Split /codex mount per project

tests/run_tests.sh

@@ -15,6 +15,16 @@ fi
 
 failures=()
 
+can_run_script_pty() {
+  if ! command -v script >/dev/null 2>&1; then
+    return 1
+  fi
+  if ! script -q -c "true" /dev/null >/dev/null 2>&1; then
+    return 1
+  fi
+  return 0
+}
+
 run_shellcheck() {
   printf '==> shellcheck\n'
   if ! command -v shellcheck >/dev/null 2>&1; then
@@ -154,6 +164,9 @@ if [[ ${1-} == "-c" ]]; then
     exit 0
   fi
 fi
+if [[ -x /usr/bin/sha256sum ]]; then
+  exec /usr/bin/sha256sum "$@"
+fi
 printf 'sha256sum stub encountered unsupported args: %s\n' "$*" >&2
 exit 1
 EOF
@@ -306,6 +319,94 @@ run_resume_target() {
   teardown_stub_env
 }
 
+run_auth_file_mount() {
+  local scenario_dir
+  scenario_dir=$(cd "$TEST_ROOT/resume_target" && pwd -P)
+  printf '==> auth_file_mount\n'
+  setup_stub_env
+  mkdir -p "$STUB_HOME/.codex"
+  printf '{"access_token":"test"}\n' >"$STUB_HOME/.codex/auth.json"
+  if ! PATH="$STUB_BIN:$PATH" HOME="$STUB_HOME" FAKE_PODMAN_LOG="$STUB_LOG" FAKE_PODMAN_INSPECT_FAIL=1 \
+    "$SLOPTRAP_BIN" "$scenario_dir" </dev/null >/dev/null 2>&1; then
+    record_failure "auth_file_mount: sloptrap exited non-zero"
+    teardown_stub_env
+    return
+  fi
+  if ! grep -q -- "-v ${STUB_HOME}/.codex/auth.json:/codex/auth.json:Z" "$STUB_LOG"; then
+    record_failure "auth_file_mount: missing auth file bind mount"
+  fi
+  if ! grep -q -- "-v ${STUB_HOME}/.codex/sloptrap/state/" "$STUB_LOG"; then
+    record_failure "auth_file_mount: missing project state bind mount"
+  fi
+  teardown_stub_env
+}
+
+run_project_state_isolation() {
+  local scenario_a scenario_b
+  scenario_a=$(cd "$TEST_ROOT/resume_target" && pwd -P)
+  scenario_b=$(cd "$TEST_ROOT/secret_mask" && pwd -P)
+  printf '==> project_state_isolation\n'
+  setup_stub_env
+  mkdir -p "$STUB_HOME/.codex"
+  printf '{"access_token":"test"}\n' >"$STUB_HOME/.codex/auth.json"
+  if ! PATH="$STUB_BIN:$PATH" HOME="$STUB_HOME" FAKE_PODMAN_LOG="$STUB_LOG" FAKE_PODMAN_INSPECT_FAIL=1 \
+    "$SLOPTRAP_BIN" "$scenario_a" </dev/null >/dev/null 2>&1; then
+    record_failure "project_state_isolation: first project run failed"
+    teardown_stub_env
+    return
+  fi
+  if ! PATH="$STUB_BIN:$PATH" HOME="$STUB_HOME" FAKE_PODMAN_LOG="$STUB_LOG" \
+    "$SLOPTRAP_BIN" "$scenario_b" </dev/null >/dev/null 2>&1; then
+    record_failure "project_state_isolation: second project run failed"
+    teardown_stub_env
+    return
+  fi
+  local -a codex_mounts=()
+  mapfile -t codex_mounts < <(
+    {
+      grep "FAKE PODMAN: run " "$STUB_LOG" \
+        | grep -oE -- "-v [^ ]+:/codex:Z" \
+        | sed -e 's/^-v //' -e 's/:\/codex:Z$//'
+    } || true
+  )
+  if [[ ${#codex_mounts[@]} -lt 2 ]]; then
+    record_failure "project_state_isolation: missing /codex state mounts"
+    teardown_stub_env
+    return
+  fi
+  if [[ ${codex_mounts[0]} == "${codex_mounts[1]}" ]]; then
+    record_failure "project_state_isolation: projects reused same Codex state mount"
+  fi
+  if [[ ${codex_mounts[0]} != */.codex/sloptrap/state/* || ${codex_mounts[1]} != */.codex/sloptrap/state/* ]]; then
+    record_failure "project_state_isolation: state mounts did not use sloptrap namespace"
+  fi
+  teardown_stub_env
+}
+
+run_auto_login_empty_auth() {
+  local scenario_dir
+  scenario_dir=$(cd "$TEST_ROOT/resume_target" && pwd -P)
+  printf '==> auto_login_empty_auth\n'
+  setup_stub_env
+  mkdir -p "$STUB_HOME/.codex"
+  : >"$STUB_HOME/.codex/auth.json"
+  if ! PATH="$STUB_BIN:$PATH" HOME="$STUB_HOME" FAKE_PODMAN_LOG="$STUB_LOG" FAKE_PODMAN_INSPECT_FAIL=1 \
+    "$SLOPTRAP_BIN" "$scenario_dir" </dev/null >/dev/null 2>&1; then
+    record_failure "auto_login_empty_auth: sloptrap exited non-zero"
+    teardown_stub_env
+    return
+  fi
+  local first_run
+  first_run=$(grep "FAKE PODMAN: run " "$STUB_LOG" | head -n 1 || true)
+  if [[ -z $first_run || $first_run != *" login" ]]; then
+    record_failure "auto_login_empty_auth: expected login before primary run"
+  fi
+  if ! grep -q -- "-v ${STUB_HOME}/.codex/auth.json:/codex/auth.json:Z" "$STUB_LOG"; then
+    record_failure "auto_login_empty_auth: missing auth file bind mount"
+  fi
+  teardown_stub_env
+}
+
 run_codex_symlink_home() {
   local scenario_dir
   scenario_dir=$(cd "$TEST_ROOT/resume_target" && pwd -P)
@@ -418,8 +519,8 @@ run_invalid_allow_host_network() {
 run_wizzard_create_manifest() {
   local scenario_dir="$TEST_ROOT/wizzard_empty"
   printf '==> wizzard_create_manifest\n'
-  if ! command -v script >/dev/null 2>&1; then
-    printf 'skipping wizzard_create_manifest: script binary not found in PATH\n'
+  if ! can_run_script_pty; then
+    printf 'skipping wizzard_create_manifest: script PTY support not available\n'
     return
   fi
   rm -f "$scenario_dir/.sloptrap"
@@ -449,8 +550,8 @@ run_wizzard_create_manifest() {
 run_wizzard_existing_defaults() {
   local scenario_dir="$TEST_ROOT/wizzard_existing"
   printf '==> wizzard_existing_defaults\n'
-  if ! command -v script >/dev/null 2>&1; then
-    printf 'skipping wizzard_existing_defaults: script binary not found in PATH\n'
+  if ! can_run_script_pty; then
+    printf 'skipping wizzard_existing_defaults: script PTY support not available\n'
     return
   fi
   local input=$'\n\n\n\n\n'
@@ -475,8 +576,8 @@ run_wizzard_existing_defaults() {
 run_wizzard_build_trigger() {
   local scenario_dir="$TEST_ROOT/wizzard_build"
   printf '==> wizzard_build_trigger\n'
-  if ! command -v script >/dev/null 2>&1; then
-    printf 'skipping wizzard_build_trigger: script binary not found in PATH\n'
+  if ! can_run_script_pty; then
+    printf 'skipping wizzard_build_trigger: script PTY support not available\n'
     return
   fi
   setup_stub_env
@@ -504,6 +605,9 @@ run_manifest_injection
 run_helper_symlink
 run_secret_mask
 run_resume_target
+run_auth_file_mount
+run_project_state_isolation
+run_auto_login_empty_auth
 run_codex_symlink_home
 run_root_directory_project
 run_shared_dir_override