relay-codex 0.7.3 → 0.7.4

package/docs/publishing.md

@@ -8,8 +8,8 @@ Friends can run `npx relay-codex` or install it with `npm install -g relay-codex
 The GitHub repository is enough for friends to install or try Relay:
 
 ```sh
-npm install -g github:blackspider-ops/relay#v0.7.3
-npx --yes github:blackspider-ops/relay#v0.7.3 --version
+npm install -g github:blackspider-ops/relay#v0.7.4
+npx --yes github:blackspider-ops/relay#v0.7.4 --version
 ```
 
 `npx` runs packages; it is not a separate publishing service. Publishing

package/docs/troubleshooting.md

@@ -51,13 +51,22 @@ visible. Use Restart for a stopped worker rather than sending it live controls.
 
 **A usage-limit panel remains open and Relay says “waiting for activity.”**
 
-Update Relay if you are using a version older than 0.7.3. A missed tool-completion
-notification could leave a finished tool marked as active. Relay now checks full
-native history for the matching tool before continuing account recovery. It keeps
+Update Relay if you are using a version older than 0.7.4. Background terminals
+and missed tool notifications could leave a finished turn marked as active.
+Relay checks native history and the current backend's status. Commands explicitly
+listed by Codex as background terminals can keep running while accounts change
+after the model turn ends. The usage panel does not need to be clicked. Relay keeps
 waiting when work is still running or completion cannot be verified; approvals
 and paused recovery still need attention. Existing workers retain the code they
 started with, so an update takes effect after that worker is relaunched.
 
+**Codex says “auth refresh request failed: code=-32000.”**
+
+Relay retries authentication on its normal retry schedule, then tries another
+available account. If Codex reports that a refresh token was revoked, sign in
+again with `relay account reauth LABEL`. Switch any sessions using that account
+first. A revoked login cannot be repaired by retrying the same token.
+
 **Tab completion is missing.**
 
 Load `source <(relay completion zsh)` after `compinit`, or use

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "relay-codex",
-  "version": "0.7.3",
+  "version": "0.7.4",
   "description": "Keep your Codex sessions moving between your own accounts.",
   "license": "MIT",
   "author": "blackspider-ops",

package/python/broker.py

@@ -225,6 +225,11 @@ async def serve(state, binary):
                                     ):
                                         value = candidate
                                 if value is None:
+                                    if request.get("refresh"):
+                                        # A retained native manager can hold a refresh
+                                        # grant rotated by another process. Reload the
+                                        # Keychain under this account's shared lock.
+                                        await account.close()
                                     await account.start()
                                     result = await account.rpc.call(
                                         "account/read",

package/python/execution.py

@@ -350,7 +350,7 @@ async def _run(args, state, binary):
         controller.launch_overrides = overrides
         controller.client = output
         output.controller = controller
-        backend.handler = controller.event
+        backend.handler = lambda message: controller.event(message, origin=backend)
         init = await backend.initialize()
         heartbeat = asyncio.create_task(controller.maintain())
         model = values.get("--model")

package/python/pool.py

@@ -545,6 +545,13 @@ CAPACITY_MESSAGE = "Selected model is at capacity. Please try a different model.
 
 
 def failure_kind(info, message=None):
+    if (
+        info in (None, "other", "unauthorized")
+        and isinstance(message, str)
+        and message.strip().removeprefix("■").strip().lower()
+        == "auth refresh request failed: code=-32000"
+    ):
+        return "auth"
     if info == "policyCapacityUnavailable":
         return "capacity"
     # Older/generic error envelopes can omit the enum. Match only the known

package/python/router.py

@@ -24,7 +24,7 @@ from pool import Pool, blocked, reset_time, failure_kind, file_lock
 from launch import translate, RESUME_FIELDS
 import settings
 
-VERSION = "0.7.3"
+VERSION = "0.7.4"
 _support = Path.home() / "Library/Application Support"
 _legacy = _support / "Codex Accounts"
 _default_state = _legacy if (_legacy / "accounts").exists() else _support / "Relay"
@@ -95,6 +95,17 @@ def clean_env(home: Path) -> dict:
     return env
 
 
+def rejected_failure_kind(payload):
+    if payload.get("code") == -32001:
+        return "transient"
+    if (
+        payload.get("code") in {-32000, -32603}
+        and failure_kind("other", payload.get("message")) == "auth"
+    ):
+        return "auth"
+    return None
+
+
 def codex_path() -> str:
     path = shutil.which("codex")
     if not path:
@@ -193,6 +204,9 @@ class RPC:
         self.reader = asyncio.create_task(self.read_loop())
         self.startup_guard = None
 
+    def disconnected(self):
+        return self.proc.returncode is not None or self.reader.done()
+
     @classmethod
     async def start(
         cls, binary: str, home: Path, *, helper=False, handler=None, extra_args=None
@@ -330,7 +344,7 @@ class Account:
         self.lock = asyncio.Lock()
 
     async def start(self):
-        if self.rpc and self.rpc.proc.returncode is not None:
+        if self.rpc and self.rpc.disconnected():
             await self.rpc.close()
             self.rpc = None
         if not self.rpc:
@@ -384,6 +398,7 @@ class Account:
     async def close(self):
         if self.rpc:
             await self.rpc.close()
+            self.rpc = None
 
 
 class Controller:
@@ -433,9 +448,11 @@ class Controller:
         self.turn_ids = {}
         self.recovery_jobs = {}
         self.pending_intents = {}
+        self.rejected_turns = {}
         self.active_items = set()
         self.active_item_threads = {}
         self.item_revision = 0
+        self.auth_account = None
         self.backend_factory = None
         self.restart_lock = asyncio.Lock()
         self.restart_task = None
@@ -675,6 +692,7 @@ class Controller:
                         model=next((self.model_for(t) for t in self.last_turn), None),
                         paused=self.paused,
                         background=self.background,
+                        activity=self.activity_snapshot(),
                     )
                     last_heartbeat = now
                 new_revision = self.pool.revision()
@@ -743,7 +761,7 @@ class Controller:
                     pass
             if now - last_watch >= self.preferences["watchdog_interval"]:
                 last_watch = now
-                if self.backend.proc.returncode is not None and self.backend_factory:
+                if self.backend_disconnected() and self.backend_factory:
                     if not self.restart_task or self.restart_task.done():
                         self.restart_task = asyncio.create_task(self.restart_backend())
                 elif self.active_threads:
@@ -805,6 +823,7 @@ class Controller:
             )
             if index is None:
                 raise ControlRejected("unknown_account")
+            await self.reconcile_active_items()
             if self.active_threads or self.active_items or self.server_requests:
                 raise ControlRejected("busy")
             options = self.pool.options(label) if self.pool else {}
@@ -859,20 +878,24 @@ class Controller:
 
     async def restart_backend(self):
         async with self.restart_lock:
-            if self.backend.proc.returncode is None:
+            if not self.backend_disconnected():
                 return
             self.note("restarting")
             in_flight = bool(self.active_items or self.server_requests)
             old = self.backend
+            old_auth_account = self.auth_account
             candidate = None
             try:
                 candidate = await self.backend_factory()
-                candidate.handler = self.event
+                candidate.handler = lambda message: self.event(
+                    message, origin=candidate
+                )
                 await candidate.initialize()
                 self.backend = candidate
                 await self.login(self.index)
             except Exception:
                 self.backend = old
+                self.auth_account = old_auth_account
                 if candidate:
                     await candidate.close()
                 self.note("backend_restart_failed", reason="startup_or_login_failed")
@@ -966,9 +989,17 @@ class Controller:
                     )
                 ):
                     raise ControlRejected("account_unavailable")
-            await self.backend.call(
-                "account/login/start", {"type": "chatgptAuthTokens", **credentials}
-            )
+            # Native refresh callbacks can arrive before the login response.
+            # Bind them to the credentials being installed, not the old index.
+            previous_binding = self.auth_account
+            self.auth_account = self.accounts[index]
+            try:
+                await self.backend.call(
+                    "account/login/start", {"type": "chatgptAuthTokens", **credentials}
+                )
+            except RemoteError:
+                self.auth_account = previous_binding
+                raise
             self.index = index
             # Acceptance of token syntax alone isn't a verified, usable login.
             result = await self.backend.call("account/read", {"refreshToken": False})
@@ -984,25 +1015,34 @@ class Controller:
             except Exception:
                 pass
 
-    async def event(self, message):
+    async def event(self, message, *, origin=None):
+        if origin is not None and origin is not self.backend:
+            return
         method, params = message.get("method"), message.get("params", {})
         if method == "account/chatgptAuthTokens/refresh":
+            account = self.auth_account or self.account
+            transport = self.backend
             try:
                 # Never return another identity in response to a refresh request.
-                credentials = await self.account.credentials(refresh=True)
+                credentials = await account.credentials(refresh=True)
                 previous = params.get("previousAccountId")
                 if previous and previous != credentials["chatgptAccountId"]:
                     raise RouterError(
                         "Refresh account mismatch; re-enroll the account."
                     )
-                await self.backend.send({"id": message["id"], "result": credentials})
+                if transport is not self.backend:
+                    return
+                await transport.send({"id": message["id"], "result": credentials})
             except (RouterError, asyncio.TimeoutError):
-                await self.backend.send(
+                if transport is not self.backend:
+                    return
+                self.note("auth_refresh_failed", account=account.label)
+                await transport.send(
                     {
                         "id": message["id"],
                         "error": {
                             "code": -32000,
-                            "message": "Account requires sign-in.",
+                            "message": "Account credentials could not be refreshed. Relay will retry after this turn ends.",
                         },
                     }
                 )
@@ -1024,6 +1064,7 @@ class Controller:
             if self.pool and thread.get("id"):
                 self.pool.claim(thread["id"])
         if method == "turn/started":
+            self.rejected_turns.pop(params["threadId"], None)
             self.active_threads.add(params["threadId"])
             self.turn_ids[params["threadId"]] = params.get("turn", {}).get("id")
             if params["threadId"] in self.pending_intents:
@@ -1034,6 +1075,7 @@ class Controller:
                 accepted=True,
                 turn=params.get("turn", {}).get("id"),
                 state="working",
+                rejected=False,
             )
         elif method == "item/started" and params.get("item", {}).get("type") in {
             "commandExecution",
@@ -1206,7 +1248,9 @@ class Controller:
                         await self.reconcile(thread)
                 if time.monotonic() - began > self.preferences["idle_warning_after"]:
                     self.note(
-                        "waiting_for_activity", reason="actions_or_approvals_not_idle"
+                        "waiting_for_activity",
+                        reason="actions_or_approvals_not_idle",
+                        activity=self.activity_snapshot(),
                     )
             if self.paused:
                 self.wake.clear()
@@ -1217,7 +1261,7 @@ class Controller:
         return generation == self.user_generation and self.attached()
 
     async def reconcile_active_items(self):
-        """Retire missed completion events only from matching, full native history."""
+        """Reconcile finished actions and native background jobs at idle boundaries."""
         owners = dict(self.active_item_threads)
         revision = self.item_revision
         for thread in set(owners.values()):
@@ -1226,6 +1270,10 @@ class Controller:
                 for item, owner in owners.items()
                 if owner == thread and item in self.active_items
             }
+            if not pending:
+                continue
+            await self.reconcile_background_activity(thread, pending, revision)
+            pending &= self.active_items
             if not pending:
                 continue
             cursor = None
@@ -1279,6 +1327,103 @@ class Controller:
                     break
                 visited.add(cursor)
 
+    def backend_disconnected(self):
+        check = getattr(self.backend, "disconnected", None)
+        return (
+            check()
+            if check
+            else getattr(getattr(self.backend, "proc", None), "returncode", None)
+            is not None
+        )
+
+    def activity_snapshot(self):
+        """Private diagnostic metadata; never tool arguments or credentials."""
+        return {
+            "threads": sorted(self.active_threads),
+            "items": sorted(self.active_items),
+            "owners": dict(self.active_item_threads),
+            "requests": sorted(
+                {
+                    m.get("method", "unknown")
+                    for m in self.pending_server_requests.values()
+                }
+            ),
+            "request_count": len(self.server_requests),
+            "paused": self.paused,
+            "disconnected": self.backend_disconnected(),
+        }
+
+    async def reconcile_background_activity(self, thread, pending, revision):
+        """After a turn ends, known background terminals need not block login.
+
+        These jobs remain alive in the same backend. Unknown tools and pending
+        approvals still block recovery; a terminal turn alone cannot clear them.
+        """
+        turn_id = self.turn_ids.get(thread)
+        generation = self.user_generation
+        if not turn_id or self.server_requests:
+            return
+        try:
+            turn = await self.latest(thread) or {}
+            if turn.get("id") != turn_id or turn.get("status") not in {
+                "completed",
+                "failed",
+                "interrupted",
+            }:
+                return
+            background = set()
+            cursor = None
+            visited = set()
+            for _ in range(8):
+                params = {"threadId": thread, "limit": 100}
+                if cursor:
+                    params["cursor"] = cursor
+                result = await self.backend.call(
+                    "thread/backgroundTerminals/list", params, timeout=15
+                )
+                background.update(item.get("itemId") for item in result.get("data", []))
+                cursor = result.get("nextCursor")
+                if not cursor or cursor in visited or pending <= background:
+                    break
+                visited.add(cursor)
+            if not pending & background:
+                return
+            info = await self.backend.call(
+                "thread/read", {"threadId": thread}, timeout=15
+            )
+        except (RouterError, asyncio.TimeoutError):
+            return
+        if (
+            revision != self.item_revision
+            or generation != self.user_generation
+            or self.turn_ids.get(thread) != turn_id
+            or self.server_requests
+            or info.get("thread", {}).get("status", {}).get("type")
+            not in {"idle", "systemError"}
+            or info.get("thread", {}).get("canAcceptDirectInput") is False
+        ):
+            return
+        cleared = {
+            item
+            for item in pending & background
+            if self.active_item_threads.get(item) == thread
+            and item in self.active_items
+        }
+        for item in cleared:
+            self.active_items.discard(item)
+            self.active_item_threads.pop(item, None)
+        if cleared:
+            self.active_threads.discard(thread)
+            self.persist(thread, active_items=bool(self.active_items))
+            if self.pool:
+                self.pool.record(
+                    "background_activity_reconciled",
+                    count=len(cleared),
+                    thread=thread,
+                    turn=turn_id,
+                )
+            self.status_changed.set()
+
     async def continue_thread(self, thread, generation):
         if not self.can_continue(thread, generation):
             return
@@ -1295,6 +1440,19 @@ class Controller:
                 params[key] = self.thread_settings[thread][key]
         params["clientUserMessageId"] = str(uuid.uuid4())
         baseline = self.turn_ids.get(thread) or "__unknown_before_submission__"
+        rejected = self.rejected_turns.get(thread)
+        if rejected:
+            baseline = rejected["baseline"]
+            try:
+                latest = await self.latest(thread)
+            except (RouterError, asyncio.TimeoutError):
+                self.hold_for_review(thread, "rejected_request_history_unavailable")
+                return
+            observed = (latest or {}).get("id") or "__unknown_before_submission__"
+            if observed != baseline:
+                self.hold_for_review(thread, "rejected_request_history_changed")
+                return
+            params = dict(rejected["params"])
         try:
             while True:
                 async with self.login_lock:
@@ -1312,6 +1470,7 @@ class Controller:
                             accepted=False,
                             state="submitting",
                             baseline=baseline,
+                            rejected=bool(rejected),
                         )
                         result = await self.backend.call("turn/start", params)
                         break
@@ -1319,6 +1478,7 @@ class Controller:
                     return
             turn = result.get("turn", {})
             if turn.get("id"):
+                self.rejected_turns.pop(thread, None)
                 self.turn_ids[thread] = turn["id"]
                 self.pending_intents[thread]["accepted"] = True
                 self.persist(
@@ -1326,18 +1486,35 @@ class Controller:
                     accepted=True,
                     turn=turn["id"],
                     state=turn.get("status", "working"),
+                    rejected=False,
                 )
         except RemoteError as error:
-            if error.payload.get("code") == -32001:
-                return await self.recover(thread, generation, "transient")
+            kind = rejected_failure_kind(error.payload)
+            if kind:
+                if self.pending_intents.get(thread, {}).get("accepted"):
+                    return await self.uncertain(thread, generation, baseline)
+                self.remember_rejected(thread, params, baseline)
+                return await self.recover(thread, generation, kind)
             raise
         except (RouterError, asyncio.TimeoutError):
             return await self.uncertain(thread, generation, baseline)
         self.report(f"Continued the saved thread with {self.account_name()}.")
 
+    def remember_rejected(self, thread, params, baseline):
+        # Only explicit pre-acceptance rejections qualify. Keep the original
+        # input in memory; a worker restart requires resubmission, not a guess.
+        self.rejected_turns[thread] = {
+            "params": dict(params),
+            "baseline": baseline or "__unknown_before_submission__",
+        }
+        self.persist(thread, rejected=True)
+
     async def restore_recovery(self, thread, persisted):
         """Honor an accepted retry's original deadline after a process restart."""
         generation = self.user_generation
+        if persisted.get("rejected"):
+            self.hold_for_review(thread, "rejected_request_requires_resubmission")
+            return
         if persisted.get("review_required"):
             self.hold_for_review(
                 thread, persisted.get("review_reason") or "review_required"
@@ -1703,6 +1880,7 @@ class Controller:
                 self.fallback_tried.pop(message["params"]["threadId"], None)
             self.status_changed.set()
             if method == "turn/start":
+                self.rejected_turns.pop(message["params"]["threadId"], None)
                 self.clear_review(message["params"]["threadId"])
                 self.last_turn[message["params"]["threadId"]] = message["params"]
                 self.merge_settings(message["params"]["threadId"], message["params"])
@@ -1768,6 +1946,7 @@ class Controller:
                         accepted=False,
                         baseline=self.turn_ids.get(thread),
                         state="submitting",
+                        rejected=False,
                     )
                 async with guard:
                     result = await self.backend.call(
@@ -1834,13 +2013,22 @@ class Controller:
             await self.emit({"id": request_id, "error": error.payload})
             # Ingress overload rejects a turn before a turn/completed event
             # exists. Its documented code is explicit, not message matching.
-            if method == "turn/start" and error.payload.get("code") == -32001:
+            kind = rejected_failure_kind(error.payload)
+            if method == "turn/start" and kind:
                 if self.recovery and not self.recovery.done():
                     self.recovery.cancel()
                 thread = message["params"]["threadId"]
-                self.recovery = asyncio.create_task(
-                    self.recover(thread, self.user_generation, "transient")
-                )
+                intent = self.pending_intents.get(thread, {})
+                baseline = intent.get("baseline", "__unknown_before_submission__")
+                if intent.get("accepted"):
+                    self.recovery = asyncio.create_task(
+                        self.uncertain(thread, self.user_generation, baseline)
+                    )
+                else:
+                    self.remember_rejected(thread, message["params"], baseline)
+                    self.recovery = asyncio.create_task(
+                        self.recover(thread, self.user_generation, kind)
+                    )
         except (RouterError, asyncio.TimeoutError):
             await self.emit(
                 {

package/python/service.py

@@ -376,7 +376,12 @@ def restart(state, prefix):
     spec = json.loads(path.read_text())
     if not Path(spec["cwd"]).is_dir():
         raise RouterError("The project folder no longer exists")
-    spec.update(state="starting", background_launch=True, foreground_owner=None)
+    spec.update(
+        state="starting",
+        background_launch=True,
+        foreground_owner=None,
+        relay_runtime=str(Path(__file__).parent.resolve()),
+    )
     spec.pop("last_error", None)
     atomic_json(path, spec)
     process = spawn(
@@ -534,7 +539,7 @@ async def _serve(state, ident, binary):
     controller.retry_interval = controller.preferences["retry_interval"]
     controller.retry_attempts = controller.preferences["retry_attempts"]
     controller.interval = controller.preferences["unknown_reset_interval"]
-    backend.handler = controller.event
+    backend.handler = lambda message: controller.event(message, origin=backend)
     heartbeat = asyncio.create_task(controller.maintain())
     connection = root / (ident + ".connection.json")
     try:
@@ -717,7 +722,7 @@ async def _serve(state, ident, binary):
                     if not persisted.get("accepted")
                     else None,
                 )
-                if state_name == "completed":
+                if state_name == "completed" and not persisted.get("rejected"):
                     controller.persist(
                         thread_id,
                         state="completed",
@@ -729,6 +734,7 @@ async def _serve(state, ident, binary):
                     )
                 elif (
                     persisted.get("review_required")
+                    or persisted.get("rejected")
                     or persisted.get("active_items")
                     or not persisted.get("accepted")
                 ):

package/tests/fake_native.py

@@ -128,6 +128,12 @@ for raw in sys.stdin:
             result = {"account": {"type": "chatgpt", "planType": "plus"}}
         elif method == "account/login/start":
             result = {"type": params["type"]}
+            send(
+                {
+                    "method": "account/updated",
+                    "params": {"authMode": "chatgptAuthTokens", "planType": "plus"},
+                }
+            )
         elif method == "account/rateLimits/read":
             reset_count = change(lambda d: d.get("reset_credit_count", 1))
             weekly = change(
@@ -215,6 +221,12 @@ for raw in sys.stdin:
                 value["itemsView"] = params.get("itemsView", "summary")
         elif method == "thread/loaded/list":
             result = {"data": change(lambda d: list(d["threads"]))}
+        elif method == "thread/backgroundTerminals/list":
+            result = {
+                "data": change(
+                    lambda d: d.get("backgrounds", {}).get(params["threadId"], [])
+                )
+            }
         elif method in {"turn/start", "review/start"}:
             thread = params["threadId"]
             turn = str(uuid.uuid4())
@@ -263,6 +275,28 @@ for raw in sys.stdin:
                         "params": {"threadId": thread, "item": tool},
                     }
                 )
+            if count <= fault.get("background_activity_turns", 0):
+                item_id = "background-" + turn
+                change(
+                    lambda d: (
+                        d.setdefault("backgrounds", {})
+                        .setdefault(thread, [])
+                        .append({"itemId": item_id, "processId": "test-background-job"})
+                    )
+                )
+                send(
+                    {
+                        "method": "item/started",
+                        "params": {
+                            "threadId": thread,
+                            "item": {
+                                "id": item_id,
+                                "type": "commandExecution",
+                                "status": "inProgress",
+                            },
+                        },
+                    }
+                )
             if fault.get("external"):
                 send(
                     {

package/tests/test_recovery_boundary.py

@@ -0,0 +1,422 @@
+"""Quota recovery at native idle boundaries and account refresh races."""
+
+import asyncio
+import json
+from pathlib import Path
+import tempfile
+import unittest
+from unittest.mock import patch
+import sys
+
+from pool import failure_kind
+from router import Controller, RemoteError, RouterError, RPC
+from settings import atomic_json
+from test_router import FakeAccount, FakeBackend, FakeClient, completed
+from test_services import fake_executable, wait_for
+from test_pool import Clock
+
+
+class BoundaryTests(unittest.IsolatedAsyncioTestCase):
+    def controller(
+        self,
+        *,
+        status="systemError",
+        turn_status="failed",
+        tool_status="completed",
+        backgrounds=True,
+    ):
+        c = Controller(
+            [FakeAccount("one"), FakeAccount("two")],
+            FakeBackend(),
+            report=lambda _: None,
+        )
+        c.client = FakeClient()
+        c.last_turn["thread-1"] = {"threadId": "thread-1"}
+        c.turn_ids["thread-1"] = "turn-1"
+        c.active_items.add("orphaned-lifecycle-id")
+        c.active_item_threads["orphaned-lifecycle-id"] = "thread-1"
+        original = c.backend.call
+
+        async def call(method, params=None, **kw):
+            if method == "thread/backgroundTerminals/list":
+                return {
+                    "data": [
+                        {
+                            "itemId": "orphaned-lifecycle-id",
+                            "processId": "background-job",
+                        }
+                    ]
+                    if backgrounds
+                    else []
+                }
+            if method == "thread/turns/list":
+                return {
+                    "data": [
+                        {
+                            "id": "turn-1",
+                            "status": turn_status,
+                            "itemsView": "full",
+                            "items": [
+                                {
+                                    "id": "persisted-action",
+                                    "type": "commandExecution",
+                                    "status": tool_status,
+                                }
+                            ],
+                        }
+                    ]
+                }
+            if method == "thread/read":
+                return {
+                    "thread": {"status": {"type": status}, "canAcceptDirectInput": True}
+                }
+            return await original(method, params, **kw)
+
+        c.backend.call = call
+        return c
+
+    async def test_known_background_terminal_unblocks_quota_without_replaying_request(
+        self,
+    ):
+        c = self.controller()
+        await c.event(completed())
+        await asyncio.wait_for(c.recovery, 1)
+        self.assertFalse(c.active_items)
+        self.assertEqual(c.account.label, "two")
+        starts = [p for m, p in c.backend.calls if m == "turn/start"]
+        self.assertEqual(len(starts), 1)
+        self.assertEqual(starts[0]["threadId"], "thread-1")
+
+    async def test_active_or_incomplete_native_work_still_blocks(self):
+        for options in (
+            {"status": "active"},
+            {"status": "notLoaded"},
+            {"turn_status": "inProgress"},
+            {"tool_status": "inProgress", "backgrounds": False},
+            {"tool_status": None, "backgrounds": False},
+            {"backgrounds": False},
+        ):
+            with self.subTest(options=options):
+                c = self.controller(**options)
+                await c.reconcile_active_items()
+                self.assertTrue(c.active_items)
+
+    async def test_manual_switch_keeps_known_background_job_without_new_turn(self):
+        c = self.controller()
+        await c.control("switch", {"account": "two"})
+        self.assertEqual(c.account.label, "two")
+        self.assertFalse(c.active_items)
+        self.assertFalse(any(m == "turn/start" for m, _ in c.backend.calls))
+
+    async def test_pending_approval_and_different_current_turn_still_block(self):
+        for blocker in ("approval", "different-turn"):
+            c = self.controller()
+            if blocker == "approval":
+                c.server_requests.add(99)
+            else:
+                c.turn_ids["thread-1"] = "newer-turn"
+            await c.reconcile_active_items()
+            self.assertTrue(c.active_items)
+
+    async def test_new_user_work_during_status_read_invalidates_boundary(self):
+        c = self.controller()
+        original = c.backend.call
+
+        async def call(method, params=None, **kw):
+            result = await original(method, params, **kw)
+            if method == "thread/read":
+                c.user_generation += 1
+            return result
+
+        c.backend.call = call
+        await c.reconcile_active_items()
+        self.assertTrue(c.active_items)
+
+    async def test_refresh_callback_during_login_uses_new_account(self):
+        c = self.controller()
+        original = c.backend.call
+
+        async def call(method, params=None, **kw):
+            if method == "account/login/start":
+                await c.event(
+                    {
+                        "id": "refresh",
+                        "method": "account/chatgptAuthTokens/refresh",
+                        "params": {"previousAccountId": "two"},
+                    }
+                )
+            return await original(method, params, **kw)
+
+        c.backend.call = call
+        await asyncio.wait_for(c.login(1), 1)
+        self.assertEqual(c.backend.sent[-1]["result"]["chatgptAccountId"], "two")
+        self.assertFalse(c.client.messages)
+
+    async def test_failed_refresh_is_private_and_classified_for_auth_retry(self):
+        c = self.controller()
+
+        async def failed(refresh=False):
+            raise RouterError("PRIVATE_EXCEPTION_DETAIL")
+
+        c.accounts[0].credentials = failed
+        await c.event(
+            {"id": 3, "method": "account/chatgptAuthTokens/refresh", "params": {}}
+        )
+        self.assertEqual(c.backend.sent[-1]["error"]["code"], -32000)
+        self.assertNotIn("PRIVATE_EXCEPTION_DETAIL", json.dumps(c.backend.sent))
+        self.assertFalse(c.client.messages)
+        self.assertEqual(
+            failure_kind("other", "Auth refresh request failed: code=-32000"), "auth"
+        )
+        self.assertIsNone(
+            failure_kind("badRequest", "Auth refresh request failed: code=-32000")
+        )
+        self.assertIsNone(
+            failure_kind("other", "unrelated request failed: code=-32000")
+        )
+
+    async def test_refresh_from_replaced_backend_cannot_reach_new_connection(self):
+        c = self.controller()
+        old = c.backend
+
+        async def rotating(refresh=False):
+            c.backend = FakeBackend()
+            return {"accessToken": "FAKE", "chatgptAccountId": "one"}
+
+        c.account.credentials = rotating
+        await c.event(
+            {"id": 12, "method": "account/chatgptAuthTokens/refresh", "params": {}},
+            origin=old,
+        )
+        self.assertFalse(c.backend.sent)
+        self.assertFalse(old.sent)
+        await c.event(completed(), origin=old)
+        self.assertIsNone(c.recovery)
+
+    async def test_auth_rejection_before_acceptance_retries_original_input_once(self):
+        c = self.controller()
+        c.active_items.clear()
+        c.active_item_threads.clear()
+        clock = Clock()
+        c.clock, c.sleep = clock, clock.sleep
+        c.retry_interval = 300
+        original = c.backend.call
+        requests = []
+
+        async def call(method, params=None, **kw):
+            if method == "turn/start":
+                requests.append(dict(params))
+                if len(requests) == 1:
+                    raise RemoteError(
+                        {
+                            "code": -32603,
+                            "message": "auth refresh request failed: code=-32000",
+                        }
+                    )
+                return {"turn": {"id": "accepted-turn", "status": "inProgress"}}
+            return await original(method, params, **kw)
+
+        c.backend.call = call
+        await c.forward(
+            {
+                "id": 1,
+                "method": "turn/start",
+                "params": {
+                    "threadId": "thread-1",
+                    "input": [
+                        {
+                            "type": "text",
+                            "text": "UNIQUE_NEW_REQUEST",
+                            "text_elements": [],
+                        }
+                    ],
+                },
+            },
+            {},
+        )
+        await asyncio.wait_for(c.recovery, 1)
+        self.assertEqual(len(requests), 2)
+        self.assertEqual(requests[0]["input"], requests[1]["input"])
+        self.assertEqual(
+            requests[0]["clientUserMessageId"], requests[1]["clientUserMessageId"]
+        )
+        self.assertEqual(c.account.label, "one")
+        self.assertFalse(c.rejected_turns)
+        self.assertEqual(c.turn_ids["thread-1"], "accepted-turn")
+
+    async def test_changed_history_prevents_replay_of_rejected_input(self):
+        c = self.controller()
+        c.active_items.clear()
+        c.remember_rejected(
+            "thread-1", {"threadId": "thread-1", "input": []}, "older-turn"
+        )
+        await c.continue_thread("thread-1", 0)
+        self.assertIn("thread-1", c.paused_uncertain)
+        self.assertFalse(any(m == "turn/start" for m, _ in c.backend.calls))
+
+    async def test_worker_restart_does_not_guess_rejected_prompt(self):
+        c = self.controller()
+        await c.restore_recovery(
+            "thread-1",
+            {"rejected": True, "accepted": False, "state": "retry_scheduled"},
+        )
+        self.assertIn("thread-1", c.paused_uncertain)
+        self.assertFalse(any(m == "turn/start" for m, _ in c.backend.calls))
+
+    async def test_watchdog_detects_eof_while_native_process_is_still_alive(self):
+        proc = await asyncio.create_subprocess_exec(
+            sys.executable,
+            "-c",
+            "import os,time; os.close(1); time.sleep(30)",
+            stdin=asyncio.subprocess.PIPE,
+            stdout=asyncio.subprocess.PIPE,
+        )
+        rpc = RPC(proc)
+        c = Controller([FakeAccount("one")], rpc, report=lambda _: None)
+        c.backend_factory = lambda: None
+        restarted = []
+
+        async def restart():
+            restarted.append(True)
+            c.stopping.set()
+
+        c.restart_backend = restart
+        try:
+            await asyncio.wait_for(asyncio.shield(rpc.reader), 3)
+            self.assertIsNone(proc.returncode)
+            await asyncio.wait_for(c.maintain(), 3)
+            await c.restart_task
+            self.assertTrue(restarted)
+        finally:
+            await rpc.close()
+
+    async def test_broker_refresh_reloads_persisted_grant_under_shared_lock(self):
+        import base64
+        import time
+        import broker
+
+        with tempfile.TemporaryDirectory() as folder:
+            state = Path(folder)
+            home = state / "accounts" / "one"
+            home.mkdir(parents=True)
+            (home / "enrolled").write_text("{}")
+            events = []
+
+            class Account:
+                def __init__(self, label, home, binary, pool):
+                    self.home = home
+                    self.rpc = FakeBackend()
+
+                async def start(self):
+                    events.append("start")
+
+                async def close(self):
+                    events.append("close")
+
+            part = (
+                base64.urlsafe_b64encode(
+                    json.dumps({"exp": time.time() + 3600}).encode()
+                )
+                .decode()
+                .rstrip("=")
+            )
+            credentials = {
+                "accessToken": "fake." + part + ".fake",
+                "chatgptAccountId": "one",
+            }
+            with (
+                patch("router.Account", Account),
+                patch("router.read_keychain", return_value=credentials),
+            ):
+                server = asyncio.create_task(broker.serve(state, "unused"))
+                try:
+                    await wait_for(lambda: broker.paths(state)[1].exists())
+                    await broker.exchange(state, {"op": "usage", "label": "one"})
+                    value = await broker.exchange(
+                        state, {"op": "credentials", "label": "one", "refresh": True}
+                    )
+                    self.assertEqual(value, credentials)
+                    self.assertEqual(events[:3], ["start", "close", "start"])
+                finally:
+                    await broker.exchange(state, {"op": "stop"})
+                    await asyncio.wait_for(server, 3)
+
+    async def test_background_activity_over_real_jsonl_switches_without_restart(self):
+        class ResetPromptClient(FakeClient):
+            def __init__(self):
+                super().__init__()
+                self.blocked = False
+                self.saw_reset_prompt = False
+
+            async def send(self, raw):
+                message = json.loads(raw)
+                params = message.get("params", {})
+                error = params.get("error") or params.get("turn", {}).get("error") or {}
+                if (
+                    message.get("method") in {"error", "turn/completed"}
+                    and error.get("codexErrorInfo") == "usageLimitExceeded"
+                ):
+                    self.blocked = True
+                    self.saw_reset_prompt = True
+                if message.get("method") == "account/updated":
+                    self.blocked = False
+                await super().send(raw)
+
+        with tempfile.TemporaryDirectory() as folder:
+            root = Path(folder)
+            atomic_json(
+                root / "fault.json", {"quota_turns": 1, "background_activity_turns": 1}
+            )
+            rpc = await RPC.start(fake_executable(root), root)
+            c = Controller(
+                [FakeAccount("one"), FakeAccount("two")], rpc, report=lambda _: None
+            )
+            c.client = ResetPromptClient()
+            rpc.handler = c.event
+            try:
+                pid = rpc.proc.pid
+                await rpc.initialize()
+                await c.forward(
+                    {"id": "thread", "method": "thread/start", "params": {}}, {}
+                )
+                thread = next(iter(c.last_turn))
+                await c.forward(
+                    {
+                        "id": "turn",
+                        "method": "turn/start",
+                        "params": {
+                            "threadId": thread,
+                            "input": [
+                                {"type": "text", "text": "work", "text_elements": []}
+                            ],
+                        },
+                    },
+                    {},
+                )
+
+                def recovered():
+                    turns = json.loads((root / "fake-history.json").read_text())[
+                        "threads"
+                    ][thread]["turns"]
+                    return len(turns) == 2 and turns[-1]["status"] == "completed"
+
+                await wait_for(recovered)
+                self.assertEqual(c.account.label, "two")
+                self.assertFalse(c.active_items)
+                self.assertEqual(rpc.proc.pid, pid)
+                history = json.loads((root / "fake-history.json").read_text())
+                self.assertTrue(history["backgrounds"][thread])
+                self.assertTrue(c.client.saw_reset_prompt)
+                self.assertFalse(c.client.blocked)
+                self.assertFalse(c.server_requests)
+                self.assertFalse(
+                    any(
+                        c["method"] == "account/rateLimitResetCredit/consume"
+                        for c in history["calls"]
+                    )
+                )
+            finally:
+                if c.recovery:
+                    c.recovery.cancel()
+                    await asyncio.gather(c.recovery, return_exceptions=True)
+                await rpc.close()