tokenmaxxing 0.12.0 → 0.13.1

package/DESIGN.md

@@ -101,7 +101,9 @@ The decision engages at `five_hour >= 50%` (policy.greedySessionFloor): from the
 
 **Shipped since (0.11.0):** a programmatic SDK surface (`src/sdk.ts`, the package's `exports["."]`) for pairing with the Claude Agent SDK - personal use across the owner's own pooled accounts. The Agent SDK reads credentials per subprocess spawn and has no statusLine, so the surface is boundary-driven: run the shared switch decision before a spawn (`ensureBestAccount`) and at Stop-hook turn boundaries (`stopHookCheck`), and hand the SDK a pinned real-claude path plus a full replacement env scrubbed of credential overrides (`pooledOptions`).
 
-**Later:** Codex as a second pool; tool-agnostic picker.
+**Later:** tool-agnostic picker.
+
+**Shipped since (0.13.0):** Codex as a second pool, parallel state (`codex-accounts.json`, `codex-creds/`, own flock), same pace-pressure policy. Codex differences that shaped it: restart IS the switch (a running codex refuses another account's credential), usage is a free direct GET with epoch resets and a duration-classified window set (the weekly window is primary on current plans), the refresh token rotates with reuse punished (harvest-by-true-owner, persist every rotation), and codex's new Stop-hook system drives the auto-swap through a codex supervisor shim that respawns `codex resume <session-id>` (hooks must be trusted once via `/hooks`).
 
 **Non-goals:** an API/MITM proxy; reimplementing OAuth beyond the single refresh-grant call in the swap.
 

package/README.md

@@ -36,7 +36,10 @@ claude                  # use claude as always
 | command | what it does |
 |---|---|
 | `tokenmaxxing init` | import the current account + install supervisor & hooks |
+| `tokenmaxxing init --codex` | same for codex: import login, install codex supervisor + Stop hook |
 | `tokenmaxxing add` | register an additional account (isolated login, harvested into the pool) |
+| `tokenmaxxing add --codex` | register an additional codex account (isolated login) |
+| `tokenmaxxing switch --codex [sel]` | switch the codex pool (takes effect on the next codex start) |
 | `tokenmaxxing ls` | list pooled accounts |
 | `tokenmaxxing status` | accounts with 5h / weekly usage bars, active + exhausted-until-reset |
 | `tokenmaxxing status --force` | additionally ping every account (one tiny haiku request each) so all 5h session timers start now, then sample fresh |
@@ -101,6 +104,20 @@ The SDK reads credentials when it spawns the claude subprocess and has no status
 
 This is for pooling **your own** subscription accounts in agents you run yourself - the same personal-use posture as the CLI. Anthropic does not allow third-party products to offer claude.ai login or rate limits, including agents built on the Agent SDK; don't ship this surface to third parties.
 
+## Codex support
+
+The same pooling works for OpenAI's Codex CLI (your own ChatGPT-subscription accounts):
+
+```sh
+tokenmaxxing init --codex   # import your current codex login + install the codex supervisor & Stop hook
+tokenmaxxing add --codex    # log in another account, isolated - your primary login is untouched
+codex                       # use codex as always
+```
+
+Codex mechanics differ from Claude Code in one hard way: a running codex process refuses a credential swapped to a different account, so **a restart is the switch**. The installed Stop hook runs the same greedy pace-pressure decision at each turn boundary (usage read free from codex's own rate-limit endpoint: percentages plus absolute reset times, weekly aggregate and per-model caps alike); when it swaps, the supervisor relaunches `codex resume <session-id>` on the fresh account with the transcript intact. `tokenmaxxing switch --codex [sel]` does it manually, `status`/`watch`/`ls` show both pools.
+
+Two codex-specific facts worth knowing: codex does not run hooks it has not been told to trust, so after `init --codex` you must open codex once and trust the tokenmaxxing Stop hook via `/hooks` (auto-switching is inert until then); and codex has no cross-process lock on `auth.json`, so tokenmaxxing serializes all of its own credential writes behind its own lock and swaps only at idle turn boundaries.
+
 ## Honest limitations
 
 - **One cold turn.** The first turn after resuming on a new account re-uploads context once (prompt cache is org-scoped).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "0.12.0",
+  "version": "0.13.1",
   "description": "Automatic Claude Code account switching: pool multiple accounts and hot-swap when quota fills, resuming your session on the fresh account.",
   "type": "module",
   "license": "MIT",

package/src/cli/add.ts

@@ -15,7 +15,7 @@ import { withLock } from "../lib/lock.ts";
 import { loadAccounts, saveAccounts } from "../lib/state.ts";
 import { credItemFor, paths } from "../lib/paths.ts";
 import { CredentialBlobSchema, OAuthAccountSchema, type Account } from "../lib/types.ts";
-import { c } from "./render.ts";
+import { c, count } from "./render.ts";
 
 /** True once `/login` has written a usable identity into the onboard dir. */
 function identityReady(cjPath: string): boolean {
@@ -129,7 +129,7 @@ export async function cmdAdd(): Promise<number> {
   await cleanup();
 
   console.log();
-  const usageNote = sampled ? ` · session ${sampled.session.usedPercentage}% / week ${sampled.weekAll.usedPercentage}%` : "";
-  console.log(`${c.green("✓")} added ${c.bold(account.email)} (${account.subscriptionType ?? "?"})${usageNote} → pool now has ${poolSize} account(s)`);
+  const usageNote = sampled ? ` (session ${sampled.session.usedPercentage}% / week ${sampled.weekAll.usedPercentage}%)` : "";
+  console.log(`${c.green("✓")} added ${c.bold(account.email)} (${account.subscriptionType ?? "?"})${usageNote} → pool now has ${count({ n: poolSize, noun: "account" })}`);
   return 0;
 }

package/src/cli/codexadd.ts

@@ -0,0 +1,99 @@
+// `tokenmaxxing add --codex` - register an ADDITIONAL codex account. Runs
+// `codex login` inside a throwaway CODEX_HOME pinned to file-mode credential
+// storage (auto mode would keyring-namespace the login on macOS and leave
+// nothing harvestable), then parks the resulting auth.json under the token's
+// OWN identity and indexes it. The primary login is never touched.
+
+import { mkdirSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { MAX_WRAP_DEPTH, WRAP_DEPTH_ENV } from "../lib/claudebin.ts";
+import { resolveRealCodex } from "../lib/codexbin.ts";
+import { codexIdentityOf, readCodexAuthAt, writeParkedCodexAuth } from "../lib/codexauth.ts";
+import { CodexUsageReadError, fetchCodexUsage } from "../lib/codexusage.ts";
+import { loadCodexAccounts, saveCodexAccounts } from "../lib/codexstate.ts";
+import { saveTermios, restoreTermios } from "../lib/tty.ts";
+import { withLock } from "../lib/lock.ts";
+import { codexCredItemFor, codexPaths } from "../lib/paths.ts";
+import { writeFileAtomic } from "../lib/atomic.ts";
+import type { CodexAccount, CodexUsage } from "../lib/types.ts";
+import { c, count } from "./render.ts";
+
+export async function cmdCodexAdd(): Promise<number> {
+  const real = resolveRealCodex();
+  const onboardDir = codexPaths.onboardDir;
+  // Deliberate hard delete (not trash; user decision 2026-07-16): the onboard
+  // dir holds a plaintext live credential after login, and a trashed copy
+  // would keep that token readable. The dir is tokenmaxxing's own transient
+  // artifact; its one durable output is parked separately before cleanup.
+  // Same rationale at the end-of-run cleanup below.
+  rmSync(onboardDir, { recursive: true, force: true });
+  mkdirSync(onboardDir, { recursive: true });
+  writeFileAtomic(join(onboardDir, "config.toml"), 'cli_auth_credentials_store_mode = "file"\n');
+
+  console.log(c.cyan("Opening an isolated codex login - your primary login is untouched."));
+  console.log(c.dim("Complete the browser sign-in with the account to add; the command exits once you're in."));
+  console.log();
+
+  const savedTermios = saveTermios();
+  const p = Bun.spawn([real, "login"], {
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit",
+    env: {
+      ...process.env,
+      CODEX_HOME: onboardDir,
+      TOKENMAXXING_PROBE: "1",
+      [WRAP_DEPTH_ENV]: String(MAX_WRAP_DEPTH),
+    },
+  });
+  await p.exited;
+  restoreTermios(savedTermios);
+
+  const cleanup = () => rmSync(onboardDir, { recursive: true, force: true });
+
+  const auth = readCodexAuthAt({ path: join(onboardDir, "auth.json") });
+  if (p.exitCode !== 0 || !auth) {
+    console.error(c.red("no codex login landed in the isolated home - nothing added."));
+    cleanup();
+    return 1;
+  }
+
+  const identity = codexIdentityOf({ auth });
+  console.log(c.dim("sampling usage..."));
+  let usage: CodexUsage | null = null;
+  try {
+    usage = await fetchCodexUsage({ auth });
+  } catch (e) {
+    if (!(e instanceof CodexUsageReadError)) throw e;
+    console.log(c.yellow("could not sample usage now - it will fill in on first use."));
+  }
+
+  const credFile = codexCredItemFor(identity.accountId);
+  writeParkedCodexAuth({ credFile, auth });
+
+  const { account, poolSize } = await withLock(codexPaths.lockFile, () => {
+    const index = loadCodexAccounts();
+    const existing = index.accounts.find((entry) => entry.accountId === identity.accountId);
+    const fresh: CodexAccount = {
+      accountId: identity.accountId,
+      email: usage?.email ?? identity.email,
+      label: existing?.label ?? usage?.email ?? identity.email ?? identity.accountId.slice(0, 8),
+      planType: usage?.planType ?? identity.planType,
+      credFile,
+      addedAt: existing?.addedAt ?? new Date().toISOString(),
+      needsReauth: false,
+      lastUsage: usage ? { aggregate: usage.aggregate, perLimit: usage.perLimit } : existing?.lastUsage,
+      lastUsageAt: usage ? Date.now() : existing?.lastUsageAt,
+    };
+    if (existing) Object.assign(existing, fresh);
+    else index.accounts.push(fresh);
+    saveCodexAccounts({ index });
+    return { account: fresh, poolSize: index.accounts.length };
+  });
+
+  cleanup();
+
+  console.log();
+  console.log(`${c.green("✓")} added codex account ${c.bold(account.label)} (${account.planType ?? "?"}) - codex pool now has ${count({ n: poolSize, noun: "account" })}`);
+  return 0;
+}

package/src/cli/codexinit.ts

@@ -0,0 +1,104 @@
+// `tokenmaxxing init --codex` - bring the codex side up: verify + pin the real
+// codex binary, import the existing live login as codex account #1, install
+// the on-PATH codex supervisor shim and the Stop hook declaration, and tell
+// the user about the one step tokenmaxxing cannot do for them: codex skips
+// hooks it has not been TRUSTED to run (trust is recorded against the hook's
+// hash via /hooks in the codex TUI), so auto-switching stays inert until then.
+
+import { existsSync, readFileSync } from "node:fs";
+import { resolveRealCodex, verifyRealCodex } from "../lib/codexbin.ts";
+import { codexIdentityOf, readLiveCodexAuth, writeParkedCodexAuth } from "../lib/codexauth.ts";
+import { CodexUsageReadError, fetchCodexUsage } from "../lib/codexusage.ts";
+import { loadCodexAccounts, saveCodexAccounts } from "../lib/codexstate.ts";
+import { loadConfig, saveConfig } from "../lib/state.ts";
+import { installCodexSupervisor, codexSupervisorLink, ensurePathInRc, shellRcPath } from "../lib/install.ts";
+import { withLock } from "../lib/lock.ts";
+import { codexCredItemFor, codexPaths } from "../lib/paths.ts";
+import type { CodexAccount, CodexUsage } from "../lib/types.ts";
+import { c } from "./render.ts";
+
+/** Fail fast when config.toml pins the credential store away from the plain
+ *  file tokenmaxxing swaps (structural line scan: the repo ships no TOML
+ *  parser, and this single key is the only one we ever inspect). */
+function keyringStoreConfigured(): boolean {
+  const configToml = `${codexPaths.home}/config.toml`;
+  if (!existsSync(configToml)) return false;
+  for (const rawLine of readFileSync(configToml, "utf8").split("\n")) {
+    const line = rawLine.trim();
+    if (!line.startsWith("cli_auth_credentials_store_mode")) continue;
+    return line.includes("keyring");
+  }
+  return false;
+}
+
+export async function cmdCodexInit(): Promise<number> {
+  const real = resolveRealCodex();
+  const fail = verifyRealCodex({ bin: real });
+  if (fail !== null) {
+    console.error(c.red(`codex binary failed verification: ${real}: ${fail}`));
+    return 1;
+  }
+  const cfg = loadConfig();
+  cfg.codexBin = real;
+  saveConfig(cfg);
+
+  if (keyringStoreConfigured()) {
+    console.error(c.red("codex config.toml pins cli_auth_credentials_store_mode to keyring - tokenmaxxing swaps the plain auth.json file."));
+    console.error(c.dim('recovery: set cli_auth_credentials_store_mode = "file" in ~/.codex/config.toml, run `codex login`, then re-run this.'));
+    return 1;
+  }
+
+  const live = readLiveCodexAuth();
+  if (!live) {
+    console.error(c.red(`no codex login found at ${codexPaths.authJson} - run \`codex login\` first, then re-run this.`));
+    return 1;
+  }
+  const identity = codexIdentityOf({ auth: live });
+
+  console.log(c.dim("sampling usage..."));
+  let usage: CodexUsage | null = null;
+  try {
+    usage = await fetchCodexUsage({ auth: live });
+  } catch (e) {
+    if (!(e instanceof CodexUsageReadError)) throw e;
+    console.log(c.yellow("could not sample usage now - it will fill in on first use."));
+  }
+
+  const credFile = codexCredItemFor(identity.accountId);
+  writeParkedCodexAuth({ credFile, auth: live });
+
+  const account = await withLock(codexPaths.lockFile, () => {
+    const index = loadCodexAccounts();
+    const existing = index.accounts.find((entry) => entry.accountId === identity.accountId);
+    const fresh: CodexAccount = {
+      accountId: identity.accountId,
+      email: usage?.email ?? identity.email,
+      label: existing?.label ?? usage?.email ?? identity.email ?? identity.accountId.slice(0, 8),
+      planType: usage?.planType ?? identity.planType,
+      credFile,
+      addedAt: existing?.addedAt ?? new Date().toISOString(),
+      needsReauth: false,
+      lastUsage: usage ? { aggregate: usage.aggregate, perLimit: usage.perLimit } : existing?.lastUsage,
+      lastUsageAt: usage ? Date.now() : existing?.lastUsageAt,
+    };
+    if (existing) Object.assign(existing, fresh);
+    else index.accounts.push(fresh);
+    index.activeAccountId = identity.accountId;
+    saveCodexAccounts({ index });
+    return fresh;
+  });
+
+  installCodexSupervisor();
+  const rc = shellRcPath();
+  if (rc) ensurePathInRc(rc);
+
+  console.log();
+  console.log(`${c.green("✓")} imported codex account ${c.bold(account.label)} (${account.planType ?? "?"})`);
+  console.log(`${c.green("✓")} codex supervisor installed at ${codexSupervisorLink()}`);
+  console.log(`${c.green("✓")} Stop hook declared in ${codexPaths.hooksJson}`);
+  console.log();
+  console.log(c.bold(c.yellow("one manual step: codex skips untrusted hooks.")));
+  console.log(c.yellow("open codex, run /hooks, and trust the tokenmaxxing Stop hook - auto-switching is inert until then."));
+  console.log(c.dim("then add more accounts with `tokenmaxxing add --codex`."));
+  return 0;
+}

package/src/cli/codexswitch.ts

@@ -0,0 +1,80 @@
+// `tokenmaxxing switch --codex [sel]`. Bare form is GREEDY and IDEMPOTENT off
+// cached windows, exactly like the claude switch: rank every codex account
+// (current included) by pace pressure among those under their screening bars;
+// when the current account already wins, do nothing. The current account is
+// the LIVE auth.json's own identity, never the stored label. The swap takes
+// effect for the NEXT codex start: a running codex refuses a different
+// account's credential (restart is the switch; the Stop hook + supervisor
+// automate that for supervised sessions).
+
+import { withLock } from "../lib/lock.ts";
+import { codexPaths } from "../lib/paths.ts";
+import { loadConfig } from "../lib/state.ts";
+import { loadCodexAccounts } from "../lib/codexstate.ts";
+import { codexCurrentWins, pickBestCodex } from "../lib/codexpick.ts";
+import { performCodexSwap } from "../lib/codexswap.ts";
+import { CodexInvalidGrantError } from "../lib/codexoauth.ts";
+import { liveCodexAccountId } from "../lib/codexsample.ts";
+import { presentCodexAccountIds, targetableCodexAccounts } from "../lib/codexpresence.ts";
+import { effectiveBars } from "../lib/picker.ts";
+import { c } from "./render.ts";
+
+export async function cmdCodexSwitch(sel?: string): Promise<number> {
+  const cfg = loadConfig();
+  const bars = effectiveBars(cfg);
+  const now = Date.now();
+
+  return withLock(codexPaths.lockFile, async () => {
+    const index = loadCodexAccounts();
+    if (index.accounts.length === 0) {
+      console.log(c.dim("no codex accounts yet - run `tokenmaxxing init --codex`"));
+      return 1;
+    }
+    const currentId = liveCodexAccountId();
+
+    if (sel !== undefined) {
+      const target = index.accounts.find(
+        (account) => account.label === sel || account.email === sel || account.accountId.startsWith(sel),
+      );
+      if (!target) {
+        console.error(c.red(`no codex account matches "${sel}"`));
+        for (const account of index.accounts) console.error(c.dim(`  ${account.label} (${account.accountId.slice(0, 8)})`));
+        return 1;
+      }
+      if (target.accountId === currentId) {
+        console.log(`already on ${c.bold(target.label)}`);
+        return 0;
+      }
+      if (presentCodexAccountIds().has(target.accountId)) {
+        console.error(c.red(`${target.label} is running in a live codex session - swapping onto it would break that session's credential`));
+        return 1;
+      }
+      await performCodexSwap({ target });
+      console.log(`${c.green("✓")} switched codex to ${c.bold(target.label)} (takes effect on the next codex start)`);
+      return 0;
+    }
+
+    while (true) {
+      const current = loadCodexAccounts();
+      const candidates = targetableCodexAccounts({ accounts: current.accounts, activeAccountId: currentId });
+      const active = candidates.find((account) => account.accountId === currentId) ?? null;
+      if (codexCurrentWins({ active, accounts: candidates, thresholds: bars, now })) {
+        console.log(`already on the best codex account: ${c.bold(active?.label ?? "?")}`);
+        return 0;
+      }
+      const best = pickBestCodex({ accounts: candidates, thresholds: bars, now, currentAccountId: currentId });
+      if (!best) {
+        console.log(c.yellow("no usable codex switch target (all at their bars, unmeasured, or needing reauth)"));
+        return 1;
+      }
+      try {
+        await performCodexSwap({ target: best });
+      } catch (e) {
+        if (e instanceof CodexInvalidGrantError) continue;
+        throw e;
+      }
+      console.log(`${c.green("✓")} switched codex to ${c.bold(best.label)} (takes effect on the next codex start)`);
+      return 0;
+    }
+  });
+}

package/src/cli/doctor.ts

@@ -52,7 +52,7 @@ export async function cmdDoctor(): Promise<number> {
     try {
       const org = await blobOrg(live);
       if (org) check(org.organization_uuid === active.organizationUuid, `live credential identity matches active (${active.email})`, `token belongs to ${org.organization_name} - run \`tokenmaxxing switch\``);
-      else console.log(c.dim(`  · live credential identity unverifiable (access token expired)`));
+      else console.log(c.dim(`  - live credential identity unverifiable (access token expired)`));
     } catch (e) {
       check(false, `live credential identity matches active (${active.email})`, String((e as Error).message ?? e).slice(0, 100));
     }
@@ -65,7 +65,7 @@ export async function cmdDoctor(): Promise<number> {
       try {
         const org = await blobOrg(parked);
         if (org) check(org.organization_uuid === a.organizationUuid, `parked credential identity matches ${a.email}`, `token belongs to ${org.organization_name} - re-auth with \`tokenmaxxing add\``);
-        else console.log(c.dim(`  · ${a.email} identity unverifiable (access token expired)`));
+        else console.log(c.dim(`  - ${a.email} identity unverifiable (access token expired)`));
       } catch (e) {
         check(false, `parked credential identity matches ${a.email}`, String((e as Error).message ?? e).slice(0, 100));
       }

package/src/cli/ls.ts

@@ -1,13 +1,14 @@
-// `tokenmaxxing ls` - compact list of pooled accounts.
+// `tokenmaxxing ls` - compact list of pooled accounts, claude then codex.
 
 import { loadAccounts } from "../lib/state.ts";
+import { loadCodexAccounts } from "../lib/codexstate.ts";
+import { liveCodexAccountId } from "../lib/codexsample.ts";
 import { c } from "./render.ts";
 
 export function cmdLs(): number {
   const idx = loadAccounts();
   if (idx.accounts.length === 0) {
     console.log(c.dim("no accounts yet - run `tokenmaxxing init` then `tokenmaxxing add`"));
-    return 0;
   }
   for (const a of idx.accounts) {
     const active = a.accountUuid === idx.activeAccountUuid;
@@ -18,7 +19,24 @@ export function cmdLs(): number {
     const tag = flags.length ? ` ${flags.join(" ")}` : "";
     const label = a.label || a.email;
     console.log(`${marker} ${c.bold(label)}${tag}`);
-    console.log(`  ${c.dim(`org ${a.organizationUuid.slice(0, 8)} · ${a.subscriptionType ?? "?"} · uuid ${a.accountUuid.slice(0, 8)}`)}`);
+    console.log(`  ${c.dim(`org ${a.organizationUuid.slice(0, 8)}, ${a.subscriptionType ?? "?"}, uuid ${a.accountUuid.slice(0, 8)}`)}`);
+  }
+
+  const codex = loadCodexAccounts();
+  if (codex.accounts.length > 0) {
+    const liveId = liveCodexAccountId();
+    console.log();
+    console.log(c.dim("codex"));
+    for (const account of codex.accounts) {
+      const active = account.accountId === liveId;
+      const marker = active ? c.green("●") : c.dim("○");
+      const flags: string[] = [];
+      if (active) flags.push(c.green("active"));
+      if (account.needsReauth) flags.push(c.red("needs-reauth"));
+      const tag = flags.length ? ` ${flags.join(" ")}` : "";
+      console.log(`${marker} ${c.bold(account.label)}${tag}`);
+      console.log(`  ${c.dim(`${account.planType ?? "?"}, id ${account.accountId.slice(0, 8)}`)}`);
+    }
   }
   return 0;
 }

package/src/cli/render.ts

@@ -18,6 +18,11 @@ export function makeColors(enabled: boolean) {
 
 export const c = makeColors(!process.env.NO_COLOR && !!process.stdout.isTTY);
 
+/** "1 account" / "3 accounts": counted nouns always pluralize properly. */
+export function count(input: { n: number; noun: string }): string {
+  return `${input.n} ${input.noun}${input.n === 1 ? "" : "s"}`;
+}
+
 /** A fixed-width usage bar, colored by fill. */
 export function bar(pct: number, width = 16): string {
   const clamped = clamp(pct, 0, 100);

package/src/cli/status.ts

@@ -16,11 +16,15 @@ import { loadAccounts, loadConfig, loadUsage, loadModelUsage, saveAccounts } fro
 import { readOAuthAccount } from "../lib/claudejson.ts";
 import { probeActiveUsage, probeParkedUsage, type SampleOutcome } from "../lib/sample.ts";
 import { withLock } from "../lib/lock.ts";
-import { paths } from "../lib/paths.ts";
+import { codexPaths, paths } from "../lib/paths.ts";
 import { effectiveBars, isExhausted, nextWeeklyReset } from "../lib/picker.ts";
-import { bar, c, fmtAgo, fmtReset } from "./render.ts";
+import { loadCodexAccounts, saveCodexAccounts } from "../lib/codexstate.ts";
+import { liveCodexAccountId, sampleCodexAccount, type CodexSampleOutcome } from "../lib/codexsample.ts";
+import { isCodexExhausted } from "../lib/codexpick.ts";
+import { isSessionWindow } from "../lib/codexusage.ts";
+import { bar, c, count, fmtAgo, fmtReset } from "./render.ts";
 import type { FullUsage } from "../lib/usage.ts";
-import type { UsageWindow } from "../lib/types.ts";
+import type { Config, CodexWindow, UsageWindow } from "../lib/types.ts";
 
 /** `preRender` runs after sampling, right before the first output line: `watch`
  *  keeps the previous frame on screen through the multi-second sample and
@@ -93,7 +97,7 @@ export async function cmdStatus(force = false, preRender?: () => void): Promise<
   });
 
   preRender?.();
-  console.log(c.dim(`threshold 5h ${cfg.thresholds.session}% · week ${cfg.thresholds.weekly}%  ·  ${idx.accounts.length} account(s)`));
+  console.log(c.dim(`thresholds 5h ${cfg.thresholds.session}% weekly ${cfg.thresholds.weekly}%  (${count({ n: idx.accounts.length, noun: "claude account" })})`));
   console.log();
 
   // A window whose cached reset has passed is empty again; weekly windows recur
@@ -129,7 +133,7 @@ export async function cmdStatus(force = false, preRender?: () => void): Promise<
     }
     if (perModel) for (const [name, w] of Object.entries(perModel)) row(name, w, true);
     if (failed && outcome && !outcome.ok) {
-      const cached = aggregate || perModel ? `cached${a.lastUsageAt != null ? ` ${fmtAgo(a.lastUsageAt, now)}` : ""} · ` : "";
+      const cached = aggregate || perModel ? `cached${a.lastUsageAt != null ? ` ${fmtAgo(a.lastUsageAt, now)}` : ""}, ` : "";
       console.log(`    ${c.yellow(`${cached}live sample failed`)}: ${c.dim(outcome.reason)}`);
     }
     if (outcome?.pingError != null) {
@@ -144,5 +148,71 @@ export async function cmdStatus(force = false, preRender?: () => void): Promise<
     }
     console.log();
   }
+
+  await renderCodexSection({ cfg, now, row });
   return 0;
 }
+
+/** The codex pool, appended when it is non-empty. Every account samples via
+ *  the free usage GET (nothing metered, no window started): the live account
+ *  through the live auth.json, parked accounts through their parked blobs. */
+async function renderCodexSection(input: {
+  cfg: Config;
+  now: number;
+  row: (name: string, w: UsageWindow, weekly: boolean) => void;
+}): Promise<void> {
+  const { cfg, now, row } = input;
+  let index = loadCodexAccounts();
+  if (index.accounts.length === 0) return;
+
+  console.error(c.dim("sampling codex usage..."));
+  const outcomes = new Map<string, CodexSampleOutcome>();
+  let liveId: string | null = null;
+  await withLock(codexPaths.lockFile, async () => {
+    index = loadCodexAccounts();
+    liveId = liveCodexAccountId();
+    await Promise.all(
+      index.accounts.map(async (account) => {
+        const outcome = await sampleCodexAccount({ account, liveAccountId: liveId, now });
+        outcomes.set(account.accountId, outcome);
+        if (outcome.ok) {
+          account.lastUsage = { aggregate: outcome.usage.aggregate, perLimit: outcome.usage.perLimit };
+          account.lastUsageAt = Date.now();
+          if (outcome.usage.email != null) account.email = outcome.usage.email;
+          if (outcome.usage.planType != null) account.planType = outcome.usage.planType;
+        } else if (outcome.deadGrant) {
+          account.needsReauth = true;
+        }
+      }),
+    );
+    saveCodexAccounts({ index });
+  });
+
+  console.log(c.dim(`codex  (${count({ n: index.accounts.length, noun: "account" })})`));
+  console.log();
+  const windowLabel = (window: CodexWindow) =>
+    isSessionWindow({ window }) ? `${Math.round((window.windowSeconds ?? 0) / 3600)}h` : "week";
+  for (const account of index.accounts) {
+    const active = account.accountId === liveId;
+    const marker = active ? c.green("●") : c.dim("○");
+    const badges: string[] = [];
+    if (active) badges.push(c.green("active"));
+    if (account.needsReauth) badges.push(c.red("needs-reauth"));
+    if (isCodexExhausted({ account, thresholds: effectiveBars(cfg), now })) badges.push(c.yellow("exhausted"));
+    console.log(`${marker} ${c.bold(account.label)} ${account.planType ? c.dim(account.planType) : ""} ${badges.join(" ")}`);
+
+    const usage = account.lastUsage;
+    if (usage) {
+      for (const window of usage.aggregate) row(windowLabel(window), window, !isSessionWindow({ window }));
+      for (const [name, windows] of Object.entries(usage.perLimit)) {
+        for (const window of windows) row(name, window, !isSessionWindow({ window }));
+      }
+    }
+    const outcome = outcomes.get(account.accountId);
+    if (outcome && !outcome.ok) {
+      const cached = usage ? `cached${account.lastUsageAt != null ? ` ${fmtAgo(account.lastUsageAt, now)}` : ""}, ` : "";
+      console.log(`    ${c.yellow(`${cached}live sample failed`)}: ${c.dim(outcome.reason)}`);
+    }
+    console.log();
+  }
+}

package/src/cli/watch.ts

@@ -4,7 +4,7 @@
 // 5h session windows, so watching must stay free; each refresh costs only the
 // parked accounts' `/usage` probes the one-shot status already does.
 
-import { delay } from "es-toolkit";
+import { clamp, delay } from "es-toolkit";
 import { loadAccounts } from "../lib/state.ts";
 import { cmdStatus } from "./status.ts";
 import { c } from "./render.ts";
@@ -22,7 +22,7 @@ export function resolveWatchInterval(arg?: string): number | null {
   if (arg === undefined) return DEFAULT_INTERVAL_S;
   const n = Number(arg);
   if (!Number.isFinite(n) || n <= 0) return null;
-  return Math.min(Math.max(n, MIN_INTERVAL_S), MAX_INTERVAL_S);
+  return clamp(n, MIN_INTERVAL_S, MAX_INTERVAL_S);
 }
 
 /** Home + clear screen + clear scrollback. Written only once the fresh frame is
@@ -40,7 +40,7 @@ export async function cmdWatch(intervalArg?: string): Promise<number> {
 
   const paintHeader = () => {
     process.stdout.write(process.stdout.isTTY ? CLEAR : "\n");
-    console.log(c.dim(`watch · every ${intervalS}s · ${new Date().toLocaleTimeString()} · ctrl-c to quit`));
+    console.log(c.dim(`watch: every ${intervalS}s, ${new Date().toLocaleTimeString()}, ctrl-c to quit`));
   };
   while (true) {
     // One failed tick (a mid-write ~/.claude.json read, a transient probe or
@@ -50,7 +50,7 @@ export async function cmdWatch(intervalArg?: string): Promise<number> {
       await cmdStatus(false, paintHeader);
     } catch (e) {
       paintHeader();
-      console.error(c.red(`status failed this tick: ${String((e as Error).message ?? e)}`));
+      console.error(c.red(`status failed this tick: ${e instanceof Error ? e.message : String(e)}`));
     }
     await delay(intervalS * 1000);
   }

package/src/entries/codexstophook.ts

@@ -0,0 +1,67 @@
+// Codex Stop hook (installed in ~/.codex/hooks.json by `init --codex`). Fires
+// when codex finishes a turn: the transcript is committed and the process is
+// idle, the one boundary where killing it loses nothing. If the decision swaps
+// accounts and this session runs under the codex supervisor, drop a respawn
+// marker keyed by the supervisor's id; the supervisor SIGTERMs codex and
+// relaunches `codex resume <session-id>` on the new account (a running codex
+// never adopts a different account's credential: restart IS the switch).
+//
+// Contract with codex (verified against the 0.144.4 binary + hooks reference):
+// stdin carries session_id, stdout `{}` on exit 0 is the documented no-op, and
+// a hook failure must never block the stop - errors are logged, not thrown.
+
+import { join } from "node:path";
+import { mkdirSync } from "node:fs";
+import { z } from "zod";
+import { codexPaths } from "../lib/paths.ts";
+import { writeFileAtomic } from "../lib/atomic.ts";
+import { evaluateAndMaybeSwapCodex } from "../lib/codexdecide.ts";
+import { CODEX_SUPERVISOR_ID_ENV } from "./codexsupervisor.ts";
+import { CodexRespawnMarkerSchema, CodexStopStdinSchema } from "../lib/types.ts";
+import { log } from "../lib/log.ts";
+
+const SupervisorIdSchema = z.string().min(1).optional().catch(undefined);
+
+async function readStdin(): Promise<string> {
+  const chunks: Uint8Array[] = [];
+  for await (const chunk of Bun.stdin.stream()) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+/** The testable core: decide, and on a swap under a supervisor, drop the
+ *  respawn marker. Never throws (a hook failure must not block the stop). */
+export async function handleCodexStop(input: { rawStdin: string }): Promise<void> {
+  const parsed = CodexStopStdinSchema.safeParse((() => {
+    try {
+      return JSON.parse(input.rawStdin);
+    } catch {
+      return {};
+    }
+  })());
+  const sessionId = parsed.success ? (parsed.data.session_id ?? null) : null;
+
+  try {
+    const decision = await evaluateAndMaybeSwapCodex({});
+    const supervisorId = SupervisorIdSchema.parse(process.env[CODEX_SUPERVISOR_ID_ENV]);
+    if (decision.swapped && decision.account && supervisorId) {
+      mkdirSync(codexPaths.respawnDir, { recursive: true });
+      const payload = CodexRespawnMarkerSchema.parse({
+        account: decision.account.label,
+        sessionId,
+        ts: Date.now(),
+      });
+      writeFileAtomic(join(codexPaths.respawnDir, supervisorId), JSON.stringify(payload));
+      log("codexstop.marker", { supervisorId: supervisorId.slice(0, 8) });
+    }
+  } catch (e) {
+    log("codexstop.error", { err: e instanceof Error ? e.message : String(e) });
+  }
+}
+
+export async function runCodexStopHook(): Promise<number> {
+  if (!process.env.TOKENMAXXING_PROBE) {
+    await handleCodexStop({ rawStdin: await readStdin() });
+  }
+  process.stdout.write("{}"); // documented no-op hook output; never block the stop
+  return 0;
+}