claude-multiacc 2.0.67 → 2.0.68

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.67",
+  "version": "2.0.68",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/test_release_validation.py

@@ -480,6 +480,7 @@ class ValidatedPublicationTests(RepositoryFixture, unittest.TestCase):
         self.did_publish = False
         self.publish_error = False
         self.registry_existing = None
+        self.registry_output = None
         self.registry_latest = "2.0.65"
         self.readback_integrity = self.record["artifact"]["integrity"]
         self.readback_results = []
@@ -506,7 +507,8 @@ class ValidatedPublicationTests(RepositoryFixture, unittest.TestCase):
             integrity = self.readback_integrity if self.did_publish else self.registry_existing
             if integrity is None:
                 return 1, "", "npm error code E404"
-            return 0, json.dumps(integrity), ""
+            return 0, (json.dumps(integrity) if self.registry_output is None
+                       else self.registry_output), ""
         if argv[:2] == ["npm", "publish"]:
             self.did_publish = True
             return (1, "", "publication response lost") if self.publish_error else (0, "published fixture", "")
@@ -616,6 +618,72 @@ class ValidatedPublicationTests(RepositoryFixture, unittest.TestCase):
         self.assertFalse(self.did_publish)
         self.assertTrue(any(command[:2] == ["git", "push"] for command in self.commands))
 
+    def test_npm12_existing_singleton_integrity_repairs_tag_without_republishing(self):
+        self.registry_existing = [self.record["artifact"]["integrity"]]
+        self.registry_latest = "2.0.99"
+        result = self.publish()
+        self.assertEqual(result["integrity"], self.record["artifact"]["integrity"])
+        self.assertFalse(self.did_publish)
+        self.assertTrue(any(command[:2] == ["git", "push"] for command in self.commands))
+
+    def test_npm12_singleton_readback_confirms_exact_new_publication(self):
+        self.readback_integrity = [self.record["artifact"]["integrity"]]
+        result = self.publish()
+        self.assertEqual(result["integrity"], self.record["artifact"]["integrity"])
+        self.assertEqual(sum(command[:2] == ["npm", "publish"] for command in self.commands), 1)
+        self.assertTrue(any(command[:2] == ["git", "push"] for command in self.commands))
+
+    def test_npm12_singleton_recovers_a_lost_publish_response(self):
+        self.publish_error = True
+        self.readback_integrity = [self.record["artifact"]["integrity"]]
+        result = self.publish()
+        self.assertEqual(result["integrity"], self.record["artifact"]["integrity"])
+        self.assertEqual(sum(command[:2] == ["npm", "publish"] for command in self.commands), 1)
+        self.assertTrue(any(command[:2] == ["git", "push"] for command in self.commands))
+
+    def test_npm12_conflicting_singleton_integrity_is_never_republished(self):
+        self.registry_existing = ["sha512-another-artifact"]
+        with self.assertRaisesRegex(ValueError, "different bytes"):
+            self.publish()
+        self.assert_not_published_or_tagged()
+
+    def test_malformed_or_ambiguous_integrity_prevents_publication(self):
+        integrity = self.record["artifact"]["integrity"]
+        self.registry_existing = integrity
+        for value in ([], [integrity, integrity], [integrity, "sha512-other"],
+                      [[integrity]], [None], [42], {"integrity": integrity},
+                      None, True, 42, "", [""]):
+            with self.subTest(value=value):
+                self.commands.clear()
+                self.registry_output = json.dumps(value)
+                with self.assertRaisesRegex(ValueError, "ambiguous or malformed"):
+                    self.publish()
+                self.assert_not_published_or_tagged()
+        for output in ("not-json", '["unterminated"', json.dumps(integrity) + " trailing"):
+            with self.subTest(output=output):
+                self.commands.clear()
+                self.registry_output = output
+                with self.assertRaises(ValueError):
+                    self.publish()
+                self.assert_not_published_or_tagged()
+
+    def test_ambiguous_readback_never_creates_a_tag(self):
+        integrity = self.record["artifact"]["integrity"]
+        self.readback_integrity = [integrity, integrity]
+        with self.assertRaisesRegex(ValueError, "ambiguous or malformed"):
+            self.publish()
+        self.assertTrue(self.did_publish)
+        self.assertFalse(any(command[:2] in (["git", "tag"], ["git", "push"])
+                             for command in self.commands), self.commands)
+
+    def test_npm12_mismatched_readback_never_creates_a_tag(self):
+        self.readback_integrity = ["sha512-another-artifact"]
+        with self.assertRaisesRegex(ValueError, "did not confirm"):
+            self.publish()
+        self.assertTrue(self.did_publish)
+        self.assertFalse(any(command[:2] in (["git", "tag"], ["git", "push"])
+                             for command in self.commands), self.commands)
+
     def test_lost_publish_response_recovers_only_after_exact_registry_readback(self):
         self.publish_error = True
         result = self.publish()