claude-multiacc 2.0.60 → 2.0.64

package/README.md

@@ -571,7 +571,12 @@ claude-accounts mcp apply                        # re-apply now (repair drift)
   config dir outside the pool is plain passthrough. Global options in front of `mcp` are
   looked past the way the real parser does (`alias claude='claude
   --dangerously-skip-permissions'` puts one before every typed `claude mcp add`; until
-  2026-10-22 that kept motionsites in 2 of 11 accounts).
+  2026-10-22 that kept motionsites in 2 of 11 accounts). Mirroring is limited to the server
+  named by the command, including its project approvals: a concurrent runner update to
+  another server cannot become a synced override or tombstone. An unrecognized command
+  option leaves the native command intact and warns that its change was not mirrored.
+  Claude's desktop bulk import mirrors changes except names and retirements belonging to
+  another machine-local overlay owner; an explicit named command can still override one.
 - **Adoption**: whatever reached an account by another route — the real binary run
   directly, a hand edit, another tool's installer — is adopted by the next reconcile: a
   server (user scope or a project entry) or a project's `.mcp.json` approval that no section
@@ -680,8 +685,12 @@ claude-accounts mcp auth-forget higgsfield   # log it out of EVERY account on th
   cannot open) stays ignored and is cleared by a later pass.
 - **Kill switches**: `CLAUDE_MULTIACC_MCP_OAUTH=0` stops sharing (the shim's merge and the
   limits pass's sync); `CLAUDE_MULTIACC_MCP_OAUTH_REFRESH=0` never refreshes — and so shares
-  nothing. `auth-status` and `auth-forget` always run. Claude pool only: Codex keeps MCP
-  OAuth in its own store, and `codex-accounts mcp auth-…` says so.
+  nothing. `auth-status` and `auth-forget` always run. These commands describe the Claude pool.
+
+Codex shares its native MCP credential file and refresh locks locally, so a login in
+one pooled account works in the others. Run `codex-accounts mcp auth-sync` to repair
+sharing now; use native `codex mcp login NAME`, `list`, and `logout NAME` for authentication.
+See [Codex MCP authentication](docs/CODEX_MCP_AUTH.md) for storage constraints and recovery.
 
 app-robot tasks are different: the panel launches Claude with `--strict-mcp-config` and a
 merged MCP document (`agent_mcp.servers_for`) and Codex with the same document as `-c`

package/bin/claude

@@ -224,15 +224,26 @@ mcp_mutation_argv() {
   i="$(cli_positional_at "$@")" || return 1
   [ "${!i}" = "mcp" ] || return 1
   j=$((i + 1))
-  case "${!j:-}" in add|add-json|add-from-claude-desktop|remove) return 0 ;; esac
+  case "${!j:-}" in add|add-json|add-from-claude-desktop|remove) MCP_MUTATION_AT="$j"; return 0 ;; esac
   return 1
 }
 
 mcp_mirror_run() { # $1 acct dir, then the user's argv — exits when it handled the run
-  local d="$1" snap="" rc
+  local d="$1" snap="" rc parse_rc name="" mirror_args=()
   shift
   mcp_mutation_argv "$@" || return 1
   [ "${CLAUDE_MULTIACC_MCP:-1}" != "0" ] && [ -f "$MCP_PY" ] || return 1
+  if [ "${!MCP_MUTATION_AT}" != add-from-claude-desktop ]; then
+    if name="$(. "$SELF_DIR/../lib/mcp_mirror.sh" && mcp_mutation_name claude "${@:$MCP_MUTATION_AT}")"; then
+      mirror_args=("--name=$name")
+    else
+      parse_rc=$?
+      "$REAL" "$@"; rc=$?
+      [ "$rc" -ne 0 ] || [ "$parse_rc" = 2 ] \
+        || printf 'claude-multiacc: could not identify the MCP target; change not mirrored\n' >&2
+      exit "$rc"
+    fi
+  fi
   mcp_ensure "$d"
   snap="$(mktemp "${TMPDIR:-/tmp}/claude-mcp-snap.XXXXXX" 2>/dev/null)" || snap=""
   if [ -n "$snap" ] && ! "$MCP_PYBIN" "$MCP_PY" --root "$ACC_ROOT" --provider claude snapshot \
@@ -243,7 +254,7 @@ mcp_mirror_run() { # $1 acct dir, then the user's argv — exits when it handled
   rc=$?
   if [ "$rc" -eq 0 ] && [ -n "$snap" ]; then
     "$MCP_PYBIN" "$MCP_PY" --root "$ACC_ROOT" --provider claude learn --account-dir "$d" \
-      --before "$snap" --project "$(pwd -P 2>/dev/null || pwd)" </dev/null \
+      --before "$snap" --project "$(pwd -P 2>/dev/null || pwd)" ${mirror_args[@]+"${mirror_args[@]}"} </dev/null \
       || printf 'claude-multiacc: could not mirror the MCP change to the other accounts — run: claude-accounts mcp apply\n' >&2
   elif [ "$rc" -eq 0 ]; then
     printf 'claude-multiacc: could not mirror the MCP change to the other accounts — run: claude-accounts mcp apply\n' >&2

package/bin/codex

@@ -93,6 +93,11 @@ fi
 # the servers themselves. Same contract as bin/claude's mcp_ensure.
 MCP_PY="$SELF_DIR/../lib/mcp_registry.py"
 MCP_PYBIN="${CLAUDE_MULTIACC_PYTHON:-python3}"
+mcp_oauth_ensure() {
+  [ -f "$SELF_DIR/../lib/codex_mcp_oauth.sh" ] || return 0
+  bash "$SELF_DIR/../lib/codex_mcp_oauth.sh" "$ACC_ROOT" "$MCP_PYBIN" \
+    "$SELF_DIR/../lib/codex_mcp_oauth.py" "$1" "$REAL" >/dev/null 2>&1 </dev/null || true
+}
 mcp_sig() { # $1 acct dir -> "m:z,m:z,m:z" (registry, overlay, account config; - = absent)
   local f out="" s
   for f in "$ACC_ROOT/mcp-servers.json" "$ACC_ROOT/mcp-servers.local.json" "$1/config.toml"; do
@@ -165,15 +170,24 @@ mcp_mutation_argv() {
       *) break ;;
     esac
   done
-  case "${!j:-}" in add|remove) return 0 ;; esac
+  case "${!j:-}" in add|remove) MCP_MUTATION_AT="$j"; return 0 ;; esac
   return 1
 }
 
 mcp_mirror_run() { # $1 acct dir, then the user's argv — exits when it handled the run
-  local d="$1" snap="" rc
+  local d="$1" snap="" rc parse_rc name=""
   shift
   mcp_mutation_argv "$@" || return 1
   [ "${CODEX_MULTIACC_MCP:-1}" != "0" ] && [ -f "$MCP_PY" ] || return 1
+  if name="$(. "$SELF_DIR/../lib/mcp_mirror.sh" && mcp_mutation_name codex "${@:$MCP_MUTATION_AT}")"; then
+    :
+  else
+    parse_rc=$?
+    "$REAL" "$@"; rc=$?
+    [ "$rc" -ne 0 ] || [ "$parse_rc" = 2 ] \
+      || printf 'codex-multiacc: could not identify the MCP target; change not mirrored\n' >&2
+    exit "$rc"
+  fi
   mcp_ensure "$d"
   snap="$(mktemp "${TMPDIR:-/tmp}/codex-mcp-snap.XXXXXX" 2>/dev/null)" || snap=""
   if [ -n "$snap" ] && ! "$MCP_PYBIN" "$MCP_PY" --root "$ACC_ROOT" --provider codex snapshot \
@@ -184,7 +198,7 @@ mcp_mirror_run() { # $1 acct dir, then the user's argv — exits when it handled
   rc=$?
   if [ "$rc" -eq 0 ] && [ -n "$snap" ]; then
     "$MCP_PYBIN" "$MCP_PY" --root "$ACC_ROOT" --provider codex learn --account-dir "$d" \
-      --before "$snap" </dev/null \
+      --before "$snap" "--name=$name" </dev/null \
       || printf 'codex-multiacc: could not mirror the MCP change to the other accounts — run: codex-accounts mcp apply\n' >&2
   elif [ "$rc" -eq 0 ]; then
     printf 'codex-multiacc: could not mirror the MCP change to the other accounts — run: codex-accounts mcp apply\n' >&2
@@ -234,6 +248,9 @@ if [ -n "${CODEX_HOME:-}" ] \
     printf 'codex-multiacc: auto-resume cannot enter account selection.\n' >&2
     exit 2
   fi
+  if [ "${CODEX_MULTIACC_DISABLE:-0}" != "1" ] && [ -n "${CODEX_HOME:-}" ]; then
+    mcp_oauth_ensure "$CODEX_HOME"
+  fi
   mcp_nested_mirror "$@" || true
   exec "$REAL" "$@"
 fi
@@ -1249,9 +1266,11 @@ if [ -n "${CODEX_ACCOUNT:-}" ] && [ "$AR_PROBE" != "1" ]; then
     share_state_index "$d"
     export CODEX_HOME="$d"
     export CODEX_SHIM_ACTIVE=1
+    unset CODEX_MULTIACC_SELECTED_HOME
     # A pinned account carries every registered MCP server too, and a pinned
     # `codex mcp add|remove` is mirrored like any other (exits inside).
     mcp_ensure "$d"
+    mcp_oauth_ensure "$d"
     mcp_mirror_run "$d" "$@" || true
     exec "$REAL" "$@"
   fi
@@ -1542,6 +1561,7 @@ if [ "$AR_TIER" = "credits" ]; then
 fi
 # The picked account carries every registered MCP server before the client starts.
 mcp_ensure "$pick"
+mcp_oauth_ensure "$pick"
 
 # Opportunistic limits refresh: non-blocking, throttled, backgrounded. The windows are
 # deliberately wide (10m, matching the 5m scheduled pass): the usage endpoint rate-limits
@@ -1572,6 +1592,9 @@ sel_log "$acct weekly=$(fresh_field "$pick" weekly_percent || echo '?')%" \
   "session-ok=${PICK_GATE_COUNT} pwd=$PWD${credit_funding_log}"
 
 export CODEX_SHIM_ACTIVE=1
+# An isolated child job can distinguish this automatic selection from a caller pin.
+# Consumers must also require CODEX_HOME to match and respect explicit pins/disable.
+export CODEX_MULTIACC_SELECTED_HOME="$pick"
 
 # A `codex mcp add|remove` is run as a child under the picked account and mirrored to
 # every other one (exits inside); anything else falls through to exec.
@@ -1582,9 +1605,9 @@ if mcp_mutation_argv "$@"; then
 fi
 
 # Auto-retry applies only to `codex exec` runs with an alternative account available,
-# and only when stdin is finite (tty, regular file, or char device like /dev/null).
-# A service-spawned pipe that never EOFs must take the plain exec path, or the
-# stdin pre-buffering below would hang the call.
+# and stdin is a file/device or an explicit `exec ... -` prompt. That prompt needs
+# EOF in the native CLI too. Other pipes stay unbuffered so a non-consuming command
+# can finish even when its service leaves stdin open.
 wants_retry=0
 if [ "${CODEX_SHIM_RETRY:-1}" != "0" ] \
   && { [ "${#eligible[@]}" -ge 2 ] || [ "$AR_TIER" = "credits" ]; }; then
@@ -1594,19 +1617,26 @@ if [ "${CODEX_SHIM_RETRY:-1}" != "0" ] \
   if [ "$wants_retry" = "1" ]; then
     # A TTY cannot be buffered or replayed: `codex exec` with no prompt argument reads
     # stdin, and the retry path would hand it /dev/null. Plain exec instead —
-    # stdin is inherited untouched. A pipe that never EOFs would hang the pre-buffer,
-    # so only finite stdin (regular file, /dev/null-style char device) takes the retry
-    # path; everything else execs directly.
+    # stdin is inherited untouched. Explicit stdin prompts can replay a pipe: an
+    # AppInspire/Node child receives a complete prompt through a socket, not a file.
+    # Keep unknown commands and pipes the CLI need not consume on direct exec.
     if [ -t 0 ]; then
       wants_retry=0
     elif [ -f /dev/fd/0 ] || [ -c /dev/fd/0 ]; then
       :
+    elif bash "$SELF_DIR/../lib/codex_exec_stdin.sh" "$@" 2>/dev/null; then
+      :
     else
       wants_retry=0
     fi
   fi
 fi
 
+# Keep a damaged installation fail-open rather than wrapping an unowned child.
+if [ "$wants_retry" = 1 ] && ! . "$SELF_DIR/../lib/codex_retry_process.sh" 2>/dev/null; then
+  wants_retry=0
+fi
+
 share_state_index "$pick"
 if [ "$wants_retry" = "0" ]; then
   export CODEX_HOME="$pick"
@@ -1678,7 +1708,8 @@ cur="$pick"
 rc=0
 while :; do
   if [ -n "$stdin_file" ]; then exec 3< "$stdin_file"; else exec 3< /dev/null; fi
-  CODEX_HOME="$cur" "$REAL" "$@" <&3 > "$tmpd/out" 2> "$tmpd/err"
+  CODEX_HOME="$cur" CODEX_MULTIACC_SELECTED_HOME="$cur" \
+    codex_retry_run "$REAL" "$@" <&3 > "$tmpd/out" 2> "$tmpd/err"
   rc=$?
   exec 3<&-
   if [ "$rc" -ne 0 ] && [ "$attempt" -eq 1 ] \
@@ -1740,6 +1771,7 @@ while :; do
       # away from — not the one that bounced.
       remember_pick "$cur"
       mcp_ensure "$cur"
+      mcp_oauth_ensure "$cur"
       attempt=2
       continue
     fi

package/bin/codex-accounts

@@ -133,6 +133,8 @@ USAGE
                                             re-apply the registry now (repair drift)
   codex-accounts mcp import-local --owner NAME   (stdin JSON) machine-local overlay for
                                             a runner daemon; applied here, never synced
+  codex-accounts mcp auth-sync               share native MCP files and refresh locks locally
+      Sign in with `codex mcp login NAME`; sign out with `codex mcp logout NAME`.
 
 ENV
   CODEX_ACCOUNTS_ROOT   pool root, overriding ~/.codex-accounts — one isolated pool
@@ -146,6 +148,7 @@ ENV
   CODEX_MULTIACC_DISABLE=1  bypass the shim entirely
   CODEX_MULTIACC_AUTO_RESET=0  disable automatic usage-reset redemption
   CODEX_MULTIACC_MCP=0   disable the MCP registry (no reconcile at seed/launch, no mirror)
+  CODEX_MULTIACC_MCP_OAUTH=0  stop preparing shared native MCP storage and locks
   CODEX_MULTIACC_MODEL_CATALOG=0  never refresh the codex pool's model-catalog.json
                         (MULTIACC_MODEL_CATALOG=0: neither pool's)
 EOF
@@ -1848,6 +1851,7 @@ PYEOF
   trap - EXIT
   # Every account's MCP servers, adopting what one holds that the registry does not know.
   mcp_registry_pass
+  codex_mcp_oauth_ensure "$ACC_ROOT" "$PYBIN" "$LIB_DIR/codex_mcp_oauth.py"
   # This pool's model catalog, once its copy is an hour old (lib/common.sh).
   model_catalog_backstop
   # The refresher fails open per account; a NON-zero status means the pass itself
@@ -2264,10 +2268,14 @@ cmd_mcp() {
   local args=()
   case "$sub" in
     add|add-json|remove|list|apply|import-local) shift ;;
-    # Sharing MCP OAuth logins across accounts is a claude-pool feature (lib/mcp_oauth.py):
-    # Codex keeps an MCP server's OAuth state in its own per-account store.
-    auth-status|auth-sync|auth-forget)
-      die "mcp $sub is not supported for the codex pool — MCP OAuth logins are shared across the claude pool only (claude-accounts mcp $sub)" ;;
+    auth-sync)
+      shift
+      local real
+      real="$(find_real_codex "$_self")" || die "real codex binary not found"
+      "$PYBIN" "$LIB_DIR/codex_mcp_oauth.py" ensure --root "$ACC_ROOT" --codex-bin "$real" "$@"
+      return $? ;;
+    auth-status|auth-forget)
+      die "use codex mcp list for native auth status, or codex mcp logout NAME to clear shared MCP authentication" ;;
     "") usage; return 1 ;;
     *) die "unknown mcp subcommand: $sub (add, add-json, remove, list, apply, import-local)" ;;
   esac

package/docs/ACCOUNT_OPERATIONS.md

@@ -260,8 +260,8 @@ What to expect, and how to read `auth-status`:
   re-authentication in ANY one account revokes the shared login at the server, so the pool
   retires it in every account (`login: none — retired … (cleared in acct-NN file)`); one
   sign-in in any account shares the new one. `mcp auth-forget NAME` is the same logout from
-  the operator's side. `codex-accounts mcp auth-*` is not supported (Codex keeps MCP OAuth in
-  its own store).
+  the operator's side. Codex uses native login/logout over shared local storage;
+  `codex-accounts mcp auth-sync` repairs it. See [Codex MCP authentication](CODEX_MCP_AUTH.md).
 - **Rolling it out**: the first share runs at install time (the limits agent starts on
   install), and a build older than this one reads a shared MCP-only file as a live login:
   every setup-token account would then say "Not logged in". Install it only where no older

package/docs/AUTORESUME.md

@@ -164,7 +164,12 @@ shell:   runs the shim again → token → marker on the old account → normal
    1. It consumes the token. A token is single-use and valid for 10 minutes.
    2. It writes the old account's marker with the pool's existing writers (see the tables
       below).
-   3. It `cd`s to the session's directory.
+   3. It `cd`s to the session's directory. For Codex, this is the latest directory saved
+      by that session, including a change since its first turn. Starting or resuming it
+      from another shell directory therefore does not stop the automatic restart at
+      **Working directory · resume**. The selected account trusts this same directory
+      before startup. If the saved directory is unavailable, an existing initial session
+      directory or launch directory is used as a fallback.
    4. It runs **normal selection**, with one addition: the accounts this chain of
       relaunches left are skipped until their own reset. The selection policy is
       otherwise untouched.

package/docs/CODEX.md

@@ -18,8 +18,21 @@ then the 30-point weekly-headroom band with random spread, ≥90% any-bucket
 exclusion, peers rotate), same marker semantics (`.limited` cooldowns, `.expired` parks with
 credential/policy scoping and soft expiry), same fail-open guarantees, same sync
 safety guards. The `codex` shim engages the buffered auto-retry only for
-`codex exec` runs with finite stdin, exactly like `-p` on the claude side. Interactive
-`codex` in tmux gets [auto-resume](AUTORESUME.md) instead, like `claude`.
+`codex exec` runs with file/device stdin and explicit `codex exec ... -` prompts from pipes.
+The latter require EOF in the native CLI too; the shim saves and replays the exact prompt
+on its one account retry. Unknown commands, interactive stdin and non-consuming live pipes
+remain unbuffered. Explicit `CODEX_HOME` and `CODEX_ACCOUNT` pins still bypass rotation.
+Cancelling a buffered run forwards TERM/INT/HUP to its active native process and reaps it
+before removing the temporary prompt/output files.
+Interactive `codex` in tmux gets [auto-resume](AUTORESUME.md) instead, like `claude`.
+
+Automatic selection exports `CODEX_MULTIACC_SELECTED_HOME` equal to the serving
+`CODEX_HOME`, including after a retry. Selecting an explicit `CODEX_ACCOUNT` clears the marker;
+a home passthrough never creates it. Nested invocations still pass through.
+An isolated job launcher may request fresh pool selection only when `CODEX_SHIM_ACTIVE=1`,
+the marker exactly matches `CODEX_HOME`, no `CODEX_ACCOUNT` is set and
+`CODEX_MULTIACC_DISABLE` is not `1`. Omit the inherited home/guard/marker only for that
+child. Unmarked older sessions and overridden homes retain their existing pin behavior.
 
 Codex-specific notes:
 
@@ -215,6 +228,10 @@ claude-multiacc codex status          # same status command via the npm wrapper
 
 ## MCP servers for every account
 
+OAuth logins also need shared storage; see
+[Codex MCP authentication](CODEX_MCP_AUTH.md). `codex-accounts mcp auth-sync` repairs
+local credential and refresh-lock sharing without touching account `auth.json` files.
+
 `codex-accounts mcp add|add-json|remove|list|apply|import-local` manages the pool's MCP
 registry (`~/.codex-accounts/mcp-servers.json`); `add`/`remove` default to `--provider both`,
 so the claude pool beside it gets the same change, and `mcp remove` retires the server in

package/docs/CODEX_MCP_AUTH.md

@@ -0,0 +1,58 @@
+# Codex MCP authentication across pooled accounts
+
+The MCP registry shares server configuration. Codex stores OAuth logins separately:
+the direct OS keyring is shared, but its fallback `.credentials.json` belongs to
+`CODEX_HOME`. On 2026-10-23 MotionSites was configured in all 18 accounts, while its
+login existed only in `acct-06`. The other 17 reported `not_logged_in`.
+
+The addon prepares one machine-local native MCP credential file and one directory
+of native refresh/store locks under `<pool>/.codex-mcp-oauth/`. Accounts hardlink
+`.credentials.json` to that file and link `mcp-oauth-locks` to the shared locks.
+Codex reads, refreshes, saves and logs out using its own implementation. The addon
+never refreshes a token or reads the OS keyring. Account `auth.json` files remain
+independent, and none of this MCP state is included in fleet sync.
+
+```bash
+codex-accounts mcp auth-sync       # repair storage sharing now
+codex mcp login motionsites       # authorize once on this machine
+codex mcp list                    # native authentication status
+codex mcp logout motionsites      # clear the shared login
+```
+
+Preparation runs before pooled launches, during seeding, and after limits passes.
+It requires native Codex 0.163.0 or newer, whose storage and lock contract is checked
+before preparation; older clients keep their existing stores.
+A first login saved after preparation is picked up at the next launch or explicit
+`auth-sync`. Restart an already running session to reload its MCP connections.
+`CODEX_MULTIACC_MCP_OAUTH=0` stops preparation; it does not undo existing shared
+storage. Each machine still needs its own authorization.
+
+## Native storage constraints
+
+Codex 0.163.0 refuses final-component credential symlinks with `O_NOFOLLOW`, so a
+regular hardlinked file is necessary. Its file writer updates that inode in place
+under `mcp-oauth-locks/file-store.lock`. A tokenless reserved entry keeps the native
+document nonempty after its last real login is removed: otherwise Codex unlinks
+only the account's filename, leaving the other hardlinks with the old login.
+The reserved entry is not a configured server and cannot authenticate a request.
+
+The refresh lock must be shared too: native locks normally live under each
+`CODEX_HOME`, even when the grant is in the globally shared direct OS keyring.
+Sharing a rotating grant without its lock lets simultaneous sessions reuse an
+obsolete refresh token. Preparation preserves existing lock inodes, defers busy
+stores and refuses independent credential documents rather than choosing a grant.
+Initial migration atomically exchanges native lock directories with their shared
+links. It retains discarded lock files until preexisting client handles close;
+an operation racing that first migration can make preparation wait for its native
+lock timeout. Later launches use the existing shared paths without that migration.
+Linux excludes an inaccessible process only after proving that it has exited with
+no living threads; inaccessible live or uncertain handle state still defers migration.
+Only manifest accounts are eligible, including the supported `acct-NN → ~/.codex`
+adoption. Foreign directory symlinks, duplicate homes and unsupported scoped
+credential entries are refused. Encrypted secrets storage is not merged.
+
+Implementation: `lib/codex_mcp_oauth.py` and its supporting modules. Native contract:
+[OAuth storage](https://github.com/openai/codex/blob/rust-v0.163.0/codex-rs/rmcp-client/src/oauth.rs)
+and [refresh locks](https://github.com/openai/codex/blob/rust-v0.163.0/codex-rs/rmcp-client/src/oauth/refresh_lock.rs).
+The supported store settings are documented in the
+[OpenAI configuration reference](https://learn.chatgpt.com/docs/config-file/config-reference).

package/lib/autoresume.py

@@ -69,6 +69,7 @@ from autoresume_cross_receipt import confirm_cross
 from model_catalog import load as load_catalog, parse_id
 from model_match import resume_settings, settings_flags
 from session_settings import session_settings
+from codex_resume_cwd import codex_resume_cwd
 
 # ---- vocabulary ---------------------------------------------------------------------
 
@@ -2698,11 +2699,11 @@ class Watcher:
         return self.busy_memo[1]
 
     def session_cwd(self):
-        """Where the probe and the relaunch run. claude: the registry's cwd first
-        (``--resume`` finds the transcript by it). codex: the launch directory first, so
-        the relaunch repeats the user's own invocation; the rollout's cwd after it."""
-        order = (self.cwd, self.st["cwd"]) if self.provider == "claude" \
-            else (self.st["cwd"], self.cwd)
+        """Restore the session's directory before the picked account trusts and resumes it.
+        Codex's saved cwd can differ from both the launching shell and initial metadata."""
+        order = (self.cwd, self.st["cwd"])
+        if self.provider == "codex":
+            order = (codex_resume_cwd(self.transcript, self.sid),) + order
         for cand in order:
             if cand and os.path.isdir(cand):
                 return cand

package/lib/autoresume_cross.py

@@ -110,7 +110,8 @@ def revalidate(watcher, plan):
     history = plan['history']
     current = validate_source(watcher.provider, watcher.sid, watcher.transcript,
                               watcher.session_cwd(), inode=history['inode'])
-    return (current is not None and current['offset'] >= history['offset'] and not shared_source(watcher)
+    return (current is not None and current['offset'] >= history['offset'] and current['cwd'] == history['cwd']
+            and not shared_source(watcher)
             and all(enabled(watcher, provider, root) for provider, root in plan['roots'].items()))
 
 

package/lib/autoresume_handoff.py

@@ -12,6 +12,8 @@ import os
 import re
 import stat
 
+from codex_resume_cwd import codex_resume_cwd
+
 
 PROVIDERS = ("claude", "codex")
 SID_RE = re.compile(r"^[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$")
@@ -48,8 +50,8 @@ def _read_source(path, inode):
         return None
 
 
-def _codex_identity(data, sid, cwd):
-    """A main interactive rollout identifies itself in its first JSONL record."""
+def _codex_identity(data, sid, cwd, path, identity):
+    """Bind main-thread identity and its saved cwd at the validated snapshot boundary."""
     try:
         record = json.loads(data.split(b"\n", 1)[0])
     except (ValueError, UnicodeError):
@@ -63,8 +65,14 @@ def _codex_identity(data, sid, cwd):
         return False
     if meta.get("originator") not in (None, "codex-tui", "codex_cli_rs", "codex_cli"):
         return False
-    directory = meta.get("cwd")
-    return isinstance(directory, str) and os.path.isabs(directory) and os.path.realpath(directory) == cwd
+    try:
+        directory = codex_resume_cwd(path, sid, upto=identity.st_size)
+        after = os.stat(path)
+    except OSError:
+        return False
+    return (directory is not None and os.path.realpath(directory) == cwd
+            and (after.st_dev, after.st_ino) == (identity.st_dev, identity.st_ino)
+            and after.st_size >= identity.st_size)
 
 
 def _claude_identity(data, sid, cwd):
@@ -110,7 +118,7 @@ def validate_source(provider, sid, path, cwd, inode=None):
     if provider == "codex":
         if not name.startswith("rollout-") or not name.endswith("-" + sid + ".jsonl"):
             return None
-        valid = _codex_identity(data, sid, directory)
+        valid = _codex_identity(data, sid, directory, resolved, identity)
     else:
         valid = name == sid + ".jsonl" and _claude_identity(data, sid, directory)
     if not valid:

package/lib/codex_exec_stdin.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Exit 0 only for a known `codex exec ... -` prompt that itself requires stdin EOF.
+# Unknown options/subcommands and early exits fail closed into ordinary passthrough.
+set -u
+
+seen_exec=0
+for arg in "$@"; do
+  case "$arg" in -h|--help|-V|--version) exit 1 ;; esac
+done
+while [ "$#" -gt 0 ]; do
+  arg="$1"; shift
+  case "$arg" in
+    --)
+      [ "$seen_exec" = 1 ] && [ "$#" = 1 ] && [ "$1" = - ]
+      exit $? ;;
+    -)
+      [ "$seen_exec" = 1 ] && [ "$#" = 0 ]
+      exit $? ;;
+    -c|--config|--enable|--disable|--remote|--remote-auth-token-env|-m|--model|--local-provider|\
+    -p|--profile|-s|--sandbox|-C|--cd|--add-dir|-a|--ask-for-approval|--thread-source|\
+    --cyber-access-program|--output-schema|--color|-o|--output-last-message)
+      [ "$#" -gt 0 ] || exit 1
+      case "$1" in -*) exit 1 ;; esac
+      shift ;;
+    -i|--image)
+      [ "$#" -gt 0 ] || exit 1
+      case "$1" in -*) exit 1 ;; esac
+      while [ "$#" -gt 0 ]; do
+        case "$1" in -*) break ;; esac
+        shift
+      done ;;
+    --config=*|--enable=*|--disable=*|--remote=*|--remote-auth-token-env=*|--model=*|--local-provider=*|\
+    --profile=*|--sandbox=*|--cd=*|--add-dir=*|--ask-for-approval=*|--thread-source=*|\
+    --cyber-access-program=*|--output-schema=*|--color=*|--output-last-message=*|--image=*|\
+    -c?*|-m?*|-p?*|-s?*|-C?*|-a?*|-o?*|-i?*) ;;
+    --strict-config|--oss|--approve-for-me|--dangerously-bypass-approvals-and-sandbox|\
+    --dangerously-bypass-hook-trust|--worktree|--skip-git-repo-check|--ephemeral|\
+    --ignore-user-config|--ignore-rules|--json|--no-daemon) ;;
+    exec|e)
+      [ "$seen_exec" = 0 ] || exit 1
+      seen_exec=1 ;;
+    *) exit 1 ;;
+  esac
+done
+exit 1