=[]), "limits-test-definitions", "exec"), namespace)
+    return namespace["FileStore"]
+
+
+class AcquireCallbackLock:
+    """Make a competing login finish exactly when our lock is acquired."""
+
+    def __init__(self, callback):
+        self.callback = callback
+        self.compromised = False
+        self.released = False
+
+    def acquire(self):
+        self.callback()
+        return True
+
+    def release(self):
+        self.released = True
+
+
+class OAuthRefreshFixture:
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory(prefix="multiacc-oauth-refresh-")
+        self.addCleanup(self.temp.cleanup)
+        self.account = Path(self.temp.name) / "acct-test"
+        self.account.mkdir()
+        self.path = self.account / ".credentials.json"
+        self.now = time.time()
+        self.original = {"claudeAiOauth": {
+            "accessToken": "fixture-old-access", "refreshToken": "fixture-old-refresh",
+            "expiresAt": int((self.now - 3600) * 1000),
+            "refreshTokenExpiresAt": int((self.now + 86400) * 1000),
+            "scopes": ["user:inference", "user:profile"]},
+            "mcpOAuth": {"fixture-server": {"accessToken": "fixture-mcp-original"}}}
+        self.write(self.original)
+        self.store = file_store_class()(str(self.path))
+        self.posts = []
+        self.messages = []
+        self.park = mock.Mock()
+        self.on_post = lambda: None
+        self.lock = None
+        self.error = None
+        self.reply = {"access_token": "fixture-new-access", "refresh_token": "fixture-new-refresh",
+                      "expires_in": 3600, "refresh_token_expires_in": 2592000}
+        patcher = mock.patch.object(urllib.request, "urlopen", side_effect=self.provider)
+        patcher.start()
+        self.addCleanup(patcher.stop)
+
+    def write(self, document):
+        self.path.write_text(json.dumps(document), encoding="utf-8")
+
+    def read(self):
+        return json.loads(self.path.read_text(encoding="utf-8"))
+
+    def provider(self, request, **_kwargs):
+        self.assertEqual(request.full_url, "https://provider.invalid/token")
+        self.posts.append(json.loads(request.data))
+        self.on_post()
+        if self.error is not None:
+            raise self.error
+        return io.BytesIO(json.dumps(self.reply).encode())
+
+    def refresh(self):
+        options = {"now": self.now, "force": True, "token_url": "https://provider.invalid/token",
+                   "client_id": "fixture-client", "say": self.messages.append,
+                   "park_dead_grant": self.park, "clear_expired": lambda *_args: False}
+        if self.lock is not None:
+            patcher = mock.patch.object(claude_oauth_refresh, "RefreshLock", return_value=self.lock)
+            patcher.start()
+            self.addCleanup(patcher.stop)
+        refresher = claude_oauth_refresh.OAuthRefresher(**options)
+        return refresher.refresh("acct-test", str(self.account), self.store)

package/tests/run-tests.sh

@@ -1867,7 +1867,9 @@ claude >/dev/null 2>&1
 [ ! -f "$ACC/acct-01/.limited" ] \
   && t_ok "an old transcript cannot recreate a telemetry-disproved marker" \
   || t_fail "client recovery watermark" "old rejection recreated the marker"
-rm -f "$ACC/acct-01/.limited"
+# Later fixtures create independent rejections, possibly in this same second. The
+# preceding recovery watermark must not suppress their expiry/opt-out/index checks.
+rm -f "$ACC/acct-01/.limited" "$ACC/acct-01/.client-limit-cleared"
 
 # an ALREADY-ELAPSED rejection is history, not an exclusion
 mkclientlimit "$ACC/acct-01" "$SID1" "$(( $(date +%s) - 60 ))"

package/tests/test_claude_oauth_lock.py

@@ -0,0 +1,138 @@
+#!/usr/bin/env python3
+"""Native-shaped OAuth locks in temporary directories; no credentials or network."""
+from __future__ import annotations
+
+import os
+from pathlib import Path
+import sys
+import tempfile
+import threading
+import time
+import unittest
+from unittest import mock
+
+sys.dont_write_bytecode = True
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / 'lib'))
+import claude_oauth_lock as locks
+
+
+class RefreshLockTests(unittest.TestCase):
+    def setUp(self):
+        temporary = tempfile.TemporaryDirectory(prefix='claude-oauth-lock-test-')
+        self.addCleanup(temporary.cleanup)
+        self.root = Path(temporary.name)
+        self.account = self.root / 'acct-02'
+        self.account.mkdir()
+        self.lock = locks.RefreshLock(self.account, timeout=0.1)
+        self.addCleanup(self.lock.release)
+
+    def test_holds_native_and_legacy_without_storage_lock(self):
+        self.assertTrue(self.lock.acquire())
+        self.assertEqual(self.lock.paths, (self.account / '.oauth_refresh.lock',
+                                         Path(str(self.account.resolve()) + '.lock')))
+        self.assertTrue(all(path.is_dir() for path in self.lock.paths))
+        self.assertFalse((self.account / '.storage-write.lock').exists())
+        self.assertFalse(self.lock.compromised)
+        self.lock.release()
+        self.assertTrue(all(not path.exists() for path in self.lock.paths))
+
+    def test_either_native_lock_blocks_and_partial_acquisition_is_released(self):
+        for blocked in self.lock.paths:
+            with self.subTest(path=blocked.name):
+                blocked.mkdir()
+                identity = blocked.stat().st_ino
+                self.assertFalse(self.lock.acquire())
+                self.assertEqual(blocked.stat().st_ino, identity)
+                self.assertFalse(next(path for path in self.lock.paths if path != blocked).exists())
+                blocked.rmdir()
+
+    def test_stale_empty_native_locks_are_recovered(self):
+        for path in self.lock.paths:
+            path.mkdir()
+            old = time.time() - locks.STALE_SECONDS - 10
+            os.utime(path, (old, old))
+        self.lock.timeout = 0
+        self.assertTrue(self.lock.acquire())
+        self.assertFalse(self.lock.compromised)
+
+    def test_symlinks_and_nonempty_stale_locks_are_preserved(self):
+        target = self.root / 'unrelated'
+        target.mkdir()
+        for path in self.lock.paths:
+            with self.subTest(path=path.name):
+                path.symlink_to(target, target_is_directory=True)
+                self.assertFalse(self.lock.acquire())
+                self.assertTrue(path.is_symlink())
+                path.unlink()
+        path = self.lock.paths[0]
+        path.mkdir()
+        (path / 'foreign-file').write_text('preserve')
+        old = time.time() - locks.STALE_SECONDS - 10
+        os.utime(path, (old, old))
+        self.assertFalse(self.lock.acquire())
+        self.assertEqual((path / 'foreign-file').read_text(), 'preserve')
+
+    def test_replaced_directory_is_not_released(self):
+        self.assertTrue(self.lock.acquire())
+        current = self.lock.paths[0]
+        previous = self.account / 'previous-lock'
+        current.rename(previous)
+        current.mkdir()
+        identity = current.stat().st_ino
+        self.assertTrue(self.lock.compromised)
+        self.lock.release()
+        self.assertEqual(current.stat().st_ino, identity)
+        self.assertTrue(previous.is_dir())
+        self.assertFalse(self.lock.paths[1].exists())
+
+    def test_changed_timestamp_is_not_released_or_renewed(self):
+        self.assertTrue(self.lock.acquire())
+        current = self.lock.paths[0]
+        changed = current.stat().st_mtime_ns + 1_000_000
+        os.utime(current, ns=(changed, changed))
+        self.assertTrue(self.lock.compromised)
+        self.assertFalse(self.lock._renew())
+        self.lock.release()
+        self.assertEqual(current.stat().st_mtime_ns, changed)
+
+    def test_heartbeat_updates_both_locks_and_stops_on_release(self):
+        renewed = threading.Event()
+        original = self.lock._renew
+        with mock.patch.object(locks, 'UPDATE_SECONDS', 0.01), mock.patch.object(
+            self.lock, '_renew', side_effect=lambda: (original(), renewed.set())[0]
+        ):
+            self.assertTrue(self.lock.acquire())
+            before = [path.stat().st_mtime_ns for path in self.lock.paths]
+            self.assertTrue(renewed.wait(1))
+            self.assertTrue(all(path.stat().st_mtime_ns > stamp
+                                for path, stamp in zip(self.lock.paths, before)))
+            self.assertFalse(self.lock.compromised)
+            thread = self.lock._thread
+            self.lock.release()
+            self.assertFalse(thread.is_alive())
+
+    def test_symlinked_account_uses_resolved_legacy_lock(self):
+        alias = self.root / 'alias'
+        alias.symlink_to(self.account, target_is_directory=True)
+        peer = locks.RefreshLock(alias, timeout=0)
+        self.addCleanup(peer.release)
+        self.assertEqual(peer.paths[1], self.lock.paths[1])
+        self.assertTrue(self.lock.acquire())
+        self.assertFalse(peer.acquire())
+        self.assertTrue(alias.is_symlink())
+
+    def test_second_helper_can_acquire_only_after_release(self):
+        peer = locks.RefreshLock(self.account, timeout=0)
+        self.addCleanup(peer.release)
+        self.assertTrue(self.lock.acquire())
+        self.assertFalse(peer.acquire())
+        self.lock.release()
+        self.assertTrue(peer.acquire())
+        peer.release()
+        with mock.patch.object(locks.os, 'open', side_effect=PermissionError):
+            self.assertFalse(peer.acquire())
+        self.assertTrue(all(not path.exists() for path in peer.paths))
+
+
+if __name__ == '__main__':
+    unittest.main()

package/tests/test_claude_oauth_refresh.py

@@ -0,0 +1,106 @@
+#!/usr/bin/env python3
+"""Deterministic OAuth refresh races: temporary credentials and a stub provider only."""
+
+from __future__ import annotations
+
+import copy
+from pathlib import Path
+import unittest
+
+from claude_oauth_fixture import AcquireCallbackLock, OAuthRefreshFixture
+
+
+class ClaudeOAuthRefreshTest(OAuthRefreshFixture, unittest.TestCase):
+
+    def test_native_refresh_lock_blocks_token_post(self):
+        for path in (self.account / ".oauth_refresh.lock", Path(str(self.account.resolve()) + ".lock")):
+            with self.subTest(lock=path.name):
+                self.write(self.original)
+                self.posts.clear()
+                path.mkdir()
+                try:
+                    self.refresh()
+                    self.assertEqual(self.posts, [], "a native refresh lock must prevent rotating the grant")
+                    self.assertEqual(self.read(), self.original)
+                finally:
+                    path.rmdir()
+
+    def test_rereads_login_after_acquiring_refresh_lock(self):
+        newer = copy.deepcopy(self.original)
+        newer["claudeAiOauth"].update(accessToken="fixture-native-access",
+                                      refreshToken="fixture-native-refresh",
+                                      expiresAt=int((self.now + 3600) * 1000))
+        self.lock = AcquireCallbackLock(lambda: self.write(newer))
+        result = self.refresh()
+        self.assertEqual(self.posts, [], "a refresh completed during lock acquisition must be adopted")
+        self.assertEqual(result, "fixture-native-access")
+        self.assertEqual(self.read(), newer)
+        self.assertTrue(self.lock.released)
+
+    def test_success_survives_native_invalid_grant_tombstone(self):
+        tombstone = copy.deepcopy(self.original)
+        tombstone["claudeAiOauth"].update(accessToken="", refreshToken="", expiresAt=0)
+        self.on_post = lambda: self.write(tombstone)
+        self.assertEqual(self.refresh(), "fixture-new-access")
+        self.assertEqual(len(self.posts), 1)
+        self.assertEqual(self.read()["claudeAiOauth"]["refreshToken"], "fixture-new-refresh")
+
+    def test_nonempty_newer_grant_is_preserved(self):
+        newer = copy.deepcopy(self.original)
+        newer["claudeAiOauth"].update(accessToken="fixture-other-access",
+                                      refreshToken="fixture-other-refresh")
+        self.on_post = lambda: self.write(newer)
+        self.refresh()
+        self.assertEqual(len(self.posts), 1)
+        self.assertEqual(self.read(), newer)
+
+    def test_partial_clearing_is_not_mistaken_for_native_tombstone(self):
+        for fields in ({"accessToken": "fixture-other-access", "refreshToken": "", "expiresAt": 0},
+                       {"accessToken": "", "refreshToken": "", "expiresAt": 1000},
+                       {"refreshToken": ""}):
+            with self.subTest(fields=fields):
+                self.write(self.original)
+                changed = {"claudeAiOauth": fields}
+                self.on_post = lambda document=changed: self.write(document)
+                self.assertIsNone(self.refresh())
+                self.assertEqual(self.read(), changed)
+
+    def test_deleted_document_is_not_resurrected_after_logout(self):
+        self.on_post = self.path.unlink
+        self.assertIsNone(self.refresh())
+        self.assertEqual(len(self.posts), 1)
+        self.assertFalse(self.path.exists(), "an in-flight refresh must not undo logout")
+
+    def test_removed_login_is_not_restored_into_mcp_document(self):
+        remaining = {"mcpOAuth": {"fixture-server": {"accessToken": "fixture-mcp-only"}}}
+        self.on_post = lambda: self.write(remaining)
+        self.assertIsNone(self.refresh())
+        self.assertEqual(self.read(), remaining)
+
+    def test_concurrent_mcp_changes_survive_successful_refresh(self):
+        concurrent = copy.deepcopy(self.original)
+        concurrent["mcpOAuth"]["fixture-server"]["accessToken"] = "fixture-mcp-updated"
+        concurrent["mcpOAuthClientConfig"] = {"fixture-server": {"clientId": "fixture-client-id"}}
+        self.on_post = lambda: self.write(concurrent)
+        self.assertEqual(self.refresh(), "fixture-new-access")
+        saved = self.read()
+        self.assertEqual(saved["mcpOAuth"], concurrent["mcpOAuth"])
+        self.assertEqual(saved["mcpOAuthClientConfig"], concurrent["mcpOAuthClientConfig"])
+        self.assertEqual(saved["claudeAiOauth"]["refreshToken"], "fixture-new-refresh")
+
+    def test_unknown_refresh_expiry_still_attempts_refresh(self):
+        document = copy.deepcopy(self.original)
+        del document["claudeAiOauth"]["refreshTokenExpiresAt"]
+        self.write(document)
+        self.assertEqual(self.refresh(), "fixture-new-access")
+        self.assertEqual(len(self.posts), 1)
+
+    def test_omitted_refresh_expiry_preserves_native_expiry_semantics(self):
+        del self.reply["refresh_token_expires_in"]
+        self.assertEqual(self.refresh(), "fixture-new-access")
+        self.assertEqual(self.read()["claudeAiOauth"]["refreshTokenExpiresAt"],
+                         self.original["claudeAiOauth"]["refreshTokenExpiresAt"])
+
+
+if __name__ == "__main__":
+    unittest.main()