claude-multiacc 2.0.55 → 2.0.57

package/tests/test_autoresume_cross_policy.py

@@ -0,0 +1,123 @@
+"""Quota fallback keeps same-provider priority and never stops a client without a safe target."""
+
+import unittest
+from unittest import mock
+
+import test_autoresume as fixtures
+from autoresume_cross_unit_support import cancel_record, scenario
+import autoresume_cross as cross
+
+
+class CrossProviderPolicyTests(unittest.TestCase):
+    def test_unknown_or_inconsistent_source_capacity_never_probes_another_provider(self):
+        replies = ((127, ""), (124, "pick=acct-02 tier=hard"), (0, "malformed reply"),
+                   (3, "pick=acct-02 tier=hard"), (0, "pick= tier=none"),
+                   (3, "pick=acct-02 tier=none"), (0, "pick= tier=hard"),
+                   (0, "pick=acct-01 tier=eligible"), (1, "pick=acct-02 tier=eligible"))
+        for provider in ("claude", "codex"):
+            for status, reply in replies:
+                with self.subTest(provider=provider, status=status, reply=reply):
+                    case, watcher, runner, _, _ = scenario(self, provider)
+                    original = runner.run
+                    def source_failure(argv, timeout, env=None, cwd=None):
+                        if argv[0] == watcher.st["self"]:
+                            return status, reply + "\n"
+                        return original(argv, timeout, env=env, cwd=cwd)
+                    with mock.patch.object(runner, "run", side_effect=source_failure):
+                        self.assertEqual(watcher.run(), 0)
+                    self.assertEqual((runner.target_probes, runner.signals, runner.sends), ([], [], []))
+                    self.assertEqual(case.relaunch_files(), [])
+                    self.assertIn("hold", case.events())
+
+    def test_valid_empty_source_pool_probes_another_provider(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                _, watcher, runner, _, _ = scenario(self, provider)
+                runner.probe_out = "pick= tier=none\n"
+                runner.target_out = "pick= tier=none\n"
+                self.assertEqual(watcher.run(), 0)
+                self.assertTrue(runner.target_probes)
+                self.assertEqual((runner.signals, runner.sends), ([], []))
+
+    def test_same_provider_eligible_soft_or_configured_credits_wins_without_cross_probe(self):
+        for provider in ("claude", "codex"):
+            for tier in ("eligible", "soft", "credits"):
+                with self.subTest(provider=provider, tier=tier):
+                    case, watcher, runner, _, _ = scenario(self, provider)
+                    runner.probe_out = "pick=acct-02 tier=" + tier + "\n"
+                    if tier == "credits":
+                        watcher.env[provider.upper() + "_MULTIACC_CREDITS"] = "1"
+                    self.assertEqual(watcher.run(), 0)
+                    self.assertEqual(len(runner.probes), 1)
+                    self.assertEqual(runner.target_probes, [])
+                    self.assertEqual(len(runner.signals), 1)
+                    self.assertIn("switch", case.events())
+
+    def test_nonquota_errors_never_probe_the_other_provider(self):
+        cases = (("claude", "auth"), ("claude", "blocked"), ("claude", "model"),
+                 ("claude", "transient"), ("codex", "auth"), ("codex", "transient"))
+        for provider, error_class in cases:
+            with self.subTest(provider=provider, error_class=error_class):
+                case, watcher, runner, _, _ = scenario(self, provider, error_class=error_class)
+                self.assertIsNone(cross.plan_fallback(watcher, watcher.tracker.pending, ""))
+                self.assertEqual((runner.target_probes, runner.signals, runner.sends), ([], [], []))
+
+    def test_exhausted_or_missing_target_holds_the_source(self):
+        for provider in ("claude", "codex"):
+            for reply in ("pick=acct-01 tier=hard", "pick= tier=none", "malformed answer"):
+                with self.subTest(provider=provider, reply=reply):
+                    case, watcher, runner, _, _ = scenario(self, provider)
+                    runner.target_out = reply + "\n"
+                    self.assertEqual(watcher.run(), 0)
+                    self.assertTrue(runner.target_probes)
+                    self.assertEqual((runner.signals, runner.sends, case.relaunch_files()), ([], [], []))
+                    self.assertIn("hold", case.events())
+
+    def test_both_directions_accept_same_named_target_account_without_source_avoid_leak(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                case, watcher, runner, _, target_root = scenario(self, provider)
+                target = "codex" if provider == "claude" else "claude"
+                avoided = "acct-01:%d" % (case.t0 + 7200)
+                plan = cross.plan_fallback(watcher, watcher.tracker.pending, avoided)
+                self.assertIsNotNone(plan)
+                self.assertEqual((plan["provider"], plan["pick"], plan["root"]),
+                                 (target, "acct-01", str(target_root)))
+                self.assertEqual(runner.target_probes[-1]["env"][target.upper() + "_MULTIACC_AR_AVOID"], "")
+                fields = cross.chain_fields(watcher, avoided)
+                self.assertEqual((fields["avoid_" + provider], fields["avoid_" + target]), (avoided, ""))
+
+    def test_existing_target_avoidance_survives_independently(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                case, watcher, runner, _, _ = scenario(self, provider)
+                target = "codex" if provider == "claude" else "claude"
+                target_avoid = "acct-02:%d" % (case.t0 + 3600)
+                watcher.st["avoid_" + target] = target_avoid
+                plan = cross.plan_fallback(watcher, watcher.tracker.pending, "acct-01:%d" % (case.t0 + 7200))
+                self.assertIsNotNone(plan)
+                self.assertEqual(plan["avoid"], target_avoid)
+                self.assertEqual(runner.target_probes[-1]["env"][target.upper() + "_MULTIACC_AR_AVOID"], target_avoid)
+
+    def test_user_input_during_either_probe_cancels_before_any_signal(self):
+        for provider in ("claude", "codex"):
+            for stage in ("source", "target"):
+                with self.subTest(provider=provider, stage=stage):
+                    case, watcher, runner, history, _ = scenario(self, provider)
+                    setattr(runner, stage + "_hook", lambda: fixtures.append(history, [cancel_record(case, provider)]))
+                    self.assertEqual(watcher.run(), 0)
+                    self.assertIsNone(watcher.tracker.pending)
+                    self.assertEqual((runner.signals, runner.sends, case.relaunch_files()), ([], [], []))
+
+    def test_rotation_budget_cannot_be_bypassed_by_changing_provider(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                case, watcher, runner, _, _ = scenario(self, provider)
+                watcher.st["hist"] = ",".join("quota:%d" % (case.t0 - n) for n in range(8))
+                self.assertEqual(watcher.run(), 0)
+                self.assertEqual((runner.probes, runner.target_probes, runner.signals), ([], [], []))
+                self.assertIn("reason=rotate-budget", case.log_lines()[-1])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_autoresume_cross_receipt.py

@@ -0,0 +1,141 @@
+"""A destination startup token is insufficient without fresh exact user input in its own history."""
+
+import json
+from pathlib import Path
+import unittest
+
+import test_autoresume as fixtures
+from autoresume_cross_receipt_support import TARGET_PID, TOKEN, receipt_scenario
+import autoresume_cross_receipt as receipt
+
+
+class CrossProviderReceiptTests(unittest.TestCase):
+    def test_fresh_exact_prompt_confirms_the_new_destination_sid_in_both_directions(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                _, watcher, _, plan, _, _, _, sid = receipt_scenario(self, provider)
+                self.assertNotEqual(sid, watcher.sid)
+                self.assertEqual(receipt.confirm_cross(watcher, TOKEN, plan), sid)
+
+    def test_missing_wrong_or_replayed_startup_token_does_not_confirm(self):
+        for provider in ("claude", "codex"):
+            for bad in ("missing", "wrong-token", "wrong-state-token"):
+                with self.subTest(provider=provider, bad=bad):
+                    _, watcher, _, plan, proof, state, _, _ = receipt_scenario(self, provider)
+                    if bad == "missing":
+                        proof.unlink()
+                    elif bad == "wrong-token":
+                        data = json.loads(proof.read_text())
+                        data["token"] = "AnotherReceipt0123456789"
+                        proof.write_text(json.dumps(data))
+                    else:
+                        state.write_text(state.read_text().replace("handoff_token=" + TOKEN,
+                                                                   "handoff_token=AnotherReceipt0123456789"))
+                    self.assertIsNone(receipt.read_start(watcher, TOKEN, plan))
+                    self.assertIsNone(receipt.confirm_cross(watcher, TOKEN, plan))
+
+    def test_dead_reused_or_mismatched_client_receipt_is_rejected(self):
+        for provider in ("claude", "codex"):
+            for bad in ("dead", "zombie", "reused", "absent-start", "pane", "chain", "provider", "depth"):
+                with self.subTest(provider=provider, bad=bad):
+                    _, watcher, runner, plan, proof, _, _, _ = receipt_scenario(self, provider)
+                    if bad == "dead":
+                        runner.exit(TARGET_PID)
+                    elif bad == "zombie":
+                        runner.gone = lambda pid: pid == TARGET_PID or pid not in runner.live
+                    elif bad == "reused":
+                        runner.starts[TARGET_PID] = "a different process instance"
+                    elif bad == "absent-start":
+                        runner.starts[TARGET_PID] = None
+                        data = json.loads(proof.read_text())
+                        data.pop("started")
+                        proof.write_text(json.dumps(data))
+                    else:
+                        data = json.loads(proof.read_text())
+                        data[bad] = 999 if bad == "depth" else "mismatched-identity"
+                        proof.write_text(json.dumps(data))
+                    self.assertIsNone(receipt.read_start(watcher, TOKEN, plan))
+
+    def test_startup_state_cannot_redirect_history_or_shim_outside_the_target(self):
+        for provider in ("claude", "codex"):
+            for changed in ("acct_dir", "self", "cwd", "tmux"):
+                with self.subTest(provider=provider, changed=changed):
+                    case, watcher, _, plan, _, state_path, _, _ = receipt_scenario(self, provider)
+                    fields = dict(line.split("=", 1) for line in state_path.read_text().splitlines())
+                    values = {"acct_dir": str(case.root / "acct-01"), "self": watcher.st["self"],
+                              "cwd": str(case.root), "tmux": "/another/tmux/socket,123,1"}
+                    fields[changed] = values[changed]
+                    state_path.write_text("".join(key + "=" + value + "\n" for key, value in fields.items()))
+                    self.assertIsNone(receipt.read_start(watcher, TOKEN, plan))
+
+    def test_an_old_or_wrong_user_prompt_cannot_confirm_even_with_fresh_startup(self):
+        for provider in ("claude", "codex"):
+            for bad in ("old", "wrong"):
+                with self.subTest(provider=provider, bad=bad):
+                    _, watcher, runner, plan, _, _, history, sid = receipt_scenario(self, provider)
+                    records = [json.loads(line) for line in history.read_text().splitlines()]
+                    user = records[-1]
+                    if bad == "old":
+                        user["timestamp"] = fixtures.iso(runner.now() - 3600)
+                    elif plan["provider"] == "claude":
+                        user["message"]["content"] = "Some other prompt"
+                    else:
+                        user["payload"]["message"] = "Some other prompt"
+                    history.write_text(fixtures.jl(records))
+                    self.assertIsNone(receipt.confirm_cross(watcher, TOKEN, plan))
+
+    def test_assistant_or_subagent_echo_is_not_a_destination_user_receipt(self):
+        for provider in ("claude", "codex"):
+            for bad in ("assistant", "subagent"):
+                with self.subTest(provider=provider, bad=bad):
+                    _, watcher, runner, plan, _, _, history, sid = receipt_scenario(self, provider)
+                    records = [json.loads(line) for line in history.read_text().splitlines()]
+                    if plan["provider"] == "claude":
+                        records[-1] = fixtures.cc_reply(runner.now(), plan["argv"][-1], sessionId=sid,
+                                                       cwd=plan["history"]["cwd"]) \
+                            if bad == "assistant" else dict(records[-1], isSidechain=True)
+                    elif bad == "assistant":
+                        records[-1]["payload"]["type"] = "agent_message"
+                    else:
+                        records[0]["payload"]["source"] = {"subagent": "spawn"}
+                    history.write_text(fixtures.jl(records))
+                    self.assertIsNone(receipt.confirm_cross(watcher, TOKEN, plan))
+
+    def test_source_sid_cannot_be_reused_as_the_destination_conversation(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                _, watcher, _, plan, _, state_path, history, sid = receipt_scenario(self, provider)
+                records = [json.loads(line) for line in history.read_text().splitlines()]
+                destination = history.with_name(history.name.replace(sid, watcher.sid))
+                if plan["provider"] == "claude":
+                    records[-1]["sessionId"] = watcher.sid
+                    state = fixtures.ar.load_state(str(state_path))
+                    registry = Path(state["acct_dir"]) / "sessions" / (str(TARGET_PID) + ".json")
+                    data = json.loads(registry.read_text())
+                    data["sessionId"] = watcher.sid
+                    registry.write_text(json.dumps(data))
+                else:
+                    records[0]["payload"].update(id=watcher.sid, session_id=watcher.sid)
+                    state_path.with_suffix(".rollout").write_text(str(destination))
+                history.rename(destination)
+                destination.write_text(fixtures.jl(records))
+                self.assertIsNone(receipt.confirm_cross(watcher, TOKEN, plan))
+
+    def test_replacing_the_bound_target_history_cannot_manufacture_a_receipt(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                _, watcher, runner, plan, _, _, history, _ = receipt_scenario(self, provider)
+                replacement = history.with_suffix(".replacement")
+                replacement.write_bytes(history.read_bytes())
+                records = [json.loads(line) for line in history.read_text().splitlines()]
+                if plan["provider"] == "claude":
+                    records[-1]["message"]["content"] = "Different user input"
+                else:
+                    records[-1]["payload"]["message"] = "Different user input"
+                history.write_text(fixtures.jl(records))
+                runner.at(runner.now() + 0.2, lambda: replacement.replace(history))
+                self.assertIsNone(receipt.confirm_cross(watcher, TOKEN, plan))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_autoresume_cross_tmux.py

@@ -0,0 +1,140 @@
+"""Cross-provider acceptance through actual tmux, shells, production shims and watchers."""
+
+import re
+import signal
+import time
+import unittest
+
+from autoresume_cross_tmux_support import CrossScenario, TMUX
+
+
+@unittest.skipUnless(TMUX, "real tmux is unavailable")
+class CrossProviderTmuxTests(unittest.TestCase):
+    def scenario(self, provider="codex", args=None, **environment):
+        case = CrossScenario(**environment)
+        self.addCleanup(case.close)
+        case.start(provider, args)
+        return case
+
+    def assert_handoff(self, case, source, target):
+        case.wait(lambda: len(case.records("ready")) >= 2, "target TUI ready")
+        case.wait(lambda: "autoresume switch" in case.logs(source), "source confirms target prompt")
+        first, second = case.records("launch")[:2]
+        prompt = case.records("prompt")[0]
+        self.assertEqual((first["provider"], second["provider"]), (source, target))
+        self.assertEqual((first["account"], second["account"]), ("acct-01", "acct-01"))
+        self.assertNotEqual(first["sid"], second["sid"])
+        self.assertEqual(first["cwd"], second["cwd"])
+        self.assertEqual(prompt["provider"], target)
+        self.assertIn(source, prompt["text"])
+        self.assertIn(first["sid"], prompt["text"])
+        self.assertIn(case.records("ready")[0]["path"], prompt["text"])
+        self.assertIn(str(case.work), prompt["text"])
+        self.assertIn("history", prompt["text"].lower())
+        self.assertIn("continu", prompt["text"].lower())
+        self.assertNotIn("--resume", second["argv"])
+        self.assertNotIn("resume", second["argv"][:-1])
+        self.assertEqual(case.records("keys"), [], "no keystroke may reach a TUI")
+        self.assertEqual(case.records("signal")[0]["signal"], signal.SIGTERM)
+        self.assertEqual(list(case.home.glob("*-pool/tmp/autoresume/r-*")), [])
+        return first, second
+
+    def test_codex_pool_exhausted_continues_in_claude_with_source_identity(self):
+        case = self.scenario()
+        case.park("codex")
+        case.quota()
+        self.assert_handoff(case, "codex", "claude")
+
+    def test_claude_pool_exhausted_continues_in_codex_with_source_identity(self):
+        case = self.scenario("claude")
+        case.park("claude")
+        case.quota()
+        self.assert_handoff(case, "claude", "codex")
+        self.assertIn("--no-daemon", case.records("launch")[1]["argv"])
+
+    def test_same_provider_has_priority_in_both_directions(self):
+        for provider in ("codex", "claude"):
+            with self.subTest(provider=provider):
+                case = self.scenario(provider)
+                case.quota()
+                case.wait(lambda: len(case.records("ready")) == 2, "same provider TUI ready")
+                case.wait(lambda: "autoresume switch" in case.logs(provider), "same provider confirmed")
+                first, second = case.records("launch")
+                self.assertEqual([first["provider"], second["provider"]], [provider, provider])
+                self.assertEqual((first["account"], second["account"]), ("acct-01", "acct-02"))
+                self.assertEqual(first["sid"], second["sid"])
+                self.assertEqual(case.records("keys"), [])
+                case.close()
+
+    def test_both_pools_unavailable_hold_then_recover_without_touching_tui(self):
+        case = self.scenario()
+        case.park("codex")
+        case.park("claude", ("acct-01", "acct-02"))
+        case.quota()
+        case.wait(lambda: "autoresume hold" in case.logs("codex"), "both pools unavailable")
+        time.sleep(0.7)
+        self.assertEqual((case.records("signal"), case.records("keys")), ([], []))
+        self.assertEqual(len(case.records("launch")), 1)
+        (case.pools["claude"] / "acct-01/.limited").unlink()
+        self.assert_handoff(case, "codex", "claude")
+
+    def test_unpersisted_target_prompt_never_logs_success(self):
+        case = self.scenario(FAKE_DROP_PROMPT="claude")
+        case.park("codex")
+        case.quota()
+        case.wait(lambda: len(case.records("ready")) == 2, "target starts without a prompt receipt")
+        case.wait(lambda: "autoresume giveup" in case.logs("codex"), "missing target receipt refused")
+        self.assertNotIn("autoresume switch", case.logs())
+        self.assertEqual(case.records("prompt"), [])
+        time.sleep(0.5)
+        self.assertEqual(len(case.records("launch")), 2, "failed receipt must not loop")
+
+    def test_target_kill_switch_holds_source(self):
+        case = self.scenario()
+        case.park("codex")
+        (case.pools["claude"] / "autoresume.off").touch()
+        case.quota()
+        case.wait(lambda: "autoresume hold" in case.logs("codex"), "target pool disabled")
+        self.assertEqual((case.records("signal"), case.records("keys")), ([], []))
+        self.assertEqual(len(case.records("launch")), 1)
+
+    def test_conservative_permissions_survive_handoff_in_both_directions(self):
+        for source, target in (("codex", "claude"), ("claude", "codex")):
+            with self.subTest(source=source):
+                case = self.scenario(source, args=[])
+                case.park(source)
+                case.quota()
+                _first, second = self.assert_handoff(case, source, target)
+                if target == "claude":
+                    self.assertEqual(second["argv"][:2], ["--permission-mode", "default"])
+                else:
+                    self.assertIn("--sandbox", second["argv"])
+                    self.assertIn("read-only", second["argv"])
+                    self.assertIn("--ask-for-approval", second["argv"])
+                    self.assertIn("on-request", second["argv"])
+                self.assertFalse(any("dangerously" in arg or arg == "--yolo" for arg in second["argv"][:-1]))
+                case.close()
+
+    def test_provider_namespaces_preserve_chain_and_avoid_rejected_account_on_return(self):
+        case = self.scenario()
+        case.park("codex")
+        case.quota()
+        first, _second = self.assert_handoff(case, "codex", "claude")
+        for marker in case.pools["codex"].glob("acct-*/.limited"):
+            marker.unlink()
+        case.park("claude")
+        case.quota()
+        case.wait(lambda: len(case.records("ready")) == 3, "chain returns to recovered Codex pool")
+        case.wait(lambda: "autoresume switch" in case.logs("claude"), "return prompt confirmed")
+        third = case.records("launch")[2]
+        self.assertEqual((third["provider"], third["account"]), ("codex", "acct-02"))
+        self.assertNotEqual(third["sid"], first["sid"])
+        chains = re.findall(r"autoresume watch provider=\w+ chain=(\w+)", case.logs())
+        self.assertEqual(len(chains), 3)
+        self.assertEqual(len(set(chains)), 1)
+        self.assertIn("depth=2", case.logs("codex"))
+        self.assertEqual(case.records("keys"), [])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_autoresume_cross_tmux_races.py

@@ -0,0 +1,45 @@
+"""Real provider selection races after the source has been checked and stopped."""
+
+import time
+import unittest
+
+from autoresume_cross_tmux_support import CrossScenario, TMUX
+
+
+@unittest.skipUnless(TMUX, "real tmux is unavailable")
+class CrossProviderRaceTmuxTests(unittest.TestCase):
+    def test_historical_target_prompt_is_not_a_new_handoff_receipt(self):
+        for source, target in (("codex", "claude"), ("claude", "codex")):
+            with self.subTest(source=source):
+                case = CrossScenario(FAKE_OLD_PROMPT=target)
+                self.addCleanup(case.close)
+                case.start(source)
+                case.park(source)
+                case.quota()
+                case.wait(lambda: len(case.records("ready")) == 2, "target TUI has a historical prompt")
+                case.wait(lambda: "autoresume giveup" in case.logs(source), "historical receipt refused")
+                self.assertEqual(len(case.records("prompt")), 1)
+                self.assertNotIn("autoresume switch", case.logs())
+                self.assertEqual(case.records("keys"), [])
+                case.close()
+
+    def test_target_capacity_lost_after_probe_never_launches_hard_fallback_or_claims_success(self):
+        for source, target in (("codex", "claude"), ("claude", "codex")):
+            with self.subTest(source=source):
+                case = CrossScenario(FAKE_PARK_TARGET_ON_TERM=target)
+                self.addCleanup(case.close)
+                case.start(source)
+                case.park(source)
+                case.quota()
+                case.wait(lambda: "autoresume giveup" in case.logs(source), "lost target capacity refused")
+                self.assertEqual(len(case.records("signal")), 1, "race occurs after the valid initial probe")
+                self.assertEqual(len(case.records("launch")), 1, "hard-fallback target must not launch")
+                self.assertNotIn("autoresume switch", case.logs())
+                self.assertEqual(case.records("keys"), [])
+                time.sleep(0.4)
+                self.assertEqual(len(case.records("launch")), 1, "the failed launch must not retry in a loop")
+                case.close()
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_autoresume_cross_tokens.py

@@ -0,0 +1,102 @@
+"""Prepared cross-provider tokens preserve chain state and cannot mark or resume the wrong pool."""
+
+import json
+import os
+from pathlib import Path
+import unittest
+from unittest import mock
+
+import test_autoresume as fixtures
+from autoresume_cross_receipt_support import TOKEN
+from autoresume_cross_unit_support import scenario
+import autoresume_cross as cross
+import autoresume_cross_dispatch as dispatch
+
+
+class CrossProviderTokenTests(unittest.TestCase):
+    def prepared(self, provider):
+        case, watcher, runner, _, root = scenario(self, provider)
+        target = "codex" if provider == "claude" else "claude"
+        watcher.st["depth"] = 3
+        watcher.st["avoid_" + target] = "acct-02:%d" % (case.t0 + 3600)
+        avoid = "acct-01:%d" % (case.t0 + 7200)
+        plan = cross.plan_fallback(watcher, watcher.tracker.pending, avoid)
+        self.assertIsNotNone(plan)
+        plan["shim"] = str(fixtures.REPO / "bin" / target)
+        watcher.cross_plan = plan
+        keys, paths = cross.prepare(watcher, watcher.tracker.pending, avoid, TOKEN,
+                                    watcher.build_relaunch_argv("quota"))
+        return case, watcher, runner, plan, keys, paths
+
+    def test_only_source_token_names_the_exhausted_account_and_target_is_fresh(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                case, watcher, runner, plan, keys, paths = self.prepared(provider)
+                source = case.ar_dir / ("r-" + TOKEN + ".relaunch")
+                target = Path(plan["root"]) / "tmp/autoresume" / source.name
+                old = fixtures.ar.parse_kv(source.read_text(), fixtures.ar.RELAUNCH_KEYS)
+                new = fixtures.ar.parse_kv(target.read_text(), fixtures.ar.RELAUNCH_KEYS)
+                self.assertEqual((old["provider"], old["acct"], old["cross"]), (provider, "acct-01", TOKEN))
+                self.assertEqual((new["provider"], new["acct"], new["cross"], new["handoff_token"]),
+                                 (plan["provider"], "", "", TOKEN))
+                self.assertEqual((new["chain"], old["chain"], new["depth"], old["depth"]),
+                                 (watcher.chain, watcher.chain, "4", "4"))
+                self.assertEqual(new["hist"], old["hist"])
+                self.assertEqual(new["avoid"], watcher.st["avoid_" + plan["provider"]])
+                argv = fixtures.ar.decode_argv(target.with_suffix(".argv").read_bytes())
+                self.assertEqual(argv, plan["argv"])
+                self.assertFalse({"--resume", "resume", watcher.sid} & set(argv[:-1]))
+                self.assertEqual(runner.signals, [])
+                self.assertTrue(all(Path(path).stat().st_mode & 0o077 == 0 for path in paths))
+                typed = next(key[-1] for key in keys if "-l" in key)
+                self.assertIn(watcher.st["self"], typed)
+                self.assertNotIn(plan["argv"][-1], typed)
+
+    def test_dispatch_payload_is_exact_installation_metadata_without_auth_or_prompt(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                case, watcher, _, plan, _, _ = self.prepared(provider)
+                path, payload = dispatch.read_dispatch(str(case.root), TOKEN)
+                self.assertEqual(payload["target_shim"], str(fixtures.REPO / "bin" / plan["provider"]))
+                self.assertEqual(payload["source_root"], str(case.root))
+                self.assertEqual(payload["sid"], watcher.sid)
+                self.assertNotIn(plan["argv"][-1], Path(path).read_text())
+                self.assertFalse({"OPENAI_API_KEY", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"}
+                                 & set(payload["settings"]))
+
+    def test_destination_dispatch_is_single_use_even_when_exec_fails(self):
+        case, watcher, _, plan, _, _ = self.prepared("codex")
+        env = {"HOME": str(case.tmp), "PATH": "/usr/bin:/bin"}
+        with mock.patch.dict(os.environ, env, clear=True), mock.patch.object(dispatch.os, "chdir"), \
+                mock.patch.object(dispatch.os, "execve", side_effect=OSError("simulated exec failure")) as execute:
+            with self.assertRaises(OSError):
+                dispatch.dispatch(str(case.root), TOKEN)
+            with self.assertRaises((OSError, ValueError)):
+                dispatch.dispatch(str(case.root), TOKEN)
+        self.assertEqual(execute.call_count, 1)
+        self.assertEqual(execute.call_args.args[1], [plan["shim"]])
+        self.assertEqual(execute.call_args.args[2]["CLAUDE_MULTIACC_AR"], TOKEN + ":" + watcher.sid)
+
+    def test_wrong_installation_or_expired_payload_cannot_dispatch(self):
+        for invalid in ("target", "expired", "permissions", "symlink"):
+            with self.subTest(invalid=invalid):
+                case, _, _, _, _, _ = self.prepared("claude")
+                path = case.ar_dir / ("r-" + TOKEN + ".cross.json")
+                if invalid == "target":
+                    payload = json.loads(path.read_text())
+                    payload["target_shim"] = "/tmp/unrelated/codex"
+                    path.write_text(json.dumps(payload))
+                elif invalid == "expired":
+                    os.utime(path, (0, 0))
+                elif invalid == "permissions":
+                    path.chmod(0o644)
+                else:
+                    destination = path.with_suffix(".backup")
+                    path.rename(destination)
+                    path.symlink_to(destination)
+                with self.assertRaises((OSError, ValueError)):
+                    dispatch.read_dispatch(str(case.root), TOKEN)
+
+
+if __name__ == "__main__":
+    unittest.main()