claude-multiacc 2.0.66 → 2.0.68

package/docs/INSTALLATION.md

@@ -56,9 +56,10 @@ version is on npm.
 (Note: newer npm versions gate install scripts; if postinstall is blocked, just run
 `claude-multiacc install` once.)
 
-New versions publish to npm automatically from `main` via GitHub Actions
-(`.github/workflows/publish.yml`, OIDC Trusted Publishing — no long-lived token after the
-first bootstrap publish; `scripts/auto-version.mjs` bumps the patch above the last release).
+New versions publish to npm automatically from `main` via GitHub Actions using OIDC
+Trusted Publishing. Prepare the version with `scripts/auto-version.mjs` before
+committing, then complete the [local release validation](RELEASING.md). The workflow
+verifies that evidence and publishes the exact validated version and package bytes.
 
 ### From a git checkout
 

package/docs/RELEASING.md

@@ -0,0 +1,75 @@
+# Releasing within two minutes of GitHub Actions starting
+
+Every release runs the full validation locally before GitHub Actions. The workflow
+then verifies authenticated evidence, repacks and compares the exact package, runs
+short hosted compatibility checks, publishes through npm OIDC, confirms registry
+integrity, and tags the same source. Measure the complete successful Actions run
+from its creation through completion, including setup and publication: the budget
+is 120 seconds. A timeout alone does not establish compliance.
+
+The full local checks still take minutes. They have not been removed, weakened or
+replaced by a smoke test. `scripts/release_validation.py` defines their canonical
+roster: the complete shell suite, selector, piped Codex retries, Keychain, shell PATH
+probe, Claude OAuth refresh coordination, autoresume, account seeding/settings/MCP,
+packed commands, and release policy tests. Seeding runs in a private Linux PID namespace; tmux and zsh must be present.
+
+## Prepare and validate an immutable candidate
+
+1. Resolve the next npm version before the final candidate commit:
+   `node scripts/auto-version.mjs .`. Commit all source, tests, release scripts and
+   documentation. Validation requires a clean checkout, including untracked files.
+2. Run `scripts/validate-release.sh --receipt /absolute/path/outside/repo/receipt.json`.
+   The helper prepares a Linux environment, runs with a private process namespace
+   and HOME, disables networking during tests, and mounts the candidate read-only.
+   npm 12.2.1 is used locally and in Actions so the packed bytes match.
+3. Keep the receipt, complete command logs and packed artifact together outside the
+   checkout. Any failing command or source change prevents successful attestation.
+4. Push that exact candidate and authenticate the result:
+
+   ```bash
+   python3 scripts/release_validation.py publish --repository gowalk-public/claude-multiacc --receipt /absolute/path/outside/repo/receipt.json
+   ```
+
+5. Mark the draft PR ready after publishing the statuses, or rerun its workflow if
+   it was already ready. Same-repository ready PRs verify the exact head and run the
+   short hosted checks; they cannot publish a package. Draft and fork PRs skip this job.
+6. Merge only when the branch tree is exactly the tested tree. If main changed such
+   that the merge would change it, update the branch and repeat validation. A squash
+   merge may change the commit ID; its tree must still equal the validated PR head.
+
+The repository variable `LOCAL_RELEASE_VALIDATION_ACTOR` names the trusted GitHub
+account allowed to attest local execution. GitHub authenticates that actor, not the
+local machine; this does not claim hardware or machine attestation. A checked-in
+JSON file alone never admits a release. Raw local receipts remain available for
+review and bind each command's exact arguments, return code and log digest.
+
+The latest `local-release-validation` status binds the Git tree and complete suite
+policy. The latest `local-release-artifact` status binds version and tarball SHA-256.
+Both must be successful, created by the trusted actor, and less than 24 hours old.
+A newer failed, pending or unauthorized status blocks an older success. Changes to
+source bytes, modes, symlink targets, policy, version or package bytes require fresh
+evidence. No CI version bump is permitted after validation.
+
+## Publication and confirmation
+
+The workflow retains real hosted PATH-probe and atomic-lock checks because hosted
+shell integration and core utilities can differ from a local Linux image. It runs
+the release-policy rejection tests as well. These short checks supplement the full
+local proof.
+
+After publishing, require both a green workflow and matching npm integrity/version
+and Git tag. Record the measured run duration. Queue or registry outages can prevent
+a release; they must never cause stale proof to be accepted or required checks to
+be skipped. The workflow refuses to start publication when it has already consumed
+the time reserved for publication and tagging.
+
+npm can accept a package and keep it unavailable while processing it. That is
+reported as pending registry confirmation, never as a completed deployment. A rerun
+checks the exact existing version's integrity, skips republishing matching bytes,
+and completes the matching tag. Conflicting bytes or an existing tag for another
+commit stop before any new publication. Registry confirmation uses the remaining
+run budget while reserving time for tagging and Actions cleanup; it never extends
+the 120-second budget. Recovery uses the new attempt's start time;
+reports retain the original run creation time so waiting does not disappear from
+the end-to-end record. Registry processing time is external to Actions and must be
+reported separately if it prevents the requested complete deployment budget.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.66",
+  "version": "2.0.68",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/autoresume_cross_tmux_environment.py

@@ -53,7 +53,10 @@ def test_environment(home, pools, overrides):
                             "USAGE_URL": "file:///nonexistent", "TOKEN_URL": "file:///nonexistent",
                             "AR_POLL": "0.05", "AR_GRACE": "0.4", "AR_HOLD_REPROBE": "0.3",
                             "AR_TERM_GRACE": "0.3", "AR_PANE_WAIT": "4", "AR_RELAUNCH_WAIT": "5",
-                            "AR_PROMPT_WAIT": "2", "AR_TRANSIENT_LADDER": "0.4"}.items():
+                            # A real target process can take over two seconds to persist
+                            # its first prompt. Match the relaunch allowance; production
+                            # allows 30s, and missing/stale receipts are still rejected.
+                            "AR_PROMPT_WAIT": "5", "AR_TRANSIENT_LADDER": "0.4"}.items():
             env[prefix + "MULTIACC_" + name] = value
     env.update(overrides)
     return env

package/tests/run-tests.sh

@@ -1867,7 +1867,9 @@ claude >/dev/null 2>&1
 [ ! -f "$ACC/acct-01/.limited" ] \
   && t_ok "an old transcript cannot recreate a telemetry-disproved marker" \
   || t_fail "client recovery watermark" "old rejection recreated the marker"
-rm -f "$ACC/acct-01/.limited"
+# Later fixtures create independent rejections, possibly in this same second. The
+# preceding recovery watermark must not suppress their expiry/opt-out/index checks.
+rm -f "$ACC/acct-01/.limited" "$ACC/acct-01/.client-limit-cleared"
 
 # an ALREADY-ELAPSED rejection is history, not an exclusion
 mkclientlimit "$ACC/acct-01" "$SID1" "$(( $(date +%s) - 60 ))"