claude-multiacc 2.0.56 → 2.0.58

package/README.md

@@ -442,7 +442,9 @@ Interactive sessions are not retried this way. They get auto-resume, described n
 
 An interactive `claude` or `codex` session in **tmux** can stop on a usage limit, a failed
 login, an API error or (claude) a crash. It is then **resumed automatically, same session
-id**, on another pooled account with headroom. There is no `/exit`, no `--resume` and no
+id**, on another pooled account with headroom. If a usage limit exhausts that provider's
+usable accounts, it can continue in the other provider with instructions to read the
+original conversation's history. There is no `/exit`, no `--resume` and no
 "continue" to type. It covers the everyday launches:
 
 - `claude --dangerously-skip-permissions`, `--resume <id>` and `--model …`;
@@ -458,7 +460,8 @@ Every other launch, including `-p` and `codex exec`, runs exactly as before.
   it, so the client owns the task and rollout through account changes.
 - **Probe.** Once an error settles, the watcher asks the shim, in probe mode, whether
   another account has headroom, including the 90–99% fallback for quota errors. If none
-  does, it **holds** and Claude's own "continuing automatically at …" carries on.
+  does, a quota recovery checks the other provider's pool. If neither can serve, it
+  **holds** and Claude's own "continuing automatically at …" carries on.
 - **Relaunch.** Otherwise it stops the TUI with SIGTERM and waits for the pane's shell
   prompt. It then types a one-line relaunch of the shim into that **shell**. It never
   sends a keystroke to the TUI, whose limit menu can add funds or spend the one-shot
@@ -477,6 +480,8 @@ CLAUDE_MULTIACC_AUTORESUME=0 claude       # one launch (CODEX_MULTIACC_AUTORESUM
 ```
 
 See [auto-resume: error classes, gates, budgets, logs and limitations](docs/AUTORESUME.md).
+See [continuing between Codex and Claude](docs/AUTORESUME-HANDOFF.md) for history,
+permission handling and the cross-provider opt-out.
 
 ## MCP servers for every account
 

package/bin/claude

@@ -196,6 +196,10 @@ if [ -n "${CLAUDE_CONFIG_DIR:-}" ] || [ -n "${CLAUDE_CODE_OAUTH_TOKEN:-}" ] \
   # An auto-resume probe asks who WOULD be picked and must never start a client; a
   # passthrough has no pool pick to report (see ---- auto-resume ----).
   [ "${CLAUDE_MULTIACC_AR_PROBE:-}" = "1" ] && { printf 'pick= tier=none\n'; exit 3; }
+  if [ -n "${CLAUDE_MULTIACC_AR:-}${CLAUDE_MULTIACC_AR_CROSS_CARRY:-}" ]; then
+    printf 'claude-multiacc: auto-resume cannot enter account selection.\n' >&2
+    exit 2
+  fi
   mcp_nested_mirror "$@" || true
   exec "$REAL" "$@"
 fi
@@ -300,9 +304,9 @@ sel_log() {
 #     picked now?" — the real candidate loop, then `pick=<acct> tier=<t>` and exit, so the
 #     watcher only kills a session there is somewhere to move to.
 # Everything fails OPEN: a missing python, a non-tmux terminal or an argv this code does
-# not recognise all mean "exec exactly as before, unsupervised". The one exception is a
-# typed relaunch whose token is gone: it names the session to resume and exits 2, because
-# its own (empty) argv would start a fresh session in the stopped one's place.
+# not recognise all mean "exec exactly as before, unsupervised". A typed relaunch whose
+# token is gone exits 2 instead of starting a fresh session. A cross-provider handoff
+# also requires remaining quota, a startup receipt and successful watcher setup.
 # Tokens and relaunch/state files live in $ACC_ROOT/tmp/autoresume; the watcher prunes.
 AR_DIR="$ACC_ROOT/tmp/autoresume"
 AR_PROBE=0
@@ -311,6 +315,8 @@ AR_DEPTH=0        # relaunches so far in this chain (the watcher caps it)
 AR_AVOID=""       # acct-NN:<until epoch>,... — accounts this chain just left
 AR_HIST=""        # class:epoch,... — the watcher's hourly budgets
 AR_CHAIN=""       # opaque chain id, minted and read by the watcher
+AR_CROSS="" AR_HANDOFF_TOKEN=""
+AR_AVOID_CLAUDE="" AR_AVOID_CODEX="" AR_POOL_CLAUDE="" AR_POOL_CODEX=""
 AR_LOADED=0
 AR_ARGV=()
 AR_ORIG_ARGV=()
@@ -337,7 +343,7 @@ ar_field_ok() { # $1 value
 # later, by ar_relaunch_apply, still ahead of any selection.
 ar_relaunch_load() { # $1 token -> 0 with AR_ARGV and the AR_R_*/chain fields set
   local tok="$1" rf af line k v n=0 a="" ok=0 ver="" prov="" sid="" cwd=""
-  local cls="" acct="" reset="" rtype="" marked="" depth=0 avoid="" hist="" chain=""
+  local cls="" acct="" reset="" rtype="" marked="" depth=0 avoid="" hist="" chain="" cross_bad=0
   # Alphanumerics only: the token becomes part of a path, so no '/' and no '..'.
   case "$tok" in *[!A-Za-z0-9]*) return 1 ;; esac
   [ "${#tok}" -ge 8 ] && [ "${#tok}" -le 64 ] || return 1
@@ -362,6 +368,15 @@ ar_relaunch_load() { # $1 token -> 0 with AR_ARGV and the AR_R_*/chain fields se
         cwd) case "$v" in /*) cwd="$v" ;; esac ;;
         depth) num_ok "$v" && depth="$v" ;;
         avoid) ar_field_ok "$v" && avoid="$v" ;;
+        avoid_claude) ar_field_ok "$v" && AR_AVOID_CLAUDE="$v" || cross_bad=1 ;;
+        avoid_codex) ar_field_ok "$v" && AR_AVOID_CODEX="$v" || cross_bad=1 ;;
+        pool_claude) [ -z "$v" ] || { ar_path_ok "$v" && AR_POOL_CLAUDE="$v"; } || cross_bad=1 ;;
+        pool_codex) [ -z "$v" ] || { ar_path_ok "$v" && AR_POOL_CODEX="$v"; } || cross_bad=1 ;;
+        cross|handoff_token)
+          [ -n "$v" ] || continue
+          case "$v" in *[!A-Za-z0-9]*) cross_bad=1; continue ;; esac
+          [ "${#v}" -ge 8 ] && [ "${#v}" -le 64 ] || { cross_bad=1; continue; }
+          if [ "$k" = cross ]; then AR_CROSS="$v"; else AR_HANDOFF_TOKEN="$v"; fi ;;
         hist) ar_field_ok "$v" && hist="$v" ;;
         chain) ar_field_ok "$v" && [ "${#v}" -le 64 ] && chain="$v" ;;
       esac
@@ -380,6 +395,8 @@ ar_relaunch_load() { # $1 token -> 0 with AR_ARGV and the AR_R_*/chain fields se
   fi
   # Single use, whatever the outcome: a token is never honoured twice.
   rm -f "$rf" "$af" 2>/dev/null
+  [ "$cross_bad" = 0 ] || ok=0
+  [ -z "$AR_HANDOFF_TOKEN" ] || { [ -z "$acct" ] && [ -z "$AR_CROSS" ]; } || ok=0
   if [ "$ok" != 1 ]; then
     AR_ARGV=()
     AR_R_SID="$sid"
@@ -587,14 +604,20 @@ ar_start_watcher() { # $1 provider, $2 picked acct dir
   printf '%s\n' "v=1" "provider=$prov" "pid=$$" "ppid=$PPID" "acct=${dir##*/}" \
     "acct_dir=$dir" "cwd=$PWD" "launched=$launched" "tmux=$TMUX" "pane=$TMUX_PANE" \
     "self=$SELF" "acc_root=$root" "depth=$AR_DEPTH" "avoid=$AR_AVOID" \
-    "hist=$AR_HIST" "chain=$AR_CHAIN" 2>/dev/null > "$tmp" \
+    "hist=$AR_HIST" "chain=$AR_CHAIN" "avoid_claude=$AR_AVOID_CLAUDE" \
+    "avoid_codex=$AR_AVOID_CODEX" "pool_claude=$AR_POOL_CLAUDE" "pool_codex=$AR_POOL_CODEX" \
+    "handoff_token=$AR_HANDOFF_TOKEN" 2>/dev/null > "$tmp" \
     && mv -f "$tmp" "$st" 2>/dev/null \
     || { rm -f "$tmp" 2>/dev/null; return 1; }
+  if [ -n "$AR_HANDOFF_TOKEN" ]; then
+    "$AR_PY" -I "$SELF_DIR/../lib/autoresume_cross_dispatch.py" startup \
+      --state "$st" --token "$AR_HANDOFF_TOKEN" </dev/null || return 1
+  fi
   # Detached and never waited for; the watcher setsid()s itself at once. It inherits
   # this environment on purpose (the probe strips the account-specific part).
   ( trap '' INT QUIT HUP TSTP
     exec "$AR_PY" -I "$lib" watch --state "$st" </dev/null >/dev/null 2>&1 &
-  ) >/dev/null 2>&1
+  ) >/dev/null 2>&1 || return 1
   return 0
 }
 
@@ -642,7 +665,8 @@ fi
 # `exec "$SELF"`. A relaunch has spent its token by then, so it hands its chain (depth,
 # the accounts it left, its budgets) over in the environment — without it the re-entered
 # selection could land right back on the account the session just left. Only such a
-# re-entry (PREFLIGHT_DEPTH set) may use it, and never a probe or a fresh token.
+# re-entry (PREFLIGHT_DEPTH set) may use it, and never a probe or a fresh token. The
+# separate CROSS_CARRY keeps both pools and their avoid lists for later reverse hops.
 if [ -n "${CLAUDE_MULTIACC_AR_CARRY+x}" ]; then
   ar_c="$CLAUDE_MULTIACC_AR_CARRY"
   unset CLAUDE_MULTIACC_AR_CARRY
@@ -657,6 +681,22 @@ if [ -n "${CLAUDE_MULTIACC_AR_CARRY+x}" ]; then
   fi
   unset ar_c ar_d ar_a ar_h
 fi
+if [ -n "${CLAUDE_MULTIACC_AR_CROSS_CARRY+x}" ]; then
+  if [ "$AR_PROBE" != 1 ] && [ "$AR_LOADED" != 1 ] && [ -n "${CLAUDE_MULTIACC_PREFLIGHT_DEPTH:-}" ]; then
+    IFS='|' read -r ar_t ar_c ar_x ar_pc ar_px ar_extra <<< "$CLAUDE_MULTIACC_AR_CROSS_CARRY"
+    if ar_field_ok "$ar_c" && ar_field_ok "$ar_x" && [ -z "$ar_extra" ] \
+      && { [ -z "$ar_pc" ] || ar_path_ok "$ar_pc"; } && { [ -z "$ar_px" ] || ar_path_ok "$ar_px"; }; then
+      case "$ar_t" in *[!A-Za-z0-9]*) exit 2 ;; esac
+      [ -z "$ar_t" ] || { [ "${#ar_t}" -ge 8 ] && [ "${#ar_t}" -le 64 ]; } || exit 2
+      AR_HANDOFF_TOKEN="$ar_t"; AR_AVOID_CLAUDE="$ar_c"; AR_AVOID_CODEX="$ar_x"
+      AR_POOL_CLAUDE="$ar_pc"; AR_POOL_CODEX="$ar_px"
+    else
+      printf 'claude-multiacc: auto-resume preflight state is invalid.\n' >&2
+      exit 2
+    fi
+  fi
+  unset CLAUDE_MULTIACC_AR_CROSS_CARRY ar_t ar_c ar_x ar_pc ar_px ar_extra
+fi
 AR_ORIG_ARGV=(${1+"$@"})
 
 # ---- model-scoped limits ------------------------------------------------------
@@ -1752,6 +1792,14 @@ token_preflight() { # $1 acct dir, $2 setup-token; rc 1 only for proven unusable
 
 # A relaunch marks the account it left before anything reads the pool (auto-resume).
 ar_relaunch_apply
+if [ -n "$AR_CROSS" ]; then
+  [ -z "$AR_HANDOFF_TOKEN" ] && ar_python || exit 2
+  exec "$AR_PY" -I "$SELF_DIR/../lib/autoresume_cross_dispatch.py" dispatch \
+    --root "$ACC_ROOT" --token "$AR_CROSS"
+fi
+if [ -n "$AR_HANDOFF_TOKEN" ]; then
+  [ -z "${CLAUDE_ACCOUNT:-}" ] && ar_argv_ok "$@" || exit 2
+fi
 
 # Explicit pin wins over everything — markers, and even missing auth: the
 # add/login ceremony pins to a dir that has no credentials yet, and the login
@@ -1854,6 +1902,10 @@ fi
 # the pool is merely un-authenticated: this is the one case the user can actually fix.
 if [ "${#valid[@]}" -eq 0 ]; then
   [ "$AR_PROBE" = 1 ] && ar_probe_exit none
+  if [ -n "$AR_HANDOFF_TOKEN" ]; then
+    printf 'claude-multiacc: auto-resume handoff has no usable account.\n' >&2
+    exit 2
+  fi
   if [ "${#expired[@]}" -gt 0 ]; then
     sel_log "all-expired: falling back to the default login (see: claude-accounts expired)"
     # Terminal only: a service-spawned `claude -p` must keep its stderr byte-clean, and
@@ -2099,6 +2151,10 @@ pick="$PICK_DIR"
 # An auto-resume probe ends here: before the token preflight (a real inference), the
 # model pin, remember_pick, the limits kick and the pick line — it chose nothing.
 [ "$AR_PROBE" = 1 ] && ar_probe_exit
+if [ -n "$AR_HANDOFF_TOKEN" ] && [ "${#eligible[@]}" -eq 0 ] && [ "${#soft[@]}" -eq 0 ]; then
+  printf 'claude-multiacc: auto-resume handoff has no remaining quota.\n' >&2
+  exit 2
+fi
 
 # The preflight can prove the selected token dead without exposing its 401 to the
 # caller. Re-enter selection so the new .expired marker is applied and another
@@ -2117,6 +2173,10 @@ if [ -n "$tok" ] && ! token_preflight "$pick" "$tok"; then
     # An auto-resume chain survives the re-entry (see ---- auto-resume ----). '|' is
     # outside every chain field's charset, so it separates them unambiguously.
     [ -n "$AR_CHAIN" ] && export CLAUDE_MULTIACC_AR_CARRY="$AR_DEPTH|$AR_AVOID|$AR_HIST|$AR_CHAIN"
+    if [ -n "$AR_HANDOFF_TOKEN$AR_AVOID_CLAUDE$AR_AVOID_CODEX$AR_POOL_CLAUDE$AR_POOL_CODEX" ]; then
+      ar_cross_carry="$AR_HANDOFF_TOKEN|$AR_AVOID_CLAUDE|$AR_AVOID_CODEX"
+      export CLAUDE_MULTIACC_AR_CROSS_CARRY="$ar_cross_carry|$AR_POOL_CLAUDE|$AR_POOL_CODEX"
+    fi
     exec "$SELF" "$@"
   fi
   printf 'claude-multiacc: portable token preflight retry limit reached\n' >&2
@@ -2262,7 +2322,10 @@ if [ "$wants_retry" = "0" ]; then
   [ -n "$tok" ] && export CLAUDE_CODE_OAUTH_TOKEN="$tok"
   sel_capture_session "$pick"
   ar_trust "$pick"
-  ar_spawn_watcher claude "$pick" || true
+  if ! ar_spawn_watcher claude "$pick" && [ -n "$AR_HANDOFF_TOKEN" ]; then
+    printf 'claude-multiacc: auto-resume handoff could not start its watcher.\n' >&2
+    exit 2
+  fi
   exec "$REAL" "$@"
 fi
 

package/bin/codex

@@ -181,6 +181,10 @@ if [ -n "${CODEX_HOME:-}" ] \
   # An auto-resume probe (see "auto-resume" below) asks which account selection would
   # pick; with no selection to run, the answer is none — it must never start a session.
   if [ "${CODEX_MULTIACC_AR_PROBE:-0}" = "1" ]; then printf 'pick= tier=none\n'; exit 3; fi
+  if [ -n "${CODEX_MULTIACC_AR:-}" ]; then
+    printf 'codex-multiacc: auto-resume cannot enter account selection.\n' >&2
+    exit 2
+  fi
   mcp_nested_mirror "$@" || true
   exec "$REAL" "$@"
 fi
@@ -749,14 +753,16 @@ auth_dead() { expired_marked "$1"; }
 # picks the next account. bin/claude carries the same hooks; docs/AUTORESUME.md is the
 # reference. Fail open everywhere: no network; the local CLI mode probe is bounded to
 # two seconds, and every path that cannot finish falls through
-# to exactly today's exec. The one exception is a typed relaunch whose token is gone: it
-# names the session to resume and exits 2, because its own (empty) argv would start a
-# fresh session in the stopped one's place.
+# to exactly today's exec. A typed relaunch whose token is gone exits 2 instead of
+# starting a fresh session. A cross-provider handoff also requires remaining quota,
+# a startup receipt and successful watcher setup.
 AR_DIR="$ACC_ROOT/tmp/autoresume"
 AR_DEPTH=0          # how many relaunches this session's chain has already taken
 AR_AVOID=""         # acct-NN:until,... — accounts the chain must not land on again
 AR_HIST=""          # class:epoch,... — the chain's verdicts, for the watcher's budgets
 AR_CHAIN=""         # the chain's id, as the watcher named it
+AR_CROSS="" AR_HANDOFF_TOKEN=""
+AR_AVOID_CLAUDE="" AR_AVOID_CODEX="" AR_POOL_CLAUDE="" AR_POOL_CODEX=""
 AR_ARGV=()
 AR_ORIG_ARGV=()
 AR_NO_DAEMON=0
@@ -898,7 +904,7 @@ ar_token_dead() { # $1 session id (the token's, else the file's) or empty
 ar_relaunch() { # $1 token
   local tok="$1" base f line k v n=0 a age
   local ver="" prov="" cls="" acct="" sid="" cwd="" depth="" avoid="" hist="" chain=""
-  local funding="" funding_pid=""
+  local funding="" funding_pid="" cross_bad=0
   ar_word_ok "$tok" 8 || return 1
   base="$AR_DIR/r-$tok"
   f="$base.relaunch"
@@ -920,6 +926,14 @@ ar_relaunch() { # $1 token
       cwd) case "$v" in /*) cwd="$v" ;; esac ;;
       depth) num_ok "$v" && depth="$v" ;;
       avoid) avoid="$v" ;;
+      avoid_claude|avoid_codex)
+        case "$v" in *[!A-Za-z0-9:,._-]*) cross_bad=1; continue ;; esac
+        [ "${#v}" -le 2048 ] || { cross_bad=1; continue; }
+        if [ "$k" = avoid_claude ]; then AR_AVOID_CLAUDE="$v"; else AR_AVOID_CODEX="$v"; fi ;;
+      pool_claude) [ -z "$v" ] || { ar_path_ok "$v" && AR_POOL_CLAUDE="$v"; } || cross_bad=1 ;;
+      pool_codex) [ -z "$v" ] || { ar_path_ok "$v" && AR_POOL_CODEX="$v"; } || cross_bad=1 ;;
+      cross) [ -z "$v" ] || { ar_word_ok "$v" 8 && AR_CROSS="$v"; } || cross_bad=1 ;;
+      handoff_token) [ -z "$v" ] || { ar_word_ok "$v" 8 && AR_HANDOFF_TOKEN="$v"; } || cross_bad=1 ;;
       hist) hist="$v" ;;
       chain) ar_word_ok "$v" 1 && chain="$v" ;;
       funding_tier) [ "$v" = credits ] && funding=credits ;;
@@ -927,8 +941,10 @@ ar_relaunch() { # $1 token
       rollout_cursor) case "$v" in *[!0-9:]*|'') ;; *) AR_ROLLOUT_CURSOR="$v" ;; esac ;;
     esac
   done < "$f"
+  [ -z "$AR_HANDOFF_TOKEN" ] || { [ -z "$acct" ] && [ -z "$AR_CROSS" ]; } || cross_bad=1
   age=$((now - $(file_mtime "$f")))
-  if [ "$ver" != "1" ] || [ "$prov" != "codex" ] || [ "$age" -gt 600 ] || [ ! -f "$base.argv" ]; then
+  if [ "$cross_bad" = 1 ] || [ "$ver" != "1" ] || [ "$prov" != "codex" ] \
+    || [ "$age" -gt 600 ] || [ ! -f "$base.argv" ]; then
     rm -f "$f" "$base.argv" 2>/dev/null
     AR_R_SID="$sid"
     return 1
@@ -979,16 +995,24 @@ ar_relaunch() { # $1 token
 # A positional must contain a space to count as a prompt: a single word may be a
 # subcommand.
 ar_argv_ok() { # the argv codex is about to get
-  local a resume=0 sid=0 prompt=0 want=0
+  local a resume=0 sid=0 prompt=0 want="" sandbox=0 approval=0 bypass=0
   for a in "$@"; do
-    if [ "$want" = 1 ]; then
-      case "$a" in ''|-*) return 1 ;; esac
-      want=0
+    if [ -n "$want" ]; then
+      case "$want:$a" in
+        sandbox:read-only) sandbox=1 ;;
+        approval:on-request) approval=1 ;;
+        model:*) case "$a" in ''|-*) return 1 ;; esac ;;
+        *) return 1 ;;
+      esac
+      want=""
       continue
     fi
     case "$a" in
-      --dangerously-bypass-approvals-and-sandbox|--yolo|--no-daemon) ;;
-      -m|--model) want=1 ;;
+      --dangerously-bypass-approvals-and-sandbox|--yolo) bypass=1 ;;
+      --no-daemon) ;;
+      --sandbox) [ "$sandbox" = 0 ] || return 1; want=sandbox ;;
+      --ask-for-approval) [ "$approval" = 0 ] || return 1; want=approval ;;
+      -m|--model) want=model ;;
       --model=?*) ;;
       --last)
         [ "$resume" = 1 ] && [ "$sid" = 0 ] || return 1
@@ -1007,7 +1031,8 @@ ar_argv_ok() { # the argv codex is about to get
         fi ;;
     esac
   done
-  [ "$want" = 0 ] || return 1
+  [ -z "$want" ] && [ "$sandbox" = "$approval" ] || return 1
+  [ "$sandbox" = 0 ] || [ "$bypass" = 0 ] || return 1
   # A bare `resume` opens the session picker: there is no session to follow yet.
   [ "$resume" = 0 ] || [ "$sid" = 1 ]
 }
@@ -1102,16 +1127,23 @@ ar_spawn_watcher() { # $1 provider, $2 picked acct dir, then the argv codex is a
     printf 'acct=%s\nacct_dir=%s\ncwd=%s\nlaunched=%s\n' "${pick##*/}" "$pick" "$PWD" "$(date +%s)"
     printf 'tmux=%s\npane=%s\nself=%s\nacc_root=%s\n' "$TMUX" "$TMUX_PANE" "$SELF" "$root"
     printf 'depth=%s\navoid=%s\nhist=%s\nchain=%s\n' "$AR_DEPTH" "$AR_AVOID" "$AR_HIST" "$AR_CHAIN"
+    printf 'avoid_claude=%s\navoid_codex=%s\n' "$AR_AVOID_CLAUDE" "$AR_AVOID_CODEX"
+    printf 'pool_claude=%s\npool_codex=%s\n' "$AR_POOL_CLAUDE" "$AR_POOL_CODEX"
+    printf 'handoff_token=%s\n' "$AR_HANDOFF_TOKEN"
     printf 'funding_tier=%s\n' "$AR_TIER"
     printf 'rollout_cursor=%s\n' "$AR_ROLLOUT_CURSOR"
   } 2>/dev/null > "$st.tmp" && mv -f "$st.tmp" "$st" 2>/dev/null || {
     rm -f "$st.tmp" "$AR_DIR/$$.argv" 2>/dev/null
     return 1
   }
+  if [ -n "$AR_HANDOFF_TOKEN" ]; then
+    "$AR_PY" -I "$SELF_DIR/../lib/autoresume_cross_dispatch.py" startup \
+      --state "$st" --token "$AR_HANDOFF_TOKEN" </dev/null || return 1
+  fi
   # Detached and never waited on: the subshell returns as soon as the watcher is forked,
   # and the watcher ignores the terminal's signals until its own setsid().
   ( trap '' INT QUIT HUP TSTP
-    exec "$AR_PY" -I "$lib" watch --state "$st" </dev/null >/dev/null 2>&1 & ) >/dev/null 2>&1
+    exec "$AR_PY" -I "$lib" watch --state "$st" </dev/null >/dev/null 2>&1 & ) >/dev/null 2>&1 || return 1
   [ "$mode" != --no-daemon ] || AR_NO_DAEMON=1
   return 0
 }
@@ -1141,6 +1173,14 @@ if [ -n "${CODEX_MULTIACC_AR+x}" ]; then
 fi
 [ -n "${CODEX_MULTIACC_AR_AVOID:-}" ] && ar_avoid_add "$CODEX_MULTIACC_AR_AVOID"
 AR_ORIG_ARGV=("$@")
+if [ -n "$AR_CROSS" ]; then
+  [ -z "$AR_HANDOFF_TOKEN" ] && ar_find_python || exit 2
+  exec "$AR_PY" -I "$SELF_DIR/../lib/autoresume_cross_dispatch.py" dispatch \
+    --root "$ACC_ROOT" --token "$AR_CROSS"
+fi
+if [ -n "$AR_HANDOFF_TOKEN" ]; then
+  [ -z "${CODEX_ACCOUNT:-}" ] && ar_argv_ok "$@" || exit 2
+fi
 
 # Explicit pin wins over everything — markers, and even missing auth: the
 # add/login ceremony pins to a dir that has no credentials yet, and the login
@@ -1217,6 +1257,10 @@ fi
 if [ "${#valid[@]}" -eq 0 ]; then
   # A probe has nothing to offer and must never exec (nor log a fallback it never took).
   if [ "$AR_PROBE" = "1" ]; then printf 'pick= tier=none\n'; exit 3; fi
+  if [ -n "$AR_HANDOFF_TOKEN" ]; then
+    printf 'codex-multiacc: auto-resume handoff has no usable account.\n' >&2
+    exit 2
+  fi
   if [ "${#expired[@]}" -gt 0 ]; then
     sel_log "all-expired: falling back to the default login (see: codex-accounts expired)"
     # Terminal only: a service-spawned `codex exec` must keep its stderr byte-clean,
@@ -1430,6 +1474,12 @@ fi
 # Remember the pick so the NEXT run does not hand back the same account. An explicit
 # CODEX_ACCOUNT pin deliberately does not: a pin is a caller overriding selection,
 # not a turn in the rotation.
+if [ -n "$AR_HANDOFF_TOKEN" ]; then
+  case "$AR_TIER" in
+    eligible|soft|credits) ;;
+    *) printf 'codex-multiacc: auto-resume handoff has no remaining quota.\n' >&2; exit 2 ;;
+  esac
+fi
 remember_pick "$pick"
 if [ "$AR_TIER" = "credits" ]; then
   "$MCP_PYBIN" "$SELF_DIR/../lib/codex_credit_selection.py" record "$pick" "$$" 2>/dev/null || true
@@ -1507,7 +1557,10 @@ if [ "$wants_retry" = "0" ]; then
   # Auto-resume: a gated, detached watcher beside this exec — the exec itself (same pid,
   # same environment minus the auto-resume variables). Supported clients own their
   # task through --no-daemon, including the continuation passed on resume.
-  ar_spawn_watcher codex "$pick" "$@" || true
+  if ! ar_spawn_watcher codex "$pick" "$@" && [ -n "$AR_HANDOFF_TOKEN" ]; then
+    printf 'codex-multiacc: auto-resume handoff could not start its watcher.\n' >&2
+    exit 2
+  fi
   ar_scrub_env
   [ "$AR_NO_DAEMON" != 1 ] || set -- --no-daemon "$@"
   exec "$REAL" "$@"

package/docs/AUTORESUME-HANDOFF.md

@@ -0,0 +1,84 @@
+# Continuing between Codex and Claude
+
+When a supervised tmux session hits a usage limit, auto-resume first looks for another
+usable account from the same provider. If that pool is exhausted, it checks the other
+provider: Codex can continue in Claude, and Claude can continue in Codex.
+
+The destination uses its normal account-selection policy. Eligible accounts, soft
+fallback with remaining quota, and configured credits keep their existing meaning.
+An exhausted destination account is not usable. If neither provider can serve, the
+source client stays running and the watcher checks again later.
+
+This fallback applies to quota errors. Login failures, model-specific limits, transient
+errors and crashes retain their existing same-provider recovery behavior.
+
+## Conversation continuity
+
+A provider change starts a **new destination conversation**. Its first message names:
+
+- the source provider and exact conversation ID;
+- the validated absolute path to that conversation's local history;
+- the original working directory and instructions to read the history before continuing.
+
+The destination agent must recover the user's latest objective, completed work and
+remaining work from that history. It also checks whether background processes or
+subagents remain active before restarting or duplicating them. The source history stays
+available; a Codex ID is never passed as a Claude native `--resume` ID, or vice versa.
+
+The watcher uses the history already bound to the source client. It does not guess from
+the newest transcript or directory name. Invalid, ambiguous or unavailable source
+history prevents the handoff before the source client is stopped.
+Codex main conversations marked `source=cli` or `source=vscode` are supported when
+resumed in a supervised TUI; their exact conversation and file identity still must match.
+
+If another live client holds the same source conversation, the watcher holds to avoid
+creating duplicate destination conversations. Stale process records do not count.
+
+Success requires the destination to persist the exact handoff message as user input.
+Starting the shell command or consuming a relaunch token is insufficient. The destination
+then gets its own watcher, with the existing rotation chain and budgets preserved.
+Account avoidance is separate for each provider, so Claude's `acct-01` and Codex's
+`acct-01` cannot be confused.
+
+## Permissions and arguments
+
+The working directory is preserved. Source model names, effort settings, session
+selectors and the original launch prompt are not replayed as destination CLI arguments.
+The destination uses its own configured model.
+
+An explicit permission bypass maps to the equivalent destination bypass. Merely allowing
+a bypass flag is not treated as enabling it. Ordinary launches use explicit conservative
+destination permissions so a pool default cannot silently grant broader access.
+Codex receives `--sandbox read-only --ask-for-approval on-request`; Claude receives
+`--permission-mode default`. Existing permission prompts may therefore still need you.
+Restrictive modes without a safe equivalent keep the source session running instead of
+relaxing its permissions.
+
+## Controls
+
+Cross-provider quota fallback is enabled by default. Disable it for launches from an
+environment while retaining same-provider auto-resume:
+
+```bash
+CODEX_MULTIACC_CROSS_PROVIDER=0 codex
+CLAUDE_MULTIACC_CROSS_PROVIDER=0 claude
+```
+
+Both providers' normal disable settings and auto-resume kill switches apply. For example,
+`~/.claude-accounts/autoresume.off` prevents a Codex quota recovery from starting Claude.
+Custom pools use their configured roots. The destination CLI must be installed and its
+pool must have an account that can serve.
+
+The process safeguards are the same as [ordinary auto-resume](AUTORESUME.md): validate
+the client and pane, prepare the relaunch, stop only that client's job, then type into
+the launching shell. No recovery keys are sent to a running TUI.
+
+## Limits
+
+Conversation history provides context; provider-specific in-memory state, running
+subagents and native goal databases are not migrated. The continuation instructions
+require the destination to inspect existing work before proceeding.
+
+If capacity disappears between the probe and launch, the destination refuses to start
+on an exhausted account. Missing confirmation of the handoff is reported as a failure,
+not as a successful continuation.

package/docs/AUTORESUME.md

@@ -2,8 +2,10 @@
 
 An interactive `claude` or `codex` session that stops on a usage limit, a failed login, an
 API error or (claude only) a crash is restarted automatically on another pooled account
-with headroom. It keeps the **same session id, directory and flags**, and you press no
-keys. This covers sessions launched from a shell inside **tmux**. Every other launch runs
+with headroom. Within the same provider it keeps the **same session id, directory and
+flags**, and you press no keys. When a quota recovery has no usable account left in that
+provider, it can continue in the other provider using the source conversation's history.
+This covers sessions launched from a shell inside **tmux**. Every other launch runs
 exactly as it did before.
 
 It is on by default. The kill switches:
@@ -98,6 +100,11 @@ shell:   runs the shim again → token → marker on the old account → normal
      serve; an exhausted account or one with an active client rejection cannot.
    - **Login, refusal and model-limit errors** still require a different account below
      the exclusion threshold.
+   - **Quota recovery can cross providers.** Only after the source pool has no usable
+     account, the watcher checks the other provider's pool. It starts a fresh target
+     conversation with the exact source provider, session ID and validated history path.
+     Same-provider flags and session IDs are not blindly passed to the other CLI.
+     See [cross-provider continuation](AUTORESUME-HANDOFF.md).
    - **Otherwise the watcher holds.** Nothing is stopped, and Claude's own "continuing
      automatically" keeps running. The probe repeats every 60 s for as long as the error
      stands.
@@ -258,8 +265,10 @@ launch.
     `-c` / `--continue`, `-r` / `--resume <uuid>` (or `--resume=<uuid>`), `--model <m>`,
     `--effort <e>`, `--permission-mode <m>`, and at most one prompt argument that
     contains a space.
-  - **codex:** `--dangerously-bypass-approvals-and-sandbox`, `--yolo`, `-m` / `--model <m>`,
-    `resume <uuid>|--last`, and at most one prompt that contains a space.
+  - **codex:** `--dangerously-bypass-approvals-and-sandbox`, `--yolo`, `--no-daemon`,
+    `-m` / `--model <m>`, `resume <uuid>|--last`, and at most one prompt that contains a
+    space. The conservative pair `--sandbox read-only --ask-for-approval on-request`
+    is also supported; partial, conflicting or other sandbox/approval combinations are not.
   - **Anything else means no watcher.** That includes `-p` (for codex, `-p` is
     `--profile`), a subcommand, `--fork-session` and any single-word argument, which
     could be a subcommand.
@@ -292,6 +301,9 @@ tokens.
 | `giveup` | watcher | could not relaunch safely (`reason=` pane, shell, pgrp, holder, tree, relaunch, …); with `stopped=1` the session was stopped and `resume=` names the command to run |
 | `relaunch` | the relaunched shim | consumed the token (`chain=`, `from=`, `class=`, `depth=`) |
 
+Cross-provider `switch` records also include `to_provider` and the newly confirmed
+destination conversation's `to_sid`; `sid` continues to identify the source conversation.
+
 Around these lines:
 
 - The new pick logs its usual selection line.
@@ -347,7 +359,6 @@ CLAUDE_MULTIACC_AR_PROBE=1 CLAUDE_MULTIACC_AR_AVOID=acct-07:1790000000 claude
   (`goals_1.sqlite`), so set the goal again after a codex rotation. Claude restores a goal
   from the transcript on resume.
 - **Out of scope for this version:**
-  - cross-provider continuation;
   - proactive switching before a limit is hit;
   - an agent that simply ends its turn early, which is not an error; use `/goal` for
     that.