claude-multiacc 2.0.55 → 2.0.57

package/lib/autoresume_handoff.py

@@ -0,0 +1,191 @@
+"""Build a fresh cross-provider conversation from one verified local source history.
+
+The watcher already knows the source conversation; this module never searches for a
+replacement by directory or recency. It returns launch data without mutating either pool.
+"""
+
+import json
+import os
+import re
+import stat
+
+
+PROVIDERS = ("claude", "codex")
+SID_RE = re.compile(r"^[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$")
+MAX_SOURCE_BYTES = 4 << 20
+PROMPT_PREFIX = "(claude-multiacc auto-resume)"
+
+
+def _read_source(path, inode):
+    """Read only a regular file and reject replacement while checking its identity."""
+    try:
+        original = os.fspath(path)
+        if not isinstance(original, str) or not os.path.isabs(original) or "\0" in original:
+            return None
+        resolved = os.path.realpath(original)
+        descriptor = os.open(resolved, os.O_RDONLY | os.O_NONBLOCK)
+        with os.fdopen(descriptor, "rb") as source:
+            before = os.fstat(source.fileno())
+            if not stat.S_ISREG(before.st_mode) or before.st_size <= 0:
+                return None
+            if inode is not None and (type(inode) is not int or inode != before.st_ino):
+                return None
+            data = source.read(min(before.st_size, MAX_SOURCE_BYTES))
+            after = os.stat(resolved)
+            if (before.st_dev, before.st_ino) != (after.st_dev, after.st_ino):
+                return None
+            if after.st_size < before.st_size or os.path.realpath(original) != resolved:
+                return None
+        return resolved, before, data
+    except (OSError, TypeError, ValueError):
+        return None
+
+
+def _codex_identity(data, sid, cwd):
+    """A main interactive rollout identifies itself in its first JSONL record."""
+    try:
+        record = json.loads(data.split(b"\n", 1)[0])
+    except (ValueError, UnicodeError):
+        return False
+    if not isinstance(record, dict) or record.get("type") != "session_meta":
+        return False
+    meta = record.get("payload")
+    if not isinstance(meta, dict) or meta.get("id") != sid or meta.get("session_id") != sid:
+        return False
+    if meta.get("source") not in (None, "cli") or meta.get("thread_source") not in (None, "user"):
+        return False
+    if meta.get("originator") not in (None, "codex-tui", "codex_cli_rs", "codex_cli"):
+        return False
+    directory = meta.get("cwd")
+    return isinstance(directory, str) and os.path.isabs(directory) and os.path.realpath(directory) == cwd
+
+
+def _claude_identity(data, sid, cwd):
+    """Skip bookkeeping; at least one main conversational record must bind this cwd."""
+    matched = False
+    for line in data.splitlines():
+        try:
+            record = json.loads(line)
+        except (ValueError, UnicodeError):
+            continue
+        if not isinstance(record, dict) or record.get("type") not in ("user", "assistant"):
+            continue
+        if record.get("isSidechain") is True or record.get("agentId"):
+            continue
+        if record.get("sessionId") != sid:
+            return False
+        directory = record.get("cwd")
+        if isinstance(directory, str) and os.path.isabs(directory) and os.path.realpath(directory) == cwd:
+            matched = True
+    return matched
+
+
+def validate_source(provider, sid, path, cwd, inode=None):
+    """Return the exact canonical history identity, or None when it cannot be proven.
+
+    ``inode`` optionally pins the watcher's already bound file. ``offset`` is the source
+    EOF at validation; the prompt references the durable native history, not a copied log.
+    """
+    if provider not in PROVIDERS or not isinstance(sid, str) or not SID_RE.fullmatch(sid):
+        return None
+    try:
+        directory = os.fspath(cwd)
+        if not isinstance(directory, str) or not os.path.isabs(directory) or not os.path.isdir(directory):
+            return None
+        directory = os.path.realpath(directory)
+    except (OSError, TypeError, ValueError):
+        return None
+    loaded = _read_source(path, inode)
+    if loaded is None:
+        return None
+    resolved, identity, data = loaded
+    name = os.path.basename(resolved)
+    if provider == "codex":
+        if not name.startswith("rollout-") or not name.endswith("-" + sid + ".jsonl"):
+            return None
+        valid = _codex_identity(data, sid, directory)
+    else:
+        valid = name == sid + ".jsonl" and _claude_identity(data, sid, directory)
+    if not valid:
+        return None
+    return {"provider": provider, "sid": sid, "path": resolved, "cwd": directory,
+            "inode": identity.st_ino, "offset": identity.st_size}
+
+
+def _permission_argv(source, argv):
+    """Map explicit permission intent, never models or provider-specific resume flags."""
+    # Import lazily: autoresume imports this helper while initializing its own parsers.
+    from autoresume import claude_argv_parse, codex_argv_parse
+
+    if source == "codex":
+        parsed = codex_argv_parse(argv)
+        if parsed is None:
+            return None
+        kept = parsed[0]
+        bypass = any(flag in kept for flag in ("--yolo", "--dangerously-bypass-approvals-and-sandbox"))
+        if bypass and any(flag in kept for flag in ("--sandbox", "--ask-for-approval")):
+            return None
+        return ["--dangerously-skip-permissions"] if bypass else ["--permission-mode", "default"]
+    kept = claude_argv_parse(argv)
+    if kept is None:
+        return None
+    modes = [kept[index + 1] for index, flag in enumerate(kept) if flag == "--permission-mode"]
+    mode = modes[-1] if modes else None
+    bypass = "--dangerously-skip-permissions" in kept
+    if mode not in (None, "default", "bypassPermissions") or bypass and mode == "default":
+        return None
+    if bypass or mode == "bypassPermissions":
+        return ["--dangerously-bypass-approvals-and-sandbox"]
+    return ["--sandbox", "read-only", "--ask-for-approval", "on-request"]
+
+
+def handoff_prompt(history, target, prompt_override=None):
+    """Mandatory identifiers and history instructions remain present with any override."""
+    source = history["provider"]
+    text = (
+        PROMPT_PREFIX + " The " + source + " account hit its usage limit and no other " + source
+        + " account has usable quota. This new " + target + " conversation continues the same task. "
+        "Source provider: " + source + ". Source conversation ID: " + json.dumps(history["sid"]) + ". "
+        "Source history JSONL: " + json.dumps(history["path"]) + ". "
+        "Source working directory: " + json.dumps(history["cwd"]) + ". "
+        "Source file inode: " + str(history["inode"]) + "; snapshot byte boundary: " + str(history["offset"]) + ". "
+        "Verify that file identity and read the complete JSONL records up to that byte boundary before acting; "
+        "if the source history is unavailable or replaced, report it rather than choosing another conversation. "
+        "Reconstruct the user's objective, "
+        "accepted constraints, completed work and remaining work. If it contains earlier cross-provider "
+        "handoff references, read those source histories as needed. Continue the unfinished task; the user "
+        "has not sent a new message. Background work may have stopped or may still be running. Inspect "
+        "its state before relying on it or restarting it, and do not duplicate active or completed work."
+    )
+    if isinstance(prompt_override, str) and prompt_override.strip() and not any(
+            character in prompt_override for character in "\0\n\r"):
+        text += " Additional continuation instruction: " + prompt_override.replace(
+            "{reason}", "the previous account hit its usage limit")
+    return text
+
+
+def handoff_argv(source_provider, target_provider, original_argv, history, prompt_override=None):
+    """Fresh target argv, or None for unsupported source options or permission intent."""
+    if source_provider not in PROVIDERS or target_provider not in PROVIDERS or source_provider == target_provider:
+        return None
+    if not isinstance(history, dict) or history.get("provider") != source_provider:
+        return None
+    if not all(isinstance(history.get(key), str) for key in ("sid", "path", "cwd")):
+        return None
+    if not SID_RE.fullmatch(history["sid"]) or not all(os.path.isabs(history[key]) for key in ("path", "cwd")):
+        return None
+    if not all(type(history.get(key)) is int and history[key] > 0 for key in ("inode", "offset")):
+        return None
+    if not isinstance(original_argv, (list, tuple)) or not all(isinstance(arg, str) for arg in original_argv):
+        return None
+    options = _permission_argv(source_provider, original_argv)
+    return None if options is None else options + [handoff_prompt(history, target_provider, prompt_override)]
+
+
+def build_handoff(source_provider, target_provider, argv, sid, transcript, cwd, inode=None, prompt_override=None):
+    """Validate source history and return ``{argv, history}`` without changing any state."""
+    history = validate_source(source_provider, sid, transcript, cwd, inode)
+    if history is None:
+        return None
+    target_argv = handoff_argv(source_provider, target_provider, argv, history, prompt_override)
+    return None if target_argv is None else {"argv": target_argv, "history": history}

package/lib/autoresume_probe.py

@@ -48,3 +48,39 @@ def probe_allows(cls, pick, tier, current):
     if cls in ROTATE:
         return tier == "eligible" and bool(pick) and pick != current
     return tier in ("eligible", "soft", "credits") and bool(pick)
+
+
+def probe_exhausted(rc, pick, tier):
+    """Only the shim's complete no-capacity responses justify changing providers."""
+    return (rc == 0 and tier == "hard" and bool(pick)) or (rc == 3 and tier == "none" and not pick)
+
+
+CROSS_DROP = set(sum(PROBE_DROP.values(), ())) | {'ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN', 'OPENAI_API_KEY'}
+CONFIG_SUFFIXES = ('ACCOUNTS_ROOT', 'ACCOUNTS_DIR', 'MULTIACC_AUTORESUME', 'MULTIACC_CROSS_PROVIDER',
+                   'MULTIACC_DISABLE', 'MULTIACC_HEADROOM_BAND', 'MULTIACC_SESSION_GATE',
+                   'MULTIACC_THRESHOLD', 'MULTIACC_CLIENT_LIMITS', 'MULTIACC_CLIENT_SCAN_TTL',
+                   'MULTIACC_CREDITS', 'MULTIACC_KEYCHAIN', 'MULTIACC_MCP', 'MULTIACC_PYTHON',
+                   'MULTIACC_STALE_AFTER', 'SHIM_SELECT', 'SHIM_RETRY',
+                   'MULTIACC_AUTORESUME_PROMPT', 'MULTIACC_AUTORESUME_DEBUG')
+
+
+def cross_env(environ, roots):
+    """The same subscription-pool environment for destination probing and execution."""
+    from autoresume import KNOBS
+    knobs = set(KNOBS) | {'TRANSIENT_LADDER', 'TEST_TMUX_ANYPANE', 'TEST_TTY'}
+    keep = {up + '_MULTIACC_AR_' + name for up in ('CLAUDE', 'CODEX') for name in knobs}
+    env = {key: value for key, value in environ.items() if key not in CROSS_DROP
+           and (key in keep or not any(key.startswith(up + '_MULTIACC_AR_') for up in ('CLAUDE', 'CODEX')))
+           and key not in ('CLAUDE_MULTIACC_PREFLIGHT_DEPTH', 'CLAUDE_MULTIACC_PREFLIGHT_SKIP')}
+    for provider, root in roots.items():
+        env[provider.upper() + '_ACCOUNTS_ROOT'] = root
+    return env
+
+
+def handoff_settings(environ, roots):
+    """Persist only noncredential operator settings; API keys/tokens never enter relaunch artifacts."""
+    from autoresume import KNOBS
+    knobs = set(KNOBS) | {'TRANSIENT_LADDER', 'TEST_TMUX_ANYPANE', 'TEST_TTY'}
+    allowed = {up + '_MULTIACC_AR_' + name for up in ('CLAUDE', 'CODEX') for name in knobs}
+    allowed |= {up + '_' + suffix for up in ('CLAUDE', 'CODEX') for suffix in CONFIG_SUFFIXES}
+    return {key: value for key, value in cross_env(environ, roots).items() if key in allowed}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.55",
+  "version": "2.0.57",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/autoresume_cross_receipt_support.py

@@ -0,0 +1,58 @@
+"""Synthetic destination startup receipts tied to exact simulated client identities."""
+
+import json
+from pathlib import Path
+import time
+
+import test_autoresume as fixtures
+from autoresume_cross_unit_support import scenario
+import autoresume_cross as cross
+
+TOKEN = "CrossReceipt0123456789abcdef"
+TARGET_PID = 6565
+
+
+def target_history(watcher, plan, state, timestamp, prompt):
+    account = Path(state["acct_dir"])
+    sid = fixtures.SID2 if plan["provider"] == "claude" else fixtures.CX_SID2
+    if plan["provider"] == "claude":
+        registry = account / "sessions" / (str(TARGET_PID) + ".json")
+        registry.parent.mkdir(parents=True, exist_ok=True)
+        registry.write_text(json.dumps({"pid": TARGET_PID, "sessionId": sid, "cwd": state["cwd"],
+                                        "startedAt": timestamp * 1000}))
+        path = account / "projects/project" / (sid + ".jsonl")
+        records = [fixtures.cc_user(timestamp, prompt, sessionId=sid, cwd=state["cwd"])]
+    else:
+        path = account / "sessions/2026/10/11" / ("rollout-fixture-" + sid + ".jsonl")
+        records = [fixtures.cx_meta(timestamp, sid=sid, cwd=state["cwd"]),
+                   fixtures.cx_event(timestamp, {"type": "user_message", "message": prompt})]
+        directory = Path(plan["root"]) / "tmp/autoresume"
+        (directory / (str(TARGET_PID) + ".rollout")).write_text(str(path))
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(fixtures.jl(records))
+    return sid, path
+
+
+def receipt_scenario(test, provider):
+    case, watcher, runner, _, root = scenario(test, provider)
+    plan = cross.plan_fallback(watcher, watcher.tracker.pending, "")
+    assert plan is not None
+    target_dir = root / "tmp/autoresume"
+    target_dir.mkdir(parents=True)
+    started = time.strftime("%a %b %d %H:%M:%S %Y", time.localtime(runner.now()))
+    state = dict(watcher.st, v="1", provider=plan["provider"], pid=TARGET_PID, acct="acct-01",
+                 acct_dir=str(root / "acct-01"), acc_root=str(root), self=plan["shim"],
+                 launched=int(runner.now()), chain=watcher.chain, depth=int(watcher.st["depth"]) + 1,
+                 handoff_token=TOKEN)
+    path = target_dir / (str(TARGET_PID) + ".state")
+    path.write_text("".join(str(key) + "=" + str(value) + "\n" for key, value in state.items()))
+    path.with_suffix(".argv").write_bytes(fixtures.ar.encode_argv(plan["argv"]))
+    receipt = {key: state[key] for key in ("provider", "pid", "acct", "pane", "ppid", "chain", "depth", "launched")}
+    receipt.update(token=TOKEN, state=str(path), started=started)
+    receipt_path = target_dir / ("h-" + TOKEN + ".start.json")
+    receipt_path.write_text(json.dumps(receipt))
+    receipt_path.chmod(0o600)
+    runner.live.add(TARGET_PID)
+    runner.starts[TARGET_PID] = started
+    sid, history = target_history(watcher, plan, state, runner.now(), plan["argv"][-1])
+    return case, watcher, runner, plan, receipt_path, path, history, sid

package/tests/autoresume_cross_tmux_environment.py

@@ -0,0 +1,59 @@
+"""Credential-free disposable pools and process environment for cross-provider tests."""
+
+import json
+import os
+import sys
+import time
+
+from autoresume_tmux_support import ORIGINAL_PATH, ROOT
+
+
+def seed_pool(home, provider):
+    pool = home / (provider + "-pool")
+    pool.mkdir()
+    shared = home / ("." + provider) / ("sessions" if provider == "codex" else "projects")
+    shared.mkdir(parents=True)
+    (pool / "accounts.json").write_text(json.dumps({"threshold": 90, "accounts": [
+        {"id": name, "email": name + "@synthetic.invalid", "home": "mac"}
+        for name in ("acct-01", "acct-02")]}))
+    (pool / ".limits-kick").touch()
+    for name, percent in (("acct-01", 10), ("acct-02", 30)):
+        account = pool / name
+        account.mkdir()
+        if provider == "codex":
+            (account / "auth.json").write_text('{"tokens":{"access_token":"test-only"}}')
+            (account / "sessions").symlink_to(shared, target_is_directory=True)
+        else:
+            (account / ".credentials.json").write_text(json.dumps({"claudeAiOauth": {
+                "accessToken": "test-only", "refreshToken": "test-only", "expiresAt": 9999999999999,
+                "refreshTokenExpiresAt": 9999999999999, "scopes": ["user:inference"], "subscriptionType": "max"}}))
+            (account / "projects").symlink_to(shared, target_is_directory=True)
+            (account / ".claude.json").write_text('{"hasCompletedOnboarding":true}')
+        (account / "limits.json").write_text(json.dumps({"fetched_at": int(time.time()), "buckets": [],
+            "max_percent": percent, "weekly_percent": percent, "session_percent": 10}, indent=1))
+    return pool
+
+
+def test_environment(home, pools, overrides):
+    fake = home / "fake"
+    fake.mkdir()
+    for provider in pools:
+        binary = fake / provider
+        binary.write_text("#!" + sys.executable + "\n" +
+                          (ROOT / "tests/fixtures/cross_provider_cli.py").read_text())
+        binary.chmod(0o755)
+    env = {"HOME": str(home), "PATH": str(fake) + os.pathsep + ORIGINAL_PATH,
+           "TERM": "xterm-256color", "SHELL": "/bin/bash", "LC_ALL": "C", "FAKE_HOME": str(home)}
+    for provider, pool in pools.items():
+        prefix = provider.upper() + "_"
+        env[prefix + "ACCOUNTS_ROOT"] = str(pool)
+        for name, value in {"PYTHON": sys.executable, "AUTORESUME": "1", "AUTORESUME_DEBUG": "1",
+                            "MCP": "0", "AUTO_RESET": "0", "NO_SYNC": "1", "CLIENT_LIMITS": "0",
+                            "HEADROOM_BAND": "0", "KEYCHAIN": "0", "PATH_PROBE": "0",
+                            "USAGE_URL": "file:///nonexistent", "TOKEN_URL": "file:///nonexistent",
+                            "AR_POLL": "0.05", "AR_GRACE": "0.4", "AR_HOLD_REPROBE": "0.3",
+                            "AR_TERM_GRACE": "0.3", "AR_PANE_WAIT": "4", "AR_RELAUNCH_WAIT": "5",
+                            "AR_PROMPT_WAIT": "2", "AR_TRANSIENT_LADDER": "0.4"}.items():
+            env[prefix + "MULTIACC_" + name] = value
+    env.update(overrides)
+    return env

package/tests/autoresume_cross_tmux_support.py

@@ -0,0 +1,112 @@
+"""Real isolated tmux, launch shell, production shims and watchers for both providers."""
+
+import json
+import os
+from pathlib import Path
+import shlex
+import signal
+import subprocess
+import tempfile
+import time
+
+from autoresume_cross_tmux_environment import seed_pool, test_environment
+from autoresume_tmux_support import ROOT, TMUX
+
+
+class CrossScenario:
+    def __init__(self, **overrides):
+        self.temp = tempfile.TemporaryDirectory(prefix="ar-cross-tmux-", dir="/tmp")
+        self.home = Path(self.temp.name).resolve()
+        self.pools = {provider: seed_pool(self.home, provider) for provider in ("codex", "claude")}
+        self.work = self.home / "work"
+        self.work.mkdir()
+        self.sock = self.home / "tmux.sock"
+        self.env = test_environment(self.home, self.pools, overrides)
+        self.pane = "%0"
+
+    def tmux(self, *args, check=True):
+        result = subprocess.run([TMUX, "-S", str(self.sock), "-f", "/dev/null", *args],
+                                env=self.env, capture_output=True, text=True, timeout=10)
+        if check and result.returncode:
+            raise AssertionError(result.stderr)
+        return result.stdout.strip()
+
+    def start(self, provider, args=None):
+        self.pane = self.tmux("new-session", "-d", "-P", "-F", "#{pane_id}", "-s", "case",
+                              "-c", str(self.work), "/bin/bash", "--noprofile", "--norc", "-i")
+        flag = "--yolo" if provider == "codex" else "--dangerously-skip-permissions"
+        arguments = [flag] if args is None else args
+        self.tmux("send-keys", "-t", self.pane, "-l", shlex.join([str(ROOT / "bin" / provider), *arguments]))
+        self.tmux("send-keys", "-t", self.pane, "Enter")
+        self.wait(lambda: len(self.records("ready")) == 1, "first fake TUI ready")
+        self.wait(lambda: "autoresume watch" in self.logs(provider), "source watcher started")
+
+    def records(self, kind=None):
+        try:
+            rows = [json.loads(line) for line in (self.home / "provider.jsonl").read_text().splitlines()]
+        except (OSError, ValueError):
+            return []
+        return [row for row in rows if kind is None or row["kind"] == kind]
+
+    def logs(self, provider=None):
+        result = ""
+        for name, pool in self.pools.items():
+            if provider is None or name == provider:
+                path = pool / "selection.log"
+                result += path.read_text() if path.exists() else ""
+        return result
+
+    def quota(self, ready=None):
+        ready = ready or self.records("ready")[-1]
+        stamp = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+        if ready["provider"] == "codex":
+            record = {"timestamp": stamp, "type": "event_msg", "payload": {"type": "task_complete", "error": {
+                "message": "You've hit your usage limit. Try again later.",
+                "codex_error_info": "usage_limit_exceeded"}}}
+        else:
+            record = {"timestamp": stamp, "type": "assistant", "sessionId": ready["sid"],
+                      "cwd": str(self.work), "isSidechain": False, "isApiErrorMessage": True,
+                      "apiErrorStatus": 429, "error": "rate_limit", "message": {"role": "assistant",
+                      "content": [{"type": "text", "text": "You've hit your limit · resets 3:36am"}]},
+                      "quotaLimits": {"status": "rejected", "rateLimitType": "five_hour"}}
+        with Path(ready["path"]).open("a") as target:
+            target.write(json.dumps(record) + "\n")
+
+    def park(self, provider, names=("acct-02",)):
+        for name in names:
+            (self.pools[provider] / name / ".limited").write_text(
+                f"{int(time.time()) + 3600}\nbucket=error-cooldown reason=error-cooldown\n")
+
+    def wait(self, predicate, label, timeout=15):
+        deadline = time.monotonic() + timeout
+        while time.monotonic() < deadline:
+            if predicate():
+                return
+            time.sleep(0.05)
+        logs = self.logs() + "\n" + self.tmux("capture-pane", "-p", "-t", self.pane, check=False)
+        for pool in self.pools.values():
+            for path in (pool / "tmp/autoresume").glob("*.log"):
+                logs += "\n" + path.read_text()
+        raise AssertionError(label + " timed out:\n" + logs)
+
+    def close(self):
+        if not self.home.exists():
+            return
+        for pool in self.pools.values():
+            (pool / "autoresume.off").touch()
+        deadline = time.monotonic() + 3
+        while any(self.home.glob("*-pool/tmp/autoresume/*.state")) and time.monotonic() < deadline:
+            time.sleep(0.05)
+        if self.sock.exists():
+            self.tmux("kill-server", check=False)
+        processes = subprocess.run(["ps", "-A", "-o", "pid=,args="], capture_output=True,
+                                   text=True, env=self.env, timeout=5).stdout
+        owned = ["watch --state " + str(pool / "tmp/autoresume") + "/" for pool in self.pools.values()]
+        for row in processes.splitlines():
+            parts = row.strip().split(None, 1)
+            if len(parts) == 2 and any(marker in parts[1] for marker in owned):
+                try:
+                    os.kill(int(parts[0]), signal.SIGTERM)
+                except ProcessLookupError:
+                    pass
+        self.temp.cleanup()