feat: auto-failover — baton watch

[ehsanjso]

What

baton watch — detect quota-dead sessions and pass the baton automatically: convert the transcript, import it into the failover target, print the ready-to-run resume command.

• Detection — Claude Code: newest assistant event in the transcript tail, flagged isApiErrorMessage with limit-shaped text (matched against real error shapes: "You've hit your session limit · resets 5:50pm"). OpenCode: newest message per session via opencode db --format json, limit-shaped error payload. 401s / model errors / stalls do NOT fire.
• Interactive by default — quota is account-level, so every active session dies at once; watch lists the dead and you pick which to fail over. No pre-configuration.
• --auto — unattended mode fails over only allowlisted sessions. Allowlist from inside the conversation via new MCP tools: failover_opt_in, failover_opt_out, failover_status (session id defaults to the caller's own session = most recently active).
• --once — single scan for wiring into agent hooks later; --to overrides the default claude-code ⇄ opencode pair.
• Dedup: each error event fires exactly once (state file keyed by event id); a session that recovers and re-dies re-fires.

Verified

• 7 new unit tests (detection predicates both formats, tail reading, dir scan, state round-trip); 30 total pass, clippy clean on new code.
• End-to-end both directions against the real CLIs:
  • claude-code → opencode: fixture transcript with real-shaped limit error → baton watch --once --auto → real opencode import → opencode export confirms all 3 messages.
  • opencode → claude-code: crafted export with limit error imported into opencode's SQLite → watch detects via opencode db → transcript written under ~/.claude/projects/<encoded-cwd>/ → claude --resume <id> command printed.
  • Rerun after failover: silent (dedup works).

Notes / ceilings

• opencode import sets the session directory to the import cwd (ignores info.directory) — hence the documented "run baton watch from the project directory" constraint.
• Error matching is keyword-based (limit/quota/429), not a per-provider taxonomy — widen if a provider's quota error slips through.
• Other agents (codex, gemini) are follow-ups: detection predicates per format, same pipeline.

🤖 Generated with Claude Code

[ehsanjso]

Post-review pass (self): fixed a mid-scan state clobber (MCP opt-in written while watch was scanning could be lost), made failover_opt_in re-arm a death that fired before the opt-in, and hardened the opencode directory comparison for Windows verbatim paths/trailing separators. 31 tests green.