claude-multiacc 2.0.56 → 2.0.57

package/tests/autoresume_cross_unit_support.py

@@ -0,0 +1,92 @@
+"""Disposable dual-provider pools and simulated processes for cross-provider policy tests."""
+
+import json
+from pathlib import Path
+
+import test_autoresume as fixtures
+
+
+class DualRunner(fixtures.FakeRunner):
+    def __init__(self, case, target):
+        super().__init__(case.t0, case.PID, case.PPID, case.self_path)
+        self.ar_dir = case.ar_dir
+        self.target = target
+        self.probe_out = "pick=acct-02 tier=hard\n"
+        self.target_out = "pick=acct-01 tier=eligible\n"
+        self.source_hook = None
+        self.target_hook = None
+
+    def run(self, argv, timeout, env=None, cwd=None):
+        if argv[0] == self.self_path and self.source_hook:
+            callback, self.source_hook = self.source_hook, None
+            callback()
+        if argv[0] == self.target:
+            self.calls.append({"argv": list(argv), "env": env, "cwd": cwd, "t": self.t})
+            if self.target_hook:
+                callback, self.target_hook = self.target_hook, None
+                callback()
+            return (3 if "tier=none" in self.target_out else 0), self.target_out
+        return super().run(argv, timeout, env=env, cwd=cwd)
+
+    @property
+    def target_probes(self):
+        return [call for call in self.calls if call["argv"][0] == self.target]
+
+
+def source_history(case, provider, error_class):
+    reset = int(case.t0) + 7200
+    if provider == "claude":
+        case.registry()
+        record = fixtures.cc_quota(case.t0, resets=reset, cwd=str(case.work))
+        if error_class != "quota":
+            codes = {"auth": "authentication_failed", "blocked": "account_on_hold",
+                     "transient": "server_error", "model": "model_requires_usage_credits"}
+            record = fixtures.cc_api_error(case.t0, codes[error_class], cwd=str(case.work))
+            if error_class == "model":
+                record.update(error="rate_limit", apiError="model_requires_usage_credits")
+        return case.transcript([record])
+    code = {"quota": "usage_limit_exceeded", "auth": "unauthorized", "transient": "internal_server_error"}
+    return case.rollout([fixtures.cx_meta(case.launched, cwd=str(case.work)),
+                         fixtures.cx_tokens(case.t0, primary={"used_percent": 100,
+                             "window_minutes": 300, "resets_at": reset}),
+                         fixtures.cx_error(case.t0, code[error_class])])
+
+
+def scenario(test, provider, argv=None, error_class="quota", environment=None):
+    case = fixtures.PoolCase() if provider == "claude" else fixtures.CodexWatcherTests()
+    case.setUp()
+    test.addCleanup(case.tearDown)
+    target = "codex" if provider == "claude" else "claude"
+    sibling = case.tmp / "bin" / target
+    sibling.parent.mkdir(exist_ok=True)
+    sibling.write_text("#!/bin/sh\nexit 3\n")
+    sibling.chmod(0o700)
+    Path(case.self_path).write_text("#!/bin/sh\nexit 3\n")
+    Path(case.self_path).chmod(0o700)
+    target_root = case.tmp / (target + "-pool")
+    target_root.mkdir()
+    (target_root / "acct-01").mkdir()
+    manifest = json.dumps({"accounts": ["acct-01", "acct-02"], "threshold": 90})
+    (target_root / "accounts.json").write_text(manifest)
+    (case.root / "accounts.json").write_text(manifest)
+    default = ["--dangerously-skip-permissions"] if provider == "claude" else ["--yolo", "resume", fixtures.CX_SID]
+    state = case.write_state(default if argv is None else argv, provider=provider)
+    history = source_history(case, provider, error_class)
+    runner = DualRunner(case, str(sibling))
+    env = {"HOME": str(case.tmp), "PATH": str(sibling.parent) + ":/usr/bin:/bin",
+           provider.upper() + "_ACCOUNTS_ROOT": str(case.root),
+           target.upper() + "_ACCOUNTS_ROOT": str(target_root)}
+    env.update(environment or {})
+    watcher = fixtures.ar.Watcher(state, fixtures.ar.load_state(state),
+                                 fixtures.ar.load_argv(fixtures.ar.argv_path_for(state)), runner=runner, environ=env)
+    watcher.started = runner.now()
+    watcher.lstart = fixtures.LSTART
+    watcher.read()
+    runner.at(case.t0 + 15, lambda: runner.exit(case.PID))
+    return case, watcher, runner, history, target_root
+
+
+def cancel_record(case, provider):
+    return fixtures.cc_user(case.t0 + 5, "I will continue manually", cwd=str(case.work)) \
+        if provider == "claude" else fixtures.cx_event(case.t0 + 5,
+            {"type": "user_message", "message": "I will continue manually"})

package/tests/fixtures/cross_provider_cli.py

@@ -0,0 +1,121 @@
+"""Disposable native-CLI stand-in for the real tmux cross-provider acceptance tests."""
+
+import json
+import os
+from pathlib import Path
+import select
+import signal
+import sys
+import termios
+import time
+import tty
+import uuid
+
+PROVIDER = Path(sys.argv[0]).name
+HOME = Path(os.environ["FAKE_HOME"])
+SIDS = {"codex": "01a0cb0f-a719-7461-bba6-a59bdf2412cc", "claude": "f8470bf4-f810-4492-b564-1712a7c4930e"}
+
+
+def record(kind, **fields):
+    with (HOME / "provider.jsonl").open("a") as target:
+        target.write(json.dumps(dict(kind=kind, provider=PROVIDER, pid=os.getpid(), **fields)) + "\n")
+
+
+def stop(signum, _frame):
+    record("signal", signal=signum)
+    target = os.environ.get("FAKE_PARK_TARGET_ON_TERM")
+    if signum == signal.SIGTERM and target in SIDS and target != PROVIDER:
+        for account in (HOME / (target + "-pool")).glob("acct-*"):
+            (account / ".limited").write_text(
+                f"{int(time.time()) + 3600}\nbucket=error-cooldown reason=error-cooldown\n")
+    raise SystemExit(0)
+
+
+def timestamp():
+    return time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+
+
+def session_identity():
+    arguments = sys.argv[1:]
+    for flag in ("--session-id", "--resume", "-r"):
+        if flag in arguments:
+            return arguments[arguments.index(flag) + 1]
+    if "resume" in arguments:
+        return next((arg for arg in arguments if len(arg) == 36 and arg.count("-") == 4), SIDS[PROVIDER])
+    records = HOME / "provider.jsonl"
+    if records.exists() and any(json.loads(line).get("provider") == PROVIDER
+                                for line in records.read_text().splitlines()):
+        return str(uuid.uuid4())
+    return SIDS[PROVIDER]
+
+
+def user_record(sid, prompt):
+    if PROVIDER == "codex":
+        return {"timestamp": timestamp(), "type": "response_item", "payload": {
+            "type": "message", "role": "user", "content": [{"type": "input_text", "text": prompt}]}}
+    return {"timestamp": timestamp(), "type": "user", "sessionId": sid, "cwd": os.getcwd(),
+            "isSidechain": False, "uuid": "585fd5be-e0df-4cb3-ae28-672ba54550a3",
+            "message": {"role": "user", "content": prompt}}
+
+
+def initialize_history(account, sid):
+    if PROVIDER == "codex":
+        directory = account / "sessions/2026/10/11"
+        path = directory / ("rollout-test-" + sid + ".jsonl")
+    else:
+        directory = account / "projects" / os.getcwd().replace("/", "-")
+        path = directory / (sid + ".jsonl")
+        registry = account / "sessions" / (str(os.getpid()) + ".json")
+        registry.parent.mkdir(exist_ok=True)
+        registry.write_text(json.dumps({"pid": os.getpid(), "sessionId": sid, "cwd": os.getcwd(),
+            "startedAt": int(time.time() * 1000), "kind": "interactive", "entrypoint": "cli"}))
+    directory.mkdir(parents=True, exist_ok=True)
+    history = path.open("a+")
+    if history.tell() == 0:
+        if PROVIDER == "codex":
+            history.write(json.dumps({"timestamp": timestamp(), "type": "session_meta", "payload": {
+                "id": sid, "session_id": sid, "timestamp": timestamp(),
+                "cwd": os.getcwd(), "source": "cli"}}) + "\n")
+        history.write(json.dumps(user_record(sid, "Complete the synthetic acceptance task.")) + "\n")
+    prompt = sys.argv[-1] if len(sys.argv) > 1 and " " in sys.argv[-1] else ""
+    if prompt and os.environ.get("FAKE_DROP_PROMPT") != PROVIDER:
+        user = user_record(sid, prompt)
+        if os.environ.get("FAKE_OLD_PROMPT") == PROVIDER:
+            user["timestamp"] = "2000-01-01T00:00:00Z"
+        history.write(json.dumps(user) + "\n")
+        record("prompt", text=prompt, sid=sid, path=str(path.resolve()))
+    history.flush()
+    return history
+
+
+def main():
+    if sys.argv[1:] == ["--help"]:
+        print("Usage: " + PROVIDER + " [OPTIONS]\n  --no-daemon  Run locally\n  --session-id UUID")
+        return
+    if sys.argv[1:] == ["--version"]:
+        print(PROVIDER + " test")
+        return
+    account = Path(os.environ["CODEX_HOME" if PROVIDER == "codex" else "CLAUDE_CONFIG_DIR"])
+    sid = session_identity()
+    record("launch", argv=sys.argv[1:], cwd=os.getcwd(), account=account.name, sid=sid)
+    settings = termios.tcgetattr(0)
+    signal.signal(signal.SIGTERM, stop)
+    signal.signal(signal.SIGHUP, stop)
+    history = initialize_history(account, sid)
+    try:
+        tty.setraw(0)
+        record("ready", sid=sid, path=str(Path(history.name).resolve()))
+        print("FAKE " + PROVIDER.upper() + " READY", flush=True)
+        while True:
+            if select.select([0], [], [], 0.1)[0]:
+                data = os.read(0, 4096)
+                if not data:
+                    return
+                record("keys", data=data.hex())
+    finally:
+        history.close()
+        termios.tcsetattr(0, termios.TCSANOW, settings)
+
+
+if __name__ == "__main__":
+    main()

package/tests/test_autoresume.py

@@ -1927,9 +1927,11 @@ class ClaudeWatcherTests(PoolCase):
         self.registry()
         self.transcript([cc_quota(self.t0, resets=int(self.t0) + 999)])
         other = self.root / "acct-02" / "sessions" / "6060.json"
-        other.write_text(json.dumps({"pid": 6060, "sessionId": SID, "cwd": str(self.work)}))
+        other.write_text(json.dumps({"pid": 6060, "sessionId": SID, "cwd": str(self.work),
+                                     "startedAt": self.launched * 1000 + 700}))
         w, r = self.watcher(state)
         r.live.add(6060)
+        r.starts[6060] = time.strftime("%a %b %d %H:%M:%S %Y", time.localtime(self.launched))
         self.assertEqual(w.run(), 0)
         self.assertEqual((r.signals, r.sends, self.relaunch_files()), ([], [], []))
         self.assertIn("reason=holder", self.log_lines()[-1])

package/tests/test_autoresume_cross_claude_holders.py

@@ -0,0 +1,81 @@
+"""Claude registry files must identify a current live holder before preventing a handoff."""
+
+import json
+import time
+import unittest
+
+from autoresume_cross_unit_support import scenario
+import autoresume_cross as cross
+
+
+class ClaudeHolderIdentityTests(unittest.TestCase):
+    def holder(self, case, watcher, runner):
+        pid = 6060
+        path = case.root / "acct-02" / "sessions" / (str(pid) + ".json")
+        record = {"pid": pid, "sessionId": watcher.sid, "cwd": str(case.work),
+                  "startedAt": case.launched * 1000 + 700}
+        path.write_text(json.dumps(record))
+        runner.live.add(pid)
+        runner.starts[pid] = time.strftime("%a %b %d %H:%M:%S %Y", time.localtime(case.launched))
+        return pid, path, record
+
+    def test_genuine_live_holder_blocks_both_same_and_cross_provider_relaunch(self):
+        case, watcher, runner, _, _ = scenario(self, "claude")
+        pid, _, _ = self.holder(case, watcher, runner)
+        self.assertEqual(watcher.other_holder(), pid)
+        self.assertEqual(cross.shared_source(watcher), pid)
+        self.assertIsNone(cross.plan_fallback(watcher, watcher.tracker.pending, ""))
+        self.assertEqual((runner.target_probes, runner.signals, runner.sends), ([], [], []))
+
+    def test_dead_zombie_or_reused_pid_does_not_hold_the_source(self):
+        for stale in ("dead", "zombie", "reused", "invalid-process-start"):
+            with self.subTest(stale=stale):
+                case, watcher, runner, _, _ = scenario(self, "claude")
+                pid, _, _ = self.holder(case, watcher, runner)
+                if stale == "dead":
+                    runner.exit(pid)
+                elif stale == "zombie":
+                    runner.gone = lambda candidate: candidate == pid or candidate not in runner.live
+                else:
+                    runner.starts[pid] = "invalid start" if stale == "invalid-process-start" else time.strftime(
+                        "%a %b %d %H:%M:%S %Y", time.localtime(case.launched + 120))
+                self.assertIsNone(watcher.other_holder())
+                self.assertIsNotNone(cross.plan_fallback(watcher, watcher.tracker.pending, ""))
+
+    def test_malformed_registry_identity_cannot_claim_a_matching_live_pid(self):
+        invalid = (("pid", "6060"), ("pid", 7070), ("pid", None), ("startedAt", None),
+                   ("startedAt", True), ("startedAt", "123"), ("startedAt", float("nan")),
+                   ("startedAt", float("inf")), ("startedAt", 10 ** 1000))
+        for key, value in invalid:
+            with self.subTest(key=key, value=str(value)[:20]):
+                case, watcher, runner, _, _ = scenario(self, "claude")
+                _, path, record = self.holder(case, watcher, runner)
+                record[key] = value
+                path.write_text(json.dumps(record))
+                self.assertIsNone(watcher.other_holder())
+                self.assertIsNotNone(cross.plan_fallback(watcher, watcher.tracker.pending, ""))
+
+    def test_registry_of_another_session_or_invalid_document_does_not_hold(self):
+        for malformed in ("another-session", "list", "invalid-json", "future-start"):
+            with self.subTest(malformed=malformed):
+                case, watcher, runner, _, _ = scenario(self, "claude")
+                _, path, record = self.holder(case, watcher, runner)
+                if malformed == "another-session":
+                    record["sessionId"] = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa"
+                elif malformed == "future-start":
+                    record["startedAt"] = (runner.now() + 120) * 1000
+                path.write_text("[1]" if malformed == "list" else "{" if malformed == "invalid-json"
+                                else json.dumps(record))
+                self.assertIsNone(watcher.other_holder())
+                self.assertIsNotNone(cross.plan_fallback(watcher, watcher.tracker.pending, ""))
+
+    def test_new_holder_after_target_probe_invalidates_the_plan(self):
+        case, watcher, runner, _, _ = scenario(self, "claude")
+        plan = cross.plan_fallback(watcher, watcher.tracker.pending, "")
+        self.assertIsNotNone(plan)
+        self.holder(case, watcher, runner)
+        self.assertFalse(cross.revalidate(watcher, plan))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_autoresume_cross_guards.py

@@ -0,0 +1,133 @@
+"""Fallback opt-outs, pool boundaries and probe-time changes remain fail-closed."""
+
+from pathlib import Path
+import unittest
+from unittest import mock
+
+from autoresume_cross_receipt_support import TOKEN
+from autoresume_cross_unit_support import scenario
+import autoresume as ar
+import autoresume_cross as cross
+from autoresume_probe import cross_env, handoff_settings
+
+
+class CrossProviderGuardsTests(unittest.TestCase):
+    def test_preparation_write_failure_removes_only_its_own_artifacts(self):
+        for provider in ("claude", "codex"):
+            for failed_write in range(1, 6):
+                with self.subTest(provider=provider, failed_write=failed_write):
+                    case, watcher, runner, _, root = scenario(self, provider)
+                    watcher.cross_plan = cross.plan_fallback(watcher, watcher.tracker.pending, "")
+                    unrelated = case.ar_dir / "r-unrelated.relaunch"
+                    unrelated.write_text("preserve another chain\n")
+                    original, writes = ar._atomic_write, []
+                    def fail_write(path, data):
+                        writes.append(path)
+                        if len(writes) == failed_write:
+                            raise OSError("simulated preparation write failure")
+                        return original(path, data)
+                    with mock.patch.object(ar, "_atomic_write", side_effect=fail_write):
+                        with self.assertRaises(OSError):
+                            cross.prepare(watcher, watcher.tracker.pending, "", TOKEN,
+                                          watcher.build_relaunch_argv("quota"))
+                    self.assertEqual(list(case.ar_dir.glob("r-" + TOKEN + ".*")), [])
+                    self.assertEqual(list((root / "tmp/autoresume").glob("r-" + TOKEN + ".*")), [])
+                    self.assertEqual(unrelated.read_text(), "preserve another chain\n")
+                    self.assertEqual((runner.signals, runner.sends), ([], []))
+
+    def test_source_cross_provider_opt_out_does_not_probe_the_target(self):
+        for provider in ("claude", "codex"):
+            for disabled in ("0", "false", "no", "off"):
+                with self.subTest(provider=provider, disabled=disabled):
+                    _, watcher, runner, _, _ = scenario(self, provider,
+                        environment={provider.upper() + "_MULTIACC_CROSS_PROVIDER": disabled})
+                    self.assertIsNone(cross.plan_fallback(watcher, watcher.tracker.pending, ""))
+                    self.assertEqual((runner.target_probes, runner.signals), ([], []))
+
+    def test_either_provider_disable_or_pool_kill_switch_prevents_a_handoff(self):
+        for provider in ("claude", "codex"):
+            for stopped in ("claude", "codex"):
+                for mode in ("environment", "disable", "file"):
+                    with self.subTest(provider=provider, stopped=stopped, mode=mode):
+                        _, watcher, runner, _, _ = scenario(self, provider)
+                        if mode == "file":
+                            (Path(cross.pool_roots(watcher)[stopped]) / "autoresume.off").touch()
+                        else:
+                            suffix = "AUTORESUME" if mode == "environment" else "DISABLE"
+                            watcher.env[stopped.upper() + "_MULTIACC_" + suffix] = "0" if mode == "environment" else "1"
+                        self.assertIsNone(cross.plan_fallback(watcher, watcher.tracker.pending, ""))
+                        self.assertEqual((runner.target_probes, runner.signals), ([], []))
+
+    def test_missing_target_pool_or_executable_holds_without_stopping(self):
+        for provider in ("claude", "codex"):
+            for missing in ("pool", "shim", "executable", "same-root", "alias-root"):
+                with self.subTest(provider=provider, missing=missing):
+                    _, watcher, runner, _, root = scenario(self, provider)
+                    if missing == "pool":
+                        (root / "accounts.json").unlink()
+                    elif missing == "shim":
+                        Path(runner.target).unlink()
+                    elif missing == "executable":
+                        Path(runner.target).chmod(0o600)
+                    else:
+                        target = "codex" if provider == "claude" else "claude"
+                        shared = Path(watcher.st["acc_root"])
+                        if missing == "alias-root":
+                            alias = root.parent / "alias-root"
+                            alias.symlink_to(shared, target_is_directory=True)
+                            shared = alias
+                        watcher.env[target.upper() + "_ACCOUNTS_ROOT"] = str(shared)
+                    self.assertIsNone(cross.plan_fallback(watcher, watcher.tracker.pending, ""))
+                    self.assertEqual((runner.target_probes, runner.signals), ([], []))
+
+    def test_restrictive_permissions_hold_before_probing(self):
+        for mode in ("plan", "acceptEdits", "dontAsk", "auto"):
+            with self.subTest(mode=mode):
+                _, watcher, runner, _, _ = scenario(self, "claude", argv=["--permission-mode", mode])
+                self.assertIsNone(cross.plan_fallback(watcher, watcher.tracker.pending, ""))
+                self.assertEqual((runner.target_probes, runner.signals, runner.sends), ([], [], []))
+
+    def test_target_kill_switch_appearing_during_probe_prevents_source_signal(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                case, watcher, runner, _, root = scenario(self, provider)
+                runner.target_hook = lambda: (root / "autoresume.off").touch()
+                self.assertEqual(watcher.run(), 0)
+                self.assertEqual((runner.signals, runner.sends, case.relaunch_files()), ([], [], []))
+
+    def test_snapshot_truncation_with_same_inode_invalidates_a_prepared_plan(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                _, watcher, _, history, _ = scenario(self, provider)
+                with history.open("a") as target:
+                    target.write('{"type":"progress","data":"later source state"}\n')
+                plan = cross.plan_fallback(watcher, watcher.tracker.pending, "")
+                self.assertIsNotNone(plan)
+                inode = history.stat().st_ino
+                lines = history.read_bytes().splitlines(keepends=True)
+                history.write_bytes(b"".join(lines[:-1]))
+                self.assertEqual(history.stat().st_ino, inode)
+                self.assertFalse(cross.revalidate(watcher, plan))
+
+    def test_target_environment_cannot_inherit_source_auth_pins_or_relaunch_tokens(self):
+        roots = {"claude": "/tmp/fixture-claude", "codex": "/tmp/fixture-codex"}
+        private = {key: "TEST_ONLY_SENTINEL" for key in (
+            "CLAUDE_CONFIG_DIR", "CODEX_HOME", "CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY", "OPENAI_API_KEY",
+            "ANTHROPIC_AUTH_TOKEN",
+            "CLAUDE_ACCOUNT", "CODEX_ACCOUNT", "CLAUDE_SHIM_ACTIVE", "CODEX_SHIM_ACTIVE",
+            "CLAUDE_MULTIACC_AR", "CODEX_MULTIACC_AR", "CLAUDE_MULTIACC_AR_AVOID", "CODEX_MULTIACC_AR_AVOID")}
+        env = dict(private, HOME="/tmp/fixture-home", CLAUDE_MULTIACC_HEADROOM_BAND="17",
+                   CODEX_MULTIACC_CREDITS="1", CODEX_MULTIACC_AR_POLL="0.1")
+        cleaned = cross_env(env, roots)
+        self.assertFalse(set(private) & set(cleaned))
+        self.assertEqual(cleaned["CLAUDE_ACCOUNTS_ROOT"], roots["claude"])
+        self.assertEqual(cleaned["CODEX_ACCOUNTS_ROOT"], roots["codex"])
+        self.assertEqual(cleaned["CODEX_MULTIACC_CREDITS"], "1")
+        settings = handoff_settings(env, roots)
+        self.assertFalse(set(private) & set(settings))
+        self.assertNotIn("HOME", settings)
+        self.assertEqual(settings["CODEX_MULTIACC_AR_POLL"], "0.1")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_autoresume_cross_holders.py

@@ -0,0 +1,89 @@
+"""An exact live source holder blocks a fork; stale or unrelated claims do not."""
+
+from pathlib import Path
+import time
+import unittest
+
+import test_autoresume as fixtures
+from autoresume_cross_unit_support import scenario
+import autoresume_cross as cross
+
+
+class CrossProviderHolderTests(unittest.TestCase):
+    def holder(self, case, watcher, runner, history, pid=5454):
+        state = Path(case.write_state(["resume", fixtures.CX_SID], provider="codex", pid=pid))
+        claim = state.with_suffix(".rollout")
+        claim.write_text(str(history))
+        started = time.strftime("%a %b %d %H:%M:%S %Y", time.localtime(case.launched))
+        runner.live.add(pid)
+        runner.starts[pid] = started
+        runner.table.append((pid, case.PPID, started))
+        return state, claim, pid
+
+    def test_live_matching_codex_holder_prevents_a_new_provider_conversation(self):
+        case, watcher, runner, history, _ = scenario(self, "codex")
+        _, _, pid = self.holder(case, watcher, runner, history)
+        self.assertEqual(cross.shared_source(watcher), pid)
+        self.assertIsNone(cross.plan_fallback(watcher, watcher.tracker.pending, ""))
+        self.assertEqual((runner.target_probes, runner.signals), ([], []))
+
+    def test_dead_zombie_or_reused_pid_cannot_keep_a_stale_claim_alive(self):
+        for stale in ("dead", "zombie", "reused", "invalid-start"):
+            with self.subTest(stale=stale):
+                case, watcher, runner, history, _ = scenario(self, "codex")
+                _, _, pid = self.holder(case, watcher, runner, history)
+                if stale == "dead":
+                    runner.exit(pid)
+                elif stale == "zombie":
+                    runner.gone = lambda candidate: candidate == pid or candidate not in runner.live
+                else:
+                    started = "invalid process time" if stale == "invalid-start" else time.strftime(
+                        "%a %b %d %H:%M:%S %Y", time.localtime(case.launched + 120))
+                    runner.starts[pid] = started
+                    runner.table = [(pid, case.PPID, started)]
+                self.assertIsNone(cross.shared_source(watcher))
+                self.assertIsNotNone(cross.plan_fallback(watcher, watcher.tracker.pending, ""))
+
+    def test_claim_must_match_state_basename_provider_root_and_parent_identity(self):
+        for changed in ("pid", "provider", "acc_root", "ppid"):
+            with self.subTest(changed=changed):
+                case, watcher, runner, history, _ = scenario(self, "codex")
+                state, _, _ = self.holder(case, watcher, runner, history)
+                fields = dict(line.split("=", 1) for line in state.read_text().splitlines())
+                values = {"pid": "7878", "provider": "claude", "acc_root": str(case.tmp / "another-pool"),
+                          "ppid": "888"}
+                fields[changed] = values[changed]
+                state.write_text("".join(key + "=" + value + "\n" for key, value in fields.items()))
+                self.assertIsNone(cross.shared_source(watcher))
+                self.assertIsNotNone(cross.plan_fallback(watcher, watcher.tracker.pending, ""))
+
+    def test_malformed_state_and_missing_claim_target_do_not_crash_or_block(self):
+        for invalid in ("malformed-state", "missing-rollout"):
+            with self.subTest(invalid=invalid):
+                case, watcher, runner, history, _ = scenario(self, "codex")
+                state, claim, _ = self.holder(case, watcher, runner, history)
+                if invalid == "malformed-state":
+                    state.write_text("v=1\nprovider=codex\npid=not-a-pid\n")
+                else:
+                    claim.write_text(str(case.tmp / "absent-rollout.jsonl"))
+                self.assertIsNone(cross.shared_source(watcher))
+                self.assertIsNotNone(cross.plan_fallback(watcher, watcher.tracker.pending, ""))
+
+    def test_another_live_session_is_not_a_holder_of_this_source(self):
+        case, watcher, runner, _, _ = scenario(self, "codex")
+        unrelated = case.rollout([fixtures.cx_meta(case.launched, sid=fixtures.CX_SID2, cwd=str(case.work))],
+                                sid=fixtures.CX_SID2)
+        self.holder(case, watcher, runner, unrelated)
+        self.assertIsNone(cross.shared_source(watcher))
+        self.assertIsNotNone(cross.plan_fallback(watcher, watcher.tracker.pending, ""))
+
+    def test_new_holder_after_target_probe_invalidates_the_plan(self):
+        case, watcher, runner, history, _ = scenario(self, "codex")
+        plan = cross.plan_fallback(watcher, watcher.tracker.pending, "")
+        self.assertIsNotNone(plan)
+        self.holder(case, watcher, runner, history)
+        self.assertFalse(cross.revalidate(watcher, plan))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_autoresume_cross_policy.py

@@ -0,0 +1,123 @@
+"""Quota fallback keeps same-provider priority and never stops a client without a safe target."""
+
+import unittest
+from unittest import mock
+
+import test_autoresume as fixtures
+from autoresume_cross_unit_support import cancel_record, scenario
+import autoresume_cross as cross
+
+
+class CrossProviderPolicyTests(unittest.TestCase):
+    def test_unknown_or_inconsistent_source_capacity_never_probes_another_provider(self):
+        replies = ((127, ""), (124, "pick=acct-02 tier=hard"), (0, "malformed reply"),
+                   (3, "pick=acct-02 tier=hard"), (0, "pick= tier=none"),
+                   (3, "pick=acct-02 tier=none"), (0, "pick= tier=hard"),
+                   (0, "pick=acct-01 tier=eligible"), (1, "pick=acct-02 tier=eligible"))
+        for provider in ("claude", "codex"):
+            for status, reply in replies:
+                with self.subTest(provider=provider, status=status, reply=reply):
+                    case, watcher, runner, _, _ = scenario(self, provider)
+                    original = runner.run
+                    def source_failure(argv, timeout, env=None, cwd=None):
+                        if argv[0] == watcher.st["self"]:
+                            return status, reply + "\n"
+                        return original(argv, timeout, env=env, cwd=cwd)
+                    with mock.patch.object(runner, "run", side_effect=source_failure):
+                        self.assertEqual(watcher.run(), 0)
+                    self.assertEqual((runner.target_probes, runner.signals, runner.sends), ([], [], []))
+                    self.assertEqual(case.relaunch_files(), [])
+                    self.assertIn("hold", case.events())
+
+    def test_valid_empty_source_pool_probes_another_provider(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                _, watcher, runner, _, _ = scenario(self, provider)
+                runner.probe_out = "pick= tier=none\n"
+                runner.target_out = "pick= tier=none\n"
+                self.assertEqual(watcher.run(), 0)
+                self.assertTrue(runner.target_probes)
+                self.assertEqual((runner.signals, runner.sends), ([], []))
+
+    def test_same_provider_eligible_soft_or_configured_credits_wins_without_cross_probe(self):
+        for provider in ("claude", "codex"):
+            for tier in ("eligible", "soft", "credits"):
+                with self.subTest(provider=provider, tier=tier):
+                    case, watcher, runner, _, _ = scenario(self, provider)
+                    runner.probe_out = "pick=acct-02 tier=" + tier + "\n"
+                    if tier == "credits":
+                        watcher.env[provider.upper() + "_MULTIACC_CREDITS"] = "1"
+                    self.assertEqual(watcher.run(), 0)
+                    self.assertEqual(len(runner.probes), 1)
+                    self.assertEqual(runner.target_probes, [])
+                    self.assertEqual(len(runner.signals), 1)
+                    self.assertIn("switch", case.events())
+
+    def test_nonquota_errors_never_probe_the_other_provider(self):
+        cases = (("claude", "auth"), ("claude", "blocked"), ("claude", "model"),
+                 ("claude", "transient"), ("codex", "auth"), ("codex", "transient"))
+        for provider, error_class in cases:
+            with self.subTest(provider=provider, error_class=error_class):
+                case, watcher, runner, _, _ = scenario(self, provider, error_class=error_class)
+                self.assertIsNone(cross.plan_fallback(watcher, watcher.tracker.pending, ""))
+                self.assertEqual((runner.target_probes, runner.signals, runner.sends), ([], [], []))
+
+    def test_exhausted_or_missing_target_holds_the_source(self):
+        for provider in ("claude", "codex"):
+            for reply in ("pick=acct-01 tier=hard", "pick= tier=none", "malformed answer"):
+                with self.subTest(provider=provider, reply=reply):
+                    case, watcher, runner, _, _ = scenario(self, provider)
+                    runner.target_out = reply + "\n"
+                    self.assertEqual(watcher.run(), 0)
+                    self.assertTrue(runner.target_probes)
+                    self.assertEqual((runner.signals, runner.sends, case.relaunch_files()), ([], [], []))
+                    self.assertIn("hold", case.events())
+
+    def test_both_directions_accept_same_named_target_account_without_source_avoid_leak(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                case, watcher, runner, _, target_root = scenario(self, provider)
+                target = "codex" if provider == "claude" else "claude"
+                avoided = "acct-01:%d" % (case.t0 + 7200)
+                plan = cross.plan_fallback(watcher, watcher.tracker.pending, avoided)
+                self.assertIsNotNone(plan)
+                self.assertEqual((plan["provider"], plan["pick"], plan["root"]),
+                                 (target, "acct-01", str(target_root)))
+                self.assertEqual(runner.target_probes[-1]["env"][target.upper() + "_MULTIACC_AR_AVOID"], "")
+                fields = cross.chain_fields(watcher, avoided)
+                self.assertEqual((fields["avoid_" + provider], fields["avoid_" + target]), (avoided, ""))
+
+    def test_existing_target_avoidance_survives_independently(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                case, watcher, runner, _, _ = scenario(self, provider)
+                target = "codex" if provider == "claude" else "claude"
+                target_avoid = "acct-02:%d" % (case.t0 + 3600)
+                watcher.st["avoid_" + target] = target_avoid
+                plan = cross.plan_fallback(watcher, watcher.tracker.pending, "acct-01:%d" % (case.t0 + 7200))
+                self.assertIsNotNone(plan)
+                self.assertEqual(plan["avoid"], target_avoid)
+                self.assertEqual(runner.target_probes[-1]["env"][target.upper() + "_MULTIACC_AR_AVOID"], target_avoid)
+
+    def test_user_input_during_either_probe_cancels_before_any_signal(self):
+        for provider in ("claude", "codex"):
+            for stage in ("source", "target"):
+                with self.subTest(provider=provider, stage=stage):
+                    case, watcher, runner, history, _ = scenario(self, provider)
+                    setattr(runner, stage + "_hook", lambda: fixtures.append(history, [cancel_record(case, provider)]))
+                    self.assertEqual(watcher.run(), 0)
+                    self.assertIsNone(watcher.tracker.pending)
+                    self.assertEqual((runner.signals, runner.sends, case.relaunch_files()), ([], [], []))
+
+    def test_rotation_budget_cannot_be_bypassed_by_changing_provider(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                case, watcher, runner, _, _ = scenario(self, provider)
+                watcher.st["hist"] = ",".join("quota:%d" % (case.t0 - n) for n in range(8))
+                self.assertEqual(watcher.run(), 0)
+                self.assertEqual((runner.probes, runner.target_probes, runner.signals), ([], [], []))
+                self.assertIn("reason=rotate-budget", case.log_lines()[-1])
+
+
+if __name__ == "__main__":
+    unittest.main()