claude-multiacc 2.0.61 → 2.0.64

package/tests/test_codex_mcp_oauth_native.py

@@ -0,0 +1,109 @@
+#!/usr/bin/env python3
+"""Linux process exit must not hide a live native OAuth lock holder."""
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import time
+import unittest
+from unittest.mock import MagicMock, patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / 'lib'))
+import codex_mcp_oauth_native as N
+from codex_mcp_oauth_store import Deferred
+
+
+def scan_process(process):
+    """Limit the proc fixture to this test's process, retaining real fd operations."""
+    root = MagicMock()
+    root.iterdir.return_value = [process]
+    with patch.object(N, 'Path', return_value=root):
+        return N.linux_handles(set(), set())
+
+
+class NativeProcessTests(unittest.TestCase):
+    def test_denied_live_or_unproven_process_still_defers(self):
+        statuses = [
+            'State:\tS (sleeping)\nThreads:\t1\n',
+            'State:\tZ (zombie)\nThreads:\t2\n',
+            'State:\tZ (zombie)\n',
+            'State:\tZ (zombie)\nThreads:\tinvalid\n',
+            'Threads:\t1\n',
+        ]
+        process = MagicMock(spec=Path)
+        process.name = '12345'
+        process.stat.return_value.st_uid = os.getuid()
+        process.__truediv__.return_value.iterdir.side_effect = PermissionError('denied')
+        for status in statuses:
+            with self.subTest(status=status):
+                process.__truediv__.return_value.read_text.return_value = status
+                with self.assertRaises(Deferred):
+                    scan_process(process)
+
+    def test_denied_single_thread_exit_does_not_block_migration(self):
+        process = MagicMock(spec=Path)
+        process.name = '12345'
+        process.stat.return_value.st_uid = os.getuid()
+        process.__truediv__.return_value.iterdir.side_effect = PermissionError('denied')
+        for state in ('Z (zombie)', 'X (dead)'):
+            with self.subTest(state=state):
+                process.__truediv__.return_value.read_text.return_value = f'State:\t{state}\nThreads:\t1\n'
+                self.assertFalse(scan_process(process))
+
+    def test_unreadable_status_defers_but_vanished_process_does_not(self):
+        process = MagicMock(spec=Path)
+        process.name = '12345'
+        process.stat.return_value.st_uid = os.getuid()
+        process.__truediv__.return_value.iterdir.side_effect = PermissionError('denied')
+        process.__truediv__.return_value.read_text.side_effect = PermissionError('denied')
+        with self.assertRaises(Deferred):
+            scan_process(process)
+        process.__truediv__.return_value.read_text.side_effect = FileNotFoundError('gone')
+        self.assertFalse(scan_process(process))
+
+    @unittest.skipUnless(sys.platform == 'linux', 'requires Linux proc metadata')
+    def test_real_unreaped_child_releases_its_file_descriptors(self):
+        child = subprocess.Popen([sys.executable, '-c', 'pass'])
+        try:
+            os.waitid(os.P_PID, child.pid, os.WEXITED | os.WNOWAIT)
+            process = Path('/proc') / str(child.pid)
+            self.assertTrue(N.exited_process(process))
+            self.assertFalse(scan_process(process))
+        finally:
+            child.wait(timeout=3)
+
+    @unittest.skipUnless(sys.platform == 'linux', 'requires Linux thread-group behavior')
+    def test_zombie_leader_with_living_thread_still_defers(self):
+        script = '''import ctypes,os,sys,threading,time
+ready=threading.Event()
+def owner():
+    with open(sys.argv[1], 'w'):
+        ready.set()
+        time.sleep(10)
+threading.Thread(target=owner).start()
+ready.wait()
+ctypes.CDLL(None).pthread_exit(None)
+'''
+        with tempfile.TemporaryDirectory() as directory:
+            child = subprocess.Popen([sys.executable, '-c', script, str(Path(directory) / 'lock')])
+            try:
+                process = Path('/proc') / str(child.pid)
+                deadline = time.monotonic() + 3
+                while time.monotonic() < deadline:
+                    status = (process / 'status').read_text()
+                    if 'State:\tZ' in status and 'Threads:\t2' in status:
+                        break
+                    time.sleep(0.01)
+                else:
+                    self.fail('fixture did not leave a zombie leader with a living thread')
+                self.assertFalse(N.exited_process(process))
+                with self.assertRaises(Deferred):
+                    scan_process(process)
+            finally:
+                child.kill()
+                child.wait(timeout=3)
+
+
+if __name__ == '__main__':
+    unittest.main()

package/tests/test_codex_mcp_oauth_safety.py

@@ -0,0 +1,130 @@
+#!/usr/bin/env python3
+"""Sharing boundaries and recovery use synthetic machine-local pools only."""
+import json
+import os
+from pathlib import Path
+import sys
+import tempfile
+import subprocess
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / 'lib'))
+import codex_mcp_oauth as M
+from codex_mcp_oauth_store import SENTINEL
+
+ENTRY = {'server_name': 'demo', 'server_url': 'https://example.invalid/mcp',
+         'client_id': 'fake-client', 'access_token': 'fake-access', 'refresh_token': 'fake-refresh'}
+
+
+class SafetyTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        self.account = self.root / 'acct-01'
+        self.account.mkdir()
+        (self.root / 'accounts.json').write_text(json.dumps({'accounts': [{'id': 'acct-01'}]}))
+        self.source = self.account / '.credentials.json'
+        self.source.write_text(json.dumps({'demo|1234': ENTRY}))
+        self.shared = self.root / M.SHARED_DIR
+
+    def test_nonmanifest_and_symlink_accounts_are_never_touched(self):
+        outside = self.root / 'unmanaged'
+        outside.mkdir()
+        self.assertFalse(M.ensure(self.root, outside))
+        self.assertFalse(self.shared.exists())
+        self.source.unlink()
+        self.account.rmdir()
+        self.account.symlink_to(outside, target_is_directory=True)
+        self.assertFalse(M.ensure(self.root, self.account, initialize=True))
+        self.assertEqual(list(outside.iterdir()), [])
+
+    def test_symlink_credentials_and_shared_state_are_refused(self):
+        other = self.root / 'private.json'
+        self.source.rename(other)
+        before = other.read_bytes()
+        self.source.symlink_to(other)
+        self.assertFalse(M.ensure(self.root))
+        self.assertEqual(other.read_bytes(), before)
+        self.source.unlink()
+        other.rename(self.source)
+        outside = self.root / 'outside'
+        outside.mkdir()
+        self.shared.symlink_to(outside, target_is_directory=True)
+        self.assertFalse(M.ensure(self.root))
+        self.assertEqual(list(outside.iterdir()), [])
+
+    def test_shared_canonical_deletion_never_reimports_old_link(self):
+        self.assertTrue(M.ensure(self.root))
+        (self.shared / 'credentials.json').unlink()
+        self.assertTrue(M.ensure(self.root))
+        self.assertEqual(set(json.loads(self.source.read_text())), {SENTINEL})
+        self.assertTrue(M.ensure(self.root))
+        self.assertEqual(set(json.loads(self.source.read_text())), {SENTINEL})
+
+    def test_removed_account_link_clears_shared_document(self):
+        self.assertTrue(M.ensure(self.root))
+        self.source.unlink()
+        self.assertTrue(M.ensure(self.root))
+        self.assertEqual(set(json.loads(self.source.read_text())), {SENTINEL})
+
+    def test_foreign_locks_and_malformed_documents_are_refused(self):
+        foreign = self.root / 'foreign-locks'
+        foreign.mkdir()
+        locks = self.account / 'mcp-oauth-locks'
+        locks.symlink_to(foreign, target_is_directory=True)
+        self.assertFalse(M.ensure(self.root))
+        self.assertEqual(list(foreign.iterdir()), [])
+        locks.unlink()
+        for doc in ([], {'bad': {'access_token': 'secret-do-not-print'}}, {'bad': dict(ENTRY, expires_at='bad')}):
+            self.source.write_text(json.dumps(doc))
+            self.assertFalse(M.ensure(self.root))
+        self.assertFalse(self.shared.exists())
+
+    def test_encrypted_backend_is_refused_unless_explicit_file_store(self):
+        config = self.account / 'config.toml'
+        config.write_text('[features]\nsecret_auth_storage = true\n')
+        self.assertFalse(M.ensure(self.root))
+        self.assertFalse(self.shared.exists())
+        config.write_text('mcp_oauth_credentials_store = "file"\n[features]\nsecret_auth_storage = true\n')
+        self.assertTrue(M.ensure(self.root))
+
+    def test_cli_refusal_reports_only_static_reason(self):
+        binary = self.root / 'codex-fake'
+        binary.write_text('#!/bin/sh\necho "codex-cli 0.163.0"\n')
+        binary.chmod(0o700)
+        self.source.write_text('{"secret-do-not-print": "private-value-do-not-print"}')
+        command = [sys.executable, M.__file__, 'ensure', '--root', str(self.root), '--codex-bin', str(binary)]
+        result = subprocess.run(command, capture_output=True, text=True, check=False)
+        self.assertEqual(result.returncode, 1)
+        self.assertIn('invalid credential entry', result.stderr)
+        self.assertNotIn('private-value', result.stdout + result.stderr)
+        self.assertNotIn('secret-do-not-print', result.stdout + result.stderr)
+        quiet = subprocess.run(command + ['--quiet'], capture_output=True, text=True, check=False)
+        self.assertEqual(quiet.returncode, 1)
+        self.assertEqual(quiet.stdout + quiet.stderr, '')
+
+    def test_failed_link_staging_preserves_original_grant_and_lock_directory(self):
+        other = self.root / 'acct-02'
+        other.mkdir()
+        (self.root / 'accounts.json').write_text(json.dumps({'accounts': [{'id': 'acct-01'}, {'id': 'acct-02'}]}))
+        before = self.source.read_bytes()
+        real_link = os.link
+
+        def reject_destination(source, destination):
+            if Path(destination).parent == other.resolve():
+                raise OSError('synthetic destination failure')
+            return real_link(source, destination)
+
+        with patch('codex_mcp_oauth_store.os.link', side_effect=reject_destination):
+            self.assertFalse(M.ensure(self.root))
+        self.assertEqual(self.source.read_bytes(), before)
+        self.assertFalse((other / '.credentials.json').exists())
+        self.assertFalse((self.account / 'mcp-oauth-locks').is_symlink())
+        self.assertEqual(list(other.glob('.codex-mcp-oauth*')), [])
+        self.assertTrue(M.ensure(self.root))
+
+
+if __name__ == '__main__':
+    unittest.main()

package/tests/test_codex_mcp_oauth_shim.py

@@ -0,0 +1,188 @@
+#!/usr/bin/env python3
+"""Exercise Codex OAuth launch hooks with native-shaped, entirely synthetic state."""
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import time
+import unittest
+
+REPO = Path(__file__).resolve().parents[1]
+SHIM = REPO / 'bin/codex'
+CLI = REPO / 'bin/codex-accounts'
+ENTRY = {'server_name': 'motionsites', 'server_url': 'https://example.invalid/mcp',
+         'client_id': 'fake-client', 'access_token': 'fake-mcp-access', 'refresh_token': 'fake-mcp-refresh',
+         'expires_at': 2000000000000, 'scopes': []}
+DOCUMENT = {'motionsites|0000000000000001': ENTRY}
+REAL = '''#!/bin/sh
+if [ "${1:-}" = --version ]; then
+  echo "codex-cli ${TEST_CODEX_VERSION:-0.163.0}"
+  exit 0
+fi
+printf 'exec %s\n' "${CODEX_HOME##*/}" >> "$EVENT_LOG"
+if [ "$CODEX_HOME/.credentials.json" -ef "$CODEX_ACCOUNTS_ROOT/.codex-mcp-oauth/credentials.json" ]; then
+  echo shared
+else
+  echo private
+fi
+if [ "${TEST_RETRY_ONCE:-0}" = 1 ] && [ ! -e "$RETRY_MARK" ]; then
+  : > "$RETRY_MARK"
+  echo 'usage limit exceeded' >&2
+  exit 1
+fi
+'''
+PYTHON = '''#!/bin/sh
+printf 'python %s\n' "${1##*/}" >> "$EVENT_LOG"
+exec "$REAL_PYTHON" "$@"
+'''
+
+
+class CodexMcpOauthShimTests(unittest.TestCase):
+    def setUp(self):
+        work = tempfile.TemporaryDirectory(prefix='codex-mcp-oauth-shim-')
+        self.addCleanup(work.cleanup)
+        self.work = Path(work.name)
+        self.pool, self.home, self.realbin = [self.work / name for name in ('pool', 'home', 'realbin')]
+        for directory in (self.pool, self.home, self.realbin):
+            directory.mkdir()
+        self.accounts = [self.pool / name for name in ('acct-01', 'acct-02')]
+        manifest = {'version': 1, 'server': 'none', 'accounts': [{'id': p.name} for p in self.accounts]}
+        (self.pool / 'accounts.json').write_text(json.dumps(manifest))
+        for account in self.accounts:
+            account.mkdir()
+            (account / 'auth.json').write_text('{"tokens":{"access_token":"fake-codex-access"}}\n')
+            (account / 'config.toml').write_text('# account settings\nmodel = "kept"\n')
+            (account / 'limits.json').write_text(json.dumps({
+                'fetched_at': int(time.time()), 'weekly_percent': 10, 'session_percent': 10, 'max_percent': 10}))
+        self.credential = self.accounts[0] / '.credentials.json'
+        self.credential.write_text(json.dumps(DOCUMENT))
+        self.events = self.work / 'events.log'
+        for name, script in (('codex', REAL), ('python-log', PYTHON)):
+            executable = self.realbin / name
+            executable.write_text(script)
+            executable.chmod(0o755)
+        self.env = {
+            'PATH': f'{self.realbin}:/usr/bin:/bin:/usr/sbin:/sbin', 'HOME': str(self.home), 'USER': 'tester',
+            'LC_ALL': 'C', 'CODEX_ACCOUNTS_ROOT': str(self.pool), 'EVENT_LOG': str(self.events),
+            'CLAUDE_MULTIACC_PYTHON': str(self.realbin / 'python-log'), 'REAL_PYTHON': sys.executable,
+            'CODEX_MULTIACC_AUTORESUME': '0', 'CODEX_MULTIACC_CLIENT_LIMITS': '0',
+            'CODEX_MULTIACC_PATH_PROBE': '0', 'CODEX_MULTIACC_MODEL_CATALOG': '0',
+            'CLAUDE_MULTIACC_MODEL_CATALOG': '0', 'CODEX_MULTIACC_MCP': '0',
+            'RETRY_MARK': str(self.work / 'retried'), 'PYTHONDONTWRITEBYTECODE': '1',
+        }
+
+    def run_command(self, argv, **environment):
+        self.events.write_text('')
+        result = subprocess.run([str(item) for item in argv], env={**self.env, **environment},
+                                stdin=subprocess.DEVNULL, capture_output=True, text=True, timeout=60)
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        self.assertNotIn('fake-mcp-access', result.stdout + result.stderr)
+        self.assertNotIn('fake-mcp-refresh', result.stdout + result.stderr)
+        return result, self.events.read_text().splitlines()
+
+    def test_pinned_selected_and_nested_clients_receive_shared_state_before_exec(self):
+        modes = ({'CODEX_ACCOUNT': 'acct-02'}, {},
+                 {'CODEX_HOME': str(self.accounts[1]), 'CODEX_SHIM_ACTIVE': '1'})
+        original_auth = [(account / 'auth.json').read_bytes() for account in self.accounts]
+        for environment in modes:
+            with self.subTest(environment=environment):
+                result, events = self.run_command([SHIM, '--help'], **environment)
+                self.assertEqual(result.stdout.strip(), 'shared')
+                self.assertEqual(events[0], 'python codex_mcp_oauth.py')
+                self.assertTrue(events[-1].startswith('exec acct-'))
+                authority = self.pool / '.codex-mcp-oauth/credentials.json'
+                for account, before in zip(self.accounts, original_auth):
+                    self.assertTrue(os.path.samefile(account / '.credentials.json', authority))
+                    self.assertEqual((account / 'mcp-oauth-locks').resolve(), (authority.parent / 'locks').resolve())
+                    self.assertEqual((account / 'auth.json').read_bytes(), before)
+
+    def test_retry_prepares_the_replacement_account_before_running_it(self):
+        result, events = self.run_command([SHIM, 'exec', 'test prompt'], TEST_RETRY_ONCE='1')
+        oauth_and_exec = [line for line in events if line == 'python codex_mcp_oauth.py' or line.startswith('exec ')]
+        self.assertEqual(len(oauth_and_exec), 4, events)
+        self.assertEqual(oauth_and_exec[::2], ['python codex_mcp_oauth.py'] * 2)
+        self.assertNotEqual(oauth_and_exec[1], oauth_and_exec[3])
+        self.assertEqual(result.stdout.strip(), 'shared')
+
+    def test_empty_pool_kill_switch_and_missing_python_preserve_launch(self):
+        self.credential.unlink()
+        result, events = self.run_command([SHIM, '--help'], CODEX_ACCOUNT='acct-02')
+        self.assertEqual((result.stdout.strip(), events), ('private', ['exec acct-02']))
+        self.assertFalse((self.pool / '.codex-mcp-oauth').exists())
+        self.credential.write_text(json.dumps(DOCUMENT))
+        for environment in ({'CODEX_MULTIACC_MCP_OAUTH': '0'}, {'CODEX_MULTIACC_DISABLE': '1',
+                             'CODEX_HOME': str(self.accounts[1])},
+                            {'CLAUDE_MULTIACC_PYTHON': '/nonexistent/python3'}):
+            with self.subTest(environment=environment):
+                result, events = self.run_command([SHIM, '--help'], CODEX_ACCOUNT='acct-02', **environment)
+                self.assertEqual((result.stdout.strip(), events), ('private', ['exec acct-02']))
+                self.assertFalse((self.accounts[1] / '.credentials.json').exists())
+        broken = self.work / 'broken-install'
+        (broken / 'bin').mkdir(parents=True)
+        (broken / 'lib').mkdir()
+        shim = broken / 'bin/codex'
+        shim.write_bytes(SHIM.read_bytes())
+        shim.chmod(0o755)
+        (broken / 'lib/codex_mcp_oauth.sh').write_text('if then invalid shell syntax\n')
+        result, events = self.run_command([shim, '--help'], CODEX_ACCOUNT='acct-02')
+        self.assertEqual((result.stdout.strip(), events), ('private', ['exec acct-02']))
+
+    def test_nested_foreign_and_retired_homes_cannot_initialize_pool_sharing(self):
+        for home in (self.work / 'foreign', self.pool / 'acct-99'):
+            with self.subTest(home=home):
+                home.mkdir()
+                path = home / '.credentials.json'
+                path.write_text('{"outside":"untouched"}\n')
+                before = path.read_bytes()
+                result, _events = self.run_command([SHIM, '--help'], CODEX_HOME=str(home), CODEX_SHIM_ACTIVE='1')
+                self.assertEqual(result.stdout.strip(), 'private')
+                self.assertEqual(path.read_bytes(), before)
+                self.assertFalse((self.pool / '.codex-mcp-oauth').exists())
+                self.assertEqual(json.loads(self.credential.read_text()), DOCUMENT)
+
+    def test_auth_sync_dispatches_and_keeps_cli_arguments(self):
+        result, events = self.run_command([CLI, 'mcp', 'auth-sync', '--quiet'])
+        self.assertEqual(result.stdout, '')
+        self.assertIn('python codex_mcp_oauth.py', events)
+        self.assertTrue(os.path.samefile(self.credential, self.accounts[1] / '.credentials.json'))
+        self.assertTrue((self.accounts[1] / 'mcp-oauth-locks').is_symlink())
+
+    def test_account_seeding_joins_existing_oauth_state(self):
+        command = ['bash', '-c', '. "$1"; seed_account_dir "$2"', 'seed',
+                   REPO / 'lib/common.sh', self.accounts[1]]
+        _result, events = self.run_command(command, MULTIACC_PROVIDER='codex')
+        self.assertIn('python codex_mcp_oauth.py', events)
+        self.assertTrue(os.path.samefile(self.credential, self.accounts[1] / '.credentials.json'))
+        self.assertEqual((self.accounts[1] / 'config.toml').read_text(), '# account settings\nmodel = "kept"\n')
+
+    def test_pool_backstop_joins_every_manifest_account(self):
+        command = ['bash', '-c', '. "$1"; codex_mcp_oauth_ensure "$2" "$3" "$4" "" "$5"', 'backstop',
+                   REPO / 'lib/codex_mcp_oauth.sh', self.pool, self.realbin / 'python-log',
+                   REPO / 'lib/codex_mcp_oauth.py', self.realbin / 'codex']
+        _result, events = self.run_command(command)
+        self.assertEqual(events, ['python codex_mcp_oauth.py'])
+        self.assertTrue(os.path.samefile(self.credential, self.accounts[1] / '.credentials.json'))
+        # A subsequent pass must accept already linked lock dirs, including /var aliases on macOS.
+        newcomer = self.pool / 'acct-03'
+        newcomer.mkdir()
+        manifest_path = self.pool / 'accounts.json'
+        manifest = json.loads(manifest_path.read_text())
+        manifest['accounts'].append({'id': newcomer.name})
+        manifest_path.write_text(json.dumps(manifest))
+        self.run_command(command)
+        self.assertTrue(os.path.samefile(self.credential, newcomer / '.credentials.json'))
+
+    def test_older_native_client_preserves_private_credentials(self):
+        result, events = self.run_command([SHIM, '--help'], CODEX_ACCOUNT='acct-02', TEST_CODEX_VERSION='0.162.0')
+        self.assertEqual(result.stdout.strip(), 'private')
+        self.assertEqual(events, ['python codex_mcp_oauth.py', 'exec acct-02'])
+        self.assertFalse((self.pool / '.codex-mcp-oauth').exists())
+        self.assertEqual(json.loads(self.credential.read_text()), DOCUMENT)
+
+
+if __name__ == '__main__':
+    unittest.main()

package/tests/test_codex_retry_process.py

@@ -0,0 +1,143 @@
+#!/usr/bin/env python3
+"""Buffered Codex retry owns and terminates only its active native child."""
+
+import json
+import os
+from pathlib import Path
+import signal
+import subprocess
+import sys
+import tempfile
+import time
+import unittest
+
+import test_codex_exec_stdin as pipe_fixture
+
+REPO = Path(__file__).resolve().parents[1]
+HELPER = REPO / 'lib/codex_retry_process.sh'
+RUNNER = '''source "$1"
+exec 3< "$2/input"
+fixture_root="$2"
+trap 'printf cleaned > "$fixture_root/exit-cleanup"' EXIT
+trap 'printf restored > "$fixture_root/restored-trap"' TERM
+CODEX_HOME="$2/fake-profile" codex_retry_run "$3" "$2/native.py" "$2" "$4"
+rc=$?
+[ "$4" != restore ] || kill -TERM $$
+exit "$rc"
+'''
+NATIVE = '''import json, os, pathlib, signal, sys, time
+root = pathlib.Path(sys.argv[1])
+mode = sys.argv[2]
+def stop(number, frame):
+    (root / 'stopped').write_text(str(number))
+    sys.exit(0)
+for number in (signal.SIGTERM, signal.SIGINT, signal.SIGHUP):
+    signal.signal(number, stop)
+data = sys.stdin.buffer.read()
+(root / 'received').write_bytes(data)
+(root / 'profile').write_text(os.environ.get('CODEX_HOME', ''))
+(root / 'native.pid').write_text(str(os.getpid()))
+if mode == 'wait':
+    while True:
+        time.sleep(0.05)
+print(json.dumps({'mode': mode}))
+print('native stderr', file=sys.stderr)
+sys.exit(7 if mode == 'fail' else 0)
+'''
+
+
+class CodexRetryProcessTests(unittest.TestCase):
+    def launch(self, mode):
+        temporary = tempfile.TemporaryDirectory(prefix='multiacc-retry-process-')
+        self.addCleanup(temporary.cleanup)
+        root = Path(temporary.name)
+        (root / 'input').write_bytes(b'finite stdin\n\x00\xff')
+        (root / 'native.py').write_text(NATIVE)
+        process = subprocess.Popen(
+            ['bash', '-c', RUNNER, 'retry-test', str(HELPER), str(root), sys.executable, mode],
+            stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+        self.addCleanup(self.cleanup_process, process, root)
+        deadline = time.monotonic() + 5
+        while not (root / 'native.pid').exists() and process.poll() is None and time.monotonic() < deadline:
+            time.sleep(0.02)
+        self.assertTrue((root / 'native.pid').exists(), 'owned native child did not launch')
+        return process, root
+
+    def cleanup_process(self, process, root):
+        # Only this fixture's owned native PID; ordinary assertions verify it was
+        # already reaped. A regression must not leave a sleeping fake behind.
+        if process.poll() is None:
+            process.terminate()
+        pid_file = root / 'native.pid'
+        if pid_file.exists():
+            try:
+                os.kill(int(pid_file.read_text()), signal.SIGTERM)
+            except ProcessLookupError:
+                pass
+        try:
+            process.communicate(timeout=3)
+        except subprocess.TimeoutExpired:
+            process.kill()
+            process.communicate(timeout=3)
+
+    def test_termination_signals_reach_and_reap_only_the_owned_native_child(self):
+        for number in (signal.SIGTERM, signal.SIGINT, signal.SIGHUP):
+            with self.subTest(signal=number):
+                process, root = self.launch('wait')
+                process.send_signal(number)
+                process.communicate(timeout=3)
+                self.assertEqual(process.returncode, 128 + number)
+                self.assertEqual(int((root / 'stopped').read_text()), number)
+                with self.assertRaises(ProcessLookupError):
+                    os.kill(int((root / 'native.pid').read_text()), 0)
+                self.assertEqual((root / 'exit-cleanup').read_text(), 'cleaned')
+
+    def test_success_failure_and_prior_traps_are_preserved(self):
+        for mode, expected in [('success', 0), ('fail', 7), ('restore', 0)]:
+            with self.subTest(mode=mode):
+                process, root = self.launch(mode)
+                stdout, stderr = process.communicate(timeout=3)
+                self.assertEqual(process.returncode, expected)
+                self.assertEqual(json.loads(stdout), {'mode': mode})
+                self.assertEqual(stderr, b'native stderr\n')
+                self.assertEqual((root / 'received').read_bytes(), (root / 'input').read_bytes())
+                self.assertEqual((root / 'profile').read_text(), str(root / 'fake-profile'))
+                self.assertEqual((root / 'exit-cleanup').read_text(), 'cleaned')
+                if mode == 'restore':
+                    self.assertEqual((root / 'restored-trap').read_text(), 'restored')
+
+    def test_actual_shim_pipe_cancellation_reaps_native_without_retry_or_scratch(self):
+        fixture = pipe_fixture.CodexExecStdinTests()
+        fixture.setUp()
+        self.addCleanup(fixture.doCleanups)
+        root = fixture.root
+        native = NATIVE.replace('root = pathlib.Path(sys.argv[1])',
+                                "root = pathlib.Path(os.environ['FAKE_ROOT'])\n"
+                                "with (root / 'attempts').open('a') as handle: handle.write('attempt\\n')")
+        native = native.replace('mode = sys.argv[2]', "mode = 'wait'")
+        (root / 'bin/codex').write_text(f'#!{sys.executable}\n' + native)
+        process = subprocess.Popen([str(REPO / 'bin/codex'), *fixture.args], env=fixture.env,
+                                   stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+        self.addCleanup(self.cleanup_process, process, root)
+        process.stdin.write(pipe_fixture.PROMPT)
+        process.stdin.close()
+        process.stdin = None
+        deadline = time.monotonic() + 5
+        while not (root / 'native.pid').exists() and process.poll() is None and time.monotonic() < deadline:
+            time.sleep(0.02)
+        self.assertTrue((root / 'native.pid').exists(), 'shim did not launch native child')
+        process.send_signal(signal.SIGTERM)
+        process.communicate(timeout=3)
+        self.assertEqual(process.returncode, 143)
+        self.assertEqual(int((root / 'stopped').read_text()), signal.SIGTERM)
+        with self.assertRaises(ProcessLookupError):
+            os.kill(int((root / 'native.pid').read_text()), 0)
+        self.assertEqual((root / 'attempts').read_text(), 'attempt\n')
+        self.assertEqual((root / 'received').read_bytes(), pipe_fixture.PROMPT)
+        self.assertEqual(list(fixture.pool.glob('tmp/shim.*')), [])
+        self.assertNotIn('retry from=', (fixture.pool / 'selection.log').read_text())
+        self.assertFalse((fixture.pool / 'acct-01/.limited').exists())
+
+
+if __name__ == '__main__':
+    unittest.main()