@modelprofile.com/authswitch 3.3.0 → 4.0.0

package/ts/classes.cli.ts

@@ -5,29 +5,34 @@ import { OpenCodeHarness } from './classes.opencodeharness.js';
 import { ClaudeCodeHarness } from './classes.claudecodeharness.js';
 import { AuthSwitchTui } from './classes.tui.js';
 import { AglAuthSwitchCoordinator, AuthSwitchOperations, type TAuthSwitchCoordinator, type TAuthSwitchMutation } from './classes.operations.js';
-import { AccountListRenderer, readAccountList } from './classes.accountlist.js';
+import { readAccountList } from './classes.accountlist.js';
+import { AccountListRenderer } from './classes.listrenderer.js';
 import { accountLimits, activeAccounts, CondensedRenderer } from './classes.limits.js';
-import { credentialDriftNote, duration, orderedUsageWindows, readAccountBadges, until } from './accounts.js';
+import { consoleTable } from './consoletable.js';
+import { accountName, credentialDriftNote, duration, orderedUsageWindows, readAccountBadges, until, usagePercentText } from './accounts.js';
 import { describeHarnessProcesses, describeStopOutcome } from './classes.harnessprocesses.js';
 import { defaultPreusePrompt, PreuseError, validatePreuseOptions } from './preuse.js';
+import { parseCommandArgs, parseDurationOption, parseIntegerOption, UsageError } from './cliargs.js';
+import { AuthSwitchWatch, watchEventText } from './classes.watch.js';
+import { WatchBusyError, WatchLock } from './classes.watchlock.js';
+import { authSwitchHome } from './classes.credentialstore.js';
 import type { CodexSwitcher } from './classes.codexswitcher.js';
 import type { IAuthHarness, IHarnessAccount, IHarnessOutcome, IHarnessProcess, IHarnessState, IHarnessStopOutcome, IHarnessPreuseResult } from './interfaces.harness.js';
 import { bold, dim, green, orange, plainText, red } from './formatting.js';
 
 const canPrompt = (): boolean =>
   process.stdin.isTTY === true && process.stdout.isTTY === true && !process.env.CI;
-const COMMANDS = ['login', 'stash', 'list', 'ls', 'limits', 'active', 'use', 'preuse', 'current', 'drop', 'rm', 'doctor'];
+const COMMANDS = ['login', 'stash', 'list', 'ls', 'limits', 'active', 'use', 'preuse', 'watch', 'current', 'drop', 'rm', 'doctor'];
 /** What to do about the harness's own running instances before a credential file is rewritten. */
 export type TStopMode = 'stop' | 'force-stop' | 'keep-running';
 const STOP_FLAGS = ['--stop', '--force-stop', '--keep-running'];
 /** Commands that replace or clear a native login, and therefore offer to stop its instances. */
 const STOP_COMMANDS = ['use', 'stash'];
-/** Read-only overviews that work across every registered harness and support --json. */
+/** Overviews across every registered harness; none of them changes which account is in use, and all support --json. */
 const OVERVIEW_COMMANDS = ['list', 'ls', 'limits', 'active'];
-
-/** An account as prompts and reports name it: its label, qualified by its credential slot when it has one. */
-const accountName = (accountArg: IHarnessAccount): string =>
-  `${plainText(accountArg.label)}${accountArg.slotId ? ` (${plainText(accountArg.slotId)})` : ''}`;
+const WATCH_USAGE = 'Usage: authswitch [harness] watch [harness] [--interval <duration>] [--threshold <percent>] [--dry-run] [--once] [--json]';
+const WATCH_INTERVAL = { defaultMs: 120_000, minMs: 60_000, maxMs: 86_400_000 };
+const WATCH_THRESHOLD = { default: 95, min: 50, max: 100 };
 
 /** The account a command acts on, named as it was offered, with the badge it was offered with. */
 interface IChosenAccount {
@@ -73,6 +78,9 @@ ${bold('Usage')}
   authswitch active                  one row per provider: which account is in use, and since when
   authswitch <harness> preuse <account> [--prompt <text>] [--model <id>]
                                     send one prompt through that account without switching
+  authswitch watch [harness] [--interval <duration>] [--threshold <percent>] [--dry-run] [--once] [--json]
+                                    check usage every 2m and switch to a better saved account
+                                    when the active one reaches the threshold (95%)
   authswitch <harness> stash [account/provider] [--keep]
                                     save one active login; --keep leaves it active
   authswitch <harness> use [account] [--stop|--force-stop|--keep-running]
@@ -92,14 +100,24 @@ ${bold('Options')}
   -v, --version                      show the version
   -i, --interactive                  open the guided account manager
   --tui                             open the terminal management dashboard
-  --json                            JSON output for list / ls / limits / active only
+  --json                            JSON output for list / ls / limits / active; one JSON event per line for
+                                    watch, written after the command (authswitch watch --json)
   --stop                            stop this harness's running instances before the switch
   --force-stop                      the same, then kill instances that ignore SIGTERM
   --keep-running                    switch without stopping anything
 
-A switch works while OpenCode or Claude Code is running. Instances that keep running hold
-the previous login in memory and can write it back at their next token refresh, so the
-switch offers to stop them first; without a terminal it leaves them running and says so.
+A switch works while OpenCode or Claude Code is running. Claude Code picks the new login
+up on its next request, so its sessions are stopped only on --stop or --force-stop.
+OpenCode keeps the previous login in memory and can write it back at its next token
+refresh, so an OpenCode switch offers to stop it first; without a terminal it leaves
+it running and says so.
+
+Watch covers the harnesses that support automatic switching (${[...this.harnesses.values()].filter(harness => harness.autoSwitch === true).map(harness => harness.id).join(', ') || 'none registered'}).
+--interval takes seconds or a unit (120, 90s, 2m; from 1m to 1d); --threshold takes 50 to 100.
+A switch goes to a saved account at least 10 points below the threshold, or, when every
+account is used up, to the one usable again first. No session of yours is stopped, though
+a Codex switch restarts Codex' own app-server; --dry-run only reports, --once checks once.
+One watch runs per AUTHSWITCH_HOME.
 
 Preuse consumes the selected account's quota. Its default prompt is:
   "${defaultPreusePrompt}"
@@ -121,6 +139,11 @@ ${bold('Environment')}
         const qualified = args[0] !== 'preuse';
         return await this.commandPreuse(qualified ? this.harnesses.get(args[0]) : undefined, args.slice(qualified ? 2 : 1));
       }
+      // Watch owns its options, --json among them.
+      if (args[0] === 'watch' || (this.harnesses.has(args[0]) && args[1] === 'watch')) {
+        const qualified = args[0] !== 'watch';
+        return await this.commandWatch(qualified ? this.harnesses.get(args[0]) : undefined, args.slice(qualified ? 2 : 1));
+      }
       const jsonFlags = args.filter(value => value === '--json');
       const json = jsonFlags.length === 1;
       if (jsonFlags.length > 1) { process.stderr.write('Use --json only once.\n'); return 2; }
@@ -234,14 +257,17 @@ ${bold('Environment')}
    * Decide what happens to the harness's own running instances before its credential file changes.
    *
    * The switch itself no longer depends on this: it writes atomically and re-saves the outgoing
-   * login either way. What a running instance still costs is durability -- it holds the previous
-   * login in memory and can write it back at its next refresh -- so the instances are named and
-   * stopping them is offered, never assumed. Without a terminal and without a flag nothing is
-   * signalled, and only pids enumerated here for this user are ever signalled at all.
+   * login either way. A harness that picks up swaps live needs nothing here, so its instances are
+   * only stopped on an explicit --stop or --force-stop. Any other running instance still costs
+   * durability -- it holds the previous login in memory and can write it back at its next refresh --
+   * so the instances are named and stopping them is offered, never assumed. Without a terminal and
+   * without a flag nothing is signalled, and only pids enumerated here for this user are ever
+   * signalled at all.
    */
   private async settleRunningInstances(harnessArg: IAuthHarness, modeArg?: TStopMode): Promise<void> {
     const control = harnessArg.processes;
-    if (!control) return;
+    const stopRequested = modeArg === 'stop' || modeArg === 'force-stop';
+    if (!control || (harnessArg.liveSwap === true && !stopRequested)) return;
     let running: IHarnessProcess[];
     try { running = control.list(); }
     catch { process.stdout.write(`${orange(`Could not check for running ${plainText(harnessArg.label)} processes; continuing with the switch.`)}\n`); return; }
@@ -250,7 +276,7 @@ ${bold('Environment')}
     if (control.stopUnavailableReason !== null) { process.stdout.write(`${dim(control.stopUnavailableReason)}\n`); return; }
     const stoppable = running.filter(item => !item.isAncestor);
     if (!stoppable.length || modeArg === 'keep-running') return;
-    let stop = modeArg === 'stop' || modeArg === 'force-stop';
+    let stop = stopRequested;
     if (modeArg === undefined) {
       if (!canPrompt()) { process.stdout.write(`${dim('Leaving them running. Use --stop, --force-stop or --keep-running to decide this without a terminal.')}\n`); return; }
       stop = await this.out.prompts.ask({
@@ -298,28 +324,18 @@ ${bold('Environment')}
 
   private async commandPreuse(harnessArg: IAuthHarness | undefined, argsArg: string[]): Promise<number> {
     let reference: string | undefined;
-    let prompt = defaultPreusePrompt;
+    let prompt: string;
     let model: string | undefined;
-    const flags = new Set<string>();
     try {
-      for (let index = 0; index < argsArg.length; index++) {
-        const argument = argsArg[index];
-        if (argument.startsWith('--prompt=') || argument.startsWith('--model=') || argument === '--prompt' || argument === '--model') {
-          const separator = argument.indexOf('=');
-          const flag = separator < 0 ? argument : argument.slice(0, separator);
-          if (flags.has(flag)) throw new PreuseError(`Use ${flag} only once.`);
-          flags.add(flag);
-          const value = separator < 0 ? argsArg[++index] : argument.slice(separator + 1);
-          if (value === undefined) throw new PreuseError(`${flag} requires a value.`);
-          if (flag === '--prompt') prompt = value; else model = value;
-        } else if (argument.startsWith('-') || reference !== undefined) {
-          throw new PreuseError('Usage: authswitch [harness] preuse <account> [--prompt <text>] [--model <id>]');
-        } else reference = argument;
-      }
+      const parsed = parseCommandArgs(argsArg, { values: ['--prompt', '--model'], flags: [], maxPositionals: 1,
+        usage: 'Usage: authswitch [harness] preuse <account> [--prompt <text>] [--model <id>]' });
+      [reference] = parsed.positionals;
+      prompt = parsed.values.get('--prompt') ?? defaultPreusePrompt;
+      model = parsed.values.get('--model');
       validatePreuseOptions({ prompt, model });
-      if (!reference && !canPrompt()) throw new PreuseError('preuse requires an account outside an interactive terminal.');
+      if (!reference && !canPrompt()) throw new UsageError('preuse requires an account outside an interactive terminal.');
     } catch (error) {
-      process.stderr.write(`${error instanceof PreuseError ? error.message : 'Invalid preuse arguments.'}\n`);
+      process.stderr.write(`${error instanceof UsageError || error instanceof PreuseError ? error.message : 'Invalid preuse arguments.'}\n`);
       return 2;
     }
     const harness = harnessArg ?? await this.selectHarness();
@@ -366,13 +382,11 @@ ${bold('Environment')}
         if (windows?.length) {
           const now = Date.now();
           process.stdout.write('Reset schedule reported after the prompt:\n');
-          if ((process.stdout.columns ?? 100) < 40) {
-            for (const window of windows) process.stdout.write(`${plainText(window.label)} (${duration(window.durationSeconds)})\n  Used: ${window.usedPercent}%\n  Reset in: ${until(window.resetAt, now)}\n`);
-          } else await this.out.table(windows, { columns: [
+          await consoleTable(this.out, windows, [
             { key: 'window', title: 'Window', value: row => `${plainText(row.label)} (${duration(row.durationSeconds)})` },
-            { key: 'usage', title: 'Used', value: row => `${row.usedPercent}%` },
+            { key: 'usage', title: 'Used', value: row => usagePercentText(row.usedPercent) },
             { key: 'reset', title: 'Reset in', value: row => until(row.resetAt, now) },
-          ], overflow: 'wrap' });
+          ]);
         } else process.stdout.write('Reset schedule could not be verified; the completed prompt will not be repeated.\n');
       } catch {
         process.stderr.write('Prompt completed, but its reset schedule could not be verified or displayed. The prompt will not be repeated.\n');
@@ -384,6 +398,57 @@ ${bold('Environment')}
     }
   }
 
+  /**
+   * Watch usage and switch automatically; see `AuthSwitchWatch`. SIGINT and SIGTERM end it cleanly with status 0.
+   * `--once` runs one check and exits 1 when a switch it attempted did not complete.
+   */
+  private async commandWatch(harnessArg: IAuthHarness | undefined, argsArg: string[]): Promise<number> {
+    let options: { harnesses: IAuthHarness[]; intervalMs: number; threshold: number; dryRun: boolean; once: boolean; json: boolean };
+    try {
+      const parsed = parseCommandArgs(argsArg, { values: ['--interval', '--threshold'], flags: ['--dry-run', '--once', '--json', '--help', '-h'],
+        maxPositionals: harnessArg ? 0 : 1, usage: WATCH_USAGE });
+      if (parsed.flags.has('--help') || parsed.flags.has('-h')) { process.stdout.write(`${this.usage()}\n`); return 0; }
+      const named = parsed.positionals[0];
+      const harness = harnessArg ?? (named === undefined ? undefined : this.harnesses.get(named));
+      if (named !== undefined && !harness) throw new UsageError(`Unknown harness "${plainText(named)}". ${WATCH_USAGE}`);
+      if (harness && harness.autoSwitch !== true) throw new UsageError(`${plainText(harness.label)} does not support automatic switching.`);
+      const harnesses = (harness ? [harness] : [...this.harnesses.values()].filter(item => item.autoSwitch === true))
+        .sort((left, right) => left.label.localeCompare(right.label) || left.id.localeCompare(right.id));
+      if (!harnesses.length) throw new UsageError('No registered harness supports automatic switching.');
+      const interval = parsed.values.get('--interval');
+      const threshold = parsed.values.get('--threshold');
+      options = {
+        harnesses, dryRun: parsed.flags.has('--dry-run'), once: parsed.flags.has('--once'), json: parsed.flags.has('--json'),
+        intervalMs: interval === undefined ? WATCH_INTERVAL.defaultMs : parseDurationOption('--interval', interval, WATCH_INTERVAL),
+        threshold: threshold === undefined ? WATCH_THRESHOLD.default : parseIntegerOption('--threshold', threshold, WATCH_THRESHOLD),
+      };
+    } catch (error) {
+      if (!(error instanceof UsageError)) throw error;
+      process.stderr.write(`${error.message}\n`);
+      return 2;
+    }
+    const watch = new AuthSwitchWatch({
+      harnesses: options.harnesses, operations: this.operations, lock: new WatchLock(authSwitchHome()),
+      intervalMs: options.intervalMs, threshold: options.threshold, dryRun: options.dryRun,
+      onEvent: event => { process.stdout.write(`${options.json ? JSON.stringify(event) : watchEventText(event)}\n`); },
+    });
+    const controller = new AbortController();
+    const stop = () => controller.abort();
+    process.once('SIGINT', stop);
+    process.once('SIGTERM', stop);
+    try {
+      const completed = await watch.run(controller.signal, { once: options.once });
+      return options.once && !completed ? 1 : 0;
+    } catch (error) {
+      if (!(error instanceof WatchBusyError)) throw error;
+      process.stderr.write(`${error.message}\n`);
+      return 1;
+    } finally {
+      process.removeListener('SIGINT', stop);
+      process.removeListener('SIGTERM', stop);
+    }
+  }
+
   private async selectHarness(): Promise<IAuthHarness | undefined> {
     if (this.harnesses.size === 1) return this.harnesses.values().next().value;
     if (this.harnesses.size === 0 || !canPrompt()) {
@@ -494,7 +559,7 @@ ${bold('Environment')}
       process.stdout.write(`${dim('no account is currently active')}\n`);
     }
     if (stateArg.saveUnavailableReason) process.stdout.write(`${dim(stateArg.saveUnavailableReason)}\n`);
-    for (const drift of stateArg.credentialDrift ?? []) process.stdout.write(`${orange(credentialDriftNote(harnessArg.id, drift))}\n`);
+    for (const drift of stateArg.credentialDrift ?? []) process.stdout.write(`${orange(credentialDriftNote(harnessArg, drift))}\n`);
   }
 
   private async selectActive(harness: IAuthHarness, reference?: string): Promise<IHarnessAccount | undefined> {
@@ -515,12 +580,13 @@ ${bold('Environment')}
   }
 
   /**
-   * The condensed views are projections of the same read-only account list, so a provider is queried
-   * once, per account, with the same bounded timeouts and per-account failure isolation as `list`.
+   * The condensed views are projections of the same account list, which never changes which account is in
+   * use, so a provider is queried once, per account, with the same bounded timeouts and per-account failure
+   * isolation as `list`.
    */
   private async commandCondensed(commandArg: 'limits' | 'active', harnessesArg: IAuthHarness[], jsonArg: boolean): Promise<number> {
     const list = await readAccountList(harnessesArg);
-    const document = commandArg === 'limits' ? accountLimits(list) : activeAccounts(list);
+    const document = commandArg === 'limits' ? accountLimits(list, harnessesArg) : activeAccounts(list, harnessesArg);
     if (jsonArg) process.stdout.write(`${JSON.stringify(document, null, 2)}\n`);
     else if ('limits' in document) await new CondensedRenderer(this.out).renderLimits(document);
     else await new CondensedRenderer(this.out).renderActive(document);
@@ -530,17 +596,10 @@ ${bold('Environment')}
   private async commandList(harnessesArg: IAuthHarness[], jsonArg = false): Promise<number> {
     const list = await readAccountList(harnessesArg);
     if (jsonArg) process.stdout.write(`${JSON.stringify(list, null, 2)}\n`);
-    else await new AccountListRenderer(this.out).render(list);
+    else await new AccountListRenderer(this.out).render(list, harnessesArg);
     return list.complete ? 0 : 1;
   }
 
-  private printAccount(accountArg: IHarnessAccount): void {
-    const saved = accountArg.isStashed ? 'saved' : 'not saved';
-    process.stdout.write(`${accountArg.isActive ? green('*') : ' '} ${bold(plainText(accountArg.label))} ${dim(`(${saved})`)}\n`);
-    if (accountArg.savedAt) process.stdout.write(`  ${dim('Saved: ' + plainText(accountArg.savedAt))}\n`);
-    for (const detail of accountArg.details) process.stdout.write(`  ${detail}\n`);
-  }
-
   private async resolveAccount(harnessArg: IAuthHarness, referenceArg: string): Promise<string | null> {
     const resolved = await harnessArg.resolveAccount(referenceArg);
     if ('id' in resolved) return resolved.id;

package/ts/classes.codexharness.ts

@@ -16,6 +16,10 @@ export class CodexHarness implements IAuthHarness {
   public readonly loginHint = 'Use authswitch codex login to sign in and save another account.';
   public readonly loginProviders: IHarnessLoginProvider[] = [{ providerId: 'openai', label: 'OpenAI', flows: ['device'] }];
   public readonly diagnosticsLabel = 'Check credential storage and remote control';
+  /** Running Codex sessions keep the login they loaded; the switch itself restarts the managed app-server. */
+  public readonly liveSwap = false;
+  /** Every saved ChatGPT login reports its usage, and a switch restarts only the managed app-server. */
+  public readonly autoSwitch = true;
 
   constructor(
     private readonly switcher = new CodexSwitcher(),

package/ts/classes.codexstatus.ts

@@ -1,6 +1,7 @@
 import type { ICodexIdentity } from './interfaces.js';
 import type { IHarnessAccountStatus, IHarnessStatusOptions, IHarnessStatusSummary } from './interfaces.harness.js';
 import { commitinfo } from './00_commitinfo_data.js';
+import { latestRetryAt, retryAtFrom } from './ratelimit.js';
 
 // Verified Chromium-compatible billing request profile, independent of any locally installed browser.
 const billingUserAgent = 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36';
@@ -31,13 +32,18 @@ const count = (valueArg: unknown): number => {
 /** Only fixed, local diagnostics may cross the HTTP error boundary. */
 class StatusRequestError extends Error {}
 
+/** The service refused a section for too many requests; that says nothing about the account's usage. */
+class StatusRateLimitError extends StatusRequestError {
+  constructor(public readonly retryAt: string | null) { super('The service is rate limiting requests (HTTP 429); try again later.'); }
+}
+
 /**
  * Read-only ChatGPT status contract verified against Codex 0.154.0.
  * These source-defined backend routes are isolated here. No token refresh,
  * credential writes, app-server lifecycle changes or reset consumption occur.
  */
 export class CodexAccountStatus {
-  constructor(private readonly fetcher: typeof fetch = globalThis.fetch) {}
+  constructor(private readonly fetcher: typeof fetch = globalThis.fetch, private readonly now: () => number = Date.now) {}
 
   public async read(rawArg: string, identityArg: ICodexIdentity, optionsArg: IHarnessStatusOptions = {}): Promise<IHarnessAccountStatus> {
     if (identityArg.kind !== 'chatgpt') return {
@@ -85,6 +91,8 @@ export class CodexAccountStatus {
       }
       catch { result.problems.push(`${labels[index]}: the service returned an unsupported response; no values were inferred.`); }
     }
+    const limited = sections.flatMap(section => section.status === 'rejected' && section.reason instanceof StatusRateLimitError ? [section.reason] : []);
+    if (limited.length) result.rateLimit = { retryAt: latestRetryAt(limited.map(error => error.retryAt)) };
     if (!result.summary?.subscription && identityArg.planType) {
       result.facts.unshift({ section: 'Subscription', summaryKey: 'subscription', label: 'Last known plan', value: `${identityArg.planType} (from stored login; not verified live)` });
       result.summary = { ...result.summary, subscription: { plan: identityArg.planType, source: 'stored' } };
@@ -105,6 +113,7 @@ export class CodexAccountStatus {
       if (!response.ok) {
         await response.body?.cancel();
         if (response.headers.get('cf-mitigated') === 'challenge') throw new StatusRequestError('Blocked by a service verification challenge (Cloudflare); this lookup is unavailable to the current HTTP client.');
+        if (response.status === 429) throw new StatusRateLimitError(retryAtFrom(response.headers.get('retry-after'), this.now()));
         if (response.status === 401) throw new StatusRequestError('Login expired or was rejected. Log in again with the account’s harness, then save the account.');
         if (response.status === 403) throw new StatusRequestError('Access denied by the service (HTTP 403).');
         throw new StatusRequestError(`Service returned HTTP ${response.status}.`);
@@ -157,9 +166,9 @@ export class CodexAccountStatus {
     const append = (label: string, value: string) => facts.push({ section: 'Billing', summaryKey: 'billing', label, value });
     if (billing.hasActiveSubscription !== undefined) append('Active subscription', billing.hasActiveSubscription ? 'yes' : 'no');
     if (billing.autoRenew !== undefined) append('Automatic renewal', billing.autoRenew ? 'on' : 'off');
-    if (billing.renewsAt) append('Renewal date (UTC)', billing.renewsAt);
-    if (billing.cancelsAt) append('Cancellation date (UTC)', billing.cancelsAt);
-    if (billing.expiresAt) append('Subscription expiry (UTC)', billing.expiresAt);
+    if (billing.renewsAt) append('Renewal date', billing.renewsAt);
+    if (billing.cancelsAt) append('Cancellation date', billing.cancelsAt);
+    if (billing.expiresAt) append('Subscription expiry', billing.expiresAt);
     return { facts, summary: { billing } };
   }
 
@@ -172,8 +181,9 @@ export class CodexAccountStatus {
     const appendLimit = (nameArg: string, valueArg: unknown, scopeArg: 'account' | 'feature') => {
       if (valueArg == null) return;
       const limit = record(valueArg);
-      facts.push({ section: 'Limits & credits', label: `${nameArg} usage allowed`, value: boolean(limit.allowed) ? 'yes' : 'no' });
-      facts.push({ section: 'Limits & credits', label: `${nameArg} limit reached`, value: boolean(limit.limit_reached) ? 'yes' : 'no' });
+      // The service's own reading of the same windows, so a view that shows the windows need not repeat it.
+      facts.push({ section: 'Limits & credits', summaryKey: 'usageWindows', label: `${nameArg} usage allowed`, value: boolean(limit.allowed) ? 'yes' : 'no' });
+      facts.push({ section: 'Limits & credits', summaryKey: 'usageWindows', label: `${nameArg} limit reached`, value: boolean(limit.limit_reached) ? 'yes' : 'no' });
       for (const [key, name] of [['primary_window', 'primary'], ['secondary_window', 'secondary']]) {
         if (limit[key] == null) continue;
         const window = record(limit[key]);
@@ -251,7 +261,7 @@ export class CodexAccountStatus {
         return { date, tokens: numeric(day.tokens) };
       }).sort((leftArg, rightArg) => rightArg.date.localeCompare(leftArg.date));
       for (const day of days.slice(0, 7)) facts.push({ section: 'Daily tokens', label: `Tokens ${day.date}`, value: day.tokens.toLocaleString('en-US') });
-      if (days.length > 7) facts.push({ section: 'Daily tokens', label: 'Daily activity', value: `Showing the latest 7 of ${days.length} reported days` });
+      facts.push({ section: 'Daily tokens', label: 'Reported days', value: String(days.length) });
     }
     return facts;
   }

package/ts/classes.credentialstore.ts

@@ -1,5 +1,5 @@
 import * as plugins from './plugins.js';
-import { writeSecretFileAtomically } from './helpers.js';
+import { errorCode, pause, writeSecretFileAtomically } from './helpers.js';
 
 export const credentialRecord = (value: unknown): Record<string, unknown> => {
   if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('Unsupported credential document.');
@@ -64,11 +64,29 @@ export interface IStoredCredential {
   credential: Record<string, unknown>;
 }
 
+/** The root of authswitch's own state: `AUTHSWITCH_HOME`, or `~/.authswitch`. */
+export const authSwitchHome = (envArg: NodeJS.ProcessEnv = process.env): string =>
+  envArg.AUTHSWITCH_HOME || plugins.path.join(plugins.os.homedir(), '.authswitch');
+
+export interface ICredentialStoreOptions {
+  /**
+   * How long an operation waits for another authswitch operation on the same store, 45 seconds by default: longer
+   * than the longest operation that holds the lock -- a Claude Code login refresh (30 s) plus the 15 s a native
+   * write waits for Claude Code's own locks -- so such operations queue instead of being told the store is locked.
+   */
+  lockTimeoutMs?: number;
+}
+
+const DEFAULT_LOCK_TIMEOUT_MS = 45_000;
+const LOCK_RETRY_MS = 50;
+
 /** A single atomic, owner-only record keeps the saved credential and its identity together. */
 export class CredentialStore {
   public readonly dir: string;
-  constructor(harness: string, root = process.env.AUTHSWITCH_HOME || plugins.path.join(plugins.os.homedir(), '.authswitch')) {
+  private readonly lockTimeoutMs: number;
+  constructor(harness: string, root = authSwitchHome(), optionsArg: ICredentialStoreOptions = {}) {
     this.dir = plugins.path.join(root, harness);
+    this.lockTimeoutMs = optionsArg.lockTimeoutMs ?? DEFAULT_LOCK_TIMEOUT_MS;
   }
   public id(slot: string, identity: string): string { return credentialHash(JSON.stringify([slot, identity])); }
   private file(id: string): string {
@@ -89,12 +107,22 @@ export class CredentialStore {
       .map(name => this.read(name.slice(0, -5))).sort((a, b) => b.savedAt.localeCompare(a.savedAt));
   }
   public save(entry: Omit<IStoredCredential, 'schemaVersion' | 'id' | 'savedAt'>): IStoredCredential {
-    const record: IStoredCredential = { ...entry, schemaVersion: 1, id: this.id(entry.slotId, entry.identity), savedAt: new Date().toISOString() };
+    return this.write({ ...entry, schemaVersion: 1, id: this.id(entry.slotId, entry.identity), savedAt: new Date().toISOString() },
+      'Saved credential verification failed; the active login was preserved.');
+  }
+  /**
+   * Replaces a saved login's credential in place, such as with refreshed tokens: the account, its identity and when
+   * it was saved stay as they are. The caller holds the lock and has checked the record it replaces.
+   */
+  public replaceCredential(id: string, credential: Record<string, unknown>): IStoredCredential {
+    return this.write({ ...this.read(id), credential }, 'The refreshed login could not be verified after saving it.');
+  }
+  private write(record: IStoredCredential, failureArg: string): IStoredCredential {
     plugins.fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 });
     plugins.fs.chmodSync(this.dir, 0o700);
     const raw = JSON.stringify(record, null, 2) + '\n';
     writeSecretFileAtomically(this.file(record.id), raw);
-    if (readCredentialDocument(this.file(record.id)).raw !== raw) throw new Error('Saved credential verification failed; the active login was preserved.');
+    if (readCredentialDocument(this.file(record.id)).raw !== raw) throw new Error(failureArg);
     return this.read(record.id);
   }
   public remove(id: string): void { this.read(id); plugins.fs.unlinkSync(this.file(id)); }
@@ -124,13 +152,29 @@ export class CredentialStore {
     plugins.fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 });
     writeSecretFileAtomically(this.switchFile, JSON.stringify({ schemaVersion: 1, switches: records }, null, 2) + '\n');
   }
-  public locked<T>(action: () => T): T {
+  /**
+   * Runs `action` as the only authswitch operation on this store; the lock is held until an asynchronous action settles.
+   *
+   * An operation that finds the store locked waits for it, up to the store's lock timeout, so concurrent operations
+   * (a manual switch and a watch refreshing a saved login) run one after the other instead of failing. The signal
+   * ends the wait early; an action that has started is never interrupted by it.
+   */
+  public async locked<T>(action: () => T | Promise<T>, optionsArg: { signal?: AbortSignal } = {}): Promise<T> {
     plugins.fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 });
     const file = plugins.path.join(this.dir, '.lock');
-    let fd: number;
-    try { fd = plugins.fs.openSync(file, 'wx', 0o600); }
-    catch { throw new Error(`Account storage is locked. Close other authswitch operations; if none remain, remove ${file}.`); }
-    try { return action(); }
+    const deadline = Date.now() + this.lockTimeoutMs;
+    let fd: number | undefined;
+    while (fd === undefined) {
+      optionsArg.signal?.throwIfAborted();
+      try { fd = plugins.fs.openSync(file, 'wx', 0o600); }
+      catch (error) {
+        if (errorCode(error) !== 'EEXIST' || Date.now() >= deadline) {
+          throw new Error(`Account storage is locked. Close other authswitch operations; if none remain, remove ${file}.`);
+        }
+        await pause(Math.min(LOCK_RETRY_MS, deadline - Date.now()), optionsArg.signal);
+      }
+    }
+    try { return await action(); }
     finally { plugins.fs.closeSync(fd); plugins.fs.unlinkSync(file); }
   }
 }